BOI into the 2012 Tornado Collision over the Moray Firth

[Fox3WheresMyBanana]

It would seem from the detail of the BoI that AOC 1Gp was writing lots of letters trying to get CWS incorporated.
So, is he part of the problem, or just someone else caught in an invidious position on this one?

[Distant Voice]

It would seem from the detail of the BoI that AVM Atha was writing lots of letters trying to get CWS incorporated.

All the more reason for not declaring his Tornadoes Tolerable and ALARP.

DV

[Fox3WheresMyBanana]

What I was driving at was that CAS in his letter to SoS in 2011 said it was not ALARP, so what was going on internally in the RAF? Was AOC 1Gp being "asked" to declare it ALARP whilst the fight went on at higher level to get CWS? Did AOC 1GP and CAS at the time disagree? Since there are numerous other examples of individuals being basically ordered to lie, was that the case? As far as I understand it, the case history seems to indicate an individual is obliged to lie if ordered to do so. Maybe CAS decided 2008 wasn't the right time to pick the 'not ALARP' fight, and 2011 was? Maybe it was because of different CAS/AOC 1 Gp

Hands up everyone who's been asked to lie officially whilst something was fixed behind the scenes? Ah, that will be all of us then.

Edit: Stu Atha was AOC 1GP after 2011 I believe
AOC 1 Gp during the period most in question was
2007–2009 Air Vice-Marshal C N Harper
2009-2011 Air Vice-Marshal G J Bagwell
2011- Air Vice-Marshal S Atha

I was acquainted with Greg Bagwell. Seemed like a straight-up and talented guy. Ditto Stu Atha.

[Easy Street]

If I read the report correctly, AOC 1 Gp had already elevated the risk to the Senior Duty Holder. Having used all the 'levers' available to him to reduce the risk (which, considering the piffling financial delegation a 2* gets these days, are fairly limited), the AOC decided that there was more risk than he could bear, since it was both reasonable and practicable to fund CWS. The AOC couldn't approve funding himself, so he passed it up the chain. At that point, if the SDH says 'keep flying', the AOC keeps flying. It's not his call any more, even if he thinks the risk is excessive. He is perfectly entitled to keep writing letters to the SDH saying 'I really think you should fund CWS', but he is no longer the risk owner, so he doesn't call the shots (or carry the can if there is a subsequent collision).

Once the risk had shot up to SofS, who recognised the steaming turd that had arrived on his desk and ordered that money be found to get rid of it at once, funding was in place. Having a funded project is indeed not the same as having the kit in place and working, but would it now reasonable to ground the Tornado fleet until the CWS was installed? For up to 3 years? I think the answer to that is clearly 'no', with the aircraft on active duty in Afghanistan and with an eye on the potential (at the time) for involvement in the near East. Some risks clearly outweigh the operational prerogative (fuel leaking onto hot pipes perhaps?) but I don't see how CWS could be one of those. If the need for a CWS trumped operational flying, you'd have to squawk mode 3 all the time in hostile airspace - certainly not reasonable.

[Distant Voice]

Stu Atha was AOC 1GP after 2011 I believe

AVM Atha became AOC 1GP in August 2011.

Today, he still seems to think that the risk is Tolerable and Alarp after more Class As and three deaths.

DV

[Easy Street]

There are plenty of other mitigations that could be applied to reduce the risk of fast jet mid-air collision, some of or all of which fail the 'reasonableness' test for various reasons:

• Establish controlled airspace around all military airfields
• Mandate use of Traffic Service as absolute minimum level of service outside controlled airspace
• Limit autonomous military training to Restricted or Danger Areas
• Paint all combat aircraft black
• Extend danger areas around weapons ranges to include all maneouevring airspace, not just the weapon flight airspace
• Apply the 250kt below 10000ft speed limit

and there are probably more. AOC 1 Gp could have demanded any or all of these (well, apart from the first - he probably would have had a fight on his hands). Is he negligent for not doing so? No, none are reasonably practicable. DV, your 'reasonableness' radar is a bit out on this one. A risk event occurring does not change anything in terms of the prescribed treatment, unless the number of occurrences invalidates the probability of occurrence assumed in that treatment. If it was declared ALARP following approval of CWS funding, it's still ALARP after the collision, unless the underpinning maths has changed.


Incidentally, at least one of the 'Cat A Tornado airproxes' being bandied around in the Scottish press was a Tornado minding its own business behind a tanker at night when a Typhoon pilot got horribly disoriented and nearly clapped hands with it. Hardly fair to blame that on the Tornado or its lack of a CWS, I would say (TCAS would have been off in any case).

[Distant Voice]

If it was declared ALARP following approval of CWS funding, it's still ALARP after the collision, unless the underpinning maths has changed.

Yes, but who declared it ALARP and on what basis? Having an ALARP programme does not make a risk ALARP, but merely creates "paper safety at the expense of real safety"; to use H-C's words. Anyway, for ALARP to have any meaning the risk must be at least TOLERABLE, and this risk is not. The AOC 1 Gp and the MAA DG must realise that fact. See my posting #250

The collision risk associated with Tornado GR4 aircraft is neither Tolerable, nor ALARP, and can only be mitigated by following MRP RA 1020.

Cease routine aviation operations if RtL are identified that are not demonstrably at least Tolerable and ALARP.





DV

[thefodfather]

DV, not wanting to split hairs where lives are concerned and not wanting to play numbers games with such a serious question as safety, but, as far as I know the last mid air collision involving a Tornado before this event was in 1990. Therefore, whilst CWS might have prevented this accident it might not prevent the next one. Pro-active safety with finite budgets is about making choices and it how the choices are made that is, for me, the most important thing.

[Wrathmonk]

Will CWS help avoid mid-air collisions with non-CWS aircraft at low level? If memory serves me right upwards of 10 people have been killed in midairs between FJ and civilian aircraft, at low level, in the UK in the past 20 years or so - if 'see and avoid' (i.e. no CWS fitted) is not suitable for routine military operations then surely the same can be said about non-CWS fitted civilian operations. Or are all bug smashers fitted with CWS these days?

[Fox3WheresMyBanana]

I would agree TFF, were they prepared to come out and say that, but that isn't the case. If they said "It's not worth it", they would have to justify risk vs cost.
What the MoD have said is - Not having CWS is not justifiable from a safety standpoint, so we'll bring in CWS......except it's taken them over 18 years to date with no system fitted from a point where it could have taken them 2 years, and they had a working system. This is beyond delays, this is lying, and they should get their balls nailed to the wall for it.
And as DV points out, they are breaking their own rules. Having a safety system and then ignoring it is far worse that having no system at all. It wastes everybody's time at huge expense, gives a false impression of safety, and acts as a block to an effective safety system being introduced.

[Distant Voice]

but, as far as I know the last mid air collision involving a Tornado before this event was in 1990

The previous Tornado collision was with a Cessna in 1999. Having said that collision is not the risk, it a consequence of the risk not being adequately mitigated. In this case installation of CWS. The "Top Event", main risk or incident, is "Airprox". (Obtained from MAA Bowtie data).

A CWS would act as (1) "prevention" againt the Top Event (Airprox) occurring, and (2) "mitigation" in order to reduce the impact of of the Top Event should it happen. In TCAS terms TA and RA.

Not having an accident is no guarentee of safety. Nimrod flew for 30 years with fuel couplings in close proximity to hot air pipes. In this case there was neither prevention nor mitigation.

N.B For the avoidance of doubt Airprox means "Aircraft in close proximity to another aircraft that their safety is, or may be compromised"

DV

[Distant Voice]

The "Top Event", main risk or incident, is "Airprox".

It is noted that in the latest Risk Register for Tornado collision (8th June 2014) the Top Event is no longer ALARP but Societal Concern. An entry in the RR talks about "a very significant and negative societal impact associated towards the RAF and MOD"

So it is now about image not lives.

DV

[salad-dodger]

that's twisting things a bit DV.

From the HSE:

"...the risks or threats from hazards which impact on society and which, if realised, could have adverse repercussions for the institutions responsible for putting in place the provisions and arrangements for protecting people, eg Parliament or the Government of the day. This type of concern is often associated with hazards that give rise to risks which, were they to materialise, could provoke a socio-political response, eg risk of events causing widespread or large scale detriment or the occurrence of multiple fatalities in a single event. Typical examples relate to nuclear power generation, railway travel, or the genetic modification of organisms. Societal concerns due to the occurrence of multiple fatalities in a single event is known as 'societal risk.' Societal risk is therefore a subset of societal concerns."

But then you probably knew that....

S-D

[Easy Street]

Originally Posted by Distant Voice

The "Top Event", main risk or incident, is "Airprox". (Obtained from MAA Bowtie data).

The bowties are used to explore and catalogue the causes of incidents, and to enable probabilistic analysis. So, you have seen the bowtie which explores the causes of airproxes, which has 'airprox' as its Top Event. The analysis resulting from this bowtie would be a component of the predicted occurrence rate for Mid-air Collision, which is the actual risk logged in the Duty Holders' risk registers. Airprox is not, itself, the risk under treatment; it is a proxy from which the potential causes of mid-air collisions can be broken out and then individually treated. Plenty of airproxes result in no degradation of safety whatsoever.

Originally Posted by Distant Voice

The collision risk associated with Tornado GR4 aircraft is neither Tolerable, nor ALARP

On what basis do you say that? The fact that there has been a collision in which 3 people were killed, and X number of Cat A airproxes, does not automatically make the risk intolerable. Your statement is, however, a neat demonstration of societal risk. I haven't seen the latest numbers on the mid-air collision risk, but it wouldn't surprise me to find that societal issues helped to push CWS over the funding threshold.

[Distant Voice]

Easy Street

Bowties are used to list the triggers, or threats that may lead to an undesired event (Top Event), and the consequences if the Top Event occurs. They also display the preventive measures in place in order to avoid the Top Event and the mitigations to reduce the impact should the Top Event occur.

The Top Event for the CAA and MAA is the same, "Aircraft in close proximity with another aircraft that their safety is, or may be compromised [Airprox]" That is what we are trying to prevent, because a consequence of that occurrence is a possible collision. TCAS acts as both prevention and mitigation.

You talk about Bowtie being used for probability analysis and predicted occurrences, may I suggest that you use some historical "actuals". Since the MAA started to use Bowtie we have had seven Class A near misses and one collision, so the predictive model does not appear to be working. Focus on preventing the Top Event, then the consequences will not appear.

Why do I believe that the risk is not Tolerable and ALARP? - Simple. The Risk Register shows it to be CATASTROPHIC and REMOTE, which by the H-C and CAA matrix makes it INTOLERABLE. By the way, MAA's definition of REMOTE is highly questionable; many would suggest OCCASIONAL. With regards to ALARP, once again the Risk Register makes it clear. Under the heading "Management and Mitigation Strategies and Controls to Achieve ALARP State" is listed CWS. So if we do not have CWS we do not have ALARP. Besides who in their right mind believes that you can go from not Tolerable and not ALARP in 2011 to being Tolerable and ALARP simply by initiating a programme.

DV

[Easy Street]

It's totally irrelevant what the CAA or H-C matrices show. The Duty Holders are working to MAA regs, like them or not. CATASTROPHIC/REMOTE in the RA1210 matrix is a 'HIGH' risk which can be held by an ODH. The MAA's tolerability table in RA1210 makes reference only to annual probability of death; it's got nothing to do with individual incident outcomes.

As for ALARP, do you seriously consider it 'reasonable' to ground a combat aircraft for lack of a CWS only 2 years after funding was approved? It's almost impossible to get new kit into service any quicker. Perhaps you would like DE&S to cut some corners?

[Distant Voice]

It's totally irrelevant what the CAA or H-C matrices show. The Duty Holders are working to MAA regs, like them or not. CATASTROPHIC/REMOTE in the RA1210 matrix is a 'HIGH' risk which can be held by an ODH. The MAA's tolerability table in RA1210 makes reference only to annual probability of death; it's got nothing to do with individual incident outcomes

What a pity you feel that way about H-C (BP 1201) and the CAA, it seems that the MAA is out of step with acceptable approaches. It is important that when we use common terminology we apply common meaning. The RAF shares, at times, common airspace with the CAA, so when a collision risk is declared Tolerable and ALARP it should mean the same to both organisations. Once again death is not the risk we are mitigating (risk register indicates Mid-Air Collision - MAC), it is the consequence of a collision, which in turn is a consequence of "an aircraft being in close proximity of another aircraft that their safety is or may be compromised". TCAS (or the bespoke system) prevents the latter. An OR (Air) 1998 submission, which MoD hides, specifies the requirement as being "To automatically detect aircraft whose relative position and course pose a risk of mid-air collision and to warn the crew so that avoiding action can be taken". It does not say "To keep the death rate better than 1 in 1000 per year.

As for ALARP, do you seriously consider it 'reasonable' to ground a combat aircraft for lack of a CWS only 2 years after funding was approved? It's almost impossible to get new kit into service any quicker. Perhaps you would like DE&S to cut some corners?

The simple answer to that is "No", but I do expect the MAA and DHs to apply the same restrictions as they were prepared to apply back in 2011, when the risk was declared Not Tolerable, and Not ALARP. And with regards to "cutting corners", well, it has only taken 23 years and it's still not fitted.

May I remind you that the Nimrod force was scapped because fuel couplings and hot air pipes could not be replaced effectively. That was after one fuel fire in 30 years.

DV

[Distant Voice]

Easy Street

Can I draw your attention to page 224 at the link below. It covers a Class C Airprox between a Lossiemouth Tornado and a Airbus A319 in the vicinity of Inverness airport on 20th April 2012. It would appear that TCAS on the Airbus saved the day. I suppose MoD regarded the collision risk Tolerable and Alarp? Not sure what it would have done to the death rate figures had it happened.

http://www.airproxboard.org.uk/docs/423/BOOK%2028.pdf


The DG of the MAA claims that "bad luck" played a part in the Tornado collision over the Moray Firth, if the same bad luck had come into play on this occasion we would have been looking at multiple deaths in the air and on the ground.

DV

[Fox3WheresMyBanana]

The Tornado pulled up through the instrument approach lane to his local airport. This is unwise. The Station Flying Order Book was duly amended, although in the 1980's local routings by adjacent airfields were displayed on maps both in the FOB and in operations. Perhaps this has disappeared as a practice in the age of digital maps and planning?

Given the Tornado/Tornado mid-air was also contributed to by less than adequate range joining procedures, I think Lossie has a bunch of questions to ask itself. Would this be in Sqn Ldr Ops ToRs?

[Sandy Parts]

Fox3 - I'd have thought it would be up to the OC of any flying unit at the Station to ensure any such procedures are followed (and Staneval or similar to provide assurance of such). SLOps would be able to provide the information needed to help establish such procedures, but I wouldn't have thought it was his role to ensure they are followed by the aviators?