Bing, you are correct, the hazard/risk remains but you can reduce the probability of it occurring, passing it up the line to the next DH level does not eliminate the risk either. You are also correct that the HSE is not the military regulatory body, but the MAA constantly make reference to their 'Reducing Risks' documentation. The risk boundaries set in RA1210 are lifted from the HSE documentation. The MAA and Duty Holders can not 'cherry-pick' in order to get the answer they want.

The following is an extract from the MoD Helicopter Safety Enhancement Programme, dated Sept 2013;

"Operating Risks are owned and managed by the Duty Holder who is personally and legally responsible for ensuring that the Risk to Life (RtL) emanating from activities associated with their generation and sustainment of force elements is at least Tolerable and As Low As Reasonably Practicable (ALARP). If an identified Risk to Life (RtL) is not demonstrably at least Tolerable or ALARP then those activities should not continue". (Please note it says 'is', not can be, or will be at some time in the future)

RA 1210 makes it clear that Duty Holders are legally accountable for safe operations and are expected to defend the validity of their ALARP safety statement in a court of law in the event of an accident. That has never happened.

DV

I suspect that there are people in the MAA/MoD who would have had the Concorde fleet back in the air, a few weeks after the Paris crash, simply because there was a repair scheme in the pipeline.

DV

That's the bit I asked the HSE about, their response was that it was nothing to do with them. They have incidentally been removed from the latest version of RA1210 not that that has any bearing on this accident.

Well no, they hit a tethered ballon which wouldn't have been detected even if they had had a TAS system fitted as they don't, to my knowledge, have a transponder. It's also not classified as a Mid-Air Collision as collisions with objects on or connected to the ground aren't included in that risk. It actually falls under CFIT.

Bing, I was referring to the general risk and mitigation, which is the theme of DV's posts on this subject. The original mitigation for avoiding collision with, or controlled flight into, a cable, didn't need a transponder. I've posted before that the technology was ready, but system integration was not, so the decision was correct at the time. But over 30 years have passed, the kit was ready shortly thereafter, so there was no reason not to revisit. Instead, the general risk was allowed to drift on, based on a decision that was no longer valid.

Thanks for the CFIT clarification. If I ever knew that, I'd forgotten!

The issue may then be that no one in a position to do anything about it is aware that the kit exists.

Bing, that's what the continuous assessment obligation is for. But, yes, MoD's corporate knowledge has long since gone and decamped to pprune.

I had noticed that, so DHs have no idea where the boundaries sit? The latest definition of tolerable, lifted from a general statement in the HSE R2P2 document, states "a willingness by society as a whole to live with a risk so as to secure certain benefits and in the confidence that the risk is one that is worth taking and that it is being properly controlled". How does a Duty Holder know what society as a whole is thinking. This is something that needs to be agreed in court in order to be legal.

The TAS would have alerted the pilot of the doomed Puma as to the location of the other craft, and improved his situation awareness. As I stated in my earlier post the fixation was with locating the second Puma not the football pitch, which had been overshot may times, and therefore not a big issue. I note that you talk about TAS, what happened to the original fit of TCAS, as installed in the Bond Super Puma?

You are correct to point out that this was a CFIT, but I can find no reference to that in the SI report (but could be wrong). Having said that I should point out that the MAA Bowtie for CFIT indicates wire-cutters as one of the recovery controls. Whether they would have been effective or not with a banking helicopter we will never know. However, this recovery control was not fitted.

DV

They probably have a better idea than they did before.
Under the old scheme you had to consider deaths per thousand of the population at risk per year. Which you averaged over a five year period. This works fine for any large industry with many thousands of people involved. However for your typical military aircraft the population at risk is normally in the low hundreds, if you're lucky. This meant any accident that caused death of a first party made the airframe intolerable for the next five years as you'd have to multiply the small population and the fatalities by whatever factor was required to reach 1000.
At the same time a logical reading of the 3rd party tolerability boundary, 1 death per million of the population at risk per year, meant you could happily kill 60 civilians a year and remain tolerable.
So as guidance it was notably unhelpful. Ultimately I'd suggest DHs consider any deaths intolerable in the current climate and are working to remove the risk as well as they can with the levers available to them.

I'd agree with that but I don't know that that would definitely have prevented the accident if the crew had been heads in looking at the TAS they may not have seen the balloon at all.

I don't know that TCAS was ever considered. For aircraft that spend a lot of time at low level it doesn't really give you anything extra as the RAs are suppressed below a certain height.

They would not have worked in this situation as at no time did the cable cross part of the airframe where they would have been located, ie the nose. The rotor took the cable to the tailboom avoiding the fuselage completely. What I found interesting is that other helicopters have hit balloon tethers with the rotor disc and not suffered any notable damage.

I'm not sure TCAS would have been much use in this scenario; my experience of using it in formation at low level is that it just warns you continuously that your play mate is there, so gets turned off by the number 2. Even if it was fitted and on, I'm not sure it would have provided the fidelity in sufficient time to prevent this accident.

Not sure how DHs will have a better idea without guidelines as to what is tolerable. As I said before what is quoted in Issue 4 of RA 1210 is just a general statement lifted from HSE (R2P2). Also, not sure where the five year average came from as there is no mention of it in the HSE documentation. I suspect it is (was) a fudge in order to make the boundary data fit the needs of the day.

Your statement also exposes another flaw in the risk to life process, namely it can only be regarded as a risk to life if a death has already occurred; it is reactive rather than proactive. Risk assessment must be about determining the potential of gaining or losing something of value. In his comments to the the Tornado SI Air Marshal Garwood said, "bad luck has to be part of the explanation.......a few few feet difference in altitude of one aircraft would have created a near miss rather than this tragic accident". So would this near miss have been regard as a risk to life, or not. For me the risk to life occurred before the collision event, not after it. In my book every Class A/B near miss, confirmed by the AIRPROX body, is a risk to life (not machine)

The following is an extract from the MoD Helicopter Safety Enhancement Programme, dated Sept 2013,

"The UK MOD is actively considering installing systems on the majority of the helicopter fleet. For most types the decision in the short term is to fit a non-integrated system, most likely to be a TAS type unit. For the larger platforms (Chinook, Merlin and Puma) the fitment of fully integrated TCAS II systems is being considered."

We can continue to debate what the outcomes could have been with and without certain items of equipment, but the facts remain the same,

(1) The risks of collision and wire strike were the No.1 and No.2 Air Safety risk according to the Cdr JHC (ODH).
(2) The risks, at the time of the accident, were neither tolerable nor ALARP.
(3) The ODH had signed off to say they were.

According to RA1210, by reference,”The Health and Safety Executive is responsible for making adequate arrangements for enforcement. In fulfilment of its duty the Executive provides guidance to its regulatory staff who have to judge whether measures put in place or proposed, by those who are under a duty to control and reduce risks "as low as is reasonably practicable" (ALARP), are acceptable.
The principles and guidelines set out [in HSE documentation]are based on what the courts have decided is required of duty-holders, and are intended to help HSE regulatory staff reach decisions about the control of risks and make clear what they should expect from duty-holders. Ultimately, it is for the courts to decide whether or not duty-holders have complied with the law.”

The final paragraph is very important and is the reason why it is covered in MAA RA1210. So far the MAA/MoD have avoided having the regulation tested in court.

DV

Ahh, you have reminded me of another quirk with the previous edition of RA1210. It had Tolerable as defined by the unhelpful deaths per 1000 population at risk per year and Tolerable in the sense of accepting the level of risk of doing something for the operational benefit doing it brings. E.g. it's tolerable to practice IMC flying by having one of the pilots external vision obscured as you gain the benefit of being able to fly on instruments in actual IMC. The DHs still understand what is tolerable in that sense, what they don't have to do is produce some dubious maths to meet an arbitrary limit that doesn't really tell you anything.

Not so, and if that's the impression I gave then I apologise, there are plenty of risks to life that haven't caused a death. Additionally the MAA Hazard Risk Matrix includes minor and major injury so you can have risk to life that you don't think will ever cause a death.

In that case I'd assume the additional features of TCAS II weren't considered advantages for a support helicopter as they typically operate below the level where RAs are suppressed. But that's supposition on my part.

You'd need to look at the detail behind the headline titles to determine what that meant though. I.e. Wire Strike was likely to be concerned with horizontally strung power and telephone lines. MAC was probably concerned with hitting other aircraft in flight. The actual risk experienced fell under CFIT, and without knowing what the detail behind that was you can't jump to your next point.

That's not a fact, that's your opinion until it's tested in court. Just because an accident happens doesn't mean the risk wasn't ALARP, it's As Low As Reasonable Practicable, not As Low As Possible.

MoD likes to say this, knowing very well that the CPS and HSE - and Crown Office in Scotland - run a mile whenever asked to consider prosecution. For example, in the 2011 Red Arrows case (XX177), and despite MoD openly admitting imprisonable offences, both CPS and HSE announced there was no evidence of wrongdoing. After a full confession? This leaves it to the families to re-mortgage properties or take out loans to fund legal assistance. Even then, few engage with expert witnesses who actually understand the issues. On the rare occasions they have, MoD's so called experts have been utterly destroyed in court. (Nimrod XV230 and C130 XV179 are the obvious ones). There's a reason why Star-ranking officers and officials don't appear as witnesses. They'd have to lie, or accuse their subordinates of lying.

MoD also forgets its own teaching. This activity (risk/hazard mitigation) is not presumed safe (innocent) until proven unsafe (guilty). The Safety Management System and its outputs must prove the system or aircraft is safe before Service use; including risks to be ALARP and tolerable. There is a different starting point to the legal process.

The MAA needs to go back to basics; air safety within the MoD was not invented by Haddon-Cave. Adequate regulations were in force long before that, they simply weren’t followed. Unfortunately, since his review the MAA has tried to reinvent the wheel and in many areas has come up with a square one. It still turns, but not as good as the previous round one.

Let’s revisit BP 1201 and the guidelines set out there. Where the risk matrix (probability against severity) is used to define whether a risk is intolerable, tolerable or broadly acceptable and not which level of Duty Holder holds the risk. Passing the risk to a higher level does not eliminate or mitigate the risk. On the subject of risk severity, why was it necessary to change the criteria for category levels so that, for example, Remote went from ‘Unlikely to occur during the operational life of a particular fleet’ to ‘Likely to occur one or more times in 10 years’; the latter being more in line with Occasional or Probable under BP 1201? Of course it did allow a Class A risk to become a Class B risk, overnight, and lowered the standards.

Let’s accept that safe means that a risk is broadly acceptable, or tolerable and ALARP, and by ALARP I mean the legal interpretation set out by HSE and not ALARP (temporal). According to the narrative verdict handed out at the Nimrod inquest ALARP is a current requirement, not a future one. That is why Andrew Walker called for the grounding of the Nimrod fleet, because the fuel system was not ALARP.

Having legally accountable Duty Holders, is a good outcome from H-C, but they need tighter guidelines to work with; remember most of them have only done the 2 day course. As it stands at present I believe that the TOLERABLE and ALARP standard set out by the MAA is so subjective that Duty Holders choose to state whether it is or isn't depending on how they feel. As yet not one of them has been held accountable after three major accidents.

DV

DV:-
And therein lies the rub. Civilian operators would long ago have had strap hanging passengers, a la train commuters, if they were free to regulate themselves. No doubt it would have been justified by some acronym or other and dressed up with fanciful and dubious statistics. It wouldn't matter much what people thought anyway as they would be their own judge and jury. That is exactly the case with the MOD and its "independent" Regulator the MAA (and its "independent" Investigator the MilAAIB, or whatever it's called this week).

Grounding, or "pausing" fleets (the Hawk T2's now?) is not the answer. The answer to all these airworthiness related fatal air accidents, whether actual or potential, is a truly independent Regulator and Investigator of the operator (the MOD) and of each other. Unless and until that happens avoidable military airworthiness related air accidents will go on happening relentlessly.

Self Regulation Doesn't Work and in Aviation It Kills!

I mentioned Mr Andrew Walker's recommendation simply to illustrate the importance of ALARP. He viewed it as a now requirement, not something that can be put off.

Mr Walker also recommended, "that consideration be given to civil aircraft investigation replacing the Board of Inquiry system for investigating the loss of military aircraft.":ugh:

DV

Indeed DV, it took a 700 year old institution to tell one which has yet to make its first century, "There is something wrong with your bloody aircraft". It has yet to recognise that fact and to take the necessary remedial action.

As tuc continually reminds us, rearranging the deck chairs by rewriting the regs is not the answer. All that is required is to implement the old ones, but that would require admitting why they were scrapped in the first place, and who it was who scrapped them. The RAF can go on protecting the VSOs responsible, or it can move towards regaining its airworthiness. It can't do both.