If MAA don't approve RivetJoin after we've bought it and its been in service for years with the USAF I doubt the Treasury or No. 10 will ever allow the RAF to buy another aircraft ever again......................

And everyone involved with turning it down will be on the s*** list forever - no promotion, no gongs

I'm sure that thought isn't in their minds at all tho'......... :bored:

The original decision makers involved in this Project have moved on. Many have left.

Those in the decision chain now must be strong and ensure the system is safe. Saving embarrassment and face saving is not an option.

Be interesting to see the reaction if we reject as unsafe a design that the USAF uses.

This all seems like something from a "Yes Prime Minister " sketch. We scrap an excellent platform (R1) because another version of that platform is declared unsafe (MR 2) after spending miliions developing an advanced version (MRA 4).

We then buy an older platform (EC-135) from some one else who is already using it quite happily. But... we can't use the newly purchased platform because of the red tape put in place (quite correctly) after a fatal enquiry into a crash of the original platform concludes that better safety checks should have been in place. Said safety checks are put in place but they now prevent us flying the newly aquired platform.

Where were the checks and balances, project management, forward planning, risk assessment- whatever we want to call it that should have checked to see if we could have been cleared to fly the new platform if we went ahead and purchased it?

If the Red Tops decide to focus on this one they will have a field day, surely.:eek:

There has to be a simple answer, if the spams are flying it and they consider it safe, can someone not have a B**ls to sign it off as safe for RAF crews to fly in, surley with rank comes responsibility, lets say if Chief of the Air Staff flies on the first 5 sorties and declares , there you go boys I'm okay, crack on (yes I know if only it was that simple but aparrently thats what the Indian Air force bosses are doing).:ugh:

So we crack on with the US certification, and there is either an accident, or the mission system makes an error resulting in collateral damage or a blue on blue? The chap(s) who signed off the system is then hounded by ambulance chasing lawyers on behalf of the families and people on this forum write how we should have done things properly. YOU CANNOT HAVE BOTH RISK AND SPEEDY INTO SERVICE NOW THAT CROWN IMMUNITY IS NO LONGER WITH US! That is why we have lost maritime capability and probably why we will lose other capability in the future - especially with the reduction in manpower in the support organisations.

Jim 208

That all works well as long as you then fly the jet through its entire career without a major mishap.

Wensley and Jim,

In all my working life as an engineer, I never once thought about 'ambulance chasing lawyers' when making decisions. However, I thought quite a lot about the safety of those who were flying the aircraft that I had signed off as serviceable. And I can speak for all my engineering colleagues.

As Tuc and many others have tried to get over on this thread - you can get aircraft and new equipment into service safely, effectively and quickly. There is no compromise as long as you do the job properly first time. And honestly, it's not rocket science (except, maybe, for rockets).

But it's a job for engineers, one we do for the aircrew because we damn well care. We know we can't solve 'world peace' every time an aircraft is bought , or modified. We know the kit is needed at the front line. We know when something is acceptably safe and when it isn't. And we work with aircrew to get those decisions right. We do this because we are professionals.

A little while back, I had an interesting conversation with an aircrew VSO, who loudly and aggressively informed me that if he had his way, he would buy the aircraft he wanted direct from the US Armed Force concerned, and fly them in the UK 'under US rules'. He went on to inform me that the 'airworthiness concerns' being voiced by 'engineers who don't fly' were 'an attempt to justify their existence'.

And this was a VSO who was, at the time, a full Duty Holder. Go figure.

You do not, repeat, not, get CAS into an aircraft, get him to pole it around for 5 sorties, and then ask him to say 'there you go boys, I'm okay, crack on'. Look, you really don't.

Some aircrew need to understand this. When they don't they start applying pressure to 'just get the aircraft into service', asserting that 'they can get over the little problems engineers obsess over' (another actual quote from another aircrew officer just a few weeks ago). Then, things suddenly get 'political'. This is happening right now, and it needs to stop.

If (and it's an 'if, I hope I'm wrong), someone decided that we could buy old USAF airframes off the shelf with US kit in them, and didn't do the 'due diligence' required to get them cleared for UK service, then I sincerely hope they stay on the ground until they are fixed so that they are acceptably safe for use.

However, I more sincerely hope that they did do the necessary preparation, and that the aircraft get into service as soon as possible. Our dedicated and professional aircrew deserve nothing less.

Best Regards as ever to all those trying to do the right thing for the right people,

Engines

HH:-
What goes around comes around! The genesis for this debacle dates back to the late 80's and 'is coming to a unit near you soon'. Your comments are well made HH and point to the urgency of making the MAA and the MAAIB independent of the MOD and of each other. High visibilty situations like MRA4 or RJ are simply the tip of this ginormous iceberg. There probably isn't an aircraft or system in service that won't upon investigation prove to be unairworthy, as the SI into the tragic death of Flt Lt Cunningham has shown us.

Reversing the effects of the deliberate and malevolent attack on UK Military Airworthiness by RAF VSOs in the late 80s/ early 90s is going to take decades. Like any such long march it can only be started by taking that first step. That must be by the RAF biting the bullet, admitting what happened, and taking action against the willful suborning of Mandatory Regulations and the issuing of Illegal Orders. That will take leadership...is it there?

Read what Engines said!

Throughout my career I came across very few aircrew who were “anti”. But I well remember the last one who was. He wanted me to cancel a trial of kit his superiors had declared Safety Critical, pack my bags and go back to AbbeyWood. He’s dead, killed by a non-engineer’s decision that functional safety could be ignored and a false declaration made that the work had been satisfactorily carried out. This kit was not fitted or being used correctly in the aircraft he was flying on his last flight. The non-engineers actions were withheld from the BoI and Coroner, and the MoD/MAA continue to support him.



It only takes one like that to get to Star rank and the system is in trouble. He did, and it is....... MoD engineers, Service and Civilian, knew how to get it right first time, and were within a whisker of doing so when this fraud was perpetrated upon us (and aircrew). It is almost always cheaper and quicker to simply implement the regs. Every accident or issue we discuss here has that same common denominator. Avoidable if the regs had been implemented. Yet, still, MoD/MAA rail against anyone who says this. Instead, they re-write the regs, somehow implying they are to blame. And cause so much confusion in the process their own Flight Safety centre doesn't know if they're full bored or countersunk. (Neither, you're being screwed ).

Engines,


Fully agree with your post.. however, ambulance chasing lawyers are certainly a consideration these days. Ask an ex-colleague of mine who spent a long time with the threat of legal action hanging over him because he did what a senior officer ordered him to do. (Thankfully it was all dropped because he kept a good paper trail). There but for the grace of God perhaps?

Wensley,

Yes, I agree that the lawyers are very much more in evidence than they were. I have recent experience of this being used, but not in the way I expected - being told that if my actions delayed a project, the MoD could be sued for 'undue delays'. Note no mention of the MoD running the risk of being sued for taking short cuts with basic airworthiness management.

I agree that things have changed, but the basics of ensuring a safe and effective product for the aircrew haven't, and that's what Tuc keeps pointing out. Neither have the basics of military discipline - if an order's not reasonable, you don't have to obey it. Here's my (not very warry) story.

My first ever front line embarkation. I'm a very junior Lieutenant aircraft engineer. During an ORI, but not at war. Aircraft lands on with blade leading edge strip (old rubber type) severely holed and lifting. I tell the crew to shut down. Senior Pilot angrily tells me to sign the aircraft fit for the next sortie. I refuse. He then gives me a direct order to do as I am told and sign the aircraft as serviceable. I drop the volume, request a word in a quiet space away from the flight deck. I quietly tell him that I'm the engineer, he is the pilot, and I will get the aircraft fixed as fast as possible, and only then will he get the aircraft to fly. If he's unhappy, get another engineer.

Pause.

Senior Pilot asks me if I'm sure I'm right. I say yes. he nods, turns and walks off. Here's the postscript. We had a truly outstanding relationship from that point forward. I would have jumped over the proverbial cliff for him, and I know he'd have done the same for me.

If things have changed, I'm truly sorry for those who have to work in the system. But I suppose what I'm trying to say is that whatever the system, as long as aircrew and engineers behave professionally and honourably, the system can recover. In fact, I think that's the only way things will get better - by people taking responsibility whenever they are required to. Perhaps I'm being naive, but that's where I stand.

Best regards as ever

Engines

Okay, then what is the best and safest solution to the problem? (I was only joking about the CAS and his five trips by the way). After 32 years in the service I know that would never happen).

Is there a clear way out of this mess? If the original Boeing and USAF documentation is not avaialable from the 60's, where do the MOD safety people start?

Is their an estimate of when I might actually see an RJ stooging around the MATZ above me?

Engines, Tuc, Wensleydale et al,

Many thanks for such an informative (if depressing) review. I have two questions (or had, It's Life Jim 208 has asked the one about "When?").

The second is what is the level of assurance required? I don't suppose that a 1964 KC-135 is as inherently safe as a 2013 built A330 Voyager - if only because of the FBW protection in the Airbus. So how do you get to a place where something like the RJs can get certified? How much assurance is "enough"?

Thanks in advance,

S41

S41,

The simple (but probably not reassuring) answer is not the actual amount of 'assurance', but the development of a proven and auditable safety case that demonstrates that operation of the aircraft is sufficiently safe.

By 'sufficiently', I mean that the safety case shows that the aircraft meets the target laid down in MAA RA1230, which says:

The cumulative probability of the loss of an aircraft due to a technical fault and the cumulative probability of a technical failure of the aircraft (inclusive of its systems, structure and stores) leading to the death of any aircrew or passengers, should both be assessed to be of the order of one in a million per flying hour (probability of occurrence 1x10-6 per flying hour) when operated within the conditions used for the airworthiness demonstration.

How long does that take? As long as it takes to assemble all the evidence and analysis to underpin the claims made in the safety case. (I've probably got some of the detailed terminology wrong here, but I think I'm fairly close).

If the original Boeing and USAF documentation isn't available (and let's be clear, there's a decent possibility that it never existed in the first place) then the PT is having to develop new evidence based on analysis and/or read across from other airframes. As Tuc so often (and rightly) reminds us, doing that after the aircraft has been built and flown for many years is not an easy task.

Hope this helps

Best Regards

Engines

There is clearly a lot more to this than this rather simplistic statement in MAA documentation. The subtleties of safety, airworthiness and fitness for purpose must be considered.


Firstly, it rather bodyswerves the concept of functional safety. Tornado ZG710 would, probably, have passed this test, yet was functionally unsafe because its IFF failure warning systems were not integrated and the failure to reply to the Patriot interrogation was not notified to the crew. (See BoI report, ACM Burridge’s comments and recommendations – which were ignored). That failure left them with a Build Standard that “COULD result in loss of life”; which is the definition of Safety Critical. The regulations decreed the aircraft, at that Build Standard, could not be put to the use for which it was intended. It was “airworthy” in the sense it could be flown in a very benign environment, with restrictive limitations. However, the management rulings of the day (by DGAS2 and XD5) decreed that the IPT need NOT integrate the warnings. DE&S and the MAA continue to support these rulings. Ministers continue to uphold them. Sort that one out and you’re half way to fixing the systemic failures that plague MoD.

The last bit is important.... “when operated within the conditions used for the airworthiness demonstration.” What is that? The initial “airworthiness demonstration” is typically carried out in the Proof Installation aircraft, very often without systems that would be considered operationally “No Go”. That is partly why you have a Part 2 (Service Deviations) in the RTS. Each subsequent change to the Build Standard MUST be tested and trialled and the subject of an update to the Safety Case. This last is where the system falls down, especially when the change is a Service Modification. Again, the same 2 Stars ruled that this regulation, mandated upon MoD by Secy of State, could be waived. Worse, that a false declaration could be made that it had been complied with. (See Chinook HC Mk2 RTS). It is this lack of a valid Safety Case which compromises any current airworthiness declaration. Without it, the RTS cannot be validated. The RTS is the Master Airworthiness Reference.



Part of the above ruling and practice upheld by the Nimrod/Chinook 2 Star (DGAS2) was that “if it works on the bench, it will work and be safe in the aircraft”, so testing and trialling at the new Build Standard was, and is, often waived. That is, the “airworthiness demonstration” baseline often omits complete systems. That was the case with IFF, for example. So, this definition, combined with extant rulings and practice, is very restrictive and could, and often does, produce an aircraft that is unsafe and not fit for purpose. (Remember that during the XV179 C130 inquest, the IPTL claimed he did not know how to achieve and maintain fitness for purpose. I am always reminded of a young civilian clerical officer who supported me in the late 80s. He knew, and could be trusted to manage the administrative side of such routine work. Billy, I hope you read this!)



Now, as Engines says, try applying that retrospectively to a 50 year old airframe. The chances of the OEMs having the relevant evidence, and a robust audit trail of every change (and Change, if you know the difference!), is very remote indeed. But we (UK) cannot complain. We can’t produce such evidence for our newest aircraft, never mind 50 year old ones. And that is why the IPT would have had a problem seeking funding to attempt to reconcile these conflicts (the risk reduction activity I mentioned). Requirement Scrutiny would immediately reveal that the same issue applied Pan-MoD, opening up a can of worms. Which is why conducting Requirement Scrutiny can be an offence in MoD, despite being a legal obligation. Another ruling by the same people.

Tucumseh,


May I also add the muddying of water caused by using COTS (components off the shelf) which was encouraged by our lords and masters in order to save money - however this has made the configuration of aircraft within a fleet nearly impossible to manage... it has been suggested that a new installation in a COTS fleet has to be fully tested for every aircraft because the configuration for each aircraft (if known) is different. This is particularly problematical for complex aircraft - especially when fitted with highly classified equipment and software.

Wensleydale

Very true. After many years of sensible people avoiding COTS like the plague, for these very reasons, the Defence Scientific Advisory Council (not just scientists, but including users at, typically, SO1 level, and reporting direct to SofS) issued a report in 2000 completely trashing the notion as too risky. (MoD refuses to release it, which is why you keep your own copy!) There are exceptions in various domains, but usually not in airborne equipment.

You mention configuration management. Nailed it. The RAF Chief Engineer withdrew ALL funding for CM in 1992/3 and, while partly resurrected, the gaps were never plugged. And subsequent generations of staff were taught it was a waste. Without it, the Safety Case can NEVER be validated. This is the remedial work the MAA should have been concentrating on instead of re-writing the regs. But doing so would reveal the underlying reason for their very existence, which they do not want to acknowledge.

W

To be entirely fair, I should add that I once saw a vacancy notice at AbbeyWood for a Configuration Manager for EFA (Typhoon). But I often wondered where they got a sufficiently experienced candidate from, given they had graded it very low. Thier counterparts in industry are usually quite senior, same as Risk Managers. Very often the RM is by far the most senior grade in the company team. In MoD it is a peripheral appointment, ditched at the first hint of savings. Always assuming you're given the post in the first place. The two are linked. Failure to maintain CC is ALWAYS a standing risk in MoD.

Guys,

As ever, Tuc does a great job of filling in the important gaps I left in my brief post. The concept of 'functional' safety (aka fitness for purpose) is one I've been trying to get across to requirements managers for around seven years now, and Tuc is right on the money when he identifies the level of ignorance around the risks of assuming that if kit works on the bench (or worse, on the demo stand at the air show) it will work on the aircraft.

Perhaps this will help: here's my own (admittedly imperfect) 'take' on what I see as the three elements of safety.

First - the basic 'airworthiness' aspect - will the item stay in one piece/not catch fire/not fall out of the sky/not poison you/last the required service life, stop working next to a radar, etc. This is where a lack of airframe and systems related information on Rivet Joint could pose an issue.

Second - the 'Functional Safety' bit, or 'Fitness for Purpose': Does the item work as intended? Does it work with the other kit on the platform? Does it tell the aircrew when it is working and when it isn't? Is it reliable? Can it be used in a safe manner? This is where HMI issues can come in. (Example - requiring ten button presses to select an emergency frequency isn' a good thing). On Rivet Joint, this should pose less of an issue, but US sourced kit (or COTS kit) has a habit of springing some nasty little surprises - 'Hey, why isn't that light coming on when I press the button?', etc.

Third - does it support safe operations - does the radio have the required range and clarity, does the aircraft deliver the capability required to stay safe - does the DAS kit work, do data links link, etc. On Rivet Joint, this area will depend on high level agreements for information exchange with the USAF - I would guess (but don't know) that this should be less of an issue.

This is my own personal list - it's probably not right for all projects, but i've found it useful. I'm totally relaxed if others disagree.

The key to achieving all of this safety stuff in a quick and effective manner is a good set of requirements. If the team takes the time to set down a clear and achievable set of requirements in enough detail, the contractor and the PT have a fighting chance of getting across the line in good order.

And this is where the problems, in my view, usually arise.

If the requirement for Rivet Joint was 'we'll have three of those lovely Rivet Joint aircraft just like you've got, please' (I exaggerate to make my point) then problems are bound to arise. If the requirement was 'We'll have three RJ aircraft, but they've got to meet the UK's Air Safety requirements as set down in MAA regs xxxxx' then the issue would be getting the US Government to sign up to that. They would not have.

My personal observation is that too many Requirements Managers I have worked with on aircraft related projects are simply not equipped to do the job. It's not that they are aircrew (as most of them are), it's that they are aircrew who have not had the required training in systems engineering and requirements management. They are often freshly promoted SO2s straight out of flying jobs. As a result, many of them just don't understand what a good requirement set looks like, or what it takes to produce one. I would say straight away that there have been exceptions, and very good ones, who were keen, technically aware, very experienced and happy to learn. But they were exceptions.

Starting out with a poor requirements set throws the risks straight on to the project managers and engineers in the PTs, who are sometimes short of experience and technical expertise, or detailed knowledge about the systems they are dealing with. Again, not their fault, but it's another link in the accident chain.

Of course, variation in configuration within a (supposedly consistent) fleet of aircraft is just another honking great link in the chain. It's a source of real worry that this variation is often deliberately introduced by the customer (those RMs again) with no declaration of the consequent potential safety hazard.

Hope this ramble (sorry for length) is of passing interest to some people out there.

Best Regards as ever to all those trying to get over the line in good order,

Engines

I see that the airworthiness issues surrounding the ac have finally made today's Sunday Times. However, I am intrigued that MOD have now decided that (quote)'an alternative method of issuing a safety certificate has been devised!

So we lose one aircraft type (and the whole MR/R1 capability) that can't meet a new MAA system, buy a much older airframe just for the R1 that also can't meet the new airworthiness system, and immediately kick it all in to touch so that no one gets egg on their face (but presumably much scrambled egg on their hats).

After being involved in conversations in both the crewroom and Ops room conversations at Aldergrove the day before Mull of Kintyre regarding the HC2 Chinook when Boscombe effectively grounded theirs I had hoped I would not see yet another occurrence of the safety case being over-ridden. I'm sure the ac (RJ) is probably perfectly safe, but if we have an airworthiness system - no matter how flawed as Tuc has well argued - it should not be circumvented.