PPRuNe Forums

PPRuNe Forums (https://www.pprune.org/)
-   Rotorheads (https://www.pprune.org/rotorheads-23/)
-   -   EH101 Merlin (https://www.pprune.org/rotorheads/135616-eh101-merlin.html)

Heliport 18th Jul 2001 11:26

EH101 Merlin
 
The RAF’s latest troop transport helicopter entered squadron service yesterday at a ceremony watched by the Chief of the Air Staff, Air Chief Marshal Sir Peter Squire.
The Merlin HC Mark III can fly further and faster and carry heavier loads than the existing RAF Puma helicopters it will operate alongside.

Defence Procurement Minister Lord Bach said: “This aircraft is very advanced and its combination of agility, low noise signature, high reliability and 24-hour a day all-weather capability will enhance our battlefield capabilities significantly. “Merlin HC Mark III has been procured under a £750 million programme which is running within budget. The aircraft can carry up to 24 fully-equipped troops, internal cargo or several tonnes of cargo underslung.”

The aircraft will equip 28 (Army Co-operation) Squadron at RAF Benson in Oxfordshire. The Merlin HC Mk III weighs more than 14 tonnes, has three engines and has a top speed of over 150 knots. It will enter operational service in early 2003 following completion of extensive trials with 28 Squadron.

22 aircraft were ordered from GKN Westland Helicopters in June 1995. The aircraft is a military utility version of the UK-Italian Merlin HM Mark I anti-submarine helicopter, which is in service with the Royal Navy.

Lu Zuckerman 18th Jul 2001 15:28

The part about high reliability “aint necessarily so”. During the design phase all references to catastrophic failures were removed from the Failure Mode Effects Analyses and because of that, they were never considered in the Safety hazards Analyses. The rotor brake problem was one of the failure modes that were removed from the FMEAs.

The most serious failure mode that was removed from consideration is a lock-up of the main transmission. The EH 101 main rotor shaft as originally designed had a shear point that would fracture in the event of a lock-up allowing a successful autorotation. The energy that was required to effect this fracture is the inertia of the main rotor system. At the instant of the lock-up, the rotor would stop rotating and the inertia of the blades would compress the dampers to their stops providing a mechanical lock-up and the inertial energy would pass into the rotor head and then to the shaft causing the fracture. The dampers in the process of this action would destruct because the stress levels would be very much higher than the damper design stress level. In the process of the damper failure the load would be transmitted to the elastomeric bearings and apply a side load that the bearings are incapable of reacting quite possibly causing complete failure of the bearings and the subsequent loss of the helicopter.

I would strongly suggest that the Royal Navy request access to the FMEAs and check to see if my statements are true.

Edit by Heliport
Good idea of yours to seek comments from military pilots - I've put a link on the Mil Aircrew Forum inviting contributions.

[ 18 July 2001: Message edited by: Heliport ]

BIT 22nd Jul 2001 18:06

Hi there, I'm not sure where this link is going but I have a couple of notes on the FMECA.

1. Firstly I fail to see how the presence or otherwise of a catastrophic event within the FMECA would directly change the reliability of an airframe. Surely reliability and availability are functions of MTBF and system redundancy?

2. Secondly, if a catastrophic event were not mentioned at the design stage of an aircraft, that is not to say it would not be in the safety case to the airframe purchaser. Are you saying that there were no catastrophic events in the Merlin FMECA?

3. Lets permit the Merlin to get some serious time in UK Service before we judge it. If after that if there are problems, it will be constructive criticism that will be required.

Thats it. Interested to see how this link fill up.

Lu Zuckerman 22nd Jul 2001 19:34

To: BIT

1. Firstly I fail to see how the presence or otherwise of a catastrophic event within the FMECA would directly change the reliability of an airframe. Surely reliability and availability are functions of MTBF and system redundancy?

In a proper Product Assurance program the first thing is to establish the failure rates for the individual piece parts that make up the elements of the components that are in a system. At this time an FMEA is performed at the component level and the failures of the individual piece parts within that component are related to the effect at the top level of that component. Then the FMEA is performed for the system. The end effects at the component level are the modes of failure at the system level. If a system is properly designed with adequate redundancy the effect of failure of a single component within the system will not migrate upwards to the aircraft level. So to answer your question proper design does effect the reliability and ultimate availability of the subject aircraft. The FMEA performs two major functions. 1) It drives the design by identifying the weak spots and 2) it serves to develop the troubleshooting instructions relative to diagnosing system defects / failures.

2. Secondly, if a catastrophic event were not mentioned at the design stage of an aircraft, which is not to say it would not be in the safety case to the airframe purchaser. Are you saying that there were no catastrophic events in the Merlin FMECA?

As indicated above one function of the FMEA is to identify the weak spots. The FMEA is normally performed at the very beginning of the design process so as to minimize the cost and time effects of changing the design. In the design process of the EH 101 the FMEAs identified all of the catastrophic single point failures that could down the helicopter. By definition a single point failure that could cause loss of the helicopter or death and or serious injury to the occupants can occur no more frequently than one time in a billion hours of operation of the aircraft fleet. (1 10-9).
After including all of these failures in the FMEA the department manager for whatever reason decided to take them out. Since they were not included in the FMEA they were never included in the Safety Hazards Analysis. By not being included in the SHA the failures were never mentioned in the training syllabus, the tech manuals nor were they included in simulator training. In other words these catastrophic failures would never occur.

3. Lets permit the Merlin to get some serious time in UK Service before we judge it. If after that if there are problems, it will be constructive criticism that will be required.

When these failures do occur the operators will collectively wonder why this type of failure was never addressed in the design.

[ 22 July 2001: Message edited by: Lu Zuckerman ]

BIT 22nd Jul 2001 21:43

LZ,

thank you for the ethos behind FMECA, I found it most interesting. You appear to have actual hands on experience of the detail of such an analysis on the EH101.

I was surprised that you were so specific in pointing out who, in your opinion was allegedly responsible for removing identified catastrophic events from a FMEA. Were I one of the persons concerned (I am not) I would be keen to question your statement. Nevertheless, your concern for the operators is clear and worthy. Do the operators have access to the Merlin FMEA through their procurement or airworthiness chain? Even if a company put together a weak safety case would it not be checked as part of the airworthiness requirement? Also , was the rotor brake problem that you refer to in your previous post the one that caused the recent EH101 crash? Because if so, surely that would have focussed the airworthiness chains attention on the safety case?

Thanks again
BIT

Vfrpilotpb 22nd Jul 2001 22:45

To Bt and Lu,

Henry Ford had a policy once of letting customers find the major faults in his new models, when it happened one had the car towed to the repair man, Bt has said lets get some serious hours in on the Merlin, if any catastrophic breakages happen you will be left with not only mangled airframes, with this in mind will any new pilots want to fly them!

Lu Zuckerman 22nd Jul 2001 22:52

To: BIT

I developed a computerized FMEA for Agusta for use on the A 129 and modified it for use on the EH 101. I worked for Agusta on a consulting basis for almost three years and then performed the same service for six months for the firm that built the hydraulic system. We used the same system on this contract as well.

Our counterparts at Westland constructed a similar system but after their system was fully developed we found out that the two systems were incompatible due to different programming structure and different mainframe computers. A system was to be constructed to allow the computers at Agusta and Westland to talk to each other but while I was on the program this system was not fully developed nor was it tested to my knowledge.

I attended a meeting at EHI offices in London where Agusta and Westland were presenting their respective R&M programs and assigning the respective workloads. Both Westland and Agusta were committing themselves to a level of effort that would be impossible to accomplish. Westland at that time was reducing the size of their product assurance department and Agusta only had five R&M engineers besides myself working the EH 101 program. These five engineers were in training and required constant guidance from myself. Besides, they had limited English skills.

I sat through the meeting and finally I couldn’t take any more. I tore into both companies for committing to such a heavy workload with inadequate staffing. In the process of this lambasting the Agusta manager took offense. When we returned to Italy, the manager told the five R&M engineers to not talk to me nor, could they ask any questions. Shortly after that, he told the men to remove the catastrophic failures. During the next thirty days I sat and read magazines, went out on the flight line and watched helicopters being built. After this enforced situation I went to work for the director of Agusta with the responsibility to integrate the engineering department with the product support department. Six months of concerted effort and it never happened. To my knowledge the two departments are still not speaking to each other and that was over 12 years ago.

The document required for certification are separate from those documents that establish the reliability and maintainability requirements and the safety requirements are still another document. In the certification process the helicopter is tested against the requirements of
Advisory Circular 29-2A (Certification of transport category rotorcraft) or, the JAR equivalent.

This document is performance oriented and has no relationship to safety, reliability or maintainability. If the FMEA is prepared against a military contract, the client has access to all of the documentation. On a civil contract the client can request access to the FMEA but he must come to the manufacturers facility to see the documents. This is also true for the documentation used in the safety analysis.

The latest rotor brake problem was determined by Royal Navy investigators to have been caused by a maintenance error. This would not normally be addressed in the FMEA unless it could be seen as a possibility. The first two failures were addressed in the FMEA but later removed. These failures resulted in a loss of life.

BIT 22nd Jul 2001 23:27

LZ

Thank you for your summary of the FMEA procedures on the EH101.

Clearly ths thread has wondered well offthe Merlin Entering Service line but here goes (all my own opinion without comittment or bias!):

The facts as I see them.
For an aircraft to enter UK service it must have a safety case that is acceptable to the procuring authority. Such a safety case will be agreed by a combination of service and civilian specialists working for or on behalf of he procuring authority. Such a safety case will begin with the contractors safety case with omissions or other changes made as the case develops. This case is in no way hidden from the Service as it is directly involved in its production. Merlin is in service,QED an acceptable safetycase exists or is reaching conclusion.

No safety case wil ever cover every concievable malfunction combination so operators are reliant on the general engineering design basis when push comes to shove.

The best indication of reliability is safe flight hours flown. I think that AUG did their long term hours building in Italy and Scotland to test the longevity of the EH101 major components.

In summary, The Merlin is here and now. Its had a chequered start but the RN and RAF are currently fielding an ac which has been extensively analysed and tested. I would like to hear from Merlin OPERATORS. Whats bad (and good) about it. Can they do the job safely and effectively with it?

Nick Lappos 23rd Jul 2001 00:05

Lu,

I started to address each of your points in turn, and finally gave up, as it would yet again let you set the agenda on these long, pontific posts that you spin.

I find your point of view insulting and inflammatory, and at odds with my intimate knowledge of the Westland and Agusta folks who work in my profession. That anyone would assert that such folks as Jerry Tracy (Westland Test Pilot) or Rafael Longibardi (Agusta Chief Test Pilot who perished in the rotor brake fire accident) would participate in some kind of white wash is offensive and does not serve this forum at all. When you state that these accidents would not have happened if they had only followed your instructions is absurd. While your posts seem erudite to the less experienced members of this forum, you don't fool me a bit!

For all those who look to this forum for straight from the shoulder knowledge to make them better at their craft, let me catagorically state that the manufacturers of the machines we fly are populated with people of high integrity and expertise. Even though I consider the EH-101 to be a prime competitor of the aircraft we make, I have very high regard for the technical integrity and capabilities of the people who make it.

From your egotistical attitude and willingness to slur those others who might disagree with you, I fully understand why you are only a temporary consultant, and even as such why they let you go.

Your previous posts which held that the US Army and Marines lied about the capabilities of their aircraft come to mind, too. For the rest of the readers of this forum, please try to separate Lu's technical opinions from the polemics that slip into his posts.

Lu Zuckerman 23rd Jul 2001 01:10

To: Nick Lappos,

I beg to differ with you regarding on what subterfuge aircraft companies enter into when selling a design to the military or to a civilian operator. In my line of work I get to see all of it. By the time it gets to people like yourself the design good or bad is cast in concrete and you have to work with it. Sometimes the problems manifest themselves in a short period and in other cases the design has to accumulate many hours before the problems manifest themselves. A perfect example of this is the fail safe design of the S76 rotor blade.

I have been in this line of work since 1968 and I have been involved in aircraft since 1949. I would say that this provides a good perspective as to what is good and what is bad.

Regarding your two friends at Agusta and Westland they had absolutely nothing to do with the preparation of the product assurance documents and as I stated above they had to work with the design that was presented for testing. Unluckily for those engineers and technicians at Agusta that lost their lives the design was defective and nobody was aware of it because the stated failure among many others were removed from the FMEA and consequently never were considered in the safety analysis.

Now, let’s get on the subject of how honest aircraft companies are when dealing with a customer when there is an accident. Although the following can be representative of any airframe manufacturer it is a story that happened at the Flying S the same company you work for. Put your self in the position of the two investigators from the Navy or, better still in the places of the crew involved in the accident.

I was a techrep for Sikorsky probably before you were born.
Our in plant education consisted of fourteen weeks of classroom study and eight to ten months in the shop. While in the shop, we did everything. We punched rivets, installed hydraulic systems and electrical systems. We built up and installed rotor blades, rotor heads, gearboxes, and clutches, fuel tanks and, flight control components. If it went into the three models being built by Sikorsky our group had our hands in it or on it.

It was during the shop program that the writer became aware of what is to follow. The writer had just completed a two-week stint in the gearbox and rotor head section. The trainees were usually asked to leave because they were building these units faster that the shop personnel. The writer moved into the adjacent group that built tail rotor and intermediate gearboxes, as well as mechanical and hydromechanical clutches. Shortly after moving into this area, the writer became aware of a hushed conversation between the shop foreman, the plant manager and two U.S. Navy Officers. They were reviewing some paper work. They would go off to the transmission run-in room and upon returning they would again look at the papers. They seemed to be in an argument, but they kept their voices down so as not to be overheard. Finally the group broke up and the two Navy officers left. They seemed to be in a heated conversation.

It took a while, but the writer eventually got the full picture. Actually it was two pictures. One was the company picture the other was the Navy picture. The Navy had recently lost a brand new helicopter. It crashed in San Diego Bay after losing its tail rotor. The three crewmen died in the crash. Within hours, the Navy recovered the helicopter with the tail rotor gearbox still attached. They also recovered the tail rotor, which was almost intact.

When the accident investigation began, the tail rotor gearbox was opened. The investigators found that a critical part was missing. It was thought that it may have fallen out of position and got entrained in the gear mesh. Closer examination proved this to be a wrong conclusion. The gears were unmarked and there was no debris inside the gearbox. The finding of the accident investigation team was that the snap ring had never been installed which lead to the accident. That is what the Navy Officers were saying, and the other two men were denying it. The papers they were looking at, were the inspection records for the tail rotor gearbox.

By the time the writer was to move to his next workstation, he had developed his own conclusions, which were in total agreement with the Navy investigation team.
As each element is installed the technician and the inspector sign it off. Then the next part is installed with the same double sign-off. On several occasions the writer saw the technicians install several parts without signing the work off. They would then sign off the work and the inspector would buy the work off on their say so, totally in violation of quality control regulations. This happened many times. In some cases, the gearboxes were closed up before the work was signed off. After the gearboxes are complete and all signed off they are sent to the run in room where they are placed under load and run in for an hour or so.
Under normal condition, the gearbox would be returned to the work area to be partially disassembled to allow the gear mesh pattern to be checked. Some times they would luck out when the pattern was found to be O.K. If the mesh pattern were unacceptable, it would normally be corrected by the second run. This gearbox was returned, not for a check of the gear mesh, but because it was leaking.

The gearbox was partially disassembled to install a new gasket. It was then returned to the run in room. Instead of creating new paper work, the technician’s double stamped the existing paper work. It took three more tries to fix the leak. Each time the gearbox was reassembled, a stamp would be made on the paper work. This time the gearbox didn’t leak and after the run in the gear mesh was checked. To do this, the end of the gearbox, which is held in place by several bolts, is removed. This provides a direct view of the snap ring. The only thing that was of interest at that time, was the gear mesh. The Navy postulated that they didn’t look at the lock nut, which was supposedly held in place by the snap ring. When the end closure was reinstalled and bolted in place all of that work was double stamped.

Some of the tasks on the paper work had as many as fourteen stamps, including the inspectors’ stamps. The technician and the inspector double stamped the end cap removal/replacement. It was the company’s argument that when the end plate was removed the technician not only checked the gear mesh pattern he also verified that the snap ring was in place. That may be true and if it was true, why didn’t the technician double stamp those tasks as well. Another point to ponder was that the two technicians were given time off with pay and the inspector was moved to another department during the period that the Navy Officers were in the plant. The two people that made the argument for the company had absolutely no knowledge of what happened and those people that did were not made available to answer the questions of the two Navy personnel.

Three good men died because of an error made by those technicians. However, it could have been worse. When that gearbox was signed off, it was painted and placed in free stock. As free stock it could have been placed on a commercial or U.S. Army version of the Navy helicopter. These helicopters carry a crew of two and up to twelve passengers.

[ 22 July 2001: Message edited by: Lu Zuckerman ]

Hoverman 23rd Jul 2001 02:54

Nick Lappos
Thanks for your informative posts on several topics over the past few weeks.
You are a welcome addition to the Forum.
You seem to have grasped the fundamentals of Lu's thesis very quickly: All helicopter manufacturers are dishonest with a blatent disregard for the safety of those who will fly/fly in their aircraft. :rolleyes:
Your input is extremely valuable - thanks.

Jiff 23rd Jul 2001 03:10

Mr Lappos,
I find it hard to believe that someone with your experience and in your position would make the kind of comments you have made with regard to Lu Zuckerman.
Whether you like the guy or not, and I don't know him either personally or professionally, the arguments he has put forward are well founded and supported with technical facts. Yet most of the criticism has been along the lines of "that cant be right" and "I don't think your right". Almost none of the criticism has contained anything which says "you are wrong because", do you see the difference?

The real bummer about arguing with competent engineers is that they normally have all there ducks in a row and the fact is that the truth is always completely defendable.

With regard to the technical folks at Augusta and Westland, I agree completely that by far the majority of these people have immense technical talent, ability and are of the highest of integrity. The problem is that there is usually some non technical project manager who's only focus in life is budget and schedule, he saw 001 prototype flying for the first time and thinks everything is just fine and the safety guys are just being a pain in the ass.
Your probably thinking I must be on a different planet or something but unfortunately not, been there seen it and it happens. It doesn't just happen in the aviation industry either.

I certainly hope that the less experienced members of this forum do listen to what's being said here and if it only is sufficient to raise enough doubt in someone's mind that it causes them to question the B.S. and look for the facts then that's a good thing.

A few more facts
After reading all of the info about the Osprey on this forum, the press and the internet, I was certainly left with the impression that there were lies being told. Didn't an investigation prove this?

The R22 debate, well Frank Robinson responded in some very broad terms and completely failed to address the specific points which were raised in the argument, why?

Jiff

Nick Lappos 23rd Jul 2001 03:17

Lu said:
By the time it gets to people like yourself the design good or bad is cast in concrete and you have to work with it. .......
Regarding your two friends at Agusta and Westland they had absolutely nothing to do with the preparation of the product assurance documents and as I stated above they had to work with the design that was presented for testing. (along with many, many many other things)

Nick sez:
Your arrogance is shown in the belief that only the devine Lu Zuckerman can do an FMEA, and few mortals could possibly understand the magic.

I was project pilot on several Sikorsky models, and worked as a member of the design team in many ways, usually before the decision to design the machine had been made. With a great team of experts, I helped set the number and chord of the blades, the electric, hydraulic and control systems design and such. The FMEA is an integral part of this, and I worked with the R&M professionals to assure proper safety in the designs, before the FMEA's are written.

I will not debate with you because you are truly hopeless, but I want the other readers of this forum to see that you are a very cynical observer and do not necessarily understand the import of what you say. In the above post, you wax on and on about a mistake that was made as if that somehow proves your point. It does not, because your point is simply wrong. Our industry is made of operators, Military services, governmental agencies and manufacturers who try in most ways to do the best, and to use a high degree of integrity to fulfil their responsibilities. To assert otherwise, as you are prone to do, is to impune the reputations of many who will never read your puny words, but who could be harmed by them anyway.

The two fellows I mentioned by name are or were of the finest in their field, and fully able to beat your pants off when it comes to preparing an FMEA or in a trip outside in the carpark. I mentioned their names because I want to assure the readers of this forum that there are no faceless individuals who hold our fates in their hands. They are flesh and blood professionals who do, as we do, their best.

I sit in breathless expectation of another long tirade from you about 1) how wonderful you are and 2) how rotten are the manufacturers, militaries and governments and 3) how much better life would be if only we would face toward you each morning and bow.

But to the readers of this this forum, please know that the world of aviation works pretty well, and that the mechanic who tightens the bolts, the engineer who designs the gears and the accident investigator who writes the reports are all trying to do what is proper, in spite of Lu's assertions otherwise.

Lu Zuckerman 23rd Jul 2001 04:00

To: Nick Lappos


1) I find your point of view insulting and inflammatory, and at odds with my intimate knowledge of the Westland and Agusta folks who work in my profession. That anyone would assert that such folks as Jerry Tracy (Westland Test Pilot) or Rafael Longibardi (Agusta Chief Test Pilot who perished in the rotor brake fire accident) would participate in some kind of white wash is offensive and does not serve this forum at all. When you state that these accidents would not have happened if they had only followed your instructions is absurd. While your posts seem erudite to the less experienced members of this forum, you don't fool me a bit!

Where in my post did I state that your friends at Agusta and Westland had anything to do with a cover-up of problems? You have limited knowledge of what transpired at Agusta during the design phase of the A 129 and the EH 101. There was absolutely no cooperation between the product support department and engineering. The product support department was denied access to the engineering mainframe computer and as a result they purchased an NCR computer that was not compatible with the IBM mainframe. Because of this the product support department had no access to the FMEAs for either aircraft and could not develop comprehensive trouble shooting guides. The tech manuals were minimalist because the Product support department did not have direct access to the drawing system, which was on the mainframe computer. My last six months at Agusta were spent trying to establish a level of cooperation between engineering and product support. This lack of cooperation stemmed from the bad blood between the engineering manager and the manager of the product support department. This bad blood existed since the development of the A109 ten years earlier. By that time both departments changed management at least two times and still the cooperation was non existent. When I left, the two departments were paying lip service to the Idea but nothing changed. Regarding the accidents not happening if the FMEAs had not been emasculated I can’t honestly say but where do you get off challenging my word as if to say I am lying.

1) For all those who look to this forum for straight from the shoulder knowledge to make them better at their craft, let me categorically state that the manufacturers of the machines we fly are populated with people of high integrity and expertise. Even though I consider the EH-101 to be a prime competitor of the aircraft we make, I have very high regard for the technical integrity and capabilities of the people who make it.

It is true that aircraft manufacturers are populated with high minded and dedicated employees. However no matter how high minded and dedicated these individuals can be over ridden when schedules and money are concerned. That is the main problem when it comes to Reliability and Maintainability because any change to improve either will impact design schedules and cost money. I Identified 27 different R&M problems on the Apache and none of them were incorporated because of two things. Engineering had no use for R&M and Engineering did not want to change the design. All 27 of these items have manifested themselves during the life of the Apache. Now, regarding Agusta the one thing that they had that no other helicopter company had was their employees were all Italian and as such possessed a great deal of machismo that was threatened if a suggestion to change the design was implemented.

2) From your egotistical attitude and willingness to slur those others that might disagree with you, I fully understand why you are only a temporary consultant, and even as such why they let you go.

How have I expressed an egotistical attitude? And, when did I slur or take a shot at anyone that disagreed with my point of view? Regarding my position as a consultant short term contracts are the norm. Some last for a week and some for three years and all of that pays a hellova lot of money. I’m 70 years old so no company will hire me as a permanent employee. I have been let go from several jobs but not for incompetence. For example I was let go from Boeing because I kept telling them that the reliability of the hydraulic system would be severely diminished because of the design of the proprotor. Hydraulics. Does that ring a Bell?

3) Your previous posts, which held that the US Army and Marines lied about the capabilities of their aircraft, come to mind, too. For the rest of the readers of this forum, please try to separate Lu’s technical opinions from the polemics that slip into his posts.

“I” didn’t state that the Army lied I stated that the information was provided by an investigator from the Government Accounting Office who was generating a scathing report on the unreliability and poor maintainability of the Apache. I have the greatest respect for you and what you do however I really don’t care to be judged by someone that does not understand what I do and what I stand for. Read my bio. It states that I am interested in flight safety and crew safety. That is why I post what I do. To provide an understanding by the pilots and mechanics of the aircraft the fly in and work on.

BIT 25th Jul 2001 22:16

Well said Nick,

You put in straight words what I as a newcomer to this forum was thinking. LZ clearly has a long history on the EH101 but the emphasis is on long with that being from my estimates from his comments is from about 12 yrs ago. Therefore, for him to comment on the current safety case is questionable.

I know some of the individuals you have mentioned by name and agree wholeheartedy with you regarding their commendable motives for getting the aircraft right.

Shame that this thread was hijacked but I hope we can get real OPERATORS opinion on the Merlin EH101 on another thread sometime.

Be safe

Lu Zuckerman 25th Jul 2001 23:09

To: BIT

What you say is true. I did work on the EH 101 a long time ago but it was when the FMEA was being prepared. In almost every program I have ever worked on when the findings of the FMEA were included in the Safety hazards Analysis the whole thing is accepted and cast in concrete never to be changed. It should be noted that when I was on the program a Safety Hazards Analysis was not a requirement for the military end of the contract. Agusta I believe at that time was, as a part of the work sharing agreement would produce the civil variants. Per certification requirements for civil aircraft they had to prepare a Hazards Analysis and this was most likely done after I left the program if in fact it was done because the initial certification was done under RAI rules.

The purpose of the Hazards Analysis is to not only verify that the safety of the design meets the certification requirements it also Identifies single point failures that can cause death, Injury or, loss of the aircraft. This part of the analysis is keyed to the findings of the FMEA. If no single point failures are identified they will not appear in the Hazards Analysis.

If you read one of my previous posts I mentioned that a transmission lockup could cause loss of the aircraft and that with proper stress analysis of the loads on the dampers they could eliminate the problem. I mentioned this to the Agusta Dynamics department and they stated that they were going to demonstrate this malfunction using an A 109 transmission and rotor system. That was about a year prior to my leaving Agusta and the test had not been performed. I don’t know if it was ever performed.

After leaving Agusta I worked in the same capacity with the builder and designers of the hydraulic system for the EH 101 including the dampers. I told them about the problems with the dampers not being able to meet the stress levels imparted on the dampers during a lock up.
I suggested they contact Agusta and tell them. They adamantly refused saying that the last time they brought up a problem relating to an Agusta design the Machismo level at Agusta went up several orders of magnitude and Agusta ended up chewing out their collective butts. Agusta eventually made the change.

Nobody talked between departments and if an individual wanted to discuss a problem with an engineer in another department he had to be introduced by his department manager to the other department manager before he could get to the person he wanted to talk to. The entire program at least at Agusta was operated as if each department was a fiefdom within its’ self and it was unrelated to any other department even though there was a distinct relationship between the systems on the aircraft.

It was because of the above stated problems I suggested that the Royal Navy gain access to the FMEA and if possible the Safety Hazards Analysis.

[ 25 July 2001: Message edited by: Lu Zuckerman ]

BIT 25th Jul 2001 23:35

Well LZ

That proves my point. Knowledge in aviation perishes quickly. While what you say may well have been correct when you were on the programme, things change, for better or worse but change is a fact of life so:

1. The FMEA which is now known as a FMECA does and has changed.

2. The current procedure involves the production of a Hazard Analysis HA, a detailed analysis DA and a Safety Report for each system with an overall report pulling everything together. It has been worked on extensively by dedicated and skilled people some company, some not. It is most certainly NOT set in concrete.

But rather than drone on about it I'm not going to ask you or anybody else on this forum about safety cases.

I only looked at the thread because I wanted to know what PILOTS (and navs/observers/crewmen etc) thought about their new flying machines.

I wish I hadnt read your reply to the opening note and also wish I had not fuelled your later posts with my questions.

"I learnt about the rotorheads forum from that"

Lu Zuckerman 26th Jul 2001 01:10

To: BIT

Whether you want to continue this discussion or not, I will respond to your statements. If you wish to respond that is your prerogative.

An FMEA and an FMECA are basically the same thing. The C stands for criticality and it references the criticality requirement of Mil Std. 882 or, the FAA / JAR or, the CAA. There are four criticality levels. For the FAA there are 3 levels. Depending on the contractual requirement one or the other analyses will be used.

CAA 1 Minor JAR Same as CAA FAA Non essential Mil Std. 4 Minor
2 Major Essential 3 Marginal
3 Hazardous Critical 2 Critical
4 Catastrophic 1 Catastrophic

The above categories are tied to the frequency of occurrence related to number of hours flown by the fleet of a given type of aircraft.

It is true, the hazard analyses are worked on by many people and the various reports that are generated reflect the perceived safety of each of the aircraft’s systems based on the use of failure rates that are factored using Boolean algebra. However they are not pulled together to reflect the overall operational safety as to do so it could be shown that at the aircraft level the combined systems do not meet the safety requirements of the governing specification. If you know about this type of analysis each system is represented as a number of gates that must open to allow the failure to migrate up to the top level and the final gate is an and gate. If you take the top levels of each system and raise them one level to the aircraft then using this same Boolean logic it will show that the aircraft does not meet the spec. Once the analysis is complete it is not changed unless there is a major design modification and then only that part that reflects the change is modified. Normally by that time the design is in production.

The failure rates are defined in the reliability analyses, which also define the characteristics of the system to include redundancy. These number along with the redundancies are input into the FMEA / FMECA and then on to the Hazards Analyses.

The whole purpose of these various analyses is to drive the design. Once they are input into the design the company will lay off all R&M contractors and cut back on the department staff by moving them onto new programs. This in essence means that all work is stopped and if that is not cast in concrete I don’t know what is.

I'm sorry but this system does not respond well to tables.

[ 25 July 2001: Message edited by: Lu Zuckerman ]

BIT 26th Jul 2001 11:48

Its a hard thing to swallow but you are factually wrong. I have worked on FMECA, know what the C stands for and know how the DAs are pulled together.

Been there seen it got the T shirt so I suggest you take your outdated procedures and bring them UP TO DATE before commenting further on this topic.

It may surprise you but other people do know how to do a safety analysis but they choose not to be so self righteous and base their comments on the latest procedures.

Lu Zuckerman 26th Jul 2001 16:37

To:Bit

Before we get into a P!ss!ng contest let me make a statement. Several months ago I became embroiled in a running argument with various UK and Oz types about gyroscopic precession. The argument went on for some time until I came to the realization that in their POF classes in the UK they address Gyroscopic Precerssion as a minor influence to the point it is minimally addressed. In the USA in POF classes it is everything. Once we got that straightened out the arguments became fewer and fewer as In any of my posts I would preface my statements with the disclaimer that there would be differences of opinion.

Now I’ll address the FMEA and the Hazard analysis. First of all the entire field relating to reliability was developed by the US Airforce about 40 years ago. These principles were applied to every military program and were eventually adopted by the civil sector. Over the years the procedures were modified and the process was taken over by the Society of Automotive Engineers (SAE) as it applied to civil applications and military applications are controlled by the Reliability Analysis Center (RAC). The US Military is procuring more and more off the shelf equipment and usually on these programs they recommend the use of the SAE procedures. There is very little difference in the requirements of the two systems it is just that the formatting of the forms is different.

Right now I am performing the reliability analysis and preparing the FMEAs for the Dornier 728 Jet hydraulic system. The format for the FMEAs was developed for civil applications and can be used as an FMECA or an FMEA. The difference is in filling out the column labeled as criticality or not filling out that column. On my system we do not address the criticality relative to the aircraft. However at the next level they will.

Getting back to the opening paragraph relative to differences in approach the FMEA /FMECA forms you use in the UK I believe stem from a MOD Def Stan and were modified from the American procedures. If this is the case we are talking about the same thing but from our own knowledge perspective.

[ 26 July 2001: Message edited by: Lu Zuckerman ]

[ 26 July 2001: Message edited by: Lu Zuckerman ]


All times are GMT. The time now is 02:03.


Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.