The UK’s new military air safety regime has contributed to the delayed entry into British service of some new platforms, such as the Airbus A330MRTT Voyager tanker, the Thales Watchkeeper UAS and the L-3 Integrated Systems Airseeker (the UK version of the USAF’s RC-135 Rivet Joint SIGINT aircraft). As a result, some UK aerospace industry managers have expressed dissatisfaction with the Military Aviation Authority (MAA), in off-the-record comments to this editor and others. But the senior Royal Air Force officers that currently lead the MAA are unapologetic about the increased scrutiny that they have imposed.

In his first media interview since becoming director general of the MAA, Air Marshal Dick Garwood told AIN earlier this year, “The Haddon-Cave review called for an independent regulator that fosters continual improvement in safety culture, regulation and practice.”

The Hon. Mr. Justice Haddon-Cave QC is the senior judge who led an independent inquiry into the crash of an RAF Nimrod maritime patrol aircraft in 2006. He found a fundamental failure of leadership, culture and priorities, and a dilution of responsibility and accountability.Among other failings, the UK Ministry of Defence (MoD) had outsourced the Nimrod safety case to the manufacturer, the QC noted.

The MAA was established in early 2010 to put things right. It employs 250 people, 70 who filled new posts created as a result of the Haddon-Cave review (the remainder filled safety positions transferred from elsewhere in the MoD).

Garwood and his staff still take their marching orders from that review. For instance, “it’s not acceptable for industry to have sole intellectual ownership of airworthiness, for aircraft on the military register,” MAA technical director Air Vice-Marshal Martin Clark told AIN. Implementing Haddon-Cave’s recommendations has not “always been without short-term challenges to the DE&S (Defence Equipment and Support), frontline commands and the defense industry but the long-term result is that Defence will operate more safely and understand the risks that it takes much better,” commented Garwood.

DE&S is the MoD’s procurement agency. To outsiders, the relationship between it and the MAA has sometimes seemed dysfunctional. But during the procurement process, the DE&S must submit evidence to the MAA to enable the latter to issue either a military type certificate (MTC), an approved design change certificate (ADCC) or a statement of type design assurance (STDA). Once that is done, the DE&S proceeds to the point where it is ready to recommend the release to service (RTS). The MAA then audits this work. “We mark their homework,” AM Garwood said. Finally, the DE&S sends the case to the relevant RTS Authority in the RAF, Army or Royal Navy, which makes the final judgment.

This doesn’t sound like the optimum process. Garwood told AIN that the UK Defence Secretary at the time did not accept Haddon-Cave’s recommendation that the MAA assume responsibility for issuing RTS for new or modified aircraft or systems.

The MAA is keen to explain why an aircraft that is already certified by civilian authorities must undergo further scrutiny before it is approved for use by the UK military. The introduction of the Beechcraft King Air 350ER (to train the Royal Navy’s rear crew) and the Airbus A330MRTT were both delayed as the MAA sought additional assurance. In the latter case, this was despite Airbus Military having obtained from the civil certification authorities, two supplemental type certificates (STCs) covering the military modifications to the basic A330 airliner.

“We don’t repeat work that has already been done [by the civil authority],” Garwood claimed. But according to one source close to Airbus Military, the MAA initially proposed to do just that, by ignoring the A330MRTT’s two STCs. Garwood told AIN that those STCs “did not cover the full extent of the military modifications or their operation.”

The operating environment for a military aircraft is very different, the MAA notes. (The table below) lists the differences.) Further, the civil certification of an aircraft is a one-time event, whereas a military aircraft may be introduced in a phased manner, from initial to full operating capability. Nevertheless, the MAA says its certification process is “heavily based” on EASA regulations. Garwood told AIN that he had consulted with the UK Civil Aviation Authority (CAA) on this matter.

“We’ve got better with experience,” admitted Garwood, with reference to civil versus military certification. AVM Clark also conceded that there had been an “evolution” in the way that the MAA approaches this issue. Nevertheless, he added, “We do require the project teams [at the DE&S] to understand and ‘own’ what has previously been accomplished.”

Design Standards

Defence Aircraft Design Standard 00-970 is at issue here. It has a long lineage, and benefits from 95 years’ of UK experience in operating military aircraft. It has been adopted by some other nations. All UK military aircraft are supposed to comply with this standard. “We didn’t make this stuff up,” noted Garwood.

But most aircraft–such as the King Air and the A330–aren’t designed to 00-970. AVM Clark admitted that this had been “a source of friction.” He added, “It must be understood how a new aircraft type ‘sits alongside’ the standard. Make the argument, we’ve said!” The MAA has now begun work to further update and harmonize the standard with other codes.

The Watchkeeper remotely piloted aircraft system (RPAS) posed a unique set of problems. Regulators worldwide are wrestling with how to certify and regulate RPASs or UAVs. The MAA has a small multi-disciplinary team examining whether current UK regulations are appropriate for RPASs. The Watchkeeper’s entry into service with the British Army was delayed three years, partly because of the MAA’s concerns, especially over the aircraft’s software. Two years ago, a military officer with knowledge of the matter told AIN that Thales had not been able to obtain basic airworthiness data from Elbit Systems, the Israeli designer of the UAV. Thales declined to comment. The MAA eventually granted an STDA for the system last October. “We may eventually know enough to issue a type certificate,” commented AVM Clark.

The RAF’s acquisition of 50-year-old airframes for SIGINT brought a different challenge to the MAA (and the DE&S). Three KC-135 tanker aircraft are being converted to the same RC-135 Rivet Joint configuration that is already flying with the USAF. L-3 Integrated Systems is the contractor, having gained huge experience in the overhaul, care and maintenance of the RJ fleet over many years at its Greenville, Texas facility. Called the Airseeker by the RAF, the aircraft are being acquired via the U.S. foreign military sales (FMS) process and the USAF’s Big Safari acquisition program office, which manages the RJ fleet.

In its latest annual report, dated last August but not released to the public until April, the MAA notes that the MoD was aware about potential aging aircraft concerns before the Airseeker buy was confirmed. From U.S. sources, AIN became aware of mounting frustration at Big Safari, as the DE&S sought type design assurance and an audit trail for the airframes. Repeated questions were sent from the UK, and proprietary information was sought from Boeing. One particular area of interest was the aircraft’s fuel system, since the Nimrod crash was caused by a fuel fire.

Meanwhile, progress in converting the first aircraft was running ahead of schedule, and the U.S. side sought to make delivery six months early. The first Airseeker duly arrived at RAF Waddington last November, but did not fly again until May, as the DE&S continued to examine the safety case.

The DE&S had engaged QinetiQ to do an “independent technical evaluation” (ITE) of the aircraft. The privatized former MoD-owned company has worked for the DE&S on some other acquisitions. The U.S. found this ironic, since QinetiQ was severely criticized by Haddon-Cave for its performance in a safety review of the Nimrod. A senior UK aerospace industry manager told AIN, “QinetiQ gets paid by the number of questions it asks–there’s no incentive to get the job done.”

“QinetiQ is often, but not always, employed by the DE&S,” noted AVM Clark. “The more we see the procurement team and the designers doing ITE, the less assurance we may do ourselves,” he added.

“We had problems articulating our own processes over the Airseeker,” AM Garwood admitted. “The Americans won’t go back and retrospectively check the whole design life of an aircraft that’s been in their inventory for 50 years. There’s lots of complex work to do. We are looking at an alternative airworthiness strategy,” he told AIN last January.

The MAA recently told AIN that as a result of the “alternative approach” to certification, it has provided advice to the RTS Authority (for example, the Assistant Chief of the Air Staff) to enable RAF crews to begin flying the Airseeker.

The MAA is now evaluating the safety of two major platforms that will soon enter RAF service–the A400M airlifter and the F-35 stealth fighter. The A400M has already achieved EASA civil certification and entered service with the French air force. AVM Clark said theMAAis “reasonably confident” that it will be able to issue a military type certificate for theA400M in due course. The Authority recently issued an STDA to support the initial operating capability (IOC) configuration of the aircraft. “The F-35 is really challenging, but the (DE&S) procurement team is ‘in the right place,’” he added.

Harmonized Requirements

In the future, an MAA initiative should help pan-European programs like the A400M. The authority is taking a leading role in a forum that aims to harmonize requirements within Europe for military airworthiness. The European Defence Agency (EDA) is supporting the effort. But although the forum is basing the requirements framework on EASA regulations, there is no intention to create a pan-European regulatory agency for military aircraft, according to Clark, theMAA’s technical director. “Regulation will remain a national responsibility,” he toldAIN.

The certification of new military aircraft is only one of the MAA’s responsibilities. It also audits the operational military flying community; the contractors who fly military aircraft either for test purposes, or under the various contracts that the MoD has let for the privatized provision of services; and maintenance facilities. It is the keeper of the rulebooks for flying and air traffic management, including airfield operation. It approves training organizations, and also holds its own training courses. It also conducts the military air accident investigations. It may be licensing aviation technicians in the future.

Garwood emphasized the independence of the MAA. “I report directly to the permanent undersecretary at the MoD, but I have access to the Defence Secretary (for example, the senior defense minister). I’m independent of the service chiefs,” he added.

The main responsibility for complying with the military air safety regime lies with “operating duty holders” (ODHs) at two-star level. This was another Haddon-Cave recommendation–that those “holding risk” be clearly identified. These risk holders are personally liable in the event of an accident. The DH chain is not the same as the UK military command chain, Garwood noted. This deliberately provides “tension” in the system, he explained. “Haddon-Cave wanted leadership, accountability and simplicity; for example, ‘who ‘owns’ this machine?’” he added.

“There’s no Crown immunity,” Garwood confirmed. But, he said, if a duty-holder feels he cannot hold a particular risk, he can “elevate” it to a higher level–for example, the “senior duty holders” who are the four-star chiefs of the three British armed services. But even they can pass on specified risks. In the annual report, the MAA suggests that the Defence Secretary will likely have “to release DE&S from compliance with the Military Air Certification Process” with respect to the Airseeker.

Collision Risk

The MAA describes the risk of mid-air collision as “the highest operating risk.” It was highlighted by the fatal collision of two of the RAF’s Tornado combat aircraft in July 2012. Even though the out-of-service date for the Tornado is only five years away, a collision warning system is being procured for the jet.

“I have given a pledge to the Commander of Joint Operations that our work will not be a hindrance to operational freedoms,” AM Garwood told AIN. The MAA’s mission statement requires it “to enhance the delivery of operational capability.” It’s a difficult balancing act, of course. The desired philosophy is demonstrated in an acronym favored by the MAA, which says that air safety risks should be driven “as low as reasonably practical” (ALARP). In recent times, the ODHs have temporarily grounded six British military aircraft types to reassess the risk to air safety.

The MAA has been rewriting all the military air safety regulations to make them “concise, unambiguous and readily accessible.” They were previously of “byzantine complexity,” according to Haddon-Cave. AVM Clark told AIN that the exercise had, to date, been essentially a “repackaging exercise...only five percent of the regulations are new.” Now the MAA is reviewing the regulations “to make them better,” he added. There is broad agreement that they already read much better than before, Clark claimed.

In the annual report, the MAA warned that “the lack of suitable qualified and experienced personnel...is a strategic risk to a self-sustaining safety system and culture.” It painted a rather alarming picture of “air safety being undermined by work that is left incomplete; safety modification work not being progressed; poor supervision; latent risks that remain unqualified, and inappropriate normalization of low standards and behaviors.” There is a well-advertised shortage of qualified personnel at the DE&S, but the MAA says the problem extends “across all disciplines and commands.”

Military vs Civil Ops, according to the MAA

Military:

Hazardous envelope is normal

Deployable maintainers

Aircrew lead, manage and plan

Maintenance locations may move, and may be threatened

Passengers may be armed, and Passengers may be armed and may leave during the flight

Civil:

Safe envelope is the preferred mode

More mature and static maintainers

Aircrew only fly

Maintenance locations are predictable and safe

Passengers are screened and scheduled

What They Say About the MAA

“We’ve asked some difficult questions. That’s why we were created.” Air Vice-Marshal Martin Clark

“The RAF is running scared of prosecution and the civil servants of being fired.”–UK aerospace industry leader

“I don’t see a culture of ‘running scared.’ Our commanders are comfortable with the clarity, and they are empowered to make the right decisions that impact on their people.”–Air Marshal Dick Garwood

“Actually, I found the MAA’s review process to be intellectually stimulating and thought-provoking.”–an RAF Air Commodore responsible for delivering a major operational capability

It’s hard to measure an air safety culture, but it’s definitely improved–I see that as I get out and about.”–Air Marshal Dick Garwood

Farnborough Air Show 2014

AIN Products

SUBSCRIPTIONS

RESOURCES

ABOUT AIN