The Loss of RAF F-35B ZM152: An Organisational Accident

The Loss of RAF F-35B ZM152 from HMS Queen Elizabeth: An Organisational Accident

On 17 November 2021, Lockheed Martin F-35B Lightning II ZM152 (BK-18) of Royal Air Force (RAF) 617 Squadron, crashed into the eastern Mediterranean, during take off from HMS Queen Elizabeth.  As the ship sailed past the wreckage before it sank, an intake blank was seen to float free.

Was the loss of this £81.1 million fighter simply because ‘someone’ was negligent or incompetent?  No.  In this deep dive case study we will demonstrate that real life is more complex.

We look at how the 148 page Service Inquiry Report, published by the Defence Safety Authority on 10 August 2023, identified systemic organisational factors. This requires understanding the organisational context of the accident, not just the actions of individuals in the minutes and hours beforehand.

Organisational Accidents

James Reason, Professor Emeritus, University of Manchester popularised the expression ‘organisational accident’ with his seminal 1997 book Managing the Risks of Organizational Accidents.  He used the term to differentiate simple ‘individual accidents’ involving just one person from complex accidents involving more people, organisations, technology and systems.   Reason explained that:

Organizational accidents have multiple causes involving many people operating at different levels of their respective companies.

Such accidents result from ‘latent organisational failures’ that are like pathogens that have infected the organisation. In the earlier, 1995 book, Managing the Risks of Organizational Accidents, Maurino, Reason, et al give examples:

• Lack of top-level management safety commitment or focus
• Conflicts between production and safety goals
• Poor planning, communications, monitoring, control or supervision
• Organizational deficiencies leading to blurred safety and administrative responsibilities
• Deficiencies in training
• Poor maintenance management or control
• Monitoring failures by regulatory or safety agencies

Reason famously illustrated how pathogens build up through the concept of the swiss cheese model, where each layer of cheese represents a defensive barrier.

Latent holes in the cheese, the pathogens, are introduced by both local workplace and organisational factors that remain dormant until holes in every layer align.  Often the last line of defence is breached by a human action but focusing on that in safety investigations, means the inherent pathogens are ignored and barriers and control remain unfixed.

The Aerossurance visualisation of this model is that as time progresses many of these holes will dynamically change size and position as circumstances change, either increasing or decreasing the risk.

In practice human actions also routinely plug the holes too, knowingly or unknowingly.  Another reason that focusing on the actions or inactions of one individual can mean missing the big picture.

Pathogens as Precursors to this Accident: Critical Context on How the ‘Holes in the Cheese’ were Created

617 Squadron and HMS Queen Elizabeth

In 2017  the National Audit Office (NAO) summarised the wider UK’s Carrier Enabled Power Projection (CEPPP) programme as follows:

After personnel underwent training at MCAS Beaufort, South Carolina, 617 Squadron reformed at RAF Marham, home of the UK Lightning Force, in April 2018 with the F-35B, the Short Take Off and Vertical Landing (STOVL) variant of the F-35.  The aircraft is powered by a Pratt and Whitney F135 engine.  For STOVL operations there is a Rolls-Royce three-bearing swivel nozzle at the rear, a shaft driven vertical lift fan forward and two wing mounted roll posts.

HMS Queen Elizabeth is the first of a pair of 65,000 t Royal Navy aircraft carriers.  She was ordered in May 2008, built in Rosyth, Scotland by the Aircraft Carrier Alliance and commissioned in December 2017.

In September 2018 the first F-35 take off and landings occurred on HMS Queen Elizabeth.

A phased operational introduction of the F-35B to HMS Queen Elizabeth was planned “to gradually build experience and capability”:

617 Squadron had embarked on the HMS Queen Elizabeth in May 2021, ultimately for Operation Fortis, which took the UK Carrier Strike Group (CSG) 21 (CSG21) to the Far East on a 40,000 nautical mile journey. Also onboard was a US Marine Corps (USMC) F-35B squadron VMFA-211 and 7 Leonardo Merlin helicopters from 820 Naval Air Squadron (NAS).  Oddly, though the USMC presence was widely publicised by the UK Ministry of Defence (MOD) at the time, the SI reports redacts any mention of them.

The SI Report states Exercise Strike Warrior 20-2 “established many of the routines and procedures” that would be used for Operation Fortis.  However, later comments challenge the effectiveness of that learning.

HMS Queen Elizabeth departed Portsmouth on 22 May 2021 for Operation Fortis.

The SI Report redacts the number of 617 Squadron F-35Bs deployed but images included in the report (see below) confirm there were eight.  Only three were…

…were fully mission capable at the time of embarkation. The others required engineering activity after they embarked to achieve this standard.

This is reminiscent of HMS Hermes and HMS Invincible famously leaving Portsmouth in April 1982 for the Falklands conflict with every embarked BAe Sea Harrier on deck, even the ones that had no engine fitted…

617 Squadron Maintenance 

Aviation engineering on HMS Queen Elizabeth was coordinated from the Flight Deck and Hangar Operations Centre (FDHOC) on 2 Deck (the hangar deck immediately below the flight deck [1 Deck]).

617 Squadron had a Senior Engineering Officer (SEngO) who was supposed to be either as an RAF Squadron Leader (Sqn Ldr) or a RN Lieutenant Commander (Lt Cdr).  In the two years before Operation Fortis five officers held or were nominated that post, a significant turnover.  Two successive junior officers steeped in while a SEngO was recruited (including during the crucial Exercise Strike Warrior 20-2), with one of the five nominated but decline the role it would need an extended familiarisation period, lengthening their tour and impacting their “career timeline”. 

The SEngO appointed in May 2021 only gained the Level J authorisation needed for the role on 1 May 2021, having been a helicopter squadron Junior Engineering Officer (JEngO) and an F-35B Trials Management Officer previously.

Within 617 Squadron the SEngO was supported by two JEngOs and a Warrant Officer Engineer (WOEng).  Only one “had completed more than one of the workup embarkations”.

Personnel who had gained embarked experience and built relationships during the previous work-up exercises had been posted and the new officers had to re-learn…introduction risk…”.

For an F-35 squadron the UK assumed 12 `Direct Maintainer Spaces per Aircraft’ (DMSpA) would be needed as a minimum.  This mean 12 personnel at RAF Sergeant or RN Petty Officer rank and below.  However, addition an extra margin would be required “to accommodate postings and long-term downgrades…leave and training courses”.

However, the SI report states that:

Since its inception the UK F-35 workforce was under resourced. This resulted in an inability to generate sufficient aircraft to deliver the required operational capability.

The report then contains some redacted comparative personnel information but one source has concluded that:

• 617 Squadron embarked in HMS Queen Elizabeth with 8 aircraft and 113 maintenance personnel (14 per aircraft)
• VMFA-211 embarked with 10 aircraft and 255 personnel (25 per aircraft)

Prior to Operation Fortis only 55% of 617 Squadron had previous experience at-sea, with only 77% having completed the Embarked Forces Sea Survival Course (EFSSC).  To commence Operation Fortis 617 Squadron had to exchange 13 maintenance personnel with the Operational Conversion Unit (OCU), 207 Squadron (though in another place the report says 15).  They got back less experienced but “medically deployable personnel”.  Another 14 joined straight from training.  Unlike RN training “Lightning RAF engineers did not have a training pathway to qualify in flight line servicing” resulting in a smaller pool of personnel who could work on deck doing see-offs.  Then 12 personnel from 617 Squadron subsequently returned home, without replacement, for either personal or health reasons.  This resulted in:

…disrupting squadron cohesion and creating inefficiency in the Lightning Force as a whole…

The Lightning Force at RAF Marham had already…

…raised the risk of ‘Insufficient workforce to meet the operational requirement’ on the [RAF’s] Performance And Risk Management Information System (PARMIS) and assessed it as ‘HIGH’ risk (frequent/critical).

There was also another HIGH entry in PARMIS for “training deficiencies creating inability to…meet Op tasking”.  THE SI Panel decided this risk was owned at too low a level in the organisation.

To aggravate these issues, the SI report states that:

It was not until the commencement of Operation Fortis that it was discovered just how much carrier operations increased demands on see-off teams.

617 Squadron F-35B About to Take Off from HMS Queen Elizabeth (Credit: RAF – Crown Copyright)

Aircraft were required to be moved around the deck more frequently than was the case on an airfield, placing an additional workforce demand on the Squadron. Also, see-offs required additional tasks such as last-minute refuelling and management of [tie-down] chains, which required more engineers. The combined effect of these was that a larger engineering workforce was needed when embarked compared to land-based operations.  This resulted in personnel being drawn from maintenance work in the hangar.

The SI Panel determined that…

…carrier operations required even more engineers than the DMSpA figure suggested.

It is not clear what reassessment, if any, of the already ‘High’ risk occurred during the 6 months of Operation Fortis once this was realised.  Its also not clear, especially after years of preparatory planning, training with the USMC in the US, Exercise Westlant in 2019 and Exercise Strike Warrior 20-2, why this seems to have been a surprise.  Especially as:

In January 2020 the Royal Navy Flight Safety Centre commissioned the Institute of Naval Medicine (INM) to support a study into Human Factors in embarked operations. The INM report, published in April 2020, found that the most common challenge was fatigue induced by working routines, compounded by time pressure, environmental conditions and insufficient workforce. It recommended the use of fatigue management tools during pre-deployment planning, preservation of maintenance and rest days and provision of adequate workforce. Without such provisions, supervisors commented that they observed an increase in errors and physical signs of fatigue in their teams.

An unspecified fatigue related occurrence with an unspecified unit on HMS Queen Elizabeth in June 2020 that should have further underlined a need for action.

To manage fatigue, 617 Squadron was working to a Duty Holder Advice Note (DHAN), endorsed by the squadron Officer Commanding (OC) and the Lightning Force Delivery Duty Holder (DDH), the RAF Mahram Station Commander, that set out three possible operational tempos (the details of which were redacted):

• Routine
• Maintenance Day
• Surge Ops

These were assessed to be “difficult to interpret and apply to real life operational scenarios”.  The CSG desired baseline flying rates said to be closer to ‘surge’ during Operation Fortis.

617 Squadron’s engineers were frequently required to exceed the [documented] limitations. The reality of a flying programme with six days flying followed by one no-fly day was that the engineers would invariably still be required to work on that no-fly day.

In contrast the SI Panel commented, once the redactions are deciphered [and our emphasis added] that:

The [USMC] approach was to sustain a high rate of operational flying…and [were] appropriately
resourced to do so.

The implication being, the US squadron was achieving more flying than the RAF.  Which a reader might speculate would result in maintaining a pressure on 617 Squadron to achieve a surge tempo.

Additionally:

This [USMC] approach applied pressure to minimise periods when the flight deck was not available for flying operations. This decreased opportunities for fresh air and recreation for those without routine access to outside spaces, thereby contributing to fatigue.

Witnesses described HMS Queen Elizabeth as ‘the largest submarine in the Navy’. Engineers were often unrepresented at planning meetings, so their fatigue issues were sometimes not considered.

617 Squadron adopted a two shift pattern, apparently then modified to better suit the ship’s meal service times, that the DSA considered so sensitive that details of it needed to be redacted in the SI report.  COVID-19 restrictions and the working tempo restricted the opportunity for personnel to recuperate.  Having to modify 5 aircraft to be fully mission capable at the start of the deployment was another complexity that added early workload.

The report then discusses heat stress further and how “the effect of being in extreme temperatures for prolonged periods [during see-offs] was very likely to have heightened the fatigue levels” in the small pool of personnel qualified to work on see-offs.

Overall:

Many personnel across all departments remarked that the deployment was extremely fatiguing. The Principal Medical Officer (PMO) stated that they had observed everyone on the ship as being very tired by the end of Operation Fortis, and morale in some quarters was very low.

RAFCAM [RAF Centre for Aviation Medicine] HF [Human Factors] specialists observed that the accident occurred approximately six months into the deployment and it was likely that personnel were experiencing the effects of accumulative fatigue at that stage.

They noted that without adequate rest fatigue accumulates and as fatigue accumulates, attention span gets narrower and human anticipation of accuracy and timing degrades leading to lower performance standards being tolerated. They stated that personnel would have been more susceptible to degraded performance, reduced attention and the chances of errors occurring.

No specific information is recorded in the SI Report on the actual rest and duty times of the personnel connected to ZM152 in the last 24 hours before the accident.

Red Gear

Each F-35B had a set of protective covers known as ‘Red Gear‘, which could be fitted as required between flights.

A full set comprised of:

Smaller elements of Red Gear (e.g. the air data pitot probe covers, flush port covers and earth bonding lead) were kept in a small, hardened case in the i. The larger items (e.g. the intake, exhaust and PTMS blanks) were kept in a caged pallet store (known as a ‘Thatcham‘) on Deck 4, remote from the aircraft.  These were not controlled in the way that tools were.

617 Squadron recorded fitment and removal of Red Gear in accordance with ‘Work Instruction – RED GEAR CONTROL and MANAGEMENT’ [in a Red Gear Log].

The log, which lists 8 aircraft and an image of the Red Gear allocations confirm 8 aircraft were deployed (invalidating the redactions made).

The structure of the log made it difficult to identify how many sets of Red Gear were issued at anyone time (something a database or a tally system would have aided).  It was also not unusual for only individual items of Red Gear to be used for certain maintenance activities, something the log did not cater for. Hence:

The use of the Red Gear log was inconsistent and the absence of corrections suggested that it had not been checked at any time.

Furthermore:

The instruction was amended in September 2021. Prior to this… the rectification controller was required to record in a log, located in the FDHOC [on Deck 2], when Red Gear was fitted to aircraft. This provided a quick reference that Red Gear would need to be removed before clearing an aircraft for flight. The…amendment moved the log to the issue centre [on Deck 4], where it was inaccessible if the issue centre was closed.

By the time of the accident three different intake blank designs had been used.  The original Lockheed Martin design, a wrap around cover secured by pip-pins, was difficult to fit and the pip-pins caused skin damage.  At MCAS Beaufort locally manufactured intake plug blanks were initially acquired.  These were ultimately replaced by a Lockheed Martin plug design.  This blank had “two nylon handles to assist with installation and just one pip-pin to secure to the lower edge of the intake in the event it became dislodged. A pocket was provided for the pip-pin to be stowed during installation, removal and storage”.

The single pip-pin appears not to have been routinely used due to continued concern about airframe damage. Investigators raised concerns that the design may not have considered use in high wind on a carrier deck and was not consistently addressed in procedures and technical publications.  In fact, there were no published procedures for installing intake blanks in use.  This was partly because of confusion on whether Red Gear was an RAF Lightning Force MilCAM (Military Continuing Airworthiness Manager) or a DE&S Lightning Delivery Team responsibility.

The words ‘REMOVE BEFORE FLIGHT’ was marked on the blanks but the characters were also found to peel off presenting a FOD hazard. During the deployment on HMS Queen Elizabeth 617 Squadron engineers removed the lettering from the intake blanks having “raised awareness of the FOD issue by raising a Defence Air Safety Occurrence Report (DASOR)”.

Other DASORs had been raised since early 2018 on Red Gear becoming dislodged, though investigators imply that reporting was likely to be inconsistent in cases where Red Gear had simply been found dislodged and was then reseated.

Red Gear issues where seen as just a ‘nuisance’ and had not been identified in the F-35 risk to life (RtL) model produced by the Lightning Delivery Team.

This resulted in learned behaviour of the poor performance of the Red Gear being a [normalised] feature of F-35B operations.

On the flight deck, experience had shown that “intake and exhaust blanks could be blown out by modest wind or aircraft launching nearby” and DASORs had been raised.  Consequently a formal, risk assessed, procedural deviation had been agreed and recorded to not routinely fit these items when at sea unless there were security reasons.

Due to its nature as a ‘low observable’ (or ‘stealth‘) design the F-35B was subject to enhanced security as a Special Access Programme (SAP).  In particular certain design features that would be obscured by the Red Gear was considered sensitive.  The SI report also noted that:

During routine flying operations only those personnel with duties on the flight deck were permitted there. On rare occasions, if flying activity was not being conducted, the deck was opened for recreation to other personnel. On one of these recreation days a DASOR was raised due to recreational activities infringing aircraft security.

Ironically, in illustrating that a blank could be come dislodged and be difficult to see within the F-35Bs intakes, the Service Inquiry published photographs of the intake.

However, there were other reasons to fit blanks when at sea.  At least one DASOR was raised for several events where F-35B jet exhaust eroded the top layer of anti-slip paint from the flight deck and paint debris had been found in parked F-35B intakes.

Prior Red Gear Intake Obstruction Incidents in the F-35 Fleet

The SI Report lists the following:

• 23 September 2014, Eglin AFB, F-35A USAF: The pilot reported an engine stall on take-off, with loud bangs and throttle unresponsive. An intake plug was found ingested into the intake and stuck on the front face of the engine.
• 10 September 2015, MCAS Yuma, F-35B USMC: A low power ground run was performed with the left intake blank inside the aircraft. The intake plug had gone un-noticed during two previous ground runs.
• 26 July 2018, Hill AFB, F-35A USAF: The pilot advanced the throttle to 78%, and at 26 kts heard a loud bang and observed black smoke from the exhaust. An intake blank was found in the aircraft.
• 21 January 2020, VFA-125, F-35C US Navy: A low speed abort on take-off was conducted due to the intake cover still installed. The intake cover was found lodged in the intake of the aircraft. This was reported in ‘F-35 safety events’ 16-31 Jan 20, newsletter released to all F-35 operators

There were also 8 prior UK DASORS and one additional witness report of blanks blowing away, becoming dislodged or degrading prior to the intake blank becoming dislodged on ZM152.  However:

Given that the F-35 was an international programme, UK reporting was but a small piece of the overall picture. The [SI] panel considered it more than likely that other Red Gear issues were going unreported across the F-35 community, so the threat to air safety was under appreciated.

The SI Panel are thus suggesting that other nations are not as forthcoming on precursor occurrences as the UK.  Though it is not clear in the SI Report if the UK shared data with other nations.  The report does state that “the panel opined that hazard perception of Red Gear, and its potential to cause the loss of an aircraft, was low”, which suggests that sharing was unlikely.

617 Squadron Quality Assurance

The report describes a quality assurance programme of:

• unit self audits
• RAF Standards Evaluation visits (“typically” 6 per annum)
• A station level ‘internal’ annual audit of each squadron
• An Air Command ‘external’ audit every two years

An anomaly in the UK military system, that the SI report does not comment on is that while the regulator, the UK Military Aviation Authority (MAA) audits civil contractors who are approved to maintain military aircraft, no such audits occur of military maintenance organisations.

The SI Report states that the onset of COVID-19, 20 months before the accident, had “significantly impacted” the QA programme.  From March-July 2020 there was a “complete stop” and there was “decreased activity during subsequent COVID-19 lockdowns”.

In the 37 months between 617 Squadron reforming at RAF Marham in April 2018 and their departure on Operation Fortis in May 2021 only the following two audits occurred (the SI report makes no comment on self-audits or Standards Evaluation visits in this period):

• An internal (i.e. station level) audit in September 2019: “This identified 14 quality occurrence reports (QOR) and 15 observations for action, which the panel judged to be a significant number.  It highlighted low morale amongst junior ranks and a lack of basic standards. One QOR identified four issues with Red Gear, including poor management of blanks, blanks being mixed between aircraft sets and incorrect stowage of blanks. The root cause of these was insufficient provision of sets of Red Gear”.
• An external (i.e. Air Command) audit in August 2020.  “It remarked that the…self-audit programme was ineffective, and the RAF Marham Quality Management System provided only ‘limited assurance’. It highlighted that there was insufficient Red Gear, and that it was inadequately managed”.

The SI Report postulates a decrease audit resulted in the immaturity of Lightning Force (i.e. RAF Marham) and 617 Squadron engineering orders (i.e. procedures).  However, the two recorded audits both highlighted issues with Red Gear control and the SI Panel suggests that post audit follow-up action was inadequate.  Hence, the mention of COVID-19 seems, at least in part, a red herring, especially as there seems to be no mechanism to ensure independent audits would occur during embarked operations on an aircraft carrier, and as we will see the operating environment had a big influence on this accident.

The Accident: How the ‘Holes in the Cheese’ Lined Up

Events in the Days Prior to the Accident Flight

After a port visit to Duqm, Oman, HMS Queen Elizabeth sailed on 7 November 2021 and conducted routine flying exercises until 13 November 2021 when it entered the Red Sea, en route for the Suez Canal.  On 14 November 2021 there was no flying as the flight deck was closed for a Remembrance
Sunday service. During the service, around 20 personnel required medical support due to the heat.  The rest of the day was an afternoon off for much of the crew.

On 15 November 2021 there was no flying as there were a series of flight safety events and briefings that ironically covered human factors and refresher training for deck operations.

For most of 16 November 2021 the HMS Queen Elizabeth conducted a transit through the Suez Canal.  Red Gear was required to be fitted.  E-mail communications about this was only sent to the JEngOs and Executive Officer of 617 Squadron. No evidence was found by the SI that this “was shared with the trade desks, line or rectification controllers, and their handover notes contained no reference to planning that included Red Gear fitment”.  Fitment only occurred late on 15 November 2021 when a security officer gave a verbal reminder to the line team.  As they were fitted in the dark it would have been difficult to confirm they blanks were correctly seated.  The fitment was not recorded in the handover diary as no engineering management were present at the time.  Maintenance personnel were not allowed on the flight deck during the transit so there was no opportunity to observe the Red Gear was still in place and secure.

On the evening of 16 November 2021 an engineer shift commenced.  There was only a written handover from the previous shift as maintenance personnel had been stood down during the Suez Canal transit.  That night Post Operation Servicing (POS) and Before Operation Servicing (BOS) tasks were conducted in accordance with Joint-Service Technical Data (JTD).

The weather was described as “very windy” and personnel “lean into the wind when walking on the flight deck.”

Two maintenance personnel independently worked on ZM152 (called Eng 1 & 2 in the SI Report), partly because Eng 2 had been required to help move storage containers around the hangar.  Splitting the team so they worked independently was unhelpful.  Additionally:

Operations on the flight deck at night were hazardous so a `two-man rule’ was in place so that engineers would not work solo.

Both maintenance personnel considered the presence of other people on deck was satisfactory means of compliance.  This ‘rule’ was in fact only a verbal local order, briefed at an unspecified time prior.  Not only was this therefore open to interpretation but being verbal, can barely be considered a ‘rule’ in the conventional sense.

The Eng 1 commenced their aspects of the servicing shortly after 21:30 and was completed no later by 23:00.  At that point:

Eng 1 collected the right intake and PTMS blanks and took them down to the Thatcham in the hangar. After this they returned the tools to a makeshift tool tidy in the crew room for Eng 2 to use and mentioned to Eng 2 that their parts of the servicing were complete but did not discuss which blanks had been removed.

After a mid-shift meal, Eng 2 started their work at 00:30.  Eng 2’s tasks were also delayed due to a thunderstorm warning that temporarily precluded certain tasks.

[T]he only piece of Red Gear they observed was the exhaust blank lying on the deck just behind BK-18, which they returned to the issue centre.

No further comment is made about this in the SI report and may indicate loose blanks were a known and common issue.

[W]eather on the flight deck was windy and upper surfaces of the aircraft were wet from recent rain. [Eng 2] elected not to climb on top of the aircraft to carry out the upper surfaces inspection, considering that the protective overboots required to walk on top of the aircraft provided poor traction in the wet.

This omission should have been recorded in a deviation register but was not.

Servicing was complicated by an understanding that white light could not be used on the flight deck at night to persevere the bridge team’s night vision.  The torches in use had blue, green or red filters.  Investigators could not find any evidence of this ‘understanding’ in any of the ship’s orders, briefings or training.  The use of filtered light increased the chances that debris in an engine intake, for example, would not be seen.

On completion of their parts of the POS/BOS, at approximately 02:50, Eng 2 returned all tools to the issue centre and the exhaust blank to the Thatcham. On checking the Red Gear log at the issue centre, Eng 2 discovered that there was no entry for the fitting of blanks to BK-18 [ZM152] following the last removal on 7 November 2021, upon leaving Duqm Port. They discussed this with the issue centre custodian (ICC) and concluded that the exhaust blank had inadvertently been left fitted when all other Red Gear had been removed.

During operations on deck on the morning of 17 November 2021 an exhaust blank was dislodged from one British F-35B by jet blast from a US F-35B at c 06:47 but recovered by aircraft handlers.

The dislodged exhaust blank was brought down to the FDHOC… handed to the 617 Sqn line supervisor and was subsequently sent to the Thatcham in the hangar. The 617 Squadron JEngO in the FDHOC was informed, who initiated a recall of the night shift and sent them to the flight deck to recover the Red Gear. All visible 617 Squadron blanks were recovered at 07:57 and stowed in the Thatcham.

However:

No blanks were recorded as being removed from aircraft on the Red Gear log held in the issue centre.

Also the Red Gear was stowed in the Thatcham in a haphazard manner, spilling out on to the hangar floor, complicating verification that all items were removed .

At around 07:45 another exhaust blank was seen to fall into the sea.  This had been left in an aircraft because its tail overhung the deck edge so removal could only occur when it was towed forward.

The loss of the aircraft blank was reported to 617 Squadron in the FDHOC. The ICC raised a DASOR for the loss.

A range of Red Gear issues were discussed briefly prior to the first 617 Squadron launch, however…

…the JEngO and rectification controller were preoccupied with management of [a defensive] flare load. This load was not specified in Lightning Force (LF) orders, and so 617 Squadron wrote temporary orders for themselves for Operation Shader [combat operations against Daesh in Syria & Iraqi]. These orders had not been used in the intervening four months and the JEngO and rectification controller were focussed on re-reading and debating the flare load policy and procedures rather than on the Red Gear.

Investigator concluded that there was a perception “that Red Gear was only a risk to other aircraft or personnel, not a threat to airworthiness of the aircraft to which it was fitted” and so “treated less rigorously” than other items such as tools.

The Accident Flight

A two ship of ZM152 and ZM155 was to be the first launches of UK F-35Bs that day.

A see-off is the process by which maintenance personnel support the pilot’s walkaround, the pilot’s boarding and engine start until the aircraft taxies from its parking space.  On land a ‘see-off’ involves one or two maintenance personnel.  During Operation Fortis this was expanded to a team of three plus a supervisor to assist with refuelling and removal of chocks and lashings.  We would observe that while more people might nominally reduce risk, giving more eyes on the aircraft, it does magnify the potential for communication or coordination issues too.

In accordance with the F-35B Flight Manual…

….pilot’s walkaround included an inspection of both engine intakes, the exhaust, and a general visual inspection of the aircraft. Due to the noise on the flight deck, the pilots wore their helmets throughout the walkaround. BK-18’s pilot noticed the undercarriage pins were still installed, removed them and handed them to the see-off team.

At 11:37, ZM152 taxied onto the runway.

The Ship was sailing at a steady speed of 5 kts, which gave 12 kts wind over the deck.

ZM152’s take off commenced.  The associated paragraph of the SI Report is unhelpfully fully redacted.  However, the Interim SI Report, issued on 22 March 2022, was less coy, explaining that:

The aircraft converted to short take-off mode and at the direction of the Captain of the Flight Deck the pilot conducted engine run up checks, confirmed all engine indications were normal, selected take-off power, 97% Engine Thrust Request (ETR), and released the brakes.

The pilot reported that the initial acceleration felt normal, but then decreased. On checking the engine displays they discovered that the power was low, at 74% ETR. The pilot then selected maximum (100% ETR) but the engine continued to deliver lower than expected power.

Due to the resulting low speed of ZM152, the pilot attempted to abort the take-off but was unable to stop the aircraft before the end of the ramp and ejected.

From commencing the abort to reaching the top of the ramp took 3 seconds.  A leaked video of the take off resulted in a sailor being arrested.

The ejection was successful, the parachute deployed, and the pilot landed on the flight deck suffering only minor injuries.  The aircraft impacted the sea and was seen to be afloat passing down the port side of the Ship before it subsequently sank.

The accident was covered in a BBC Documentary (see 39:12 onwards):

Emergency Response & Salvage Operations

During the emergency response there was some confusion as an initial tannoy broadcast was that the aircraft had ditched, then the Crash on Deck (COD) alarm was sounded, before a third tannoy call stated their was a casualty on deck.  This resulted the the responding medical team being split between two muster points.  The pilot’s Personal Locator Beacon (PLB) activated automatically during the ejection sequence, sending a 406 MHz distress message. A communication embargo unhelpfully delayed the ship contacting the rescue co-ordination authorities to inform them that SAR activity was not required.

Prior to sinking, the left-hand intake blank was observed to float clear of ZM152’s wreckage…

The intake blank was recovered by HMS Queen Elizabeth’s sea boat.

The pip-pin remained stowed in the storage pocket, indicating that it had not been used.

The wrecked had to be salvaged from a depth of 2,000 m, which was rapidly achieved with multi-national cooperation and chartered vessels at a cost of £2.63 million ($3.35 million).

The aircraft was discovered, by remotely operated vehicle, inverted on the seabed, intact with a few minor parts such as the ejection seat detached but close to the airframe.

Technical Safety Investigation

The F-35 is fitted with an electrostatic Intake Debris Monitoring System (IDMS) with two sensors in the engine intake.  Based on the recorded data investigators concluded the intake blank was “laying against the front face of the engine”.  Examination of the recovered intake blank found damage consistent with it being…

…in contact with the variable inlet vanes. This would have caused the engine to produce insufficient thrust for a successful launch.

Examination of recorded engine data showed that:

There was a minimum of 17% deficit between demanded and delivered thrust, which equated to 38,000 lb thrust requested, but only 31,500 lb of thrust delivered. There was a lag between the time the 97% and 100% ETRs were demanded, and the 80% maximum was delivered.

The time spent at a significantly lower than demanded thrust resulted in the poor acceleration.

The pilot reported that the engine indicated it was providing thrust equivalent to 74% ETR at the point of the abort.  This low power state was also recorded in the HMD video.

This figure was the total thrust of the main engine, roll posts [the wing mounted nozzles that provide roll control] and lift fan combined. The forward momentum of the aircraft during the take-off roll was provided by the main engine thrust. This forward thrust was around 55% of that which would normally be generated.

The engine rotational speed and air mass flow rates were lower than nominal for a STO launch so the FADEC [Full Authority Digital Engine Control] matched the fuel flow accordingly.

There was no ICAW [Integrated Caution, Advisories and Warnings] alerting the pilot that the FADEC was limiting fuel or that the engine had not reached the desired thrust.

Trials at RAF Marham showed their was variability in installation of the blanks, which relied on the friction between their sides and the intake to resist wind loads.  The rain on the evening of 16 November 2021 is also likely to have reduce the friction.  Further experimentation showed that:

The [intake] blank could become unstable and fall into the intake at wind speeds much less than the design requirement of 35kts.

The standard procedure for F-35Bs on HMS Queen Elizabeth to take-off from as far forward on the deck as possible, usually 350 ft, was considered to be an aggregating factor, as simulations showed that with 500 ft a successful abort would have been possible.

The investigation conformed that the Martin Baker Mk16E ejection seat “operated as expected” with the exception that the arm restraint system did not perform as expected.  This was not an issue in a low speed ejection and appears to have been poor fitment.  Although the pilot did not inflate his life jacket, subsequent examination determined that it suffered a dormant failure where only one stole would inflate due to poor packing.  This was similar to a fining identified after a 25 March 2021 accident to Royal Navy Hawk T1 XX189.

The Service Inquiry Findings & Safety Recommendations

The SI Panel concluded that the causal factor was that “the left intake blank was at the front face of the engine compressor during the aircraft launch”.  They then identify 26 ‘contributory’, 1 ‘aggravating’ and 25 ‘other’ factors.  They then make 46 recommendations to 15 different post holders.

Convening Authority Comments: What the Director General Defence Safety Authority Added

The three pages of comments by DG of the DSA contained the following paragraphs:

• Introduction
• Red Gear: Which claims “basic procedures for the control of equipment were not
  fully followed”, ignoring that their were major gaps identified by the SI Panel in procedures, but also a crucial acknowledgment that the Red Gear was not fit for purpose,.
• Security vs safety: Which states that “complex interaction of safety and security requirements” were “not fully appreciated”.  This is ironic considering the mess made of redacting this report for publication.
• Life Jacket Urgent Safety Advice: the DG comments positively on the action taken but not on the seemingly slow response after the Hawk accident 8 months earlier.
• Lightning Force: while acknowledging “insufficient workforce, training shortfalls and inexperience”, the DG takes the view that this is simply because of not reaching a nebulous “critical mass” rather than the result of the prior strategic decisions on the entry to service of the type, resourcing and tasking.  He vaguely adds that “Defence must recognise the trade-offs between readiness, growth and safety” without advocating a specific change in plans, processes or behaviour.
• Conclusions: In the penultimate paragraph he states that 20% of Lightning Force DASORs have been classified as involving Failure to Follow Process [sic] (F2FP) vs 15% overall (something not discussed by the SI Report).  He cites two landing gear pin incidents on the 2022 CSG deployment, indicating an over-focus on non-compliant behaviour.  He adds that, reactively, he has asked the MAA “to conduct a risk-based assurance audit of…the Lightning Force”, which would have been more useful before a major deployment.  However, he then more reflectively states: “With the pace of F-35 operations increasing, and the UK aspiring to continue to expand its CSG deployments, this accident delivers a timely reminder to take stock and ensure we are giving the Lightning Force the best chance of success”.

Our Safety and Programme Management Observations

Describing the organisational context before describing the events immediately proximate to the accident helps avoid focusing simply on individuals (a common mistake).

In this case a shortage of suitably qualified and experienced personnel & lack of continuity, immature or absent procedures, an ambitious operating tempo and extreme operating environment all conspired to make maintenance during Operation Fortis challenging.

The Red Gear was poorly designed, there were no procedures for their fitment, the procedure to control them was weak and neither the paperwork or their storage made visually identifying missing items easy.

Noticeably many of what Reason called pathogens seem to have been identified by risk assessments, safety reports, audits and commissioned research before the accident, yet there was an inability to either fuse this safety insight or to effectively act on it.

The NAO had also stated back in 2017 that the MOD had “set out an ambitious Carrier Enabled Power Projection (CEPP) schedule”.  They also commented:

The NAO found there is increasing pressure on a few highly trained personnel to operate the capability. There is a shortage of military personnel, running at 4% below a target strength of 145,560. Staffing gaps include engineering roles and warfighting specialists in the Royal Navy and engineering, intelligence and some aircrew cadres in the RAF.

Paradoxically perhaps the more that risks are identified but not addressed, the more they become accepted across the organisation.

The SI neither examines the effectiveness of Safety Management System (SMS), the prevailing organisational culture or the strategic resourcing decisions.

Ultimate, when all the holes in the cheese lined up and one intake blank remained ‘fitted’ to ZM152, it migrated out of sight down the intake, ultimately being at the front face of the engine, and so was not identified during pre-flight preparations.

It is noticeable that only one, short three week UK F-35B embarked deployment, CSG22, occurred in 2022 as part of Operation Achillean.

The UK’s second F-35B squadron, 809 Naval Air Squadron (NAS),whose formation was announced in 2013 was expected to form in 2018.  On 12 September 2022 Minister for the Armed Forces, James Heappey announced that this was to slip to 2023Q2.  This has still to occur, meaning the Lightning Force Full Operating Capability (FOC), when two squadrons can be deployed simultaneously, targeted for 31 March 2025 is also likely to slip farther (in 2021 FOC was expected in 2023).  Perhaps this is a sign that expectations have been adjusted to safely match the limited resources available.

HMS Queen Elizabeth is expected to deploy again to northern European waters for CSG23 before the end on 2023, while sister ship HMS Prince of Wales will deploy to the US eastern seaboard for Westlant 23.

Safety Resources

UPDATE 26 October 2023: ATSB issue safety recommendations after Saab 340 taxied for flight with a horizontal stabiliser bung still installed.

You may also find these Aerossurance articles of interest:

• What Lies Beneath: The Scope of Safety Investigations
• How To Develop Your Organisation’s Safety Culture
• James Reason’s 12 Principles of Error Management
• Psychology of Blame
• Airworthiness Matters: Next Generation Maintenance Human Factors
• Aircraft Maintenance: Going for Gold?
• B1900D Emergency Landing: Maintenance Standards & Practices
• Meeting Your Waterloo: Competence Assessment and Remembering the Lessons of Past Accidents
• Loss of RAF Nimrod MR2 XV230 and the Haddon-Cave Review
• RCAF Production Pressures Compromised Culture
• ‘Procedural Drift’: Lynx CFIT in Afghanistan
• Inadequate Maintenance, An Engine Failure and Mishandling: Crash of a USAF WC-130H
• Investigation into F-22A Take Off Accident Highlights a Cultural Issue
• Inadequate Maintenance at a USAF Depot Featured in Fatal USMC KC-130T Accident
• USMC CH-53E Readiness Crisis and Mid Air Collision Catastrophe
• MC-12W Loss of Control Orbiting Over Afghanistan: Lessons in Training and Urgent Operational Requirements
• A Second from Disaster: RNoAF C-130J Near CFIT
• Culture and CFIT in Côte d’Ivoire
• Culpable Culture of Compliance?
• A Railroad’s Cult of Compliance
• Performance Based Regulation and Detecting the Pathogens
• Metro-North: Organisational Accidents and Shelfware

Also:

• Safety Performance Listening and Learning – AEROSPACE March 2017
• Learning from Adverse Events: Includes nine principles for incorporating human factors into learning investigations.
• The Royal Aeronautical Society (RAeS) has launched the Development of a Strategy to Enhance Human-Centred Design for Maintenance.  Aerossurance‘s Andy Evans is pleased to have had the chance to participate in this initiative.
• Helioffshore Maintenance Resilience White Paper. Aerossurance‘s Andy Evans also contributed to this white paper.

Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements:

MOP is neither another audit or a competence assessment.

Aerossurance’s Andy Evans was recently interviewed about safety investigations, the perils of WYLFIWYF (What-You-Look-For-Is-What-You-Find) and some other ‘stuff’ by with Sam Lee of Integra Aerospace:

---

Final Word

A public inquiry chaired by Anthony Hidden QC investigated 1988 Clapham Junction rail accident. In the report of the investigation, known as the Hidden Report, he commented:

There is almost no human action or decision that cannot be made to look flawed and less sensible in the misleading light of hindsight.  It is essential that the critic should keep himself constantly aware of that fact.

---

Aerossurance has extensive safety management, culture & leadership, flight operations, airworthiness / maintenance, human factors, aviation regulation and safety analysis experience.  For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com

Follow us on LinkedIn and on Twitter @Aerossurance for our latest updates.