Boeing Max problems foreshadowed in 2009 TK crash

[dagger]

I'm putting this as a separate topic because the New York Times provides significant detail about this crash and how Boeing made sure its implications were minimized and contained.

 

https://www.nytimes.com/2020/01/20/business/boeing-737-accidents.html?action=click&module=Top Stories&pgtype=Homepage

 

How Boeing’s Responsibility in a Deadly Crash ‘Got Buried’

By Chris Hamby

Jan. 20, 2020, 6:00 a.m. ET

Lessons from the 2009 accident would have newfound relevance in tragedies years later.Ade Johnson/Agence France-Presse — Getty Images

After a Boeing 737 crashed near Amsterdam more than a decade ago, the Dutch investigators focused blame on the pilots for failing to react properly when an automated system malfunctioned and caused the plane to plummet into a field, killing nine people.

The fault was hardly the crew’s alone, however. Decisions by Boeing, including risky design choices and faulty safety assessments, also contributed to the accident on the Turkish Airlines flight. But the Dutch Safety Board either excluded or played down criticisms of the manufacturer in its final report after pushback from a team of Americans that included Boeing and federal safety officials, documents and interviews show.

The crash, in February 2009, involved a predecessor to Boeing’s 737 Max, the plane that was grounded last year after accidents in Indonesia and Ethiopia killed 346 people and hurled the company into the worst crisis in its history.

A review by The New York Times of evidence from the 2009 accident, some of it previously confidential, reveals striking parallels with the recent crashes — and resistance by the team of Americans to a full airing of findings that later proved relevant to the Max.

In the 2009 and Max accidents, for example, the failure of a single sensor caused systems to misfire, with catastrophic results, and Boeing had not provided pilots with information that could have helped them react to the malfunction. The earlier accident “represents such a sentinel event that was never taken seriously,” said Sidney Dekker, an aviation safety expert who was commissioned by the Dutch Safety Board to analyze the crash.

Dr. Dekker’s study accused Boeing of trying to deflect attention from its own “design shortcomings” and other mistakes with “hardly credible” statements that admonished pilots to be more vigilant, according to a copy reviewed by The Times.

The study was never made public. The Dutch board backed away from plans to publish it, according to Dr. Dekker and another person with knowledge of its handling. A spokeswoman for the Dutch board said it was not common to publish expert studies and the decision on Dr. Dekker’s was made solely by the board.

At the same time, the Dutch board deleted or amended findings in its own accident report about issues with the plane when the same American team weighed in. The board also inserted statements, some nearly verbatim and without attribution, written by the Americans, who said that certain pilot errors had not been “properly emphasized.”

The muted criticism of Boeing after the 2009 accident fits within a broader pattern, brought to light since the Max tragedies, of the company benefiting from a light-touch approach by safety officials.

References to Dr. Dekker’s findings in the final report were brief, not clearly written and not sufficiently highlighted, according to multiple aviation safety experts with experience in crash investigations who read both documents.

One of them, David Woods, a professor at the Ohio State University who has served as a technical adviser to the Federal Aviation Administration, said the Turkish Airlines crash “should have woken everybody up.”

Some of the parallels between that accident and the more recent ones are particularly noteworthy. Boeing’s design decisions on both the Max and the plane involved in the 2009 crash — the 737 NG, or Next Generation — allowed a powerful computer command to be triggered by a single faulty sensor, even though each plane was equipped with two sensors, as Bloomberg reported last year. In the two Max accidents, a sensor measuring the plane’s angle to the wind prompted a flight control computer to push its nose down after takeoff; on the Turkish Airlines flight, an altitude sensor caused a different computer to cut the plane’s speed just before landing.

Boeing had determined before 2009 that if the sensor malfunctioned, the crew would quickly recognize the problem and prevent the plane from stalling — much the same assumption about pilot behavior made with the Max.

And as with the more recent crashes, Boeing had not included information in the NG operations manual that could have helped the pilots respond when the sensor failed.

Even a fix now proposed for the Max has similarities with the past: After the crash near Amsterdam, the F.A.A. required airlines to install a software update for the NG that compared data from the plane’s two sensors, rather than relying on just one. The software change Boeing has developed for the Max also compares data from two sensors.

Critically, in the case of the NG, Boeing had already developed the software fix well before the Turkish Airlines crash, including it on new planes starting in 2006 and offering it as an optional update on hundreds of other aircraft. But for some older jets, including the one that crashed near Amsterdam, the update wouldn’t work, and Boeing did not develop a compatible version until after the accident.

The Dutch investigators deemed it “remarkable” that Boeing left airlines without an option to obtain the safeguard for some older planes. But in reviewing the draft accident report, the Americans objected to the statement, according to the final version’s appendix, writing that a software modification had been unnecessary because “no unacceptable risk had been identified.” GE Aviation, which had bought the company that made the computers for the older jets, also suggested deleting or changing the sentence.

The Dutch board removed the statement, but did criticize Boeing for not doing more to alert pilots about the sensor problem.

Dr. Woods, who was Dr. Dekker’s Ph.D. adviser, said the decision to exclude or underplay the study’s principal findings enabled Boeing and its American regulators to carry out “the narrowest possible changes.”

The problem with the single sensor, he said, should have dissuaded Boeing from using a similar design in the Max. Instead, “the issue got buried.”

Boeing declined to address detailed questions from The Times. In a statement, the company pointed to differences between the 2009 accident and the Max crashes. “These accidents involved fundamentally different system inputs and phases of flight,” the company said.

Asked about its involvement with the Dutch accident report, Boeing said it was “typical and critical to successful investigations for Boeing and other manufacturers to work collaboratively with the investigating authorities.”

Joe Sedor, the N.T.S.B. official who led the American team working on the Turkish Airlines investigation, said it was not unusual for investigating bodies to make changes to a report after receiving feedback, or for American safety officials to jointly submit their comments with Boeing.

Mr. Sedor is now overseeing the N.T.S.B.’s work on the Max crashes. He acknowledged that reliance on a single sensor was a contributing factor in both cases but cautioned against focusing on it.

“Each of these accidents were complex and dynamic events with many contributing factors,” he said. “Boiling them down simply to the number of inputs ignores the many, many more issues that differentiate them.”

The F.A.A., in a statement, also emphasized the “unique set of circumstances” surrounding each accident. “Drawing broad connections between accidents involving different types of emergencies oversimplifies what is, by definition, a complex science,” it said.

The agency, also part of the American team in the Dutch investigation, declined to say whether the lessons from the Turkish Airlines crash factored into its decision to certify the Max — which was approved to fly in 2017 and became the fastest-selling plane in Boeing’s history.

But a senior F.A.A. official, who was not authorized to speak publicly, praised Dr. Dekker’s study and said it identified important issues that had not received enough public attention. The official pointed to the similarities — such as the reliance on a single sensor — between the Turkish Airlines crash and the Max accidents.

A spokeswoman for the Dutch board, Sara Vernooij, said it was common practice to amend draft reports in response to outside comments, but she declined to address the specific changes. Other companies and government bodies involved in the investigation, such as the French firm that made the sensors and that country’s aviation safety board, also submitted comments, but the American submission was the most extensive.

Ms. Vernooij said the Dutch agency regarded the Dekker study as confidential. “The parts considered relevant by the board were used while writing the final report,” she said.

Focus on the Pilots

On the morning of Feb. 25, 2009, Turkish Airlines Flight 1951 approached Amsterdam, carrying 128 passengers from Istanbul. The first officer guided the plane toward Runway 18R, calling out changes to its speed and direction. He was new to the Boeing jet, so the crew included a third pilot in addition to the captain, who was a former Turkish Air Force officer with about 13 years of experience flying the aircraft.

Because of instructions from air traffic control, the crew had to execute a maneuver that could be challenging: slowing while descending more rapidly than normal. They engaged a computer that controlled engine thrust, known as an autothrottle, to help regulate the drop in speed.

As the plane dipped to 1,000 feet, the pilots had not yet completed their landing checklist. Strict adherence to airline procedure would have meant circling around for another try, but violations were commonplace at the busy runway, investigators later determined.

About a minute later, with the plane at about 450 feet, the pilots’ control sticks began shaking, warning of an impending stall. The jet had slowed too much. Immediately, one of the pilots pushed the thrust lever forward to gain speed, but when he let go, the computer commanded it to idle.

The captain intervened, disabling the autothrottle and setting the thrust levers to their maximum. Nine seconds had elapsed since the stall warning. By then, it was too late. The jet plunged into a field less than a mile from the airport.

The three pilots, another crew member and five passengers were killed.

Dutch investigators determined that the cause of the malfunction was a sensor on the plane’s exterior measuring altitude. The sensor had mistakenly indicated that the plane was just moments from touchdown, prompting the computer to idle the engines.

For 70 seconds, the autothrottle had done what the crew intended: steadily cut the plane’s speed. But the pilots failed to notice that the computer did not then maintain the target speed when it was reached; instead, it continued to slow the plane down. The pilots realized what had happened only when the control stick began vibrating.

Losing track of airspeed is considered a grave error. The pilots, who investigators believe were preoccupied with the landing checklist, also missed multiple warnings that the autothrottle was acting up. The Dutch board’s conclusions focused on the decision not to abort the landing, the failure to recognize the dangerous drop in speed and the incorrect response to the shaking control stick, possibly because of inadequate training.

At the request of the American team led by the N.T.S.B., the Dutch added comments that further emphasized the pilots’ culpability. The final report, for example, included a new statement that scolded the captain, saying he could have used the situation to teach the first officer a “lesson” on following protocol.

In their comments, reflected largely in an appendix, the Americans addressed criticism of Boeing in the draft report. A description of the company’s procedures for monitoring and correcting potential safety problems was “technically incorrect, incomplete and overly” simplistic, they wrote. In response, the board inserted a description of Boeing’s safety program written by the Americans and a statement that Boeing’s approach was more rigorous than F.A.A. requirements.

The draft had also referred to studies that found it was common for complex automation to confuse pilots and suggested design and training improvements. The studies, the draft said, included research by “Boeing itself.”

The Americans objected, saying the statements “misrepresent and oversimplify the research results.” In its final report, the board deleted the Boeing reference.

When the Dutch board announced its conclusions during a news conference, its chairman said, “The pilots could have prevented this.”

Missing Information

The Dutch Safety Board had also commissioned Dr. Dekker’s analysis of the accident, which applied an engineering discipline known as human factors. As planes have come to rely on complex computer systems, researchers and investigators have identified design and training practices that can make pilot error less likely.

Dr. Dekker, then a professor in Sweden who had investigated other serious crashes and had worked part time flying a 737, acknowledged fatal mistakes by the Turkish Airlines pilots in his 129-page study.

But he also found that Boeing bore significant responsibility.

While his study was never made public, copies circulated among some researchers and pilots. And his role in the investigation was cited in an appendix to the board’s report. He is now a professor in Australia and the Netherlands.

In the study, Dr. Dekker chastised Boeing for designing the autothrottle to rely on just one of two sensors measuring altitude. That decision, he wrote, left “a single-failure pathway in place,” raising the risk that a single error could lead to catastrophe.

Five years before the Turkish Airlines crash, Boeing was aware that a sensor malfunction could idle the engines improperly, but the company decided it wasn’t a safety concern, the Dutch investigators wrote. After receiving reports about autothrottle misfires that did not lead to accidents, a Boeing review board determined that if a malfunction occurred, pilots would recognize it and intervene.

In the meantime, Boeing developed a software update that allowed the autothrottle to compare the readings from the two altitude sensors. If they differed by more than 20 feet, the autothrottle wouldn’t be able to improperly idle the engines.

The safeguard was available in 2006, but the change wouldn’t work on some 737 NG models, like the Turkish Airlines plane, that used an autothrottle computer made by a different company. After the 2009 crash, Boeing developed a version of the update compatible with those computers, and the F.A.A. required airlines to install it.

The Dekker study found that another decision by Boeing — to leave important information out of the operations manual — had also hampered the Turkish Airlines pilots.

The 737 NG has two parallel sets of computers and sensors, one on the left side of the plane and one on the right. Most of the time, only one set is in control.

On the Turkish Airlines flight, the system on the right was in control. The pilots recognized the inaccurate altitude readings and noted that they were coming from the sensor on the left. This would have led them to conclude that the bad data coming from the left didn’t matter because the autothrottle was getting the correct data from the right, Dr. Dekker found.

What the pilots couldn’t have known was that the computer controlling the engine thrust always relied on the left sensor, even when the controls on the right were flying the plane. That critical information was nowhere to be found in the Boeing pilots’ manual, Dr. Dekker learned.

Erik van der Lely, a 737 NG pilot and instructor for a European airline who studied under Dr. Dekker, told The Times that he had not known about this design peculiarity until he read a copy of the study. “I’m pretty sure none or almost none of the 737 pilots knew that,” he said.

When the draft report criticized Boeing for not giving pilots information that might have helped prevent the accident, the Americans disagreed, citing general directions from the training manual and writing, “Boeing did provide appropriate guidance to flight crews.” The plane was “easily recoverable” if the pilots had followed the proper procedures, they said.

In its final report, the board retained its general conclusion but softened some language.

Boeing later made a similar assessment on the 737 Max. The company did not inform pilots of a new automated system that contributed to both deadly crashes, hindering their ability to counteract its erroneous commands, investigators have determined.

Over all, the final report by the Dutch Safety Board did mention some of Dr. Dekker’s conclusions, but the aviation safety experts who read his study said the systemic issues he raised received too little emphasis.

For example, while the report noted the design quirk not included in the manual, it did so only briefly amid other technical documentation, and the significance of it was unclear. Dr. Dekker estimated that the board included the equivalent of about one page of information from his study in its report, which was 90 pages in addition to appendices.

‘Failure of Responsibility’

Today, faced with a public outcry over the Max crashes and demands for reforms, Boeing and the F.A.A. have agreed that more attention should be paid to the engineering discipline Dr. Dekker applied in his study.

Both the N.T.S.B. and a panel of international experts found that Boeing and the F.A.A. had not sufficiently incorporated lessons from this human-factors research when developing and certifying the Max.

But even though the research has been around for decades — an F.A.A. studyrecommended in 1996 that the industry and regulators embrace the approach more readily — accident investigations have tended to focus on pilot errors while minimizing or ignoring systemic factors, such as design and training problems, experts said.

“It’s really easy to blame it on the dead pilots and say it has nothing to do with our improperly designed system,” said Shawn Pruchnicki, who teaches at Ohio State and has worked on accident investigations for the Air Line Pilots Association.

Dr. Pruchnicki, who studied under Dr. Dekker, said he had participated in numerous investigations in which human-factors experts were largely ignored. “It just gets frustrating because we keep having the same types of accidents,” he said.

Dr. Woods, the Ohio State professor who has advised the F.A.A., wrote an email to colleagues shortly after the first 737 Max crash, in October 2018, of Lion Air Flight 610, which killed 189 people just minutes after taking off from Jakarta, Indonesia. The initial details, he wrote, indicated it was an automation-triggered disaster of the sort that he and others had studied for almost 30 years. He cited research from the 1990s and pointed to the Turkish Airlines crash.

“That this situation has continued on for so long without major action is not how engineering is supposed to work,” he wrote.

After the second Max crash — in March 2019, of Ethiopian Airlines Flight 302, killing all 157 people on board shortly after takeoff from Addis Ababa — Dr. Woods said in an interview, “I was appalled.”

“This is such of a failure of responsibility,” he said. “We’re not supposed to let this happen.”

[Don Hudson]

DSB Final Report

 

FROM: THE BOEING COMPANY TO: MOM [MESSAGE NUMBER:MOM-MOM-09-0063-01B] 04-Mar-2009 05:29:01 AM US PACIFIC TIME Multi Operator Message This message is sent to all 737-100,-200,-300,-400,-500,-600,-700,-800,-900,-BBJ customers and to respective Boeing Field Service bases, Regional Directors, the Air Transport Association, International Air Transport Association, and Airline Resident Representatives.

SERVICE REQUEST ID: 1-1228079803

ACCOUNT: Boeing Correspondence

(MOM) DUE DATE: 10-Mar-2009 PRODUCT TYPE: Airplane

PRODUCT LINE: 737 PRODUCT: 737-100,-200,-300,-400,-500,-600,-700,-800,-900,-BBJ ATA: 3400-00

SUBJECT: 737-800 TC-JGE Accident at Schiphol Airport, Amsterdam - 25 February 2009

REFERENCES: /A/ 1-1222489391 Dated 25 February 2009 Reference /A/ provides Boeing's previous fleet communication on the subject event. The US NTSB, FAA, Boeing, the Turkish DGCA, the operator, the UK AAIB, and the French BEA continue to actively support the Dutch Safety Board's (DSB) investigation of this accident. The DSB has released a statement on the progress of the investigation and has approved the release of the following information. While the complex investigation is just beginning, certain facts have emerged from work completed thus far: - To date, no evidence has been found of bird strike, engine or airframe icing, wake turbulence or windshear. - There was adequate fuel on board the airplane during the entire flight. - Both engines responded normally to throttle inputs during the entire flight. - The airplane responded normally to flight control inputs throughout the flight. The Digital Flight Data Recorder (DFDR) data indicates that the crew was using autopilot B and the autothrottle for an ILS (Instrument Landing System) approach to runway 18R at Amsterdam Schiphol airport. During the approach, the right Low Range Radio Altimeter (LRRA) was providing accurate data and the left LRRA was providing an erroneous reading of -7 to -8 feet. When descending through approximately 2000 feet the autothrottle, which uses the left radio altimeter data, transitioned to landing flare mode and retarded the throttles to the idle stop. The throttles remained at the idle stop for approximately 100 seconds during which time the airspeed decreased to approximately 40 knots below the selected approach speed. The two LRRA systems provide height above ground readings to several aircraft systems including the instrument displays, autothrottle, autopilots and configuration/ground proximity warning. If one LRRA provides erroneous altitude readings, typical flight deck effects, which require flight crew intervention whether or not accompanied by an LRRA fault flag, include: - Large differences between displayed radio altitudes, including radio altitude readings of -8 feet in flight. - Inability to engage both autopilots in dual channel APP (Approach) mode - Unexpected removal of the Flight Director Command Bars during approach - Unexpected Configuration Warnings during approach, go-around and initial climb after takeoff - Premature FMA (Flight Mode Annunciation) indicating autothrottle RETARD mode during approach phase with the airplane above 27 feet AGL. There will also be corresponding throttle movement towards the idle stop. Additionally, the FMA will continue to indicate RETARD after the throttles have reached the idle stop Boeing Recommended Action - Boeing recommends operators inform flight crews of the above investigation details and the DSB interim report when it is released. In addition, crews should be reminded to carefully monitor primary flight instruments (airspeed, attitude etc.) and the FMA for autoflight modes. More information can be found in the Boeing 737 Flight Crew Training Manual and Flight Crew Operations Manual. Operators who experience any of the flight deck effects described above should consult the troubleshooting instructions contained in the 737 Airplane Maintenance Manual. Further, 737-NG operators may wish to review 737NG-FTD-34-09001 which provides information specific for the 737-NG installation. Initial investigations suggest that a similar sequence of events and flight deck indications are theoretically possible on the 737-100/-200/-300/-400/-500. Consequently the above recommendations also apply to earlier 737 models.

 

FROM: THE BOEING COMPANY
TO: MOM [MESSAGE NUMBER:MOM-MOM-09-0063-01B<WBR></WBR>] 04-Mar-2009 05:29:01 AM US PACIFIC TIME
Multi Operator Message

This message is sent to all 737-100,-200,-300,-400,-50<WBR></WBR>0,-600,-700,-800,-900,-BBJ<WBR></WBR> customers and to respective Boeing Field Service bases, Regional Directors, the Air Transport Association, International Air Transport Association, and Airline Resident Representatives.

SERVICE REQUEST ID: 1-1228079803
ACCOUNT: Boeing Correspondence (MOM)
DUE DATE: 10-Mar-2009
PRODUCT TYPE: Airplane
PRODUCT LINE: 737
PRODUCT: 737-100,-200,-300,-400,-50<WBR></WBR>0,-600,-700,-800,-900,-BBJ<WBR></WBR>
ATA: 3400-00

SUBJECT: 737-800 TC-JGE Accident at Schiphol Airport, Amsterdam - 25 February 2009

REFERENCES:
/A/ 1-1222489391 Dated 25 February 2009

Reference /A/ provides Boeing's previous fleet communication on the subject event. The US NTSB, FAA, Boeing, the Turkish DGCA, the operator, the UK AAIB, and the French BEA continue to actively support the Dutch Safety Board's (DSB) investigation of this accident.

The DSB has released a statement on the progress of the investigation and has approved the release of the following information.

While the complex investigation is just beginning, certain facts have emerged from work completed thus far:

- To date, no evidence has been found of bird strike, engine or airframe icing, wake turbulence or windshear.
- There was adequate fuel on board the airplane during the entire flight.
- Both engines responded normally to throttle inputs during the entire flight.
- The airplane responded normally to flight control inputs throughout the flight.


The Digital Flight Data Recorder (DFDR) data indicates that the crew was using autopilot B and the autothrottle for an ILS (Instrument Landing System) approach to runway 18R at Amsterdam Schiphol airport. During the approach, the right Low Range Radio Altimeter (LRRA) was providing accurate data and the left LRRA was providing an erroneous reading of -7 to -8 feet. When descending through approximately 2000 feet the autothrottle, which uses the left radio altimeter data, transitioned to landing flare mode and retarded the throttles to the idle stop. The throttles remained at the idle stop for approximately 100 seconds during which time the airspeed decreased to approximately 40 knots below the selected approach speed.

The two LRRA systems provide height above ground readings to several aircraft systems including the instrument displays, autothrottle, autopilots and configuration/ground proximity warning. If one LRRA provides erroneous altitude readings, typical flight deck effects, which require flight crew intervention whether or not accompanied by an LRRA fault flag, include:

- Large differences between displayed radio altitudes, including radio altitude readings of -8 feet in flight.
- Inability to engage both autopilots in dual channel APP (Approach) mode
- Unexpected removal of the Flight Director Command Bars during approach
- Unexpected Configuration Warnings during approach, go-around and initial climb after takeoff
- Premature FMA (Flight Mode Annunciation) indicating autothrottle RETARD mode during approach phase with the airplane above 27 feet AGL. There will also be corresponding throttle movement towards the idle stop. Additionally, the FMA will continue to indicate RETARD after the throttles have reached the idle stop

Boeing Recommended Action
- Boeing recommends operators inform flight crews of the above investigation details and the DSB interim report when it is released. In addition, crews should be reminded to carefully monitor primary flight instruments (airspeed, attitude etc.) and the FMA for autoflight modes. More information can be found in the Boeing 737 Flight Crew Training Manual and Flight Crew Operations Manual.

Operators who experience any of the flight deck effects described above should consult the troubleshooting instructions contained in the 737 Airplane Maintenance Manual. Further, 737-NG operators may wish to review 737NG-FTD-34-09001 which provides information specific for the 737-NG installation. Initial investigations suggest that a similar sequence of events and flight deck indications are theoretically possible on the 737-100/-200/-300/-400/-50<WBR></WBR>0. Consequently the above recommendations also apply to earlier 737 models.

[Don Hudson]

Sidney Dekker, Human Factors Specialist, who has spoken at Canadian flight safety conferences before, did a human factors examination on the Turkish B738 Amsterdam accident and the Dutch Safety Board has decided to publish this report. It can be found at https://www.barracuda.com/products/essentials

Don

SUMMARY
CONSIDERATIONS FOR A HUMAN FACTORS ANALYSIS
 A word on hindsight  
 The scope of this human factors analysis
 A word on time
A SEQUENCE OF EVENTS
TK1951: AN AUTOMATION SURPRISE
 TK1951 and research on automation surprises
AUTOMATION TRAINING AND BUGGY MENTAL MODELS
 Autothrottle in the airplane manuals
 Alerts and indications associated with RA failure  
 Comparison with other TRTO
 Experience on aircraft type and buggy mental models
SPEED, MODE MONITORING AND THE NOTICING OF A NON-EVENT
 How to see that something doesn’t happen
 Not noticing a mode change
 Automation surprises and representations of the future
 “Moving thrust levers” that didn’t move and other cues
 Workload and interleaving task demands  
 Speed tapes: How a cockpit knows its speed
CRM AND THE INTERVENTION DECISION
 The flight crew of TK1951  Training
 (CRM) at THY TK1951: A breakdown in CRM?
 Was TK1951 a rushed approach?
 Why not make a go-around?

[ILB]

38 minutes ago, Don Hudson said:

Sidney Dekker, Human Factors Specialist, who has spoken at Canadian flight safety conferences before, did a human factors examination on the Turkish B738 Amsterdam accident and the Dutch Safety Board has decided to publish this report. It can be found at https://www.barracuda.com/products/essentials

 

Thanks very much for sharing this, Don.

Your link may be broken, is this the document? Report of the Flight Crew Human Factors Investigation for the DSB TK1951

[Don Hudson]

Hi ILB - yes, that's the link, thanks. Copied the incorrect one.

Don