New information shows that the Ministry of Defence withheld
information from an air chief marshal about software flaws that
could have caused the RAF's worst peacetime accident.Tony Collins
provides the latest update on Chinook.
When air chief marshal William Wratten sat in judgement on the
RAF's worst peacetime accident, he ruled out major equipment
failure, not having been told that faulty software was capable of
causing the crash.
Wratten blamed the pilots for the crash of a Chinook helicopter,
ZD576, on the Mull of Kintyre in June 1994, which killed four crew
and 25 intelligence and police officers.
It has now emerged that the Ministry of Defence did not tell
Wratten that at the time of the accident it was suing the
software's prime contractor. In secret proceedings, the MoD was
alleging that the helicopter's Full Authority Digital Engine
Control System (Fadec) contained "fundamental" design flaws.
This withholding of information emerged this month when the MoD
replied to a parliamentary question put down by former Labour
minister Frank Field. The MoD said, "At the time of the RAF Board
of Inquiry into the Mull of Kintyre accident, Wratten was not aware
of this litigation and did not recall the Wilmington incident that
led to this legal action being taken."
The Wilmington incident was a ground test of the Fadec fuel
control system, newly installed on an MoD Chinook. The test was
ended when the helicopter's rotor blades span out of control at up
to 322rpm - about the speed of sound - against a design limit of
244rpm, because of an engine surge. It caused severe damage to the
helicopter and was said in the litigation to have endangered the
lives of the Chinook's occupants.
After the incident in 1989, it was found that the engine surge
and rotor "overspeed" occurred when the Fadec system suffered an
"E5" fault, indicating an error in the system's reading of the
engine's speed. Five years later the same fault code was found on
the Fadec system that was recovered from the wreckage on the Mull
of Kintyre in June 1994.
At the time of the RAF Board of Inquiry into the crash of ZD576,
all information about the test incident in 1989, including the
possible significance of the E5 fault code, and the subsequent
legal action against Textron Lycoming, the Fadec's supplier, was
kept secret by the MoD.
As a result, Wratten, the RAF Board of Inquiry, the Air Accident
Investigations Branch and the Scottish Fatal Accident Inquiry had
no reason to believe that a Fadec problem was capable of causing
pilots to lose control of the helicopter. They also had no
knowledge of any incident in which a Fadec problem had actually
caused pilots to lose control of a Chinook.
It is possible that Wratten's air vice-marshal John Day, who was
in charge of RAF Chinooks at the time of the crash of ZD576, was
also unaware of the threat to human life posed by the faulty Fadec
software.
The MoD said that Day was "aware there had been an incident, and
that legal action was being taken, but was not aware of the
detail".
Like Wratten, Day found that the pilots of ZD576 were grossly
negligent. In his written judgement, Day said he did not believe
that any distraction by a technical malfunction could have been so
strong as to prevent safe flight. Both marshals reached conclusions
at odds with the report of a three-man RAF Board of Inquiry, which
had found that there was insufficient evidence to find the pilots
at fault.
Had Wratten and Day seen the full picture, they would have known
that, at the time of the crash on the Mull, the MoD was accusing
Fadec's supplier of having designed a Fadec that was not airworthy,
did not meet international safety standards and had not been tested
adequately.
But, although the MoD did not make known the seriousness of its
concerns about the Fadec technology, there was other information in
the public domain at the time of the tragedy which highlighted
day-to-day difficulties with system.
A day before the crash of ZD576, for instance, trials flying on
the Chinook Mk2 was stopped because of concerns over the Fadec.
Operational pilots including flight lieutenants Jonathan Tapper and
Rick Cook, who flew on the last flight of ZD576, were asked to
continue flying the Mk2.
The Fadec problems were so well known that the RAF Board of
Inquiry into the Mull crash discussed whether the system could have
failed and left no trace in the wreckage.
After hearing evidence on oath that the Chinook suffered from
"flight-critical" Fadec problems including sudden engine
shut-downs, engine surges, and warning lights illuminating in the
cockpit, the board did not rule out the possibility of a major
technical malfunction distracting the crew.
It said, "Possible distractions were numerous and ranged from a
major technical malfunction to an intermittent and minor
irritationÉ The board concluded that distraction by a technical
malfunction could have been a contributory factor in the
accident."
After reading the report, Wratten judged that there was "not
even a hint of any circumstances which would have been beyond [the
pilots'] professional skills to accommodate."
Yet, even if Wratten and Day had known in detail of concerns
over Fadec and the MoD's legal action against the system's
supplier, it may not have made any difference to their decision to
attribute responsibility for the crash to the crew.
However, one QC who has studied the case said privately that the
MoD may have deliberately withheld material that was relevant to
the determination of the RAF Board of Inquiry.
If so, this raises the question of whether the MoD put into
operational service an aircraft whose safety-critical software had
a history of design flaws, and then withheld relevant information
on the seriousness of those flaws after the Mull of Kintyre
crash?
If this possibility exists, it may be argued that the MoD cannot
be an objective party in deciding whether to reopen an inquiry into
the Mull crash.
Indeed, it may be said that leaving such a decision to the MoD
would be like asking the Crown Prosecution Service to judge whether
to prosecute a case in which it would be the main defendant.
Did the MoD know Fadec posed a threat to the Chinook
crew?
- One of the MoD's defences to criticism that it withheld
potentially vital information about the Chinook's Fadec, is that
the 1989 Wilmington Incident and the litigation were irrelevant
because the RAF Board of Inquiry found no evidence that Fadec had
been a factor in the crash. This is not entirely correct. The board
concluded that, "An unforeseen technical malfunction of the type
being experienced on the Chinook HC2, which would not necessarily
have left any physical evidence, remained a possibility and could
not be discounted."
- Another of the MoD's counter-arguments is that the Wilmington
test involved a pre-production version of the Fadec which was
subsequently modified. Therefore, the system that was involved in
the 1989 incident had no relevance to the Fadec recovered from the
wreckage on the Mull. In fact, MoD papers show that Fadec system
problems, including "E5" fault codes, continued long after the 1989
incident. Boscombe Down, the MoD's airworthiness testing authority,
had declined to give the Fadec an unqualified approval without a
software rewrite, which did not happen. An independent assessment
of the Fadec software by defence contractor EDS-Scicon in July 1993
was abandoned when the company found 485 anomalies in less than 20%
of the code. On 3 June 1994, a day after the Mull crash, a memo by
the Electronic Assessment section at Boscombe Down, said the Fadec
software was "unsuitable for intended purpose". About a year later,
in 1995, another internal MoD document referred to there having
been "fundamental" flaws in the Fadec during 1994.
- A third MoD argument is that the Wilmington incident was caused
mainly by faulty testing procedures at Chinook manufacturer Boeing,
not by Fadec, and that the litigation arose mainly because of
faulty testing. But leaked papers show that the MoD made only
relatively minor allegations of faulty test procedures and brought
a major case against the Fadec's supplier Textron over the system's
design flaws. The MoD received a $500,000 discount on invoices from
Boeing on the matter of faulty test procedures. But the MoD won $3m
from Textron over the Fadec's design flaws. The MoD has also argued
that the Fadec is not capable of causing a crash. But leaked papers
show that in the legal proceedings after the Wilmington Incident
the MoD was arguing that the Fadec software was "truly critical in
maintaining safe flight".