Whitehall has set a dangerous precedent by allowing the MoD to
stand by its Chinook verdict
The Ministry of Defence's mulish rejection of independent inquiries
by two Parliamentary committees, and its insistence on upholding
its decision to blame pilot error for the crash of Chinook flight
ZD576, suggests that it cares more about losing face than about
righting a miscarriage of justice.
Its decision to stand by its verdict of "gross negligence with
absolutely no doubt whatsoever" on the part of RAF flight
lieutenants Jonathan Tapper and Richard Cook flies in the face of
all the evidence to the contrary that has accumulated since the
tragedy claimed the lives of 29 crew and passengers on the Mull of
Kintyre in June 1994.
A compelling body of evidence points to flaws in the Chinook's Full
Authority Digital Engine Control System (Fadec) as a possible cause
of the crash. Indeed, problems with Fadec, which regulated the fuel
to the Chinook's jet engines without direct pilot control, had
caused other Chinook engines to behave erratically prior to the
crash.
To support its standpoint, the MoD this week brandished the results
of a fresh Boeing simulation of the crash - despite the recent
assertion by Boeing staff that their simulations are merely
investigative tools that should not be treated as proven fact.
Computer Weekly has long campaigned to clear the names of pilots
Tapper and Cook, because they never had the chance to do so
themselves.
But it has also sought to point out the dangerous precedent of
assuming that a lack of concrete evidence of software malfunction
is sufficient to pin the blame for a disaster on operator error,
rather than any failing on the part of the software manufacturer.
For complex technology, only the manufacturer can understand the
system well enough to identify any design, coding or testing flaws
within it. Yet no commercial manufacturer can seriously be expected
to implicate itself in a software-related disaster.
Moreover, the circumstances of a disaster such as the one that
occurred in 1994 make it extraordinarily difficult to recover any
meaningful evidence of software flaws. To accept the verdict of
pilot negligence is to accept that in all such cases it is
reasonable to blame the operators as a matter of course, if the
cause of a disaster is not known.
In other words, manufacturers of safety-critical software have this
week received an unequivocal message from Whitehall that if flaws
in their products lead to loss of life, they are unlikely to be
held to account.
In refusing to budge from its original position, the MoD seems
determined to live down to the reputation for "unwarrantable
arrogance" for which it was chastised by the Public Accounts
Committee two years ago.
More sinisterly, in expressing absolute confidence that the pilots
were the cause of the crash of Chinook ZD576, it has sought to
exonerate itself of any blame for allowing into service an aircraft
which even its own air safety experts had warned featured defective
safety-critical software.
The MoD found itself on trial this week. Its ability to defend
itself successfully can be explained by the fact that it was able
to act as its own judge and jury.