Royal Aeronautical Society fellows doubt safety of Chinook software

Three fellows of the Royal Aeronautical Society have questioned whether the Chinook Mk2, of the type which crashed on the Mull of Kintyre in 1994, was airworthy.

They question the RAF’s decision to clear the helicopter as safe to fly in the face of “world-leading, expert advice that the fuel computer software implementation was “positively dangerous”.

In a letter to Computer Weekly, the three fellows say that senior RAF officers disregarded advice on the software given by Ministry of Defence IT experts at Boscombe Down in Hampshire.

Full article –

Fellows’ letter:

“We are pleased Air Chief Marshall Stephen Dalton chose to reply to the recent BBC coverage of the “positively dangerous” software implementation in the Chinook fuel computers in The Guardian, letters, 6th January 2010 and The Times (7 Jan 2010) as it gives us the opportunity to respond. This letter also replies to ACM Graydon’s letter to The Daily Telegraph (7 Jan 2010) and is complementary to our last letter to The Minister for Defence, as copied to ACM Dalton.

“ACM Dalton makes three main claims and admissions.

“1. The “positively dangerous” status of the software was well known at the time. That being so, perhaps MoD would care to say what corrective action was taken and why, given this was safety critical software, was it not corrected before the Assistant Chief of Air Staff signed the Release to Service in November 1993? Such failures in the MoD’s safety management system have been noted before, most recently by Mr Charles Haddon-Cave, QC in his coruscating condemnation of MoD’s “systemic failings”.

“2. That the above status was “factored into the operating instructions”. These instructions are, primarily, the Aircrew Manual (from which the aircrews derive their understanding of the aircraft) and the Flight reference Cards (used by the aircrews in flight to operate the aircraft). Successive inquiries, including the MoD’s own Board of Inquiry, heard irrefutable evidence of the immaturity of these documents. Indeed, the evidence of one Chinook Flight Commander at the time described them as “incomprehensible to aircrew operating the aircraft”. That is, they were not fit for purpose, a failing that endangered both aircrew and their passengers. Again, why did Assistant Chief of the Air Staff (ACAS) sign the Release to Service (RTS) given such a fundamental breach of the airworthiness regulations?

“3. That the “positively dangerous” software issue was discounted following the Air Accident Investigation Branch (AAIB) investigation. This is quite wrong. A simple search of the AAIB report shows no mention of “positively dangerous”, or even the word “software”. However, it does state, clearly, that the (fuel computer) “operating program” was “not altered from delivery”. That is, it remained in the “positively dangerous” state advised by MoD’s own experts at Boscombe Down. In fact, Boscombe Down’s opinion had hardened, as they grounded their own aircraft shortly before the crash.

“We submit that the aircraft was demonstrably not airworthy. ACM Dalton’s letter, far from protecting the MoD’s position, actually admits they knew of the problems and adds weight to our submission.

“It is now time for the MoD to say why this decision was made – their own regulations demand such a record be kept. Who, we ask, would sign to say an aircraft was safe in the face of world-leading, expert advice that the fuel computer software implementation was “positively dangerous”?

“And, perhaps more to the point, why would they do this before taking corrective action?”

Captain Ralph Kohn FRAeS

Retired Airline pilot and regulatory authority inspector (Ret) – Compiler of the Macdonald report (April 2000)

Captain Ron Macdonald  FRAeS – retired Air Canada pilot &. qualified aircraft accident investigator

Richard K J Hadlow FRAeS – retired RAF squadron leader & support helicopter squadron commander (with 20 years service) & retired airline pilot.


Chinook accident – a personal memory of the software

Chinook software was positively dangerous, say newly-disclosed documents –

Chinook negligence verdict “rubbish” –

House of Lords report into the crash of Chinook ZD576 and the blaming of the dead pilots – 2002

Chinook software – a chronology –

RAF Justice – Computer Weekly’s 140-page report on the Chinook Mk2 software –

Pilot’s father fights to clear his son’s name – The Independent