What Air France Airbus crash says about Chinook ZD 576

Last week’s press conference on the loss of the AF447 Air France Airbus A330-200 highlighted the importance of black boxes in any major fatal crash investigation.

Spokespeople for BEA, the French air accident investigators, were at the conference to report their interim findings. Without the cockpit voice and flight data recorders they don’t know why the Airbus went into the Atlantic Ocean off Brazil on 1 June.

They still hope to find the cockpit voice and flight data recorders, although hopes of finding them before they are damaged by salt water, are fading.  

There’s an extraordinary contrast in the [separate] investigations into the causes of the Airbus and Chinook crashes. In one, accident investigators admit they don’t know what happened because there are no black boxes.

In the other, the MoD and two air marshals said the pilots caused the crash although the helicopter wasn’t fitted with black boxes. Chinook ZD576 went into the Mull of Kintyre in June 1994, killing all 29 on board, including 25 VIPs.

The MoD and the air marshals didn’t simply blame the pilots: they found them grossly negligent. RAF rules at the time said that deceased aircrew could be found negligent only if there was “absolutely no doubt whatsoever”.

On 2 June 1994, an internal MoD recommendation to the RAF was to stop flying Chinook Mk2s because of the uncertain performance of the Mk2 safety-critical FADEC fuel control computer system.

The FADEC was unusual in its design – it was entirely software-controlled, in both primary and reversionary (backup) mode. But the software design did not meet MoD standards for verification. Services company EDS began an independent evaluation of the FADEC software but gave up when it found a plethora of anomalies.     

On the same day as the MoD recommendation to stop flying Chinook MK2s, Chinook ZD576 – a Chinook Mk2 – crashed on the Mull of Kintyre. The MoD and RAF hierarchies had dismissed the internal recommendation.

Nobody knows for certain what caused the crash of ZD576. But every Labour Secretary of Defence has stood by the “guilty” finding against the pilots Flt Lieutenants Rick Cook and Jonathan Tapper. 

Yet more is known about the performance of the Airbus in its last minutes than the Chinook’s. 

The Airbus, flying over the Atlantic off Brazil, sent 24 maintenance data messages to Airbus Industries in France in the minutes before the links were lost. The messages, according to the investigators, show that the pilots were getting conflicting information on their air speed, possibly because blocked pitot tubes.

The BEA says that the pitot tubes are a suspected factor in the chain of events but not the cause which may never be known.

If French investigators are so uncertain about the probable cause of a major fatal crash because they don’t have the black boxes, how is it that some believe they can be certain about the cause of the crash of ZD576 when there weren’t any black boxes?

The uncertainties over the crash of ZD576 run deeper because it did not transmit any real-time messages about its performance in the minutes before it crashed.

Some of the Airbus 330-200 has been recovered and some of ZD576 too. Many people have tried to draw conclusions from what was left of ZD576 but that is speculation without a cockpit voice and flight data recorder. 

The air marshals who blamed the pilots of ZD576 derived conclusions from the Racal Avionics “SuperTANS” Tactical Area Navigation System.

But the information recovered from the TANS was not independently verified, and indeed was extracted without independent supervision. It was not intended as a black box, so the manufacturer had to devise its own routines to extract data from it. The integrity of those routines has not been checked independently.

So it’s difficult to see how any information from the TANS could be taken as verified fact; and it’s worth nothing that the Air Accidents Investigation Branch did not rely on TANS data in its report.

French investigators are determined to find the black boxes by different methods if the current ones fail. They say that without them they may never know why AF447 crashed.

Would they change their minds if told about ZD576? That it was possible reconstruct the last moments of flight without black boxes, when large parts of the aircraft have been destroyed, when the AAIB has been limited by the RAF to investigating only some aspects of the crash, and when there have been no maintenance data links?

The French investigators would probably say that they would like to carry on their search for the black boxes. So anxious are they to find them that a nuclear sub is involved in the search, as is the US Navy.

As for the cause of the crash of Chinook ZD576, ministers and the MoD take the view that black boxes are not needed – which makes the gross negligence finding against the pilots of ZD576 particularly odd, a gross miscarriage of justice in fact.

We can be sure that the investigators of the crash of the Airbus AF447 will not put across speculation as fact. It’s a pity the RAF and the MoD are not so sensitive.

[I posted some of this comment on PPrune last week ]


Does Chinook crash matter 14 years on? – IT Projects blog  

The best analysis I have seen yet of the Airbus AF447

FADEC – what could have gone wrong? – Computer Weekly

House of Lords report on Chinook ZD 576