Faulty safety-critical software changed after fatal Mull crash

Faulty safety-critical "Fadec" software that was installed on the Chinook Mk2 helicopter had secret modifications after the notorious fatal crash on the...

Faulty safety-critical "Fadec" software that was installed on the Chinook Mk2 helicopter had secret modifications after the notorious fatal crash on the Mull of Kintyre, Computer Weekly has learned.

The Ministry of Defence has repeatedly dismissed claims that the Mull crash could have been caused by software. Its argument, in part, is that Chinooks have been flying safely all over the world while fitted with the "Fadec" engine control system.

But Computer Weekly has learned that the contractors responsible for the Fadec software, who had previously resisted making code changes requested by the MoD's IT experts at Boscombe Down, modified the software after the crash on the Mull of Kintyre - at their own expense.

The crash of Chinook ZD576 was one of the worst peacetime accidents in the RAF's history. It killed four crew and 25 senior police and intelligence officers.

The RAF Board of Inquiry into the accident did not rule out a Fadec problem as a contributory factor in the Mull crash. But when RAF air marshals reviewed the Inquiry's report they concluded that the two pilots, Flight Lieutenants Rick Cook and Jonathan Tapper, had been grossly negligent.

Much evidence has emerged since the Board of Inquiry which has cast doubt on the airworthiness of the Chinook Mk2 at the time of the crash on the Mull. The Mod at Boscombe Down, Hampshire, had described a flaw in the Fadec software in 1993 as "positively dangerous" but the aircraft was given airworthiness approval without changes to the software.

In the weeks before the crash on the Mull of Kintyre, pilots reported a series of problems with control of the engines, some of which were damaged. The problems were later traced to faults with the Fadec which had full authority to control automatically the flow of fuel to the Chinook's two jet engines. The Fadec could not be overridden by the pilots.

Now Computer Weekly has learned that, at the time of the Mull crash, the Fadec's contractors were in discussion with the MoD about modifying the Fadec software at their own expense.

This is revealed in a confidential Mod memo which was written on 6 June 1994, four days after the Mull crash. It said there were proposals for a "block change" of the Chinook Mk2 engine software.

The memo, from a senior officer at the MoD Procurement Executive, added: "I have to state that the serious, frequent and unexplained incidents to which have alluded have eroded what confidence we had in the Chinook HC Mk2 engine management system. This unease has grown since 25 May."

The date of 25 May 1994 was eight days before the crash on the Mull of Kintyre.

BC R4 "Today" programme reports again on "bitter debate" over danger Chinook software - IT Projects blog

Computer Weekly publishes confidential internal MoD memos on its concerns over Chinook Mk2 Fadec software

Fadec explained by an expert

Read more on IT risk management