Did MoD deceive RAF inquiry?

New information shows that the Ministry of Defence withheld information from an air chief marshal about software flaws that could...

New information shows that the Ministry of Defence withheld information from an air chief marshal about software flaws that could have caused the RAF's worst peacetime accident.Tony Collins provides the latest update on Chinook.

When air chief marshal William Wratten sat in judgement on the RAF's worst peacetime accident, he ruled out major equipment failure, not having been told that faulty software was capable of causing the crash.

Wratten blamed the pilots for the crash of a Chinook helicopter, ZD576, on the Mull of Kintyre in June 1994, which killed four crew and 25 intelligence and police officers.

It has now emerged that the Ministry of Defence did not tell Wratten that at the time of the accident it was suing the software's prime contractor. In secret proceedings, the MoD was alleging that the helicopter's Full Authority Digital Engine Control System (Fadec) contained "fundamental" design flaws.

This withholding of information emerged this month when the MoD replied to a parliamentary question put down by former Labour minister Frank Field. The MoD said, "At the time of the RAF Board of Inquiry into the Mull of Kintyre accident, Wratten was not aware of this litigation and did not recall the Wilmington incident that led to this legal action being taken."

The Wilmington incident was a ground test of the Fadec fuel control system, newly installed on an MoD Chinook. The test was ended when the helicopter's rotor blades span out of control at up to 322rpm - about the speed of sound - against a design limit of 244rpm, because of an engine surge. It caused severe damage to the helicopter and was said in the litigation to have endangered the lives of the Chinook's occupants.

After the incident in 1989, it was found that the engine surge and rotor "overspeed" occurred when the Fadec system suffered an "E5" fault, indicating an error in the system's reading of the engine's speed. Five years later the same fault code was found on the Fadec system that was recovered from the wreckage on the Mull of Kintyre in June 1994.

At the time of the RAF Board of Inquiry into the crash of ZD576, all information about the test incident in 1989, including the possible significance of the E5 fault code, and the subsequent legal action against Textron Lycoming, the Fadec's supplier, was kept secret by the MoD.

As a result, Wratten, the RAF Board of Inquiry, the Air Accident Investigations Branch and the Scottish Fatal Accident Inquiry had no reason to believe that a Fadec problem was capable of causing pilots to lose control of the helicopter. They also had no knowledge of any incident in which a Fadec problem had actually caused pilots to lose control of a Chinook.

It is possible that Wratten's air vice-marshal John Day, who was in charge of RAF Chinooks at the time of the crash of ZD576, was also unaware of the threat to human life posed by the faulty Fadec software.

The MoD said that Day was "aware there had been an incident, and that legal action was being taken, but was not aware of the detail".

Like Wratten, Day found that the pilots of ZD576 were grossly negligent. In his written judgement, Day said he did not believe that any distraction by a technical malfunction could have been so strong as to prevent safe flight. Both marshals reached conclusions at odds with the report of a three-man RAF Board of Inquiry, which had found that there was insufficient evidence to find the pilots at fault.

Had Wratten and Day seen the full picture, they would have known that, at the time of the crash on the Mull, the MoD was accusing Fadec's supplier of having designed a Fadec that was not airworthy, did not meet international safety standards and had not been tested adequately.

But, although the MoD did not make known the seriousness of its concerns about the Fadec technology, there was other information in the public domain at the time of the tragedy which highlighted day-to-day difficulties with system.

A day before the crash of ZD576, for instance, trials flying on the Chinook Mk2 was stopped because of concerns over the Fadec. Operational pilots including flight lieutenants Jonathan Tapper and Rick Cook, who flew on the last flight of ZD576, were asked to continue flying the Mk2.

The Fadec problems were so well known that the RAF Board of Inquiry into the Mull crash discussed whether the system could have failed and left no trace in the wreckage.

After hearing evidence on oath that the Chinook suffered from "flight-critical" Fadec problems including sudden engine shut-downs, engine surges, and warning lights illuminating in the cockpit, the board did not rule out the possibility of a major technical malfunction distracting the crew.

It said, "Possible distractions were numerous and ranged from a major technical malfunction to an intermittent and minor irritationÉ The board concluded that distraction by a technical malfunction could have been a contributory factor in the accident."

After reading the report, Wratten judged that there was "not even a hint of any circumstances which would have been beyond [the pilots'] professional skills to accommodate."

Yet, even if Wratten and Day had known in detail of concerns over Fadec and the MoD's legal action against the system's supplier, it may not have made any difference to their decision to attribute responsibility for the crash to the crew.

However, one QC who has studied the case said privately that the MoD may have deliberately withheld material that was relevant to the determination of the RAF Board of Inquiry.

If so, this raises the question of whether the MoD put into operational service an aircraft whose safety-critical software had a history of design flaws, and then withheld relevant information on the seriousness of those flaws after the Mull of Kintyre crash?

If this possibility exists, it may be argued that the MoD cannot be an objective party in deciding whether to reopen an inquiry into the Mull crash.

Indeed, it may be said that leaving such a decision to the MoD would be like asking the Crown Prosecution Service to judge whether to prosecute a case in which it would be the main defendant.

Did the MoD know Fadec posed a threat to the Chinook crew?

  • One of the MoD's defences to criticism that it withheld potentially vital information about the Chinook's Fadec, is that the 1989 Wilmington Incident and the litigation were irrelevant because the RAF Board of Inquiry found no evidence that Fadec had been a factor in the crash. This is not entirely correct. The board concluded that, "An unforeseen technical malfunction of the type being experienced on the Chinook HC2, which would not necessarily have left any physical evidence, remained a possibility and could not be discounted."

  • Another of the MoD's counter-arguments is that the Wilmington test involved a pre-production version of the Fadec which was subsequently modified. Therefore, the system that was involved in the 1989 incident had no relevance to the Fadec recovered from the wreckage on the Mull. In fact, MoD papers show that Fadec system problems, including "E5" fault codes, continued long after the 1989 incident. Boscombe Down, the MoD's airworthiness testing authority, had declined to give the Fadec an unqualified approval without a software rewrite, which did not happen. An independent assessment of the Fadec software by defence contractor EDS-Scicon in July 1993 was abandoned when the company found 485 anomalies in less than 20% of the code. On 3 June 1994, a day after the Mull crash, a memo by the Electronic Assessment section at Boscombe Down, said the Fadec software was "unsuitable for intended purpose". About a year later, in 1995, another internal MoD document referred to there having been "fundamental" flaws in the Fadec during 1994.

  • A third MoD argument is that the Wilmington incident was caused mainly by faulty testing procedures at Chinook manufacturer Boeing, not by Fadec, and that the litigation arose mainly because of faulty testing. But leaked papers show that the MoD made only relatively minor allegations of faulty test procedures and brought a major case against the Fadec's supplier Textron over the system's design flaws. The MoD received a $500,000 discount on invoices from Boeing on the matter of faulty test procedures. But the MoD won $3m from Textron over the Fadec's design flaws. The MoD has also argued that the Fadec is not capable of causing a crash. But leaked papers show that in the legal proceedings after the Wilmington Incident the MoD was arguing that the Fadec software was "truly critical in maintaining safe flight".

  • Read more on IT legislation and regulation

    CIO
    Security
    Networking
    Data Center
    Data Management
    Close