Chinook crash: The unanswered software questions

A damning report issued this week has reminded the world that unexpected Chinook helicopter engine shutdowns and blowouts, in the years leading up to the disastrous 1994 Mull of Kintyre crash, mostly resulted from engine software that Ministry of Defence airworthiness experts had not been able to approve.

Share

A damning report issued this week has reminded the world that unexpected Chinook helicopter engine shutdowns and blowouts, in the years leading up to the disastrous 1994 Mull of Kintyre crash, mostly resulted from engine software that Ministry of Defence airworthiness experts had not been able to approve.

Lord Philip’s report– which finally cleared the two pilots of blame for the disastrous 1994 crash of a Boeing Chinook helicopter on the Mull of Kintyre that killed 25 intelligence personnel and a four-person special forces crew – highlights a raft of still-unanswered technical questions.

For 16 years, serious criticisms have been levelled by campaigners, around problems with the Chinook’s Full Authority Digital Electronic Control (FADEC) engine control software and the troubled upgrade that introduced it into the Mk 2 model helicopter type that crashed.

FADEC, which when it worked was an advanced system that made the pilots’ job easier, was not apportioned blame for having any role in the accident. But the report, which concentrated on the pilots, made clear the concerns of experts who had not been able to write off the chances of system failure.

Lord Philip noted that following the crash, the RAF investigating board of 1994 had concluded that while a technical failure “was unlikely to have been the direct cause” of the accident, “a malfunction or warning may have distracted the pilots and contributed to the accident”. He reached this conclusion despite MoD officials repeatedly telling ministers that the Chinook was so designed that if FADEC failed, competent pilots would still have able to land it safely.

The system, which controlled the helicopters’ Textron-Lycoming engines, had encountered serious problems since its introduction. Errors caused unexpected engine shutdowns, as well as surges in power that resulted in engines completely blowing out.

The upgrade to Chinook Mk 2, beginning a year before the crash, was branded by the report as “fraught and to some degree chaotic”, with test flying suspended and aircraft coming back late from upgrades. Philip noted, “the operational imperative to keep the Chinook flying meant that the RAF was still getting to know what was essentially a new aircraft.” The upgrade had “unsurprisingly” generated “some concern amongst the aircraft’s pilots, air and ground crews”.

Such was the concern surrounding the upgrade that the RAF introduced a reduced weight limit for the helicopter before the crash – reducing by 25 percent what it was able to carry.

ComputerworldUK.com blogger and investigative journalist Tony Collins has written extensively on the FADEC engine fuel control system, highlighting the “positively dangerous” problems that MoD experts said they had found with the system months before the crash. Collins was publicly thanked by MPs from the floor of the House of Commons on Wednesday, alongside other campaigners and journalists, for his “massive contribution” in making sure the truth around the pilots saw the light of day.

The Philip report details a number of the major problems with the FADEC system while Chinook Mk 2s were being introduced into operational service.

“During this period, both at Boscombe Down [the RAF’s aircraft test and evaluation site, where the system was found to be ‘unsuitable for its purpose’] and in service with operational squadrons, the aircraft experienced unpredictable malfunctions. These mostly affected, but were not limited to, the engines and more particularly their [FADEC] system and led to undemanded shutdowns and surges in power, which could cause overheating to the point of self-destruction.

“Torque mismatching between engines and false captions were also experienced. It was sometimes difficult to identify which of the two engines was faulty and the application of remedial measures to the wrong engine could lead to catastrophic consequences.”

The report noted that “most but not all of these malfunctions occurred when aircraft were [being tested] on the ground.”

Experts at RAF Boscombe Down refused to fly the helicopters, judging the aircraft as not airworthy and urging the MoD and air force "in the strongest possible terms" to end operational flights of the Chinook until corrective action was taken on FADEC.

The Philips report – in carefully-worded language designed not to apportion blame given the remit of the inquiry – notes that as the Mk 2 Chinook was being introduced, and before the crash, “several important meetings took place” between RAF personnel who were gravely concerned about the problems with the new helicopters. The report notes that these meetings “presented a challenge of leadership” and “relied upon” the “loyalty” of the personnel, who were increasingly concerned about the safety questions surrounding the aircraft.

A 1993 review of the FADEC software by EDS-SCICON found 485 anomalies after examining only 18 per cent of the software code.

In an apparent reference to the FADEC problems, the review by Lord Philip stated that “the doubts created by the terms of [the Air Accidents Investigation Branch inspector’s 1994 report] were reinforced by the history of the HC-2 [Chinook Mk 2] and in particular the catalogue of engine control and other malfunctions experienced both at Boscombe Down and by the Squadrons to which the HC-2 had been released”.

Find your next job with computerworld UK jobs