Jackonicko
6th Sep 2000, 17:18
Brian Dixon sent me a PDF of the Computer Weekly article and asked me to post it.
It's huge, so I've started this strand, with a URL link to the original thread:
http://www.pprune.org/ubb/NonCGI/Forum46/HTML/000333.html
Apologies for the size of this post! It includes only the contents and CHAPTER ONE: - Summary. If anyone wants me to post another Chapter, please E-Mail me!
RAF JUSTICE
How the Royal Air Force blamed two dead pilots and covered up problems with the
Chinook? computer system FADEC
Contents
CHAPTER ONE Summary
CHAPTER TWO Development of FADEC engine control system
CHAPTER THREE Problems introducing FADEC into service
CHAPTER FOUR FADEC enters service despite concerns
CHAPTER FIVE THE CRASH
CHAPTER SIX The crash investigations
CHAPTER SEVEN The technical and political cover-up
ACKNOWLEDGEMENTS
RAF JUSTICE
How the Royal Air Force blamed two dead pilots and covered up problems with the Chinook? computer system
FADEC Chapter 1 2 - 1
Shortly after 7.30am on Friday June 2 1994, crew members of a Chinook helicopter,airframe registration number ZD576, had their last breakfast. They ate cereals; one had poached eggs as well, and another had a full fried breakfast. Then the crew collected their weapons, ready for the day? duties, which were mostly around Northern Ireland. The aircraft? crew flew some undemanding sorties around the province in the morning and arrived back at RAF Aldergrove, in good time to prepare for their next flight to Fort George, Inverness, Scotland. A few minutes after 5 obout 15 minutes after take-off, a yachtsman Mark Holbrook, saw it flying low and straight in good visibility. In front of the Chinook was the Mull of Kintyre, the top of it covered in cloud. To the left was open, unfettered sea and continued good low-level visibility. The pilots entered onto their navigation computer the pre-planned change of course: a left-turn to avoid the Mull. About 18 seconds before impact everything seemed normal. However the Chinook did not make its intended turn. Instead it flew a course ?nobody knows for certain in these last few seconds if it was going straight, weaving or undulating ?towards the bad weather on the top of the Mull. The station commander at RAF Odiham, the UK? main Chinook base, would later tell an RAF Board of Inquiry that he did not believe that the crew would have elected to fly straight towards the bad weather on the Mull. At about 6pm several people on the Mull heard a dull thump followed by a loud whooshing sound. The air was filled with flames, and two cyclists on the hillside were enveloped in smoke. Chinook ZD576 had hit the hillside, bounced, broken up and landed again about 300m further on. All the occupants of the aircraft suffered major trauma on impact and died instantly. The RAF could have investigated the incident itself, but it chose to request help from the Department of Transport? Air Accident Investigation Branch. The investigators concluded that there was no evidence of a technical malfunction capable of causing the crash. Later a RAF Board of Inquiry could not determine whythe pilots had not made a left turn as planned and blamed them for flying into the Mull. Queen? regulations state that: ?nly in cases where there is a absolutely no doubt whatsoever should deceased aircrew be found negligent.?
Jonathan Tapper and Rick Cook were convicted posthumously of gross negligence. No professional airman can be branded with a more infamous mark of disgrace. Ministers of the last two governments, and the Ministry of Defence, have defended the decision to blame the pilots with vigour, on the basis of the report by the AirAccident Investigation Branch. However there may have been a world of difference between ?o evidence of technical malfunction?and no malfunction.
* * * * *
Four years after the crash on the Mull of Kintyre, Bric Lewis finds himself piloting a Chinook which is flying particularly smoothly.
Inside the cavernous cabin of a Chinook the ferment of noise is intrusive. With two large jet engines and six 60-foot rotor blades slapping the air at 225 revolutions per minute, you can cup your hand over someone? ear, shout and they will not understand a word.But when Lewis exclaims involuntarily ?h God?into the microphone of his headset, and the words are transmitted instantaneously to all those on board, the cabin goes almost ethereally quiet, as if life itself were held in suspension. The Chinook is falling out of the sky ... upside down ...yet the displays in the cockpit show no warning lights?no evidence of any technical malfunction?no evidence of technical malfunction. It was exactly the phrase that had been used four years earlier to condemn the two pilots, Jonathan Tapper and Rick Cook after the crash on the Mull of Kintyre. Lewis and his crew knew then that, if they did not survive, they too stood to lose not only their lives but their reputations. It was a simple equation: accident plus no evidence of technical malfunction equalspilot error. Yet Lewis? aircraft had become uncontrollable without warning, for no apparent reason.
* * * * *
At around the same time as the incident involving Bric Lewis? Chinook in the USA, the United Kingdom Armed Forces Minister Dr John Reid was taking centre seat before the House of Commons Defence Committee. He could not have looked more grave.The television crew made their last-minute checks as the high ceilings of the committee room soaked up the light banter. Some MPs tried to engage Dr Reid in small-talk. He seemed to resist.
The Committee was convening to discuss one of the most notorious military aircraft crashes of the past 30 years: the loss of a Chinook ZD576 on the Mull of Kintyre, Scotland in June 1994.?his was a tragic, tragic loss of life,?said Bruce George, chairman of the Committee, ?heir deaths were a severe blow in the fight against terrorism.?A clue to the importance of the meeting was the fact that Reid, by his own admission, had spent two days preparing for it. On the outcome of the hearing would rest Reid? ministerial credibility, at least in the eyes of his department. Officials and some military officers wanted a minister who was able to defend one of the most controversial decisions the armed forces has made in recent years: the decision to find the dead pilots of ZD576 guilty of gross negligence. The verdicts against Flight Lieutenants Jonathan Tapper and Rick were based on thefact that there was no evidence of any technical malfunction which could have caused them to crash into the Mull of Kintyre. So it was taken as read that, for no reason which has been ascertained, that Tapper and Cook decided to fly a serviceable aircraft into the ground. Some MPs including Martin Orch 1998, MPs were given a chance to challenge some of the evidence, face to face with the minister and his advisers. Depending on the evidence presented, MPs would be either satisfied that the verdict was correct or could press for a re-opening ofthe inquiry. There had already been an investigation by the Department of Transport? Air Accidents Investigation Branch which assisted a Board of Inquiry convened by the Royal Air Force, and a Fatal Accident Inquiry conducted by a civil judge in Scotland. As these inquiries were regarded as exhaustive, and had concluded that there was no technical malfunction which could have caused the crash on the Mull of Kintyre, the Defence Committee agreed not to challenge or endorse the findings of earlier inquiries into the accident. MPs were to ask questions on the ?ider issues.?Jonathan Tapper and Rick Cook were two Special Forces pilots who had been selected to fly the mission from Northern Ireland to Inverness in Scotland. Before the flight, Tapper and Cook had, separately, expressed their doubts about whether the newly-modified Chinook ZD576, was ready for operational service. Chinook ZD576 had recently come out the maintenance depot. It had been upgraded from Mk1 to Mk2 status. Among its new features was a complex and innovative computer system to control the engines, called FADEC. It stood for Full Authority Digital Electronic Control, though some in the military world call it the Full Authority Digital Engine Control.
Since the installation of the FADEC modifications, the Chinook Mk2 had had some problems. Warning signs had been illuminated in the cockpit; warnings of the mostserious kind, indicating a possible engine failure. A few weeks before the crash of ZD576, one of the two engines on this helicopter had been replaced because of afaulty torque meter. These and other technical problems had made Tapper and Cook anxious about flying in the Chinook Mk2. The helicopter was not the easiest aircraft to fly at the best of times. Any significant warning sign in the cockpit, such as ?NG FAIL?for engine failure required a series of checks to establish whether or not it was a spurious warning. What if something were to go wrong while those crucial checks were being carried out? Something serious? On Friday, 27 May 1994, six days before his last flight, Tapper had asked permission of his Squadron Leader David Prowse to keep an extra Chinook Mark One in Northern Ireland for an additional period. The Mk1 version of the helicopter was without FADEC. The RAF? Board of Inquiry was told that Tapper and Cook had been particularly concerned about FADEC-related incidents. Tapper and Cook were uncertain how it would perform during operational sorties. They wondered ?hat sort of emergencies or situations the present number ofspurious and unexplained incidents would lead to,?said Lieutenant Ian Kingston RN (Royal Navy), at the RAF Board of Inquiry in 1995.The Inquiry was also told that the problems with the Chinook Mark two were not always of a trivial nature. Squadron Leader David Morgan said there had been emergencies of a ?light critical nature?which ?ave mainly been associated with the engine control system FADEC.?These emergencies included episodes of the engine running out of control, he added. For Tapper, aged 28, and Cook aged 30, death was not the only fear. Both pilots had lost close friends in three earlier Chinook accidents. None of the pilots had been totally exonerated after these crashes. In no fatal Chinook crash in more than a decade have the pilots been totally exonerated.Tapper and Cook feared that if they lost their lives in an accident, their reputations would die with them. Tapper? request for a Chinook Mk1 was refused because there were none available. He died a few days later in the ?ark two?aircraft he had been reluctant to fly.The concerns that Tapper and Cook had expressed about flying a newly-modified, perhaps jinxed aircraft, which had been in the maintenance depot once too often, were held to be groundless. Ministers have said, repeatedly, that the new FADEC system played no part in the crash. Indeed, on this last flight of ZD576, ministers said that nothing had gone seriously awry except the judgement of the pilots.
?here isn? a shred of evidence that there was any technical malfunction on this Chinook,?Reid said in a Channel Four interview. As not all MPs were convinced that this was the case, Reid, in a formal white shirt with gold cufflinks, gold watch, and gifted with an unaffected voice which he used with the clean, measured articulation of a practiced orator, came to answer questions from the Defence Committee on 4 March 1998. ?here have been a lot of misinformed statements,?said Reid, ?ome of them sincerely pursued, others because of the virtue of the headlines they might create. Therefore I welcome the opportunity to explain or inform whenever I can on these.?He said that the Defence Secretary George Robertson and other ministers have triedwith ?ome pain, some sympathy, some scepticism and some scrutiny to look at theseevents.?He added: ?e are all capable of making mistakes but to the best of our abilities we have not been able to find ground for re-opening the inquiry.?In his sometimes lengthy tracts of verbal evidence he spoke with quiet, imposing authority.? have looked at it in detail not just because it is a matter of public interest but because this deals with human beings who died, and human beings whose families are in anguish because a judgement was made that they [the pilots] were in error. That is not something to be taken lightly.?For the Ministry of Defence, the hearing was an unequivocal success. After Reid? oral evidence and further information from the Ministry, the Committee concluded that there was ?o compelling evidence of any fundamental flaws in the design of the Chinook Mark 2 or its components.?The Committee? report also sought to lay to rest any notion that the last flight ofZD576 may have had a serious technical malfunction. It appears, however, that Reid had not been briefed comprehensively by his officials and therefore had not told the whole story. Nor had the Ministry of Defence. Nor hadthe Air Accidents Investigation Branch. The crash investigators had not presented all the evidence because they had not, in turn, been given all the facts.?nvestigators had not been told by the RAF about a serious incident involving the ZD576 which had led to an engine being replaced ... six weeks before the ZD576 and all its occupants were destroyed in a crash.?nvestigators were not told that the Ministry of Defence was suing the manufacturers of the FADEC at the time of the crash of ZD576.?nvestigators were also unaware that a basis for the case against the contractor, Textron Lycoming was the defects in the design of the FADEC ... the system that had given rise to Tapper and Cook? concern.?he Fatal Accident Inquiry in Scotland which spent a considerable time studying the FADEC after the Mull of Kintyre crash, was not told that the Ministry ofDefence was suing the FADEC? contractor Textron Lycoming, mainly overdefects in the design of the FADEC?the system that had given rise to Tapper and Cook? concern. ?he FADEC contractor was asked to help the investigators of the crash of ZD576 determine whether their equipment was faulty (at a time when the Ministry of Defence was suing the same contractor over defects in the FADEC engine control system). ?hen fault codes were found in the memory of one of ZD576? surviving engine control systems, the contractors said none of these was significant. MPs were unaware that the assessments of the fault codes in the FADEC were carried out by the same contractors. By their own admission, however, investigators had not understood all of the fault codes. One of those codes found in the wreckage of ZD576 was ?5.?It was described by the contractors as a ?ypical nuisance fault.? Investigators did not know that it was the pre-existence of this ?5?code that had contributed to the severe damage to a Chinook in 1989. ?he Fatal Accident Inquiry in Scotland was not told, at the time of its investigation, of a report by the multinational independent computer company EDS-Scicon which had found what it described as 485 anomalies in the Chinook? FADEC software. And there? no mention of EDS-Scicon? findings in the RAF Board of Inquiry ? report. This is despite the fact that the RAF Board of Inquiry took evidence on the FADEC system. Indeed the investigators were unaware that EDS had found so many anomalies that it had stopped its analysis of the software after examining less than 20% of the code. By this time, EDS-Scicon had identified 56 of the most serious ?ategory one?anomalies. This high level of anomalies was indicative of poorly-developed code, said EDS-Scicon. ?he Fatal Accident Inquiry in Scotland was unaware of a report that had been written by the Assistant Director Helicopter Projects six weeks before the crash of ZD576. The report expressed concern about the ?ow?level of flight testing on the Chinook FADEC. The Assistant Director had added that the FADEC engine control software needed to be revised ?n pursuit of a satisfactory resolution of all safety case issues.?There? also no mention of the Assistant Director? concern about FADEC in the RAF Board of Inquiry? report. The gaps in the level of understanding of the investigators ran deeper still. ?nvestigators did not test two key instruments that give an early warning of one of the dangerous occurrences on a helicopter: an engine runaway which can, in extreme cases, lead to rotors flying off. Prior to the crash of ZD576, there had been a number of engine runaways involving the newly-modified Chinooks. ?nvestigators asked Boeing to help conduct a computer simulation of the crash of ZD576. The simulation differed fundamentally from some of the evidence in the wreckage.
The simulation did not take into account the unusual position of the pilot? footpedals. In a Chinook which is under control a movement in the pedals of between five and 10% is normal. But when the wreckage of ZD576 was examined the pedal position indicated a 77% movement towards its maximum extension. On aChinook travelling at speed the pedals are not used to turn left or right. One of their main functions is to keep the aircraft under control by stopping it turning sideways. The pedal position could have moved when the crash occurred. It is also possible that John Cook, like Bric Lewis four years later, was struggling to save an aircraft in which the flying controls were not responding. Was it really the case that there was not a shred of evidence of technical malfunctionon ZD576? The House of Commons Defence Committee was given technical evidence that was not always accurate. It was told that, because one of the two engine control computer systems on the Chinook had survived the impact, it indicated that the other was working. Dr Reid, based on briefings by his officials, told MPs:?..if one was working normally the other one was working normally.?This is not the case. There was some sharing of information between the Chinook?two FADEC systems but they operated largely independently of each other: one controlled the No1 engine and the other controlled the No 2 engine. So, saying that if one was working the other was also working, was a little like saying that, in examining the wreckage of a car crash, that if the front brakes were found tohave worked normally, the back brakes must also have been working normally. It was also of note that the computer systems that controlled each engine were going wrong with such regularity before the crash of ZD576, that there were not enough spare devices to go around. So aircraft were cannibalised for their systems. It was not only MPs who were, on occasions, given the wrong impression. A briefing note prepared for Ministry of Defence spokes-people said that the Chinook? navigation computer system enabled the RAF Board of Inquiry to conclude that ?he aircraft kit was functioning properly.?The Tactical Air Navigation System was a computerised navigation system which used satellites, a Doppler velocity sensor and the aircraft? compass heading to help the pilots maintain the correct flight path. The system was not a purpose-built flight data or cockpit voice recorder, neither of which was fitted to ZD576. The Tactical Air Navigation System did not say how the engines or the computer systems that controlled them, were functioning. It did notgive an account of the tens of thousands of components on the Chinook.
This statement told only half the truth. Evidence has, in the past few weeks, come to light which shows that there had been a flight safety critical accident involving the Chinook Mk2. Moreover it involved a Chinook belonging to the UK government. The incident in 1989 was so serious that it caused the destruction of a Chinook Mk2 ... and it was caused by a defect in the design of the FADEC. Indeed the UK government won a legal action against the FADEC? contractor on the basis that the design of FADEC was defective, and had led to damage to a Chinook which cost millions of pounds to repair. The Ministry mounted a cover-up after the accident. Reid told the Defence Committee in 1998 that the accident was not to do with the FADEC software. So it appears that the Chinook Mk2 was given a clearance to fly in 1993, mainly on the basis of an incorrect assumption that there had been no flight safety critical problems. Also the Ministry? statement that it cleared the Mk2 for flight after taking into account the US Army? experience of FADEC gives an incorrect impression. For the US Army did not buy a FADEC system that was exactly the same as the RAF? version. Indeed the Assistant Director Helicopter Projects said in a confidential memo shortly before the crash of ZD576, questioned the validity of comparing the tests that had been carried out on the US? FADEC-equipped engines with the tests on the RAF? FADEC-equipped engines. He described the flight tests on the RAF? version of FADEC as ?ow.?In the same memo the Assistant Director counselled that ?ull account?should be taken of the views of the aircraft? assessors at the Aeroplane and Armament Experimental Establishment (A&AEE). So, despite the concerns of the A&AEE - concerns that the Assistant Director Helicopter Projects had urged should be taken full account of - and despite the incorrect impression that there had been no flight safety critical problems during ground or flight testing of the FADEC, the Chinook Mk2 received a clearance that would leave Tapper and Cook with no choice but to fly the aircraft as instructed. It would also emerge that, a day before the crash of ZD576, airworthiness assessors had suspended flights on the newly-modified Chinook because they had not had satisfactory explanations from the contractors over a number of unexplained incidents. Most of those incidents had involved the new FADEC system.Such was the concern of the trials pilots that they refused to fly a Chinook Mk 2 even for a 12-minute daytime trip from the A&AEE? site at Boscombe Down to RAFOdiham, the Chinook? main base. The then senior unit test pilot at RAF Odiham, Squadron Leader Robert Burke, had to take an operational crew in a car from RAF Odiham to Boscombe Down to collect the Chinook M2 and bring it back to Odiham.
The dispensation not to the fly the Chinook Mk2 was afforded only to trials pilots. Tapper and Cook, as operational pilots, were operational pilots who could not refuseto fly the Chinook Mk2 unless it had been refused clearance for safe flight. Trials flying on the Mk2 did not resume at the A&AEE until November 1994, more than four months after the crash, and only then after there were further modifications. Our investigation also raises questions about the lengths to which the Ministry of Defence went, after a fatal accident, to protect its contractors from any suggestion that their equipment may have been faulty. Reid was adamant last year that the Ministry? legal action over the Chinook which was destroyed in an accident 1989, was taken on the basis of faulty testing procedures, not because of the software. ?e did not sue them because of a failure of the FADEC software,?Reid told the House of Commons Defence Committee in March 1998. ?his is one of the misconceptions that has been allowed to flourish... it was essentially about negligence in testing procedures and not with the software...?Yet the documents filed by the UK government against the manufacturer of the engine control systems contained a series of allegations about the design defects in the software, including a claim that the FADEC was not airworthy. The documents also alleged that development tests on the hardware were inadequate and that there was a failure to document the software adequately. Insurers for the contractor, Textron Lycoming, denied the allegations, and criticised a test that had been carried out on the system, but the company ended up paying the Ministry of Defence more than $3m in settlement. So Reid, in giving the UK government? position, was actually affirming the defence that had been put forward by Textron-Lycoming? insurers, not the successful case on which the Ministry? allegations were based. Reid also told the Committee, based on his briefings, that the engine control system was not safety-critical. However Boeing, which had a contractual responsibility to deliver the aircraft to the Ministry with, in effect, an assurance that it was safe, did categorise the engine control system as safety critical. These and other facts have emerged only after years of campaigning by the families of the two dead pilots; specialists who have been concerned enough to pass on documentary evidence; and to a much lesser extent MPs, and journalists. Was this unofficial investigation necessary? The grief of the families of all 29 people who died on ZD576 cannot be imagined. But should the families of the two pilots have endured such extended and intense suffering? To lose a son in the service of one? country is a sacrifice that the parents of anyone in the armed forces must be prepared to make. But to have the memory and reputation of a dead son vilified by the service to which he has given his life ... without any evidence to prove gross negligence beyond all doubt ... and without his testimony or defence ... could be regarded as a pitiless and posthumous defamation.
?od we?e right side up,?says Biessner. But the Chinook is now was only 250 feet above the ground. The rotor blades are in overspeed, spinning much faster than they should. If the rotor on a helicopter spins too quickly, there? a danger the blades will fly off. And now it? making a screaming sound. But the rotors provide immediate lift and the Chinook? descent slows suddenly, as if a parachute has opened above it. For Nield, it feels as if the bottom is going to drop out of the aircraft. The helicopter is going forward but is yawing again to an extreme. Fortunately there are no obstructions ahead; only level ground. At this moment the nose begins to lift without any command, as if in a repeat of the earlier incident in which the helicopter inverted. Trying to land as soon as possible, Lewis and Nield go to use another of the main flying controls on the Chinook: the collective or thrust lever. It isn? working. The collective lever resembles the handbrake on a car. Some pilots call it ?he collective,?others the thrust lever. Whereas the cyclic is between the plot? legs, the collective is to his side. Any movement of the lever directly alters the pitch of all six rotor blades in unison. The more the collective is pulled, the more the angle of the blades is turned against the air, giving helicopters the familiar ?lapping?noise as the rotors blades attack the surrounding air. It is the collective which enables helicopters to rise or descend on a vertical axis. It is an important flying control when landing. Although Lewis pulls on the collective lever with considerable force, it barely moves. Nield is also trying to force it up without success. But they are now so close to the ground that by pulling on the cyclic, they can bring down the back wheels. Then the helicopter is stationary. Lewis is screaming: ?e made it! We killed the beast!?Everyone gives each other high fives in the cockpit. Now, when it doesn? matter, they find that the collective lever is working perfectly. So does the cyclic, though a pedal is stuck. The engines start to wind down. That? when the crew hear three loud bangs in quick succession. The blades are striking the fuselage. In some previous helicopter accidents in which the rotor blades have been out of control, they have pounded and then sliced the fuselage, and its occupants, into sections. Nield tries to duck down over the console. Lewis tries to get down by the pedals. Buttheir shoulder harnesses are locked.
Reid was right to make the point that the Chinook has an impressive safety record. However the statistics he gave MPs at the committee hearing were wrong. After the hearing the Mod issued the corrected figures. In the UK, there were nine serious accidents involving RAF Chinook between 1984 and 1994. In five of them, the pilots had lived to explain what happened, and in none of these was blame attributed to the aircrew. The same could not be said of the remaining four crashes, all of which were fatal. Three of the four were put down to aircrew error. The fourth was, officially, ?ot positively determined.?The evidence in this last crash of a Chinook during a post-maintenance test flight in the Falklands Islands pointed strongly towards a technical malfunction. Eyewitnesses saw the helicopter in straight and level flight. Then the nose dipped down slightly at first; and the aircraft fell out of the sky, cockpit first. The last words transmitted by the pilots were unintelligible. Investigators found a failure in a flying control, known as the cyclic trim actuator, though they said that this was not serious enough to cause the accident unless there was a separate serious simultaneous malfunction which could have prevented recovery of the aircraft. A second problem was indeed discovered: the malformation of a component. It was found during practical tests that if the pilot had applied a rapid control input in response to an unidentified nose-down pitch, it is possible that a fly
[This message has been edited by Jackonicko (edited 07 September 2000).]
It's huge, so I've started this strand, with a URL link to the original thread:
http://www.pprune.org/ubb/NonCGI/Forum46/HTML/000333.html
Apologies for the size of this post! It includes only the contents and CHAPTER ONE: - Summary. If anyone wants me to post another Chapter, please E-Mail me!
RAF JUSTICE
How the Royal Air Force blamed two dead pilots and covered up problems with the
Chinook? computer system FADEC
Contents
CHAPTER ONE Summary
CHAPTER TWO Development of FADEC engine control system
CHAPTER THREE Problems introducing FADEC into service
CHAPTER FOUR FADEC enters service despite concerns
CHAPTER FIVE THE CRASH
CHAPTER SIX The crash investigations
CHAPTER SEVEN The technical and political cover-up
ACKNOWLEDGEMENTS
RAF JUSTICE
How the Royal Air Force blamed two dead pilots and covered up problems with the Chinook? computer system
FADEC Chapter 1 2 - 1
Shortly after 7.30am on Friday June 2 1994, crew members of a Chinook helicopter,airframe registration number ZD576, had their last breakfast. They ate cereals; one had poached eggs as well, and another had a full fried breakfast. Then the crew collected their weapons, ready for the day? duties, which were mostly around Northern Ireland. The aircraft? crew flew some undemanding sorties around the province in the morning and arrived back at RAF Aldergrove, in good time to prepare for their next flight to Fort George, Inverness, Scotland. A few minutes after 5 obout 15 minutes after take-off, a yachtsman Mark Holbrook, saw it flying low and straight in good visibility. In front of the Chinook was the Mull of Kintyre, the top of it covered in cloud. To the left was open, unfettered sea and continued good low-level visibility. The pilots entered onto their navigation computer the pre-planned change of course: a left-turn to avoid the Mull. About 18 seconds before impact everything seemed normal. However the Chinook did not make its intended turn. Instead it flew a course ?nobody knows for certain in these last few seconds if it was going straight, weaving or undulating ?towards the bad weather on the top of the Mull. The station commander at RAF Odiham, the UK? main Chinook base, would later tell an RAF Board of Inquiry that he did not believe that the crew would have elected to fly straight towards the bad weather on the Mull. At about 6pm several people on the Mull heard a dull thump followed by a loud whooshing sound. The air was filled with flames, and two cyclists on the hillside were enveloped in smoke. Chinook ZD576 had hit the hillside, bounced, broken up and landed again about 300m further on. All the occupants of the aircraft suffered major trauma on impact and died instantly. The RAF could have investigated the incident itself, but it chose to request help from the Department of Transport? Air Accident Investigation Branch. The investigators concluded that there was no evidence of a technical malfunction capable of causing the crash. Later a RAF Board of Inquiry could not determine whythe pilots had not made a left turn as planned and blamed them for flying into the Mull. Queen? regulations state that: ?nly in cases where there is a absolutely no doubt whatsoever should deceased aircrew be found negligent.?
Jonathan Tapper and Rick Cook were convicted posthumously of gross negligence. No professional airman can be branded with a more infamous mark of disgrace. Ministers of the last two governments, and the Ministry of Defence, have defended the decision to blame the pilots with vigour, on the basis of the report by the AirAccident Investigation Branch. However there may have been a world of difference between ?o evidence of technical malfunction?and no malfunction.
* * * * *
Four years after the crash on the Mull of Kintyre, Bric Lewis finds himself piloting a Chinook which is flying particularly smoothly.
Inside the cavernous cabin of a Chinook the ferment of noise is intrusive. With two large jet engines and six 60-foot rotor blades slapping the air at 225 revolutions per minute, you can cup your hand over someone? ear, shout and they will not understand a word.But when Lewis exclaims involuntarily ?h God?into the microphone of his headset, and the words are transmitted instantaneously to all those on board, the cabin goes almost ethereally quiet, as if life itself were held in suspension. The Chinook is falling out of the sky ... upside down ...yet the displays in the cockpit show no warning lights?no evidence of any technical malfunction?no evidence of technical malfunction. It was exactly the phrase that had been used four years earlier to condemn the two pilots, Jonathan Tapper and Rick Cook after the crash on the Mull of Kintyre. Lewis and his crew knew then that, if they did not survive, they too stood to lose not only their lives but their reputations. It was a simple equation: accident plus no evidence of technical malfunction equalspilot error. Yet Lewis? aircraft had become uncontrollable without warning, for no apparent reason.
* * * * *
At around the same time as the incident involving Bric Lewis? Chinook in the USA, the United Kingdom Armed Forces Minister Dr John Reid was taking centre seat before the House of Commons Defence Committee. He could not have looked more grave.The television crew made their last-minute checks as the high ceilings of the committee room soaked up the light banter. Some MPs tried to engage Dr Reid in small-talk. He seemed to resist.
The Committee was convening to discuss one of the most notorious military aircraft crashes of the past 30 years: the loss of a Chinook ZD576 on the Mull of Kintyre, Scotland in June 1994.?his was a tragic, tragic loss of life,?said Bruce George, chairman of the Committee, ?heir deaths were a severe blow in the fight against terrorism.?A clue to the importance of the meeting was the fact that Reid, by his own admission, had spent two days preparing for it. On the outcome of the hearing would rest Reid? ministerial credibility, at least in the eyes of his department. Officials and some military officers wanted a minister who was able to defend one of the most controversial decisions the armed forces has made in recent years: the decision to find the dead pilots of ZD576 guilty of gross negligence. The verdicts against Flight Lieutenants Jonathan Tapper and Rick were based on thefact that there was no evidence of any technical malfunction which could have caused them to crash into the Mull of Kintyre. So it was taken as read that, for no reason which has been ascertained, that Tapper and Cook decided to fly a serviceable aircraft into the ground. Some MPs including Martin Orch 1998, MPs were given a chance to challenge some of the evidence, face to face with the minister and his advisers. Depending on the evidence presented, MPs would be either satisfied that the verdict was correct or could press for a re-opening ofthe inquiry. There had already been an investigation by the Department of Transport? Air Accidents Investigation Branch which assisted a Board of Inquiry convened by the Royal Air Force, and a Fatal Accident Inquiry conducted by a civil judge in Scotland. As these inquiries were regarded as exhaustive, and had concluded that there was no technical malfunction which could have caused the crash on the Mull of Kintyre, the Defence Committee agreed not to challenge or endorse the findings of earlier inquiries into the accident. MPs were to ask questions on the ?ider issues.?Jonathan Tapper and Rick Cook were two Special Forces pilots who had been selected to fly the mission from Northern Ireland to Inverness in Scotland. Before the flight, Tapper and Cook had, separately, expressed their doubts about whether the newly-modified Chinook ZD576, was ready for operational service. Chinook ZD576 had recently come out the maintenance depot. It had been upgraded from Mk1 to Mk2 status. Among its new features was a complex and innovative computer system to control the engines, called FADEC. It stood for Full Authority Digital Electronic Control, though some in the military world call it the Full Authority Digital Engine Control.
Since the installation of the FADEC modifications, the Chinook Mk2 had had some problems. Warning signs had been illuminated in the cockpit; warnings of the mostserious kind, indicating a possible engine failure. A few weeks before the crash of ZD576, one of the two engines on this helicopter had been replaced because of afaulty torque meter. These and other technical problems had made Tapper and Cook anxious about flying in the Chinook Mk2. The helicopter was not the easiest aircraft to fly at the best of times. Any significant warning sign in the cockpit, such as ?NG FAIL?for engine failure required a series of checks to establish whether or not it was a spurious warning. What if something were to go wrong while those crucial checks were being carried out? Something serious? On Friday, 27 May 1994, six days before his last flight, Tapper had asked permission of his Squadron Leader David Prowse to keep an extra Chinook Mark One in Northern Ireland for an additional period. The Mk1 version of the helicopter was without FADEC. The RAF? Board of Inquiry was told that Tapper and Cook had been particularly concerned about FADEC-related incidents. Tapper and Cook were uncertain how it would perform during operational sorties. They wondered ?hat sort of emergencies or situations the present number ofspurious and unexplained incidents would lead to,?said Lieutenant Ian Kingston RN (Royal Navy), at the RAF Board of Inquiry in 1995.The Inquiry was also told that the problems with the Chinook Mark two were not always of a trivial nature. Squadron Leader David Morgan said there had been emergencies of a ?light critical nature?which ?ave mainly been associated with the engine control system FADEC.?These emergencies included episodes of the engine running out of control, he added. For Tapper, aged 28, and Cook aged 30, death was not the only fear. Both pilots had lost close friends in three earlier Chinook accidents. None of the pilots had been totally exonerated after these crashes. In no fatal Chinook crash in more than a decade have the pilots been totally exonerated.Tapper and Cook feared that if they lost their lives in an accident, their reputations would die with them. Tapper? request for a Chinook Mk1 was refused because there were none available. He died a few days later in the ?ark two?aircraft he had been reluctant to fly.The concerns that Tapper and Cook had expressed about flying a newly-modified, perhaps jinxed aircraft, which had been in the maintenance depot once too often, were held to be groundless. Ministers have said, repeatedly, that the new FADEC system played no part in the crash. Indeed, on this last flight of ZD576, ministers said that nothing had gone seriously awry except the judgement of the pilots.
?here isn? a shred of evidence that there was any technical malfunction on this Chinook,?Reid said in a Channel Four interview. As not all MPs were convinced that this was the case, Reid, in a formal white shirt with gold cufflinks, gold watch, and gifted with an unaffected voice which he used with the clean, measured articulation of a practiced orator, came to answer questions from the Defence Committee on 4 March 1998. ?here have been a lot of misinformed statements,?said Reid, ?ome of them sincerely pursued, others because of the virtue of the headlines they might create. Therefore I welcome the opportunity to explain or inform whenever I can on these.?He said that the Defence Secretary George Robertson and other ministers have triedwith ?ome pain, some sympathy, some scepticism and some scrutiny to look at theseevents.?He added: ?e are all capable of making mistakes but to the best of our abilities we have not been able to find ground for re-opening the inquiry.?In his sometimes lengthy tracts of verbal evidence he spoke with quiet, imposing authority.? have looked at it in detail not just because it is a matter of public interest but because this deals with human beings who died, and human beings whose families are in anguish because a judgement was made that they [the pilots] were in error. That is not something to be taken lightly.?For the Ministry of Defence, the hearing was an unequivocal success. After Reid? oral evidence and further information from the Ministry, the Committee concluded that there was ?o compelling evidence of any fundamental flaws in the design of the Chinook Mark 2 or its components.?The Committee? report also sought to lay to rest any notion that the last flight ofZD576 may have had a serious technical malfunction. It appears, however, that Reid had not been briefed comprehensively by his officials and therefore had not told the whole story. Nor had the Ministry of Defence. Nor hadthe Air Accidents Investigation Branch. The crash investigators had not presented all the evidence because they had not, in turn, been given all the facts.?nvestigators had not been told by the RAF about a serious incident involving the ZD576 which had led to an engine being replaced ... six weeks before the ZD576 and all its occupants were destroyed in a crash.?nvestigators were not told that the Ministry of Defence was suing the manufacturers of the FADEC at the time of the crash of ZD576.?nvestigators were also unaware that a basis for the case against the contractor, Textron Lycoming was the defects in the design of the FADEC ... the system that had given rise to Tapper and Cook? concern.?he Fatal Accident Inquiry in Scotland which spent a considerable time studying the FADEC after the Mull of Kintyre crash, was not told that the Ministry ofDefence was suing the FADEC? contractor Textron Lycoming, mainly overdefects in the design of the FADEC?the system that had given rise to Tapper and Cook? concern. ?he FADEC contractor was asked to help the investigators of the crash of ZD576 determine whether their equipment was faulty (at a time when the Ministry of Defence was suing the same contractor over defects in the FADEC engine control system). ?hen fault codes were found in the memory of one of ZD576? surviving engine control systems, the contractors said none of these was significant. MPs were unaware that the assessments of the fault codes in the FADEC were carried out by the same contractors. By their own admission, however, investigators had not understood all of the fault codes. One of those codes found in the wreckage of ZD576 was ?5.?It was described by the contractors as a ?ypical nuisance fault.? Investigators did not know that it was the pre-existence of this ?5?code that had contributed to the severe damage to a Chinook in 1989. ?he Fatal Accident Inquiry in Scotland was not told, at the time of its investigation, of a report by the multinational independent computer company EDS-Scicon which had found what it described as 485 anomalies in the Chinook? FADEC software. And there? no mention of EDS-Scicon? findings in the RAF Board of Inquiry ? report. This is despite the fact that the RAF Board of Inquiry took evidence on the FADEC system. Indeed the investigators were unaware that EDS had found so many anomalies that it had stopped its analysis of the software after examining less than 20% of the code. By this time, EDS-Scicon had identified 56 of the most serious ?ategory one?anomalies. This high level of anomalies was indicative of poorly-developed code, said EDS-Scicon. ?he Fatal Accident Inquiry in Scotland was unaware of a report that had been written by the Assistant Director Helicopter Projects six weeks before the crash of ZD576. The report expressed concern about the ?ow?level of flight testing on the Chinook FADEC. The Assistant Director had added that the FADEC engine control software needed to be revised ?n pursuit of a satisfactory resolution of all safety case issues.?There? also no mention of the Assistant Director? concern about FADEC in the RAF Board of Inquiry? report. The gaps in the level of understanding of the investigators ran deeper still. ?nvestigators did not test two key instruments that give an early warning of one of the dangerous occurrences on a helicopter: an engine runaway which can, in extreme cases, lead to rotors flying off. Prior to the crash of ZD576, there had been a number of engine runaways involving the newly-modified Chinooks. ?nvestigators asked Boeing to help conduct a computer simulation of the crash of ZD576. The simulation differed fundamentally from some of the evidence in the wreckage.
The simulation did not take into account the unusual position of the pilot? footpedals. In a Chinook which is under control a movement in the pedals of between five and 10% is normal. But when the wreckage of ZD576 was examined the pedal position indicated a 77% movement towards its maximum extension. On aChinook travelling at speed the pedals are not used to turn left or right. One of their main functions is to keep the aircraft under control by stopping it turning sideways. The pedal position could have moved when the crash occurred. It is also possible that John Cook, like Bric Lewis four years later, was struggling to save an aircraft in which the flying controls were not responding. Was it really the case that there was not a shred of evidence of technical malfunctionon ZD576? The House of Commons Defence Committee was given technical evidence that was not always accurate. It was told that, because one of the two engine control computer systems on the Chinook had survived the impact, it indicated that the other was working. Dr Reid, based on briefings by his officials, told MPs:?..if one was working normally the other one was working normally.?This is not the case. There was some sharing of information between the Chinook?two FADEC systems but they operated largely independently of each other: one controlled the No1 engine and the other controlled the No 2 engine. So, saying that if one was working the other was also working, was a little like saying that, in examining the wreckage of a car crash, that if the front brakes were found tohave worked normally, the back brakes must also have been working normally. It was also of note that the computer systems that controlled each engine were going wrong with such regularity before the crash of ZD576, that there were not enough spare devices to go around. So aircraft were cannibalised for their systems. It was not only MPs who were, on occasions, given the wrong impression. A briefing note prepared for Ministry of Defence spokes-people said that the Chinook? navigation computer system enabled the RAF Board of Inquiry to conclude that ?he aircraft kit was functioning properly.?The Tactical Air Navigation System was a computerised navigation system which used satellites, a Doppler velocity sensor and the aircraft? compass heading to help the pilots maintain the correct flight path. The system was not a purpose-built flight data or cockpit voice recorder, neither of which was fitted to ZD576. The Tactical Air Navigation System did not say how the engines or the computer systems that controlled them, were functioning. It did notgive an account of the tens of thousands of components on the Chinook.
This statement told only half the truth. Evidence has, in the past few weeks, come to light which shows that there had been a flight safety critical accident involving the Chinook Mk2. Moreover it involved a Chinook belonging to the UK government. The incident in 1989 was so serious that it caused the destruction of a Chinook Mk2 ... and it was caused by a defect in the design of the FADEC. Indeed the UK government won a legal action against the FADEC? contractor on the basis that the design of FADEC was defective, and had led to damage to a Chinook which cost millions of pounds to repair. The Ministry mounted a cover-up after the accident. Reid told the Defence Committee in 1998 that the accident was not to do with the FADEC software. So it appears that the Chinook Mk2 was given a clearance to fly in 1993, mainly on the basis of an incorrect assumption that there had been no flight safety critical problems. Also the Ministry? statement that it cleared the Mk2 for flight after taking into account the US Army? experience of FADEC gives an incorrect impression. For the US Army did not buy a FADEC system that was exactly the same as the RAF? version. Indeed the Assistant Director Helicopter Projects said in a confidential memo shortly before the crash of ZD576, questioned the validity of comparing the tests that had been carried out on the US? FADEC-equipped engines with the tests on the RAF? FADEC-equipped engines. He described the flight tests on the RAF? version of FADEC as ?ow.?In the same memo the Assistant Director counselled that ?ull account?should be taken of the views of the aircraft? assessors at the Aeroplane and Armament Experimental Establishment (A&AEE). So, despite the concerns of the A&AEE - concerns that the Assistant Director Helicopter Projects had urged should be taken full account of - and despite the incorrect impression that there had been no flight safety critical problems during ground or flight testing of the FADEC, the Chinook Mk2 received a clearance that would leave Tapper and Cook with no choice but to fly the aircraft as instructed. It would also emerge that, a day before the crash of ZD576, airworthiness assessors had suspended flights on the newly-modified Chinook because they had not had satisfactory explanations from the contractors over a number of unexplained incidents. Most of those incidents had involved the new FADEC system.Such was the concern of the trials pilots that they refused to fly a Chinook Mk 2 even for a 12-minute daytime trip from the A&AEE? site at Boscombe Down to RAFOdiham, the Chinook? main base. The then senior unit test pilot at RAF Odiham, Squadron Leader Robert Burke, had to take an operational crew in a car from RAF Odiham to Boscombe Down to collect the Chinook M2 and bring it back to Odiham.
The dispensation not to the fly the Chinook Mk2 was afforded only to trials pilots. Tapper and Cook, as operational pilots, were operational pilots who could not refuseto fly the Chinook Mk2 unless it had been refused clearance for safe flight. Trials flying on the Mk2 did not resume at the A&AEE until November 1994, more than four months after the crash, and only then after there were further modifications. Our investigation also raises questions about the lengths to which the Ministry of Defence went, after a fatal accident, to protect its contractors from any suggestion that their equipment may have been faulty. Reid was adamant last year that the Ministry? legal action over the Chinook which was destroyed in an accident 1989, was taken on the basis of faulty testing procedures, not because of the software. ?e did not sue them because of a failure of the FADEC software,?Reid told the House of Commons Defence Committee in March 1998. ?his is one of the misconceptions that has been allowed to flourish... it was essentially about negligence in testing procedures and not with the software...?Yet the documents filed by the UK government against the manufacturer of the engine control systems contained a series of allegations about the design defects in the software, including a claim that the FADEC was not airworthy. The documents also alleged that development tests on the hardware were inadequate and that there was a failure to document the software adequately. Insurers for the contractor, Textron Lycoming, denied the allegations, and criticised a test that had been carried out on the system, but the company ended up paying the Ministry of Defence more than $3m in settlement. So Reid, in giving the UK government? position, was actually affirming the defence that had been put forward by Textron-Lycoming? insurers, not the successful case on which the Ministry? allegations were based. Reid also told the Committee, based on his briefings, that the engine control system was not safety-critical. However Boeing, which had a contractual responsibility to deliver the aircraft to the Ministry with, in effect, an assurance that it was safe, did categorise the engine control system as safety critical. These and other facts have emerged only after years of campaigning by the families of the two dead pilots; specialists who have been concerned enough to pass on documentary evidence; and to a much lesser extent MPs, and journalists. Was this unofficial investigation necessary? The grief of the families of all 29 people who died on ZD576 cannot be imagined. But should the families of the two pilots have endured such extended and intense suffering? To lose a son in the service of one? country is a sacrifice that the parents of anyone in the armed forces must be prepared to make. But to have the memory and reputation of a dead son vilified by the service to which he has given his life ... without any evidence to prove gross negligence beyond all doubt ... and without his testimony or defence ... could be regarded as a pitiless and posthumous defamation.
?od we?e right side up,?says Biessner. But the Chinook is now was only 250 feet above the ground. The rotor blades are in overspeed, spinning much faster than they should. If the rotor on a helicopter spins too quickly, there? a danger the blades will fly off. And now it? making a screaming sound. But the rotors provide immediate lift and the Chinook? descent slows suddenly, as if a parachute has opened above it. For Nield, it feels as if the bottom is going to drop out of the aircraft. The helicopter is going forward but is yawing again to an extreme. Fortunately there are no obstructions ahead; only level ground. At this moment the nose begins to lift without any command, as if in a repeat of the earlier incident in which the helicopter inverted. Trying to land as soon as possible, Lewis and Nield go to use another of the main flying controls on the Chinook: the collective or thrust lever. It isn? working. The collective lever resembles the handbrake on a car. Some pilots call it ?he collective,?others the thrust lever. Whereas the cyclic is between the plot? legs, the collective is to his side. Any movement of the lever directly alters the pitch of all six rotor blades in unison. The more the collective is pulled, the more the angle of the blades is turned against the air, giving helicopters the familiar ?lapping?noise as the rotors blades attack the surrounding air. It is the collective which enables helicopters to rise or descend on a vertical axis. It is an important flying control when landing. Although Lewis pulls on the collective lever with considerable force, it barely moves. Nield is also trying to force it up without success. But they are now so close to the ground that by pulling on the cyclic, they can bring down the back wheels. Then the helicopter is stationary. Lewis is screaming: ?e made it! We killed the beast!?Everyone gives each other high fives in the cockpit. Now, when it doesn? matter, they find that the collective lever is working perfectly. So does the cyclic, though a pedal is stuck. The engines start to wind down. That? when the crew hear three loud bangs in quick succession. The blades are striking the fuselage. In some previous helicopter accidents in which the rotor blades have been out of control, they have pounded and then sliced the fuselage, and its occupants, into sections. Nield tries to duck down over the console. Lewis tries to get down by the pedals. Buttheir shoulder harnesses are locked.
Reid was right to make the point that the Chinook has an impressive safety record. However the statistics he gave MPs at the committee hearing were wrong. After the hearing the Mod issued the corrected figures. In the UK, there were nine serious accidents involving RAF Chinook between 1984 and 1994. In five of them, the pilots had lived to explain what happened, and in none of these was blame attributed to the aircrew. The same could not be said of the remaining four crashes, all of which were fatal. Three of the four were put down to aircrew error. The fourth was, officially, ?ot positively determined.?The evidence in this last crash of a Chinook during a post-maintenance test flight in the Falklands Islands pointed strongly towards a technical malfunction. Eyewitnesses saw the helicopter in straight and level flight. Then the nose dipped down slightly at first; and the aircraft fell out of the sky, cockpit first. The last words transmitted by the pilots were unintelligible. Investigators found a failure in a flying control, known as the cyclic trim actuator, though they said that this was not serious enough to cause the accident unless there was a separate serious simultaneous malfunction which could have prevented recovery of the aircraft. A second problem was indeed discovered: the malformation of a component. It was found during practical tests that if the pilot had applied a rapid control input in response to an unidentified nose-down pitch, it is possible that a fly
[This message has been edited by Jackonicko (edited 07 September 2000).]