Hi everyone,
I mentioned that a more comprehensive review of Mr Campbell's publication would be posted. It has been written by Air Cdr (Ret'd) John Blakeley, and has the full endorsement of Jon's father, Mike Tapper. It is very comprehensive. Apologies for the length of the post, but it would have lost much had it been shortened.
Introduction
I have now had the chance to look at Steuart Campbell's book "Chinook Crash", albeit on a speed reading basis. In parts it reads with the sort of detail of a Clancy techno-thriller, and this style will certainly appeal to some readers even though it generates a lot of page filling and irrelevant detail - but if it was a Clancy style work of fiction I would have suggested a happier ending. Sadly, of course, it isn't and we all know that the story ends in tragedy - but none of us, including Campbell, know with certainty why. Campbell's last sentence "The accident is now explained" must rate very high on the Jeremy Paxman scale of arrogant statements. By partial quotes from the BoI; by only using those "facts" that suit his theory and by failing to challenge the Board in so many areas where we know they were deficient, and I am looking very much at the engineering area and the evidence to the House of Lords Select Committee, I believe that Campbell has started from the answer and then "situated the appreciation". This is a pity, since he obviously put a lot of effort into his book but failed to analyse all potentially relevant causes of the accident, including such basics as the airworthiness of the Chinook fleet at the time. He also gives the impression of wanting to vilify the captain, Jonathan Tapper, at every opportunity, and one has to ask why? We have been here before as there was a serious attempt to vilify Jonathan Tapper at the FAI which drew the Sheriff's comment of " the universal plaudits of those witnesses who had actually flown with him before the accident and whose evidence I have outlined above".
Those readers familiar with the BoI and the inquiries will find little new in the summaries of all of these activities, and probably, like me, they will be constantly saying - did the Board really say that? As a few examples:
1. Board Conclusions
1.1 VFR versus IFR
At Chapter 4 Campbell notes that amongst the Board's incidental conclusions was a statement that " the weather was suitable for the flight, but would have required (my underlining) flight in accordance with IFR near the Mull of Kintyre". In fact this is one of the classic non sequiturs of the Board that one might have expected the detailed analysis that Campbell claims to have done to have picked up. I have, for example, seen Campbell's recent e-mail to Ralph Kohn criticising Tim Slessor's book in which Campbell claims "With no bias and thorough investigation, I was able to take a 'balanced' view, which I hope will be evident to you." I will not comment on the bias, but the thorough investigation claim has so far eluded me since at paragraph 42, discussing the weather, the Board says:
42. Weather - The Board considered that the weather information available to the crew at RAF Aldergrove prior to flight was comprehensive and adequate for the task, and the Board was content that the crew had considered the weather relevant to their flight. The Board then considered the suitability of the forecast and actual weather for the VFR flight planned by the crew. The weather documentation faxed to the crew indicated that conditions entirely suitable for helicopter low level VFR flight would prevail over the greater portion of their route, but that over coastal areas there would be an occasional risk of less favourable but acceptable conditions, and an isolated risk of conditions sufficiently poor to preclude VFR flight. These indications were reflected in the associated TAFs and METARs. Along the crews planned route, these occasional and isolated conditions would only have been expected in the area of the Mull of Kintyre, with a specific risk of a 30% probability of weather below VFR limits being forecast for Machrihanish. In the opinion of the Board, a forecast of a 30% probability of en-route weather below VFR limits was not sufficient to preclude an attempt at a VFR flight (my underlining). However, a suitable bad weather contingency plan would have been required. This might have been a VFR diversion around the bad weather, a VFR return to the point of departure, or a pre-planned climb and conversion to IFR flight (my underlining). The possibility of a lightning strike affecting the aircraft was also considered by the Board, but as there were no reports of lightning activity in the area, and no evidence of a lightning strike was found in the technical investigation, it was discounted. Similarly, the Board also considered the part that turbulence may have played in the accident and, as the aftercast indicates that the turbulence in the area was only moderate, the Board concluded that it could have provided no more than a distraction to the crew, particularly when flying in IMC. However, as the actual weather in the area of the crash site at the time of the accident was very poor, with very low cloud bases and low visibilities, the Board concluded that weather was a contributory factor in the accident.
Quite how the BoI and then Campbell take these statements as requiring IFR flight in the vicinity of the Mull I will leave others to work out.
1.2 Serviceability
1.2.1
Again Campbell is happy to accept the BoI's unfounded assertion that the aircraft was serviceable to undertake the flight. Leaving aside the fleet airworthiness issue which would have meant that the aircraft came nowhere near meeting the safety requirements for civilian passenger flight, neither the BoI nor Campbell recognise the fact that the BoI again ignores its own evidence and the technical history of the aircraft in making such an assertion. As a minimum we know that the aircraft was carrying at least one incipient electrical fault in the PTIT gauge or its DECU or the sensor or, even more likely in my experience in its wiring or connectors (and if Campbell knew anything about aircraft maintenance operations he would realise that the problem going away when the gauges were swapped round is a classic trait of any transient electrical fault. Sqn Ldr Burke said at the House of Lords Select Committee "The [DECU] Multi point connector was not of a good design, and again you had power interrupts on the system. The squadrons introduced a procedure, probably the OCU did as well, but I am not certain on that point, where the crewman every quarter of an hour would have to go up and check physically that this multi-point had not vibrated loose". HL Paper25(ii) para 677" Even in October 1995 the US Army Release to Service recognised the inherent "security" problems of the DECU connectors by requiring both a pre-fight and a 30 minute ramp check of the DECU connectors - ie they were still being inspected before every flight
1.2.2
In their opening remarks the Board decides to "eliminate [my bold] as possible causes: major technical malfunction or structural failure of the aircraft prior to impact;
Therefore the Inquiry focused on the crews handling and operation of the aircraft.
But at paragraph 35d the Board states:
Nevertheless an unforeseen technical malfunction of the type being experienced on the Chinook HC2, which would not necessarily have left any physical evidence, remained a possibility, and could not be discounted.
Perhaps I am missing something obvious, but it seems to me that this statement is at total odds with the Board's opening remarks, and this major discrepancy should have easily been picked up by the Review Process and indeed by Campbell's "unbiased and thorough investigation". Further evidence that Campbell was only too willing to believe the BoI in those areas that suited his appreciation of the situation - or perhaps better helped situate his appreciation!
1.2.3
In an amazing piece of logic under "Malfunction" Campbell makes the following statement:
"Much has been made of the fact that the AAIB admitted that it could not exclude the possibility of pre-impact damage or faults with some systems in ZD576. Those convinced that the accident was caused by some mechanical fault that somehow distracted the pilots at the moment when they should have been turning or made it impossible to turn the aircraft have seized on this admission as evidence that there was such a fault. However, absence of evidence is not evidence of absence (nor evidence of presence). If a mechanical component is found to be damaged from the impact, but it could have been faulty or damaged before the impact, and there is no way to distinguish between these two alternatives, it cannot be assumed that the damage was pre-impact. Claims that there was a pre-impact fault need to be based on direct evidence of such a fault. The complete absence of such evidence suggests that there was no such fault and that the aircraft was completely serviceable when it crashed. "
I was doing OK until the last two sentences, but then it goes very wrong. If you do not know whether the item was damaged before or after the accident (and bearing in mind that the "damage" may be a transient electrical or software fault) it goes without saying that there will be no direct evidence before the crash - that is where ADRs and CVRs are so useful as I know from personal involvement in my engineering officers using the Tornado ADR to investigate incidents where there were no symptoms by the time the aircraft landed - incidentally quite a few of which were uncommanded control movements and major aircraft departures from controlled flight. The use of this twisted logic to claim that "The complete absence of such evidence suggests that there was no such fault and that the aircraft was completely serviceable when it crashed." does not accord with any logical argument that I can see. Am I claiming the aircraft was unserviceable - no I am not - like everyone else, other than, it seems, Campbell, I do not know. I do know though that it could have been unserviceable and indeed there are at least as many "facts" pointing to this was as there are hypotheses, or worse hypotheses turned into facts, that point at an operational reason for the accident - had Campbell done the unbiased and thorough examination he claims he would see it too.
2. Crew Duty Time
In his evidence on the crew\'s intentions Campbell again mis-uses the BoI evidence by directly questioning how Tapper intended to get back to Belfast that evening without breaking Crew Duty Time CDT limitations and suggesting that whatever he did Tapper would have been "reprimanded". What an outrageous comment, again attacking Tapper\'s reputation to help support Campbell\'s story, which in my opinion shows just how low Campbell has had to sink to put his story together. Campbell could not have known anything of the sort. He repeats a similar comment in the conclusions where he claims as a contributory cause of the accident that "it may have been a mistake for Tapper to insist on taking the sortie near the end of his crew\'s shift, especially when he was bound to exceed the time limit and so break regulations". Again an unjustified and outrageous assertion by Campbell. Had the crew actually broken the rules and had the accident occurred on the homeward flight Campbell\'s comments might be relevant, but the fact is that the crew were perfectly "legal" in terms of CDT and it is mischief making to comment otherwise. If Campbell had read on to the comments of the Station Commander at Aldergrove (and also as SRAFONI responsible for authorising any CDT extension to the maximum allowable) he would have seen the following comments:
"Crew Duty Considerations- The crew of ZD 576 had flown a task within NI earlier on the 2 Jun. I concur with the Board\'s statement (para 66a), that the decision for the crew to carry out the Inverness sortie "Whilst not ideal, was not unreasonable". It was detachment practise, because of the extended day time in early June at Aldergrove\'s latitude, to preserve where possible, a "day-on day-off " routine between the 2 crews. Given the routine nature of the day\'s earlier tasking, it was reasonable, as a one off for a single crew to plan to complete the full day\'s tasking by extending flying hours within the Crew Duty Time (CDT).
Turning to possible further extensions of CDT, I do not believe that, in the absence of any firm evidence one way or the other, we can usefully speculate on TAPPER\'s further intentions after arrival at Inverness. At the time of the accident, the crew was operating within CDT extension which had been properly sought and granted (para 30b), and fatigue was unlikely to have contributed to the cause of the accident."
Not surprisingly, since it would have been a major criticism of flying supervision at RAF Aldergrove, neither of the Air Marshals disagrees with the Station Commander\'s statement. Campbell also implies that Tapper was acting alone by failing properly to take account of CDT on some sort of renegade mission - in fact nothing would have been further from the truth - both 230 Sqn and Aldergrove Operations would have been aware of the tasking and CDT issues (and if they were not they were failing in their duty) as would the JATOC. If supervisors had been unhappy with Tapper\'s plans they could have stopped them at any time, even allowing for the fact that Tapper was "self-authorising" - itself a carefully supervised delegation of authority from above.
3, FADEC
3.1 Although Campbell\'s book touches on the underlying airworthiness issues of the Chinook Mk 2 at the time of the accident, he does not seem to recognise their implications either as a potential cause of the accident or as a major issue that should have been considered by RAF command staffs, including RAF Odiham, before this aircraft was allocated for a passenger flight, where it might have been reasonable for the passengers to have expected to be flying in an aircraft that met at least basic CAA airworthiness standards. The FADEC is a particular example of Campbell\'s ability to ignore facts and draw his own (favourable) conclusions. The "Malfunction" section of his Conclusions is a classic example of muddled thinking and a lack of understanding of the equipment function. It is worth quoting, and then analysing, in full for those areas where he is discussing the FADEC:
"Malfunction
The accident in Wilmington in 1989 was to a Mkl Chinook that, for testing purposes, had been fitted with an experimental FADEC engine control system. The unit inquiry (not a Board) that investigated found that the accident was caused by an error in testing procedure, specifically the disconnection of a vital connector. It turned out that it was also due to a fault in the FADEC software that allowed a catastrophic engine runaway when the signal from that connector was lost. In effect, it was due to an unfortunate combination of these two factors. The aircraft was seriously damaged, but not beyond repair and the FADEC software was later substantially rewritten before Mk2s were introduced into service. Consequently, allegations that the incident showed that FADEC is dangerous and might have contributed to the Kintyre crash are misplaced and specious. It is invalid to argue that, because an engine runaway occurred five years earlier in a Chinook on test when a vital sensor was disconnected and the software was not able to cope, this happened on the fatal flight of ZD576. The problems that Boscombe Down experienced appear to have been self-inflicted, in taking FADEC beyond its limits. As a result, BD unnecessarily alarmed Chinook pilots. Nor, as it turned out, were the CA Release restrictions necessary.
FADEC has not featured in any of the other Chinook crashes, all to Mkls fitted with a hydro-mechanical fuel control system with a poor record for reliability. Although the particular FADEC system installed in the RAF Chinooks is unique to them, similar computerized fuel control systems are installed in US and Dutch Chinooks, all Airbuses, the Boeings 767 and 777, Concorde and aircraft of the Queen\'s Flight. Consequently, such an engine control system is not inherently unsafe and it has not been implicated in any aircraft accident. Nor, once the software was rewritten, has the RAF FADEC given further trouble. It is inherently unlikely therefore that the FADEC had anything to do with the accident. The House of Lords Select Committee accepted that neither the E5 code found in one of the FADEC\'s DECUs nor the faulty altimeter were relevant to the accident.
Excluding the Wilmington incident, of the eight other Chinook accidents (see list below and, reports in Appendix 1), only two were definitely attributed to a technical fault and in neither case were there any fatalities. In only one fatal case were mechanical faults discovered which could have caused the accident. However, in the case of ZD576, no mechanical fault was found. Crew error has been identified as the cause in all the fatal accidents except for one, the cause of which could not positively be determined."
3.2 I am not aware of any allegations that the FADEC itself was "dangerous", but there is no doubt that at the time of the accident it was not seen by Boscombe Down as being proven to be "fit for purpose" and in addition there was no doubt that even with the further re-written standard of software following the Wilmington incident FADEC was the cause of many in-service problems. Thus Witness 20 Sqn Ldr Morgan comments: "The unforeseen malfunctions on the Chinook HC2 of a flight critical nature [my bold] have mainly been associated with the engine system FADEC. They have resulted in undemanded engine shutdown, engine run-up, spurious engine failure captions and misleading and confusing cockpit indications. This is a man who knew what he was talking about at the time even though the BoI themselves chose to omit the words "flight critical" when they quoted his evidence. Put this statement together with the BoI\'s major non sequitur on aircraft serviceability - see 1.2 above and is Campbell really so sure that FADEC could not have contributed to the accident even if only in the form of a major distraction at the critical moment of new waypoint selection? I am not saying this happened, but equally he does not know that it did not!
3.3 Campbell\'s comment that Boscombe Down\'s problems with the FADEC were self-inflicted is, in my view, total nonsense. Whilst we may not always like the time it takes and their sometimes pedantic approach (and certainly with his memo the Senior Reviewing Officer or one of his staff did not) it IS BD\'s job to both take the system to the limits and to fully understand the failure mechanisms and emergency/recovery procedures (which all too often in the past the manufacturer has failed fully to document, and which presumably showed in the state of the FRCs for the Chinook Mk 2). Campbell also comments, by implication as a criticism, that the CA Release restrictions were not necessary. This statement is unbelievably naive, and again shows a total lack of understanding of BD\'s role and methodology. The comment that the CA Release restrictions were not necessary is both incorrect, given the need to maintain flight on one engine in an aircraft subject to "flight critical" engine problems, and irrelevant. The fact is that the restriction was there, and the pilots had no choice but to obey it in all of their flight tasking and planning procedures - indeed the restrictions had been reinforced by comments from the flying supervisory chain.
3.4 Campbell comments that FADEC has not figured in any of the other Chinook crashes in his table of 8 accidents. Again he seems to be being somewhat disingenuous since even by his own admission they were all Chinook Mk 1s and did not have FADEC fitted! FADEC for the T55-L-712F engine only went into production in July 1991 for incorporation on the Chinook Mk 2 aircraft. His comment that the FADEC with the re-written and validated software has not been cited as the cause of any subsequent accident is more valid, but does he know how many flight incidents it has been cited in - we have consistently been refused this information by MOD.
3.5 There are so many more relevant comments questioning the FADEC that there is not room to cover them all. I have picked just two more:
3.5.1 Campbell claims that it is inherently unlikely that the FADEC had anything to do with the accident and then quotes the House of Lords saying that the E5 code ....etc. But the House of Lords conclusions also said the following: "Mr Cable accepted that it was possible that there had been an intermittent engine fault which had subsequently reverted to normal before the impact. The problems arising from the newly installed FADEC system had not all been resolved by June 1994". Are the House of Lords saying that FADEC caused the accident - no of course not, but they are not writing it out as a possible cause either - but Campbell does.
3.5.2 The Boscombe Down (EAS) memorandum reference AEN58/022/1 dated 3 June 1994, which I believe Campbell must have seen in any thorough examination states quite categorically "Notwithstanding the claims made by Textron\'s white paper, the problem remains that the product (FADEC at the software standard being tested at BD - assumed to be the same issue as on ZD 576) has been shown to be unverifiable and is therefore unsuitable (their bold) for its purpose". The Textron White Paper being referred to was, of course, only produced in March 1994 and was an attempt to answer major criticisms of their development programme for the FADEC software going back over many years, and made by independent system house assessments. As far as I can recall comments such as this, and indeed the Textron White Paper, were never shown to the BoI and if they were they were never investigated - this critical area from BD was not even asked to be a witness at the Inquiry, and no link was made to the BD decision to stop the flight trials. The EAS memorandum then goes on to make some 17 major comments (one of which has 7 sub-comments) on the content and testing of the software and notes that contrary to what was being said at the time (including I think to the investigations later) the software for FADEC was "safety critical" and hence should have been developed, tested and documented as such. Even against the lower JSP 188, level of documentation that had been contracted for BD had identified 34 category 1 and 48 category 2 anomalies in their Traceability Study (which was conducted against the system rather than the detailed requirement level). Since it would appear that the 8 RAF Chinook Mk3s that are sitting unused have had safety critical software procured with similar problems to the Chinook Mk2 (albeit, it is stated by MOD, in a different area) it is surprising that Campbell has not picked up this problem - which has already potentially "wasted" £200M of taxpayers\' money with a lot more to come to put them right. Given the BD position it was a major omission by the BoI not to investigate this area - did they know about it? Did they get warned off? These are the sort of areas a thorough investigation should have looked at.
4. Reporting of Defects
Campbell rightly picks up the problem of Tapper\'s failure to raise a defect report on the faulty PTIT gauge, using this as part of his contention that Tapper had a "relaxed" attitude to regulations and even going so far as to imply that this alleged attitude somehow contributed to the accident. The BoI actually notes the following failures to follow the regulations as far as the reporting of defects was concerned:
c. AP 100B-01, order 0703, para 16 in that Lt KINGSTON did not raise a maintenance work order log entry for the engine PTIT fault.
d. AP 100B-01, order 0701, para 5 in that Sgt MAY and Cpl POLLARD transposed the No 1 and No 2 engine PTIT gauges without raising a maintenance work order.
e. AP 100B-01, order 0703, para 16 in that Flt Lt TAPPER did not raise a maintenance work order log entry for the superTANS/GPS fault.
f. AP 100B-01, order 0701, para 5 in that Cpl GUEST and SAC CLARK carried out a functional test on the SuperTANS and GPS without raising a maintenance work order.
In their conclusions the Board then stated "that these failings were not factors in the accident".
As anyone who has been on an operational detachment or even a major training exercise knows this approach to the reporting of what are perceived as minor or nuisance defects is often taken, particularly when there is a shortage of aircraft. It is not correct, but it is a fact of life that it happens.
In fact Tapper also queried the PTIT gauge from the trip before the accident, but was assured that it was only a transient gauge problem. Hence he was carrying at least one unservicability in the engine system when he took off. Given the known defect history of ZD 576 and the issues with the security of DECU connectors (and the PTIT sensor routes its signal to the DECU where it is split one signal being used by the DECU in the engine control laws, and one signal going to the gauge) it was perhaps unfortunate with the benefit of hindsight (which the BoI of course had) that this area was not looked at further. It would be of particular interest to know how much Odiham knew as to what had gone on at Aldergrove, as it was there that the right information connection might have been made and questions asked as to the underlying serviceability of ZD 576. The Detachment was operating on the RAF Odiham EOB so both SEngO 7 Sqn and OC Eng Wg RAF Odiham were the responsible officers in the airworthiness chain for this aircraft, with SEngO 230 Sqn (and NOT Tapper as Detachment Commander who would normally have been responsible) being responsible for Chinook engineering supervision at Aldergrove. In fact the BoI did not call OC Eng Wg Odiham at all. SEngO 7 Sqn only appeared to present the servicing documentation to the BoI and SEngO 230 Sqn, who appeared to know something about the PTIT gauging problems and the "malpractices" claimed that he was satisfied that Chinook HC2 ZD576 was serviceable for its (sic) final flight on 2 Jun 94". No-one asked how he was "satisfied" as to its serviceability (had he visited the detachment, had he reviewed the servicing records, had he discussed the defect history and the potential links to the PTIT problem, etc) or why he had done nothing to regularise the defect reporting omissions - he, not Tapper, appeared to be responsible for this, albeit both Kingston and Tapper would have to accept some of the initial blame for their failure to raise the work order log entry. Again Campbell ignores all of these issues in favour of the tiny bit of the story that fits his ideas.
5. Poor Research
As what would normally be a minor point, but in the light of Campbell\'s claims to have solved by his meticulous research and analysis what so many others more capable and skilled than him have failed to solve it is a pity that Campbell does not seem to know the difference between a Flight Lieutenant RAF and a Lieutenant Royal Navy, since Kingston was of course a naval pilot - and note 27 says this. A minor error, but an important one.
Summary and Conclusions
What must be of concern is that for those of Mr Campbell\'s readers who have not seen the BoI and the transcripts of the various other enquiries (presumably he hopes the majority if the book is to sell in large numbers) then his version, whilst not representing the correct facts in many areas and certainly having nothing in it to support his claim to have solved the mystery, is going to look very convincing to the lay reader.
Despite these reservations I would have to accept that along with many other people Campbell appears to have raised a valid possible cause for the accident - I say "appears" because I am not a helicopter pilot and I do not know the area of the Mull of Kintyre (although I sent many happy hours flying round the Falklands in helicopters, including Chinook Mk1s, in some very dodgy conditions - but then I have always had great faith in military pilots). Some more familiar with the helicopter and the area might wish to turn Campbell\'s "possibility" into a probability although I would not subscribe to this. What is clear is that his theories can never be the "certainty" that he claims. Whether possibility, probability or even the certainty that he would claim then Campbell\'s theory does, however, do the pilot\'s families one great favour for, as he rightly points out, a navigation error could not, by definition, be "Gross Negligence" not just in legal terms, but by the standards of judgement applied to other similar accidents of the time (remember AEW Mk Shackleton WR 965 - hit the Isle of Harris following a navigation error in a bad weather descent to low level on 30 April 1990 - 10 killed, but, as I recall no findings of negligence of any sort). So support Campbell\'s theory by all means, but remember that it is only one of the possibilities. Also remember that whilst Campbell\'s theory might still be an aircrew error, or one of the new equivalents, verdict, it will not be a gross negligence one - despite his publisher\'s flyer claiming their book "generally" supports the Gross Negligence verdict!
END
As I said in a previous post, I have no wish to turn the thread into a book critique thread, but I believe this to be a valid response to the publication. The only thing we can safely (and rightly) conclude is that we don\'t know what was the cause of the accident with absolutely no doubt whatsoever. The negligence verdict should, therefore be removed. Only then, will the campaign go away!
Apologies for the overall length of the post.
My best, as always.
Brian
"Justice has no expiry date" - John Cook