2 1 - 2 Chapter Two Summary of Chapter Two
The FADEC engine control computer system – the dangers of new safety-critical systems The advantages of FADEC –suppliers case to Ministry of Defence. Contract for new Chinook FADEC system awarded without open competition Tension in relationship between RAF and contractors re access to FADEC information. Pilots accused of gross negligence train for RAF career as work on FADEC starts 2 3 - 2
There were teething problems. Until they were redesigned the doors had a tendency to detach themselves and endanger the aircraft. There was so little appreciation of the risks associated with a new engine control system for the Chinook that a small number of senior officers in the armed forces expressed anger and incredulity that the Ministry of Defence's own appointed software specialists could not simply accept the new computer systems without raising questions. Much later, those same officers refused to accept the possibility that the malfunctioning of a software-based fuel control system could cause a Chinook to crash. Yet Boeing, the manufacturers of the Chinook, had classified the computer system as a flight-safety critical component. This meant that its malfunctioning could, in certain circumstances, lead to a complete loss of control of the aircraft. The FADEC on the Chinook comprises two main parts. One is the Digital Electronic Control Unit (DECU) for each of the helicopter's two engines. The DECU is a computer that monitors electronic signals that indicate things like engine and rotor speed. The computer also receives electronic commands from the pilot and converts this into data which is transmitted to control the flow of fuel to the engines. The system controls other engine functions such as ignition. Each DECU also has a display for diagnostics purposes which shows some fault information related to the performance of the engine and the FADEC itself. The second part of the FADEC is a hydromechanical unit that receives signals from the DECU. In response to these, the hydromechanical unit pumps the correct amount of fuel to the engine. In principle the FADEC is a good idea. Although non-FADEC engines have some automatic features, the pilots are required to play an active part in monitoring the engine's behaviour and making frequent adjustments to maintain performance. It was not an efficient use of the pilot’s time and the human intervention led to unnecessary wear and tear on the engines and components. Also, in the high-vibration environment imposed by helicopter engines and rotor blades, purely hydro-mechanical engine control systems had short useful lives. Maintenance costs were high, reliability low. The FADEC’s software-driven automatic controls are more finely tuned. They have fewer mechanical parts, and so can achieve longer lives. Also the engine performance is superior; smoother fuel flow, lower fuel consumption, higher accuracy without pilot interventions. From the pilot's perspective FADEC is in theory a major advance. He is relieved of many of the routine tasks required to monitor the engine and fuel flow. In many helicopters, there is no accelerator as on a car. Nor are there throttles as on a conventional passenger jet. On a Mk2 Chinook, the pilot operates the controls and the FADEC provides the power and fuel to achieve the desired speed and flight path. 2 4 - 2 Computerised engine controls have been widely used on military aircraft since the 1970s. They went generally into service in commercial aircraft, including helicopters, from the early 1980s onwards. * * * *
In 1984 the subcontractors who were to build the Chinook's FADEC submitted a proposal to the Ministry of Defence which described the system in enthusiastic terms. "The latest state-of-the-art component and manufacturing technology is employed in the proposed design to provide a low cost high reliability solution." "It is estimated the direct maintenance cost per hour will be reduced by a factor of 10 and a substantial reduction in maintenance and overhaul costs will provide gross savings of nearly $30m when projected over 20 years." "The airframe-mounted Digital Electronic Control Unit provides a built-in, alphanumeric diagnostics display for the FADEC that can be interrogated on the ground or during flight." "The proposed FADEC design is based on substantially identical units currently being developed and qualified for Lycoming ALF 502 and Rolls-Royce GEM engines." Therefore technical risk was described by the subcontractors as "extremely low." * * * *
At the time of its conception, the FADEC proposed for the Chinook was not intended as a fully digital system. For reasons of safety, each FADEC was to have two "lanes" which performed similar functions. The main or primary lane was to be a computer system. The back-up, or as it called "reversionary" lane, was to be based on more conventional analogue technology. But as time went on the project became more technologically ambitious and, without any opposition from the Ministry of Defence, the manufacturers went ahead with a system which was digital in primary and back-up mode. Unusually in a FADEC system, there was no mechanical backup. The wisdom of this approach was never questioned at the time. But 15 years later the technological pendulum swung back, in favour of mechanical back-up systems for FADEC. 2 5 - 2 In 1999 the Chinook's engine makers announced that they had begun a research project in Farnborough, England, to build a successor to FADEC. They would call it Epic ... "Unlike a FADEC that relies on dual electrical systems for power source redundancy, the Epic system will feature independent mechanical backup subsystems for all critical control functions.” * * * *
The award of the original contract for the Chinook FADEC was made without any open competition or public announcement. The Ministry of Defence later defended this in a statement to Computer Weekly but gave no specific response to the allegation that it had failed to seek competitive bids. “... Mod adopts the procurement strategy which is most appropriate for the equipment being procured,” it said. The early documents submitted to the Ministry to persuade officials of the virtue of a FADEC system were well presented and technically detailed. However the arrangements for managing the project were complicated by the number of subcontractors and the relationships between them. Hawker Siddeley Dynamics Engineering, a specialist branch of the British Hawker Siddeley aerospace group, wrote much of the FADEC's software. At first, Hawker Siddeley had nothing to do with the Chinook programme. Boeing, the US aircraft and aerospace company based in Seattle, USA, manufactured the Chinook. On 25 October 1984, Hawker Siddeley signed a joint-venture agreement with a US company, Chandler Evans of Connecticut which manufactured controls for aerospace engines. In turn Chandler Evans signed a joint-venture agreement with what was then Avco Lycoming, a Boeing subcontractor, which supplied engines for the Chinook. So the FADEC programme involved Boeing as the Chinook's manufacturer, and three main subcontractors: Lycoming as the engine supplier, Chandler Evans who helped to build and design parts of the FADEC, and Hawker Siddeley wrote the software. By the early 1980s, it was already clear that the UK was to lead the way in the development of the FADEC system, but it was not exactly clear who in the UK was leading the development, the subcontractrors or the Ministry of Defence. By 1986, two years into the FADEC programme, the RAF was expressing concern about its lack of involvement in the project, and the difficulties posed by the coagulation of different companies. "Clearly we have been brought in late," says an internal RAF report, "and there will be little or no chance for CSDE (the RAF's Central Servicing Development Establishment in Norfolk) to influence any part of the design." 2 7 - 2