Walter Kennedy wrote:
Tony Collins
<<There were important changes to the FADEC code after the Mull crash, and a different CPU used. From NAO report Feb 2000:
"… In September 1998 the Department, with the Royal Air Force’s consent, issued full Controller Aircraft Release for the Chinook Mk2 ...>>
Could you please give us an estimate of how many hours were flown in HC2 Chinooks between the accident date and the first implementation of any of these changes? In other words, how much flying was done subsequent to the crash without any changes to the FADEC system? And, if the amount is sufficient to pass judgement on, how does this compare with expected/satisfactory reliability for a military aircraft?
I don't know the answer to Walter's first two questions but I think I can address the last and the answer is: there were nowhere near enough hours flown to make a positive judgement. Broadly speaking, the target for UK military aircraft is that they should have a catastrophic accident no more than once every million hours of flight (JSP 553, interpreted somewhat for simplicity but not so as to invalidate what I write). Consequently, the target for FADEC-caused catastrophic accidents should also be no more than once every million hours (in fact, rather less, since there are many other potential causes of catastrophic accidents and you wouldn't want the FADECs to use up the whole budget, as it were). Since it is very plausible that FADEC failure could lead directly to a catastrophic accident, we are asking for the FADEC to fail dangerously no more often than once every million hours (probably rather less). To have any confidence that this was being achieved through operational experience, you would need to fly the aircraft for (probably tens of) millions of hours. Our Chinook fleet hasn't managed anything like that and never will.
From time to time, on this thread, I see people apparently suggesting that because no other (dangerous?) FADEC software failures have been observed in the Chinook fleet (I don't know if this is a true claim, incidentally), it could not have been the FADECs that caused the Mull accident. Leaving aside the obvious weakness of this argument, when you're aiming for ultra-reliability you have to operate for a very very very very very long time to demonstrate that ultra-reliability. Nearly always, that's more time than you have in practice.
As far as I'm aware, there is no significant evidence that the FADECs caused the Mull accident. But I'm also not aware of any conclusive evidence that they didn't.