FADEC Software
AA,
As another reminder it was not just Boscombe Down - in 1993 MOD asked EDS-Scicon as an independent and expert company for an evaluation of the FADEC software, which had been substantially re-written after the Wimington incident (in which you may recall an engine runaway up occurred whch took the rotors to over 140%) - their conclusion was that the "new" software was "poorly developed code [which] is significantly more difficult to analyse than code written and documented to a well-defined standard." These comments were made after EDS had apparently found 485 anomalies in the first 18% of the code they analysed - at which point work was stopped. In their final report dated July 1993 these anomalies were broken down as follows:
Primary Lane Cat 1 (real error in the code or a discrepancy between the code and documentation) 13; Cat 2 (poor code or poor correspondence between code and documentation but it is likely that it performs the intended function) 111; Cat 3 (obvious documentation errors) 42: Cat 4 (poor coding style) 81. The figures for the Reversionary Lane were Cat 1 - 8; Cat 2 - 43; Cat 3 - 75; Cat 4 - 20. The figures for Documentation Tracebility were Cat 1 - 35; Cat 2 - 39; Cat 3 - 75; Cat 4 - 3.
AD/HP1 met Textron Lycoming (T/L) on 21 Jan 1994 to "discuss the way forward with Chinook HC MKII FADEC software". A secondary aim of the meeting was to "discuss the longer term options for revisions to the software which would enable the UK to satisfactorily complete the CA Release process". Several significant actions were agreed at the meeting, but despite the obvious problems there is a footnote which says "At the end of the day the T/L meeting did not alter DHP's current view of the FADEC, which is that we have no positive eveidence of a software safety problem that would critically affect airworthiness, but that it would be prudent to observe the restrictions recommended by A&AEE in their Interim CA Release report until our present investigations and additional studies are concluded."
Like everyone else concerned with the injustice of this verdict I make no claims that FADEC software failings definitely led to this accident, but they, along with quite a few other airworthiness related issues, could have done. Given that actions agreed at the end of January did not change the FADEC software in use in June, what is sure is that the BoI should have looked at all these issues, and especially whether DHP's confidence was misplaced - and it certainly looks to me that it was. But then, as has been said many times before, the word "airworthiness" does not figure in their deliberations or theirs and the ROs' findings.
JB