Top Chinook test pilot reveals unease over engine software
A campaign by Computer Weekly and Channel Four News has sought to show that a computer problem not pilot error could have led to...
In 1994, at the time of the crash on the Mull of Kintyre, squadron leader Robert Burke was the unit test pilot at RAF Odiham, the unofficial headquarters of the Chinook fleet.
Despite having more flying hours on the Chinook than any other test pilot, and first-hand experience of problems involving the helicopter's new Full Authority Engine Control (Fadec) computer system, the RAF stopped him from giving evidence to investigators.
Shortly before the crash on the Mull, the Chinook had been fitted with a complex new Fadec computer system. By adjusting automatically the fuel control to the Chinook's two jet engines, the Fadec could, at one extreme, cause the engines to accelerate out of the control of pilots, or cause them to run down to idle.
Burke told the Lords committee last week that pilots love Chinooks. "It's a fantastic aircraft at the moment." But in the period before the crash on the Mull there was considerable unease, he said.
"I speak with first-hand experience about the speed at which this aircraft was brought into service. Particularly in the area of Fadec, it was felt that neither the RAF nor, in my view, some of the Boeing personnel knew all they should have done about Fadec."
On two occasions Burke experienced engine runaways in which one of the Chinook's engines accelerated unexpectedly.
After the crash on the Mull, which killed all on board including the two pilots, two aircrew and 25 senior police and intelligence officers, Burke was contacted by Tony Cable, the accident's chief technical investigator.
Cable worked for the Department of Transport's Air Accidents Investigation Branch which comprised a small unit of investigators.
Burke had several conversations with Cable. Later, with the help of RAF technicians, they were simulating what they thought was the possible condition of the aircraft before it crashed.
"We were working out what was happening. At midday, in the middle of this, I got a message to see my immediate boss, wing commander John Cooke and he said, 'I have instructions that you are not to continue to help with this investigation in any way'."
Before he left the wing commander's office, Burke asked if it was a direct order or a request. "He put it in these words, 'This is a direct order Bob. You are not to discuss this crash with anyone and you are not to approach anyone'."
"I went back and told the people I was working with on the aircraft that I had been pulled off [the investigation]," he added.
Burke said that when Fadec was working properly, which he said was most of the time, it made the work of pilots easier.
However, airworthiness assessors, from the Ministry of Defence's facility at Boscombe Down, had refused to fly the aircraft after a series of Fadec-related incidents.
The atmosphere between airworthiness test specialists and pilots at Boscombe Down and personnel at RAF Odiham was "very strained indeed", said Burke. At one point Boscombe Down pilots refused to fly a Chinook on a 12-minute trip to Odiham. Burke had to drive to Boscombe Down and fly the aircraft back to Odiham.
Asked about the effects of a possible Fadec-related engine surge, Burke said a temporary engine surge could cause the aircraft to rise unexpectedly into cloud.
He said, "It [an engine] can run up jolly fast. This would start the aircraft climbing, the increased lift coming from the increased rotor speed. So you are in cloud. The instruments would be very difficult to read because of acute vibration. The pilots could be in a desperately difficult situation."
What the House of Lords committee has heard so far
The remit of the House of Lords committee investigating the crash of Chinook ZD576 on the Mull of Kintyre is to consider the justification for the finding of negligence against the two pilots.
Captain John Cook, father of Rick Cook, one the two pilots killed in the crash, said his son had been concerned about the Chinook Mk2's new Fadec system. "On one occasion I was in the drawing room when he came - he was going to Northern Ireland and they were going to send a Mk2 there - and said, 'You will look after Sarah and Eleanor?' That was his wife and daughter. On the last occasion I said, 'Come on, Rick. What is it?' He said, 'Dad, the aircraft is not ready and we are not ready. We have had too little time to try and sort it out.' Three or four days later he was killed."
Arguments that the crash was due to pilot negligence
Sir William Wratten was one of two air marshals who found the pilots negligent. He said he was in absolutely no doubt whatsoever over the cause of the crash. He said the pilots were negligent because they were in the wrong position in the prevailing weather conditions on the approach to the Mull. "Airmanship demanded that they did everything in their power to avoid getting anywhere near to that cloud-covered, very steeply and rapidly rising high ground," he said.
Sir John Day, now commander in chief, strike command, also found the pilots negligent. He said, "Let me say, Lord Jauncey [chairman of the committee], this is the most difficult decision I have ever had to make in my career." Asked about a possible Fadec problem, he said, "It is beyond comprehension in my view that a minor emergency would have so distracted them that they forgot they were about to hit a mountain."
But technical experts have expressed serious doubts over the performance of Fadec. Three fellows of the Royal Aeronautical Society said that Fadec-related problems or a possible jam of the controls could have led to the crash.
What happens next?
A final hearing of the committee is due to be held in November when Day and chief technical investigator Tony Cable will be recalled to give further evidence. The committee is due to report its findings by 31 January 2002.
Why Computer Weekly is campaigning over the crash
The issue goes beyond that of a possible miscarriage of justice. The question is whether the operators, in this case pilots, are being blamed for a possible supplier problem.
With the growing complexity of IT systems, it is increasingly the case that only the manufacturers can identify faults in their system. But should we expect them to incriminate themselves if there has been a major failure of their systems?
What happens, for instance, if a supplier's faulty system is suspected to be the main cause of the financial collapse of a company? The supplier could say "there is no evidence the collapse is our fault".
If the software is so complex that only the supplier understands it enough to say whether it is faulty, the customer is effectively powerless. So nobody will be able to hold the supplier to account for a possible major failure.
In the case of the crash on the Mull of Kintyre, the pilots have not only been blamed, partly on the basis of a lack of proof of any technical failure, but the RAF says there is absolutely no doubt whatsoever of their negligence.
If this verdict stands, it is, in effect, saying that it is acceptable to blame the operators if there is no proof of fault in the equipment.
