The Chinook accident in 1989 - the facts
Problem with fault logic of FADEC software identified at key meeting
On 21 January 1989, a day after the accident at Boeing’s Flight Test Facility at Wilmington in Delaware, a joint review group meeting was held in the USA.
It comprised representatives from Textron Lycoming, the main contractor of the Chinook’s Full Authority Digital Engine Control (FADEC) system, Chandler Evans, one of Textron’s US-based subcontractors on FADEC, and the UK Chinook Liaison Office, which represented the MoD’s interests in the US. From Boeing there were delegates from various divisions, including Electrical, Propulsion, Wiring, and Reliability Engineering.
Minutes of the meeting including the names of all attendees has been obtained by Computer Weekly. Contrary to the impression given by the Ministry of Defence in the House of Commons last week, there was no criticism or any hint of negligence in the testing procedures. The meeting concluded that there was a “problem with the fault logic” in the FADEC’s design.
“It was agreed that among items to be completed prior to continuation of testing was the correction of the identified fault logic and a detail review to identify other problems” say the minutes.
The meeting was also told in detail why the FADEC “failure mode had escaped detection in prior testing and design review”. It was found that assessments of possible faults “did not cover failure modes resulting from a combination of failures unless they could be related to a common cause”.
The ground test accident at Boeing’s Flight Test Facility highlighted the FADEC’s inability to cope with the loss of the two sensors that relay the speed of the engines to the software.
One of the sensor readings was already registering a problem, as indicated by a fault code “E5” on the FADEC, when the other sensor signal to the software was disconnected as part of a test to simulate the effects of small arms fire.
On detecting no signal from either sensor, the FADEC should have frozen the supply of fuel to the engines. Instead the software mistakenly thought that the engines had slowed down, and tried to restore their speed by instructing the fuel pumps to deliver more fuel.
In fact the engines were working normally, but the flood of fuel caused the No 1 engine to surge uncontrollably. The engine “overspeed” incident caused the Chinook’s rotors to spin at up to 140% of their 225rpm normal operating condition which stressed the aircraft, causing millions of pounds of damage.
A subsequent RAF Board of Inquiry on 27 January 1989 did not blame Boeing or find negligence in the test procedures. The Board said of the test procedures that “these procedures were correctly applied”. There were criticisms of some aspects of the test but “the Committee found that none of the above was directly related to the cause of the incident”.
The Board attributed the main cause of the overspeed accident to the simultaneous effect of the E5 fault (that indicated the loss of one speed sensor to the FADEC) together with the loss of the second speed sensor when a plug was disconnected to simulate the effect of small arms fire.
Of the contributory causes listed by the Board, the first was the FADEC’s inability to cope with the loss of the two sensors. An “E5” fault code was found in the only FADEC system to have survived the crash on the Mull of Kintyre.
After the 1989 accident, the UK Government’s lawyers in Washington, Morgan Lewis and Bockius, sued Textron. Boeing was excluded after agreeing a settlement of $500,000. The settlement agreement with Boeing in September 1993 provided for the company to be released from all claims related to the 1989 accident.
An official case document prepared by the government lawyers Morgan Lewis and Bockius describes the arbitration proceedings that led to the MoD winning $3m from Textron.
“Textron’s allegations that the damage [in the 1989 accident] was really somebody else’s responsibility, Boeing or the British Government’s, fell flat at the hearing. In the end these attempted defences were supported neither by documentary evidence nor by testimony”.
The lawyers said: “The evidence introduced in this case shows, and Textron’s own admissions confirm - that the overspeed and the damage were caused by Textron’s faulty design of the FADEC. The lawyers also said that “Boeing’s test procedures were adequate and reasonable”.
