Chinook ZD576: How the Fadec engine control software worked and what could have gone wrong
What follows is some of the evidence ...
What follows is some of the evidence given by Squadron Leader Robert Burke to the House of Lords committee which investigated the crash of Chinook ZD576 on the Mull of Kintyre. Burke gave evidence to the Lords' committee on 16 October 2001.
Burke had been unit test pilot at RAF Odiham in North Hampshire, which is the home of Chinook helicopters.
He referred to Boscombe Down which is where the Fadec software for the Chinook Mk2 - the type of helicopter which crashed on the Mull of Kintyre - was tested. Boscombe Down's IT specialists were so concerned about the Chinook Mk2 software that they had recommended a rewrite - but this did not happen before the aircraft went into operational service. Soon after Chinook ZD576 went into service with the new Fadec system it crashed and the pilots were blamed.
House of Lords committee, questioning Squadron Leader Robert Burke: Do you know the circumstances in which the pilots at Boscombe Down had refused to fly a Chinook Mark II?
Burke: I can only talk about basically what I know, and I heard Squadron Leader Morgan's comments on it yesterday I was here. My perception was somewhat different because I was talking to Boscombe Down, just like the OCU were, not on a daily basis, but on a reasonably regular basis as part of my job as the unit test pilot at Odiham. It was part of my terms of reference to keep contact with other test organisations, which I did both here and with Boeing quite a lot. My very strong perception, particularly when talking to the senior man in the Chinook project team, the American major, was they were very unhappy with the Fadec[Full Authority Digital Engine Control] system generally, extremely unhappy, because they had had a lot of problems, particularly on the ground, with the engines running up and running down. Whether they refused to fly it or not I can only comment on the following, the atmosphere between Boscombe Down and RAF Odiham was very strained indeed, especially after the accident-it was pretty strained beforehand because of restrictions on the aircraft and one or two other things. It got to such a point that Boscombe Down sent a project team up to Odiham and briefed the executives at Odiham the station commander and senior engineering officers, flight commanders and myself. They made a formal presentation at Odiham on the problems they had been having at Boscombe Down. It lasted about an hour and a half. When the meeting ended the atmosphere was even less amicable than when it began. There was no doubt in my mind, I cannot speak for others, well I can to a certain extent because we discussed it when we came out of the meeting, that Boscombe Down's air crew were not prepared to fly the Chinook or continue flying it because of problems with the Fadec, they were not happy with the reliability of the system. I can also say that I personally had to fly the Boscombe Down aircraft back to Odiham for a minor servicing, me and an Odiham crew, because the Boscombe Down crew would not fly it. To fly this particular aircraft, because of paperwork considerations, the aircraft was assigned to MOD (PE) at Boscombe Down, not the RAF, so it was their aircraft. It was also fitted with quite a lot of non-standard test equipment, so it had modifications. For me to fly it back a "service deviation" or a series of them had to be issued to allow me as an RAF pilot, not a Boscombe pilot, to fly it back and for me to fly the aircraft with these various modifications. I suggested many times that it would be much easier if Boscombe flew the 12 minutes back to Odiham and they would not do so. I spoke to the pilots and they would not do so. I then asked the pilots if they were prepared to meet me at Boscombe Down and discuss the implications of these modifications and they would not appear, they would not do that. So my perception of whether Boscombe would fly or not was very different, perhaps, to that received by Squadron Morgan in his one telephone call. I was quite interested to know when he said Boscombe rang up the next day after the crash and said it was basically nothing to do with why they stopped flying. How they knew what was wrong at Boscombe Down I have no idea, considering we are still discussing it some seven years later. I believe a number of people have also drawn your attention to a document which was a draft DO (Demi Official Letter) from the AOCinC to the ACAS about Chinook flying, which has apparently had fairly wide circulation. I am not sure how. You have a copy of it so you are able to read the first paragraph, "it is, a) announced for the second time this year because of their concerns about safety of the Fadec system they had stopped trials flying the Chinook Mark II". It could not be much clearer than that, it was from a very senior airman. It goes on to say, "we are all agreed", this is Boeing and ourselves, the RAF, the frontline squadrons, "the Chinook Mark II is safe to operate and there can be no excuse for AAEE not to fly at least to these parameters". That was pretty well the view of most of the frontline pilots in the RAF at the time in the Chinook force.
Lord Tombs: Are the Boscombe Down pilots civilian or service pilots?
Burke: They were service pilots at that time, one was an American officer on exchange and the other one, who I have spoken to since then, is retired working in the City now. The project leader was an American Army pilot on exchange, he may have been an American Air Force pilot, Major Myers.
Lord Hooson: Did you gather that the sense of unease was due to their own experience or general gossip in the Mess?
Burke: I can go into that in some detail, my Lord, the Boscombe Down one, and people knew what was going on at Boscombe Down, was because they had unexplained run ups and run downs and things. At RAF Odiham we had a series of problems with the Chinook Mark II, particularly concerning Fadec. I can only go into these quite specifically, one was dealt with at considerable length yesterday, the testing for the overspeed system. One of the concerns of any helicopter pilot is that the rotor will overspeed to the point where it will be seriously overstressed and fly off. I make that statement quite categorically. That is a major problem. Any rotor if you overspeed it and overstress it is likely to fly off. All helicopter pilots are aware of that. The designers of Fadec were equally aware of that and incorporated a last ditch system, basically that if the rotor speed got to 114 per cent, or something like that, this system cut in and stopped any more fuel flowing to the engine. This overspeed trip was probably the system which gave us the most problem of all when we were testing it on the ground. Boscombe insisted we had to test it before every flight because they said, "we are not very confident in Fadec, you have to test this before every flight". This test procedure led to a number of run ups and run downs. Pilots did not like doing it because you had to watch the engine like a hawk in case they over-temped or ran away. You heard a great deal about it yesterday. There were a number of other concerns, so many in fact that the squadrons-I cannot talk for all of the squadrons but I can talk for 7 Squadron, which was the resident operational squadron at Odiham, produced their own local orders, I will not say to bypass certain procedures, but because we were getting so many fault codes on the Fadec. Like any computer the Fadec system was subject to malfunctions when it had power interrupts. Because of the way, excuse me for going slightly technical, but it is necessary to explain this, the generators and the standby generator were arranged on the Chinook when you closed down and the standby generator came on there was a power interrupt on the system. It has probably been cured by now. The Fadec DECU, the Digital Electronic Control Units, had number codes on them and if it came up with 88 all was clear, the system was fine, but very often on shutdown, because of electrical interrupts, we came up with a whole variety of codes which meant technically you could not fly the aircraft until the technicians had a serious look at it that is what was laid down. One of the local orders was that if the aircrew got any codes other than 88 we were technically not allowed to fly, squadron ground crew would come out, pull two circuit breakers, push them back in again and hoped that cleared the faults. It was not a recognised procedure but the squadrons would use that. That did not lead to confidence! There was also a mechanical fault in one of the multi-point connectors that went from the engines into the DECU, basically the electronic computers. The multi point connector was not of a good design, again you had power interrupts on the system. The squadrons introduced a procedure, probably the OCU did as well, but I am not certain on that point, where the crewmen every quarter of an hour would have to go up and check physically that this multi-point connector was not vibrating loose.
Could any of these defects that you heard about or experienced-
Burke: I experienced them as well
-could they have resulted in a loss of control, even temporarily?
Burke: If you have a power interruption to the computer, certainly. There were various safety systems built in but the Fadec is a computer like any other computer. It had a back-up system which was very largely independent but it did not always work and there were certainly recorded instances, I can give you the name of the pilot but I cannot recall the aircraft, I think there were two or three of them from memory, but I cannot be certain, when due to possible power interrupts the pilots lost control of what are called the engine condition levers, which were not throttles but performed something like a throttle. You had three positions to stop, ground idle on the ground and full power and you could lose control of those and disable them due to certain electronic problems. This certainly happened. I can give you the name of one of the pilots involved in that.
**
Burke (an explanation of how Fadec words): The engine condition levers are three-position levers up there at the cockpit and one position is a stop position, one is in ground idle position, where you set the aircraft rotors running on the ground, and one is full throttle. The full throttle is then modified by the Fadec or on the old Chinook by a purely hydro mechanical system to bleed off from full power. The engine is set at full power and it is bled off and whatever kind of computer or fuel control system you are using, adjusts the power of the engines to keep 100 per cent rotor speed. The engine condition levers take you from these particular conditions, stop, ground idle, then full throttle but that is modified by the fuel control system, the Fadec in the case of the Mark II, in response to the rotor speed and how much power you are using. This is the collective or thrust lever.
Is there anything in the over-temperaturing of the engine by the Fadec system? You refer to this but does it produce any serious results at the time? When the engines are over-temped? You said that several engines had been over-temperatured.
Burke: The Ministry of Defence will give you better information on this than me, but I have seen two or three engines which have been over-temped. You have to scrap or completely rebuild the back end, the hot end of the engine.
If they become over-temperatured in flight is that likely to have a serious result?
Burke: Yes it is likely to have a serious effect on any jet engine. In fact, because we have engines which are split into two halves, the front half produces a lot of gas going at high speed and that drives another turbine at the back which is connected to the rotors. There is a loss of engine drive to the rotors as well almost straightaway, especially if the things melt or start getting distorted.
You have commented on torque mismatch. Is that when a differential power is produced by each engine?
Burke: Yes. One of the functions of the Fadec (and you will find it in my layman's guide to the Fadec) is to match the power between the two engines so they are sharing the power to the rotors. If you get a mismatch of torque it means that one engine is doing no work and the other engine is doing all the work. There might be a good reason for that. One engine may have lost power, malfunctioned or, in the case of a runaway, it might well be producing too much power.
What is the practical effect on the aircraft of a significant torque mismatch?
Burke: It all depends whether you are in a benign flight regime or if you are very heavy. Perhaps the one engine that has gone up might well then have reached its limit and it cannot produce any more power or it might go into emergency power or something like that. In a benign flight regime it has really very little effect.
I think you mentioned that large numbers of the Digital Electronic Control Units were returned to the makers for fault investigation, is that right?
Burke: Yes, I think it has happened again since. Because I was the unit test pilot involved in maintenance I can remember that we had run out of DECUs, all of the aircraft in the hanger, the ones undergoing overhaul, had been robbed of their DECUs and at some stage the frontline aircraft could not get up to sufficient numbers because we had run out of DECUs. The situation was very bad, this is from personal memory, there were many days at Odiham when we only had one Chinook available for training, some days when we had none, and the situation got so bad, as far as my memory serves me, when, the final straw was another DECU going down and we had no aircraft available and the Northern Ireland standby aircraft had to be used for the United Kingdom standby commitments.
What was the position, was this a design problem?
Burke: Nobody really knows, my Lord, because on most of the ones that went back no fault was found. All the ones that were taken out had something going wrong with them, that is why they were taken out. Part of the problem was that because of the speed at which this aircraft was introduced, the ground technicians were not terribly familiar with the systems and what they did was take out an unserviceable DECU and sometimes swap them across from side to side and, as with any bit of electronic equipment, as soon as you start moving it round the connections start going and you will find that most of the problems on any computer are probably simple electrical connections and the more you move them the more problems you get. I do not know whether the problems persist in that area, and I cannot answer that, but at the time we were desperately short.
**
You mentioned in the aircraft which crashed there had been Fadec related incidents on 16, 17 and 19 May 1994, could you expand on that a little, please?
Burke: Offhand I would rather not. The details are already available in the documents. My memory would not be as good as the documents.
You refer to there being primary channel and reversionary system, is that in relation to the Fadec?
Burke: Yes, my Lord.
Are they completely independent of one another or is there an extent to which they run in series rather than in parallel?
Burke: There is at least one area in the shutdown procedures where they run in series. I believe there are others but I am not the best person to answer this, there is an expert on the subject, Mr Malcolm Perks, whose name you may have seen, and I would much rather you ask him that question. It is four and a half years, or rather less, since I used the system and I would rather not comment on that detail.
**
You then refer to a possibility of engine malfunction, four kinds.
Burke: Yes. Would you like me to read it out? I have looked at this again and I have not really got anything to add to it. There might have been a run away up, a run down, an engine freeze or the RPM cycling up and down. All of those can occur in any fuel control system. The engine freeze is unlikely to have any operational effect. The run down is likely to have the aircraft descending and slowing down probably very rapidly.
You exclude that?
Burke: I think it unlikely, I do not exclude them, I think they are very unlikely. On the other hand if there had been a temporary run away up or partial run away up, or RPM cycling up and down the aircraft would have entered cloud, for reasons I will go into. A temporary increase in the rotor speed could have occurred even though the other engine had backed off as quickly as it could, when one goes up the other one will try to run down as fast as it can. How fast it runs down is, to a certain extent, limited by the various controls in the system. The one that is running up, of necessity something is wrong with it for it to run up and it might run up jolly fast. This will start the aircraft climbing, the lift coming from the increased rotor speed, the faster the rotor goes round you will get an increase in lift. That is not what we use to increase our lift but that will happen. The pilot fearing total run up will have raised the collective lever to contain the rotor RPM, this is an essential drill towards a first action in the simulator. Although there are flip cards, you have to know some of the drills, they are immediate actions. If you look at the flip cards at the time, it may differ now, for a run away up you will not find it there. This is taught as an immediate and instinctive reaction to the flight simulator in Farnborough, as it was then, and by raising the collective lever you increase the pitch on the blades, the lift on all of the six blades increases the lift at the same time, so you are in cloud.
That means that the blades offer more resistance in the air as they go round?
Burke: They do. You increase the drag, that is the immediate way of slowing the rotor down. I will read this out, if I may, I do not want to change what I wrote three years ago, "the handling pilot by now would clearly unexpectedly be in cloud and have had to transfer to flight instruments having had his vision outside the cockpit, peering through the windscreen. . .", looking ahead, "the collective lever would have been well up under his left arm, he would yank the collective lever up until the rotor speed was contained. The engine instruments and the flight instruments would have been very difficult to read because of acute vibration". This is something which cannot be simulated and can only be experienced. "Even that is nothing like the vibration which appears to be higher with high power on". I will talk about self-tuning vibration absorbers. These are massive absorbers, basically levers on springs under the pilots' seats and the instrument panel and these are there to absorb the naturally large vibration experienced particularly in tandem rotor helicopters.
You say the aircraft would be yawing severely?
Burke: It might have been yawing, it might have been doing several things, but yawing particularly because the pilots would have kept the aircraft straight and level. The rotor speed at this stage would be going up and down. The rotors are not flat on the top, they are like that (indicates) at an angle to one another.
When you say "yawing" it would be going from side to side?
Burke: Sliding like sideslip in a car or skidding in a car.
