Macdonald Report - 20 April 2000 - 2010 Update-with Contents List

RAF CHINOOK HC2 ACCIDENT MULL OF KINTYRE – 2 JUNE 1994

20 April 2000 i

WITH REFERENCE TO THIS REPORT BY

Captain Ron MACDONALD FRAeS

Retired Airline Captain and Aircraft Accident Investigator

Captain Richard K. J. HADLOW FRAeS

Retired Airline Captain and Armed Forces Helicopter Pilot

Captain Ralph KOHN FRAeS

Retired Airline Captain and Regulatory Authority Inspector

(Editor and compiler)

20 APRIL 2000 REPORT - EXECUTIVE SUMMARY

An in-depth study was made of all the available accident reports and other documents relating to the fatal RAF Chinook Mark 2 helicopter crash on the Mull of Kintyre on 2 June 1994. The study was carried out because it was difficult to understand why the Senior RAF Reviewing Officers ignored the findings of the RAF’s own Board of Inquiry (BOI) and arrived at the conclusion that the pilots caused the accident by flying into high ground through gross negligence. The subjective views of AVM J.R DAY, (Now Sir John DAY) the first RAF Senior Reviewing Officer, were seemingly based on an opinion not substantiated by facts. His superiors echoed his views and endorsed this opinion with no evidence offered to confirm such views, when overturning the RAF BOI findings. At a later Civil Fatal Accidents Inquiry (FAI) in Scotland, the Sheriff was unable to agree with the RAF’s finding showing pilot error as being the cause of the crash. Notwithstanding this FAI finding, the RAF Senior Reviewing Officers would not change their accusation of gross negligence. Further investigation of this matter by the authors of the above captioned independent report, established that vital information relating to Chinook HC2 engine malfunctions was knowingly kept from the various Boards of Inquiry by the RAF and that known possible causal factors were ignored by the RAF’s own BOI. In fact, orders were given to a serving officer (unit test pilot) not to discuss Chinook HC2 related technical problems with any of the investigators or fellow officers. It would also appear that the views of RAF Boscombe Down test pilots and of computer software specialists were ignored. The aircraft was ordered into Service before faults, such as those found in the HC2 flight-critical FADEC engine control computer software, had been satisfactorily cleared and before the aircraft was authorised to fly in icing conditions. Since the subject crash, new information has been obtained from other Chinook operators on technical malfunctions that have resulted in fatal accidents or very near accidents. In at least two cases, clues as to their cause were similar to some found on ZD576, the RAF Chinook HC2 that crashed. This means that the accident may have been caused by factors other than flight into terrain because of pilot error as inferred by the Senior Reviewing Officers. In the circumstances and under the RAF’s own Rules at the time of the accident which state “ONLY IN CASES

WHEN THERE IS ABSOLUTELY NO DOUBT WHATSOEVER SHOULD DECEASED AIRCREW BE FOUND NEGLIGENT”, the accusation of gross negligence should be set aside, indeed unconditionally withdrawn. The 20 April 2000 report was prepared to bring together salient facts that emerged from the study of available documentation relating to this crash. Factual statements are offered in some chronological and logical sequence, to build a picture that it is hoped, will allow readers to arrive at their own conclusion(s). Answers to questions that arise from the report may also be of interest


20 April 2000 REPORT ii

ROYAL AIR FORCE

CHINOOK MARK 2 ACCIDENT

MULL OF KINTYRE STRATHCLYDE - SCOTLAND

2 JUNE 1994

CONTENTS

Report Appendices A to M Addendum 1 - Weather Addendum 2 - Electro Magnetic Interference (EMI) Addendum 3 - House of Lords Select Committee Inquiry- Special report Addendum 4 - Airworthiness (2010 update)

REPORT PREPARED BY









20 April 2000 REPORT iii

SUMMARY

On 2 June 1994 a Chinook HC2 of the Royal Air Force crashed on the Mull of Kintyre whilst on a flight from Northern Ireland. All on board were killed, including 25 senior members of the British Intelligence Services and the crew of four. The RAF Accident Investigation Board of Inquiry could not criticise the pilots for human failings nor could it determine a definite cause of the accident although many possible causes were considered, and it accepted the possibility that a technical fault that had left no trace could not be dismissed. Nonetheless, two senior RAF reviewing officers declared that the pilots were guilty of gross negligence and that they were to blame for the accident. Following the RAF’s own investigation, a Fatal Accidents and Sudden Deaths Inquiry was carried out by Sir Stephen Young the Strathclyde Sheriff. He was unable to apportion blame and did not agree with the cause of the accident as found by the (RAF) Board of Inquiry. Notwithstanding, the two RAF BOI reviewing officers (surprisingly) refused to change their finding of gross negligence. The important point of departure in the analysis which follows, is a Royal Air Force regulation relevant to accident investigations of this kind. The Regulation states : “Only in cases in which there is absolutely no doubt whatsoever should deceased aircrew be found negligent”. The simple but fundamental question therefore is,” Was there, in this case, absolutely no doubt whatsoever about the cause of the accident”. It is in fact the only question. Aircraft serviceability and inadequate equipment may have been causal factors in the crash, whereas speculation on the dark possibility of intelligence related cover-ups and sabotage is unsubstantiated. However, it can also be argued that negligence on the part of the pilots is equally unsubstantiated. The history of this episode demonstrates clearly that it was certainly not a case in which there was “absolutely no doubt whatsoever”. In the light of all that, it must be a matter of grave concern that two young officers of the RAF Special Force, with exemplary records and considerable experience, should be found guilty of gross negligence and held entirely responsible for a disaster of this magnitude. Two thorough and comprehensive enquiries, one military and one civilian, have clearly been unable to identify beyond doubt the cause of the accident. More recently, possible technical causes that have made the HC2 aircraft uncontrollable have been identified, such as FADEC software faults that could cause a runaway engine situation at any time. For example a fault code E5 was found in the surviving ZD 576 engine DECU computer memory after it crashed. The same E5 fault code was found on the Chinook that suffered severe damage in Delaware after a runaway engine and rotor overspeed due to a FADEC fault, well before the ZD 576 accident. Apart from the appalling impact of this on the families of the young men, this episode must inevitably involve the jealously guarded honour of the armed forces. There would be nothing dishonourable in now conceding that the imputation of gross negligence was severe and unjust. A call to the Secretary of State to initiate further investigation and/or to set aside the accusations of “gross negligence” in view of the latest technical findings following more recent Chinook accidents, would go a long way towards redressing a glaring injustice. End of Summary


20 April 2000 REPORT iv

ABBREVIATIONS

AAIB Air Accidents Investigation Board, UK (Civil)

ACM Air Chief Marshal

AM Air Marshal

AP Air Publication (RAF document)

ATC Air Traffic Control

AOC Air Officer Commanding

AOC in C Air Officer Commanding in Chief

AVM Air Vice Marshal

BOI Board of Inquiry (RAF)

CAS Chief of Air Staff

CVR Cockpit Voice Recorder

DASH Differential Air-Speed Hold

DECU Digital Engine Control Unit

EAS Electronic Assessment Section

FADEC Full Authority Digital Electronic Engine Control

FAI Fatal Accident (and Sudden Deaths) Inquiry (Civil Scottish Sheriff’s Inquiry)

FDR Flight Data Recorder

Flt Lt Flight Lieutenant

FRC Flight Reference Cards

GMT Greenwich Mean Time

HC1 Boeing Chinook Mark 1 Helicopter

HC2 Boeing Chinook Mark 2 Helicopter (Updated Mark 1)

IFR Instrument Flight Rules

ILCA Integrated Lower Control Actuator

IMC Instrument Meteorological Conditions

LCA Lower Control Actuator

MALM Master Air Load-Master

MOD Ministry of Defence

MSA Minimum Safe Altitude

OCU Operational Conversion Unit

RAF Royal Air Force

RPM Revolutions Per Minute

SF Special Forces

SOP Standard Operating Procedure(s)

TANS Tactical Air Navigation System

TV Television

UFCM Undemanded Flight Control Movement

VIP Very Important People

VFR Visual Flight Rules

VMC Visual Meteorological Conditions


20 April 2000 REPORT 1

ROYAL AIR FORCE CHINOOK MARK 2 (HC2) - ZD 576 ACCIDENT

MULL OF KINTYRE, STRATHCLYDE, SCOTLAND - 2 JUNE 1994

ONLY IN CASES IN WHICH THERE IS ABSOLUTELY NO DOUBT WHATSOEVER

SHOULD DECEASED AIRCREW BE FOUND NEGLIGENT

(AP3207 - RAF MANUAL OF FLIGHT SAFETY, CHAPTER 8, APPENDIX G, PARAGRAPH 9, PAGE 3)

[This AP3207 rule was amended in 1997]

Revisiting the chain of events leading to and following the above captioned accident.

1. THE AIRCRAFT

1.1 The Chinook Mark 2 (HC2) aircraft is a Royal Air Force Mark 1 Chinook helicopter given a

mid life update by Boeing the aircraft manufacturer, to a Service defined specification issued by the MOD “Hels” office and AVM J R Day who controlled its introduction to service.

1.2 AVM J R Day, as AOC Group 1, was in charge of all helicopters and ground attack fighters.

He was one of the senior reviewing officers who overturned the RAF’s own Accident Investigation Board of Inquiry (BOI) report findings on this accident.

1.3 Some examples of the updated HC2 were in operational service with RAF Squadrons 7 and 18

at the time of the accident. Cockpit Voice Recorders (CVR) and Flight Data Recorders (FDR) that would have pinpointed causal accident factors, were not fitted. Though recommended and authorised after two previous RAF Chinook accident inquiries in 1987 and 1988, crash flight data recorders were not included in the HC1 to HC2 mid-life update specification, for reasons of economy.

a. The HC2 was not cleared to fly in icing conditions at the time of the accident. It was

limited to flight in cloud at temperatures not below 4o C.

b. The HC2 was introduced into Squadron Service (Special Forces Flight of 7 squadron) at RAF Odiham. One such aircraft, ZD 576, was deployed to Belfast for routine operations against the wishes of the pilots based at Belfast and who were to fly it. It was this aircraft that crashed on the Mull of Kintyre.

c. One HC2 was based at Boscombe Down for flight test and operational trials flying at

the time of the accident. It was not being flown by the test pilots because of certain technical shortcomings and problems related to the Full Authority Digital [Electronic] Engine Control (FADEC) system, whilst operated in the normal mode.

d. Doubts about the engine control system caused the Boscombe Down test pilots to

discontinue flying the Chinook HC2 on 3 June 1994. They did not resume flying until 20 October 1994. (See Appendix A for the “diplomatic” explanation offered by the Ministry of Defence). During this period, operational pilots on 7 and 18 squadron were ordered to continue flying the HC2 aircraft, notwithstanding the unresolved FADEC faults.

e. The Chinook HC2 was severely weight restricted because of the FADEC failure

incidents, some of which resulted in random engine rundowns for no apparent reason. 1.4 The RAF Board of Inquiry failed to mention that Mrs V Brennan from the Electronic

Assessment Section (EAS) at Boscombe Down had, on 3 June 1994, sent a memo to Mr R Sparshott at ‘MOD Procurement’, criticising the FADEC software. The memo said, quote, “the problem remains that the product has been shown to be unverifiable and is therefore unsuitable for its intended purpose”, unquote. (Appendix J refers)



1.5 Mr Malcolm PERKS who is a pre eminent computer expert in the country, was hired by the MOD to study FADEC. He said that the Chinooks’ flight critical engine control system had not been verified as safe for its designed operational tasks and that it had suffered basic problems and errors since it was introduced in 1989. These errors had not been corrected at the time of the crash of ZD 576. None of this was mentioned by the RAF BOI report.

1.6 Mr Henderson of the MOD subsequently admitted that the AAIB inspector helping the RAF

investigation was not given the full FADEC story during that investigation. 1.7 Numerous HC2 technical faults were reported prior to the accident. Failures and faults

included a. TANS Navigation system errors. b. Controls attachments coming adrift. c. FADEC flight-critical (software) faults that resulted in undemanded engine shut down,

engine run-up, spurious engine failure captions and misleading and confusing cockpit engine indications. (Squadron Leader D T Morgan – RAF BOI – Part 6 Witness Statements, Page 43).

1.8 In November 1997, Mr John SPELLAR, as Junior Minister for Defence, admitted 570

“incident signals” since the HC2 was introduced into squadron service in 1994. Of these, 70 were FADEC related. Clearly, numerous FADEC problems had as yet remained unresolved, some 3 ½ years after the accident.

1.9 As reported by operators of the type, newly identified Chinook technical problems that have

caused serious incidents or fatal accidents since the Mull of Kintyre crash, include

a. Pitch ILCA and thrust LCA hydraulic fluid contamination causing loss of control (undemanded low level roll). (Appendix D refers).

b. Water ingress through windscreens and on to the pedestal, affected electrical systems and

may have caused a fatal crash during an instrument approach (See Appendix E).

2. DOCUMENTATION FOR THE CHINOOK HC2

2.1 The HC2 Aircrew Manual was produced by Boeing the helicopter Manufacturer and given to the RAF Chinook HC2 project team that was in the United States. It was then edited and circulated to crews by 240 Operational Conversion Unit (OCU), led by Squadron Leader David T. MORGAN.

2.2 The Flight Reference Cards for the HC2 were prepared by 240 OCU with little, if any, help

from Boscombe Down, whose test pilots could not positively assist at that time due to their limited knowledge of the HC2.

2.3 240 OCU, which eventually became 27(R) Squadron, was responsible for Chinook HC2

conversion training and the preparation of documentation relevant to the operation of the HC2. 2.4 The Aircrew (Operations) Manual for the HC2 was incomplete. At the time, crews used

partially photocopied and manually amended flight reference cards due to shortfall in issue. 2.5 The aircrew manual was substantially amended in November 1994. Even then, the chapter on

FADEC was incomprehensible to operating crews. There also were misleading sections in the chapter dealing with aircraft electrics. (Precognition of FAI Witness J, Appendix C, Pages 12 & 13 refer).



2.6 Section 2, the Limitations section, was blank. It was in fact a single page with “to be issued” written upon it. The flight reference cards were re-issued in their entirety in July 1994 as understanding of the aircraft systems evolved. Those in force in June 1994 were actually held to be so incorrect as to be contributory to the number of engine malfunctions observed. (Precognition of FAI Witness J, Appendix C, page 13 refers).

2.7 FADEC malfunctions were not fully covered by drills in the Chinook HC2 flight reference

cards (FRC). Chinook FRC were based primarily on the Chinook D model that is not fitted with FADEC. Drills relating to FADEC were based on the best information available on how the system might respond during certain malfunctions.

2.8 A number of emergency drills, in particular electric and hydraulic, were poorly laid out and

required the crew to be familiar with the drill to avoid confusion. The shortfall in the Chinook HC2 WAS DISCUSSED (!) with the crews during conversion courses. (Squadron Leader D T Morgan – RAF BOI – Part 6 Witness Statements, Page 44)

Pilots were therefore required to remember differences between specific drills written for the HC1, in the absence of HC2 drill cards. This is not considered acceptable when dealing with an emergency under stress, especially as most Chinook operations would be at low level.

2.9 Following the accident, HC2 Flight Reference Cards were eventually re-issued after revision, due to major errors in their content.

3. EVENTS PRIOR TO THE DAY OF THE ACCIDENT

3.1 Crew Training

The pilots were exposed to a minimum amount of HC2 conversion training during January and February 1994. They then returned to fly Mark 1 aircraft until 1 June of that year, when they were given a short “tick in the box” check out on the Mark 2 - ZD 576. They flew the HC2 again on a short troop movement mission before the accident flight. Clearly, the crew only had minimal operational experience on the Mark 2 Chinook (HC2). Such a level of training could rarely, if ever, be acceptable for the carriage of VIPs (Sensitive Personnel).

3.2 Request for a Mark 1 Chinook in preference to a Mark 2

a. Flt Lt Tapper, the Chinook detachment commander, formally requested that a second Chinook HC1 be left on the Station at Aldergrove, when it was known that an exchange Chinook HC2 was to be sent to Ireland, to replace one of the two HC1 aircraft based there. His request was denied.

b. Flt Lt Tapper was also refused permission to use the same icing conditions limitations

for the HC2 as applicable to HC1 aircraft. He was told that the aircraft was not cleared to fly in cloud in temperatures below +4o C and that no exception could be made.

3.3 Meals and Flight Times Limitations

a. Flt Lt Cook had breakfast in the officers’ mess on the morning of the accident. It was not possible to establish if Flt Lt Tapper also had breakfast although it is reported that he was well known never to miss this meal. Though there was no indication that the Captain (Flt Lt Tapper) did have breakfast, it is probable that meal boxes had been provided prior to, and during the, fatal flight. Therefore the possibility of the Captain in particular suffering from hypoglycaemia and its effects, may be discounted in all probability.



b. Pre flight briefing started at 0845 prior to the first take off at 0945. A series of local

flights were completed at 1520 hrs, using ZD 576. The crew then decided to continue with the planned flight to Inverness on the same HC2 aircraft, departing at 1747. If the return could not be achieved within 10 hours (including extensions from the normally permitted 7 hours), a possible night-stop at Inverness had been considered.

4. EVENTS LEADING TO THE FLIGHT THAT CRASHED

4.1 Chinook HC2 – ZD 576 was used for flights earlier that day with an extra crew man (Sgt John

COLES). It was then tasked to carry out the VIP flight to Inverness on the day of the accident. 4.2 Because of the HC2 limitations for flight in icing, the flight to Inverness had to be planned as a

VFR flight below cloud operation, along an approved route to be used for such visual contact flights.

4.3 The Minimum Safe Altitude (MSA) for the sector from the Mull of Kintyre to Corran is 5900

feet. An aircraft should enter an area or sector at the relevant MSA or higher.

a. Had flight in icing been permitted, the helicopter should have been at least at 5900 feet before arriving over the Mull of Kintyre, though the MSA immediately over the Mull of Kintyre, is 2800 feet. (See route planning map at Appendix F).

b. Flight at 5900 feet or more was precluded on that particular day by the cloud cover

and the fact that the +4o isotherm was at 5000 feet. Consequently, the approved alternative Visual Contact flight profile below cloud was planned and flown at 500 feet, reducing to an estimated 200 feet over the sea that day; as previously practised and to stay clear of cloud and in sight of the surface (VFR/VMC rules for helicopters).

4.4 The planned route from Aldergrove was to a point close to the Mull of Kintyre lighthouse, then

to Corran near Fort William, thence up the Great Glen to Inverness and Fort George.

a. Five waypoints were entered by the crew in the Navigation System during their pre- flight preparations. Waypoint A was N55o 18.50 W005o 48.00. This point was a approximately 280 metres South East of the Mull of Kintyre lighthouse. Waypoint B was entered as a point at, or near Corran.

b. When the aircraft was 0.81 nautical miles from Waypoint A whilst on a bearing of 018oT,

Waypoint B was manually selected. Inexplicably, the aircraft then flew on towards the Mull landmass on a track of 022oT, instead of turning left through 14o (to then fly visually along the coastline, left of the direct track from the Mull of Kintyre lighthouse to Corran , along the approved alternative visual contact route).

4.5 What could have happened as the aircraft approached the Mull of Kintyre Lighthouse and why

was the non-operationally required call made to Scottish Military at 1655:14 GMT just before the crash, not answered ? The call was seemingly made by Flt Lt TAPPER whose voice was relaxed, as recorded by Scottish Military at the Prestwick ATC centre, an indication of a normal situation on the flight deck at that time. Yet at 1659.30 GMT, some four minutes later, the aircraft crashed. What happened in that time must have been sudden and uncontrollable.

4.6 The Mode 3A transponder was on 7760 when it crashed (instead of 7000 the normal military

low level code or 7700 the distress code, or 7100 the ‘pop-up’ code when transiting from low level, upwards). One can never know who, or if anyone was trying to change the transponder code and why.



4.7 Was Flt Lt Tapper, the aircraft captain, changing the transponder code or was Master Air

Load-Master (MALM) Graham W FORBES trying to so do, whilst actively involved on the flight deck with navigation and other activities, as trained ? a. As a Full Mission Qualified (FMQ) rated Special Forces crewman, MALM Forbes

would have normally been on the flight deck and actively involved with the operation and the aircraft’s navigation. This is the Standard Operating Procedure (SOP) for Special Forces (SF) crews.

b. At the accident site, the bodies of the left seat pilot and one of the loadmasters

remained with the forward fuselage section, whilst the second loadmaster was found near to the aft rotor head impact point. Notwithstanding, the BOI does not seem to have considered that a crewman would have been in the vicinity of the jump seat (actively backing up the navigation as per SOP), though the AAIB report seems to reinforce this probability (5.11, page 15).

4.8 Did the pilots deliberately fly into the side of the Mull instead of turning 14o left just before

reaching their first navigation Waypoint, 280 metres South East of the Mull of Kintyre lighthouse, or did a major technical problem occur, which was uncontrollable or of extreme distraction, as they approached the first Waypoint ?

4.9 In view of what is now known about Chinook HC2 technical failures, there could have been

a. An uncontrollable rotor overspeed due to an engine runaway caused by a FADEC fault; or

b. A Differential Airspeed Hold (DASH) failure; or

c. A loss of control due to an undemanded flight control movement (UFCM) caused by

hydraulic contamination, as discussed in paragraph 5.2 (a) or due to an electrical failure; or

d. Other reasons; for example, a control jam. Any one of these now recognised occurrences could have forced the aircraft into high ground, regardless of what the pilots did to recover or turn away.

4.10 The significance of a DASH failure can be more readily shown by the events during a training flight, when a crew lost control of their Chinook HC1 at Odiham because of a Differential Airspeed Hold (DASH) failure on only one of the two working systems. They were at 1500 feet in IFR conditions and almost crashed as a result. (See Appendix B).

a. Such a DASH failure can occur on the HC2 which is notoriously difficult to fly when

the Automatic Flight Control System (AFCS) is not working properly. b. A double DASH failure would result in a crash, in all probability.



5. POST ACCIDENT INVESTIGATIONS

5.1 RAF Board of Inquiry (Wing Commander A D PULFORD presiding) focused on the

handling and operation of the aircraft.

5.1.1 Summary of findings by the Investigating team :

a. It would be incorrect to criticise him (Flt Lt Tapper) for human failings based on the available evidence. (BOI report : 67c, Part 2 – Page 41).

b. The Board concluded that there were no human failings with respect to Flt Lt Cook

(BOI report : 68, Part 2 – Page 42).

c. (With reference to the AAIB investigation) The Board did not dismiss the possibility that a minor technical malfunction could have provided distraction for the crew. (BOI report : 35(b), Part 2 – Page 15).

d. The possibility of the crew being distracted by a technical fault which had left no trace

could not be dismissed. (BOI report : 46(c), Part 2 – Page 28). e. There were many potential causes of the accident and despite detailed and in-depth

analysis, the board was unable to determine a definite cause. (BOI report : 61, Part 2 – Page 37).

The fact remains that The RAF’s own Board of Inquiry failed to mention that the Chinooks’ FADEC engine control system software was reported as unverifiable and unsuitable (for its designed operational tasks) by the MOD technical advisor at Boscombe Down. FADEC faults had been the cause of a runaway rotor accident during early testing in Delaware. As a result, the MOD successfully sued the engine manufacturer (Textron) for compensation.

5.1.2 Group Captain P A CRAWFORD, Station Commander, RAF Odiham

“In assessing human failings, the evidence is insufficient to be specific”. (RAF BOI report Part 3 – page 4 of statement).

5.1.3 Group Captain Roger E WEDGE, Station Commander RAF Aldergrove

“I believe that the exact train of events can never be determined with absolute certainty”. (RAF BOI report Part 3 – Page 1 of statement)

5.1.4 Air Vice Marshal J R DAY, AOC No 1 Group – Overriding Conclusion

a. “Flt Lt Tapper did not exercise appropriate care and judgement (as responsible for the

safe navigation of the aircraft). I am forced to conclude that Flt Lt Tapper was negligent to a gross degree”.

b. “He should have recognised the dangerous environment into which he was flying. He

continued to fly the aircraft directly at the Mull at high speed, low level and in poor visibility. I cannot avoid the conclusion that Flt Lt Cook was also negligent to a gross degree”.

5.1.5 Air Marshal Sir William WRATTEN, AOC in C

Air Marshall Wratten agreed with AVM Day’s conclusions.



5.2 UK (Civil) Air Accident Investigation Branch (AAIB)

(Mr A CABLE, engineer investigator, who was asked to assist the RAF BOI team)

5.2.1 Uncontrolled Flight Control Movement (UFCM)

a. A strip examination discovered a considerable amount of very small metal particles in residual fluid in parts of the boost actuator for both the pitch ILCA and the thrust LCAs. The strip examination also established the presence of four fine metal slivers up to 0.2 inch long, on one of the servo valve screens (No.2 actuator extend port) of the yaw ILCA boost actuator. The contamination seemed to have occurred before the crash. (AAIB Report : paragraph 7.4.4, page 50).

b. The US forces have established that such a hydraulic fluid contamination is a primary

cause of uncontrolled flight movements. It was established that because of such contamination, a Chinook turned upside-down, then completed a full roll before control was regained at low level. (Appendix D refers).

5.2.2 Loss of Control – Engine runaway due to FADEC malfunction

a. Although there had reportedly been problems regarding the upgraded Chinook’s FADEC system, Mr Henderson of the MOD subsequently admitted that the AAIB was not given the full FADEC story.

b. The AAIB report established full collective thrust at impact, 25% aft stick, 23% left stick

and 77% left rudder pedal. (AAIB report page 54). This is an unheard of and highly dangerous rudder flight position for normal forward flight. Such a rudder input could mean that the pilot was probably reacting to a (major ?) loss of control situation. Given that the estimated bank angle was 5o to 10o and the yaw angle less than 10o at the time of the initial impact (FAI report page 4, Item 26), it is difficult to explain the extremely large rudder input of 77%.

c. A Digital Engine Control Unit (DECU) software E5 code fault was recorded and found in the surviving engine computer memory of the crashed HC2 aircraft. (AAIB report Page 41). This was later recognised to be the same code as that found after the Chinook accident in Delaware following an engine runaway that caused a rotor overspeed, for which the MoD sued the engine manufacturer and won substantial damages. These facts were not mentioned by the RAF or the MOD in any of the Inquiries.

5.2.3 A control system malfunction could have been caused by an electric malfunction, a hydraulic

malfunction or a control jam.

a. Electric malfunction : There is an extensive history of Undemanded Flight Control Movements (UFCM) caused by electric malfunctions on the Chinook.

b. Hydraulic malfunction : Contamination of hydraulic fluid has caused a Chinook to roll

onto its back because of an Undemanded Flight Control Movement (UFCM). (See 5.2.1 and Appendix D.

c. Control jam : The possibility of a control jam could not be discounted. A temporary or

permanent control restriction could well have occurred.

i. Almost all parts of the flight control mechanical systems were identified, with no evidence of pre-impact failure or malfunction, although the possibility of control system jam could not be positively dismissed. (AAIB Report page 65, Item 43).



ii. Most attachment inserts on both flight control system pallets had detached, including the collective balance spring bracket that had previously detached from ZD 576 thrust/yaw pallet, with little evidence available to eliminate the possibility of pre-impact detachment. (AAIB Report page 65, Item 44). This detachment had been the subject of a “Serious Occurrence or Fault” Signal. (Appendix K refers)

iii. The method of attaching components to the pallets appeared less positive and less verifiable than would normally be expected for a flight control system application. (AAIB Report page 65, Item 45).

There were at least two known incidents of a balance spring mounting bracket insert coming loose before the crash (including one on ZD 576 itself) and at least three after the crash, due to the ‘bonding’ method used by Boeing to secure components of the flight control system in the “broom cupboard”. Detachment of this bracket within the flying control closet in flight could present a serious flight safety hazard, should the loose bracket foul adjacent flying controls.

5.3 Fatal Accidents and Sudden Deaths Inquiry, by Sheriff Sir Stephen Young

5.3.1 Sheriff’s Determination

Sir Stephen Young wrote, quote “It has not been established to my satisfaction that the cause of the accident was that found by the (RAF) Board of Inquiry”, unquote. (Fatal Accidents and Sudden Deaths Inquiry report at page 120).

6. THE PILOTS, THE CREW AND THEIR BACKGROUND

6.1 Flt Lt Tapper was an experienced Chinook pilot and was familiar with Chinook Northern

Ireland operations. He had a total of 3165 military flying hours. (RAF BOI Report Part 2, page 2-1). He was reported as being “extremely capable, extremely professional, very honest, very friendly, extremely conscientious, very safe and, together with Flt Lt Cook, probably more safety conscious than most pilots.” (See Sheriff Young’s Inquiry (FAI) report, Page 23). He was one of the few pilots converted to Special Forces work. He was “quite a serious pilot who took things sensibly and safely.” (Sheriff Young’s FAI report, Page 25).

6.2 Flt Lt Cook was on his second Chinook tour and also had considerable experience of Chinook

operations. He had a total of 2867 military flying hours. (RAF BOI Report Part 2 page 2-1). He had recently been assessed as an above average pilot and combat ready. He was considered to be “a very competent professional officer who undertook his duties quite seriously.” (Sheriff Young’s Inquiry report, Page 25). He was also trained for Special Forces work.

6.3 Both pilots were together referred to as “probably one of the best crews in the RAF” (Sheriff

Young’s Inquiry report, Page 23). 6.4 MALM G W FORBES had served continuously on 7 squadron since April 1987 and was the

Special Forces ‘Crewman Leader on the flight. His attention to detail and spatial awareness often led one to believe that he held a navigator’ s brevet. If ever MALM Forbes was unsure during a mission, he would always ask for clarification from the aircraft captain. (RAF BOI Witness No 15 report, Squadron Leader B M NORTH, page 6-32 and FAI witness Sergeant John COLES, RAF, Pages 318 to 321, Appendix H refers).

Prior to the fatal flight, Forbes was seen preparing a 1:500,000 scale map of the route which was a copy of the pilot’s. He had an exact copy of the route map for the Inverness flight as a back up to the navigator pilot (and) he would continuously monitor the progress of the flight along the track line as No 2 crewman of a Special Forces crew (Witness J, FAI Report P.36).



6.5 Sergeant Kevin A HARDIE was a very experienced and highly regarded Chinook crewman. 6.6 Comment on the Special Forces Operations integrated crew concept and training

North Strathclyde Fatal Accident Inquiry (FAI) witness J stated, quote : “In our environment (Special Forces), we accentuate that a four man crew works together in co-operation, far more than they do in conventional flying. For example one of the crewmen at all times navigates and acts as second navigator. The other crewman, whilst looking at the serviceability of the aircraft, will also be monitoring the performance of the pilot and, at any stage, any member of that four man crew can call for a change of flight conditions, flight status, ask that the exercise be aborted and the captain of the aircraft or the pilot handling the aircraft will immediately respond to that. We stress they are a four man crew, not a pilot and three assistants”. (Sheriff Sir Stephen Young’s FAI report, Page 35 refers under ‘Crew Working Relationships’)

6.7 Comments on crew actions

a. Given that they already had a ground speed of 140 knots, why would they accelerate to an airspeed of 150 knots or more, at the most critical moment of flight ?

b. Were they so complacent that they would attempt a high speed cruise-climb when in

Instrument Flight Conditions and faced with high ground that they had acknowledged on their maps ?

c. If the answer is YES, we must believe that

i. All 4 crew men ignored all their training, especially their Special Forces training. ii. The crewmen, one of whom prepared maps for the journey (the hallmark of SF rear

crew) played no part in the navigation or general mission management of the sortie; and/or

iii. They had a death wish.

d. If the answer is NO, we must ask,

i. Why did they crash at so high a speed ? ii. Why did they fail to avoid high ground of which they were aware ?

e. Furthermore, if the answer is NO, it implies that the crew were well aware of their position and that they were distracted or forced into their ultimate flight path.

6.8 Likely crew actions in deteriorating weather

a. They must have known that they were approaching an area of poor visibility. It is too

incredible to assume they did not. b. They would have been reluctant to climb because of the icing restriction. However,

there was no need to climb, because a “Downwind Emergency Turn” could have been carried out below the cloud in complete safety. This is a manoeuvre that is taught, as standard, to all helicopter pilots from their basic helicopter training onwards. This latter manoeuvre is designed to cope with unexpected or suddenly deteriorating weather, or an obstacle on the aircraft’s flight path when at low level.

c. It is unlikely that they would have changed the Waypoint to Waybpoint B as they did,

unless they were aware of their current position.



d. Having seen the Mull, they would have planned to fly up the West coast of the Mull, keeping the beach in view on the right.

e. If the helicopter crew had anticipated a deterioration in visibility, they would have

slowed to a speed which would depend upon the rate of visibility deterioration, (probably between 60 and 100 knots). Such a speed (somewhat faster than a Sea King helicopter) was estimated by the yachtsman witness who saw the aircraft passing almost overhead, when he could also see the lighthouse. His evidence seems not to have been given the credence it deserved by the RAF BOI. (Addendum after Page 16). (Mr Mark B HOLBROOK, Witness 18, RAF BOI Report Pages 6-36 to 6-38).

f. Had they lost complete visual reference, they would have climbed immediately at

maximum rate, instinctively and without discussion, if an emergency turn had not been carried out earlier (See 6.8(b)).

g. That they did not do so could indicate that something uncontrollable happened, which

caused them to fly onto the Mull regardless of their attempted corrective actions.

7. FADEC PROBLEMS

7.1 Aerospace Engineer Malcolm PERKS was the FADEC expert who represented the Ministry of

Defence (MoD) in its Delaware suit against the Chinook engine manufacturer. He had won damages of $3 million for the MoD in a lawsuit against Textron-Lycoming the engine manufacturer, after a RAF Chinook HC2 was partially destroyed during testing, following a rotor overspeed caused by an engine runaway due to a faulty FADEC. This accident was not mentioned at any of the Inquiries. An engine overspeed in a helicopter will initially result in a sudden climb of the sort performed by ZD 576 before it crashed. If the pilot does not bring the runaway under control within seconds, the rotor may fly off. The helicopter pilot’s main thought is to prevent a rotor separation. All other thoughts such as high ground or cloud ahead become secondary.

7.2 Mr Perks recognised the fault code E5 found in the aircraft that was severely damaged in

Delaware as being the same as the fault code found in ZD 576’s surviving engine computer memory after the crash. This indicated the possibility that a runaway engine and rotor overspeed caused by a FADEC malfunction may have occurred and that the crew was fighting an uncontrollable aircraft, hence the flight towards high ground instead of the 14o turn to port demanded by the flight plan when approaching Waypoint A.

7.3 The meaning of the Code E5 fault discovered in the ZD 576 surviving engine computer

memory, was not mentioned by the RAF at any of the Accident Inquiries, although it was the same fault code as that found in the HC2 aircraft that was severely damaged in Delaware, following a rotor overspeed due to an engine runaway.

7.4 A loose minute sent on 3 June 1994 by Mrs V. BRENNAN from EAS at Boscombe Down to Mr

R. SPARSHOTT at ‘MOD Procurement’, said that the software was unsuitable for its intended purpose (see 1.4). The inference was that this software should not be flying in a flight safety critical application. The RAF BOI report makes no mention of this memo that also said

a. “EAS does not agree that the T55-L-712F software (for the T55-L-712 RAF engine)

meets the requirements of JSP 188 (documentation standards for this level of software). The traceability study of the documentation reveals inconsistencies such as requirements not being implemented and conversely, things appearing in the code which did not appear in the requirements”; and



b. “There were a total of 34 Category 1 anomalies and 48 Category 2 anomalies in the traceability study. This does not meet the requirements of JSP 188 (the documentation standards for this level of software)”.

c. “Boeing have confirmed that the FADEC software is indeed flight critical. [ref

Software Accomplishment Summary (HSDE) ART 1251 iss.3 1991 Para 5.0]”. The fact that this memo refers to software which was being used by an aircraft that was actually in service is very disturbing. (Appendix J refers).

8. SQUADRON LEADER ROBERT BURKE

8.1 Squadron Leader Robert BURKE, now retired from the RAF, was the RAF Odiham unit test

pilot (UTP). At the time of the accident, he was acknowledged in the RAF as being the leading technical aircrew specialist on both the Puma and Chinook helicopters. His experience and flying skills when air-testing both aircraft were known to be unique.

8.2 Early during the accident investigation, Mr A (Tony) CABLE, the AAIB investigator who was

assisting the RAF BOI, telephoned Squadron Leader Burke to ask for technical advice on the Chinook HC2 and its systems. After a series of telephone conversations during which FADEC was not discussed, Squadron Leader Burke was ordered not to speak to any of the investigators about Chinook systems malfunctions.

8.3 Squadron Leader Burke prepared simplified notes for the RAF BOI, as paraphrased hereunder.

If ZD 576 had experienced a sudden engine runaway (over-rev) just below cloud, the

aircraft is likely to have climbed into the cloud. The pilot, fearing that the engine

runaway would lead to a serious rotor overspeed, would have raised the collective lever

to contain the rotor speed. This is taught in the flight simulator as an immediate and

instinctive reaction to an overspeed.

This would have put the aircraft further up into the cloud, the increase in lift coming

from the increase in the angle of attack of the rotor blades (that is the angle of rotor

blades to air-flow).

A new situation would have now arisen. The handling pilot would have been totally and

unexpectedly in cloud, having to transfer from visual flight to his flight instruments.

The collective lever would have been well up under his left armpit as he tried to control

rotor speed. The engine and flight instruments would have been very difficult to read

because of acute vibration caused by fluctuating or high rotor RPM. This acute vibration

cannot be simulated.

The captain, with a heavily vibrating aircraft, a lot of noise and almost certainly

unreadable engine instruments, would not have had time to rectify the emergency before

hitting the ground at the Mull of Kintyre.

8.4 The Burke scenario – an uncommanded engine runaway and rotor overspeed causing an

uncommanded climb – matches the fatal flight path of ZD 576. The RAF’s most experienced Chinook test pilot, was convinced, and still is, that a FADEC fault, specifically an engine run up, could have put the helicopter into cloud during the fatal flight sequence.



8.5 Squadron Leader Burke asked his Officer Commanding Operations for permission to tell the enquiry and its technical adviser, Mr ‘Tony’ Cable, the AAIB inspector, about his observed and experienced FADEC incidents. The Wing Commander ordered the Squadron Leader

not to talk to anyone; and that included Service colleagues as well as the Board of Inquiry, the AAIB and the Scottish Sheriff’s Fatal Accident Inquiry. The reason for this extremely unusual and disturbing order and its background should be investigated.

8.6 The BOI accident report did not mention Boscombe Down’s FADEC safety concerns which

had twice led to their discontinuing flight testing. Nor did the report mention the Delaware engine runaway caused by a faulty FADEC or the MOD’s lawsuit. Also, of course, the BOI did not hear Squadron Leader Burke’s evidence WHICH APPEARS TO HAVE BEEN WITHHELD

FOR AN UNKNOWN REASON. However the BOI was aware of FADEC related problems (see 1.7 (c)) and its report accepted that “an unforeseen technical malfunction of the type being

experienced on the Chinook HC2, which would not necessarily have left any physical

evidence, remained a possibility and could not be discounted”. (BOI report Part 2 - Page 18, Witness 20 and Annex Q).

9. SIR MALCOLM RIFKIND

9.1 Sir Malcolm RIFKIND was the Defence Secretary at the time of the accident. He would have wanted to know the cause of the accident and why the RAF had been flying such a valuable group of VIPs in an aircraft that was not free from major computer software design logic and other technical faults.

9.2 He would have based his opinion of the circumstances on facts given to him by the RAF at the

time. These facts may not have included reservations about the FADEC problems caused by faulty software.

9.3 Sir Malcolm RIFKIND was interviewed on 13 October 1999 during a Channel 4 TV news

programme. Words spoken regarding this accident are quoted to illustrate his feelings on the matter, after he had been made aware of the possible technical malfunctions that might have occurred on the fateful day of the accident and which are known to have affected Chinooks, both before and since the ZD 576 accident.

Quote There is a case to answer and it has not been properly answered at this stage. I would

hope that the MOD would, as it were, go back to square one and say, look we understand that there is very real concern in many quarters and that it would be sensible to have an independent inquiry.

Quote What has been said since then, is that in good faith they believe this information (the

EDS SCICON report, the 3rd June memo or the Textron case) was not even a possible explanation for the crashing of the aircraft. I don’t question their good faith. I have no reason to question their good faith. But I have still to question whether they reached the right decision.

Quote Because certainly on the face of it, I would have thought that if there had been

substantial and long standing problems with the Chinook aircraft, then THAT, AT

LEAST THEORETICALLY, HAS TO BE A POSSIBLE CAUSE OF ACCIDENTS THAT

MIGHT HAPPEN and that, is information which should have been shared with the inquiry. So at the very least IT SEEMS TO ME THAT A SIGNIFICANT ERROR OF

JUDGEMENT WAS MADE. The RAF rules at the time of the crash said deceased aircrew can only be found “grossly negligent” where there is absolutely no doubt whatsoever. The onus now lies with the MOD to prove the pilots guilty.



10. MILITARY COURTS MARTIAL AND BOARDS OF INQUIRY 10.1 The need for impartiality requires that those under investigation are dealt with by experts who

are knowledgeable in all the disciplines concerned; and that senior officers not in the direct line of command of those under investigation, be required to judge as Reviewing Officers. a. In the case of this accident, there was no Special Forces representative on the RAF

BOI and there was no one on the Board who knew the Chinook HC2 technicalities.

b. The first Reviewing Officer (AVM John DAY) happened to be the line manager in direct line of control of this particular unit. One might ask why such an officer was allowed to overrule an official Board of Inquiry and the Sheriff’s Fatal Accident Inquiry in Scotland, both of which could not find cause to blame the pilots.

10.2 One could also ask how can two inquiries (one military and one civilian) be overruled by the

reviewing officer(s) AVM DAY and then AM Sir William WRATTEN, who reported to the Chief of Air Staff (CAS) Air Chief Marshal Sir Michael GRAYDON. In turn, the CAS agreed with the accusation of gross negligence made by the first two reviewing officers. (Letter from CAS dated 3.3.97 at Appendix G refers).

10.3 The RAF inquiry procedures which were in place in the late 1980s were less than wholly satisfactory. At that time, an inquiry was caused to be made into those procedures by the lately retired Chief Inspector of Civil Aircraft Accidents, Mr W H TENCH, CBE, C.Eng, FRAeS, and he was frankly, very critical of the RAF inspection investigation procedures. The procedures were heavily criticised, yet those self-same procedures were applied, with very few modifications, to the investigation of this accident. (Statement by Lord TREFGARNE - House of Lords debate on 1 November 1999 - Extract at Appendix I refers)

One ‘TENCH REPORT’ conclusion was, quote: ” That the involvement of some Station Commanders, AOC’s Staff Officers and even the Commander in Chief, is an unwelcome intrusion upon what should be the complete independence of the Board of Inquiry” unquote.

In such circumstances, the integrity of the Reviewing Officers’ decisions may need to be challenged.

10.4 Since the Mull of Kintyre Accident, a change in RAF Board of Inquiry rules requires that

causes of accidents only be investigated, without apportioning blame.

11. CONCLUSIONS

11.1 Since the accident, events have overtaken the situation as investigated by the RAF BOI and

the subsequent Sheriff’s Inquiry, neither of which were able to blame the pilots. Even so, it seems that important technical matters were not disclosed at the time, as they should have been, to reinforce investigation findings. In particular, neither the information related to the Delaware incident nor the importance of the E5 fault code were made known to the BOI or the Fatal Accident Inquiry.

11.2 Sir Malcolm RIFKIND’s words during a recent Channel 4 interview (see 9.3) must be taken

into consideration. They reinforce the case for the need of a review of the Air Marshals’ decision of gross negligence.



11.3 Certainly, after June 1994, a number of new Chinook technical failures that are relevant to this

accident and which have caused major incidents, came to light. For example,

a. Hydraulic fluid contamination (as reportedly noted on ZD 576 - see 5.2.1) caused loss of control and an undemanded barrel roll at low level, during which the pilots only narrowly averted a crash.

b. Water ingress from poorly sealed windscreens onto electronic control boxes on the

pedestal, resulted in tripped circuit breakers and caused yet another fatal crash, this time in the USA. This is an ongoing problem.

11.4 In the circumstances, the time has come for the RAF to reconsider its finding of “Gross

Negligence”, in view of the grave doubts that continue to exist as to the real cause of the accident.

11.5 Clearly, something must have happened to force the aircraft straight into the side of the Mull.

To say anything else raises serious doubts as to the real reason behind accusations of guilt, when no proof of this can be offered in an unquestionable manner as demanded by Queen’s Regulations. In simple terms, the aircraft was introduced into Service before it was fully ready for operational use.

11.6.1 Under the RAF’s own rules set in AP 3207, the verdict of gross negligence is unsafe and

should be set aside in the light of the considerable doubts that exist about the accident.

11.7 The overriding point and perhaps the only one that really matters is not whether or not the pilots were “grossly negligent” but whether there is sufficient evidence to make those verdicts safe ‘with absolutely no doubt whatsoever’. Clearly, very considerable doubts still exist, so by definition the verdicts are unsafe and must be rescinded. Once this has been achieved, it would enable the very important Flight Safety issues surrounding the accident to be examined in an unbiased light to the future benefit of all.

11.8 THE FOLLOWING QUESTIONS MUST BE ANSWERED :

• Why did the RAF withhold vital evidence from its own BOI; such as the Delware runaway rotor incident, the significance of a fault code E5 and FADEC problems caused by unsatisfactory software, as known by Boscombe Down and MOD staff ?

• The reviewing officers produced no new evidence when they overturned the RAF BOI findings. Why ?

• Why did the RAF withhold vital evidence from the AAIB investigator and from the Sheriff’s Fatal Accidents and Sudden Deaths Inquiry ?

• Why was no new evidence produced by the reviewing officers when they refused to change the findings of gross negligence following the Civil Fatal Accident Inquiry; after the Sheriff Sir Stephen YOUNG concluded that it had not been established to his satisfaction that the cause of the accident was that found by the RAF BOI ?

• Why was Squadron Leader Robert BURKE ordered not to speak to any anyone about Chinook technical faults during the investigation and at the Inquiries? That included Service colleagues as well as the Board of Inquiry, the AAIB, The Scottish Sheriff’s fatal Accident Inquiry and any of the investigators.

• Why were the pilots refused the request for a Chinook HC1 when it became known that a Chinook HC2 was being sent to Aldergrove ?



• When it was known to have general unrectified technical faults, why was a Chinook HC2 (which had been grounded by Boscombe Down) sent to Northern Ireland for operations, then selected and the pilots ordered to fly the VIP group that was being carried on the day of the accident, instead of using an alternative fixed wing aircraft for the task ?

• Why did the RAF not review the BOI findings in the light of new information which came to light after the accident; such as control jams and electrical faults or hydraulic fluid contamination causing undemanded flight control movement incidents and accidents ?

END


20 April 2000 APPENDICES 0

APPENDICES

Contents

A. MOD reasons on refusal of Boscombe Down test pilots to fly HC2 (1 page)

B. Paper on Differential Airspeed Hold (DASH) failure (1 page)

C. Precognition of FAI Witness J (HC2 documentation etc.,) (10 pages)

D. HC2 uncommanded flight control movements due to

Hydraulic fluid contamination (5 pages)

E. HC2 fatal accident due to water ingress through windscreens

onto avionics boxes on flight deck pedestal (6 pages)

F. Route planning topographical map – Plot of First leg with MSAs (1 page)

G. Letter from CAS ACM Sir Michael Graydon (1 page)

H. FAI Witness report extract; Sergeant John COLES (5 pages)

I. Lords Debate Report - 1 November 1999 (1 page)

J. Loose Minute from EAS Boscombe Down to “MOD Procurement” (4 pages)

K. Follow-up report of a Serious Occurrence or Fault - ZD 576 (1 page)

L. Weather Conditions – FAI Testimony by Mr M HOLBROOK (4 Pages)

M. Lt. Philip AVERY RN, Meteorologist – FAI Precognition (2 Pages)


20 April 2000 APPENDIX A A 1

Appendix A

TRANSCRIPT

MEMO REFLECTING MOD VIEWS ON REFUSAL OF TEST PILOTS TO FLY CHINOOK

AT BOSCOMBE DOWN To PP 49 O?? ?6 / 686751 From Off ? as discussed

As to the allegations that some pilots refused to fly the Chinook HC Mk2 during CA Release trials at

Boscombe Down, this is an over simplification of what actually happened and perhaps it would be

helpful if some background was explained. On 7 March 1994 during one of the specified FADEC

checks on the ground, the engine of an HC2 Mk2 flamed out. Trials at Boscombe Down were halted

while the failure was investigated. The failure was not due to a software fault and flying resumed on

20 April. However in the period up to 2 June 1994 there were a number of incidents involving airborne

HC Mk2 of which approximately 5 were due to FADEC malfunction whilst operating in the normal

mode. There had also been other incidents on the ground. The MOD(PE) Projects Office sought

explanation of the various incidents from the aircraft and engine manufacturers but in the absence of

satisfactory explanations Boscombe Down suspended trials flying. The trials aircraft was transferred to

RAF Odiham for servicing and subsequently returned to Boscombe Down in mid October 1994. It was

subsequently fitted with instrumentation for the remaining flight trials which commenced in November

1994. The postponement of the trials at this time was therefore an expediency within the proper

exercise of airworthiness considerations by Boscombe Down and was not seen as a refusal by

individual test pilots to fly the Chinook HC Mk2.

End of Appendix A


20 April 2000 APPENDIX B B 1

Appendix B

DOUBLE DASH FAILURE

- The Differential Airspeed Hold (DASH) is an twin electro-mechanical device placed longitudinally in the Chinook pitch (fore and aft) control run. Its purpose is to provide the pilot with a ‘normal control feel' in pitch. Without the DASH, the pilot experiences `negative stick gradient'. Put simply, the stick (cyclic control) takes exaggerated and, at some speeds, contrary positions with increasing speed. The aircraft can be flown with the DASH switched off (by turning off the Automatic Flight Control System (AFCS)); however, this is normally done when the DASH is ‘centred’, that is, at its zero speed length. The operation of the DASH is not linear. It is at its shortest both at zero speed and at Velocity Never Exceed (VNE or 160 kts). It is at its longest at around 80 - 90 kts - A double DASH runaway in IMC is an emergency that has a severe effect on a pilot's ability to control the aircraft. It is difficult to diagnose quickly and accurately. At first it appears to be a failure

of the main attitude indicator (AI), the primary flying aid while in IMC; it then becomes apparent that there is a control malfunction. Without visual references it is entirely possible that pilot would be unable to prevent the aircraft from undergoing a series of major oscillations in pitch before he could regain full control. Each of these oscillations could involve massive height gain, or, critically, height loss. Indeed, one crew who experienced a similar control malfunction in 1989/90 (Dixon & Falvey), lost control of their Chinook completely and dropped over 1000 feet in a few seconds. They started in cloud in the RAF Odiham instrument circuit." (1500 feet AGL) and levelled out at very low level, just clear of cloud, almost crashing in the process. - The correct emergency action involves a test of the AFCS. Each of the two systems is switched off in turn to discover which, if any, is faulty. If this does not cure the problem: both are switched off In practice, this is easy when small perturbations are experienced; but when faced with sudden and dangerous partial control loss it is very difficult to do. Until you arc absolutely sure that it is an AFCS problem, you are naturally reluctant to switch off the very system that might be giving you a vestige of control. Equally, when violent oscillations occur, it is not easy to immediately focus on the AFCS. If the DASH malfunctions, the aircraft remains stable in roll and, most importantly, in yaw. This tends to point to far more ominous possibilities such as hydraulic actuator or even physical linkage failure. Furthermore, if the AFCS is switched off, a failed DASH remains unaffected; however, the subsequent loss of control in yaw (which can be extreme and very alarming) makes this action an exceptionally difficult one to undertake. This is especially true when faced with an emergency while in IMC and close to the ground. It is a rare, often unrehearsed emergency that cannot (for obvious reasons) be practised in a Chinook in cloud. The only demonstration of the DASH runaway that crews get is a rather tame and procedural exercise done during initial Chinook training. The demo is done in VMC, straight and level, with warning, and well clear of the ground. Its value, in terms of understanding the DASH, is further devalued since the student must also cope with AFCS-out flying.

End of Appendix B


20 April 2000 APPENDIX C C 1

Appendix C

FATAL ACCIDENT AND SUDDEN DEATHS INQUIRY (FAI)

PRECOGNITION OF "WITNESS J", PRIOR TO THE FAI

I am a Chinook pilot with 2900 hours flying experience, 2200 of

which is accounted for flying Boeing Vertol Chinook HC1and HC2

helicopters. I am presently serving ...

... at Royal Air Force Odiham. I have served on 7 Squadron for most

of the time since February 1985.

I knew both Flt Lt Tapper and Flt Lt Cook well, both

professionally and socially. I have read with some dissatisfaction

the findings of the board of inquiry into the crash of HC2 ZD576 on

the Mull of Kintyre on 02 June 1994. This document is a series of

considerations which arise as a result of that reading and which may

be of assistance in the subsequent inquiry in Scotland.

Approach to the Findings of the Board.

The board determined that there was 'insufficient evidence to

support a finding of negligence on the part of the Captain'. The

Board further concluded that 'no human failings could be attributed

to the co-pilot'. CO RAF Odiham then observed that there was

'insufficient evidence for a specific assessment of human failings',

but goes on to conclude that a captain is responsible for his

aircraft, the aircraft crashed, therefore the captain failed in his

responsibility. The logical leap from insufficient evidence to

guilty of negligence by default seems to be introduced at this point

in the document. This is further the simplest argument to undermine

in the inquiry and requires legal, not aviation, specialists to

demonstrate a basic failure of logic. The AOC then goes on to

contradict all that has passed before and arbitrarily decide that

the crew committed an error which was not 'an honest mistake made

while exercising the degree of skill expected of them' concluding

that both pilots were therefore 'negligent to a gross degree.' The



Board itself had concluded that the co-pilot would be acting on good

faith in response to the Captains navigation plan and was therefore

not responsible for the outcome. It is the accepted practice in

military, and I believe civil, aviation, that the Captain of an

aircraft is responsible for it, that his crew are there to assist

him toward that end: the co- pilot should not have been considered

responsible. The Captain would appear to be held responsible only on

the grounds that no other reasonable cause for the crash have been

determined. That is to say 'guilty because not proven innocent'.

Such an argument cannot hold up to legal examination anywhere

outside the armed forces.

The objective of the legal representatives should, therefore, be to

point out this simple failure of logic. If 'specialists' are

employed to attempt to demonstrate conclusively that another cause

existed then the debate could go on indefinitely for the following

reasons:

a. There are no true experts on the HC2 in operational service.

Those operating it still have an inadequate understanding of the

aircraft systems to be considered expert. The manufacturers do not

operate in a military context, under UK rules and environment.

b. The BIH simulator and Farnborough should be considered as no

more than a procedures trainer. Its flight characteristics represent

those of the aircraft only sufficiently to allow crews to conduct

procedural instrument flying and emergencies training in a familiar

cockpit. It does not 'fly like a Chinook' and the further it is

taken toward the edges of the flight envelope the less like the

actual aircraft it becomes.

c. By attempting to establish a probable cause the legal team

open themselves to a contrary response by 'experts' selected by the

RAF and Boeing Vertol. Thus the debate is prolonged. It is only

necessary to state that there exists the possibility of technical

malfunction. It is possible to demonstrate that a 'double dash

failure' incurred at the moment of introducing a cyclic climb to



abort into IMC could result in the configuration found at the crash

site. This can be done in the simulator with the limitations

discussed above.

d. Boeing Vertol have a vested interest in deterring any report

which leaves them liable. This company is well funded and has shown

a determination in the past to influence the outcome of inquiries.

When Wg Cdr M Pledger took command of 78 Sqn in the Falkland Islands

in Feb 88 I asked him to brief the Chinook Flight on the findings of

the BOI for the fatal crash which killed Flt Lts Moffat, Newman, Sgt

Johns and a number of engineering personnel, as this had not then

been published. As Chairman of the board of inquiry he briefed 2

findings: the first his own most probable cause (failure of a

hydraulic jack due to poor quality control at Boeing Vertol) and

then that which would actually be published due to the failure of

MOD to face pressure brought to bear by Boeing Vertol (cause

unknown). Wg Cdr Pledger is now Air Commodore M D Pledger OBE AFC

BSc, Air Officer Plans at HQ Strike Command, RAF High Wycombe.

The Pilots and Human Factors

The Board acknowledges that the planning for the sortie was fully

and professionally carried out, and yet once airborne the crew

lapsed to a suicidally negligent performance 18 minutes later. This

does not accord with my thorough knowledge of the crew, their

operating standards or their ability. It simply does not make sense.

The BOI makes reference to training records which indicate that the

pilots were noted as having a 'quiet and relaxed manner and lacking

assertiveness in a crew environment'. These were SF qualified

personnel, in all probability it was one of my reports that made

this observation (though I cannot verify this), reports made on them

in the normal reporting chain would undoubtedly have read 'good

throughout', in the SF environment a new assessment criteria is

introduced aimed to determine how they would react under exceptional

operating conditions (for example 200 miles inside hostile territory

with no immediate support or significant defensive weapons). In



short neither of these individuals was so 'quiet and relaxed' that

he would allow the other to fly him into a mountain. Nor was either

so inconsistent as to deteriorate from their normally extremely high

standard of operation within this 18 minute period. Flt Lt Cook and

I performed an abort from low~level at night and in very poor

weather during a Counter-terrorist exercise in the same aircraft (ZD

576) on May 20 1994, less than a month before the crash.

He was current and very capable in this procedure. Neither he nor

Flt Lt Tapper would have been so incompetent as to deliberately

attempt to abort from low-level with cruise speed, both, I am

absolutely certain, would have chosen to initiate a climb with the

cyclic stick, thus giving a high rate of climb and a commensurate

reduction in airspeed. I can only conclude that they did not because

they were in good meteorological conditions or were prevented from

doing so by a mechanical or instrumentation failure.

Flt Lt Tapper was the SF Flight Helicopter Tactics Instructor, as

such he was the acknowledged expert on electronic warfare, radios

and satellite navigation systems. As such he was fully aware of the

limitations of the RNS 252 system as fitted to the HC2. He would not

have used it as a sole navigation aid to avoid the Mull of Kintyre.

The co-pilot's intercom was selected to the pilots control box,

indicating that there had been a malfunction which would have added

to the crew workload in the period leading up to the accident.

PRESSURE TO MAKE A CONCLUSIVE REPORT

One question which has been repeatedly asked both inside and

outside the Service is 'Why did the BOI appear to be under so much

pressure to make a conclusive report out of such an inconclusive

inquiry?' Several possible answers are given below with commentary.

a. An Act of Terrorism. AIB Farnborough would have detected

such an act. Perpetrator would have publicised such a triumph.



b. Sabotage by UK personnel. The conspiracy theory runs that

persons within HMG sought the death of persons on board felt to be

obstructing the peace process. I would discount this" if for no

other reason than all involved parties were represented on board.

Such a massacre of ones own and the other organisation's men would

be an inefficient way of killing a specific party.

c. Commercial Pressure from Boeing Vertol to avoid litigation.

Such pressure would exist and most probably has been brought to bear

in the past.

d. Determination on the part of MOD to avoid legal and

financial liability. The 'loss of Crown Immunity' certainly had an

effect on a number of people throughout the RAF. Indeed it was the

focal point of a number of concerns expressed by aircrew in the

period leading up to the crash. Flt Lt Tapper himself had rung from

Northern Ireland to discuss the threat of personal liability

following an incident under investigation where he had been the

captain of an aircraft which caused minor injury to a woman at a

landing site. The impression given to crews at the time was that 'as

long as they were acting in good faith, to the best of their

ability, within the normal operating procedures' then the MOD would

stand by them. It is uncertain what the ramifications might be if a

crew were found to be negligent and, therefore, they, and not the

MOD, were responsible for the outcome of their actions: precisely

the position into which AOC 1 Gp placed these pilots.

e. Such a large loss of life, in peacetime, had to be

explained. The media and the public would not accept an inconclusive

BOI. As such it may bring into question the safety of the Chinook

(again, following its withdrawal from civil use in the UK). This

would significantly hamper flying operations and potentially bring

the Service into disrepute.

f. A conclusion was necessary to bring the BOI to an end or the

investigation could cause some embarrassment to those responsible

for conducting it. It has been suggested that the findings would



have been returned demanding further investigation had the BOI not

been conclusive. Indeed the report was delayed several times after

completion of the investigation as the resultant document was deemed

unacceptable. Precisely what was changed and by whom can only be

answered by the Chairman, Wg Cdr Pulford, CO RAF Odiham Gp Capt

Crawford or the AOC 1 Gp AVM Day. This further leads to the

suggestion that the RAF, or persons within it, were concerned that

further inquiry may bring into question the introduction to service

of the Chinook HC2. This is the major weakness which could have been

exposed by further investigation and would have an impact on AVM Day

and those within MOD Hels office who controlled the introduction of

the aircraft into service. Such concerns can only be conjectural,

but for those with an interest in such matters they are considered

below.

INTRODUCTION TO SERVICE OF THE CHINOOK HC2

It is interesting to consider the manner in which the HC2 was

introduced to service: that is to say without interruption to the

tasking in NI, with incomplete documentation and with no confidence

in the design having been expressed by AAEE at Boscombe Down.

Substantial numbers of apparently spurious faults were occurring in

the FADEC (engine control system), including incorrect engine

failure warnings, engines running down to close-down during after-

start checks and engines over-heating. Operational crews were given

a 4 day conversion course and 6 hours flying on the type. In the

case of the Captain of the crashed aircraft he then did not fly the

aircraft for a month until an HC2 was delivered to Aldergrove. The

following day the aircraft crashed.

Precedents for the introduction.

When the Harrier force upgraded from GR3 to GR5 the Squadrons were

down-graded from their role within NATO for 18 months to allow crews

to become mission capable on the new aircraft. The aircraft was held

to be sufficiently different to warrant a 6 week conversion course.



Delays were caused by the CA Release (the document which certifies

the aircraft for use). The upgrade from GR5 to GR7 was considered as

a software enhancement to the same aircraft, there was, therefore no

such interruption in the squadrons' tasking. Whether the HCl to HC2

upgrade is more akin that of the GR3 to GR5 or the latter upgrade is

open to debate. The contention is that: as the engine controls,

flight hydraulics and emergency procedures had all changed

significantly it is probably more akin the former change in the

Harrier fleet, but pressure to maintain the support to the Army was

such that it was introduced in an overhasty manner. The person best

placed to discuss the introduction of the HC2 into service is S02

Hels 2 in MOD, who acts as fleet manager. At the time it was Sqn Ldr

Dixon, now Wg Cdr C W Dixon MHF believed to be serving in DFD5 MOD.

Boscombe Down and the HC2.

The Rotary Wing test section at Boscombe Down remains in doubt as to

the suitability of the Chinook HC1 or HC2 to fly for sustained

periods at low-level. Indeed the doubts about the DASH system

(differential airspeed hold) are such that the aircraft GA release

states (CA Release Section H 1.1.6) 'prolonged cruising flight

should not take place at heights below 300 ft AGL unless it is

operationally essential to do so.' Notwithstanding this reservation

the aircraft is operated for sustained periods at low-level.

Doubts about the engine control systems were such at the time of the

accident on the Mull of Kintyre that Boscombe Down stopped flying

the HC2 as it was held to be 'unsafe' on June 3 1994 (the date is

reputedly coincidental). The HC2 was not flown again until 20

October 1994. During this period operational pilots on 7 and 18

Squadrons were ordered to continue flying the aircraft. It is

unprecedented that serious doubts by the test authority for an

aircraft type were ignored while the type continued to be flown. Sqn

Ldr Mark Prior of Rotary Wing Test Section A&AEE Boscombe Down was

on the unit at the time and would be well placed to discuss the

attitude of the airtest crews to the HC2 at the time. Wg Cdr M

Barter Officer Commanding 7 5guadron was the officer who briefed 7



Squadron on the order to continue flying. 7 It was presumably AVM

Day AOC 1 Gp who issued the order to continue flying.

Documentation for the HC2.

Documentation for the HC2 remains incomplete, though on June 2 1994

it was even less useful. The precise shortfalls at the time are

difficult to recall, but it would be possible to trace the issue

dates of amendments both to the Aircrew Manual (the document from

which flying crews derive their understanding of the aircraft) and

the Flight Reference Cards (the document used by crews in flight to

operate the aircraft). Crews at the time were using partially

photocopied and manually amended flight reference cards due to the

shortfall in issue.

The Aircrew Manual was substantially amended in November 1994. The

chapter dealing with the FADEC (engine control system) is

incomprehensible to aircrew operating the aircraft. There are

misleading sections in the chapter dealing with aircraft electrics.

The conversion course is taught on 27(R) Sgn, who teach new students

that there are 'good' and 'bad' chapters. It is arguable that there

should only be 'good' accurate, comprehensible material in the

manual. To date, Section 2, the Limitations section (which defines

the operating envelope of the aircraft) remains blank, in fact a

single page with 'to be issued' written upon it. The Flight

Reference Cards were re-issued in entirety in July 1994 as

understanding of the aircraft systems has evolved. Those in force in

Jun 94 were actually held to be so incorrect as to be contributory

to the number of engine malfunctions being observed. The flying

instructor on the Special Forces Flight responsible for teaching

such matters is Flt Lt Jonathan Burr, who has expressed reservations

about the state of both documents.

CONCLUSION

This document is by no means exhaustive, nor is it presented as

evidence, but is rather intended to present a personal perspective



on the crash and subsequent inquiry, from which evidence may be

derived to support a proposed line of inquiry. There is no doubt in

my mind that the findings of the RAF Board, or rather the judgement

passed by AOC 1 Gp on the basis of those findings, were entirely

unjust, representing poor legal practice and a casual disregard for

the ability, reputation and welfare of subordinates and their

dependants within the armed forces.

End of Appendix C (Precognition of Witness J)


20 April 2000 Report APPENDIX D D 1

Appendix D

EXTRACTS FROM FLIGHTFAX

US ARMY AVIATION RISK-MANAGEMENT INFORMATION December 1998 – Volume 26 – Issue No.15

WITH PARTICULAR REFERENCE TO

UNCOMMANDED FLIGHT CONTROL MOVEMENTS (UFCM) AND

WATER INGRESS CORROSION INDUCED ELECTRICAL MALFUNCTIONS

SPOTLIGHT: CH-47 SAFETY PERFORMANCE REVIEW

A look at the issues

Uncommanded flight-control inputs The May 1998 issue of Flightfax contained the first-person accounts of the crew of a CH-47 that did a barrel roll. As a result of that incident, Aviation Safety Action Message CH-47-98-ASAM-0l (151327Z Oct 98) requested information from users on uncommanded control inputs. Input from users confirmed that this was not the only incident of uncornmanded flight-control input experienced in the CH-47 community in the last several years. According to the Analytical Investigation Branch at Corpus Christi Army Depot, 21 activities responded to the ASAM, reporting 27 A\FCS/electrical malfunctions, 4 hydraulic related malfunctions, 4 unknown causes, and 3 suspected ice-and-water contamination incidents. Following are some examples.

• While in cruise flight at 10,000 feet msl and 126 KIAS, the aircraft experienced an uncommanded pitch down of 20 to 25 degrees. When the PC applied aft cyclic,

the aircraft pitched up then down before the PC regained control. The aircraft lost 500 to 1,000 feet of altitude during the sequence. When there were no additional problems, the crew elected to continue flight to their destination; they flew another 2 hours without further incident. It was later determined that the incident was caused by failure of the pitch axis portion of the AFCS. It is suspected that, during the sequence, excessive control inputs resulting in failure of the shock-absorber mounts.

• During flight-control check, the crew experienced control binding, with the cyclic limited to 4 inches forward movement and l.5 inches lateral movement. The crew chief stated that the forward head was moving while the aft head was stationary. Pressure was in normal ranges, and the problem persisted for 5 minutes. The situation could not be duplicated by maintenance, but an actuator problem was suspected.

UPDATE

Last year a CH-47 miraculously returned to a wheels down attitude at250 feet agl after rolling 360 degrees in flight. The Army Safety Center, CCAD Investigative Analysis Unit, AMCOM, and Boeing continue to monior and evaluate all CH 47 flight-control anomalies to determine the cause of the

incident. Following is a recap of ongoing actions :

• AMCOM's Systems Engineering Department and CH-47 PEO/PM are currently preparing an ASAM that addresses findings, recommendations, and corrective actions developed to date.



• A dehydrator will be issued in the near future to remove contaminants from flight hydraulic systems.

• All chrome plated aluminum end caps on servo cylinders will be removed and replaced with chrome plated stainless steel end caps.

• Several operational controls will be implemented to enhance early detection of flight control lockup.

• By the book maintenance is: being emphasized. For example, mechanics must ensure- that all hydraulic lines or components are capped and plugged as soon they are. disconnected; all previously used or leftover hydraulic containers must be disposed of; ;and all hydraulic components received from the supply system must be drained properly.

- MSG Ruben Burgos; Aviation Systems & Investigation Division. DSN:558-3703 [334- 255-3703]; [email protected]

Analysis indicates that the top three areas that require attention are engines, electrical

systems, and flight-related incidents (mostly inadvertent cargo release).

Engines

Engine problems accounted for nearly a fourth of all Chinook mishaps during FY98. The areas that most need attention are the torque-metering system and the power controls. The, Chinook community is anxiously waiting the fielding .of the T55-GA-714A engine which will bring improvements to all areas of the power plant, including the fuel authority digital electronic control (FADEC) system. The T55- GA-714A has proved itself on special-operations aircraft, where it drastically reduced the number of engine-related accidents. Electrical systems

The one Class A accident attributed to the electrical system during the past 5 years accounted for five fatalities. Electrical-system problems also accounted for 36 Class E mishaps during the period. CH-47-97-ASAM-07 (141323Z Apr 97) outlined measures to reduce the possibility of electrical-power loss. Consideration also is being given to introducing an improved circuit-breaker panel for the improved cargo helicopter (ICH) and current models. Further, Boeing has recommended several options to reduce water entry into the electrical system, which is also a source of H-47 electrical problems.

Flight-related incidents Inadvertent release of external loads accounts for a relatively large number of H-47 accidents. Analysis shows that the majority of these accidents are attributable to flight-crew actions and that most of them occur during hover or transitional flight. Table 2. Inadvertent-cargo-release mishaps

FY A B C D Injuries Total cost

96 0 0 5 5 2 $ 274,631

97 0 1 3 0 1 781,039

98 0 1 7 2 4 311,907

Total 0 2 15 7 7 $1,367,577

The relatively high number of mishaps helped determine that improvements are needed. Removing the human element from a system through engineering improvement is always the preferred solution.. Operational controls are a good short-term solution, but engineering controls will bring forth long-term results. The external-load-control grip on the flight-engineer station is not only next to but is identical to the press-to-talk button. With the added factors of no illumination and heavy workload, crews are inadvertently releasing loads. In some cases, loads are released when



the control grip is accidentally bumped or dropped. A few years ago, a modification work order (MWO) was introduced to recess the cargo-release button to prevent accidental release of loads. However that MWO did not solve the problem. Some believe that the MWO does not protect the button from being activated. It is evident that we are dropping cargo due to a design flaw. There are operational controls to prevent this from happening, such as not using the control grip for communication. However operational controls cannot guarantee that this won't happen again. So, the program managers are considering replacing the current switch with a covered switch that can be activated only by flipping the cover to expose the switch. Many of these incidents occur during night and/or NVG operations. One cannot prevent inadvertentactivation of the cargo-release switch when feeling to locate the right button to push. Sometimes one can inadvertently activate the switch when trying to locate the control grip itself. The Program Manager is considering requiring that the Flight Engineer School stress the correct procedure as an interim control. This would require that the flight engineer stay away from the control grip during flight and reach for the control grip only when release of the load is desired. Several months ago, Fort Bragg's l 8th Airborne Corps Safety Office was notified of an unusual finding that proved to trigger inadvertent cargo release. Following is a synopsis:

Hazard: Corrosion on the cargo-hook emergency- release switch can cause inadvertent jettison of external loads on C/MH-47D/E helicopters Description: A CH-47 unit found corrosion on the overhead control panel for the "cargo hook emergency release all switch." Improper installation of three connectors (2 on pin 5,1 on pin 6) leaves a paper-thin gap between connections on pins 5 and 6. Corrosion buildup on these two pins allows for a path of electrical conduction, needing only a single drop of water to complete the circuit. A detailed review of TM. 55-7 520-240 T3, page 16-2.8, confirmed that all three cargo hooks will open if the electrical connection between pins 5 and 6 of the cargo-hook emergency-release switch is shunted. Corrosion in this control panel exists in varying degrees across the unit fleet. It is a fact of life that moisture is going to ; get into these areas, either from rain or condensation. Improperly applied corrosion preventing compound (CPC) can contribute to the problem as well. Control measures:

• Perform a visual inspection of the overhead control switches for possible corrosion and correct installation stack-up.

• Correctly apply CPC in accordance with TM 1-1500-344-23, paragraph 3-7 and table 3-5, or TM 55-1520-240-23-2, task 2-374. Proper use of MIL-C-81309 Type II CPC normally requires a follow-up coat of additional CPC.

-MSG Ruben Burgos, Aviation Systems & Investigation Division, DSN 558-3703 [334-255-3703], [email protected]



A look at the mishaps

Class D

• While attempting to lift to a hover during slope operations, the SP noted control binding. When the other pilot tried his controls, he got the same outcome. They found no binding when they checked the cyclic boot, so they shut down the aircraft. Maintenance could not duplicate the problem, and the aircraft was released for flight. Several weeks later, another IP was flying the aircraft when it experienced severe vibrations to the point that cockpit instruments could not be read. The crew conducted an emergency shutdown without further damage. Transmission problems were suspected.

• While conducting a flight-control check during run-up, the crew experienced control binding, grinding noise was heard in the forward transmission, and the forward blade bounced up 6 inches. This event occurred primarily when the cyclic was in the full right position and the crew was moving the cyclic from full forward back through the 4-inch forward to neutral position. Further examination revealed the lower part of the swashplate would make a bouncing movement, accompanied by a loud popping sound. No control stops were reached during movement, and the anomaly was repeatable. When the forward swiveling actuator was replaced, the problem could not be duplicated, so the aircraft was released for flight.

• While transitioning through an airfield corridor at 700 feet agl and 100 KIAS, the aircraft began uncommanded left and right yaws starting at 5 degrees and increasing to 15 degrees. When the aircraft reached a 15-degree left bank, the PC applied ri5ht pedal and started a left,10-degree bank to set up for landing. As pressure was applied, both pedal and cyclic froze in a left-bank attitude. Airspeed dissipated to zero; the crew

described the aircraft's reaction as similar to that of a Huey with hydraulics off. The thrust was functioning, and, suddenly, all controls were free and functioning properly. As the crew set up for landing, the aircraft began to yaw again, and cyclic and pedals froze. At 100 feet agl, the controls released and functioned properly and the crew executed a roll-on landing. Everything was working properly, so the crew began a normal shutdown. Three steps into the checklist, the aircraft began to vibrate to the point that the gauges were unreadable, and things were flying around in the cockpit. The crew conducted an emergency shutdown as the aircraft continued to vibrate violently. A CH-47 maintenance officer witnessed the shutdown, and reported that the rotor system looked as though the pedal were displaced. After shutdown, the aft pivoting actuator was excessively hot, and the No. 1 jam indicator was popped.

Cooling fan drive shaft The Chinook community has been experiencing problems with the oil cooler fan shaft in the combining transmission area. Safety-of-flight message CH-47-98-SOF-02 (161231Z Jul 98) imposed flight restrictions, additional preflight-inspection procedures, and a recurring inspection every 4 flight hours. These requirements remain in effect, and all personnel should review the message to ensure that it is being complied with. Let's take a look at a couple of the incidents that led to release of this SOF message.

• During taxi for takeoff, the IP noticed illumination of master caution with associated transmission hot capsule. After isolating the problem to the No.1 engine transmission, the IP immediately performed emergency shutdown of both engines. Postflight inspection revealed a severed transmission cooling fan drive



shaft and metal flakes on the combining transmission filter.

• No.1 engine transmission oil temperature rose rapidly through 130oC. When power was reduced, the temperature was passing 140oC. An emergency engine shutdown was completed with the temperature peaking at 145oC. At shutdown, the No.2

engine and combining transmission oil temperatures were l20oC and rising. Maintenance found the combining transmission cooling fan shaft was sheared.

-CW4 Keith B. Freitag, Aviation Systems & Investigation Division DSN 558-3262 [334-255-3262]. [email protected]

A look at the numbers

Y98 was a good year for the Chinook community. We had no Class A accidents - and, therefore, no fatalities (for the second year in a row), 3 Class B, l6 Class C, 3 Class D, 116 Class E, and 1 Class E Damage costs totaled $1,887,015 and injury cost was $24,631, for a total cost of $1,911,646.

Table 1. CH-47 accident experience FY A B C D E Fatalities Total cost

94 2 2 8 21 242 5 28,045,061

95 2 0 7 8 218 6 18,971,713

96 2 0 15 9 192 6 36,151,899

97 1 3 11 3 182 0 13,936,699

98 0 3 16 3 116 0 1,911,646

Total 7 8 57 44 950 16 $99,017,018

February 1999 - Extracts From FLIGHTFAX - Aviation Messages Recap of selected aviation safety-action messages

CH-47-99-ASAM-02, 161228Z

Feb 99, maintenance mandatory

Investigation of incidents of

uncommmanded manoeuvres or flight-

control lockup in flight have identified

factors that may have contributed. These factors include contamination of hydraulic fluid internal parts out of tolerance, corrosion on internal parts, high barium content in preservative hydraulic fluids, hands off flying and internal FOD created by wear of aluminum parts. Flight simulators demonstrated that when such factors are present and actual hands on flying is not being observed, aircraft may perform uncommanded movements with a slow degradation in flight capabilities. However, computer simulation is not sophisticated enough to produce the exact manoeuvres of the incident aircraft, therefore, no absolute cause –and –effect relationship has been established. The purpose of this message is to eliminate known deficiencies that have been identified as suspect causes of

uncommanded manoeuvres or flight control lockups. AMCOM contact: Mr Robert Brock, DSN 788-8632 [256-842-8632] [email protected] CH-47-99-ASAM-03, 241820Z Feb 99, maintenance mandatory

Investigations have discovered

hoist/cargo panels with chafed wires and

corrosion in the terminal plugs. These

conditions could cause electrical

shorting and inadvertent jettison of external cargo. The purpose of this message is to require a one time inspection of the hoist cargo control panel for corrosion, wire routing, and wire positioning, on terminal lugs. An

inspection for water intrusion will also

be performed. In addition, the message establishes a 200/300 hour recurring inspection during phase. AMCOM contact: Mr Robert Brock,DSN 788-8632 [256-842-8632] [email protected]

End of Appendix D


20 April 2000 Report APPENDIX E E 1

APPENDIX E

FAX MESSAGE

To: David Harrison From: Tony Collins

Home

Fax: 01818707389 Tel: 01273-230327 Fax: 01273-779510 Number of pages (including coversheet) : 2 Date: ---- 10/06/99 13:19 David: This is article Malone (US) wrote in 1997, two years before Boeing settled after families claimed that technical malfunction caused the crash. Note in Malone's copy the phrase..." the collateral investigation found that the MH-47E was operating with normal AC electrical power at the time of the crash." The MH-47E is the US special operations equivalent of the Chinook Mk2 although there are differences i.e., the MH-47E has different electronic warfare equipment and more powerful engine but has a FADEC system. regards, Tony..



INITIAL REPORT OF ACCIDENT TO US ARMY CHINOOK MH-47E HELICOPTER SUSPECTED WATER INGRESS CAUSING ELECTRICAL MALFUNCTION INDUCED

LOSS OF CONTROL LEADING TO FATAL CRASH

12-7-97 By Malone Twenty months after a $26 million Army MH-47E; Chinook helicopter crashed into a Logan County field killing all five airmen board, a report has been released saying the cause of the accident is undetermined. Records that Army Safety Center has previously released show the crew was carrying on a normal conversation when the chopper disappeared from radar screens about 4 a.m. while on a routine training mission. Those records also show that a waiver was obtained to allow a student pilot to fly the aircraft, which had encountered blustery snow squalls predicted for that morning. A collateral investigation conducted by the 160th Special Operations Aviation Regiment, which is headquartered under the Army's Special Operations Command at Fort Bragg, N.C., has chosen not to blame anyone or anything for the March 8,1996 mishap, which incinerated almost all the wreckage. "The board finds the facts available in the accident do not identify the cause," said the report signed by Warrant Officers Terry Sahlin and Ronald Corley and Major Jay R. Jones. But the board did question whether student pilots "should occupy a crew station in an advanced aircraft." It also called for written standards for aborting pilot assessment missions because of weather and "recommend prohibition of (assessment) flights into forecast or known instrument meteorological conditions." The panel also recommended the adoption of advanced flight data recorder technology for aircraft on similar missions. Some rudimentary flight data collection equipment was aboard the Chinook but investigators were unable to retrieve the information after the crash. The Army report said the mission required a senior pilot, Walter Fox, to perform a night vision goggle flight evaluation of two different pilots. Fox had evaluated the first pilot, who had flown and exited the aircraft when it returned to Fort Campbell. There he picked up the second pilot, William R. Monty, Jr. Though earlier records have mentioned that water leaking into Chinooks has caused shorting in electrical power distribution panels, the collateral investigation found that the MH-47E "was operating with normal AC electrical power at the time of the crash." The report discounted as false alarms two warning lights which flashed during the aircraft's initial flight that evening. The Army panel concluded that weather was not the cause because the conditions were within the aircraft's all-weather capabilities, and "in the absence of a surviving crew member and any related facts" the board does not support human factors as a cause for this accident. End =



FOLLOW-UP REPORT OF ACCIDENT TO US ARMY CHINOOK MH-47E HELICOPTER SUSPECTED WATER INGRESS CAUSED ELECTRICAL MALFUNCTION INDUCED

LOSS OF CONTROL By Malone A heavily censored Army Safety Center report into the investigation of an MH-47 helicopter that crashed during a snowstorm in Logan County 15 months ago killing five airmen cites a string of electrical problems in the twin rotor transports that apparently

were caused by water leaking through seals.

But Army investigators from Fort Rucker, Ala., last fall in an in-house publication had attributed the likely cause of the last March 7, 1996 crash as pilot error. Student pilot William R. Monty Jr. from Fort Jackson, S.C., had not flown in the previous 18 months and had only logged 1.5 hours in an MH-47E, the all-weather version of the Army's "Chinook" workhorse. Monty was allowed to fly through an "approved waiver" during an "assessment" to determine if he would be accepted to the elite 160th Special Operations Aviation Regiment which has units based at Campbell Arm Airfield. The report also said Monty was not current in either night vision or instrument flying when he left Fort Campbell earlier that evening on the training flight to Fort Knox. Monty had tried to join the 160th in 1991 but was turned down for lack of experience. In its lengthy findings issued yesterday, Army investigators said the aircraft plunged from 3,300 feet during a turn as it was positioning itself for a runway approach about 25 miles from Fort Campbell (Kentucky) in heavy snow. The Army's last communication with the chopper was an acknowledgement of an air traffic controller's instruction to enter a turn just before I 0 p.m. Safety investigators determined that the aircraft had crashed after entering a steep banking turn from which it could not recover. Eyewitnesses in the area said at the time it looked as if the pilot was attempting to land before the crash and they heard reports of engines or gears "grinding" and "cutting out." But investigators who inspected the charred engines found them normal. After the accident, records show the Army produced two "product quality deficiency reports" involving the failure of $76 circuit breakers in the MH-47E. Mechanics reported one breaker that controlled among other things, de-icing equipment, "popped" before the fatal mission and was reset. The other fault caused a fire in a similar aircraft hovering over the Atlantic Ocean in mid-1996. It landed safely. But the Army's findings and conclusions about what if any impact the component had on the fatal crash the breaker were censored. However, the report mentions that "there was no radio contact with the crew to indicate an emergency situation." Army special operations command spokesman Major Andy Lucas at Fort Bragg said he was not familiar with the report and could not comment on it.



According to Army records, the Army later that summer discovered water was seeping through a faulty seal and into the aircraft's main electrical distribution panels. Boeing, the aircraft's builder, last December dispatched teams to Fort Campbell to "investigate water intrusion into the cockpit' of MH-47 choppers. And one of the recommendations from that inspection was to "configure the aircraft's electrical system so that a single fault cannot cause a complete failure of the electrical system." A Boeing field service report dated June 16, 1996 investigating an MH-47 cockpit

electrical fire notes "this is the third incident... of water causing smoke or fire in the

power distribution panel." Boeing later advised the Army to spray the $27 million helicopters with water hoses to check for leaks.

End =

Also see Pages 5 and 6 of this Appendix (E)



FLIGHT FAX – JANUARY 1998 COPY OF AN ARTICLE

LOSS OF CONTROL CAUSED BY ELECTRIC SYSTEM FAILURE

Combined Effort identifies

PDP Problems in Chinook

A Chinook crashed and burned, leaving no survivors to interview, no witnesses to question, and little wreckage to examine. What little evidence that was available at the time pointed to human error as the primary cause of the accident. However, uncertainty persisted and the investigation continued. The combined efforts of the accident unit AMCOM, Boeing and the Army Safety Centre ultimately uncovered information that shifted the focus of the investigation from human error to materiel failure.

Accident Review

The Chinook was on the return leg of an NVG navigation flight The crew was operating in VMC when the SP requested an lFR clearance to 4000 feet msl. His intent was to return to the home airfield via the ILS approach. He did not request a weather update when he filed for the lFR clearance. Weather forecast prior to the flight included a scattered cloud layer at 1000 feet, broken at 2300, overcast at 4900, and forecast moderate icing from 2000 to 10,000 feet.

Approximately 18 minutes after granting the IFR clearance, approach control directed the crew to make a 15 degree turn right turn for a vector to intercept the ILS approach course. During the turn, the radar controller noted that the aircraft had tightened its turn radius and passed through its assigned heading. Moments later, radar contact with the aircraft was lost, and it was quickly established that the aircraft had crashed and burned.

The investigation

At the time of the accident, all available evidence indicated that the primary cause of the accident was human error from the part of the SP and PI. Since then, additional information became available and the focus shifted to a suspected materiel failure. This new evidence led to

the conclusion that the most probable

cause of the accident was an electrical

power failure that caused loss of aircraft

control.

Let’s look at the evidence From October 1992 to June 1996, seven

Chinooks experienced varying degrees

of electrical power failure. It was determined that heavy precipitation, aircraft washing, or extended overwater operations can result in water leaking into the cockpit area and entering the a.c. auxiliary power distribution panels (PDPs). When this happens, the water can cause the circuit breaker “bus ties” to short, resulting in either partial or complete power loss to both primary and standby flight instruments. While it’s impossible to know for sure that such a power failure occurred in the accident aircraft, that is a reasonable conclusion. Complete power loss to the cockpit of the Chinook can result in the loss of all primary and standby instruments, the advanced flight control system (AFCS) and all avionics except the transponder and FM and SATCOM radios. It is reasonable to conclude that such circumstances would have made it



impossible for the crew to maintain aircraft control. In summary, it is now suspected that the crew was conducting a standard rate right turn when a power loss occurred, resulting in the lossof , at minimum, the primary flight instruments and the AFCS, With no visible horizon, it is probable that the pilot quickly became disoriented and the aircraft entered an unusual attitude that the crew was unable to recover from.

Lessons learned

Hazard: Water can enter the PDPs. Once it does, it deposits dirt and salt deposits on the contacts, which creates a good conductor. At some point, the electrical connections short out, causing the system to overload and the malfunction displays to all go blank. Controls: Changes have been initiated to protect the PDPs from water intrusion by either channelling water away from pilots’ doors and windows or designing and

installing a cover for the PDPs and circuit breakers. In addition, crews should inspect the PDPs and circuit breakers for corrosion on a regular basis and more often during periods of prolonged heavy precipitation and after aircraft washing.

Hazard: The “improved” generator control units (CCUs) currently installed on some Chinooks do not allow the PDP bus ties to operate as designed. As a result, both generators will be taken off line the CCU can isolate the electrical fault.

Control: A circuit breaker has been identified that will work with the current CCU to allow for redundancy within the electrical system as designed.

USASC POCS: MAJ Harry Trumbull;

Chief Operations Branch: DSN 558

2539 (334-255-2539); trumbull@safety-

emh1.army.mil or CW4 Keith Freitag;

Aviatlon Systems and Investigations

Branch; DSN 558-3262 (334-255-3262);

[email protected] :

End of article from Flightfax January 1998

FROM FLIGHTFAX – DECEMBER 1998

Electrical Systems.

The one class A accident attributed to the electrical system during the past 5 years accounted for 5 fatalities. Electrical system problems also accounted for 36 Class E mishaps during the period. CH-47-97-ASAM-07 (141323Z Apr 97) outlined measures to reduce the possibility of electrical power loss. Consideration also is being given to introducing an improved circuit breaker panel for the

improved cargo helicopter (ICH) and current models. Further, Boeing has recommended

several options to reduce water entry into the electrical problems.

End of Appendix E


20 April 2000 APPENDIX F F 1

Appendix F

End of Appendix F


20 April 2000 APPENDIX G G 1

Appendix G

You wrote to me on 12 February enclosing a copy of a letter

you had written to the Editor of Flight International regarding

the Mull of Kintyre Chinook accident. I know that you have also

taken up with Lord Williams of Elvel your concerns regarding the

findings of the Board of Inquiry and he has passed your letter for

comment to the Parliamentary Under-Secretary of State for Defence,

the Lord Howe.

The Lord Howe has written a detailed reply to your points

which I understand Lord Williams will pass to you. I will not

therefore reiterate his comments, with which I fully agree. I

would only confirm that the Board of Inquiry was a most thorough

investigation which looked carefully at all aspects of the crash

and which involved the close cooperation of the Aircraft Accidents

Investigation Board. The conclusion of the Board was not reached

lightly - the implications for the aircrew and their relatives was

fully appreciated. But having carefully considered all the

evidence, the officers involved (who have considerable experience

of such matters) were left in no doubt that aircrew negligence was

the cause of the crash. This is a conclusion that I fully

support, painful though it is for all those affected and not least

for the Service to which they belonged.

This was a tragic accident over which inevitably and

understandably much emotion has been generated. As a former

pilot, I am sure you recognise the importance of total objectivity

being brought to bear in the investigation and analysis of the

accident so that others might learn any lessons arising, however

unpalatable.

End of Appendix G


20 April 2000 APPENDIX H H 1

Appendix H

Scottish Civil Fatal Accidents Inquiry (FAI) – Day 3

Copy of statements made by Sergeant J R COLE RAF, Air Loadmaster,

when cross-examined by Aidan O’Neill on behalf of the Tapper Family

(Extract from FAI proceedings transcript - Pages 318 to 322 refer)

318

And in terms of maintaining a lookout,

would that include checking for weather conditions

and visibility problems ? - Yes. Everybody that

was on board the aircraft would be maintaining a

personal watch on weather around the aircraft,

looking out for obstructions or other aircraft. which

may impinge upon its safe flight.

Did you yourself see any of the non-

flying aircrew, Messrs, Forbes or Hardie, making any

navigational preparations in relation to this flight

and navigation? - Yes, Master Air Loadmaster

Forbes was preparing a 1 to 1/2 million scale map of

the route, which was a copy of the pilot's.

What was that? - He had copied down

from the pilot's master map the intended route.

had then put track lines -- he had tracked on

between various turning points on> the route. He

would then append his own distance markers, the

heading the aircraft would be flying on, any

obstructions and any Notices to Airmen -- Notam --

any industrial complexes, any area sensitive to

noise pollution, can apply to have an "avoid" put on

it, and it is then put on a Notam, which requires

crews to avoid it by set parameters.

So you say Master Air Loadmaster Forbes

had/


20 April 2000 Report APPENDIX H H 2

319

had an exact copy of the route map for the Inverness

flight, and was appending further information on

that map? - Yes.

Why would he be doing that? - As a

back-up to the navigator pilot. If for instance

the non-handling pilot was required to make a radio

call in circumstances which required navigational

assistance, he would then hand on responsibility to

the crewman with a map, who would take over for a

short period the navigation of the aircraft.

Would he also be assisting in the

navigation when the non-handling pilot was available

for navigation as well? Would there be two

navigators? - Yes, he would continuously monitor

the progress of the aircraft along the track line.

Was Master Air Loadmaster Forbes

experienced in this kind of role? - Yes, he was the

most experienced Special Forces crewman at that

time, and had been carrying out his duties for many

years, and was very highly regarded as a very

professional operator.

Was he in fact the crewman leader? -

Yes, he was.

I just want to put a statement to you,

and I was wondering if you could tell me how

accurate/



320

accurate or otherwise it might be. Master Air

Loadmaster Forbes and Sergeant Hardie were probably

stationed in the aircraft's cabin during the oversea

transit in poor weather, I accept that they were

not in a position to offer much useful navigational

input to the pilots. They would have had no

external visual references, and responsibility for

navigation lay with the Captain, As crewmen on a

straightforward transit, they would legitimately

have been occupied with the passengers". That is

the statement? - I would have to disagree with

parts of that statement.

Which parts would you disagree with?-

The references to the lack of reference and visual

clearance and the ability to navigate.

On a flight such as the flight to

Inverness would the crewmen's primary

responsibility, in particular Master Air Loadmaster

Forbes, have been particularly with regard to this

back-up navigation or occupying himself with the

passengers? - Due to the fact there are two crewmen

carried within the cabin it is easy for the No. 2 to

allow the other crewman to concentrate on looking

after the passengers while he takes more interest in

the navigation and the operation in the cockpit of

the/



321

the aircraft.

MR. 0'NEILL: The statement I have

narrated is from the report of the Board of Inquiry,

a comment by Air Marshall Day, and it is contained

in Part 4, page 2 of the Board of Inquiry Report

into the incident

MR. DUNLOP: My lord, I would object

this line of evidence. I am not sure where it is

going, but I suspect from my learned friend's

comments yesterday the line is clear in that

context, because my learned friend yesterday was at

pains to point out he was entering upon issues of

negligence. Of course, no debate was entered into

upon that at that time.

Now, my lord, in my respectful submission

this Inquiry is not here to Carry out an examination

of the Board of Inquiry procedure, how they went.

about it or the conclusions that that Inquiry

reached: this Inquiry is an Inquiry within the

terms of an Act of Parliament, and the Board of

Inquiry Report no more than puts the structural

framework which enables the factual background to be

established which forms the starting point in a

sense for witnesses to be able to give their

evidence.

My/



322

My lord, I apprehend that my learned

friend is embarking upon a critique of the

conclusions reached by other people. The

conclusions reached by other people are nothing in

my respectful submission to do with this Inquiry,

and therefore I would object to the line my learned

friend is embarking upon.

SHERIFF YOUNG: Mr. 0'Neill?

MR. 0 ' NEILL : I have no further

questions on this matter for this witness, my lord.

SHERIFF YOUNG: That takes care of the

point. However, I have noted in general terms what

Mr. Dunlop has said.

MR. 0'NEILL: If the objection is raised

again perhaps it could be dealt with: but the

objection is to the question, and there is no

further line on this.

...

[End of FAI proceedings transcript extract copy]

End of Appendix H


20 April 2000 APPENDIX I I 1

Appendix I

HOUSE OF LORDS DEBATE - 1 NOVEMBER 1999

RE-TYPED IN THE STYLE OF THE HANSARD TRANSCRIPT EXTRACT

FOR EASE OF LEGIBILITY (Page 651 refers)

Chinook Helicopter ZD576 [LORDS] Chinook Helicopter ZD576 [LORD FITT] ...

... terms that before the crash took place he knew there as something wrong either with the pilots or the aircraft. I met scores of people and no one -not a single one- is prepared to blame the pilots. Not a single widow of the 28 men killed is prepared to place the blame on the pilots. The fact is that there is no proof that the pilots were guilty of negligence. There is no certainty of a misdirection of their activities. I believe that

rather than have an inquiry we should allay

the grief of all the victims' families and that

this verdict should be set aside. [See Note 1] 8.26 p.m. Lord Trefgarne: My Lords, I do not know what happened to the RAF helicopter which is the subject of tonight's Question. However, I do know that the RAF inquiry procedures, which were in place in the late 1980s when I had some responsibilities for these matters, were less than wholly satisfactory. At that time, an inquiry was caused to be made into those procedures by Mr Tench, the lately retired inspector of civil aircraft accidents, and he was, frankly, very critical of the RAF inspection investigation procedures. I know that the noble and gallant Lord, Lord Craig, who was in a senior RAF position at that time, does not agree and I apologies for disagreeing with him now. However, the fact is that at that time the procedures were heavily criticised. Those Self same procedures were applied, with only few modifications, to the investigation of this accident. Therefore, I must agree with my noble friend Lord Chalfont that a further inquiry ought to be made. I believe that the present

conclusions are unsound. [See Note 2] 8.27 p.m. Lord Jacobs: My Lords. I thank the noble Lord, Lord Chalfont, for bringing forward the debate. I am of a cynical disposition and two years in this House has not changed that. The

idea of persuading a department of government, or the Government themselves, to go back on a decision fills me with foreboding. However in this case, I cannot believe that, if the Minister were given time to read the majority of the report, rather than the informed briefings she has no doubt received, she could not fail to recognise the imperative for reopening the inquiry in the cause of justice. Helicopters are not like aeroplanes, ships or trains. The risk profile of helicopters is very high. The commercial judgement of insurance companies gives the game away. To insure a £1 million value of an aeroplane might cost £10,000 a year. To insure a œ1 million value of a helicopter might cost as much as £120,000 a year. That says a lot about the lack of reliability of helicopters generally. The Chinooks had neither a cockpit voice recorder nor a flight data recorder. The Ministry of Defence has been criticised for such omissions. The MoD was committed to fitting FDRs by 1995 following a report made in the late 1980s. Yet, surprisingly, by 1994 they were still not fitted. There is a desperate human need to find a cause for every accident. The absence of any evidence of technical malfunction presents a serious problem. But in the UK there were nine serious accidents involving RAF Chinooks between 1984 and 1994 -nine! In five of them, the pilots lived to explain what happened and in none of the cases was any blame attributed to the air crew. The same could not be said of the remaining four accidents, all of which were fatal. Three of the four were put down to air crew, error. Clearly, if one wants to maintain one's reputation one must survive. What if there is little or no evidence? I understand that those with a legal background have taken an interest in this matter, and that there is a strong body of opinion that the evidence was insufficient to satisfy the high standard of proof which the RAF's own regulations require before a finding of


20 April 2000 APPENDIX I I 2

negligence can be made. I believe that in this

inquiry an honest mistake was made.

The best reason for reopening this inquiry is new evidence. There is indeed serious new evidence. Four years after the accident, a Chinook helicopter came tumbling out of the sky. The air crew tried desperately to turn it the right way up, but failed to do so and could find no evidence of any malfunction of the instruments. [See Note 3] Miraculously, 250 feet above the ground, the Chinook aircraft turned around and the crew and everyone on board were saved. Obviously, the Chinook was examined in great detail afterwards, and it must be stated that no fault was found with the helicopter. Therefore that is proof conclusive that a helicopter of this particular manufacture can develop faults which cause it virtually to crash and subsequently no fault is found with the helicopter. In this case, that may well have happened. On the evidence available, one

cannot but conclude that there is no proof

that the pilots were negligent. ]See note 2]

8.32 p.m. Lord Burnham: My, Lords, at the time of the crash, visibility over the MuII of Kintyre was

less than a mile. If visibility is less than five miles, the regulations state that aircraft must fly under instrument flight rules, which means that they, must be a thousand feet above the nearest obstacle. In this case, that would have meant two-and-a-half thousand feet. The pilots were clearly not doing so, and it is to be assumed that the finding of the RAF court of inquiry was based on those facts. [See Note 3] The merest yachtsman - of which I am one, but much more to the point, so too is the noble Lord, Lord Ruthcavan.- who has sailed round the Mull knows how treacherous the conditions are and how bad the visibility is liable to be. The noble Lord raised a number of

interesting points. I have a feeling that his

remark to your Lordships tonight in

themselves justify a reopening of the inquiry

because there is a lot there. [See note 4]

In a debate in May 1991 in your Lordships' House, the noble and gallant Lord, Lord Craig pointed out that the civil air accident investigation branch had ... (End of page 651 - Hansard Lords’ report for 1 November 1999)

Note 1 Lord Fitt believes that the verdict (of gross negligence) should be set aside

Note 2 Note Lord Trefgarne’s Statement and that the present conclusions (RAF BOI findings) are

unsound.

Note 3 Lord Jacob’s statement that no evidence was found of any malfunction of the instruments

after an American Chinook suddenly turned upside down, was not quite correct.

Investigators later found evidence of hydraulic fluid contamination in one of the systems.

This caused the undemanded roll. He believes there is no proof the pilots were negligent on

the available evidence.

Note 4 Lord Burnham calls for a reopening of the inquiry. His reference to VFR is only correct for

fixed wing aircraft. Helicopters need only be clear of cloud and in sight of the surface to

maintain VFR when at or below 3000 feet. Military helicopters are also subject to a speed

limit of less than 140 knots IAS in a visibility of at least 1 km with a cloud base of not less

than 250 feet.

End of Appendix I


20 April 2000 APPENDIX J J 1

LOOSE MINUTE To: R Sparshott From : V Brennan (Mrs) EAS Date: 3 June I994 File: AEN58/022/1

Appendix J

Memo from Mrs V. BRENNAN of EAS Boscombe Down to Mr R. SPARSHOTT MOD.

Copies to: ADASE, S/L EAS, S Bradbrook, L Mugridge, File

Subject: The Textron Lvcoming "White Paper" on Chinook FADEC Ref. D/DHP/HPl/4/3 dated 29 April 94 covering Textron ‘white paper’ paper 1. Summary In general, the Textron white paper made many claims that are not borne out by EAS knowledge of experience of the FADEC software or project to date. Claims were made and arguments were put forward which EAS believe, in part at least, to be incorrect or irrelevant. Textron site numerous reviews as evidence for the integrity of the FADEC but they do not identify how successful the reviews were or where the result might be found. EAS are aware that many adverse comments and results were obtained during the reviews which Textron have, in this document, chosen to ignore. In addition EAS believe that certain reviews were ineffective, for example, the 'Formal Software Testing' quoted in the software development history as taking place in 1987, failed to trap numerous errors identified in the Software Reviews carried out at A&AEE post 1988. Textron also claim that 70,000 hrs of test were performed. It is believed that most of this testing was not done using the current production RAF version of the FADEC software which makes a large proportion of it irrelevant, and that which remains relevant has tested a truly minuscule fraction of the possible input conditions. Notwithstanding the claims made in Textron's white paper, the problem remains that the

product has been shown to be unverifiable and is therefore unsuitable for its intended purpose. 2. Detailed Comments

2.1 (para 1.1 sub para 1) States that the software (s/w) configuration has not changed from the initial production release in 1991. It is then stated that the 1991 production version was for the T55-L-714 engine. As the RAF version is for the T55-L-712 engine then the software has indeed changed.

2.2 (para 1.2) EAS do not agree that the T55-L-712F software meets the requirements of JSP188 (documentation standards for this level of software). The traceability study of the documentation revealed inconsistencies such as requirements not being implemented and conversely things appearing8 in the code which did not appear in the requirements. There were a

total of 34 category 1 anomalies and 48 category 2 anomalies in the traceability study. This does

not meet the requirements of JSP l88.


20 April 2000 APPENDIX J Page J 2

2.3 (para 1.2.1) States that "the audit activity consisted of HSDE ... and extensive review by A&AEE". Textron seems to be claiming that by undergoing reviews, the software assumes a level integrity. No account has been taken of the results of the reviews, for example, there is no mention that A&AEE found the s/w to be unacceptable. In addition, Textron have place(d) emphasis on the s/w being subjected to programmer peer review - A&AEE have little confidence in this technique which clearly and demonstrably failed to detect a very large number of anomalies. This review took place in 1987 at HSDE on a standard of s/w remote from that which we are actually using. The s/w following this review still included the very large number of errors found in the code by A&AEE and then later found in the documentation and code by EDS. Boeing themselves identified a whole module which addressed the wrong area in memory.

2.4 (para 1.3) Textron cite the number of hours of testing as in excess of 70,000 and states that this exceeds, by an order of magnitude, the amount of testing typically employed for many safety critical flight control systems now in production. The first point is that 70,000 hours is the cumulative total for several different versions of s/w during development since 1982 and this figure is therefore invalid. Secondly, even if the figure was 70,000 this is still too low for safety critical s/w which is why, typically, safety critical software is verified using analysis rather than test - testing is used to validate the software.

2.5 (para 1.3.5) This para claims that testing can verify expected changes and confirm that previous test experience had not been invalidated. However, testing alone cannot verify the expected change and change will invalidate previous testing until sufficient analysis (not test) has been done to demonstrate that this is no(t?) the case.

2.6 (para 1.4) This para suggests that system safety can be verified using FMECA, (;) this is wrong. All the FMECA does is provide additional information for validation.

2.7 (para 1.4.1) This para. puts a heavy reliance on being able to operate with only one engine – the RAF want to fly in a regime that requires both. Additionally the RAF will wish to train their Chinook pilots to handle an aircraft with a single engine failure and as part of the training will fly with one engine deliberately retarded. – a failure in the nonretarded engine would be catastrophic under these conditions. This para casts some doubts over the criticality of the software, however Boeing

have confirmed that the FADEC software is indeed flight critical. Ref: Software Accomplishment Summary (HSDE) ART 1251 iss. 3 1991. Para 5-0.

2.8 (para 1.4.2) The identification of a failure and the resultant behaviour of the system is determined by the software unless both of` the processors in the 2 control lanes cease to function (in which case the stepper motor fails in a fixed position, providing a fixed fuel flow and not a. ‘fixed power level’ as stated here, regardless of the operating mode of the engine) or the software loses control causing the engine to increase speed until it reaches the analogue (N2) overspeed limiter. If the s/w believes the system is operating correctly then it will continue whether it is correct or not. Textron state that there is no FADEC failure mode which would result in creating an unsafe condition on the other engine however they do share information. Additionally Textron claim that the primary lane and reversionary lane are completely independent, however, in the event of a reversionary lane failing before or during an engine shutdown, the primary lane keeps the engine supplied with fuel and the engine overheats because it requires the reversionary lane in the shut down process to stop the fuel flow.



2.9 (para 1.4.3) The FMECA does not address s/w failures. It does however use s/w reliability to mitigate against failures in the h/w (s/w?). HSDE claim that the scenario of fuel being continued to be pumped to the engines following a shutdown with the reversionary lane failed thereby causing it to overheat is documented in the FMECA and understood by the MOD. It is not in the FMECA and the MOD knew nothing about it until it was drawn to their attention.

2.10 (para 2.1) Again Textron neglect to say that while A&AEE did review the

reversionary lane code and a proportion of the primary lane, it was found to be unacceptable.

2.11 (para 2.2) Textron attempt to devalue static analysis because it can not examine interrupts and other dynamic features. This is entirely true. However, even in its limited capacity, it still found sufficient wrong to enable EAS to have little confidence in the code itself. [note: safety critical software should not contain interrupts and dynamic features as they are not sufficiently deterministic. The only interrupts that may be allowed are normally used for timing purposes and there are ways to get around using interrupts even for that. However, interrupts are normally permitted in code of this vintage as the safety implications of the use of interrupts was not widely understood at the time.]

2.12 (para 2.3) Textron state, that the problems encountered in applying static code analysis were due to the code not being designed with static code analysis in mind. This is not the case. Any well designed code will be amenable to static analysis (;) it does not, necessarily, HAVE to be designed with static code analysis in mind, although it helps. Designing with the aid of static code analysis does, however, encourage the use of much safer programming constructs. CODE FOR USE IN SAFETY CRITICAL APPLICATIONS SHOULD BE SUFFICIENTLY SIMPLE AND TRACEABLE TO BE UNDERSTOOD BY AN INDEPENDENT TEAM OF VERIFIERS. This also makes it suitable for static code analysis.

2.13 (table 3) Because it does not produce evidence that can be assessed by a third party, is not automated, and is not mathematically rigorous in any way, peer review is not equivalent to semantic analysis using automated tools such as MALPAS and SPADE.

2.14 (para 2.4) It is true that static analysis alone cannot provide sufficient evidence to demonstrate that the FADEC system is safe. It was however sufficient to show that the s/w is

unsuitable, in its present form, for use in a safety critical application.

2.15 (para 3.1) An anomaly DOES imply that an error exists (either in the code or in the

documentation) – it also implies confusion in the coding and/or documentation. These anomalies were still in 17% of the code and the remainder is unanalysed. Moreover, the code analysed by EDS is essentially that already analysed by A&AEE earlier when many anomalies were identified, but with the advantage of additional documentation producing evidence of many more

2.16 (para .3.2) Aliasing does have a major impact on maintenance.

2.17 This document repeatedly claims that the s/w meets RTCA Do. 178A. EAS and EDS have already said that they believe it does not. Textron, additionally, claim it meets little bits of 178B. This claim is largely irrelevant. HOWEVER, here are some more of the relevant points from RTCA Doc. 178B:-



a) 178B is not prescriptive but it set objectives which are to be fulfilled using suitable methods

b) 178B para 6.0 states s/w verification is not just testing.

c) 178B para 6.3 makes a difference between review and analysis – Textron constantly claim equivalence. d) 178B para 6.3.4..f. Provides some objectives for review and analysis of the source code – they have, so far, failed to fulfil these requirements. e) 178B para 6.3.4.b. Specifically states that the data and control flow within the code should match that defined in the software architecture – data and control flow are normally ascertained using static code analysis tools. f) 178B para 11.8 Lays down some basic standards for software – the FADEC code does

not meet these standards

g) 178B para 12.3.2. States that exhaustive testing COULD be used in verification for simple system – this is not a simple system. The implication here is that something else is required in the case of a complicate system to ensure that the requirements have been correctly implemented. End

Editorial comment : This is a re-typed copy of the orginal document (Loose Minute). Note 1 : Important statements made in the loose minute have been highlighted in bold to

emphasise their importance and for ease of reference by readers Note 2 : Entries made in (bold) within brackets are for clarification of the original text

End of Appendix J


20 April 2000 APPENDIX K K 1

Appendix K

DHS FOLLOW UP REPORT OF SERIOUS OCCURRENCE OR FAULT

ADDRESSEES AML,HQSTC AO Eng & Supply, DHS, HQSTC Air

Cdre Logs, HQSCT Gp Capt Logs 2, DDHS 3,

EIFS(RAF), Hels 2(RAF), DHP AD/HP1, HQSTC Wg

Cdr Logs Rotary, HQ 1 Gp SO Eng & Supp, HQ 2 Gp SO Eng & Supply

AIRWORTHINESS REGISTER

YES

5 AIRCRAFT OR EQUIPMENT Chinook HC Mk 2 ZD576

NATURE OF OCCURRENCE OR FAULT :

Serious Fault Signal HJH/H80/OGH/KQA/H8G DTG 11121OMAY94 reported the discovery of

a partially detached balance-spring mounting bracket in the Collective channel of the flying

controls.

LOCATION RAF Odiham PARENT UNIT RAF Odiham

DATE/TIME 11 May 94 0930A hrs BY WHOM OC Eng and supply Wg

REPORTED

DESCRIPTION

The Chinook HC Mk2 Collective and Yaw channel flying control assemblies are mounted on a

composite honeycomb pallet within the flying control closet. A balance-spring bracket in the

collective channel was found to be partially detached from the mounting pallet. The bracket is

secured by 2 bolts to inserts bonded within the mounting pallet. Insert bonding failure allowed

the bracket to be pulled from the mounting pallet by the balance-spring.

ENGINEERING/OPERATIONAL IMPLICATIONS

Detachment of the bracket within the flying control closet during

flight could present a serious flight safety hazard, with the danger of a detached bracket fouling adjacent flying controls.

ACTION IN HAND OR CONTEMPLATED

A initial fleet check showed that no other balance-spring brackets were detached or loose. A PWI

requiring a check of the security of all flying control components mounted on honeycomb pallets

will be issued by the SA on 12 May.

The BH field representative at RAF Odiham has passed a US Army repair scheme for the

mounting pallet inserts, but Boeing wish to review the situation and develop their own scheme to

re-secure loose inserts.

6 The PWI will be followed up with routine inspection action pending the development of a

long term solution.

DATE SIGNATURE NAME RANK APPOINTMENT

11 May 94

(AMV) A M VERDON Gp Capt HS31

EDITORIAL COMMENT

1. This is a true copy of the document presented at the Scottish Civil Accident Inquiry (FAI). 2. There were at least 2 known incidents of a balance spring mounting bracket coming loose before the crash

(including this case) and at least 3 after the crash; due to the poor bonding method used to secure components of the flight system in the flying control closet.

End of Appendix K


20 April 2000 APPENDIX L L 1

Appendix L

Scottish Fatal Accident Inquiry (FAI) - Determination by Sir Stephen Young

Testimony on the Weather conditions by witness Mr Marc HOLBROOK, Yachtsman.

(Determination pages 56-58 refer)

Page 56

The last persons to get a good view of ZD576 were Mr Holbrook and his friend Mr McLeod who were sailing in the former’s yacht off the Mull of Kintyre.

They had missed the tide to go round the Mull that evening and therefore

spent about half an hour changing sails and the like about a quarter to half

a mile due west of the lighthouse. There was cloud hugging the hillside

about the lighthouse but Mr Holbrook could see the whole of the lighthouse

itself. At about 5.30 p.m. local time they set off from the Mul1 in a south 2 / 148-9

westerly direction and soon found themselves among some fishing boats which

they had to manoeuvre around. At that stage Mr Holbrook estimated the

visibility at sea level to be "certainly in excess of three miles and

possibly five miles". Just after the end of the shipping forecast at 5.55 2 / 153

p.m. he saw ZD576 approaching from the direction of Northern Ireland. At

that stage his yacht was about two miles to the south west or south of the

lighthouse. He estimated the range of the aircraft from his yacht to be 2 / 155

about a quarter of a mile and its height above sea level about 200 to 400

feet. He estimated this height in relation to the last vertical reference

which he had had, namely the height of the lighthouse (the light of which is

299 feet above sea level). At the same time he could see the land mass of

the Mull of Kintyre. He could not see the light itself but he could see the 2 / 156

position of the lighthouse and a white wall to the south of it. He could

also see the land mass of the island of Sanda to the east. The aircraft was

in straight and level flight. He was asked about iu speed as follows: "Q.- 2 / 158-9 Can you give any impression of the speed of the aircraft in the sense of, did

it appear to be gaining speed or slowing first of all ? A.- I believe it was

in level flight and I believe the speed was constant. Again, with the

proviso that I only saw the aircraft for a few seconds and I am not an

expert in these matters, but I would have estimated its speed to be something

between 60 and 80 knots if I had to put a figure on it. Q.- I take it you accept that that is just, as you have said very fairly, your estimate of it?

A.- Sure, but it was not moving any more rapidly.... This is the first time

I had seen a twin-rotor blade helicopter and it wasn't moving at an undue

speed relative to a Sea King which would have been engaged in looking on the

sea surface for example". Mr Holbrook saw the aircraft heading towards the 2 / 160

Mull of Kintyre peninsula. He was asked in more detail about the visibility:


20 April 2000 Report APPENDIX L L 2

Page 57

"Q.- Now, as far as visibility on the Mull of Kintyre wþas concerned at that

time, you told us you were able to make out the position of the Mull light by

first the large wall of the buildings? A.- Just. Q.- What about the Mull

itself above the lighthouse? A.- No. I recall the conditions of visibility

at sea level as being fine, perhaps as much as five miles. I think at that

point I could even see the Antrim coast so it might have been as much as six

or seven miles. In the area of the Mull there was low cloud hugging the Mull

and also the top of Sanda and I couldn't distinguish the top of the Mull.

Q.- So you have a recollection of low cloud clinging on the top of Sanda

island? A.- Yes, localised in the Kintyre Peninsula and Sanda. Q.- I don't

want to put words into your mouth, but for how long had that cloud been

clinging there? A.- That cloud had been there since... . it is difficult to

say but certainly at the time I started to observe the Mull lighthouse when I

was underneath it at 5 o'clock. There was definitely cloud cover not much

above the position of the Mull lighthouse at that time. Q.- So it certainly

was not cloud cover that suddenly appeared by the time you saw the

helicopter? A.- No, there was a ceiling of cloud so I couldn't see very much

blue sky. It was definitely overcast but the general cloud cover, as

distinct from this low cloud that was over the Mull and Sanda, I believe that

cloud cover was really quite high. I couldn't estimate its height. Q.- But

that is distinct from the cloud that is over the Mull of Kintyre and Sanda?

A.- Yes." 2 / 161-1

In cross-examination Mr Holbrook indicated that the wind had got up to about

25 to 30 knots by the time his yacht reached the lighthouse, and he

recollected that it had moved more round to the west as it had got up. Later 2 / 165

he said that it was gusting up to 35 knots. He was asked: "Q.- Then once 2 / 178

the sail change had been completed you started on your course west generally

or south? A.- South west. Q.- Were you aware of the lighthouse still being

visible? A.- Yes, I continued to be aware of the lighthouse because of the

manoeuvre we were having to do really quite rapidly to get round these boats

and there was a check in the general direction I was going in". Later he 2 / 167

volunteered: "If you are seeking to establish, do I believe the pilot could þ,

see the location of the Mull lighthouse, yes, I believe he could". He was 2 / 169



Page 58

asked again about the aircraft's speed: "Q.- Your estimate of the speed of

this helicopter, how was that done? A.- I was asked....How was that done?

Probably the only reference I have to that is helicopter activity off Troon.

The movement from moving to being stationary. Q.- So you had seen other

helicopters flying around? A.- I know what 30 knots looks like in a boat so

I would have been able to multiply that up and that is it. That is the limit

of my understanding of speed. Q.- So you think it might have been between

two or three times faster - A.- Yes it was not moving at a helluva speed.

It wasn't moving at a speed that would have caused me to remark on it in any

way all in terms of moving very rapidly from A to B and that is what caused

me to think maybe it was looking, that there was some sort of event and it

was looking for somebody. I believe the remark I made was "I wonder if he is

looking for somebody"." He was also asked about cloud levels again: "Q.- And 2 / 172-3

you could see where land is by the fact the clouds were hugging it? A.- Yes,

that is correct. Q.- You say there was also cloud generally over the sea, is

that correct? A.- There was cloud. There was general cloud cover, but, I

mean, not sunshine but sunlight was breaking through the cloud cover so it

was quite light cloud cover. It was very nearly total cover but I couldn't

estimate the height of that cover but it was high cloud. Q.- High cloud?

A.- High cloud, yes. Q.- So it was higher say than the height of the top of

the Mull for instance? A.- The general cloud cover as distinct from this low

cloud which was localised over the land mass, yes." 2 / 174

In the course of his cross-examination of H, counsel for Boeing Helicopters

put to him a statement which had been made by Mr Holbrook to the Board of

Inquiry soon after the accident in which he had stated that, when he had seen

the aircraft, the visibility had been about one mile and limited by haze.

This statement was not put to Mr Holbrook when he gave evidence in the

proceedings and his assertion that he could see the land mass of the Mull of

Kintyre and the area of the lighthouse, if not the lighthouse itself, was not

challenged. In these circumstances, and bearing in mind the details which he

was able to give about what he could see both of the Mull itself and of the

island of Sanda to the east, I think that the evidence which he gave to this

inquiry should be preferred to the statement which he gave to the Board of



Page 59

Inquiry. But of course it should be borne in mind that, in speaking of the

visibilty, Mr Holbrook was referring to the visibility at sea level.

The question also arises whether Mr Holbrook's estimate of the speed of the

aircraft at between 60 to 80 knots was correct. In light of other evidence

in the case I was at first inclined to think that he had seriously

underestimated this speed. But on reflection I am not so sure about the

matter. On the two occasions in particular on which he spoke of the

aircraft's speed he was quite emphatic that it was not moving at an undue

speed and I should have thought that, ii it had been travelling at a speed of 2 / 160

150 1þots or more (in other words, more or less double his own estimate), & 173

he might have noticed that. Besides, if the visibility was as good as he

said to this inquiry that it was, it might indeed have been expected that the

aircraft would have been reducing speed if I have understood correctly an

answer given by H towards the end of his evidence when he said: "If the

visibility was such that at two to three miles he (i.e. Mr Holbrook) could

plainly see the Mull of Kintyre or the lighthouse I would have expected the

crew to reduce speed and be below whatever the cloud base was, bearing in

mind he said he saw the aircraft at between 200 and 400 feet". Such a 14 / 2202

reduction in speed would I think have been consistent with the crew having

seen the land mass ahead and having slowed down in part because of the

decreasing visibility and in part to give them time to consider what their

next course of action should be. Clearly, if Mr Holbrook was right about the

aircraft's speed, that would raise other difficulties. For example, it may

be asked why the aircraft thereafter increased its speed again as it

approached the initial impact point and why the assistant lighthouse keeper,

Mr Murchie, did not hear any sound from the aircraft's engines or rotors

consistent with an increase in speed. It is evident too that Mr Holbrook was

mistaken about the direction of the wind when he saw the aircraft (although

he did correctly recollect its force and also the fact that his yacht would

have been beating into the wind) and so it is possible that he might have 2 / 176

been mistaken as well about the aircraft's speed. For present purposes I do

not think that it is necessary to reach a concluded view on this particular

question.

End of Appendix L


20 April 2000 APPENDIX M M 1

Appendix M

Scottish Civil Fatal Accident Inquiry (FAI) - Precognition Extract Statement by Lieutenant Philip AVERY RN, Meteorologist, residing at The Garden Flat, Barskimming, Mauchline, Ayrshire KA5 5HB

I am Lieutenant Philip Avery aged 36. I am currently serving at HMS Gannet as a

weather forecaster with the Royal Navy. I am currently employed by the Royal Navy

on a short-term contract due to finish in January l996. My career with the Royal Navy

began with a commission in 1984. In 1987 I obtained the METOC qualification. This

involves nine months training in theoretical and practical aspects of oceanography

and meteorology at the Royal Naval School at RNAS Culdrose in Cornwall.

My first posting was to RNAS Portland for ten months I then served with 802

Squadron joining HMS Ark Royal in Perth, Australia, for approximately two and a half

years until April 1991 and was then posted to RNAS Prestwick.

I have an MBA from Strathclyde University which I obtained in 1993/1994.

My main responsibility is to brief crews on the potential aviation hazards caused by

weather and also to advise on oceanographic conditions. We look after air crews and

also naval shipping in the Firths of Clyde and Forth and elsewhere. Prestwick is the

only naval weather centre north of Somerset. We also service a number of MOD

depots issuing weather warnings. There is a Navy Sea-King search and rescue

helicopter based at HMS Gannet at Prestwick for whom I provide daily forecasts. The

forecasts extend over a radius of one hundred miles from Prestwik and therefore take

in the Mull of Kintyre area. I am therefore familiar with the locality.

I have spoken with the observer who flew on the Sea-King from HMS Gannet shortly

after the accident on 2nd June l994. He said that at the time of the search the cloud

base varied from three hundred feet right up to and including the crash site. I will

enquire of the crew as to when they were at the crash site and whether it was they

who landed on the helipad at the Mull of Kintyre lighthouse.

I am told that Mr. Murchie, one of the lighthouse keepers, came out of his house and

looked out to sea as the Chinook approached. I understand that in doing so all that

he could see was a wall of fog. It is quite conceivable that on approach to the

lighthouse the Chinook could actually see the lighthouse being the first way point and

I do not consider Mr Murchie’s evidence as to the prevailing weather conditions to be

particularly relevant as it is taken from a different perspective from that of the

approaching helicopter.


20 April 2000 Report APPENDIX M Page M 2

I am familiar with the concept of spatial disorientation. I would describe this as a

condition brought on by the deprivation of visual reference. If flying without

instruments, it is necessary to have something to focus on and spatial disorientation

can be brought about by haze, snow, mist, fog, heavy rain or anything which reduces

the ability of the crew to latch onto something which is not moving outside the aircraft.

I am asked about the question of the texture of the sea surface. I note from Mr.

Holbrook’s statement that the wind was 20 knots gusting to 30 knots. That would

certainly create a texture on the surface of the sea generated by the wind in the

locality. This would almost certainly produce white caps and there would be a definite

texture on the surface of the sea. Mr. Holbrook also says that the swell was confused

and that would produce a texture on the surface. Swell is the effect: of wind at one

location observed on the surface of the sea at another. I am certain that the

combination of swell and wind would create a sea texture.

The weather conditions up and down the Mull of Kintyre can change very quickly and

I think this is borne out by much of the evidence in relation to weather which has

been given by a number of witnesses to the Board of Inquiry.

Just because the weather station at Macrihanish was reporting one type of weather

does not mean that the conditions on the Mull of Kintyre were the same and it is quite

possible that they were completely different.

The weather conditions described by Mr. Holbrook could be described as near gale

force winds and I am in no doubt that these would have produced a texture on the

surface of the sea. Mr. Holbrook also makes reference to the aircraft flying in sunlight

and in straight level flight. This to me suggests that at the time the aircraft was seen

by Mr Holbrook there could be no question of the pilots suffering from spatial

disorientation. Mr Holbrook refers to the cloud as being layered. I would agree with

this as there are no reports that there had been any rainfall at the time.

End of Precognition extract. End of Appendix M


2 September 2000 ADDENDUM 1 - WEATHER 1

ROYAL AIR FORCE

CHINOOK HC 2 ACCIDENT

Mull of Kintyre - 2 June 1994

ADDENDUM 1

Addendum to the 20 April 2000 Report

NOTES RELATING TO

WEATHER AT THE TIME OF THE ACCIDENT

Prepared by










With reference to

THE 20 APRIL 2000 REPORT WEATHER ASPECTS

REPORT EXECUTIVE SUMMARY

An in-depth study was made of all the available accident reports and other documents relating to the fatal RAF Chinook Mark 2 helicopter crash on the Mull of Kintyre on 2 June 1994. The study was carried out because it was difficult to understand why the Senior RAF Reviewing Officers ignored the findings of the RAF’s own Board of Inquiry (BOI) and arrived at the conclusion that the pilots caused the accident by flying into high ground through gross negligence. The subjective views of AVM J.R DAY, (Now AM Sir John DAY) the first RAF Senior Reviewing Officer, were seemingly based on an opinion not substantiated by facts. His superiors echoed his views and endorsed this opinion with no evidence offered to confirm such views, when overturning the RAF BOI findings. At a later Civil Fatal Accidents Inquiry (FAI) in Scotland, the Sheriff was unable to agree with the RAF’s finding showing pilot error as being the cause of the crash. Notwithstanding this FAI finding, the RAF Senior Reviewing Officers would not change their finding of gross negligence. Further investigation of this matter by the authors of the above captioned independent report, established that vital information relating to Chinook HC2 engine malfunctions was knowingly kept from the various Boards of Inquiry by the RAF and that known possible causal factors were ignored by the RAF’s own BOI. In fact, orders were given to a serving officer (unit test pilot) not to discuss Chinook HC2 related technical problems with any of the investigators or fellow officers. It would also appear that the views of RAF Boscombe Down test pilots and of computer software specialists were ignored. The aircraft was ordered into Service before faults, such as those found in the HC2 flight-critical FADEC engine control computer software, had been satisfactorily cleared and before the aircraft was authorised to fly in cloud in less than +4o C conditions. Since the subject crash, new information has been obtained from other Chinook operators on technical malfunctions that have resulted in fatal accidents or very near accidents. In at least two cases, clues as to their cause were similar to some found on ZD576, the RAF Chinook HC2 that crashed. This means that the accident may have been caused by factors other than flight into terrain because of pilot error as inferred by the Senior Reviewing Officers. In the circumstances and under the RAF’s own Rules at the time of the accident which state “ONLY IN

CASES IN WHICH THERE IS ABSOLUTELY NO DOUBT WHATSOEVER SHOULD DECEASED AIRCREW BE

FOUND NEGLIGENT”, the finding of gross negligence should be set aside, indeed unconditionally withdrawn. The 20 April 2000 report was prepared to bring together salient facts that emerged from the study of available documentation relating to this crash. Factual statements are presented in the report in some chronological and logical sequence, to build a picture that, it is hoped, allows readers to arrive at their own conclusion(s). Answers to questions that arise from the report should be of interest.

End of Summary

20 April 2000



ADDENDUM TO 20 APRIL 2000 REPORT

NOTES RELATING TO

WEATHER AT THE TIME OF THE ACCIDENT

1. Rationale for the addendum

This addendum looks into the RAF Board of Inquiry (BOI) Report inference that poor weather at the site of the crash was a contributory factor of the accident (Page 2-21). It also amplifies the statement made in the 20 April 2000 report at 6.8 (e) about evidence on visibility that should have been given more credence, as given by Mr. Mark B. HOLBROOK the yachtsman. To better understand the weather situation around the Mull at the time of the accident, it looks at his Fatal Accident Inquiry testimony. (FAI Determination by Sir Stephen Young, Pages 56 to 59 refer). With reference to this testimony, Sir Stephen said …“in these circumstances, I

think that the evidence which he (Mr Holbrook) gave at this inquiry should be preferred

to the statement he gave to the (RAF) Board of Inquiry” … (FAI Determination Page 58).

No evidence whatsoever was offered to the effect that the weather was not suitable for flight under Visual Flight Rules (VFR) as planned by the pilots for an aircraft not cleared to fly in cloud in temperatures of less than +4oC. In fact, the RAF BOI concluded that “the decision to

fly the entire sortie to Inverness as a low level flight in the forecast weather conditions was reasonable”. (RAF BOI Report at 67 (b), Pages 2-39 and 2-40). Wing Commander A.D. PULFORD the RAF BOI President, restated this opinion when questioned during the FAI. Two Senior Reviewing Officers overturned the RAF BOI findings that could not apportion blame, by claiming that the pilots broke the rules when they deliberately flew at high speed into cloud, whilst below Minimum Safe Altitude (see 7). It is therefore necessary to address weather conditions on the Mull of Kintyre approaches and in the immediate vicinity of the crash, to see if the aircraft was indeed being correctly flown within VFR limits as originally planned and intended; until it inexplicably did not turn left, at or just before Waypoint 1. The question remains : “Why did the Chinook carry on ahead and into cloud covering the Mull just before the crash, instead of climbing, turning back, or turning left in accordance with the flight plan”. Although contributory to other accidents, possible causes of the crash other than pilot

error were not considered relevant by the RAF BOI. Technical faults experienced in RAF and other Chinook HC2 helicopters before and since the accident, include Undemanded Flight Control Movements (UFCM) caused by electrical faults or hydraulic fluid contamination, the danger of a controls jam through detached mounting brackets due to poor bonding, double dash failures or loss of control due to engine runaways caused by unresolved FADEC malfunctions. In this particular case, none of these possibilities can be proved as not

having occurred.

2. Helicopter VFR Rules

International Civil Aviation Organisation (ICAO) Rules state that below 3000 feet and at an indicated airspeed of less than 140 knots, helicopters need only stay clear of cloud and in sight of the surface to satisfy flight in VFR. UK Civil Aviation Rules are similar. However, the RAF applies more stringent regulations to its Support Helicopter Force (SHF) operations in the UK low flying system. RAF flight under VFR conditions requires, in addition, a minimum cloud base of 250 feet and for crews to maintain at least 1 Km horizontal visibility, (that is 0.54 nautical miles or 0.621 statute miles) whilst in sight of the surface and clear of cloud.



3. Mr Holbrook’s evidence

Mr Marc Holbrook, a yachtsman who was sailing in Mull of Kintyre waters during the period before and after the time of the accident, gave evidence at both the RAF Accident Board of Inquiry (BOI) with Wing Commander A D Pulford Presiding and at the Scottish Civil Fatal Accident Inquiry (FAI) that was chaired by the Sheriff of Strathclyde Sir Stephen Young. Mr Holbrook was painstakingly cross-examined by the Crown during the FAI and his statements recorded in minute detail. With reference to this testimony, at the FAI. Sheriff Sir Stephen Young said ... “in the these circumstances, I think that the evidence which he (Mr

Holbrook) gave at this Inquiry should be preferred to the statement he gave to the (RAF) Board of Inquiry” ... (FAI Determination Page 58). Mr Holbrook stated in evidence at the RAF BOI (Witness 18, RAF BOI Report Part 6, Statements, Page 6-36) that when he was sailing ½ to ¾ mile from the lighthouse from 1700 to 1730 hours LT (local time) one hour to half an hour before the crash, the visibility was 1 mile and low cloud obscured the top of the Mull ... “following the contours of the landmass behind and above the lighthouse which could be seen, with its white perimeter wall” ... At 1745 hours LT (fifteen minutes before the crash), he reported that the visibility was still 1 mile. Close to 1755 hours when he saw the helicopter, he said the visibility was about 1 mile in haze.

However, when Mr Holbrook testified at the civil Scottish Fatal Accident Inquiry (FAI), he stated that just after 5.55 pm (1755 hours LT), he was sailing some 2 miles Southwest or South of the lighthouse when he estimated the visibility to be “certainly in excess of 3 miles

and possibly 5 miles”. That was just before the accident at approximately 1800 hours LT (exactly 16.59:30 GMT) which occurred some 15 minutes after the visibility had been reported as being 1 mile at the RAF BOI. At that time, Mr Holbrook saw the HC2 Chinook clear of cloud as it passed nearby at 200 to 400 feet above the surface, at the same time as he could also see the land mass of the Mull of Kintyre although he could not then see the light itself, but he reported seeing ... “the position of the lighthouse and a white wall to the south of it”.

Mr Holbrook added that at the same time, he could see the Antrim coast as well and that the visibility could (therefore) be as much as 7 miles. The discrepancy between the evidence of Mr. MURCHIE the lighthouse keeper who could only see 20 metres ahead at the time of the crash and that of Mr Holbrook who was sailing in the clear about 2 miles offshore, is simply explained. Mr Murchie was in the cloud that covered the base of the lighthouse at 250 feet above sea level. (FAI Determination Page 60).

A Royal Navy meteorologist who was not called to testify (See this Addendum at 6 and the 20 April report at Appendix C), said in a written legal statement that the weather around the Mull of Kintyre can change very quickly. This would account for a comparatively rapid change in visibility to between 3 and 5 miles when the HC2 was sighted as stated in evidence at the FAI.

The wind was 20 to 30 knots, gusting 35 from the South and Southwest generally and cloud cover was reported as generally high with sunlight breaking through. It was higher than the top of the Mull and distinct from the low cloud localised over the landmass, hugging the Mull and the top of Sanda (island). (FAI Determination Pages 57 & 58). Holbrook estimated the speed of the aircraft as close to that of a Sea King helicopter on a search, probably between 60 and 80 knots. It is known that the average airspeed between leaving the zone boundary at Belfast and the first waypoint change was 128 knots IAS, as calculated by Sir Stephen Young (FAI Day 18 Record, Page 2723 at E). The President of the

RAF BOI accorded with the Sheriff’s logical speed determination, when cross-examined

at the FAI.



In view of the available evidence, it must be accepted that the pilots were operating within RAF helicopter VFR limits when the HC2 that was seen by Mr Holbrook, passed nearly overhead as he was sailing some 2 miles South or Southwest of the Mull of Kintyre lighthouse. The HC2 was seemingly correctly flown at less than 140 knots IAS, in more than 1km (0.54 nautical miles or 0.621 statute miles) horizontal visibility, in sight of the surface, at a height of between 200 and 400 feet and clear of the cloud which was higher than that covering the base of the lighthouse at 250 feet. The RAF BOI opinion that the weather over the Mull landmass was a contributory factor in the accident is questionable because the poor visibility due to cloud over land was not that experienced on the HC2’s actual flight path to Waypoint 1, as witnessed. It was also unlikely to have been limiting over the sea thereafter, whilst circumnavigating the Mull as planned. All one can say is that the weather may have had an INDIRECT effect because it forced the flight to be planned as a low level VFR operation, to stay clear of cloud in less than +4o C. If weather conditions been better, overflight of the Mull area would have been possible at or above the Minimum Safe Altitude of 5900 feet, where any untoward malfunction causing loss of control might not have had the disastrous effect of flight into terrain.

Mr Holbrook’s testimony at the FAI can be described as complementary evidence to that

given at the RAF BOI and should be acknowledged as such in any review of the events.

4. Cloud formation and Visibility in and around clouds

It may be useful to describe the type of cloud that is likely to have covered the upper reaches of the Mull of Kintyre on 2 June 1994, yet allowing the lower parts of the cliff faces to remain visible from offshore points all round the Lighthouse, at sea level or above. A short descriptive of fog and cloud formation follows, to help clarify existing conditions over the lighthouse and around the Mull generally that day, as reported by witnesses.

4.1 Fog Fog is defined as visibility of less than 1000 metres due to solid particles or water droplets suspended in the atmosphere. Fog generally consists of water particles condensed due to cooling, on tiny nuclei of dust, smoke or salt particles. Dust or smoke fogs occur in desert areas or manufacturing cities. The formation of an ordinary fog (water particles) depends on :

a. The amount of water vapour present in the air; and b. The existing temperature of the air; and c. The existence of nuclei; and d. The temperature at which the existing amount of water vapour in the air will cause it

to become saturated and at which this vapour will therefore tend to condense into solid water particles. This temperature is called the Dew Point; and

e. The cause of the air becoming cooled. This varies and the result is different kinds of fog, such as Radiation fog, Valley fog, Sea fog, Land fog, Advection fog and/or High Ground fog.



HIGH GROUND FOG is caused merely by existing clouds being blown over high ground, or

through moist air being cooled dynamically by being forced upwards over cliffs or hills (known as orographic cloud). It is believed that a form of this latter condition was the situation around the Mull of Kintyre area on 2 June 1994.

4.2 Cloud

Clouds are the same as fog but differ in that they are above ground level and that sometimes they consist of ice, snow or sleet, instead of water particles. They are made of water particles condensed due to cooling into visible droplets, generally formed by moist air being cooled below its Dew Point by rising. The height at which the Dew Point is reached is called the Saturation level. Air rises if it is warmer than the surrounding environment or if it is pushed upwards orographically, that is by the terrain over which it moves (wind). Cloud is then formed where the mass of air reaches the saturation level (condensation height) as its moisture content turns into visible water droplets.

4.3. Reduced visibility when in cloud

As illustrated in A and in photograph B, whilst the visibility may be limited to someone in a cloud, (pilot, climber or lighthouse keeper), those outside might see the base of a hill for miles around, right up to the cloud covered peak; as was the case on 2 June 1994 when the sky was 80% overcast with layered cloud and visibility up to 7 miles, near sea level around the Mull.

Although the lighthouse keeper could hardly see ahead because he was standing in cloud, this does not mean that the pilots were not flying clear of cloud and in sight of the Mull as they approached their first Waypoint from the Southwest.

Illustration A : Orographic effect cloud formation Cloud covering peak Inside cloud : visibility may be 20 metres or less Saturation or

Condensation ---------------------------------------------------------------------------------------------------------- Level

Outside cloud

visibility can be unlimited

Wind over sea HILL Descending (Moist Airflow rising) airflow

SEA



Illustration B : Mountain peak in cloud – lower reaches visible in otherwise clear skies

5. Cloud and visibility conditions, Mull of Kintyre area, 2 June 1994

On 2 June 1994, a broadly South to Southwesterly 20 to 30 knot wind was blowing over the sea towards the Mull of Kintyre. Localised low cloud hugged the Kintyre peninsula and the top of Sanda Island. Layered cloud covered 80% of the sky. The general cloud cover, as distinct from the cloud that was localised over the landmass, was much higher than the cloud covering the Mull lighthouse (FAI Determination, Pages 57 & 58).

There was more low cloud over the land than over the sea because the moist air mass (wind) having travelled over the cold sea, was being forced uphill in the Mull of Kintyre area due to the rising terrain from the shoreline and around the base of the lighthouse. The very moist rising air (wind) condensed into cloud at a lower level than other cloud formations, enveloping the lighthouse whilst allowing the lower reaches of the Mull to remain visible from off-shore. On the subject of visibility, Mr Holbrook said that he could see the Mull from his boat at the same time as he saw the Chinook passing low overhead, when he gave evidence at the Scottish Fatal Accident Inquiry (FAI). He estimated his range from the cloud covered lighthouse to be about 2 miles Southwest or South and the visibility at sea level to be in excess of 3 miles and possibly 5 miles (FAI determination pages 56 to 59 refer). For the same period, the lighthouse keeper stated that at the time of the crash a few minutes later, he could only see 20 metres ahead when standing near the lighthouse. That is understandable as he was in the cloud. As noted in Section 4 of the 20 April 2000 report (referred to as the Macdonald report by the media), the Chinook HC2 was not cleared to fly in icing conditions. In consequence, the flight of the aircraft that was seen by Mr Holbrook, had been planned along an approved visual low-level route at 500 feet (reducing to 200 feet over the sea) to stay clear of cloud and in sight of the surface, in at least 1 km (0.54 nautical miles or 0.621 statute miles) of forward visibility. (Military VFR Rules for helicopters).



After the first ‘waypoint’ Southeast of the Mull lighthouse, the VFR flight plan would have taken the HC2 over the water and along the Western edge of the Mull peninsula to remain in visual contact with the beach on the right hand side of the helicopter, up to the next visual turning point. (See 20 April 2000 report at 4.3(b) & 4.4 (b)).

To reiterate - the opinion that the weather over the Mull landmass was a contributory

factor in the accident (BOI Report # 42, Page 2-21) is questionable because the poor

visibility due to cloud over land was not that experienced on the HC2’s actual flight path

to Waypoint 1 as witnessed; and it was unlikely that it would have been limiting over the

sea whilst circumnavigating the Mull as planned.

6. Precognition by Lieutenant Philip AVERY RN, Weather Forecaster

In a precognition made at the request of the Tapper family in November 1995 prior to the FAI, Lt Philip AVERY RN, a weather forecaster who was serving at HMS Gannet (Prestwick) at the time, agreed with Mr Holbrook’s RAF BOI evidence that there was layered cloud in the Mull area as there are no reports of rainfall at the time. (RAF BOI Report Page 6-37 said 80% cover). He also believed that there was a visible sea texture in the reported wind conditions. That the helicopter was in stable level flight over a visible sea texture suggested to Lt Avery that at the time the aircraft was seen by Mr Holbrook, there could be no question of Spatial Disorientation as a contributory factor, as suggested by the RAF BOI Report, #39, Page 2-19). Lt Avery remarked that the helicopter had been seen in level flight in sunlight, so it was conceivable that the pilots could see the lighthouse (area) when Mr Murchie, the lighthouse keeper, could not see further than 20 metres ahead. He said that Mr Murchie’s evidence as to the prevailing weather conditions was not particularly relevant as it was taken from a different perspective from that of the approaching helicopter (reportedly in a visibility of 3 to 5 miles). Lt Avery remarked that weather around the Mull of Kintyre could change very quickly, as evidenced by differences in the statements of some witnesses. In his precognition, Lt. Avery said “Just because the weather station at Macrihanish was reporting one type of weather does not mean that the conditions on the Mull of Kintyre were the same and it is quite possible that they were completely different”.

7. Overriding conclusions by the RAF BOI Reviewing Officers 7.1 Two Senior Reviewing Officers based their conclusions of gross negligence on the assumption

that the pilots flew on towards the Mull lighthouse when Waypoint 2 was selected just before Waypoint 1, whilst in cloud and in contravention of VFR limitations. They over-ruled (without offering any proof) the RAF’s own BOI report conclusions, which could not apportion blame on the available evidence. The Senior Reviewing Officers statements were as follows :

7.1.1 AVM John R. DAY , Air Officer Commanding No.1 Group (Now Air Marshal Sir John Day)

(RAF BOI Report, Part 4, Page 4-2) “He (Flt Lt Tapper) allowed his aircraft to proceed at both high speed and low level directly towards the Mull. He also contravened the strict rules of flight under either Visual Flight Rules or Instrument Flight Rules, I am forced to conclude that Flt Lt Tapper was negligent to a gross degree”… and …“He (Flt Lt Cook) continued to fly the aircraft directly at the Mull at high speed, at low level and in poor visibility. I therefore cannot avoid the conclusion that Flt Lt Cook was also negligent to a gross degree” ... and ... “It is incomprehensible why two trusted,



experienced and skilled pilots should, as indicated by all the available evidence, have flown a serviceable aircraft into cloud-covered high ground”. The use of the word serviceable is open to question. The Air Accident Investigation Board was unable to establish the pre impact serviceability of the aircraft (AAIB Report - 10 Conclusions #52, Page 65). Also Boscombe Down test pilots stopped flying the HC2 until a number of unresolved technical problems were cleared, including ongoing FADEC faults. It must be noted that in spite of Boscombe Down reservations, squadron pilots were ordered to continue to fly the Chinook HC2 with, seemingly, no restriction on the carriage of passengers.

7.1.2 AM Sir William WRATTEN (AOCinC STC)

(RAF BOI Report, PART 5 - Remarks by Air Officer Commanding-in-Chief) “Without the irrefutable evidence which is provided by an ADR and a CVR, there is inevitably a degree of speculation as to the precise detail of the sequence of events in the minutes and seconds immediately prior to impact” ... and ... “Lamentably, all the evidence points towards them (the pilots) having ignored one of the most basic tenets of airmanship, which is never to attempt to fly visually below Safety Altitude unless weather conditions are unambiguously suitable for operating under Visual Flight Rules.” ...and ...“I therefore agree with the AOC summary, in particular that the actions of the two pilots were the direct cause of the crash. I also conclude that this amounted to gross negligence”.

7.1.3 ACM Sir Michael GRAYDON (Chief of Air Staff) (20 April 2000 report - Appendix G) “The (Reviewing) Officers involved were left in no doubt that aircrew negligence was the cause of the crash. This is a conclusion that I fully support”.

7.2 Some time later (in the years 1999 and 2000) when the verdict of gross negligence was still

being questioned in aviation circles outside the military because of its apparent unfairness, Sir William WRATTEN reiterated his contention that the pilots were grossly negligent, in various statements and letters to the Press and Aviation Media.

This opinion was based on the view that AVM Day was correct when coming to the conclusion that pilot error had caused the crash. AVM Day’s (subjective) opinion was not based on objective evidence. Yet, he believed in all good faith that ...“when the aircraft crashed it was flying at high speed, well below safety altitude, in cloud, in Instrument Meteorological Conditions and in direct contravention of the rules for flight under either Visual Flight Rules (VFR) or Instrument Flight Rules (IFR).” ... hence the accusation of Gross Negligence but without irrefutable proof. It could therefore be argued that a. On the available evidence, the aircraft was unlikely to be flying at the high speed

suggested by the reviewing officers other than for an unknown reason immediately before the crash. All we know is that the average airspeed between the zone boundary and the first waypoint change was 128 knots.

b. Area and local Minimum Safe Altitudes (MSA) which were noted on the

topographical map at the flight planning stage of the flight, were not a factor as claimed because the HC2 was flown under helicopter VFR rules, in sight of the surface and clear of cloud.

c. The helicopter was flying outside cloud at all times, except for immediately before the

crash. That the aircraft entered cloud as it did has yet to be explained and must remain an imponderable. If doubts arise as to the cause of the crash, then the benefit of that



doubt MUST be given to the deceased pilots and the accusation of gross negligence set aside, indeed withdrawn.

8. To conclude 8.1 It must be reiterated that what has never been ascertained is why the HC2 continued

towards cloud covered land when a turn to the left was required by Waypoint 1, to carry on flying in VFR conditions. It is inconceivable that the pilots were not aware of their position or of the close proximity of cloud covered terrain; or of the need to stay clear of cloud which was above their VFR flight path and covering the lighthouse area. The whole conduct of the flight, from the flight planning stage onwards, accepted that the flight could only be operated in VFR, so there can be no question that the pilots were not aware of the need to remain off-shore, when near the Mull.

This paper, as an addendum to the main report, focuses on the prevailing weather over the sea, in the area around the Mull land mass near the crash, to confirm the correctness of the pilots’ decision to fly the operation at low level, in VFR conditions, on an approved route and as they were trained to do. It would seem that the RAF BOI painted a different picture of the weather to that which emerged from witness statements both at the BOI and at the subsequent FAI. 8.2 The opinions upon which the accusation of guilt was placed on the pilots cannot be left unchallenged. Neither can the speculative views of the BOI and the Reviewing Officers on weather and aircraft speed that do not tally with witness statements. In particular, AM Wratten did not deny his published admission that …“Without the irrefutable evidence which is provided by an ADR and a CVR, there is inevitably a degree of speculation as to the precise detail of the sequence of events in the minutes and seconds immediately prior to impact”… These words alone introduce speculation on the cause of the accident, so making the

accusation of pilot error unsafe.

8.3 There will always also be a doubt that “outside pressures” might have been a factor in

the decision to fly as ordered and take the passengers to their destination with as little delay as possible. The alternative to a low level, below cloud, VFR flight was to cancel the trip since flight in IFR and icing was precluded. A further option would have been to consider making use of another, possibly fixed wing, aircraft with no such limitations.

The weather on 4 June 1994 was not addressed in sufficient depth nor given sufficient

importance at the time of the accident inquiries or thereafter, hence this paper. The

corroborative evidence of Lt. Avery RN regarding Mr Holbrook’s statements on the

prevailing weather and visibility could be construed to be new evidence which has not

been formally presented before now. It was given as a precognition prior to the FAI but,

in the event, Lt Avery was not called to testify so his professional opinion was not heard.

In consequence of all of the above, THE CONTENTS AND CONCLUSIONS IN THE MAIN BODY

OF THE REPORT REMAIN UNCHANGED, AS DO THE QUESTIONS THAT ARISE THEREFROM.

End of Weather Addendum Part 1 - See Weather Charts on next Page





RAF CHINOOK HC2 ZD 576 ACCIDENT

Mull of Kintyre – 2 June 1994

20 April 2000 Report by


Captain Richard K J HADLOW FRAeSs


With reference to the Addendum 1 of the above captioned report

A. Digest of testimonies by Mr Mark Holbrook the yachtsman, as given in evidence at the RAF

accident Board of Inquiry (President Wing Commander A D PULFORD) and at the Scottish Fatal Accident Inquiry (Sheriff of Strathclyde, Sir Stephen YOUNG).

Mr Holbrook was painstakingly cross-examined by the Crown during the FAI and his statements recorded in minute detail. With reference to this testimony at the FAI, Sheriff Sir Stephen Young said …“in these circumstances, I think that the evidence which he (Mr

Holbrook) gave at this inquiry should be preferred to the statement he gave to the (RAF) Board of Inquiry” … (FAI Determination Page 58).

Mr Holbrook’s evidence

Mr Holbrook the yachtsman stated in evidence at the RAF BOI (Witness 18, RAF BOI Report Part 6, Statements, Pages 6-36 and 37) that when he was sailing ½ to ¾ mile from the lighthouse from 1700 to 1730 hours LT (local time), from one hour to half an hour before the crash, the visibility was 1 mile and low cloud obscured the top of the Mull ... “following the contours of the landmass behind and above the lighthouse which could be seen, with its white perimeter wall” ... At 1745 hours LT (fifteen minutes before the crash), he reported that the visibility was still 1 mile. He then went on to say that when he saw the helicopter near 1755 hours LT ... “the visibility was about 1 mile in haze”. However, when Mr Holbrook testified at the civil Scottish Fatal Accident Inquiry (FAI), he said that just after the end of the (BBC) shipping forecast at 5.55 pm (1755 hours LT), he was sailing some 2 miles Southwest or South of the lighthouse when he estimated the visibility to be “certainly in excess

of 3 miles and possibly 5 miles”. At about that time the yachtsman saw the approaching Chinook, clear of cloud as it passed nearby at 200 to 400 feet above the surface, at the same time as he could also see the land mass of the Mull of Kintyre although he could not then see the light itself, but he reported seeing … “the position of the lighthouse and a white wall to the south of it”. The accident occurred at about 1800 hours LT (exactly 16.59:30 GMT), 15 minutes after he had mentioned a 1 mile visibility during the RAF BOI, whilst he was ½ to ¾ miles from the lighthouse. Mr Holbrook added that at that time (1755), he could also see the Antrim coast and that the visibility could (therefore) be as much as 7 miles. The discrepancy between the evidence of Mr. MURCHIE the lighthouse keeper who could only see 20 metres ahead at the time of the crash and that of Mr Holbrook who was sailing in the clear about 2 miles offshore, is simply explained. Mr Murchie was in the cloud that covered the base of the lighthouse at 250 feet above sea level. (FAI Determination on Page 60).

A Royal Navy meteorologist who was not called to testify (See the Addendum at 6 and the main report at Appendix C), said in a written legal statement that the weather around the Mull of Kintyre can change very quickly. This would account for a comparatively rapid change in visibility to between 3 and 5 miles when the HC2 was sighted as stated in evidence at the FAI. Cloud cover was reported as generally high with sunlight breaking through. It was higher than the top of the Mull and distinct from the low cloud localised over the land mass, hugging the Mull and the top of Sanda (island). (FAI Determination Pages 57 & 58).



Mr Holbrook estimated the speed of the aircraft as close to that of a Sea King helicopter on a search, probably between 60 and 80 knots. It is known that the average airspeed between leaving the zone boundary at Belfast and the first waypoint change was 128 knots IAS, as calculated by Sir Stephen Young (FAI Day 18 Record, Page 2723 at E). The President of the RAF BOI accorded with the

Sheriff’s logical speed determination, when cross-examined at the FAI. The wind was 20 to 30 knots, gusting 35, from the South and Southwest generally. In view of the available evidence, it must be accepted that the pilots were operating within RAF helicopter VFR limits when the HC2 that was seen by Mr Holbrook, passed nearly overhead as he was sailing some 2 miles South or Southwest of the Mull of Kintyre lighthouse. The HC2 was seemingly correctly flown at less than 140 knots IAS, in more than 1km (0.54 nautical miles or 0.621 statute miles) horizontal visibility, in sight of the surface, at a height of between 200 and 400 feet and clear of the cloud which was higher than that covering the base of the lighthouse at 250 feet. The RAF BOI opinion that the weather over the Mull landmass was a contributory factor in the accident is questionable because the poor visibility due to cloud over land was not that experienced on the HC2’s actual flight path to Waypoint 1, as witnessed. It was also unlikely to have been limiting over the sea thereafter, whilst circumnavigating the Mull as planned. All one can say is that the weather may have had an INDIRECT effect because it forced the flight to be planned as a low level VFR operation, to stay clear of cloud in less than +4o C. If weather conditions had been better than forecast, overflight of the Mull area would have been possible at or above the Minimum Safe Altitude of 5900 feet, where any untoward malfunction causing loss of control might not have had the disastrous effect of flight into terrain.

Mr Holbrook’s testimony at the FAI can be described as evidence complementary to that given

at the RAF BOI and should be acknowledged as such in any review of the events.

End of Loose Minute.

Example of Mull cloud cover such as could have occurred on the day of the accident as seen

from the Mull’s North Western approaches

Photo taken at a later date & added in Jan 2010


12 March 2001 ADDENDUM 2 - EMI

ROYAL AIR FORCE

CHINOOK HC 2 ACCIDENT


ADDENDUM 2

Second Addendum to the 2 September 2000 Report

NOTES RELATING TO

ELECTROMAGNETIC INTERFERENCE

EMI

CONSIDERATION OF

ADDITIONAL POSSIBLE CAUSAL FACTORS

PREPARED BY









20 April 2000 ADDENDUM 2 - EMI

CONTENTS 1. Executive summary 2. Rationale 3. Interference from portable devices 4. Mobile telephones 5. Location of interference sensitive electronic components on raf hc2 helicopters 6. Chafed wiring looms 7. HF radio causing interference on hc2 helicopters 8. HC2 helicopter FADEC faults and failures 9. Operational use of HF radios on RAF Chinook HC2 helicopters 10. Use of portable telephones within range of interference sensitive electronic components 11. Other possible sources of EMI that may have caused a loss of control 12. Questions arising 13. Conclusions

APPENDIX 1 ILLUSTRATIONS – CHINOOK HC2 TWIN ROTOR HELICOPTER (6 PAGES) APPENDIX 2 TRANSCRIPTS OF ARTICLES ON EMI IN THE AVIATION PRESS (12 PAGES) APPENDIX 3 UK CAA REPORT ON MOBILE TELEPHONES’ INTERFERENCE IN AIRCRAFT (14 PAGES)

ABBREVIATIONS ADF Automatic Direction Finder Equipment (Gives relative bearing of station tuned) AFCS Automatic Flight Control System BOI Board of Inquiry (RAF) CAA Civil Aviation Authority of the United Kingdom DASH Differential Air-Speed Hold DECU Digital Electronic Control Unit (of the FADEC System) EM Electro-Magnetic EMI Electro-Magnetic Interference FADEC Full Authority Digital Electronic (Engine) Control System GPS Global Positioning System; geostationary satellite based high accuracy navigation system HC1 RAF Chinook twin rotor helicopter – Mark 1 HC2 RAF CHINOOK twin rotor helicopter upgrade from Mark 1 (HC1) standard HF High Frequency radio communications band: 3 to 30 MHz range HZ Radio frequency measurement (1 Hz = 1 cycle per second) IFF Identification Friend or Foe; transponder interrogator to establish aircraft ‘friendly’ identity IR Infra Red IRCM Infra Red Countermeasures (jamming) system; IR defensive equipment to protect aircraft from heat

seeking weapons KHZ Kilo Hertz; (same as Kilocycles); radio frequency measurement (Hz x 1000) MHZ Mega Hertz; (same as Megacycles); radio frequency measurement (KHz x 1000) MOD Ministry of Defence (UK) MOR Mandatory Occurrence Report; CAA technical and operational faults reporting SYSTEM PED Personal Electronic Device; laptop computers, mobile telephones, electronic games, CD players etc., RA Radar Altimeter; or Radio Altitude RAF Royal Air Force RF Radio Frequency RN Royal Navy SSB Single Side Band; HF radio transmission supplementary characteristic SSR Secondary Surveillance Radar TETRA Terrestrial Trunked Radio; a powerful digital long range ‘secure’ mobile telephone radio network used

by public safety and emergency organisations among others who require the increased functionality of TETRA technology over that available to GSM mobile cellular telephone users

UK United Kingdom VHF Very High Frequency radio communications band: 30 to 300MHz range VLF Very Low Frequency radio communications band: 3 to30 KHz range UFCM Undemanded Flying Control Movement UHF Ultra High Frequency radio communications band: 300 to 3000 MHz range


12 March 2001 ADDENDUM 2 – ELECTRO MAGNETIC INTERFERENCE (EMI) 1

ELECTRO MAGNETIC INTERFERENCE

EFFECTS ON AIRCRAFT ELECTRONIC EQUIPMENT

1. Executive Summary

Radio and electronic equipment, in particular portable telephones, can produce interference that exceeds demonstrated shielding protection for certain aircraft equipment. Such interference could affect vital aircraft electronic components, which on the Chinook HC2 include the Automatic Flight Control System (AFCS) with its Differential Air-speed Hold (DASH) capability or the Engine Full Authority Digital Electronic Control System (FADEC) Digital Electronic Control Units (DECUs). It is in this context that it was felt necessary to address the potential for interference which may have affected some or all of the above mentioned systems, possibly caused by a radio transmission or the use of a mobile telephone at about the time of the accident. The possibility that Electro Magnetic Interference (EMI) could have affected the operation of the AFCS or an engine FADEC system is additional and complementary to the points raised as possible causes of the accident, as discussed in the body of the main 20 April 2000 report. Weather aspects were discussed in a first addendum dated 20 August 2000. Any such interference to the AFCS could have caused an Undemanded Flying Control Movement (UFCM) such as a DASH runaway while an EMI induced FADEC malfunction could have resulted in an engine runaway (up) condition leading to a rotor overspeed and possible separation, unless immediate corrective action was taken by the pilot(s).

The possibility that a mobile telephone call may have been made or received by a passenger in

Chinook ZD 576 at about the time of the accident, which occurred at 16:59:30 GMT, was not fully investigated. Such a call could have adversely affected electronic equipment on board, as established by research undertaken by the UK Civil Aviation Authority (Report published 2 May 2000 at Appendix 3 refers). This research is relevant and may be taken as new evidence in support of possible loss of

control due to UFCM and DASH or FADEC failures that should be investigated in a new inquiry into the true cause of this crash. Were any modifications necessary after the helicopter was subjected to a vehicle interference test at Boscombe Down using the Radio Environmental Generator (REG ) during the MOD release trials in 1994 ?

2. Rationale This paper looks into the known effects of Electro-Magnetic Interference on aircraft avionics and electronic equipment, such as on-board computers that control engine operations, navigation equipment or flight control movement and whether EMI may have been a causal factor in the malfunction of a Chinook Mark 2 FADEC DECU or the AFCS, with a consequential loss of control. Radio and other electronic devices produce a surrounding field of electro-magnetic (EM) radiated power during their operation. The strength of interference generated by a particular item of equipment, and the radius of the field of radiated EM power produced, varies in direct proportion to the amount of power used during its operation. As the size of such a radiated field varies, the distance at which poorly shielded radio/electronic equipment may be affected will also vary. The area within which susceptible equipment could be affected is proportional to the power emission that induces the radiation. In turn, that range may be further increased by radiated EM waves bouncing off surfaces around the operating environment, or enhanced by a number of such devices being used simultaneously. EMI is produced in greater or lesser amounts by various types of radio transmission such as on-board HF radio, or outside, fixed, ground located television transmitters, large radar dishes used for satellite surveillance or space communications, radio and telephone communications relay stations or broadcasting aerial arrays and the like. It is therefore necessary to address the possibility of EMI induced malfunctions from whatever source as a possible causal factor in this accident. These aspects were not all fully addressed in depth by any of the reports on this accident.



3. Interference from portable devices

Watches and calculators that use liquid crystal displays, and other low powered items like pacemakers, usually generate negligible interference. However, radio interference of a level sufficient to conflict with sensitive aircraft systems several feet away is known to be generated by much of the following:

Calculators Radio and TV equipment Heart pacemakers (some)

Electronic games Computing equipment Photographic equipment

Tape recorders Word processing equipment Video Cameras

Audio players Time measuring equipment (some) Mobile Telephones

In large aircraft, separation of passengers from sensitive aircraft equipment is usually effective to avoid interference. However, in terms of the separation of passengers and electronic equipment in smaller aircraft such as the Chinook, on flight decks, and where equipment is in use which produces exceptional levels of interference, some aircraft electronic systems may become affected. In fact, airline pilots reporting cases of mobile telephone interference with various aircraft systems have filed many Mandatory Occurrence Reports (MOR) over the years. The problem seems to be almost entirely random and therefore difficult to quantify and pin down, hence further research being undertaken by the CAA. Radiated power electro-magnetic fields that may cause interference with other items of equipment are not only produced by the items listed above, they are also produced during certain aircraft radio broadcast transmissions such as HF radio and extra ‘role equipment’ fitted to satisfy operational requirements. Automatic Direction Finding receivers are probably more susceptible to such interference than other aircraft equipment. Yet it has also been known for autopilots and inertial navigation systems (INS) on large aircraft, such as a B747, to be affected by EMI from laptop computers or video cameras in use near the malfunctioning equipment stowage location. EMI can also be produced by land based sources located within EMI range of the aircraft, such as operating radar dishes, large radio telescopes and terrestrial mobile communications relay stations. This radiated power is known to cause interference to electronic equipment close-by, so special shielding is provided for most aircraft-carried equipment and wiring systems, to minimise such interference and its effects. However, the shielding is not always as effective as it should theoretically be and more positive steps for avoiding interference may be necessary where known circumstances cause degraded operation of other essential systems on board. Transient system faults may be caused by random EMI patterns that cannot be reproduced after the event because the offending environmental situation is no longer present. 4. Mobile telephones Mobile telephones are now in common use in everyday life throughout the world. These telephones are available in a variety of sizes and even the smaller units contain a relatively powerful transmitter to carry the voice signal from the handset to the nearest base station. Portable telephones periodically transmit, even in the “standby” mode. The transmitted signal can be up to ten times stronger than the GPS satellite navigation signal received on board the aircraft. There is therefore an obvious potential for interference. The techniques adopted for portable telephone communications were designed and engineered for use on the ground. Any attempted use in flight causes disruption and degradation of the cellular system or the disconnection of other users. In addition, such transmissions, as mentioned, may cause interference with the aircraft’s own systems, with an adverse effect on safety, in contravention of legal requirements in respect of aircraft certification. Such use also contravenes the conditions of the telephone user’s licence and instructions now issued with each mobile telephone state that they must be switched off on board aircraft, during refuelling of cars and in hospitals, due to the potential for interference. Guidance widely circulated by civil aviation authorities demands that all portable telephones are switched off prior to aircraft engines start on departure and that they remain switched off until the engines are stopped on arrival. Civil operators ensure that check-in and ground handling staff, as well as flight and cabin aircrew, are aware of this restriction and that passengers are briefed accordingly.



5. Location of interference sensitive electronic components on RAF Chinook HC2 helicopters

The two Digital Electronic Control Units (DECU) of the Full Authority Digital Electronic (Engine) Control system (FADEC) are mounted on vibration isolators, in the fuselage and within the aft cabin. The left DECU at station 380 and the right one at station 400 (Appendix 1, Fig 4) are fixed to the upper cabin walls above seating level and are within possible range of an EMI field generated by the HF Radio or from a mobile telephone used in the cabin. A DECU could be as near as 24 inches to a mobile phone in use by the nearest seated passenger and even closer if the caller was standing. (Appendix 1, Fig 4 & 5). The HC2 Electronic Compartment Communications Installation rack (known as the ‘electronics broom cupboard’) is located at the front of the Chinook’s cabin, on the left-hand side and immediately behind the left pilot seat. Equipment boxes are installed on shelves that are reached from the cabin side of the rack. Items located on its shelves include component parts of the VHF and UHF transmitter/receivers systems, a Transponder Identification Friend or Foe (IFF/SSR) interrogator unit, an Auto Direction Finding (ADF) receiver, a radar altimeter (RA) receiver/transmitter and interrelated HF radio component units. Other specialist equipment is also stowed here (Appendix 1, Fig 1). a. HF Radio

HF Radio Single Side Band (SSB) Transmitter/Receiver aerials run along the outside left hand side of the fuselage (Appendix 1 Fig 3) and are linked to component units that are mounted on the fourth shelf from the bottom of the electronic broom cupboard. These include the HF AC power-filter, the HF/SSB aerial tuning unit, the HF power amplifier, the HF power supply and the HF/SSB receiver.

b. Automatic Flight Control System (AFCS)

The two AFCS computers are mounted in the same cupboard, on the shelf immediately below the HF system component units (Appendix 1, Fig 1). They are within inches of HF radio component parts that would produce a strong electro-magnetic field when in use, hence possible EMI. Because of the location of the AFCS computers and their suspect level of effective shielding, AFCS computers could be affected by EMI caused by the HF radio when in use, for example when tuning a frequency or during a transmission. Since the AFCS units are also not very far from adjoining seats, they could theoretically suffer from mobile telephone induced EMI either from a set left in ‘standby’ mode or during a call and from the TETRA system which is used for secure communications. TETRA handsets are at least three times more powerful than more common GSM units, hence their stronger EMI potential. Mobile telephones used further aft in the cabin may still be within EMI range of the AFCS boxes, depending upon the power of the handset EMI field and/or any signals bounced from wall to wall inside the cabin, from a switched-on mobile whether in use or not.

6. Chafed wiring looms Chafed cable shielding is a good EMI point of entry. Chafed wires have often been found in cabling that emerges from the electronic ‘broom cupboard’ of Chinook helicopters, where wires rub against metal behind the outboard area of the rack. All Chinooks, including refurbished HC2 variants with only few flying hours, seem prone to this loom-wire chafing and short-circuiting known to have affected the AFCS. Chafed wires affecting the AFCS have been found behind the left corner of the third shelf down, in the electronics broom cupboard. There, wires are routed rearwards along the inner fuselage surface after a right angle bend where damage occurs when shelf-mountings break because of severe vibration. This causes the chafing when wires are then free to rub against close metal surfaces. In the first week of December 1993 and after unexplained yaw problems in flight at 140 knots, Boscombe Down test pilots suspended flying their HC2 to investigate the problem. Vibrating air pressure tubing that was badly clamped to the electric wire loom behind the radios cupboard reportedly caused the problem in this case. This was the new HC2’s first of at least three ‘groundings’ in the six months before the accident, during its technically protracted entry into Service.



7. HF Radio causing interference on HC2 helicopters

HF transmissions have been known to affect auto pilot operations on the HC2, because the AFCS computer boxes are installed immediately underneath the HF radio system HF tuner units, exciter coils and power supplies. These produce varying amounts of EMI, sometimes seemingly through ill-fitted lids. During air tests flown in accordance with the published Air Test Schedule to clear the helicopter for routine flight operations, some undemanded collective pitch control lever movements were experienced when the AFCS autopilot Barometric Altimeter (Bar-Alt) Altitude Hold was engaged, particularly during HF transmissions in the 3 to 15 Megacycles band. Consequently, HF Radio induced EMI must be

recognised as a major possible source of undemanded flying control movements (UFCM) from

AFCS sources. 8. HC2 helicopter FADEC faults and failures

In the early years of Chinook HC2 service flying, some intermittent failures of the FADEC system were traced to faulty multi-point connectors into the DECU units which were found to have come loose. A loose connector facilitates the entry of EMI by uncovering its plug-pins, which are then no longer properly shielded. Because of this tendency to vibrate loose, a crewmember was expected to check-tighten these connectors every 15 to 30 minutes whilst in flight. Clearly, check-tightening the connectors was a task for one of the two loadmasters. Squadron orders to that effect were published. Among other possible malfunctions, a poorly shielded DECU subjected to EMI could have caused an engine runaway with the dangerous consequence of a rotor overspeed and possible catastrophic separation. The code E5 fault found in the FADEC system memory after the crash pointed to the possibility of such an event. As long ago as 1984, concern was raised within the RAF about the reliability of the radio frequency filter pin connectors introduced in the Chinook. The change was made to prevent RF transmissions causing UFCM. Such pin connectors are still widely used in the RAF and have caused many problems through capacitor failures and earth faults that still cannot be detected with existing test rigs. Hard-wired aircraft, such as the Chinook, are more prone to EMI than aircraft with a ‘Databus’ cabling system like the B.757 where Automatic Flight Control cables are also run in metal tube sheaths for better shielding. It would seem that EMI factors were not addressed in sufficient depth by any of the two formal investigations following the crash. In the light of improved knowledge gained from research, EMI can now be described as providing additional evidence of possible accident causes. 9. Operational use of HF Radios on RAF Chinook HC2 helicopters

At the time of the accident HF radio calls to RAF Strike Command were routinely made every 30 minutes to indicate an “operations normal” situation. In addition, when on missions involving transits from sea to land, a call was made to indicate that the helicopter was “coasting inbound”. Some crews also made a “coasting outbound” call when crossing a coast to fly over the sea. All these HF radio calls, which may have involved tuning the necessary frequency, were obvious sources of EMI that had been known to affect the adjacently mounted AFCS computer boxes. In view of the known occurrence of interference between HF radio boxes and the AFCS computers

mounted immediately below the HF units, any HF radio calls made near the time of the accident

might have produced EMI induced UFCM or they might have affected the operation of one or

more FADEC systems via the cabin wall mounted DECU boxes.

After a 1642 GMT lift-off, ZD 576 made a call at 1646 GMT on HF 4722 KHz, to establish contact with 81 SU (Strike Command Integrated Communications System) Tactical Systems Control South (STICS) and request a ‘listening watch’. No other HF call was reportedly made but it does not rule out the possibility that the crew re-tuned the HF set for some reason, in readiness for their first ‘operations normal’ call.



10. Use of portable telephones within range of interference-sensitive electronic components

It is known that soon after the accident, a senior member of the UK CAA Policy Section contacted the RAF BOI president, Wing Commander Pulford, to point out the increasing number of incidents being reported in commercial aviation and to discuss the question of mobile telephone-induced interference and their possible effect on aircraft avionics, as known at the time. Following a significant number of interference problems world-wide and research to date, it is now suggested that a call from a mobile telephone whilst airborne, particularly if connected to the TETRA system, could have adversely affected the correct operation of one or more of the electronic systems on board ZD 576. Notwithstanding CAA’s experience in this matter since early 1991, the possible effect of such a call was discounted by the RAF BOI President who stated that only one mobile telephone could have had any effect, but did not elaborate the point. However, it is understood that immediately after the crash, security personnel who visited the site of the accident gathered some 17 mobile telephones and took them away for storage. Nothing more was heard of these mobile handsets. Were any of them on stand-by or in use ? Whatever the RAF and MOD positions are in this matter, it is widely believed that a call was indeed

made or received by one of the passengers on the RAF HC2 helicopter ZD 576, close to the time of the accident. The record does not establish if the matter was at any time thoroughly investigated by the RAF, which is not really surprising in the light of current knowledge at that time. If such a mobile call was made, it is not improbable that the EMI it generated could have affected a DECU mounted on the aft cabin walls, particularly if its multi-point connector had vibrated loose. The result might then be a FADEC caused engine ‘runaway up’ leading to a rotor overspeed which would have initiated an increase in collective pitch by the pilots, an uncommanded climb and would have demanded the full attention and efforts of the crew at a crucial moment in the flight. Similarly, a mobile telephone call made from a seat nearer the front of the helicopter’s cabin may have caused the rack mounted AFCS computers to malfunction, causing an UFCM that was unrecoverable in the time available. 11. Other possible sources of EMI that may have caused a loss of control Further to outside sources discussed earlier, it is important also to consider alternative causes of possible EMI that may have adversely affected the HC2 flying controls or its engine fuel metering devices.

a. Operation of the Infra Red Countermeasures (IRCM) system (jamming equipment)

An incident of interference with the flying controls in Northern Ireland when the IRCM jamming system was switched on is well documented in the MOD. Reports indicate that the EMI which caused interference with the flying controls was produced when the IR jammer was switched on (and also off ?). Was the IRCM system being operated by ZD 576 when approaching the Mull area ?

This question should be addressed in the search for possible causes of the accident. b. Other sources of possible outside interference

Outside sources of EMI that could have reached the overflying Chinook HC2 include the possibility of very powerful radar sweeps made by Royal Navy (RN) and other ships in transit, such as trawlers. Strong radio signals made by surface RN vessels or submerged submarines on exercises in the area may have also produced powerful EMI during routine transmissions, with a significant interference range footprint that could have affected a low flying helicopter in certain situations.

Although outside electronic bombardment tests were carried out at Farnborough and at Boscombe Down after the accident, which may have satisfied MOD that outside interference was not to blame, no tests

were carried out combining outside bombardment with a potential EMI effect from inside the fuselage. An operating ‘mobile’ inside the cabin could possibly produce harmonics with an exaggerated effect that may not be evident from normal bombardment tests. It must also be noted that both the Farnborough and the Boscombe Down test reports included in the AAIB report prepared for the RAF BOI were of limited value because they did not address any checks on interference specific to FADEC.



12. Questions arising

A number of questions arise :

a. Why did the RAF BOI President discount the possibility that a mobile telephone, even on standby, could have caused interference with aircraft systems when he was telephoned by a senior CAA staff member who highlighted such problems being experienced by civil aircraft ?

b. In view of the extensive CAA experience of mobile telephones interference with civil aircraft

systems (even when on stand-by), why was the matter of a ‘mobile’ call to or from the aircraft at about the time of the accident and its potential for interference NOT thoroughly investigated ? i. What was done with the mobile handsets recovered from the scene of the accident ? Were

any of them established as being active or on stand-by ? Where are they now and is there a report of what tests were carried out on the sets after the accident, to establish if and when they were last used ?

ii. Mobile phone service providers can provide the duration and exact time of all calls made by

a subscriber and to what number, if not shown on the invoice. The provider can also establish the area from which a call is made. The memory cards of recovered handsets that survived the crash could have also given the date and time of incoming and outgoing calls. Were such checks carried out and what was the result ?

c. Since at least 1991, civil airline crews have been required to brief passengers to switch off and

not use mobile phones on aircraft. At the time of the crash, was it standard operating procedure for military crews to so brief their passengers pre-flight and were ZD 576 passengers accordingly briefed ? Is the use of mobile telephones currently permitted on military aircraft ?

d. Why were all sources of possible EMI that could have affected aircraft systems because of poor

shielding not thoroughly explored and results included in post-accident inquiry reports ? Mobile telephones and HF radio are possible sources of transmission-induced interference that could affect the AFCS, or the FADEC system through a cabin wall-mounted cast aluminium DECU box. This has a multi-point RF filter-pin connector prone to failed capacitors and earth faults which could not be detected using existing test rigs, and which also needed regular manual check-tightening in flight.

e. Why was the problem of chafed wires at the rear of the electronic equipment stowage which

caused the AFCS to malfunction on Chinooks not corrected during the HC1 to HC2 upgrade and why was proper shielding of both EMI emitting equipment and of systems sensitive to EMI not positively achieved, in view of the known cases of actual interference causing UFCM ?

Questions arising cannot be left unanswered. If it becomes evident that not enough effort was made to correct known faults permanently or to obtain data that might have been relevant to establish a possible cause of the crash, then one must ask : why not and who was responsible for this oversight ?

13. Conclusions

This addendum does not seek to claim that EMI caused the crash of ZD 576, rather that it could have led to it. That EMI induced faults could have resulted in an irretrievable situation reinforces doubts as to what may have caused the accident. We now know EMI has the potential to interfere with a number of aircraft systems and can undoubtedly contribute to malfunctions leading to navigational errors, and to engine and flying control problems. It is therefore yet another possible cause that cannot be disproved. Because of this, further misgivings arise about the verdict that the pilots were guilty, WITHOUT ANY

DOUBT WHATSOEVER, of gross negligence. As such, the subjective finding of gross negligence by the

pilots becomes even less safe. END


12 March 2001 ADDENDUM 2 – EMI - HC2 ILLUSTRATIONS Appendix 1 - 1

ADDENDUM 2 APPENDIX 1 - EMI

ILLUSTRATIONS

Chinook HC2 Twin Rotor Helicopter

Figure 1. Electronics Compartment Figure 2. Cabin Communications Stations Figure 3. Communications Antenna Installation Figure 4. DECU location diagram and brief Figure 5. Troop seats and stretchers Figure 6. Cabin seat and stretcher configuration descriptive 3














12 March 2001 ADDENDUM 2 – EMI - ARTICLES Appendix 2 -1


TRANSCRIPTS

ARTICLES ON EMI IN THE AVIATION PRESS

1. EMI Affecting Aircraft Equipment

1.1 Outside interference 1.1.1 Canadian helicopter problems with EMI 1.1.2. Russian Built NAGIRA radar interference

1.2 EMI from within the aircraft affecting operations 1.2.1 Interference during an approach 1.2.2 EMI Entry points

2. Portable Electronic Devices (PED) Problem PEDs – Avoiding the stray CAT II Strut

3. Interference from special mobile communications systems 3.1 Terrestrial Trunk Radio (TETRA) - Static and Silence

3.2 Mobile Test Equipment



1. ELECTRO MAGNETIC INTERFERENCE AFFECTING AIRCRAFT EQUIPMENT 1.1 OUTSIDE (GROUND-BASED) INTERFERENCE 1.1.1 Cormorants may be crash prone (By David Pugliese of The Ottawa Citizen)

Canada's new high-tech search-and-rescue helicopter may not be able to handle intense electrical fields, a problem that could cause it to crash if it flies too close to television and radio transmitters or ships, warns a Canadian Forces study. Department of National defence officials are studying how susceptible the new Cormorant helicopter is to electromagnetic fields generated by civilian radar and navigation beacons, or TV and radio transmitters dotting the country. The intense electromagnetic fields created by such devices can be strong enough to disrupt flight controls on high-tech helicopters and have already caused the crashes of several U.S. military helicopters. Canadian Forces safety officials warn the Cormorant may have insufficient protection against the electromagnetic fields, which could result in crashes or emergency landings. "Of particular concern are the electronic instrumentation systems and the digital engine controls, both of which could cause catastrophic failures" states a December 1999 military report released to the Citizen under the access of information Act. Another major concern is the effect of such electromagnetic fields at sea because of radio transmitters onboard ships. Search-and-rescue helicopters are frequently used to rescue injured sailors from vessels and at times hover within 50 feet of ships and communication masts. "It may not be possible to prove with existing data that the Cormorant will be safe to fly near ships and future additional investigation will be required to establish this parameter", two Canadian Forces generals were told in a briefing in January.

1.1.2 The Russian-built NAGIRA radar

(Source : The INTERNET)

The Russian built NAGIRA radar produces short powerful pulses with the following characteristics: 10 GHz fixed frequency, 5 nanoseconds pulse length, 300MW peak power, 2 Joules per pulse, 150 Hz pulse repetition rate. NAGIRA was purchased by the UK MOD and was delivered to defence Research and Evaluation agency (DERA) Frazer, near Portsmouth in November 1995. Indications are that UK will use NAGIRA to investigate detection of fast moving targets in sea clutter, to study electromagnetic-pulse penetration into equipment and to measure the effectiveness of front-end protection devices. During initial field trials near Nizhny Novgorod, NAGIRA was able to track a helicopter at more than 150 km range and at altitudes as low as 50 metres. We understand that because of electromagnetic interference (EMI) concerns, Russian helicopters were not allowed to operate within several miles of the radar when it was operating at full power. Comment : Could a radar such as this have affected ZD 576 ?

1.2. REPORTS OF EMI FROM WITHIN THE AIRCRAFT AFFECTING OPERATIONS

(Source : The INTERNET) 1.2.1 (On interference experienced during an approach)

There was one incident reported with a B737-200. During an approach to MAN (Manchester International, UK), the localiser (LOC) for landing on runway 24 oscillated and centered; with the aircraft not on track (but offset), confirmed visually. Ground equipment was monitored and working normally. When a GSM (mobile telephone) in the cabin was switched off, all indications became correct. Frank McCormick, an aerospace engineering colleague who is also a FAA designated Engineering Representative, wonders about the physics of such possible incidents. The threat levels presented by the gadgetry in question :- personal computers, cellular phones, compact disk players, hand-held video games and so on - are mere background noise compared to the



threat levels that must be demonstrated during environmental qualification testing [of the aircraft systems]. How could an FMC (Flight Management Computer) pass, say DO-160C [standard certification] tests, yet lose its mind in the presence of a cell phone on standby ?

1.2.2 (On EMI entry points)

Peter Mellor, of the Centre for Software Reliability at City University in London, reports that the cabling on the A320 has not only been tested for resilience to "normal" EMI, but for its ability to withstand the much greater pulse that would result from the aircraft flying through a powerful radar beam, for example. While doubting that the suspected-EMI phenomenon is ubiquitous, McCormick suggests that some sort of systematic investigation could proceed by inviting protagonists (actual airplane pilots and customers with a suspect device) to participate in attempts to reproduce the incidents. Berger reports that in fact very few systematic tests are performed anyway: he asked a major portable phone manufacturer's representative what tests they performed for EMI from their devices in aircraft. The manufacturer performed none because use of cellphones is illegal in aircraft. Berger notes that nevertheless such tests are relevant, because these phones are frequently used surreptitiously or inadvertently on aircraft. He also notes that most electromagnetic interference testing is 'bench-testing', performed on independent subsystems, and that this may suggest an interesting suspect point of weakness in the aircraft, namely the system interconnections. Recall one of the incidents he noted above: neither the electronics nor the well-shielded wiring itself, but the wiring connections seem to have been problematic. He reports incidents to specific aircraft (whose registration tail numbers' are also given in the reports).

a. On a B737-300, a MCP (mode control panel) was doing weird stuff intermittently during

several flights. I mean really weird: like letting both pitch and auto-throttle fight each other to maintain speed. Nearly all boxes involved (MCP, FCC, several AFDS boxes) were changed before a clever mechanic found out that the windshield heat was not correctly grounded. This is located just a few inches from the MCP and is one of the big consumers on board. Tightening a few nuts solved an engineer's nightmare.

b. On a specific B737-400, the FMC was doing weird things, mainly in cruise. Some pilots

reported that after a request to the passengers to switch off electronic equipment, the problem was solved, others said it did not help anything even with every electronic gadget switched off in the cabin. Others reported nothing abnormal with CD's, PC's, 'Gameboys' and more of that stuff trying to jam the system unsuccessfully. Troubleshooting was done and it was decided to replace another black box that was suspected. It was pulled out but no spare was available. So the same black box was pushed in again. Problem solved, it never happened again !

Connections are a possible weak point and difficult to duplicate if a problem exists. Can an imperfect connection make a tested system EMI susceptible or not ? END


12 March 20 01 ADDENDUM 2 - (EMI) - ARTICLES Appendix 2 - 4

PORTABLE ELECTRONIC DEVICES

2. PORTABLE ELECTRONIC DEVICES

PROBLEM PEDS -AVOIDING THE STRAY CAT II STRUT

(Business and Commercial Aviation – December 2000)

By Robert N. Rossier Photographs by Paul Bowen

Ladies and gentlemen, we’ll have to ask at this time that you turn off all your: portable electronic devices including laptops, electronic games and cell phones. Once we're airborne and on our way, we'll let you know when you can turn your computers and electronic games back on. Cell phones must be turned off for the duration of the flight." Spewing off a warning about portable electronic devices (PEDs has become as familiar a mantra to flight crews as the Miranda warning is to law enforcement officers. The flying public, not to mention some pilots, find it hard to believe that something as innocuous as a laptop computer, cellular phone or a kid's ‘Game Boy’ could in any way affect the operation of an aircraft. The truth is, stray signals from these devices can, and probably have, caused aircraft to stray from course. If you think it can't happen to you, think again.

→ A regional jet flying from Salt Lake City to Eugene, Ore., received three separate warnings of discrepancies between the captain's and first officer's instruments. In question were the heading, airspeed and altitude. After the flight attendants checked the cabin for passengers using PEDs and had the devices turned off, discrepancies disappeared.

→ An aircraft on approach to Houston’s George Bush Intercontinental Airport in August l999 was advised that it was four miles off course. The CDIs had been scalloping left and right of center, so the captain ordered the flight attendant to check the cabin for any passengers using a PED. Within 15 seconds, the problem disappeared. A passenger had been using a portable computer.

→ In May 1995, the first officer of a Boeing 737 noted erratic readings from the electric compass indicators. The flight attendant made a sweep of the cabin for PEDs and found a passenger using a compact disc player. When the

player was turned off, the instruments returned to normal. These are just a few examples of reports made by pilots and flight crews. In fact numerous incidents have been reported wherein CD players, laptop computers and electronic games have interfered with the operation of navigational equipment and communication radios. The NASA Aviation Safety Reporting System (ASRS) has received more than 50 reports involving alleged PEDs interference. The International Air Transport Association (IATA) has received some 40 such reports, and the European Confidential Aviation Safety Reporting Network (EUCARE) some 60 reports. This most likely represents only the tip of the proverbial iceberg. Pilots are often reluctant to write up problems that go away, cannot be duplicated, or might potentially ground their aircraft without good cause. Often, the problems arise during the cruise portion of flight when PED use is allowed. In more than a few reported cases, aircraft have followed erroneous or erratic navigational data during an instrument approach, only to find that passengers were using computers and other electronic devices during the approach. In most cases, no problems were found with the aircraft equipment, or other aircraft using the same ground facilities. In a worse case situation, such a "stray CAT II strut" could prove fatal, and it's unlikely that PED interference would he identified as the cause. Unfortunately, the effects of PED interference are difficult to reproduce, leaving the door open for sceptics who refute the claims that PEDs pose a problem. The Nature of the Problem

So how is it that a seemingly innocent laptop computer or electronic toy could have such malevolent effects? Consider that a VOR transmitter' operates at relatively low power, typically 120 to 140 watts (compared to thousands of watts for a typical FM radio station). Despite the low power, we receive and track those signals from distances greater than 100 miles.




Receiving signals from a distant VOR is like trying to hear a pin drop at a rock concert, and to be successful, the receivers on the aircraft must be very sensitive. To tune out some of the background electronic "noise," all electronics on the aircraft are electromagnetically shielded to avoid electromagnetic interference (EMI). The desired navigation signal is received via an externally mounted antenna tuned to the specific frequency band wavelength in question. Like anything that operates electronically, laptop computers, CD players, electronic games and other consumer electronics generate a weak electromagnetic field at the operating frequency of their processor. Typically, these processors operate anywhere from around 28 MHz for a CD player to over 500 MHz for a modern laptop computer. Moreover, additional weaker electromagnetic fields called harmonics are

generated at multiples and fractions of the primary frequency. The fourth harmonic for a CD player with a 28 MHz clock speed is at 112MHz - right in the middle of the VOR frequency band. When it comes to portable computers, the more powerful the processor, the more complex the processing and the more densely packed the electronics, the greater the potential for electromagnetic emissions. As EMI engineer Finbarr O'Connor of the Illinois Institute of Technology explains, "Since the various chips in a single device may operate at different frequencies, we find these devices emitting a broad spectrum of frequencies." Often, the electromagnetic radiation produced by a laptop computer falls within the range of an aircraft's vast array of navigation and communications equipment. (see aircraft frequency band table below).

_______________________________________________________________________________________

Aircraft Frequency Bands Modern aircraft electronics utilise a surprisingly broad range of frequencies that dot the electromagnetic spectrum. Typical frequencies used include :

Omega Navigation 10 kHz to 14 kHz

ADF 190 kHz to 1,750 kHz

HF Communications 2MHz to 118MHz

Marker Beacons 74.85, 75.00 & 75.15 MHz

VOR/Localiser 108 MHz to 117.95 MHz

VHF communications 118 to 136 MHz & 225 to 339 MHz

Glide slope 328 MHz to 335 MHz

DME 960 MHz to 1220 MHz

TCAS 1030 MHz to 1090 MHz

GPS 1575 MHz, 2 MHz bandwidth

Satellite Communications 1529 MHz to 1661 MHz

Low range radio altimeter 4.3GHz

MLS 5.03 GHz to 5.09 GHz

Weather Radar 5.4 GHz to 9.3 GHz

_______________________________________________________________________________________

Electronics manufacturers construct their devices with shielding designed to limit electromagnetic radiation.. All consumer electronics capable of radiating electromagnetic energy, such as portable phones, television sets, CD players, radios and home computers, must comply with the requirements of Federal Communications Commission Part 15 in order to be sold in the United States. Although compliance with the FCC standards helps reduce the potential for EMI between various consumer electronics, interference between such devices still occurs. Just turn your head while talking on a portable

phone, or touch the antenna on your ‘boom-box’ and you'll likely note some subtle effects of EMl. Owner's manuals typically instruct consumers to reposition interfering items, move them farther apart, and to plug them in different electrical circuits. On an aircraft, the problem of EMI is magnified. To begin with, the allowed radiation from an FCC Part 15 certified device, measured at a distance of three meters from the device, is in some cases greater than the minimum signal intensity within the service volume of a ‘navaid’. That is, the




device can legally emit a signal stronger than the one an aircraft's navigation system is looking for. The Part 15 limits for PED radiation in the VOR frequency range (roughly 108 MHz to 118 MHz) is more than 50 percent greater than the minimum signal intensity in the service volume of a VOR, and almost four times the minimum signal intensity in the service volume for localisers. At the higher frequency of a GPS, the Part 15 device can emit a signal more than 10 times stronger than a GPS signal. Clearly, a PED that meets the FCC Part 15 requirements has the potential to interfere with a navigation receiver aboard an aircraft, but even weaker signals can cause problems. While a strong emission from a PED might interfere with a ‘navaid’ ID, or cause a NAV (navigation failure) flag to be displayed, a weak signal might simply deflect the CDI needle, providing false navigation data if the signal should reach the antenna. Generally speaking, the aluminium fuselage of a modern aircraft serves as an effective shield against the electromagnetic radiation from a PED that might reach an antenna outside the aircraft, but geometry can alter that effect as well. The fuselage of the aircraft can be likened to a tin can with windows representing holes along the sides. Inside the fuselage, the electromagnetic radiation from the laptops and electronic games bounces around like a ping-pong ball, intensifying like echoes in an empty room until it escapes through a hole. In some larger aircraft, the antennas might be sufficiently far away to preclude a problem, but in smaller aircraft, the proximity of PEDs and antennas is greater. As more composite materials are used in fuselage design, the effectiveness of the fuselage as an electromagnetic shield is diminished. When Talk Isn’t Cheap Cellular phones fall into a different category from other portable electronics, and represent an even greater potential safety hazard aboard an aircraft. Unlike other electronic devices, which are shielded to limit electromagnetic emissions, cellular phones are intentional transmitters and emit much more powerful signals Cellular phone use in the United States is regulated by the FCC. On the ground, a cellular phone has limited range, and must interface with

a nearby repeater station that picks up its transmission and relays it along the network. The limited range means that the same frequency can be used in multiple locations, serving multiple markets. When a cellular phone is operated at altitude in an aircraft, even at just a few hundred feet above the ground, it has the capability of transmitting to several stations simultaneously, essentially tying-up a frequency and messing up a whole network. The result is chaos to a degree that cannot be tolerated by the cellular service providers or the FCC. In December 1991, the FCC adopted 47 CFR 22.925, which prohibits the use of cell-phones after an aircraft has left the ground. On top of the network chaos lies the same "echoes-in-the-tin-can" syndrome that, like a laptop computer or electronic game, can cause interference with an aircraft's navigation and communications systems. Only, in this case, the problem is intensified due to the more powerful signal emissions. Numerous instances when a cellular phone was suspected of unwittingly altering the course of an airliner's journey have been reported through the ASRS. In one incident, a commuter flight had departed Roanoke Regional Airport en route to Washington Dulles. Before the departure, the captain and first officer checked their directional gyros and found them to be operating properly - providing the correct aircraft heading information. On departure, ATC cleared the flight directly to the Montebello VOR, and then along an airway designated V 143. Ten miles before reaching the Montebello VOR, the navigational instruments tuned to that VOR became erratic. The crew followed an approximate heading that should have taken them to the VOR, then turned to intercept the next ‘victor airway’. About 10 miles from the VOR when the HSI and RMI showed the aircraft on course, ATC informed the flight crew that they were well right of course and issued them a heading. When the flight crew, compared their two directional gyros, they found a 15 degree discrepancy. A cabin inspection revealed a passenger using a cellular phone. When the phone was turned off, the VOR signals stabilised and the two directional gyros lined up within two degrees of one another. In a similar case, the flight crew of a MD-80 had both navigational display CDIs oscillate off scale




to the right. Again, a cabin inspection turned up a passenger using a cell phone. When the phone was turned off, the navigation displays returned to normal. A Real Problem ?

Although attempts to reproduce the specific interference experienced on a particular flight have been futile, experts seem to agree at least on the potential for PED interference. The RTCA (formerly the Radio Technical Commission for Aeronautics) has conducted three studies over the past three and one-half decades to assess the dangers. The studies concluded that at least eight conditions would have to occur simultaneously to create an interference problem. These eight conditions, which relate to such factors as emission frequencies, reflection paths (wing and control surfaces off which the signals could bounce), and location of the PED in the cabin, make it highly unlikely that a problem would develop. Still, one unofficial survey found that six percent of all passengers use PEDs on domestic airline flights, and the number is growing. Considering the number of flights and the increased number of passengers using PEDs on flights, even a low probability can result in occurrences. Furthermore, the RTCA reports note that the vulnerability of aircraft navigation and communication systems may be greatest during landing and takeoff phases due to the proximity of numerous interference sources such as cable TV networks and FM broadcast stations. Considering that roughly 21 percent of all fatal jet aircraft accidents occur during takeoff and initial climb, and more than 45 percent occur during final approach and landing, the potential for a life-threatening situation seems likely. A study conducted by Boeing evaluated 16 cellular phones in both laboratory and on-aircraft tests. The lab results revealed that cellular phone emissions occurred not only at their operating frequency but also within the ranges of ADF, VOR, 1LS and VHF communications frequencies, although no susceptibility of aircraft systems was observed during the test. However, an ongoing study conducted by the British Civil Aviation Authority (CAA) measured interference from cellular phones on Boeing 737 and 747 aircraft and found that interference levels created by a cellular phone near the flight deck and avionics bay are higher than the susceptibility

levels of the aircraft systems. The result of the first phase of the study, published in May (2000), concluded that the ban on cellular phone use should be continued. (See also Appendix 3 of

this addendum)

Installed Electronics

The issue of PEDs begs the question of similar equipment provided as entertainment and conveniences to passengers. Can the electronics installed on our aircraft - videotape players, sound systems and phones - also create emissions destined to foul the navigational systems of our aircraft ? The short answer is "no," as long as the equipment meets the required specs, and is installed and tested by an FAA-approved repair station or an air carrier’s approved maintenance organisation. First, electronics to be installed in an aircraft must meet specific requirements for electromagnetic emissions. These requirements, identified in RTCA DO-160D, Environmental Procedures and Test Procedures for Airborne Equipment (also AC 21-16D), are much more stringent than FCC Part 15. By meeting these requirements, the chances of interference with sensitive aircraft navigation and communications receivers are greatly reduced. Part of the approved installation process is a test to verify that the equipment causes no interference. The installed electronics are tested with the cockpit instrumentation to check for interference. The first time an approved device is installed in a new model of aircraft, a flight test may be required to verify compatibility and that no interference occurs. In the case of ‘airphones’ provided on many commercial and business aircraft, not only is the system designed and tested to be compatible with the aircraft, but an alternative technology is employed. Airphones employ satellite-based communication systems rather than ground based systems and operate on an entirely different range of frequencies than cellular networks on the ground. In Search of Solutions

Despite the cries of those who deny the legitimacy of such claims, the PED interference issue appears to be real, and is the subject of ongoing investigations. As the issue of portable




electronic devices heats up, several potential solutions have been offered. One is to provide shielded power supplies for PEDs aboard aircraft, but the power supply is only part of the problem. PEDs can radiate electromagnetic emissions regardless of the power source, and concerns have been expressed over the PEDs corrupting the aircraft's power distribution system. Perhaps a better solution is to build lap-tops and other consumer electronics that meet the stricter requirements of RTCA DO-160D. In fact, some airlines are considering certification of certain models of PEDs as safe for use on aircraft. One recently patented concept, a microprocessor controlled power supply cable, could supply power only to approved PEDs. Again, this is only a partial solution. While it may be possible to build devices that meet the requirements when new, there is no guarantee that they will still meet them when carried aboard an aircraft and turned on. Rough handling or dropping an electronic device can degrade the shielding, even without affecting its outward performance. In the process of adding a new processor card or additional memory to a laptop, the owner or technician may inadvertently remove shielding or reconfigure the device in such a way that renders the shielding ineffective. In addition, many processor cards and peripheral cables are

not required to meet the FCC specifications, and devices are not tested in all possible configurations. Simply change the location of the PED, or plug in a peripheral device, and a whole new interference problem can arise. Due to the critical nature of the PED emission problem, a device would have to be tested before use, much the same as an installed electronic device that meets the specs. As a result of a recent Subcommittee on Aviation Hearing on Portable Electronic Devices, NASA Langley and Delta Air Lines are negotiating a co-operative agreement for a three-year study of PED interference. Delta will provide access to its passenger aircraft for test purposes, and NASA will attempt to identify specific aircraft system anomalies caused by PEDs. Only time will tell whether the study will yield meaningful results. Meanwhile, perhaps the best solution is to continue briefing our passengers and warning them of the potential dangers. When suspicious navigation or communications problems develop, it's time to reinforce the warning, and ask that all devices be turned off. The more we learn about PED interference, and the more we share with our passengers, the better understood the problem becomes. END

(Business and Commercial Aviation)

(December 2000)




PASSENGER WARNINGS

(Business and Commercial Aviation – December 2000) While most operators provide some form of warning to their passengers against the use of portable electronic devices, the perception of the potential problem and the specifics of the warnings do vary. As pilot Bill Capozzi of CitationShares in White Plains N.Y. notes. “I’m not aware of any PED interference problems on our aircraft. Most of the passengers we fly are fractional owners who fly frequently. They know to turn off their cell phones when we start the engines. We do allow laptops to be used during the en route portion of the flight”. Bruce Rockwell, a Citation Ultra captain for Executive Jet : ”We take all of our passengers’ safety problems very seriously” says Rockwell. “Like the major airlines, we do not allow PED use below 10,000 feet, and, of course, cell phones are prohibited entirely. We feel it is important to warn against cell phone use not just because it is regulatory, but as a courtesy to our passengers. We’ve heard of passengers incurring cell phone charges in the order of thousands of dollars when the devices were used in flight. This could happen either as a result of fines or multiple roaming charges when their phones trigger a multitude of stations on the ground. Beyond the regulatory requirements that prohibit PED use during the take-off and landing phases, some operators require further precautions. As Larry Washburn, a Citation VII pilot with Richmond Aviation explains : “ If we see a passenger with a laptop computer on board, we’re required to inform him not to use the computer unless specific permission is received from the Captain”. END

REPORTING PED INTERFERENCE

(Business and Commercial Aviation – December 2000) While the potential of PED interference with aircraft communications and navigation is well recognised, further documentation of incidents can help database development and other efforts designed to stem the tide of PED problems in flight. NASA’s ASRS collects and disseminates information on PED interference. Pilots who experience PED interference are encouraged to submit a report. Forms are available on-line at : http // asrs.arc.nas.gov. In addition to ASRS, pilots are encouraged to report any PED interference to the local Flight Standards District for forwarding to the FAA Flight Standards National Field Office, AFS-500. Pilots operating under FAR Part 121 or 135 certificates should follow company reporting procedures involving PED interference. When documenting PED interference, it’s best to establish a cause and effect relationship by turning-off the offending PED(s), noting resolution of the problem and turning the PED(s) back on to verify the problem. If the problem can be traced to a PED, the most valuable report will include the make and model of the PED, identification of the PED operating mode and any peripherals in use, seat location of the PED, flight phase and (geographic) location, and a thorough description of the anomaly, including frequencies tuned and the operating modes of affected systems. END


12 March 20 01 ADDENDUM 2 – (EMI) - ARTICLES Appendix 2 - 10

TETRA - COMMUNICATIONS NETWORKS

3. INTERFERENCE FROM SPECIAL MOBILE COMMUNICATIONS SYSTEMS Terrestrial Trunk Radio (TETRA) Induced Interference

3.1 STATIC AND SILENCE

The growth of electric devices creates a hostile environment for communications equipment

Article by Matt YOUSON

ENGINEERING – February 2001 When pollution is discussed thoughts invariably turn to the detrimental effect that industrial and post-industrial society has had on the natural world. But pollution does not have to come in the form of oil slicks and landfill and the environment doesn’t necessarily refer only to wilderness and coastlines. Awareness of noise and light as pollutants that affect the urban and sub-urban environments in which most of us live has become well established, and now another technology-based problem is entering more into public perception - electromagnetic interference. Anybody with a mobile phone has experienced the interference on nearby devices (landlines, audio speakers, and so on) just before it rings, as the station and base-set connect. This is a very trivial example of interference between electronic devices. On a more serious level, electromagnetic interference in combination with poor shielding has been known to cause fatalities. Take, as an example, the well-reported case of paramedics transporting a heart attack victim to hospital. The patient was attached to a monitor/defibrillator that stopped functioning each time the ambulance crew radioed for advice, leading in part to the death of the patient. When the incident was investigated, it was established that the monitor/defibrillator was exposed to intense interference from a new long-range antenna fitted to the vehicle. Shielding to the interior of the vehicle had also been reduced when the metal roof had been replaced with a fibreglass substitute. Constraints Electro-magnetic Compatibility (EMC) is defined as the ability of a product to operate within its intended electromagnetic environment and to accept or emit RF disturbances within certain defined constraints. EMC engineering has a two-fold task. The first of these is immunity – ensuring that devices are sufficiently well shielded to function properly (and in the case of devices requiring outside signals, a sufficiently wide signal to noise ratio to communicate as required). The second factor, emissions, concedes that anything capable of generating EMI/RFI of some order

must be properly analysed, controlled and where necessary suppressed. While the problem of EMI/RFI is no means new, public awareness has grown in recent years with the increased availability of wireless devices; mobile phones, obviously, but also everyday items such as remote controls, security lighting and keyless entry systems. Keyless entry, in particular when used in automotive applications, has been useful to highlight the problems which can arise when signal to noise ratios are not adequate. When the Terrestrial Trunk Radio (TETRA) communications network was launched in 1999, it was reported that if parked near a TETRA base station, owners of vehicles equipped with keyless entry could not lock or unlock their vehicles. TETRA is a digital radio network similar to the GSM phone network but intended for business users such as taxi companies, fleet operators and site radios. It combines the features of mobile cellular telephony, fast data communication and the workgroup capabilities of mobile radio and is in use with many public safety and emergency organisations. The technology behind TETRA increases functionality over that available to GSM users, with abilities such as ‘press to talk’ instant call set-up for individual and group calls and packet data transfer operating at up to 28.8 kbps. The first TETRA licence in the UK was awarded to Dolphin Telecom and, naturally, the company began receiving complaints from drivers. ‘Not guilty’ claimed Dolphin. The fault, they said, lay with the users of keyless entry system or SRDs (short-range devices), as they are known. Dolphin operates its communications network at specific assigned frequencies in the 410 to 430 MHz range of the spectrum. Dolphin’s network initially comprised around 450 base stations transmitting on a range of frequencies from 420 to 425 MHz, with vehicle installed mobiles and portable handsets transmitting between 410 to 415 MHz. Base station carriers transmit continuously, at an effective radiated power of approximately 25W.




Sensitive Dolphin does not transmit at the particular frequencies allocated to SRDs. However because the band allocated to the SRDs (418 MHz) is close to that of the frequencies used by Dolphin, early experience suggested that some SRD receivers, thanks to poor selectivity, were unduly sensitive to frequencies either side of their operating frequency (either 418 or 433.92 MHz). These, particularly if operating at 418MHz, were influenced by Dolphin’s transmissions (and in some cases rendered inoperable) if located close to TETRA base stations. When the problem first surfaced the TETRA network was not using the 415 to 420MHz region, that is, the spectrum -3MHz and +2MHz of the low power band at 418 MHz. When SRDs began using the 418 MHz frequency it was a relatively 'quiet' zone, and therefore some types of receiver were not designed with sufficient rejection performance to the presence of high power base stations between 2 and 7 MHz high of 418MHz - the range in use by TETRA. A committee called RAKE (standing for Remote Keyless Entry) was established to find a solution to the problem of radio-key interference. RAKE counts amongst its members the Low Power Radio Association, the Society of Motor Manufacturers and Traders, the AA, the RAC, the European Vehicle Security Association, the Motor Industry Research Association (MIRA), the Police Scientific Development Branch, the Radio Society of Great Britain and the Radio Communications Agency. The position of RAKE is that this problem can be resolved by vehicle and security system manufacturers improving system designs. The long term RAKE objective is to establish, in conjunction with the UK Radio communications Agency and its European counterparts, an

appropriate frequency, and ideally, one allocated solely for radio key entry systems. Problems Allocating frequencies on top of one another may seem somewhat short-sighted but, as John Pope, leader of the Electronics Group at MIRA, explains. "One of the big problems that we have, in terms of communications, is the RF spectrum. It’s a limited resource, just the same as any other resource we have. It is finite. The frequency range goes from 0 up to 400GHz but the International Telecommunications Union allocates the bands that people can use for particular functions. The TETRA mobile communications system operates at an adjacent frequency to that used by remote keyless entry systems so that if you park your car near one of these transmitters you may not be able to lock it or even worse, get back into it.” Problems such as that experienced between the SRDs and TETRA can often be resolved reasonably easily, but usually there is a financial penalty. Pope continues : “Instead of having a relatively low-cost, wide open front end on the receiver, it has to be a narrow band receiver which will increase the cost. That is the only way that you are going to be able to filter-out adjacent transmissions.” Of course automotive EMC problems amount for one small area among many. It’s just that in a vehicle, a large number of systems are present in a relatively small area. There are reports of EM Interference causing problems in everything from industrial robots to cat flaps. (There is a recorded case of high-tech cat flap with magnetic locks located in a computer room rattling every time a certain PC was booted). With the environment seeing a greater saturation of technology, the problem is liable to get worse – anything from a waste disposal unit to a portable fan can create havoc END.

____________________________________________________________________________




3.2 TEST EQUIPMENT

MOBILE ELECTRO MAGNETIC CAPACITY (EMC) TEST EQUIPMENT Traditionally, open area test sites (OATS) and semi-anechoic chambers (SACS) have been the mainstay of Electro-Magnetic Capability (EMC) testing. These are expensive - DERA's new aircraft and helicopter oval SAC chamber, designed and installed by Rainford EMC at Boscombe Down, cost over £1 million - and while this size of investment may be consistent with testing large assemblies such as aircraft or vehicles, it looks disproportionate for small, low-cost items. The Gigahertz Transverse Electromagnetic Mode (GTEM) cell is a field-generating device, which represents a significant advance in EMC testing. The GTEM, typically a compact tapered coaxial TEM, provides a controlled low ambient environment for quickly performing both emissions and immunity testing in the same cell with minimal change in the test set up. It represents a considerably cheaper option that a SAC, FAC (full anechoic chamber) or OATS for small devices and in some instances is mobile. GTEMs permit EMC testing in-house at test laboratories and QA test centres. The correlation between GTEM and OATS results was an area of concern when the devices originally appeared, but verification and approvals by many certification laboratories, including BSI, show a good correlation of results. Acceptance of the GTEM technique as an easy and convenient way to perform radiated EMC testing in the lab is growing. The method can be used for immunity compliance testing to IEC 61000-4-3, and for emissions pre-compliance (and in some cases, compliance) to FCC and ANSI C63.4. Because of the proliferation of smaller equipment, the trend is towards creating smaller cells. Schaffner-MEB has launched a new range of GTEM test cells called GTEM 'Lite'. The cells are self-contained test chambers for radiated EMC tests to 5GHz (immunity) and 2GHz (emissions). The smaller cells (up to 550mm septum height) in the ‘Lite’ range are suitable for testing of small, battery-powered devices, mobile phones and pagers for example. Rear access to the equipment under test makes set-up quicker and allows engineers to make adjustments between tests with greater ease. END ENGINEERING February 2001


12 March 20 01 ADDENDUM 2 – (EMI) - UK CAA REPORT Appendix 2 - 1

MOBILE PHONES EFFECT


UNITED KINGDOM

CIVIL AVIATION AUTHORITY

REPORT

A STUDY OF

INTERFERENCE LEVELS IN AIRCRAFT AT

RADIO FREQUENCIES USED BY PORTABLE TELEPHONES

Published 2 May 2000

(14 pages)


































End of CAA report Monday 26 February 2001




RAF Chinook HC2 Accident, Mull of Kintyre - 2 June 1994 Questions on EMI aspects

Some of the questions that arise from the EMI addendum and offered in bold print hereunder. It is believed that a mobile telephone call was made to or from the aircraft at about the time of the accident. This was more than possible since so many of the passengers carried a personal mobile. In which case, why was this matter not thoroughly investigated at the time and positive proof offered to establish that no such call was made ? If the receivers were totally destroyed, all that was needed was to check the subscriber’s bill for the period, to establish if he made a call at about the time of the accident. Was this check ever carried out and what was the result ? Similarly, calls to any of the mobiles on board could have been made. Is there a way to establish if a call was made TO the aircraft, without checking the receiver memory ? An attempt should be made to establish if such a call was received. Was an attempt ever made at obtaining the record of such a call or calls, and if not why not ? If a call was made, then why were ALL telephones NOT switched off during flight ? Were the passengers briefed before the flight that mobile phone calls were prohibited when in the aircraft ? Furthermore, passengers should have been instructed to turn their phones off and not leave them on standby whilst in the aircraft. If not, why not ? At the time of the accident, in respect of general flight operations, were there instructions to the effect that mobile telephones were to be off at all times in the aircraft. If not, why not ? It is reported that all mobile telephones found at the scene of the accident, were removed from area. What was done with them ? ... and where are they now ? Was each recovered handset memory checked for incoming or outgoing calls and their date and time ? When a senior Civil Aviation Regulatory Authority telephoned Wing Commander PULFORD (the RAF BOI President) during or after the RAF BOI inquiry, to discuss the possibility of mobile telephone induced EMI being a causal factor, why did the latter refute the possibility of EMI affecting on-board electronic equipment; and on what grounds ? Also why would Pulford not admit to a phone call being made at about the time of the accident if such a call was made ?

In respect of FADEC DECUs and AFCS malfunctions that could cause UFCM : Why was the possibility of “HF-radio induced EMI” not investigated though it produced well known and documented AFCS faults causing UFCM ?

Why was the “fix” to eliminate such UFCM only partially successful, even after the AFCS boxes were fitted with improved filter- pin connectors ?

Why was the possibility of mobile telephone induced EMI not investigated ?

Why was the possibility of outside sources of “powerful radio emissions induced EMI” not investigated. If they were, where are the records ? Why was shielding of “EMI producing equipment” not investigated and corrected if found inadequate, before the HC2 was pressed into Service?




Why was equipment that might have been sensitive to EMI not investigated for adequate shielding and why was any shielding found inadequate not improved before the HC2 was introduced into Service ? Why did connectors to the cabin mounted FADE DECUs have to be hand check-tightened by a crew member every 15 to 30 minutes when in flight ? This fault should have been addressed and eliminated before the aircraft was put into Service. There was a problem of chafed electric wire cable looms on both the HC1 and HC2 helicopters, where the wires emerged from the electronic broom cupboard, causing the AFCS to malfunction and produce UFCM. Pneumatic piping was also damaged in the same area, through similar rubbing on cabin walls behind the electronic “broom cupboard”. Why was the problem of chafed looms on Chinooks not permanently solved during the HC1 to HC2 upgrade ? If any of the above questions are left unanswered and if it is found that little or nothing was done to obtain information that might have been in any way relevant to establishing the possible cause of the accident, or to correct known faults permanently, the ultimate question remains “why not” and “who was responsible for these omissions” ? END

EMI-Qs /V1.01


1 November 2001 Addendum 3 HOUSE OF LORDS INQUIRY 1

SPECIAL REPORT

ADDENDUM 3

Report prepared for

LORD JAUNCEY OF TULLICHETTLE

CHAIRMAN

HOUSE OF LORDS SELECT COMMITTEE ON CHINOOK ZD576

RAF Chinook Helicopters – Accidents and Technical Faults

INDEX

1. RAF Chinook Helicopters Lost in Crashes 2. History of FADEC related failures affecting the RAF Chinook fleet 3. RAF Chinook (HC2) ZD576 - FADEC related faults and other failures 4. Hydro Mechanical Assembly (HMA) related faults on the RAF Chinook HC2 fleet 5. FADEC related warnings and associated faults on RAF Chinook HC2 helicopters 6. RAF Chinook HC2 Fleet - Electrical faults 7. Uncommanded Flying Control Movements (UFCM) on RAF Chinook Helicopters 7.1 Electro Magnetic Interference (EMI) 8. US Armed Forces Chinook incidents and accidents 8.1 FADEC related problems on US Armed Forces Chinook fleet 8.2 Uncommanded Flight Control Movements on US Armed Forces Chinook fleet 8.3 Examples of failures experienced on US Chinook helicopters 8.3.1 US Armed Forces Chinooks - Electrical faults 8.3.2 US Armed Forces Chinooks - UFCM due to Hydraulic fluid contamination 8.3.3 US Armed Forces Chinook Controls - Abnormal Operations 8.3.4 US Armed Forces Chinooks - Engineering & Mechanical faults 8.4 Engines on US Armed Forces Chinooks Appendix A – PQs with answers withholding information

Special report 1 November 2001

RAF Chinook Helicopters – Accidents and Technical Faults Compiled by the authors of the Macdonald report



SPECIAL REPORT

The date of the ZD 576 accident is highlighted in ‘RAF events’ tables of this report to allow a simple ‘Before and After’ comparison. 1. RAF Chinook helicopters lost in crashes Prior to the Mull of Kintyre crash, there had been seven Chinook helicopter accidents.

Date Location Mark Cause according to RAF Fatalities

14 November I984 Hampshire HC1 Technical Fault Nil 13 May l996 Falkland Islands HC1 Human Factors (Aircrew) 3 27 February 1997 Falkland Islands HC1 Not Positively Determined 7 6 May 1988 Hanover HC1 Human Factors (Aircrew) 3 24 July 1989 RAF Odiharn HC1 Non Service Control * Nil 25 July 1989 Falkland Islands HC1 Non Service Control * Nil 15 October 1991 RAF Odiham HC1 Technical Fault Nil 2 June 1994 Mull of Kintyre HC2 Human Factors (Aircrew) 29

(Source : Defence Committee, 4th report, Session 1997-98) * Indicates a cause or contributory factor which was stated as being outside the RAF’s

control, e.g., a problem arising out of air management such as an Air Traffic Control error, or a technical difficulty arising out of a contractor’s error.

On 20 January 1989, a Ministry of Defence (PE) Chinook was extensively damaged during ground testing in Wilmington (Philadelphia) following an engine runaway that caused a rotor overspeed. This FADEC related incident led to the MOD taking action against the contractors carrying out the test, for damage to the aircraft. There were no fatalities and the cause was categorised as Non Service Control. 2. History of FADEC related failures affecting the RAF Chinook fleet

When giving evidence to the House of Commons Defence Committee in 1998, the MOD said that there had been approximately 70 FADEC related incidents affecting RAF HC2 helicopters. Of these, 7 were reported as spurious, 24 arose as a result of carrying out engine overspeed tests other than as designed, 3 were unconfirmed and 36 were attributed to system faults. Of the 36 attributed system faults, 14 were due to mechanical failure, 5 were due to electrical failure and 17 were software faults. (Defence Committee, 4th report, Session 1997-98) A request by Robert Key MP in a PQ for details of the 70 FADEC related incidents up to the end of 1997, was denied by the Ministry of Defence on the grounds that “disclosure would harm the frankness and candour of internal reporting. (Appendix A refers). More FADEC related incidents have occurred since 1997. Attempts at obtaining details were not successful.



SPECIAL REPORT

3. RAF Chinook (HC2) ZD576 - FADEC related faults and other failures

Date Event Cause & Comment

21 Apr 94 Momentary torque split of 40% with engine rumbling. Indications returned to normal 1 second later

Unable to establish which engine was faulty. Cause later reported to be a faulty torquemeter (which has a sensor link to the FADEC). Said not to be a FADEC fault according to the RAF.

26 Apr 94 With both Engine Condition Levers at flight idle, no torque indications for either engine + #1 engine "running high".

Torque mismatch revealed on test. Left engine replaced. Stated as “Remedial work from previous incident (21/4) & not a new incident “ according to the RAF.

10 May 94 Heavier than normal Collective Control movement. Thrust and yaw pallet assembly collective lever stiff to operate and pulls to floor when ‘mag brake’ released

De-bonding of the pallet insert let a mounting bracket move. Thrust control balance spring bracket bonding failed. Bracket detached from the pallet assembly. Collective thrust yaw pallet assembly replaced. Serious fault signal raised.

17 May 94 #1 engine ‘emergency power’ caption illuminated 3 times momentarily. Engine temperature reached 950º with rumbling noises.

Engine removed and components returned to contractors. Engine rebuilt with new 1st stage nozzles and air bleed actuator at RNAY Fleetlands. Said not to be a FADEC fault by the RAF.

26 May 94 Various spurious caption warnings including a “Master” caption and #2 engine fail caption

Precautionary diversion & landing. Advice received suggested warning spurious. Suspected FADEC nuisance fault according to the RAF.

2 June 94 Mull of Kintyre CRASH Cause unknown

(Source : Defence Committee 4th Report 97-98 & RAF Wide Format EIC Enquiry Process records) 4. Hydro Mechanical Assembly (HMA) related faults on the RAF Chinook HC2 fleet Each engine has one HMA fuel metering device in its FADEC system. The HMA is fully controlled automatically by a Digital Engine Control Unit (DECU) mounted on a rear cabin wall. Unexpected engine speed changes due to mechanical faults occurred as follows :


7 March 94 On switching to reversionary mode, #2 engine flamed out

Fault in HMA according to MOD. Repaired under warranty at no cost.

2 June 94 Mull of Kintyre CRASH Cause unknown 5 March 96 Engine run down to ground idle HMA fault according to MOD. On return to

contractor, HMA found to contain building debris. Repair at no MOD cost. Contractor’s procedures changed.

June 96 / July 96

Engine run-down HMA fault with ratio track sticking and Compressor Discharge Pressure stuck at maximum according to MOD. Repair at no cost to MOD.

9 Dec 96 #1 engine rundown HMA fault. Repair at no cost to MOD

(Source : Defence Committee 4th Report 1997-98 session)



SPECIAL REPORT

5. FADEC related warnings and associated faults on RAF Chinook HC2 helicopters

Date HC2 Event Cause & Comment

5 Jan 94 ZA 674 #1 engine fail caption came on during engine overspeed test

Cleared after 10 seconds. Flew 6 more hours before caption came on again. No Fault Found. RAF suspected false indication.

26 Jan 94 ZA 681 #1 engine fail caption came on in flight for 5 to 10 seconds (with both engines in reversionary control)

Engine continued to operate normally All engine indications normal during period of engine fail indication. Cause unknown. RAF suspected false indication.

27 Jan 94 ZA 674 #1 engine fail caption came on for about 10 seconds in flight (with No 1 engine in reversionary control)

Engine continued to operate normally. No other indications of engine failure. No Fault Found. Cause unknown. RAF suspected false indication.

27 Jan 94 ZA 674 #2 engine fail caption came on in flight. Returned to base

DECU functional check OK. No Fault Found. Cause unknown RAF suspected false indication.

15 Mar 94 ZA 710 Pre engine start, various fault codes noted on #1 & #2 engines.

Aircraft was shut down. Faults confirmed as due to FADEC system fault. Remedial action reported to be in hand.

7 Apr 94 ZA 682 On engine shut down post flight, #2 engine fail caption came on.

DECU functional; check OK. No Fault Found. Cause unknown. Attributed by RAF to a spurious engine fail caption.

20 May 94 ZA 584 Unusual vibration felt when collective pitch raised & lowered against ‘Mag Brake’

When sound-proofing around control runs removed, loose washers and securing nut revealed on collective CPT assembly. This reportedly alters CPT output to FADEC.

2 June 94 ZD 576 Mull of Kintyre CRASH Cause unknown NO INFORMATION AVAILABLE AFTER June 1994

Source : RAF Reports (Evidence given at the 1996 Fatal Accident Inquiry) 6. RAF Chinook HC2 Fleet - Electrical faults

Date HC2 Event Cause & Comment 2 June 94 ZD 576 Mull of Kintyre CRASH Cause unknown

14 Dec 95 ZA 708 Loss of Radios and lights + sundry flight instruments fail-flags appeared. Main Attitude Indicator (AI) and Heading (HSI) information corrupt. Engines would not shut down normally.

Circuit breaker (c/b) tripped. Wrong amperage DC Essential c/b found fitted. Flight safety implications reported as ‘serious’ by unit test pilot. Recovery would have been critical at night or in cloud.

NO INFORMATION AVAILABLE AFTER December 1995

Source : RAF Reports (Evidence given at the 1996 Fatal Accident Inquiry)



SPECIAL REPORT

7. Uncommanded Flying Control Movements (UFCM) on RAF Chinook Helicopters

Date UFCM Cause

1 20 Jan 94 Internal leak within actuator 2 27 Jan 94 Faulty vertical gyro 3 10 May 94 De-bonding of pallet insert allowed mounting bracket to move 4 02 June 94 HC2 ZD 576 crash - Mull of Kintyre (Cause unknown) 5 12 Jun 94 Unserviceable Automatic Flight Control System (AFCS) 6 5 Jul 94 3 way solenoid/manual operated valve found in manual on position 7 12 Jul 94 Air in flight boost hydraulic system 8 10 Oct 94 Oil contamination on plugs 9 18 Jan 95 Incorrect barometric altitude settings on AFCS 10 18 Jun 95 Faulty auto-pilot release switch 11 20 Jul 95 Mounting bracket for pitch balance spring detached 12 18 Aug 95 Aircraft experienced 12ºnose down pitch. (No Fault Found on test) 13 25 Aug 95 Unserviceable Differential Air Speed Hold (DASH) actuator 14 16 Feb 96 Oil contamination on plugs 15 13-18 Apr 96 Faulty gyro indicator 16 22 Aug 96 Water ingress in plug/socket 17 3 Dec 96 to

21 Jan 97 AFCS computer failed

18 11 Jan 97 Pitch down followed by pitch up occurred three times during flight (Cause not positively determined)

19 13 Jun 97 Internal fault in directional gyro 20 1 Dec 97 to

9 Jan 98 Faulty cockpit control drive actuator

21 23 Dec 97 Aircraft suffered vertical bounce on ground after landing (No Fault Found on test)

22 22 Jan 98 Altitude indicator synchro defect 23 12 May 98 Loose article found in directional gyro 24 24 Jun 98 Directional gyro and AFCS faulty 25 20 Jul 98 Internal fault in directional gyro 26 27 Jul 98 During air test following flying control replacement, the aircraft

experienced a number of divergences in pitch from level flight. (Cause not positively determined)

27 10 Aug 98 Wear in the No.2 DASH actuator 28 26 Oct 98 Faulty DASH actuator 29 3 Feb 99 Cycle stick movement moved forward approximately 2 cm with resultant

10º nose down pitch. (Cause not positively determined) 30 12 Mar 99 Whilst the aircraft was in a hover, a forward movement of the stick was

noticed. (Cause not positively determined) 31 17 Mar 99 Faulty DASH actuator and directional gyro 32 20 Apr 99 Directional gyro out of tolerance 33 29 Apr 99 Faulty AFCS and directional gyro 34 14 Jun 99 Faulty directional gyro 35 29 Jun 99 Faulty AFCS and directional gyro 36 29 Oct 99 Faulty directional gyro 37 18 Nov 99 Faulty directional gyro

MORE UFCM INFORMATION OVERLEAF Written reply by Minister of State John Spellar to Mr Martin Bell MP (24 May 2000)



SPECIAL REPORT

7. (Continued) - UFCM on RAF Chinook Helicopters

Date Tail Number UFCM Cause

30 12 Mar 99 ZA 712 Faulty AFCS (re assessment of previous ‘cause’ (repeat) 31 17 Mar 99 ZA 718 Faulty DASH actuator and directional gyro (repeat) 32 20 Apr 99 ZD 983 Directional gyro out of tolerance

(repeat) 33 29 Apr 99 ZH 775 Faulty AFCS and directional gyro (repeat) 34 14 Jun 99 ZA 718 Faulty directional gyro

(repeat) 35 29 Jun 99 ZA 718 Faulty AFCS and directional gyro (repeat) 36 29 Oct 99 ZA 711 Faulty directional gyro

(repeat) 37 18 Nov 99 ZA 711 Faulty directional gyro

(repeat)

38 6 Jan 00 ZA 714 Faulty AFCS

39 6 Jan 00 ZA 718 Faulty AFCS

40 11 Feb 00 ZA 682 Faulty vertical gyro

41 4 Apr 00 ZA 682 Faulty DASH actuator gear assembly

42 5 Apr 00 ZA 679 Faulty DASH actuator

43 5 Apr 00 ZA 684 Faulty directional gyro connector

44 30 May 00 ZA 710 Faulty AFCS

45 24 July 00 ZA 679 Faulty AFCS and DASH actuator

46 5 Aug 00 ZA 674 Faulty cables to AFCS

47 9 Nov 00 ZA 671 Faulty vertical gyro

48 12 Nov 00 ZA 671 Faulty AFCS

49 17 Jan 01 ZH 777 Units replaced following pitch oscillations

50 1 Mar 01 ZA 709 Faulty directional gyro

51 1 May 01 ZA 674 Faulty directional gyro

52 24 May 01 ZA 680 Faulty lower control actuators

53 5 Jul 01 ZA 981 Faulty attitude indicator

30 Oct 2001 : Columns 565W (in response to a PQ by Mr Robert Key MP)

7.1 Electro Magnetic Interference (EMl)

Insufficient attention was given to the possibility that EMI from internal and/or external radio transmissions or from mobile telephone use sources, may have affected the AFCS causing UFCM or malfunctions of the FADEC system cabin-wall mounted DECU boxes. (Macdonald Report, Addendum 2 on EMI at (11) & (8) respectively refers). Although electronic bombardment tests were carried out, no tests were carried out combining outside bombardment with a potential EMI effect from inside the fuselage or from below.

Date Event Cause & Comment Not given Undemanded collective pitch

control movement when the AFCS auto-pilot barometric altimeter altitude hold was engaged.

UFCM during HF Transmissions in the 3 to 15 megacycles band in particular. HF radio EMI must be recognised as a possible source of UFCM from AFCS sources.

Not given Flying controls UFCM In Northern Ireland, operation of the infra-red countermeasures system.



SPECIAL REPORT

8. US Armed Forces Chinook incidents and accidents (Also See Appendix D and E of the April 2000 ‘Macdonald Report’)

It has been difficult to obtain information on accidents and incidents in the US Armed Forces Chinook Fleet. Repeated applications for information under the US Freedom of Information Act have been subjected to lengthy security reviews and mostly denied. Some information was obtained from the US Army magazine “Flightfax” and other press sources. In consequence, the information given hereunder only gives a partial picture. 8.1 FADEC related problems on US Armed Forces Chinook fleet Attempts to obtain information regarding FADEC related faults on the US Chinook fleet under the US Freedom of Information Act have been unsuccessful. 8.2 Uncommanded Flight Control Movements on US Armed Forces Chinook fleet The American Chinook fleet has experienced and continues to experience UFCM, or Uncommanded Flight Control Inputs as they are known in the US. According to the October 2000 edition of Flightfax, UFCMs are “an ongoing issue within the community that has yet to be resolved”. Following the issue of an Aviation Safety Action Message (ASAM) in October 1998, the US Army Analytical Investigation Branch at Corpus Christi Army Depot reported that in the “past several years” 27 UFCM were related to AFCS/electrical malfunctions, 4 were hydraulic related malfunctions, 3 were suspected ice and water contamination incidents and 4 were of unknown origin (Source : Flightfax December 1998). Investigation of UFCM and Flight Control Lock-ups in flight have been attributed to the contamination of hydraulic fluids, internal parts out of tolerance, internal corrosion of internal parts, high Barium content in preservative hydraulic fluids and internal Foreign Object Damage (FOD) by wear of aluminium parts. (Source : Flightfax December 1998). 8.3 Examples of failures experienced on US Chinook helicopters 8.3.1 US Armed Forces Chinooks - Electrical faults


1993-98 Electrical failures 36 Electrical System problems (Class E mishaps) occurred during period

Oct 92 – Jun 96 7 Chinooks experienced varying degrees of electrical power failure.

Water Ingress into electrical power distribution panels

7 March 1996 Helicopter crashed on night approach - 5 killed

Initial investigation blamed pilots. Later established that water ingress shorted out main electrical distribution panels

Mid 1996 Fire in Electrics bay Due to water ingress shorting out components.

16 June 1996 Electric smoke/fire Boeing reports 3rd incident of water causing smoke or fire

(Source : Flightfax December 1998)



SPECIAL REPORT

8.3.2 US Armed Forces Chinooks - UFCM due to Hydraulic fluid contamination


1997 CH-47D rolled onto its back in flight, then completed a 360 º roll, descending to 250 feet before it was safely landed

Likely cause attributed to metal contamination and moisture found in pitch, roll and yaw ILCA hydraulic fluid

Source : Flightfax May & Dec1998 + report 8.3.3 US Armed Forces Chinook Controls - Abnormal Operations


Not Given Control binding experienced during flight controls check Cyclic limited to 4 inches forward and 1.5 inches lateral movement

Forward rotor head was moving whilst rear head was not. Symptoms persisted for 5 minutes. Situation could not be duplicated by maintenance but an actuator fault was suspected

Not Given Uncommanded in-flight pitch down 20º to 25º. On application of aft cyclic, aircraft pitched up then down before pilot regained control. 1000 feet altitude lost.

Failure of the shock absorber mounts suspected

Not Given During Flight controls check control binding experienced, grinding noise heard and forward blade bounce up 6” with cyclic in full right position primarily & when cyclic was moved from full back to neutral through 4“

Forward swivelling actuator replaced

Not Given In flight, vibration coupled with left to right yaws of 5º to 15º then cyclic and pedals froze whilst banked. Freed suddenly. Occurred twice.

Aft pivoting actuator faulty

Not Given Control Binding on lift-off. then Several weeks later, severe vibration experienced

Engineering staff unable to replicate. Transmission problems suspected

Source : Flightfax December 1998 issue



SPECIAL REPORT

8.3.4 US Armed Forces Chinooks - Engineering & Mechanical faults


1995 April Fatal Chinook Crash. Cause failure of retaining bolt because steel bushing was not installed due to error in Boeing Manual. Boeing settles lawsuit with victims’ families. (Knight-Rider/Tribune Business News)

1988 Fatal Chinook Crash. Cause unknown. Boeing settles suit with victim’s families. (Dayton Daily News)

Pre July 98 Before take-off the Master caution light came ON with a transmission hot capsule warning

#1 transmission faulty. Emergency shut down of both Engines. Inspection revealed a severed transmission cooling fan drive and metal flakes on the combining transmission filter.

Pre July 98 #1 engine transmission oil temperature rapidly rose through 130ºC

Emergency shut down of engine completed. Maintenance found the combining transmission cooling fan shaft was sheared

24 Aug 1999 Gear parts World-wide grounding of Chinook fleets after cracks are identified in gear parts of RAF Chinooks. Largest grounding ever. (Atlanta Journal, 24 October 1999)

Aug 2000 Faulty gears

Boeing Settles US$ 64 million lawsuit after admitting fitting faulty gears to US Chinooks that led to at least one fatal crash and the suspected cause of others. (CBS News 03.08.2000)

Source : Flightfax December 1998 issue and as noted under ‘comment’ 8.4 Engines on US Armed Forces Chinooks To illustrate the number of engine problems, these accounted for a fourth of all Chinook mishaps in the (United States Services) Financial Year 1998. The areas that most needed attention are the torque-metering system and power controls. The Chinook community is anxiously waiting the fielding of the upgrade T-55GA-714A engine which will bring improvements to all areas of the power plant, including the full authority digital electronic control (FADEC) system. The T-55GA-714A engine has proved itself on special-operations aircraft where it drastically reduced the number of engine related accidents. (Source : Flightfax December 1998 issue) END OF SPECIAL REPORT Compiled by Captain Ralph KOHN FRAeS with Captain Ron MACDONALD FRAeS and Captain Richard K J HADLOW FRAeS See Appendix A on next page



SPECIAL REPORT

APPENDIX A PQs with Answers withholding information 03.12. 1997 Mr Key: To ask the Secretary of State for Defence if he will place in the Library a copy of the minute re. D/DHP/HP1/4/3 dated 29 April 1994 covering the Textron White Paper on Chinook FADEC. Mr Spellar: The subject document contains internal opinions and advice, disclosure of which would harm the frankness and candour of internal discussion. Accordingly, I am withholding the information requested under exemption 2b of the Code of Practice on Access to Government Information. 03.12. 1997 Mr Key: To ask the Secretary of State for Defence, if he will place in the Library a copy of the Textron Lycoming White Paper on Chinook FADEC. Mr Spellar: The information provided by Textron Lycoming in their White Paper is commercially confidential. Accordingly, I am withholding the information requested under exemption 13 of the Code of Practice on Access to Government Information. 03.12.1997 To ask the Secretary of State for Defence, pursuant to his Answer of the 18th November, Official Report, column 153, about the fully automated digital engine control system, if he will place in the Library copies of the 70 incident signals relating to FADEC on the Chinook Mk2 helicopter. Mr Spellar: The subject documents are part of the flight safety reporting procedures and disclosure would harm the frankness and candour of internal reporting. I am withholding the information requested under exemption 2 of the Code of Practice on Access to Government Information. 06.12.1999 Mr. Key: To ask the Secretary of State for Defence if he will place in the Library reports he has received from the United States authorities relating to the US Army Chinook CH-47 barrel roll incident in 1998. [101400] Mr. Spellar: No. The information that we received from the US Army Authorities about the incident was provided in confidence. I am therefore withholding it under Exemption l c (information received in confidence from foreign governments) of the Code of Practice on Access to Government Information.

House of Lords’ TULLICHETTLE Inquiry

End of the Special report


11 December 2009 ADDENDUM 4 – HC2 AIRWORTHINESS MATTERS 1

ROYAL AIR FORCE CHINOOK MARK 2 ACCIDENT


ADDENDUM 4

HC2 AIRWORTHINESS 10 January 2010

MULL OF KINTYRE

STRATHCLYDE - SCOTLAND

1993 Chinook Mark 2 - RAF Acceptance AIRWORTHINESS CONNOTATIONS

Letter to The Right Honourable Bob Ainsworth MP

Secretary of State for Defence Ministry of Defence - Main Building

London - SW1A 2HB 11 December 2009

By Captain Ron MACDONALD FRAeS


Captain Richard K. J. HADLOW FRAeS Retired Airline Captain and Armed Forces Helicopter Pilot


Retired Airline Captain and Regulatory Authority Inspector (Editor and compiler)



11 December 2009

Chinook ZD 576 crash – Mull of Kintyre – 2 June 1994

RAF Honour still at stake

Please Read Slowly and with Care

Please read all the accompanying correspondence with care, attention and without haste. It is the result of a long-standing refusal on the part of the MoD, to exonerate the two Pilots who were accused of Gross Negligence on the subjective decision of Senior Reviewing Officers of the RAF Board of Inquiry (BoI), that itself could not apportion blame. 1. Chinook ZD 576 was not Airworthy. This aspect was not looked at by the RAF BoI. The word Airworthiness does not get

mentioned in their report. We can prove that it was not airworthy. 2. It was not Fit for Purpose. This is another issue not considered by the RAF BoI despite the fact that they report on Flt Lt

Tapper's request for a Chinook Mk1 - linked to airworthiness of course; but an aircraft that might be considered "fit for purpose" for urgent operational tasks and with a known acceptance of the higher risk, was certainly not "fit for purpose" for an essentially civilian passenger flight, under the prevailing weather conditions where the RAF owed a full duty of care to meet the equivalent civil flight standards in terms of the aircraft's fitness for purpose.

3. It was not ‘Serviceable’. The RAF BoI assumed that because, inter alia, a waypoint change was made, the aircraft was

serviceable. My letter explains why the BoI was wrong in so assuming. Five separate investigations could not agree with their reversal of the BoI verdict but the Ministry of Defence (MoD) still refuses to reconsider the accusation, made in direct contravention of the RAF’s own Law at the time of the accident.

We question MoD’s refusal to accept the truth of the matter and other opinions on the accusation of gross negligence, also the MoDs Airworthiness and engineering procedures.

a. The core RAF accident Board of Inquiry (BoI) report did not apportion blame notwithstanding repeated redrafting at the behest of the Senior Reviewing Officers.

b. The AAIB report written to assist the RAF BoI could not apportion blame. c. The Strathclyde Sheriff Accidental Death Inquiry report did not agree with the RAF Reviewing Senior Officers’

findings, leading to their accusation of Gross Negligence. d. A Parliamentary Accounts Committee could not agree with the RAF Senior Reviewing Officers’ views. e. The House of Lords Inquiry on the accident did not agree with the Senior Officers’ conclusions.

We query the two Senior Reviewing Officers’ logic in their accusation and the MoD’s position in this matter. Simply, Chinook 576 was neither demonstrably Airworthy nor fit for Purpose.

Blaming the pilots cannot be condoned, because no one knows what really happened and there are many doubts about what may have caused the crash. Yes, Negligence is evident but at Airworthiness authorisation level and not of the pilots’ making.

Please do all you can to see that this indictment is finally rescinded so that the Honour of the RAF may be restored and

vindicated, by overturning this arbitrary and unjust verdict.



The Right Honourable Bob Ainsworth MP Stoney Cross The Secretary of State for Defence Heathway

Ministry of Defence Camberley

Main Building Surrey

Whitehall GU15 2EL London England SW1A 2HB Telephone/Fax: 01276 65 642 Mobile: 07802 207 457 E-mail: [email protected]

11 December 2009

Mull of Kintyre Accident – RAF Chinook HC2, ZD 576 – 2 June 1994

Dear Secretary of State, 1. I acknowledge receipt of your photocopied and delegated response to my letter of 2 October 2009. It should be no surprise to you that I did not find the response helpful as was suggested by its writer, not least because it totally ignores all the points on the HC2 airworthiness issues that had been raised by the A&AEE at Boscombe Down but which had been totally ignored by the Board of Inquiry and the Reviewing Officers. Here we must make the point that the RAF BoI report must, by definition, cover all the

considerations addressed by the Board in their investigation. These (airworthiness issues) are facts and not the hypotheses or speculation relied on by the Reviewing Officers, and which remain at the core of the need for the unjust and unjustified verdict of Gross Negligence to be overturned. The reply is incorrectly addressed, full of apologies for unanswered previous correspondence and signed by one Simon Lane who, I understand, can only toe the MoD party line and who therefore has my commiserations. AAIB, A&AEE and RAF Airworthiness Certification 2. I am putting the more detailed issues in the attached paper (Appendix A refers) but I ask you to read, understand and respond fully to the following comments and questions. There are more in the attached paper but those below alone should raise doubts on the “security” of the verdict:

3. The AAIB Report to the BoI makes it clear that not only could a control restriction not be ruled out (even though there was no clear pre-impact evidence of this), but that the Boeing method of attachment of components to the control pallet did not meet the expected standards. Given that ZD 576 had suffered a control restriction just before the accident and was being specially monitored, why was this area of concern not fully investigated by the BoI? There is also clear evidence that ZD 576 may not have been fully airworthy and fit for purpose in several areas.

4. A&AEE wrote to MOD on 6 June 1994 (ADD/308/04) – the letter being based on a meeting held at A&AEE on 25 May i.e. some 9 days before the accident. This letter, inter alia, repeated the fact that the Chinook Mk2 had been introduced into service against A&AEE’s recommendations and stated that it was a series of in-service incidents (not flight test incidents as stated to Parliament by a predecessor of yours) that caused A&AEE to “ground” their flight test aircraft. 5. The last of these in-service incidents was on ZD 576 on 19 May, just days before the accident and A&AEE then stated in their letter: “The unquantifiable risks identified at the Interim CA Release stage may not in themselves have changed but some have become more clearly defined by events, to an extent where we now consider the consequences of the risks and the probability of an occurrence to be unacceptable. (See Appendix B).

6. On 30th September 1993, a mere 4 weeks or so before Controller Aircraft signed the Initial CA Release, A&AEE stated in writing that the FADEC software implementation was "positively dangerous”. It can be seen that A&AEE’s consistent advice to MoD, was that the Mk2 did not meet the Secretary of State’s mandated standards for airworthiness. 7. These irrefutable facts raise some obvious questions, namely:



(a) On what evidence did the BoI and Reviewing Officers conclude that the Mk2 and ZD 576 in particular were fully airworthy?

(b) Given the major airworthiness issues highlighted by A&AEE, why did the BoI and the subsequent review process completely ignore the A&AEE concerns with, as a result, no investigation as to whether the airworthiness of the Chinook Mk2 fleet and ZD 576 in particular could have contributed to, or even caused the accident?

(c) Given the CAR/RTS limitations (e.g. icing limitations, false engine fail warnings, inadequate FRCs,) why did the RAF insist on the use of a Chinook Mk2 against the request of the NI Detachment Commander?

(d) We understand that extraordinary operational imperatives may have driven MoD to ignore the

A&AEE advice (that the aircraft was not airworthy), the fact remains Chinook Mk2 problems were a continuing cause for concern to all the crews operating it – including the Odiham unit test pilot (who was not a witness to the BoI – an interesting omission). This constitutes a significant Human Factors Hazard. But on what basis did the RAF authorities consider the Chinook Mk2 as being suitable for this non-operational tasking given the airworthiness issues – essentially a civilian passenger flight in an aircraft which no civil regulatory authority would have allowed to operate with the limitations and potentially dangerous characteristics that applied to the Chinook Mk2 at that time (e.g. false engine fail warnings and a warning that the new fuel computer implementation was positively dangerous)? The Safety Management System regulations require the reasoning to be recorded and we would ask for this to be re-examined in the light of this evidence not placed before the BoI.

(e) Why was the A&AEE letter of 6 June not drawn to the attention not just of the BoI but also of any of

the independent Inquiries, including the House of Lords Select Committee? For example, DHP (Director Helicopter Projects) was the action addressee for the 6 June letter (which also went to MoD itself) yet in his request for legal advice before the FAI (D/DHP/HP1/4/1/4/1 dated 24 October 1995), no mention is made of the existence of this letter – a cynic might imagine that this was because the A&AEE letter would then have had to be provided to the other side.

Reviewing Officers - Inconsistency of Opinion 8. As you will be aware a Tornado aircraft crashed in Glen Ogle in September 1994. It was fitted with an ADR/CVR, and there was no doubt whatsoever that the pilot’s control inputs caused the crash. Despite this clear evidence, the same senior-most Reviewing Officer, when writing his remarks within a few days of the comments and verdict of “Gross Negligence” on the Chinook accident, decided that: “It is therefore because there is no scope for conjecture… that I find any consideration of human failings to be academic and fruitless. Despite the wealth of detailed evidence, we are confounded and under these particular circumstances I consider it is futile to indulge in hypothesis”. 9. Perhaps you would be kind enough to explain what action MoD was taking at the time to ensure a consistency and fairness of the remarks of the Senior Reviewing Officers in BoIs – particularly given the damage that the verdict of “Gross Negligence” had, and continues to have, on the reputation of two pilots in an accident where even the Senior Reviewing Officer admits in a comment totally inconsistent with his “verdict”, that “Without the irrefutable evidence which is provided by an ADR and a CVR, there is inevitably a degree of speculation as to the precise detail of the sequence of events in the minutes and seconds immediately prior to impact.” Perhaps you could also explain how the MoD legal advisor was able to accept “speculation” as meeting the “no doubt whosoever” requirements of AP 3207. Indeed we would be grateful if we could see the legal advice that the Reviewing Officers claimed they had been given when they appeared before the House of Lords Select Committee – particularly as we have been led to understand that the RAF’s own Director of Flight Safety at the time, advised against such a verdict.



Flight Path 10. The pilots were flying in VMC below cloud by intent, because their Chinook was neither equipped with ‘cleared’ or guaranteed navigation equipment suitable for flying in cloud, nor was the aircraft cleared to fly in the icing conditions that were forecast had they entered cloud above their planned and approved flight path on that day. They were well aware of the limitations and, as even the BoI accepts, they had no intention of over-flying the Mull. Although the position of the waypoint change in space is not defined the time before impact is known and, contrary to statements made by the Reviewing Officers and repeated by MoD almost as a mantra, this time has been confirmed by experienced Chinook pilots as more than adequate for the necessary small course adjustments and continuation of the flight in VMC to the selected waypoint to take place. ‘Minimum safety altitude’ for the subsequent legs and route to Inverness was several thousand feet above the 2400 feet postulated by the Senior Reviewing Officers. 11. MoD has accepted in writing that they would have expected an immediate course change when the new waypoint was selected. As a Senior Training Captain and Regulatory Authority Inspector I would endorse this view. One does not remove a waypoint from an FMS preloaded flight plan. You select another way-point to by-pass the one want you want to leave alone/miss/fly abeam of, then you turn on to the next heading immediately, towards the selected waypoint which you activated … unless you are prevented from so doing for whatever reason and/or if the aircraft refuses to turn. 12. The BoI suggestion that the pilots decided to overfly the Mull and then selected an inappropriate rate of climb is not supported by the BoI’s evidence and it assumes a near suicidal intent that is preposterous for Special Forces aircrew of their experience. Had the crew made the decision to revert to an IMC plan, their training and experience would have had them turn away over the sea – a comment made by the Odiham Station Commander – with significantly more up to date knowledge and experience of SF operations than either of the Senior Reviewing Officers. Again being cynical, I have to wonder if this comment came down from the Reviewing Officers to support their position, rather than being a genuine finding of the board from the evidence. If the Reviewing Officers believe that the crew made a deliberate decision to overfly the Mull perhaps you could provide the evidence (not the speculation) on which this finding is based. Duty of care 13. In the last paragraph of his comments, which is totally at variance with the previous 5 paragraphs, the Odiham Station Commander states: “In assessing human failings, the evidence is insufficient to be specific. However, there is no indication of a major technical malfunction (because we suggest the BoI did not look for it) and Flt Lt Tapper and his crew were undoubtedly competent to carry out the mission. In carrying out that mission Flt Lt Tapper, as captain of an aircraft in peacetime, had an overriding duty to ensure the safety of the aircraft, its crew and. the passengers. While there may, arguably, be some mitigating circumstances, I am regrettably drawn to the conclusion that he failed in that duty.” The “duty of care” concept is well understood and this comment is hardly a revelation - we all owe a duty of care to our fellow citizens all the time. It is certainly not a provable conclusion of negligence or even pilot error. As stated by the Station Commander, this was a peacetime mission; therefore peacetime engineering and certification standards of safety criteria should have applied to ZD 576 under these circumstances. 14. There is no doubt that Tapper and Cook owed a "duty of care" to their crew and passengers - there is no proof that they failed to provide it. Indeed it could be argued that Tapper, with his knowledge of the Chinook Mk2’s problems and his rejected request to retain a Chinook Mk1 for the task, was one of the few people in this sorry saga who properly tried to exercise his duty of care. People's opinions (including the "regrettable" conclusion of the Odiham Station Commander) based on a subjective judgment and a very selective use of the facts (which did not include any investigation of the airworthiness of the Chinook fleet and the A&AEE airworthiness issues - an amazing (and directed?) omission by the BoI), are not the required proof of negligence. Worse, where were the 1 Group and HQSTC staffs' proper assessments of the inadequacies of the BoI on the engineering side - or were they “only following orders” and “keeping their heads below the parapet” on a decision that had effectively been made when the BoI’s prescribed terms of reference were also drafted? N.B., it should be noted that some of the factors considered here may not have been in the terms of reference of the BoI. In such cases the BoI would not have considered them. Negligence 15. I strongly believe that negligence was involved in this accident – it started with the recommendation to the RAF that they accept the Mk2 and continued with the issue of a Release to Service for an aircraft that



was patently immature and did not meet the requirements of the airworthiness regulations; all contrary to the advice of the MoD’s own flight test agency. It continued through to the choice of ZD 576 with all its known problems for this high profile but nevertheless non-operational task. Then followed the flawed and inadequate BoI and the subsequent process itself. This negligence is provable and it is there for all to see. But by avoiding the possibility that the crash was caused by a technical fault or the underlying airworthiness of the Chinook fleet and by blaming the pilots, the RAF and MoD could not be held responsible, so avoiding legal action against both; and possibly Boeing as well. Where was the RAF’s duty of care to its passengers and crew? 16. The complete failure of the now ACMs to face up to their responsibility for ensuring that the Chinook Mk2 was completely airworthy and fit for purpose for this particular non-operational peacetime task put them, I suggest, in the position that the truth had to be ignored, not only to protect what they might have perceived as the RAF’s reputation (perhaps the reason why the Tornado verdict was in the opposite direction), but also to allow them to “fly in the face” of Boscombe Down’s concerns on the in-service failures and their test pilots’ negative reports on FADEC software integrity, flight in icing aspects and in other critical CAR/RTS areas; such as ensuring suitable EMI protection/non-permeability. My concern is that it appears great pains were taken to ensure they were not investigated by the BoI, or since. 17. Based on their suppositions, inconsistency of judgement and avoidance of RAF Laws regarding dead flight crew, in my opinion the Air Marshals showed that the position of trust and any responsibility that they and other areas of senior RAF management held for this accident meant little. This verdict and MoD’s continuing insistence that a verdict based on hypotheses and speculation should stand, remains as a blot on the finest expected RAF standards and is an abuse of the power of the MoD itself. I believe it is also a further example of MoD’s cavalier attitude towards the implementation of airworthiness regulations and standards that has been so forcefully pointed out in the Haddon-Cave Report. 18. Of course, there is another possible explanation; that the Reviewing Officers, various inquiries and Ministers were not made aware of vital evidence, for example the truly astonishing fact that a world renowned flight-testing organisation (A&AEE) stated, in writing, that the implementation of new, safety critical software was “positively dangerous”, yet were completely ignored. This single fact, in addition to being, we believe, “new evidence”, is so fundamental to aviation safety that we implore you seek an explanation as to why, only 4 weeks later, the RAF were advised that the aircraft was safe when, clearly and demonstrably, the risk had not been mitigated. Conclusions 19. Chinook ZD 576 was not airworthy. This aspect was not looked at by the RAF BoI. The word Airworthiness does not get mentioned in their report. We can prove that it was not airworthy. 20. Chinook ZD 576 was not fit for purpose (which can be a higher or lower higher standard than that deemed airworthy at CAR). This is another issue not considered by the RAF BoI, despite the fact they report on Flt Lt Tapper's request for a Chinook Mk1. This request is significant and unusual – it reveals the concerns of a highly trained and experienced crew, is of course linked to airworthiness, and yet is left unexplored by the investigation. ZD 576 might have been considered "fit for purpose" for urgent operational tasks and with a known acceptance of any higher risk, but was certainly not "fit for purpose" for a civilian passenger flight where the RAF owed a full duty of care to meet the equivalent civil flight standards in terms of the aircraft's fitness for purpose. 21. Based upon the contents of this letter, the MoD should be directed to overturn immediately the unfair charge of ‘Gross Negligence’ placed upon the two pilots, in direct contravention of RAF Law at the time of the accident. Yours sincerely,

Captain Ralph KOHN FRAeS Retired Airline pilot and Regulatory Authority inspector (Ret) - Compiler of the Macdonald report (April 2000) Also for Captain Ron MACDONALD FRAeS & Captain Richard K J HADLOW FRAeS, report co-authors



APPENDIX A - TECHNICAL ADDENDUM Airworthiness failings of the MoD

1. The recent Haddon-Cave report, confirming findings of the Nimrod XV230 Board of Inquiry (that airworthiness regulations had not been implemented properly), has highlighted systemic failings by MoD. The same failings have been demonstrated in the C130 XV179 accident. Additionally, the Boards of Inquiry into the loss of Sea Kings XV650 and XV704 and Tornado ZG710 noted similar failings relating to lack of functional safety, recommending the implementation of fundamental airworthiness principles. 2. Various Mull of Kintyre inquiries have heard evidence of similar failings leading to the introduction to service of an immature aircraft. There is a clear link between the Haddon-Cave report and Chinook, not least because the airworthiness regulations (JSP 553) apply to all Military aircraft and many airworthiness components are provided within MoD as a common service. Therefore, it is entirely reasonable to assume that, if a department can fail so abjectly on one aircraft, it can do so on another. Indeed, this was noted by ACM Sir Clive Loader in his Nimrod recommendations. 3. The evidence presented here is of MoD(PE) failures to implement the airworthiness regulations as they applied to the introduction of the Chinook Mk2, failing to act on specialist advice from Boscombe Down that the FADEC software implementation was “positively dangerous” and the haste with which the Controller Aircraft Release (CAR) was issued when its content clearly illustrated lamentable immaturity. A&AEE (Boscombe Down) Advice 4. On 30th September 1993 A&AEE advised that the implementation of the FADEC software was “positively dangerous”. 5. Little more needs to be said. A&AEE specifically declined to recommend CAR and provided evidence that the aircraft was not sufficiently safe, but were ignored. Controller Aircraft Release (CAR) & Release to Service (RTS)

6. CAR was a notification by Controller Aircraft (a 3 Star post) to the Service department concerned that a new type of aircraft had been developed to the stage where it was suitable for use by Service aircrew. By the same token the Service required a CAR before they could operate a new type of aircraft. CAR was (is) defined as:

“The statement of the operating envelope, conditions, limitations and build standard for a particular aircraft type, within which the airworthiness has been established as meeting the desired level of safety”.

7. As CAR refers to a given build standard it follows, if the CAR is to remain valid, the build standard must be maintained. The Board of Inquiry report notes various failings in this area, notably incomplete Flight Reference Cards; but does not link these failings to airworthiness. Nevertheless, the requirement for a seamless audit trail was demonstrably broken. 8. CA signed and issued the initial CAR, known as “Issue 1”, when the Service Operational Requirements (OR) Branch formally signified their willingness to accept delivery of aircraft to the agreed standard (i.e. the build standard presented at CAR trials). We find it difficult to accept that both CA and the RAF made such a statement in the knowledge that A&AEE regarded a key component of the Mk2 upgrade “positively dangerous”. 9. The Service department should then incorporate the CAR in its entirety as Part 1 of the RTS. Part 2 contains Service Deviations, usually associated with Service Modifications. It is the content of Part 2 which often makes the aircraft “fit for purpose” (an operational term) as the CAR build standard usually lacks equipment or capability for in-theatre use. Hence, the RTS is the Master Airworthiness Reference.



10. All studied past MoD correspondence regarding this accident only refers to the CAR, not the RTS. So MoD has demonstrably used the incorrect baseline when discussing or making claims about airworthiness. Chinook HC2 - ZD 576 CAR & RTS aspects 11. The regulations (including CA Instructions at the time) require the CAR and RTS to list all avionic equipment fitted (e.g. Communications, Navigation, etc), with associated limitations, ARI (Airborne Radio Installation) numbers and the level of clearance for each (e.g. “switch-on only” or “full”). Any warnings and Operating Notes associated with each equipment item are to be included in the Initial Issue CAR. 12. That is, a positive statement is required for each equipment item; a statement which provides confidence to the Operator that the installed performance has been properly evaluated and established; a process from which Limitations are derived. So, if any equipment is fitted to the aircraft, but not listed in the CAR/RTS, then not only is there no clearance to use the equipment and the operator can have no confidence in that equipment; itself a Human Factor hazard and distraction. 13. The following table, of Navigation equipment, extracted from the Mk1 and Mk2 RTS, illustrates the failure to implement this simple regulation;

Mk1 Mk2 Mk2 Mk2 Chinook Navigation Equipment

Initial AL1 AL6

Nov 93

Mar 94

Jan 96

Decca TANS 9447 F-09 *

Decca ACD 1655E Automatic Chart Display *

Decca Doppler 71 * * *1 *

Decca Navigator Mk19 *

Marconi AD380 Radio Compass (ADF) * *7

GM9 Compass * * *2 *

E2C Standby Compass * * *3 *

Decca 671 VOR/ILS * *8

Marconi AD2770 TACAN * * *4 *

Marconi ARC 340 VHF (fm) Homing *

Chelton 7 VHF (am) Homing *

APN 198 Radar Altimeter * * *5 *

SD 1/91 RNS252/Trimble 8000 GPS * * *6 *

SD 18/91 OMEGA Grid Mode Selector *

SD 27/91 Delco IVA Carousel INS * *

SD 28/91 OMEGA Nav System *

* = Listed in RTS

AL1 is that current at the time of the accident

Notes from RTS

1. Poor performance in rain, degraded performance over water 2. To be synchronized at least every 15 minutes 3. Indicates within 5 degrees of GM9 4. A simple statement is made that TACAN operates up to 40nm 5. Spurious indications when onboard radios used. NB: the AAIB determined the Radar Altimeter was faulty. 6. GPS not declared operational by the ‘US Department of Defense’ and accuracy is therefore not guaranteed to

any level. Accuracy could degrade substantially without any indication to crew. The “Err”(or) figure displayed which has conventionally been taken as a measure of GPS performance, is meaningless and so no indication of the accuracy of the GPS is available to the user.

7. Significant errors can be expected in the vicinity of large convective clouds. 8. Due to the possibility of an inadvertent uncommanded fly-down indication, HF is not to be used during an ILS

approach at night or in IMC. Pending further trials, ILS is not to be used as the sole approach aid in IMC.

14. No guarantee of performance is given for Doppler, TACAN or RNS252/GPS, with significant cumulative errors being common in the compasses. In particular, it would seem the VOR/ILS system was not trialled and installed performance established until after the accident, and the limitations noted in January 1996 were still extant in September 1998 at AL8.



15. It can be seen that, of those navigation equipments cleared for use in the Mk2, all but TACAN are noted as having limitations, some more severe than others. Also, that some navigation equipment is NOT mentioned at all in either Mk2 RTS issued before June 1994. The only possible conclusion is that A&AEE had not completed the regression testing to ensure (at least) the installed performance had not degraded following the changes of build standard. In particular, they would have been keen to ensure the introduction of a new fuel computer was safe and not subject to Electro Magnetic Interference (EMI) from existing equipment.

In the context of a new aircraft Mark, and compared with the detailed clearances in the Mk1 RTS, this would not instil confidence in aircrew that the Mk2 was sufficiently mature. The contrast between the two RTS, both of which were extant and in use, is startling. 16. For simplification we have only listed navigation equipment, but the same applies to Communications, Electronic Warfare and other systems. We accept that certain Mk1 equipment would not be required post-Mk2 conversion, but have not made any judgment except to note subsequent clearances at AL6. The purpose of the table is to illustrate the fact that, as of June 1994, the installed performance and hence any limitations of the aircraft equipment installed performance had not been satisfactorily assessed; hence the status of the aircraft was immature. 17. We believe the above explains, in part, the background to the concerns expressed by the deceased pilots regarding the Mk2 and why they formally sought retention of a Mk1. This would have been exacerbated by virtue of the pilots having undertaken conversion training in an aircraft unrepresentative of the final build standard, but reverting to flying Mk1 aircraft until shortly before the accident; making them acutely aware of the differences in release conditions. Post Accident Investigation 18. The Design Authority, Racal, were tasked with analysing the surviving remnants of the RNS252 (“SuperTANS”). Their report concluded that the device was working at the time of the accident, but MoD extrapolated this basic assessment of one simple device to claim the entire navigation system was both serviceable and accurate. This claim defies accepted systems engineering wisdom, in that;

(a) The RNS252 is a simple computer; rubbish in, rubbish out. While it may have been processing the inputs correctly, there is no evidence the inputs themselves were correct (or correctly displayed).

(b) Racal’s testing was not conducted in a representative environment, but in a laboratory using

unvalidated and unverified techniques which were not subject to independent scrutiny. The significance of this is that, while the RTS notes various Electro Magnetic Interference (EMI) problems that may affect equipment accuracy, a laboratory is a benign EM environment and in no way indicative of the conditions in the aircraft. That is, the “evidence” used by MoD in no way reflects the actual installed performance in the aircraft; in fact, as stated above, there is considerable doubt as to whether this installed performance was fully established by June 1994. (And if one does not know what performance should be expected, how can one state an aircraft or system was functioning and accurate?).

19. We believe the above betrays a fundamental misunderstanding as to how systems engineering, safety management, validation and verification works; leading to equipment being cleared for use which has only been assessed for physical safety, not functional safety. As stated above, these are precisely the issues raised in the Haddon-Cave Nimrod report, and cited in other recent Boards of Inquiry and/or Inquests (e.g. Tornado, C130, Sea King). CAR/RTS Summary

20. We believe that neither the CAR nor RTS complied with the regulations governing format or content, lacking vital information and statements as to equipment ‘clearances’. Nor do we believe it is traceable to a defined and maintained build standard, rendering any Safety Case or Argument invalid and/or unverifiable. These failings extended to other vital components of the Aircraft Data Set, including Flight Reference Cards. In short, the mandated audit trail required by the Secretary of State before CAR or RTS can be signed did not exist at the time of the accident.



21. This is evidence not considered by ANY of the inquiries, yet is fundamental to both the airworthiness and the ability of the aircrew to (legally) do what the MoD say they should have done. It establishes, beyond any doubt whatsoever, that prior to the accident the airworthiness regulations had been systemically flouted, resulting in an immature aircraft being rushed into service; all mirroring the criticisms in the Haddon-Cave report. 22. Simply, Chinook HC2 - ZD 576 was neither demonstrably Airworthy nor Fit for Purpose and the resultant shortcomings, exacerbated by Flt Lt Tapper’s worries about the lack of a proper icing clearance on this mission, in the forecast weather conditions, clearly had an adverse Human Factors impact on the aircrew. Technical History Engine Incidents 23. Since the introduction of the HC Mk2 into Service in Oct 93, there were at least 15 engine related incidents in a total of 1258 flying hours; this excludes those incidents that occurred during tests associated with the overspeed limiter checks. Of the 15 incidents, 4 are considered to have particularly serious implications and are discussed in Appendix B. One in particular refers to RAF Odiham Incident Signal DTG 081730Z MAR 94. ZA 704 - No 2 Engine flamed out after FADEC Reversionary Switch selected during pre-flight checks on the ground. No fault found. 24. The "no fault found" engine was then fitted to ZD 576 after the 19 May incident referred to in Appendix B, but no comment or investigation on what had been done to confirm its serviceability came from the BoI. Was it relevant to the accident – who knows? … but a "proper" BoI would have looked at all these issues including the results of the other fault investigations that were taking place (and presumably completed) in the months between the accident and the publication of their findings. 25. I do not believe that the BoI understood the implications of the illegal PTIT (PDT) in one of the four incidents listed (see Appendix B); as evidenced by the very simplistic questioning of the technical witness on this issue and their failure to fully follow-up what he told them. . 26. It seems that the BoI did not investigate the AAIB issues with the component attachment to the control pallets. 27. We would respectfully invite the Minister to ascertain the facts surrounding the above issues

End of Appendix A



APPENDIX B – A&AEE MEMO (EXTRACT)

File Ref: ADD/308/04 dated 6 June 1994 CHINOOK MC Mk2 - CA RELEASE TRIALS References: A. A&AEE Letter Report TM 2210 - Chinook HC Mk2 - Interim CA Release Recommendations.

1. You will be aware that at Reference A we were unable to recommend CA Release for the Chinook

HC Mk2 aircraft due to unquantifiable risks associated with the unverifiable nature of the FADEC software. However, we offered advice and proposed limitations aimed at minimising any risk associated with unpredictable FADEC software behaviour in the event that it became operationally necessary to use the aircraft prior to verified software becoming available. This advice assumed that the reliability and integrity of the hardware in the engine control system was adequate, as appeared to be the case from rig, bench, Service experience and integrity studies.

2. Since the introduction of the HC Mk2 into Service in Oct 93, we are aware of at least 15 engine

related incidents in a total of 1258 flying hours; this excludes those incidents that occurred during tests associated with the overspeed limiter checks. Of the 15 incidents, 4 are- considered to have particularly serious implications and are discussed below:

a. RAF Odiham Incident Signal DTG 081730Z MAR 94. ZA 704 - No 2 Engine flamed out after

FADEC Reversionary Switch selected during pre-flight checks on the ground. No fault found.

b. RAF Odiham Incident Signal DTG 281232Z AFR 94. ZA 681 - No 1 Engine rapidly shut down after FADEC Reversionary Switch selected during pre-flight checks on the ground. No fault found.

c. RAF Laarbruch Incident signal DTG 1309232 MAY 94. ZA 671 – Nr rose rapidly to exceed 120% after both FADEC Reversionary Switches were selected during pre-flight checks. No fault found, but forward and aft rotor head tie bars were found to be distorted, indicating that the overspeed limiter system had failed to function.

d. RAF Odiham Incident Signal DTG 191545Z MAY 94 ZD 576 Emergency Power Caption illuminated twice in flight and once on the ground. PDT of No 1 Engine reached 950°C. No fault found, but blueing and minor cracking evident on blade tips of turbine nozzle assembly stators.

3. Three of the above incidents occurred on the ground during FADEC Reversionary lane checks, and

there is in place a restriction on the manual selection of Reversionary mode in flight, However, we no longer consider this to be an adequate safeguard against the possibility of a potentially serious in-flight incident. The Reversionary mode is a vital safety feature in a full authority digital system and as such has to perform in a reliable and effective manner. At some stage we must expect a primary lane failure in flight which will result in the automatic selection of "Reversionary Mode" but experience to date suggests that the basic requisites of that system may not be met.

4. Whilst we are aware of the very considerable steps you are taking to determine the causes of these

incidents and of the ongoing investigations involving a report from HSDE, the Textron 'White Paper', the EDS Scicon verification study and the T55 software block change proposals, I have to state that the serious, frequent and unexplained incidents to which I have alluded, have eroded what confidence we had in the Chinook HC Mk2 engine management system. This unease has grown despite our meeting on 25 May. The unquantifiable risks identified at the Interim CA Release stage may not in themselves have changed but some have become more clearly defined by events, to an extent where we now consider the consequences of the risks and the probability of an occurrence to be unacceptable.

5. As a result of our concerns for the flight safety of the aircraft, I have regretfully taken the decision to

suspend Chinook HC Mk2 flight trials until such time as we are satisfied with the explanations for, and solutions to, the above incidents. Furthermore, we strongly recommend that you make our concerns known to the RAF in order that they may consider their, own position.

6. Please be assured that this decision has been taken in complete isolation from the tragic accident that

occurred on the Mull of Kintyre on 2 June, and that we remain committed to pursuing the outstanding CA Release trials as soon as our flight safety concerns are overcome. In the meantime, we will of course continue to provide you with whatever advice and assistance we can in your deliberations and to help bring the outstanding investigations and studies to a satisfactory conclusion.

End of appendix B

END OF ADDENDUM 3 – HC2 AIRWORTHINESS

Documents

Macdonald Report - 20 April 2000 - 2010 Update-with Contents List