MINISTRY OF DEFENCE:
ACCEPTANCE OF THE CHINOOK MK2 HELICOPTER
GIVEN THE BURDEN OF PROOF REQUIRED, THE FINDING OF
THE RAF BOARD OF INQUIRY ON THE CAUSE OF THE CHINOOK ZD-576 CRASH
IS NOT JUSTIFIED BY THE AVAILABLE EVIDENCE
18. The RAF convenes a Board of Inquiry to investigate
the cause of all significant air incidents and accidents. In line
with this procedure, a Board of Inquiry was established to examine
the crash of Chinook ZD-576 on the Mull of Kintyre on 2 June 1994.
The Board of Inquiry found the pilots of ZD-576, Flight Lieutenants
Jonathan Tapper and Rick Cook, guilty of gross negligence in causing
the crash of their aircraft. According to the then extant RAF
regulations, a finding of gross negligence must be substantiated
by a burden of proof that there is "no doubt whatsoever."
In the case of ZD-576 the Committee considers that the burden
of proof was not, and cannot be, sustained by the evidence available.
Areas of doubt relate to the condition of the Chinook Mark 2 fleet
at entry to Service, to the incomplete nature of the technical
evidence from the crash of ZD-576, and to negligence being found
in the absence of any other explanation rather than being positively
identified as the cause.
At entry to Service and the time of the crash
of ZD-576 the Chinook Mark 2 fleet was experiencing widespread
and repeated faults caused by the FADEC software
19. On entry to service there were a number of faults
across the Chinook Mark 2 fleet,[46]
including on ZD-576, stemming from the FADEC system software.
The Committee asked the Department to provide a full analysis
of the faults reported on the FADEC between the time the helicopter
entered service and October 1994. The Department declined to answer
the question on the basis that to do so would take some six months
at considerable cost.[47]
The faults with the FADEC led to doubts as to the reliability
and safety of the aircraft at the time and make it very difficult
to rule out categorically a technical fault as at least a contributory
cause of ZD-576's crash:
(i) Since its introduction
into Service the Chinook Mark 2 has experienced six engine run-ups
and one run-down whereby the engine speed would change without
the pilot requiring it.[48]
The Department state that all these incidents occurred on the
ground; but an in-flight run-up or run-down of the engines would
have had serious consequences. These problems stemmed from faults
in the FADEC software[49]
and were part of the reason that the operation of the aircraft
was restricted to lower than maximum payloads;
(ii) During the aircraft's initial operating
period the engine fail caption warning light in the cockpit would
come on, requiring the crew to go through the engine failure emergency
drill which takes around a minute. Although spurious, those false
alarms were warnings of a potentially catastrophic failure which
had to be taken seriously by the crew. Again those faults originated
in the FADEC software;[50]
(iii) Although the Department have referred
to the faults during the initial in-service operation of the Mark
2 as "nuisance" faults[51]
nonetheless the FADEC software was upgraded to eliminate them.
The upgrade was not completed until the aircraft had been in-Service
for well over a year and after the crash of ZD-576;[52]
(iv) The cause and significance of the faults
experienced during initial aircraft deployment are now well understood.
However, at the time of the ZD-576 crash they were not,[53]
and both the aircrew and groundcrew operating the aircraft could
not have been sure of their implications for the safety of the
aircraft and would have had to react to every fault accordingly;
(v) The faults were such that test flying
at Boscombe Down was suspended in June 1994. Test flying did not
re-start for five months until the manufacturer of the FADEC system
had provided adequate explanations of why the faults were occurring
and what the implications were for the safe operation of the aircraft.[54]
Throughout this period operational squadrons continued to fly
the aircraft.
The technical evidence relating to the performance
of the FADEC systems on ZD-576 was incomplete
20. As part of the post-crash investigation, the
Air Accident Investigation Branch (AAIB) conducted a technical
examination of the wreckage to support the RAF Board of Inquiry.
Part of that examination related to the engine systems and "in
view of the reports of a number of ongoing service difficulties
experienced with the operation of the FADEC, the engine change
units and the FADEC were examined in some detail."[55]
However, the technical evidence relating to FADEC performance
was incomplete because:
(i) The prime source
of data on the performance of the FADEC system was the Digital
Engine Control Unit (DECU) from each of the two engines. Data
was recovered from only one of the DECUs because the other had
been irretrievably damaged by post-impact fire. [56]
It is not, therefore, possible to be absolutely definitive (as
required for a finding of gross negligence) that the FADEC was
performing normally at the time of the crash;
(ii) The FADEC system had caused repeated
spurious failure warning lights to be displayed in the cockpit,
a source of distraction for the crew. The Department stated that
if FADEC had been a factor in the crash of ZD-576 the status of
the warning lights would be key substantiating evidence. In evidence,
the Department advised that "there were no lights on in the
dashboard at the time."[57]
The Department have subsequently informed the Committee that,
although they are confident that the warning lights for number
2 engine were not illuminated before impact, that they do not
know if the lights for number 1 engine were on or off.[58]
Again, it is not possible to reach a definitive conclusion either
that the lights were off and thus did not provide a distraction
to the crew as they approached the Mull of Kintyre, or that the
FADEC was working normally.
Negligence should only be found when it is
definitively the cause of a crash, not simply as a last resort
in the absence of any other more convincing explanation
21. RAF Regulations extant at the time of the crash
investigation required that the burden of proof for negligence
demonstrate "no doubt whatsoever." In turn this requires
that there should be proof positive that the actions of the aircrew
caused the crash:
(i) In the case
of ZD-576, in the absence of a conclusive cause, the Reviewing
Officers to the RAF Board of Inquiry selected negligence as the
most likely cause because "none of the possible scenarios
was so strong as to have been likely to have prevented such an
experienced crew from maintaining safe flight."[59]
We find that logic flawed. The proper approach should have been
to reach a finding of gross negligence only if it could be positively
ruled in. We consider that, had that proper approach been taken
a finding of gross negligence would not have been returned;
(ii) Because ZD-576 crashed in Scotland,
a Fatal Accident Inquiry was held, conducted by the Sheriff Sir
Stephen Young. Having considered evidence from all parties the
Sheriff could not find a definitive cause for the accident. The
Fatal Accident Inquiry works to a lesser burden of proof in determining
cause, its findings being based on a balance of probabilities
rather than no doubt whatsoever. However, even against this lesser
burden of proof the Sheriff could not agree with the Board of
Inquiry's finding of gross negligence. We are surprised that the
Department have not taken on board this learned legal judgement.
Indeed, we believe that the Department should now recognise and
should be guided by the decision of the properly constituted Scottish
court, and should recognise that court's superior standing over
their own domestic procedures. We regard the Department's preference
for the results of their own procedures as constituting unwarrantable
arrogance;
(iii) In crash investigations, particularly
in civilian aviation, the most compelling evidence in determining
a cause comes from cockpit voice and accident data recorders—black
boxes. Chinook ZD-576 was not fitted with either a cockpit voice
recorder or accident data recorder despite comments from three
previous Chinook RAF Boards of Inquiry.[60]
As a result there is inevitably a degree of speculation as to
the cause of the loss of ZD-576. We do not understand how, given
the absence of the definitive information that black boxes could
have provided, the Board of Inquiry and the Department can have
no doubt whatsoever that crew negligence caused ZD-576 to crash.
THE PROCESS OF RAF BOARDS OF INQUIRY
IS OPEN TO CRITICISM AND SHOULD BE CHANGED
22. RAF Boards of Inquiry are convened to establish
the causes of incidents and accidents involving RAF aircraft and
make recommendations for future safety improvements. Until recently
they also apportioned blame for accidents. The decision in 1997
to drop the requirement for Boards of Inquiry to apportion blame
was a welcome change. Figure 1 illustrates how the Board of Inquiry
process works with specific reference to the case of Chinook ZD-576.
It demonstrates that there are still elements of the Board of
Inquiry process that could lead to controversy.
(i) The officers
reviewing the findings of the investigating board had command
responsibility for the management and provision of the support
helicopter fleet. They would therefore have had an interest in
ensuring minimal disruption to the support helicopter fleet, particularly
in the light of the problematic acceptance process. We have already
demonstrated why the findings of the Board are unsound. We believe
that the reviewing officers in the case of ZD-576 reached their
conclusions in good faith, however, their position as commanding
officers for the helicopter force leaves them open to allegations
of conflict of interest, and reduces the perceived objectivity
of the findings of the Board;
(ii) The current process for convening RAF
Boards of Inquiry embodies the perceived conflict of interest
shown in the case of ZD-576 because Boards are convened by, and
report to, senior officers with line management responsibility
for the equipment and personnel involved. It is absolutely essential
that the Board of Inquiry process must be seen to be fair. The
current process does not help.
23. We strongly recommend that the Board of Inquiry
process should be revised to ensure that those officers have management
and command responsibility for the aircraft and the personnel
involved do not influence or control the findings of Boards of
Inquiry.
46 Evidence, Appendix 1, Section 3, response to Qs 102-103,
112-113, para 5, pp 33-35 Back
47 Evidence,
Appendix 2, covering letter para 2, p42 Back
48 Evidence,
Appendix 1, Section 3, Qs 102-103, 112-113, para 4, pp 33-35 Back
49 Evidence,
Q106 and Evidence, pp 1-2, paras 4 and 6 Back
50 ibid Back
51 Evidence,
Appendix 1, Section 1, para 6, p32 Back
52 Evidence,
Q248 Back
53 Evidence,
Appendix 1, Section 2 (not reported) Back
54 Evidence,
Appendix 1, Section 2 (not reported) Back
55 Air
Accident Investigation Branch, Statement to the Board of Inquiry,
para 7.3, and Evidence, Appendix 1, Section 1, para 8 (not reported) Back
56 ibid,
para 7.3.4 and RAF Board of Inquiry Proceedings, para 35b (not
reported) Back
57 Evidence,
Q33 Back
58 Evidence,
Appendix 1, Section 3, response to Q33, para 2, pp 37-38 Back
59 ibid,
Section 2 (not reported) Back
60 Evidence,
Appendix 1, response to Qs 240-241, para 1, pp 38-39 and Evidence,
Appendix 2, response to Q18, pp 51-53 Back
|
