The loss of Chinook HC Mk2 ZD576, Mull of Kintyre, 1994

The airworthiness status of the Chinook Mk2 fleet on 2 June 1994

Following initial assessment in late-1993, MoD’s Independent Safety Assurance Authority at A&AEE Boscombe Down, and in accordance with the Chief Scientific Advisor’s advice to the Secretary of State for Defence, which was then mandated upon MoD staff, identified that the implementation of the Safety Critical Software for the fuel computers was ‘illegal’, and its implementation ‘positively dangerous’. [1] [2]

When implementing this mandate, there are two principles governing the assessment of design maturity. The System Integration Readiness Level (SIRL), and hence functional safety, of a system cannot be greater than that of the lowest contributing Technology Readiness Level (TRL). And, the SIRL of a system should be assessed as equivalent to the lowest SIRL of the contributing individual sub-systems. (Each has 9 levels). TRL 6/7 is required before entering production.

As the unverifiable Safety Critical Software was at no more than TRL 4 (prototype), then that was the overall SIRL of the new Full Authority Digital Engine Control (FADEC). While the engine itself was at TRL8 (but not when using the new FADEC), it is of no use without fuel flow.

Citing this as the primary reason, Boscombe declared to the MoD Project Director, a senior officer, that the aircraft at this time was unairworthy, and they could not recommend Controller Aircraft Release; which is a mandatory prerequisite to the RAF authorising Service Regulated Flying. Specifically, they applied a formal clearance status of INTERIM, also termed Switch-On Only, meaning it was ‘not to be relied upon in any way whatsoever’.[3]

On 9 November 1993 Controller Aircraft Donald Spiers (later Sir) mandated this upon the Assistant Chief of the Air Staff, Air Vice Marshal Anthony Bagnall (later Air Chief Marshal Sir).[4] In his 2011 Mull of Kintyre Review, at paragraph 2.2.8, Lord Alexander Philip confirmed this ‘mandate’, but did not articulate the precise meaning.

Instead, on 22 November 1993 AVM Bagnall issued a Release to Service (the Master Airworthiness Reference), and RAF pilots were instructed to fly the Mk2. In doing so, a false declaration was made to them that the relevant mandates, regulations and legal obligations had been satisfied. In fact, it is clear from MoD correspondence that the aircraft was being flown from October 1993, and one key outstanding question is: under what authority?[5]

Matters got steadily worse, Boscombe grounding their aircraft twice; on 7 March 1994, only resuming flying on 20 April 1994; and again the day before the accident, having ceased flying above 5,000 feet over a week earlier. These groundings were directly related to FADEC immaturity.[6] An overriding factor was there was no Certificate of Design for Safety Critical Software, meaning it should not have been accepted off-contract. That it was, and the RAF were flying, meant Boscombe were handed a fait accompli, and had to make the best of a bad job, doing their best to provide some form of safety assurance.

However, on 2 June 1994, the day of the accident, their formal position was:

‘The previous forecast of unpredictability is now a reality. The previously unquantifiable risk is now much more clearly defined, and is, at present, unacceptable. Even limiting the potential to a single engine problem, it would be impossible for the aircraft to conduct its role if it were required to remain in a safe single engine flight condition. This precludes a reasonable assurance of safety of any flight, let alone relatable trials flying. These recommendations with respect to FADEC have, to date, been ignored. Until (we) are provided with a clear, unequivocal, reasonable explanation of the faults described, with corrective action, further Chinook Mk2 flying will not be authorised. As such, we deem it imperative that, in the strongest possible terms, the RAF should be provided with a recommendation to cease Chinook Mk2 operations until the conditions established (above) are satisfied’. [7]

That evening, 25 passengers were put in an aircraft even the MoD’s most experienced test pilots were forbidden to fly.

In February 2012 MoD finally admitted the Mk2 was only cleared for training and familiarisation. As the clearance precluded flight, that was ground use only.[8]

All of the above was known to senior RAF officers, including the Air Staff.

*

Let me explain the central point briefly, as everything else falls out of that.

The Controller Aircraft Release is the statement by MoD’s Controller Aircraft (a 3-Star) to the Assistant Chief of the Air Staff (ACAS, a 2-Star) that the aircraft type is airworthy at a given build standard, subject to stated and mutually acceptable Limitations. This is mandated upon ACAS. It is not authority to fly the aircraft - ACAS provides that in his Letter of Promulgation, issued with his Release to Service. The first such letter MoD admits to is dated 12 January 1996, signed by AVM Bagnall’s successor.

INTERIM is not a temporal term, but a type of clearance. It is meant to refer to individual equipment that has been added to an already airworthy aircraft, say for trials. But here it applied to the whole aircraft, and this was made clear in both Boscombe’s INTERIM Controller Aircraft Release Recommendations, and accompanying technical reports; which had to be read together.

Post-Release to Service, testing and trials continued, and some aspects of the INTERIM clearance were lifted at Amendment List 1 on 1 March 1994. But this ‘rolling release programme’ then rolled backwards, with the two groundings. On 2 June 1994 the following sections of the Release were still at INTERIM (those considered irrelevant to this flight have been omitted for brevity):

G Fuel System

H Automatic Flight Control System

J Hydraulic System

K Electrical System

M   Radar Systems

N Communications Systems (Section marked ‘intentionally blank’, meaning no communications systems permitted in the aircraft)

P Armaments

Q Instrument and Night Flying

T Role Equipment (Freight, Passengers, Extended Range Fuel System)

W   Aircrew Equipment (Helmets, Armour, etc.)

Y Fuel, Oils

Z Modifications

In addition, Section O (Navigation Systems) places severe restrictions on the new SuperTANS navigation computer and GPS installation, saying the latter has not yet been declared operational and its accuracy is not guaranteed to any level, and the former provides ‘Error’ warnings that are not yet understood.

*

The Government’s consistent position was that ‘new’ evidence was required before the gross negligence findings again the pilots could be reconsidered. Setting aside that it was for the RAF to prove guilt, and their position was that it was for the deceased pilots to clear themselves[9], the only new evidence mentioned by Lord Philip was the above mandate on the Air Staff. There can be little doubt this is what prompted the quashing of the findings. The official reason given by the Government, poor legal advice, had already been refuted many times, and recorded in (e.g.) Hansard.[10]

As its findings have been quashed, it follows that the Board’s work is incomplete. The evidence to, and accepted by, Lord Philip shows it to be flawed and deficient.

The aim of any investigation is to prevent recurrence. The ZD576 investigation did not achieve this, primarily because so much was concealed from the Board. Unable to fulfil its aim, further fatal accidents with the same root cause followed. Nimrod XV230, 14 killed. Hercules XV179, 10 killed. Sea Kings XV650 & 704, 7 killed. Hawk XX177, one killed. And more.

The Board of Inquiry must be reconvened to complete its work. As the Fatal Accident Inquiry (which also seeks to prevent recurrence) relied entirely upon the Board’s report, it too was tainted and must be reopened. Police Scotland must reopen its investigation. Our serving and future servicemen - and the public whom their overfly - deserve no less.

[1] AEN/58/119(H) dated 18 August 1993 (Chinook HC Mk2 - Status of Engine FADEC Software).

[2] AEN/58/119(H) dated 30 September 1993 (Chinook Mk2 - T55 Engine FADEC Software)

[3] Joint Service Publication 553, Military Airworthiness Regulations.

[4] INTERIM Controller Aircraft Release, 9 November 1993.

[5] ADD/308/04, 6 June 1994.

[6] D/DHP/57/4/1, 31 May 1994. Minutes of a T55-L-712F Engine FADEC meeting held at A&AEE Boscombe Down on 25 May 1994.

[7] AFW/R/127/04, 2 June 1994

[8] MoD letter, 28 February 2012.

[9] Mull of Kintyre Review, paragraph 6.2.9.

[10] For example, Geoff Hoon, Secretary of State for Defence, 30 October 2000 and 25 September 2001. Lord Bach, Minister for Defence Procurement, 30 July 2001.