Chinook Airworthiness Review Team (CHART) report, August 1992

1. CHART notified the RAF’s airworthiness senior chain of command (but not MoD’s) of systemic failings. (The Nimrod Review of 2009 reiterated these 17 years later). It mentioned Chinook Mk2 284 times. Why, then, was the content and its implications not advised to the ZD576 Board of Inquiry by the Air Staff and the RAF Chief Engineer, given it contained exculpatory evidence? Who made this decision?

2. As the failings were systemic (affecting all Air Systems), why was Controller Aircraft not shown CHART, the content of which demanded a review of the assumptions underpinning all current Controller Aircraft Releases?

3. Similarly, did the Air Staff undertake a review of aircraft accidents that had occurred since the systemic failings were first reported? (That is, CHART ‘merely’ confirmed past notifications).

4. Given many of the same failings were (unwittingly) repeated in the Board of Inquiry report, if the RAF Chief Engineer took action who was so tasked, and why had no progress been made? (Witness the 2009 Nimrod Review, and evidence to the Public Accounts Committee on 3 March 1999 by Sir Robert Walmsley, Chief of Defence Procurement).

5. Who in the RAF senior command, knew that within 3 months of CHART being issued civilian airworthiness specialists were threatened with dismissal by the RAF for continuing to raise the same issues?

6. Regarding the statement at Paragraph 10 that ‘Boeing Helicopters had not acted as an offshore Design Authority before’, if MoD was not confident the relevant mandated regulations could be complied with (by Boeing), on what basis were they appointed?

7. Who approved and appointed Boeing before, and after, the CHART report?

8. What action was taken between August 1992 and June 1994 to ensure Boeing improved and met the standard required for their appointment?

9. Did MoD explore the possibility of, for example, a competent Aircraft Design Authority acting as Co-ordinating Design Authority, or Design Custodian, with a directed sub-contract on Boeing?

10. Regarding 224 Maintenance Procedures being out of date, how many of these remained applicable to the Mk2 Build Standard, and when were they corrected?

Full Authority Digital Engine Control (FADEC)

11. Why was FADEC accepted off-contract with the Safety Critical Software unverified, lacking a Certificate of Design and Performance, and with its implementation described as ‘positively dangerous’ by MoD’s Independent Safety Assurance Authority?

12. What dialogue took place between Textron, Boeing and MoD regarding the impact of this on their respective Safety Cases?

13. What were RSRE Malvern’s views?

14. What did the mandated Pre-contract Questionnaire say about safety criticality, verification and acceptance?

15. What advice was sought from, and provided by, the Principal Director of Patents regarding the requirement that ‘MoD should have all the rights it needs for in-service support of the software and for critical analysis’?

16. What action was taken when the officer charged with developing the syllabus to ‘train the trainers’ reported in late-1992 that Boeing professed ignorance of how FADEC worked?

17. Given this self-proclaimed ignorance, why had Boeing been contracted to install, test and demonstrate the installed performance of FADEC in the Mk1? (Resulting in an accident on 20 January 1989, and litigation).

Airworthiness of Chinook HC Mk2 / Acceptance

Acceptance off-contract

18. Certification is required ‘prior to the delivery of the first production equipment’. Who approved the FADEC software, the complete FADEC, and the aircraft itself, being accepted off-contract without valid Certificates of Design and Performance?

19. Who issued a Concession/Production Permit, if there was one? If there was not, why not?

20. When endorsing the Mk2 Build Standard before being frozen for production, did the RAF know that FADEC (including its Safety Critical Software) had not yet been certified?

21. Was the Treasury Solicitor’s approval or advice sought?

22. How did Boscombe, the MoD Project Director, and the Air Staff deal with this, and the ‘positively dangerous’ software implementation, in their respective Safety Cases?

23. How did the monthly 2-Star risk assessments deal with ‘unverifiable’ and ‘unpredictable’ software, lack of airworthiness, and inability to meet acceptance off-contract regulations?

INTERIM Controller Aircraft Release / Release to Service

24. What correspondence took place between Controller Aircraft/his staff, and the Air Staff/RAF Support Authority before 22 November 1993, regarding the Mk2 not being airworthy?

25. Under what authority, and why, did Controller Aircraft issue an INTERIM Controller Aircraft Release when his own rules prohibited it?

26. Why did he not reference the Boscombe Down reports stating why the aircraft type was not airworthy; which, Boscombe stated, had to be read in conjunction with what Controller Aircraft issued?

27. Similarly, why were these not passed to aircrew and engineers by the Air Staff to facilitate informed decisions on continuing airworthiness, serviceability, and fitness for purpose?

28. Were the findings of these reports reflected in the Aircraft and Aircrew Publications, as of 2 June 1994? For example, the emergency radio not functioning in an emergency.

29. On what basis was the time limited Controller Aircraft Release issued (due to expire on 10 June 1994)? Why was this not detailed in the INTERIM Controller Aircraft Release, or advised to aircrew?

30. Given the mandate that the Mk2 was not airworthy, who underwrote the performance and safety of the aircraft?

31. The 5,000 feet altitude limit set by Boscombe Down was conditional upon a manual FADEC reversionary mode, and Safety Critical Software rewrite. Neither was carried out. It was then increased to 10,000 feet on 1 March 1994, again without the conditions being met. Who agreed to this, and was he made aware of these pre-conditions?

32. The increasing concerns over FADEC negated the reasoning behind the 10,000 feet limit, the RAF at Boscombe reverting to 5,000 feet in May 1994. Why, then, did Controller Aircraft not amend his INTERIM CAR, and ACAS his Release to Service? Was this reversion to a previous restriction, and the reasons, advised to the RAF?

Acceptance into Service / Release to Service

33. Under what authority were RAF Mk2’s flown before a Controller Aircraft Release was issued?

34. Given the mandate he was under, did the Assistant Chief of the Air Staff seek higher authority to approve Service regulated flying?

35. Further to the time limit (above), ACAS may issue an Initial Acceptance (into Service) if there is insufficient evidence to seek either Limited or Full acceptance. How was this agreed, and promulgated, given the Release to Service proper does not say it was superseding a previous authorisation?

36. Was advice sought from RAF Legal Services?

37. Were the risks associated with flying an unairworthy aircraft advised to (a) the Chief of the Air Staff, or (b) the Secretary of State?

General

38. The Release to Service is the key document through which MoD discharges its Duty of Care on military aircraft. Given it was mostly non-compliant (evidence to the Mull of Kintyre Review), by what means did, or could, MoD discharge its Duty?

39. The list of Boscombe Chinook reports, as of May 1994, includes only one giving advice on a Service Deviation for Chinook Mk2. Why were there no reports on the others, especially given their potential impact on functional safety?

40. Who drafted the July 1994 AOC-in-C Strike Command letter to the Assistant Chief of the Air Staff, in reply to the latest notification that the Mk2 was not airworthy? Was it sent?

41. Were Boeing granted the delegation set out in Defence Standard 05-125/2 (mandated in all aviation contracts) to initiate safety-related investigations without first seeking MoD approval to commit expenditure? Did Boeing implement this on any of the issues arising from Mk2 testing and trials?

42. Why was no amendment issued to the Chinook Mk1 Release to Service subsequent to 8 September 1988, in particular one reflecting the anomalies found in the Mk2?

43. Who in the Army agreed to curtail planned training deployments due to the programme delays?

Build Standard

44. Given the Release to Service did not set out the Build Standard against which it was issued, what was ZD576’s Build Standard based on? That delivered off-contract, that trialled, that in the Air Publications; or another?

45. Were these different Build Standards reflected in separate Issues of the Safety Cases?

46. What was the minimum Build Standard required for safe flight? Did ZD576 comply?

47. What Build Standard was ZD576 at? For example, did she have the Missile Approach Warner (SD 5/94) or Cougar/Keystone Secure Comms (SD 7/94)? If not, why was she permitted in-theatre? (The Release to Service prohibited their fit).

48. If these equipments (and others) were not fitted to ZD576, but were in the Mk1, what procedures had been developed and practiced to cope with this different Build Standard?

49. Why were these and other equipments subject to Service Deviations in Mk1, not included in the Mid-Life Update? (Noting that the Director of Flight Safety had stated in CHART that they were to be included).

50. Were the crew told most of the equipment they had to rely upon was not permitted in the aircraft? (Ultimately prohibiting engine start-up).

51. What action was taken when, in January 1993, the RAF (Air Member Supply and Organisation) issued instructions that Build Standards, including Safety Cases, were not to be maintained? (And ensured this by withdrawing funding).

Technical Publications

52. Who waived the requirement that complete Flight Reference Cards be available six months before the Release to Service was issued?

53. When were Flight Reference Cards, Aircrew Manual and Operating Data Manual validated and verified by the Publications Technical Agency?

54. Why were air publications still subject to hand-written amendments based on hearsay, when they had to be verified before the In Service Date?

55. What action was taken when Aircraft Technical Publications 2 (ATP2 in Glasgow, and his staff) reported pre- and post-accident that Boeing had no understanding of how to construct publications to MoD Standards?

Argentinian Publications (see CHART report)

56. Who authorised the use of captured and unmaintained Argentinian Publications?

57. What nature did this authorisation take?

58. Was it time-limited and was it periodically reviewed?

59. Were they translated, validated and verified to confirm they reflected the UK Build Standard?

60. Were complementary MF765 (Unsatisfactory Feature Reports) raised and were they actioned?

61. Would Aircraft Technical Publications 2 have the authority or wherewithal to update Argentinian publications?

62. Was the Aircraft Design Authority's advice sought?

63. Had their use ceased on 2 June 1994? If so, were the replacement publications validated and verified on time?

64. What follow-up action was taken to ascertain how widespread this practice was?

Navigation

Automatic Chart Display

65. Regarding the Automatic Chart Display, which was correct - the Aircrew Manual or the Release to Service? Or was ZD576 different still? That is, the Manual said it was fitted, the Release said it was not.

66. What equipment/functionality/procedures compensated for the removal of the Automatic Chart Display?

67. Was an assessment conducted of whether the removal of Automatic Chart Display would exacerbate the effects of a ‘goldfish bowl’ scenario? What training was provided at this new Build Standard and Usage? (In other words, was the visual illusion Risk Score reassessed as there would no longer be a pictorial representation of the aircraft’s position?)

SuperTANS/GPS

68. Did Flight Lieutenant Tapper (the aircraft captain and non-handling pilot) submit a post-visit report after visiting Racal in May 1994, and what action was taken? Did Racal submit a report to the MoD Technical Agency? Indeed, were they under contract to support this activity, and to what level?

69. Did the RAF ensure aircraft power compatibility when selecting the commercial standard Trimble TNL8000 GPS? (Given the power supply faults found in ZD576’s GPS).

70. Given both the Trimble TNL8000 GPS and Racal RNS252 were procured from Racal, was the company under contract to demonstrate and underwrite the performance of the (a) integrated sub-system, and (b) the Navigation System as a whole. If they were not, who was?

DASH runaway warning

(Whereby a warner had been recommended after previous fatal accidents, and considered ‘Essential’).

71. Why was this not included in the Mid-Life Update, knowing that its omission would inevitably be snagged by Boscombe, thus delaying the Mk2 programme?

Pallet insert de-bonding and repair

72. If, as MoD claimed, pallet insert de-bonding in ZD576 was a one-off event in May 1994, was any consideration given to why the US Army already had their own repair scheme, dated 1990?

73. Notwithstanding this claim, why did the RAF use the US Army scheme twice on ZD576, despite Boeing expressing concern over it?

74. Was there a Boeing scheme at this time? If so, why did the RAF reject it?

75. What did the Design Review and Acceptance process say of the failures that led to this situation?

76. Why did the RAF later revert to the Boeing scheme in 1997? In what way was the US Army scheme now considered inadequate?

77. Was an assessment carried out on previous repairs carried out in accordance with the US Army scheme?

78. How were repairs, under either scheme, verified? (A repair is not complete until verified).

Chinook Mk2 groundings (March - April, and June - November 1994)

79. MoD confirmed the grounding was ‘an expediency within the proper exercise of airworthiness considerations by Boscombe Down’. (MoD facsimile 15 September 1996). Why were these airworthiness considerations not applied to the wider RAF fleet?

80. What reply did Boscombe and the MoD(PE project office receive after seeking an explanation from the manufacturers about FADEC and its software?

81. Given this indicates Boscombe were not involved during development, or at the design reviews, why were they not?

82. Given the reasons for the groundings, which repeated Boscombe notifications from mid-1993, were Boeing and Textron, the Aircraft/FADEC Design Authorities, tasked to update their respective Safety Cases? Did they comment in any way?

83. Who issued the orders to continue flying after the groundings, and for what reason?

84. Was the RAF Director of Flight Safety consulted, given the reasons repeated his warnings of August 1992?

85. What failure modes and effects data was available to Boscombe and Boeing; and subsequently the Board?

Training

86. How was the legacy failure to adequately train crews and engineers on Mk1 ameliorated on Mk2 before it entered service?

87. Was the content of the Mk1-Mk2 Differences Course changed post- Release to Service Amendment List 1, issued on 1 March 1994?

88. If the Difference Course did not reflect the 2 June 1994 Build Standard, did aircrew receive supplementary training after attending? For example, covering Service Deviations 1/94 and 2/94, and the approved but not yet promulgated Service Deviations 3/94 - 9/94, and the serious performance and safety issues they introduced.

89. Were the instructors on the Differences Courses adequately trained or briefed at all times on the progressive changes to the Build Standard?

90. If they were not, why did they proceed?

91. Did they report the deficiencies, and to whom?

Support (General)

92. Given ZD576 was the first Mk2 in theatre, did engineering personnel change upon her arrival? That is, were engineers with recent Mk2 experience sent with her?

93. Were adequate spares available at RAF Aldergrove to maintain the integrity of the provisioning parameters?

94. Given the AAIB reported that RAF Odiham lacked the necessary test equipment to ensure (e.g. Radar Altimeter) serviceability, did RAF Aldergrove have the capability required by the Chinook Mk1 and Mk2 Maintenance Policies? (Noting that this had been recorded before, in 1987, on other aircraft components).

95. Why was there no copy of the Release to Service at Aldergrove?

Pre-flight planning

96. Was the purpose of the flight within the terms of the HQ 1 Group Operational Order?

97. What was the purpose of the flight? (Setting aside for a moment that the overarching mandate was not to rely on the aircraft in any way whatsoever).

98. Why did the original 2 x Puma tasking change to a single Chinook, and who made this request?

99. Was a Mk2 stipulated? If so, was that person aware the Mk2 was only cleared for ground Training and Familiarisation, and was not fit for the purposes of the flight?

100. Who approved the use of the Mk2, and did the necessary authority exist, within the Operational Order, to remove ZD576 from theatre, especially as the only other Chinook, a Mk1, was unserviceable?

101. Did HQ 1 Group (or higher) need to approve a deviation from the Order?

102. Given the passenger list, who else was consulted?

103. Was this proper use of a scarce asset?

104. Bearing in mind the high military value of the passengers, why were they not flown in a fully proven aircraft type?

105. Similarly, why were they put together in a single aircraft?

106. Was this subject to a risk assessment?

107. What deferred faults were in the technical log?

108. Who commanded this crew to fly this sortie on this aircraft?

109. Was he aware that the Mk2’s Icing Limit was below the Safety Altitude for the flight?

110. Were the passengers told the proper authority in MoD had determined the aircraft was not to be relied upon in any way whatsoever?

Our petition can be found at www.change.org/JusticeForThe29.

Find out more about our Mull of Kintyre Chinook Crash campaign.