| Summary: | Crashed in fog; cause is disputed.• Pilot error leading to CFIT (RAF)• Mechanical failure (FADEC software error) (Independent inquiry) |
| Occurrence Type: | Accident |
| Site: | Mull of Kintyre, Scotland |
| Coordinates: | 55.3136°N -5.795°W |
| Origin: | RAF Aldergrove (near Belfast, Northern Ireland) |
| Destination: | Inverness, Scotland |
| Occupants: | 29 |
| Passengers: | 25 |
| Crew: | 4 |
| Fatalities: | 29 |
| Survivors: | 0 |
| Aircraft Type: | Boeing Chinook |
| Operator: | Royal Air Force |
| Callsign: | F4J40 |
| Tail Number: | ZD576 |
On 2 June 1994, a Chinook helicopter of the Royal Air Force (RAF), serial number ZD576, crashed on the Mull of Kintyre, Scotland, in foggy conditions. The crash resulted in the deaths of all twenty-five passengers and four crew on board. Among the passengers were almost all the United Kingdom's senior Northern Ireland intelligence experts. The accident is the RAF's fourth-worst peacetime disaster.[1] [2] [3]
In 1995, an RAF board of inquiry ruled that it was impossible to establish the exact cause of the accident. This ruling was subsequently overturned by two senior reviewing officers, who stated that the pilots were guilty of gross negligence for flying too fast and too low in thick fog. This finding proved to be controversial, especially in light of irregularities and technical issues surrounding the then-new Chinook HC.2 variant which were uncovered, and in light of technical problems with the specific airframe involved in the weeks leading up to the crash. A Parliamentary inquiry conducted in 2001 found the previous verdict of gross negligence on the part of the crew to be 'unjustified'. In 2011, an independent review of the crash cleared the crew of negligence and accepted that the RAF had falsely declared compliance with regulations in relation to the aircraft's authority to fly.
Earlier on 2 June 1994, the helicopter and crew had carried out a trooping flight, as it was considered to be safer for British troops to fly around in certain parts of Northern Ireland at the time due to the threat posed by Provisional IRA attacks. This mission was safely accomplished and they returned to RAF Aldergrove (outside Belfast, Northern Ireland) at 15:20. They took off for Inverness at 17:42. Weather en route was forecast to be clear except in the Mull of Kintyre area. The crew made contact with military air traffic control (ATC) in Scotland at 17:55.[4]
Around 18:00, Chinook ZD576 flew into a hillside in dense fog. The pilots were Flight Lieutenants Jonathan Tapper, 28, and Richard Cook, 30, both United Kingdom Special Forces pilots. There were two other crew. The helicopter was carrying 25 British intelligence experts from MI5, the Royal Ulster Constabulary and the British Army, from Aldergrove to attend a conference at Fort George (near Inverness) in Scotland. At the time of the accident, Air Chief Marshal Sir William Wratten called it "the largest peacetime tragedy the RAF had suffered".[5]
In the immediate aftermath of the accident, one commentator stated that the loss of so many top level Northern Ireland intelligence officers in one stroke was a huge blow to the John Major government, "temporarily confounding" its campaign against the IRA.[6] That the crash killed so many British intelligence experts, without any witnesses in the foggy conditions, led to considerable speculation and conspiracy theories being devised regarding the potential of a cover-up. Among these were accusations that wake turbulence from a top-secret hypersonic US aircraft had been responsible for the crash,[7] while another postulated that it was a deliberate assassination of the intelligence operatives on board in order to facilitate negotiations with republican factions during the then on-going Northern Ireland peace process.[8] [9]
In 1995, an RAF board of inquiry that investigated the incident determined that there was no conclusive evidence to determine the cause of the crash. An immediate suspicion that the helicopter could have been shot down by the Provisional IRA, with their known Strela 2 surface-to-air missile capability, had been quickly ruled out by investigators. A review of the evidence, carried out by two Air Chief Marshals of the Royal Air Force, found the two pilots to have been guilty of gross negligence by flying too fast and too low in thick fog.[10] Both the incident and the first inquiry have been subject to controversy and dispute, primarily as to whether the crash had been caused by pilot error or by a mechanical failure. The 2011 Parliamentary report found the reviewing officers to have failed to correctly adhere to the standard of proof of "absolutely no doubt" in deciding the question of negligence.[11]
The first inquiry and its conclusion proved to be highly controversial. A subsequent fatal accident inquiry (1996), House of Commons Defence Select Committee report (2000) and Commons Public Accounts Committee report have all either left open the question of blame or challenged the original conclusion. The campaign for a new inquiry was supported by the families of the pilots, and senior politicians, including former prime minister John Major and former defence secretary Malcolm Rifkind.[5] [12] The new inquiry took place in the House of Lords from September to November 2001. The findings were published on 31 January 2002, and found that the verdicts of gross negligence on the two pilots were unjustified.[13]
In December 2007, Defence Secretary Des Browne agreed to conduct a fresh report into the crash.[14] [15] On 8 December 2008, Secretary of State for Defence John Hutton announced that "no new evidence" had been presented and the verdicts of gross negligence against the flight crew would stand.[16] On 4 January 2010, doubts of the official explanation were raised again with the discovery that an internal MOD document, which had been written nine months prior to the incident, described the engine software as 'positively dangerous' as it could lead to failure of both engines.[17] [18] The 2011 Review concluded that criticism that the original board had not paid enough attention to maintenance and technical issues was unjustified.[19]
On 13 July 2011, the Defence Secretary Liam Fox outlined to MPs the findings of an independent review into the 1994 crash, which found that the two pilots who were blamed for the crash had been cleared of gross negligence.[20] In doing so, the Government accepted Lord Philip's confirmation that the Controller Aircraft Release was "mandated" upon the RAF. Issued in November 1993, the Controller Aircraft stated that the entire navigation and communications systems used on the Chinook HC2 were not to be relied upon in any way by the aircrew, and therefore it had no legitimate clearance to fly. Knowledge of this had been withheld from the pilots; by withholding this when issuing their Release to Service (RTS) (the authority to fly), the RAF had made a false declaration of compliance with regulations. In December 2012, the Minister for the Armed Forces, Andrew Robathan, confirmed such a false declaration did not constitute "wrongdoing", despite it leading directly to deaths of servicemen.
Boeing CH-47C Chinook, construction number B-868, RAF serial number ZD576 was originally delivered to the Royal Air Force as a Chinook HC.1 on 22 December 1983.[21]
It was re-delivered to No 7 Squadron as a Chinook HC.2 on 21 April 1994. On arrival at RAF Odiham, its No. 1 engine had to be replaced due to a FADEC incident. Five days later, that same engine had to be replaced due to a second FADEC incident. On 10 May 1994, a post-flight fault inspection revealed a dislocated mounting bracket had caused the collective lever to have restricted and restrictive movement; this resulted in a "Serious Fault Signal"[22] being sent as a warning to other UK Chinook operating units. On 17 May 1994, emergency power warning lights flashed multiple times and the No.1 engine was again replaced. On 25 May 1994, a serious incident occurred which had indicated the imminent failure of the No.2 engine.[21] [23]
On 31 May 1994, two days before the accident, two Chinook HC.1s were withdrawn from RAF Aldergrove and replaced by a single HC.2, ZD576.[24]
Aviation safety author Andrew Brookes wrote that the true cause will never be known, but that pilot error induced by fatigue is likely to have played a part; the crew had been on flight duty for 9 hours and 15 minutes, including 6 hours flying time, before they took off on the crash flight. Had they made it to Fort George, they would have needed special permission from a senior officer to fly back to Aldergrove.[25]
In his book, Steuart Campbell suggested that two errors by the pilots; failure to climb to a safe altitude upon entering cloud, and a navigational error made in the poor visibility (mistaking a fog signal station for a lighthouse), together caused the crash.[26] The Board of Inquiry had identified that several factors may have sufficiently distracted the crew from turning away from the Mull, and upon entering cloud, failed to carry out the correct procedure for an emergency climb in a timely manner.[27]
RAF Visual Flight Rules (VFR) require the crew to have a minimum visibility of 5.5 kilometres above 140kn, or minimum visibility of one kilometre travelling below 140 knots;[28] if VFR conditions are lost an emergency climb must be immediately flown.[29] Nine out of ten witnesses interviewed in the inquiry reported visibility at ground level in the fog as being as low as ten to one hundred metres at the time of the crash; in-flight visibility may have been more or less than this. The tenth witness, a yachtsman who was offshore, reported it as being 1miles, though he is regarded as a less reliable witness as he changed his testimony.
If witness accounts of visibility are correct, the pilots should have transferred to Instrument Flight Rules,[30] which would require the pilots to slow the aircraft and climb to a safe altitude at the best climbing speed.[31] In the area around the Mull of Kintyre, the safe altitude would be above sea level, above the highest point of the terrain.[32] The height of the crash site of ZD576 was, below the minimum safe level. The Board of Inquiry into the accident recommended formal procedures for transition from Visual Flight Rules to Instrument Flight Rules in mid-flight be developed, and the RAF has since integrated such practices into standard pilot training.[33]
Regarding negligence on the part of the pilots, the 2011 Report said "the possibility that there had been gross negligence could not be ruled out, but there were many grounds for doubt and the pilots were entitled to the benefit of it... [T]he Reviewing Officers had failed to take account of the high calibre of two Special Forces pilots who had no reputation for recklessness."[34]
At the time of the crash, new FADEC (Full Authority Digital Engine Control) equipment was being integrated into all RAF Chinooks, as part of an upgrade from the Chinook HC.1 standard to the newer Chinook HC.2 variant. The Ministry of Defence was given a £3 million settlement from Textron, the manufacturers of the system, after a ground test of the FADEC systems on a Chinook in 1989 resulted in severe airframe damage. Contractors, including Textron, had agreed that FADEC had been the cause of the 1989 incident and that the system needed to be redesigned.[35]
The committee investigating the crash were satisfied that the destructive error in 1989 was not relevant to the 1994 crash.[36] Information provided from Boeing to the investigation led to the following conclusion regarding FADEC performance: "Data from the Digital Electronics Unit (DECU) of the second engine showed no evidence of torque or temperature exceedance and the matched power conditions of the engines post-impact indicate that there was no sustained emergency power demand. No other evidence indicated any FADEC or engine faults."[37] It was expected that in a FADEC engine runaway, engine power would become asynchronous and mismatched. The investigation found the engines at the crash to have matched settings, decreasing the likelihood of a FADEC malfunction being involved.[38]
EDS-SCICON was given the task of independently evaluating the software on the Chinook HC.2 in 1993. According to the House of Commons report: "After examining only 18 per cent of the code they found 486 anomalies and stopped the review... intermittent engine failure captions were being regularly experienced by aircrew of Chinook Mk 2s and there were instances of uncommanded run-up and run-down of the engines and undemanded flight control movements".
Tests on the Chinooks performed by the MOD at Boscombe Down in 1994 reported the FADEC software to be "unverifiable and ... therefore unsuitable for its purpose". In June 1994, the MoD test pilots at Boscombe Down had refused to fly the Chinook HC.2 until the engines, engine control systems and FADEC software had undergone revision.[23] In October 2001, Computer Weekly reported that three fellows of the Royal Aeronautical Society had said that issues with either control or FADEC systems could have led to the crash.[39]
The main submission to Lord Philip (see above) revealed that the FADEC Safety Critical software did not have a Certificate of Design, and was therefore not cleared to be fitted to Chinook HC2. It further revealed that John Spellar MP had been wrong when claiming the software was not Safety Critical, providing the original policy document governing this definition to Lord Philip.
The onboard SuperTANS navigation computer, which retained only the last measured altitude, gave an altitude reading of .[40] The investigation observed that it was possible for some of the avionics systems to interfere with the Chinook's VHF radio, potentially disrupting communications.[41]
Flight data recorders and cockpit voice recorders were not fitted to all RAF Chinooks at the time of the accident. The absence of these data greatly reduced the amount and quality of data available to subsequent investigations.[42] Information on speed and height were derived from the position of cockpit dials in the wreckage and the condition of the wreckage. During 1994, the RAF had begun to fit these recording devices across the Chinook HC.2 fleet before the accident; this process was completed in 2002.[43]
The aircraft had not been classified as airworthy. It was mandated upon the RAF that it was "not to be relied upon in any way".[44]