When the Test Plan Went Wrong – Fire and Water – Part2

When the Test Plan Went Wrong – Fire and Water – Part 2

A ￡35m helicopter had been lost and a crew of 5 were lucky to escape the wreckage, but outside of the pure technical reasons, what had happened across the links in the accident chain to get to the disastrous end???It was the job of the accident investigation team to find out the cause , and a team from the Royal Navy Flight Safety and Accident Investigation Centre (RNFSAIC) team quickly arrived at Plockton. An underwater robot submarine video showed the aircraft virtually intact and sat upright on its undercarriage on the sea bed, with rotor blades missing and the tail pylon detached just in front of where the tail folding mechanism was mounted.??Whilst some light burn marks could be seen on the upper part of the fuselage the real extent of the fire, and subsequent damage to key components was not discovered until some three weeks later when the wreckage was recovered from the seabed.

The accident sequence chain had commenced from the moment it had been decided to implement a software change without going through normal certification, validation??and approval steps.??Whilst the pressure to get the aircraft into service was understandable, missing some important steps proved to be a hazardous and expensive mistake.??The assumption that a change to allow the operation of the dipping sonar would not have a marked safety effect was flawed, and the whole organisation was guilty of that omission, including us on the IFTU.

In formulating the modification (and others at the time) the MOD had created a rapid equipment modification system, called Development Test and Trials (DTAT), which allowed for the skipping of normal steps.??As a result, whilst the software changes themselves had been subject to a great deal of scrutiny, the effects on other systems was not fully understood, except that the rotor brake would need to be inhibited.??The fact that the aircraft should be in the spread configuration when this DTAT was applied had been missed, perhaps due to the rather complex nature of the Merlin rotor brake design, which even with modern graphics I still find difficult to fully understand.

The AW engineer who installed the DTAT was provided with documentation which did not mention the aircraft fold configuration and, since this was an electrical and software modification, did not realise the potential effects.??The Squadron engineering team had faith in the engineer because they were new to the Merlin and did not have sufficient on the job technical knowledge to understand the implication of what had been done.

Once installed the aircraft were quite quickly tested both on the ground and in the air.??Whilst the crash aircraft showed the residual rotor brake pressure the other did not and the assumption it was just ‘residual pressure’ after the modification was quickly accepted.??No one thought any more of the problem because, of course, the rotor brake had been disabled and no risk had been perceived.??The fact that after being bled the residual pressure returned whilst queried with AW was still assumed not to be a problem and the trial preparations went on unabated, we were all content with the situation.

The aircraft was flown from Culdrose to Scotland via a fuel stop in Wales and we all gathered in Plockton read for the trial.??With the non-crash aircraft quickly out of action with another fault ZH844 was quickly in action flying two sorties a day, using the sonar and successfully delivering the required performance results against the range targets.??It was noted by all the pilots, however, that when raising and lowering the sonar body there was a slight kick to the right in yaw.??Nothing particularly concerning and something we put down to an automatic flight control system snag, and maybe some salt build up in the mixing unit – a known issue with the Merlin at the time.

So far no-one in either the engineering or aircrew teams had raised any concerns about what was happening or whether we should pause.??We wanted to get the job done as this was the first time we had used the sonar system under trials conditions, the weather was good and Plockton was a nice place to be.

On the day the pilot took off and transited to the range as normal, he noted that there had been an issue with the rotor start sequence but nothing too untoward.??They were quickly established in the hover on the range, ready to start the first element in another day of sonar operations.

On hearing about the unusual burning smell there was initially no cause for alarm, everything looked normal and there was no smoke around.??Since the aircraft did not have mirrors the crew could not check for external indications (the range building had seen flames) and it is not normal to wander around the aircraft when in a hover overwater.??The range did not tell the aircraft there was a problem.

Once the pilot had decided to leave the hover, loss of control was inevitable, he just didn’t know it.??Once the aircraft started to move forwards the airflow through the area in front of the gearbox quickly caused the fire to spread.??Although by now the hydraulic failure was indicating (alongside some other unnamed cautions) the next big indication was a fire warning on number 2 engine.??The complex set of audio and visual cautions meant that the pilot quickly became confused as to what was going on.??Our simulator wasn’t in service at the time, and we had just started to use the RAF system at RAF Benson; but it was not nearly enough to give a competent grasp of emergency actions in a complex glass cockpit aircraft.

Fortuitously, he started to slow the aircraft down because he was becoming rapidly aware that the aircraft’s ability to stay airborne was quickly becoming degraded; that action may have saved the crew.

Once control was lost everyone was a passenger and fortunately underwater escape training alongside an emergency air bottle meant that everyone was able to escape.??The two cockpit occupants found it straightforward but those In the back did not.??The rearward facing seats, the complex system of orientation bars, and cables attached to doors and windows made life difficult for them all.??They all used their bottles to ensure they got out, fortunately the aircraft floated but only by virtue of inherent buoyancy of the fuselage as the flotation gear had not operated.

The pilot had thought the worse when he was initially the only one on the surface, but was very relieved a few seconds (which seemed a very long time to him) when the rest of the crew surfaced.??

The range crew had called the crash in immediately and the SAR helicopter from Stornaway was quickly on the scene.??All were lifted to safety and taken to the local hospital for a health check.??The aircraft sank some 3-4 hours later as the QinetiQ team had not been given permission to attach buoyancy bags or attach the aircraft to the lifting arms on their range vessel in this critical period.?

In the Plockton hangar I stood with my Senior Observer (SOBS), as we were about to brief for our won sortie, as we were greeted with the call from our Staff Officer that the aircraft had caught fire and ditched.??We paused for about a second before we started our own crash actions.??Since we were away from home all our books on how to deal with an accident were packed in a publications crate and we were quickly into it to find all the right actions we needed to do.??It would have been better to have a post crash management plan just for the detachment but we didn’t so it was into Joint Service Publication 318 to get the required telephone numbers.??SOBS called RNAS Culdrose and I called the MOD Duty Officer, to be told ‘ Oh we already know, it’s on Sky News!’; this was less than 30 minutes from the initial call.

In the subsequent weeks I acted as the Squadron liaison with the RNFSAIC team, writing notes on interviews, providing our test and trials documents and going to the RAF simulator to see if we could replicate the described sequence of failures and warnings (all before the aircraft was recovered).??I flew what we though was the crash sequence in the simulator 40 times and died every time, it was a sobering experience.

You may have seen the lessons in all the above but here are my short takeways:

• Parallel development activity and aircraft operation have inherent risks – non standard modification processes should be avoided.
• A full risk assessment was made but could not have foreseen the fold/spread issue without further technical information.
• Aircrew and engineering personnel should not be accept abnormality in new software driven aircraft.
• Schedule risks became air safety risks.
• Often the linkages between software and hardware are not well understood, even by the manufacturer.
• Helicopters should have a way for the pilots to see if they are on fire – cameras or mirrors on larger aircraft.
• Escape from an aircraft underwater must be practiced regularly in representative aircraft modules.
• Too many warnings and cautions, including those using audio can confuse not help to understand the situation.
• If you are not at home base always have a physical ready use accident plan which can be used by a responsible person without reference to other systems, computers or the internet.
• Information control about and accident is almost impossible in the digital age – think about how you can get ahead of it.