Canada’s fleet of CH-148 helicopters is no longer grounded, and Canadian Armed Forces (CAF) officials say the choppers could be back in the air by the end of the week, even though investigators don’t fully understand why a recent crash occurred.
Tuesday’s jargon-laden briefing offered new, significant information on the set of technical circumstances that led to the crash, as well as the military’s plan to get the choppers off the ground ASAP, but little on the broader circumstances that led to the deaths of six CAF members when the Cyclone they were flying took a nosedive into the Ionian sea at the end of April.
The Royal Canadian Air Force CH-148 Cyclone helicopter from 12 Wing Shearwater, known as Stalker-22, was participating in Allied training exercises with HMCS Fredericton off the west coast of Greece on April 29. It had concluded flight operations and was returning to HMCS Fredericton when, approximately 7 p.m. local time, the chopper crashed at a high speed into the water in view of witnesses at the stern of the ship.
Col. John Alexander, director of the Flight Safety and Airworthiness Investigative Authority, told reporters during the briefing that as the aircraft commenced a final left turn to approach and land on HMCS Fredericton, which he called a complicated manoeuvre, the aircraft did not respond as the pilot anticipated.
By Alexander’s account, based on information gleaned from the recovered flight data recorder, the pilot’s inputs into the helicopter’s computer while the flight director mode was engaged — essentially an autopilot function of the aircraft fly-by-wire system and the highest level of two semi-autonomous modes — led to a situation where the computer presented what officials are calling a bias in which the pilot’s manual overrides were overtaken by other data instead of responding to what the pilot was telling it to do.
Instead of correcting for the pilot’s preferred pitch command, requesting the nose to pull up, it did not get an appropriate response from the aircraft, Alexander said, and the bias caused the aircraft to pitch downward and crash into the sea.
Flight simulations based on the profile captured by the flight data recorder in the moments leading to the accident responded almost identically to the National Research Council’s modelling of the crash.
“The combination of this configuration … outside the tested aircraft spectrum, resulted in a pitch bias for which the crew would have had no previous experience nor exposure prior to this event on how to handle the situation,” Alexander said.
“The accident was unavoidable based on their low altitude and consequently the lack of time they had to realize the aircraft was not responding to their inputs.”
“Whoever wrote that software, designed it and accepted it to be that way is really responsible here.”
- Larry McWha, retired air force colonel
According to Larry McWha, a retired colonel, Sea King pilot and former commanding officer of 423 Squadron, this should have never been allowed to happen within the configuration of the software.
“The control should never have occurred where the pilot cannot intervene. The pilot is supposed to be the ultimate command here, but somehow, in this case, as they’ve explained, the computer ignored his input,” McWha said.
“Whoever wrote that software, designed it and accepted it to be that way is really responsible here.”
During the tech briefing, airworthiness officials were hesitant to describe the malfunction as a glitch.
Lt.-Gen. Alain Pelletier, commander of 1 Canadian Air Division and the Operational Airworthiness Authority, instead described it as a sequence of events that included a mix of human factors and the software of the aircraft.
“A software glitch is a challenging statement to use because we need to understand the design specifications of what we were wanting those flight control laws to do and how they were to be applied,” Alexander added.
Officials stressed the issue is unrelated to a previously identified technical problem — in 2017 a failure of the fly-by-wire software system forced a grounding of the fleet for nine weeks after a Cyclone flying at night out of Shearwater experienced a sudden loss of altitude. The glitch was addressed by the manufacturer, Sikorsky, in an upgrade.
Back in the air
Following the crash, the fleet was put under an immediate operational pause, which was officially lifted Tuesday, and officials say the fleet could be back in action by the end of the week.
While investigators don’t yet fully understand why the cyclone crashed — specifically the human factors, which could include anything from the Cyclone’s design and construction to testing and training or crew involvement — airworthiness authorities say they understand the circumstances surrounding the particular sequence of events that led to the software response that caused the crash enough to feel confident putting it back in the air after some mitigating measures.
These measures include ground training, simulator training, updates to training and aircraft publications, and changes in operational manoeuvring. It’s unclear if any updates or changes will be made to the software.
As part of the controls that exist on the Cyclones, Alexander said, there is a switch that allows the pilot to degrade the aircraft to a lower control system at any time — to either the base level from the automatic flight control system, or to the automatic control system form the flight director mode.
Whether or not the crew could have utilized this option given the novelty of the scenario and the fact the aircraft was flying at such a low altitude will be part of the ongoing investigation, but Alexander said the use of this switch to degrade the level of automation will be part of the new required training.
“At this point, given the fact that we’ve been able to isolate that flight envelope, we’ve been able to put in a box in order to enable the safe resumption of flying activity,” Pelletier said. “We’re confident in the simulation training that we’re going to provide to the air crew, which is going to enable them to learn about the switch that will disable one level of that automation layer and allow them to set the recovery path.”
The rush to get the aircraft back in operation concerns McWha, especially considering the full details surrounding the crash are not yet apparent.
“How can they say it’s safe to go back in the aircraft and perform the job you were doing before when they don’t know why this happened?” he said. “It sounds to me that they have a latent problem in the software which is laying there under some software rock which could come about again. As a pilot, I would want to have assurances that they know exactly what caused this and put in some kind of software fix that would allow (the pilot) in any circumstance to take full control of the aircraft and not be overruled by some kind of bias.”
But Pelletier said the level of collaboration between the investigators, the different airworthiness authorities, as well as Sikorsky, combined with the work that has been ongoing since the crash, should be reassuring.
“Those findings were also corroborated by the company, and the company actually went further in looking at other potential scenarios that could lead to such an event as the bias,” he said.
“I would also like to remind people that … there are always risks involved in flying activities, However, our role is to manage that to be able to continue safely to operate the aircraft.”
Now that officials understand what happened, Alexander said, the continuing flight safety investigation will focus on why it happened.
“Our focus will be on the analysis of these aircraft systems and the human factors that go behind everything in order to identify those preventative measures which will preclude future similar occurrences,” he said.
“The complexity of this investigation will take many months to identify and appreciate all the potential active and latent cause factors before we can make our final recommendations in the form of the flight safety investigation report.”
