When technology kills

 

There's a very sad report out of Canada, one that might have repercussions in America as well.  It's an analysis of what caused the crash of a Sikorsky CH-148 Cyclone helicopter last year, killing everyone aboard.

As a pilot guided one of Canada's navy helicopters up into a tight turn, neither his training nor cockpit indicators warned of how a built-in autopilot would take control and plunge the Cyclone into the Ionian Sea, a military report has concluded.

All six Canadian Forces members on board died in the crash on April 29, 2020.

. . .

The report ... said testing wasn't done during the aircraft's certification to identify what would happen if a pilot overrode the autopilot more than "momentarily" and in certain complex situations.

"The automation principles and philosophy that governed the Cyclone's design never intended for the [autopilot] to be overridden for extended periods of time, and therefore this was never tested," it said.

This was the case even though — as the report stated — pilots are known on occasion to override the autopilot system without manually pressing a button on their control stick, called the cyclic.

. . .

That crash caused the worst single-day loss of life for the Canadian Armed Forces since six soldiers were killed in a roadside bombing in Afghanistan on July 4, 2007.

The report indicated the crash might have been averted if the pilot had manually chosen to turn off the autopilot during the turn. But it also stated that it wasn't unusual for pilots to override the autopilot and there were no explicit instructions in the manuals on the necessity to manually turn off the flight director.

In addition, the report said the pilot appeared unaware the computer would attempt to regain control near the end of the turn.

When the helicopter flipped around, the report said, the pilot pulled back as far as he could on the cyclic, attempting to right the aircraft that the computer was flying into the sea. Within seconds, the helicopter hit the ocean at massive force.

The board of inquiry said it found no evidence the flying pilot recognized he had lost control of the aircraft until it was too late.

Critical to the crash, the report said, was the aircraft's software, which was certified by the military. If the autopilot is overridden, the computer accumulates digital commands, referred to as "command bias accumulation." The more commands a pilot sends manually to the computer while the aircraft is coupled with the autopilot, the more this bias accumulation occurs, the report said.

After a pilot overrides the air speed set by the autopilot, a "feed forward look" occurs, the report said, adding that in some situations, "the pilot's ability to control the aircraft will be reduced or lost."

The board of inquiry said the pilots' training didn't cover "with sufficient detail" certain risks of flying the aircraft, leaving the flyers unaware the autopilot would seek to keep control of the helicopter.

There's more at the link.

Thing is, the Cyclone is a military (Canadian-specific) version of the Sikorsky S-92 helicopter, which is in widespread commercial use.  The S-92 also serves as the foundation for the VH-92 variant, under development to replace the VH-3D variant of the Sikorsky SH-3 Sea King, which has served all US presidents since 1976.  The President's helicopter uses the callsign Marine One when he's aboard.  I imagine there's a lot of urgent investigation going on right now in the VH-92 development team, to make sure that the President of the United States won't be killed by an automated flight system error . . .

It's reminiscent of the Airbus A320 automated flight control system, which in its earliest versions was alleged to inhibit the pilot from making emergency corrective maneuvers.  That was most famously on display in the crash of a brand-new A320 in 1988 while making a low pass.  It's been alleged that the automated flight controls shut the pilot out of the loop and flew the aircraft into the forest.

A similar problem is alleged to have caused two fatal crashes of the new Boeing 737 Max airliner, where the computer overrode pilot inputs and caused the aircraft to crash.  Automation is also a factor in the current certification program for the new Boeing 777-9 widebody airliner.  It appears that the aircraft's systems are still not satisfactory, according to the FAA, which says it "needs more information – including about a major software architecture called the 'Common Core System' (CCS) – before considering the 777-9 to be on track to certification."

Automation can be a pilot's worst enemy - particularly when he doesn't know it might cancel out his decisions!

May those who died in last year's crash rest in peace, and may their families receive what comfort they may.  One hopes that the lessons learned from this crash will make the other helicopters in the CH-148 fleet - and all other aircraft using high-automation, computerized flight control systems - that much safer.

Peter