Pilot in deadly Canadian military helicopter crash unaware of flight-control software conflict, says report

The pilot of an ill-fated Canadian military helicopter tried to manually override the flight control function and — for a variety of reasons — did not see the autopilot was still on when the CH-148 Cyclone helicopter crashed into the Ionian Sea off Greece last year, an air force flight safety investigation has concluded.

The conflict between manual control and the aircraft's automatic flight controller system caused an unanticipated "bias" in the helicopter's fly-by-wire (FBW) computers, prompting the aircraft to nose dive at full speed into the ocean as it was returning to HMCS Fredericton after a flypast.

The pilot, however, was not at fault because attempting to use manual controls while the automatic system is still engaged is a routine procedure, the air force report said. 

The flight safety investigation does raise a series of additional questions about training and, more importantly, certification of the helicopter, which was fitted with a high-tech flight control system that few other helicopters in the world possess.

The accident killed six members of the military on April 29, 2020 — the biggest single-day loss of life for the Canadian Armed Forces since the Afghan war.

Those killed were: Capt. Brenden MacDonald, Capt. Kevin Hagen, Capt. Maxime Miron-Morin, Master-Cpl. Matthew Cousins, Sub-Lt. Matthew Pyke and Sub-Lt. Abbigail Cowbrough.

The final flight safety investigation report was released on Monday and does not point a finger of blame at any individual.

Rather, the report cites several mitigating factors that suggest institutional faults. 

Pilot wasn't aware of problem

The report points out that attempting to fly the helicopter manually while the automatic flight controller is engaged has been "common practise," and that the flight manuals that might have addressed this fault "may have been confusing or misleading."

In addition, the computer "may not have sufficiently drawn the pilot's attention to the fact the Flight Director [the automatic flight control system] was engaged during the manoeuvre."

Essentially, the pilot wasn't warned there was a problem before tragedy struck.

Software fixes for the flight control system are among the recommendations coming out of the fight safety investigation.

"This accident was not the result of one single causal factor, but a combination of several and could have happened to any other crew on any other day," Brig.-Gen. John Alexander, the air force's director of flight safety, said in a media statement.

He added that the fault was "unknown to the manufacturer, airworthiness authorities, and aircrew prior to the accident."

Larry McWha, a former pilot and defence expert, said he was deeply troubled by the findings. He said the last few seconds of the crew members' lives of the crew must have been horrifying — knowing their aircraft was diving toward the ocean and the computer had locked them out.

"The Cyclone, based on these reports, was obviously designed such that in certain circumstances the pilot's input could be overridden by the autopilot, and that is absolutely unacceptable in terms of the design of a flight control system," said McWha, who commanded 423 Squadron when it flew the CH-124 Sea Kings the Cyclone choppers recently replaced.

"The pilot must always be able to take control from the autopilot."

The flight certification process should have looked at that issue, he added.

The flight safety investigation of the Cyclone crash was one of two reports on the incident produced by the military. The second involved an internal technical investigation, known as a board of inquiry (BOI). A copy of that investigation was obtained and published late last week by The Canadian Press.

The inquiry came up with similar findings and indicated the crash might have been prevented if the pilot had switched off the autopilot manually during the turn.

Like the flight safety investigation, the inquiry report noted it wasn't unusual for pilots to override the autopilot and there were no explicit instructions in the manuals on the need to manually turn off the flight director.

A year ago, in answering questions about the release of the preliminary flight safety investigation, the air force's director of technical airworthiness, Brig-Gen. Nancy Tremblay, was reluctant to admit there was an issue with the flight control system, despite mounting evidence that it played a significant role in the tragedy.

Such an admission now has far-reaching flight safety, defence, corporate and political ramifications — all of them wrapped around the decision to install fly-by-wire technology on the CH-148.

The Cyclone was based on the S-92 civilian helicopter, which does not have a fly-by-wire (FBW) system. In a fly-by-wire aircraft, computers replace the mechanical controls and levers that make the aircraft function.

There are only a few helicopters in service around the world with that kind of advanced technology. Sikorsky Aircraft Corporation, the manufacturer, abandoned attempts to upgrade its civilian variant to fly-by-wire because of the cost and complexity.

Getting the software right was one of the reasons it took so long to get the CH-148 into service with the Canadian air force.

Questions about the Cyclone's certification

The crash investigation revealed that the flight director software "was not tested" for the specific situation "or similar manoeuvres, or for scenarios involving" the manual override of the system while the autopilot was still engaged.

As part of the investigation, the Aerospace Engineering Test Establishment (AETE), a combined civilian and military authority made up engineers and test pilots, found that the Cyclone's fly-by-wire system tended to generate "excessive pitch" while the helicopter was at a low level — and that such a condition was "unacceptable."

Similarly, the agency found fault with the multi-coloured banners that indicate which mode the flight director might be in — on (cature) or off (override).

"AETE discovered during simulator testing that pilots were consistently ineffective at noticing PFD banner mode colour changes during MH mission profiles," said the investigation report.

That was significant because it ties in with the report's observation that the computer "may not have sufficiently drawn the pilot's attention" to the fact the autopilot was still on.

With the findings, there will be questions about the certification of the Cyclone — which was essentially a developmental helicopter.

A year ago, Tremblay defended the certification process.

Most of the certification was done by manufacturer

"The flight control system certification of the Cyclone helicopter was a very rigorous process," she said, noting the U.S. Federal Aviation Administration, Transport Canada and the National Research Council of Canada were all involved in the evaluation of the unique system.

But a graph and supporting details — released as part of the investigation report — show that 69 per cent of the certification on the Cyclone was done by the manufacturer itself.

"In order to facilitate the CH148 Certification Basis, the TAA delegated approval to Sikorsky for many of the supporting compliance artifacts," the report said.

Former test pilot and aviation expert Shawn Coyle told CBC News in an interview last year that because fly-by-wire is so rare for helicopters, there is a shortage of expertise in certification.

The flight safety report, released Monday, tacitly acknowledged the problem, saying "certification and regulation subject matter expertise for helicopter FBW systems continues to mature and evolve."