Fix to software problem behind naval helicopter crash needed ‘forthwith’: experts

HALIFAX — The software issue identified as a cause of last year’s naval helicopter crash off Greece that killed six Canadian crew members needs to be fixed without delay, say experts on the interplay between automation and humans in aircraft.

Two internal reviews by the Canadian Armed Forces found the autopilot took control of the CH-148 Cyclone helicopter, plunging it into the Ionian Sea as the pilot was turning to return to HMCS Fredericton on April 29, 2020.

Master Cpl. Matthew Cousins, Sub-Lt. Abbigail Cowbrough, Capt. Kevin Hagen, Capt. Brenden MacDonald, Capt. Maxime Miron-Morin and Sub-Lt. Matthew Pyke died in the crash.

Mary (Missy) Cummings, an engineer and former U.S. navy pilot, reviewed the Flight Safety Investigation Report, the second of two reports by the military, after its release June 28. Cummings, director of the humans and autonomy lab at Duke University, called the pilot’s inability to regain control from automated software “a very serious problem.”

“This needs to be addressed forthwith. It should be fixed, bottom line. Who bears the costs, that’s up to the lawyers to decide,” she said in a recent video interview from Durham, N.C.

She said the automation on the aircraft is flawed. “There is known confusion for pilots, and instead of addressing this problem head on, people are trying to make excuses for either how the system is or was designed,” she said.

“It’s very likely that another fatality is going to happen if they don’t address this problem.”

According to the two reports’ findings, theautopilot was left on as the pilot executed a sharp turn, and as a result the software built up commands, preventing the pilot from resuming manual control at the end of his turn. The first military report — the Board of Inquiry report — referred to this accumulation of calculations from the automated software as “attitude command bias.”

The Board of Inquiry report said these commands in the software “can accumulate to such a degree that it severely diminishes, or even exceeds,” the pilot’s ability to control the aircraft manually.

“It wasn’t a hotdog manoeuvre,” said Cummings, a former director of the U.S. navy’s advanced autonomous rotorcraft program. “So something was wrong with the software code base, and if it were me, and I was in the Canadian military, I would stop everyone from using autopilot until I got this problem fixed.”

Greg Jamieson, a professor of industrial engineering at the University of Toronto who studies human-automation interactions, said the software issue “is a present safety issue that the Defence Department needs to immediately address with Sikorsky.”

“Of course, you don’t tell someone to change code and put it in helicopters next week. Yes, it takes time … but that process must be started immediately,” he said in a recent interview, adding he hesitates to advocate suspending use of the autopilot until the fix is completed.

The military responds that the aircraft manufacturer, Sikorsky, a subsidiary of Lockheed Martin, and the Royal Canadian Air Force have done a thorough exploration of the ways similar problems might emerge and have concluded the aircraft is safe.

In an emailed statement sent July 16, Defence Department spokeswoman Jessica Lamirandesaid that as a result of a detailed assessment, the aircraft is being modified to make pilots more aware of when they’re using autopilot and to provide more warning signals for the flight crew.

As for a fix to the software issue, Lamirande wrote that the military is working with Sikorsky to “determine the exact parameters of how to implement this modification.”

“The Cyclone is a complex system, and we need to make sure that, by introducing this change, we are not causing adverse or unintended issues to other parts of the system,” she said. She called the change “a very high priority modification for the fleet” that will be completed as soon as possible.

She added that in the meantime, the Royal Canadian Air Force has trained the aircrews to ensure they are aware of the scenario that led to the crash and understand how to avoid it or recover from it. 

“We also made some changes to the aircraft documentation, and it now provides clearer warnings, restrictions, and limitations for the aircrew,” she wrote.

However, Cummings said she remains concerned, in part because the military failed to catch the problem in certification processes. She said the situation that led the Cyclone to crash was foreseeable.

“We know that pilots tend to override automated controls with them left on,” she said. “There’s a whole series of accidents in the 1990s that we teach where humans will intervene when the automation is engaged, not realizing that this is the case.”

Ella Atkins, an aeronautical engineer and computer scientist at the University of Michigan, agreed that the software issue should be fixed immediately. 

“It is likely if they (aircrew) used the same flight control laws for aggressive manoeuvres that aren’t quite like this one, it would cause the same problem,” she said in a telephone interview.

Jamieson said he felt the publicly released “accumulation bias” description in the Flight Safety Investigation Report was unclear, and there wasn’t sufficient information provided on it.

“It’s almost treated as this mysterious force that acts on the aircraft. It’s not an engineering description. We don’t have an engineering description of this error, and that concerns me very deeply,” he said.   

John Dorrian, a spokesman for Sikorsky, said in an email the company defers to the comments from the Department of National Defence.

Dorrian said in an earlier comment to The Canadian Press that when the helicopter is operated “as designed, tested, and certified, the CH-148 has proven to be safe and effective,” adding, “If requested, we are ready to work with the Canadian Armed Forces to modify the CH-148.”

The crash was the largest single-day loss of life for Canada’s military since Afghanistan. It also cast a harsh spotlight on the Cyclone’s long and problem-plagued development, which remains a work in progress.

Sikorsky is yet to deliver all 28 Cyclones that Canada first ordered in 2004, though the Defence Department says the last one is scheduled to arrive in the country by the end of this year.

This report by The Canadian Press was first published July 27, 2021.

Michael Tutton, The Canadian Press