HALIFAX — As a pilot guided one of Canada's navy helicopters up into a tight turn, neither his training nor cockpit indicators warned of how a built-in autopilot would take control and plunge the Cyclone into the Ionian Sea, a military report has concluded.
All six Canadian Forces members on board died in the crash on April 29, 2020.
According to a board of inquiry report obtained by The Canadian Press, when the pilot was flying the turn, commonly called a "return to target," he had pointed the nose up and used his feet to turn the helicopter's tail, overriding the autopilot to complete the manoeuvre of less than 20 seconds.
The report, however, said testing wasn't done during the aircraft's certification to identify what would happen if a pilot overrode the autopilot more than "momentarily" and in certain complex situations. "The automation principles and philosophy that governed the Cyclone's … design never intended for the (autopilot) to be overridden for extended periods of time, and therefore this was never tested," it said.
This was the case even though — as the report stated — pilots are known on occasion to override the autopilot system without manually pressing a button on their control stick, called the cyclic.
The report said that at the time of the crash, the autopilot — referred to as the flight director — was set to an air speed of about 260 kilometres per hour before one of the pilots pitched the aircraft's nose upward for the turn.
It was supposed to fly back over HMCS Fredericton and practise hoisting people onto the deck. Instead, the frigate's CH-148 Cyclone helicopter crashed off the coast of Greece while returning from a NATO training mission. That crash caused the worst single-day loss of life for the Canadian Armed Forces since six soldiers were killed in a roadside bombing in Afghanistan on July 4, 2007.
The report indicated the crash might have been averted if the pilot had manually chosen to turn off the autopilot during the turn. But it also stated that it wasn't unusual for pilots to override the autopilot and there were no explicit instructions in the manuals on the necessity to manually turn off the flight director.
In addition, the report said the pilot appeared unaware the computer would attempt to regain control near the end of the turn.
When the helicopter flipped around, the report said, the pilot pulled back as far as he could on the cyclic, attempting to right the aircraft that the computer was flying into the sea. Within seconds, the helicopter hit the ocean at massive force.
The board of inquiry said it found no evidence the flying pilot recognized he had lost control of the aircraft until it was too late.
Critical to the crash, the report said, was the aircraft's software, which was certified by the military. If the autopilot is overridden, the computer accumulates digital commands, referred to as "command bias accumulation." The more commands a pilot sends manually to the computer while the aircraft is coupled with the autopilot, the more this bias accumulation occurs, the report said.
After a pilot overrides the air speed set by the autopilot, a "feed forward look" occurs, the report said, adding that in some situations, "the pilot's ability to control the aircraft … will be reduced or lost."
The board of inquiry said the pilots' training didn't cover "with sufficient detail" certain risks of flying the aircraft, leaving the flyers unaware the autopilot would seek to keep control of the helicopter.
The return-to-target manoeuvre, which led to the crash, was being flown by others in the maritime helicopter community, the report said. That manoeuvre has been disallowed since the crash.
The report makes six recommendations, five of which involve better training for pilots to make them aware of the potential problems that could occur if they override the autopilot. It recommended creating special cockpit signals pilots could use to warn each other about overriding flight directors for extended periods of time.
The report also recommended the military consider an engineering change "to automatically disengage the flight director under certain conditions, such as when the flight director is overridden in multiple axes, or for an extended period of time."
According to a senior military source, that recommendation is not shared in a second, independent report by the military's Directorate of Flight Safety, expected to be released next week.
The second report said pilots must be well trained to almost instantly press a single button on their control stick to disengage the autopilot if they're not getting the response they want out of their controls. It said, however, that automatically disengaging the autopilot might pose its own risks in some situations, especially when a pilot believes the autopilot will keep functioning.
The second report instead argued that the software — and its "bias accumulation" — needs to be addressed by American aviation company Sikorsky Aircraft, the manufacturer of the Cyclone.
"We need to look at that software … and see if we can eliminate this from the software altogether, being careful to understand when you make any changes like that you may introduce a butterfly effect and cause problems elsewhere," the source said.
The board of inquiry report, signed by three members of the panel on Nov. 20, 2020, concluded the pilots were not distracted and the crew "flew well together." It added that the aircraft captain had a strong command of the helicopter and the co-pilot showed "good situational awareness" throughout the mission.
The second report is expected to provide further analysis on the factors behind the crash.
The military source said the recommendations of the two reports must be meshed into a single set of findings for consideration by senior Royal Canadian Air Force officers.
A spokeswoman for Sikorsky referred all questions on the report to the Canadian Forces.
This report by The Canadian Press was first published June 25, 2021.
Michael Tutton, The Canadian Press
