Software fix following naval helicopter crash not complete one year after report

From top left: Master Cpl. Matthew Cousins, Sub-Lt. Abbigail Cowbrough and Capt. Brenden Ian MacDonald. From bottom left: Capt. Kevin Hagen, Sub-Lt. Matthew Pyke and Capt. Maxime Miron-Morin. (Credit: Department of National Defence)

HALIFAX -

One year after software flaws were confirmed as the cause of a naval helicopter crash that killed six personnel, the Defence Department says it has found a solution but is still working on a timeline to complete the project.

A flight safety investigation review released in June 2021 found that the autopilot controls of the CH-148 Cyclone helicopter plunged the aircraft into the Ionian Sea as the pilot was turning sharply to return to HMCS Fredericton on April 29, 2020.

The pilot was unable to regain manual control from the automated system before the helicopter hit the ocean. Master Cpl. Matthew Cousins, Sub-Lt. Abbigail Cowbrough, Capt. Kevin Hagen, Capt. Brenden MacDonald, Capt. Maxime Miron-Morin and Sub-Lt. Matthew Pyke died in the crash.

Following the release of the report, Mary (Missy) Cummings, a director of the humans and autonomy lab at Duke University, told The Canadian Press that the pilot's inability to regain control from the automated software was "a very serious problem" that needed "to be addressed forthwith."

Cummings, the former director of the U.S. Navy's advanced autonomous rotorcraft program, saidshe was also concerned the problem hadn't been caught during airworthiness certification, because she said the issue was foreseeable.

Last week, the Defence Department declined interview requests and instead provided an emailed response to questions from The Canadian Press on the Air Force's progress to fix the software issue.

Media spokeswoman Jessica Lamirande said Sikorsky, the aircraft's manufacturer, its subcontractors, and the Defence Department have considered proposed changes to the flight control software, adding that both Sikorsky and the Royal Canadian Air Force did followup testing.

"As a result, a technical solution has been reached that addresses the flight safety investigation report recommendations," Lamirande said.

The software change, she added, will "provide greater latitude to safely manoeuver the aircraft" if a pilot is attempting to override the automated system with manual controls, as occurred during the 2020 crash.

There would be some form of "automatic disconnect function" of the automated flying system "should an unsafe condition arise," she wrote. The software change would also include visual improvements of warning systems, including changes of colour, altered text, and flashing lights.

"Now that the technical requirements have been agreed upon by all parties, Sikorsky and its subcontractors are working to determine the cost and schedule to modify the fleet," she said, adding, "a full implementation proposal is expected by the end of summer 2022."

Lamirande said the Defence Department's "intention" is to begin airworthiness certification of the design change immediately, adding that the change will be implemented across the Cyclone fleet once an agreement on costing and scheduling is complete.

According to the findings of last year's report, the autopilot was left on as the pilot approached and executed a sharp turn, and as a result, the software built up commands, preventing the pilot from resuming manual control at the end of his turn.

An earlier, internal military report -- the board of inquiry report -- obtained by The Canadian Press referred to this accumulation of calculations from the automated software as "attitude command bias."

The board of inquiry report said these commands in the software "can accumulate to such a degree that it severely diminishes, or even exceeds," the pilot's ability to control the aircraft manually.

In an emailed statement sent July 16, 2021, Lamirande said the Air Force has trained the aircrews to ensure they are aware of the scenario that led to the crash and they understand how to avoid it or recover from it.

However, Greg Jamieson, a professor of industrial engineering at the University of Toronto, has questions about the military's written responses.

Jamieson said the solution doesn't speak directly to the phenomenon of built-up commands, referred to as "command attitude bias," in the flight control system, or how to eliminate this root problem.

"If I follow their statement correctly, they are now adding new automation (the disconnect function) to figure out when the 'flight director' should be overridden by pilot commands. Establishing these bounds on the autonomy of the automation is a very challenging problem," he wrote in an email.

John Dorrian, a spokesman for Sikorsky, said in an email the company is preparing a formal proposal for submission to the Defence Department later this summer, which he said will include the schedule to modify the Cyclone fleet. He referred other questions to the Defence Department.

The crash was the largest single-day loss of life for Canada's military since the Afghanistan war.

The Defence Department has said the entire cost of the changes to the software will be borne by the Canadian government.

This report by The Canadian Press was first published June 23, 2022.