The Nimrod Review - Official Documents

The Nimrod Review
10B.48
10B.49
250
Evidence for Mitigation of hazards
Hazard
No
Hazard Control Post
Control
Status
H73 Z514/614 Interacting
Systems Hazards
1. Systems maintained iaw Nimrod maintenance
procedures AP101B-0503-1.
2. Aircraft fire detection and suppression system.
Remote
Of the 25 instances where this is repeated, only six of those zones possess a fire detection and suppression
system; the other 19 do not. Therefore, the above entry was seriously flawed in three respects. First, the
reference to “Aircraft fire detection and suppression system” as a hazard control was in many cases, including
Hazard H73, a glaring factual error. Second, the inclusion of “Systems maintained iaw Nimrod maintenance
procedures AP101B-0503-1” was inappropriate as a hazard control. Third, the setting of “Remote” as a Post
Control Status was inappropriate and illogical since in many cases this was merely the ‘initial probability’ set
on CASSANDRA (see further below).
I turn to consider these flaws in more detail below. The explanations given by Frank Walsh as to how they
came about were far from satisfactory.
First Error: “Aircraft fire detection and suppression system”
10B.50
10B.51
10B.52
10B.53
Annex A contained a repeated and fundamental factual error in the entries for 19 of the 30 Unclassified
“Interacting Systems” hazards (Hazards H44 to H82): namely, the statement that an “Aircraft fire detection
and suppression system” in the third column was a mitigating control. This was erroneous. Of the 25 where
“Aircraft fire detection and suppression system” is noted, only six zones were fitted with fire detection and
suppression systems on either Mk of Nimrod. Three of these zones were on the MR2 and these related to
Hazards H45, H47, and H66 , namely, Zone 113 (Aileron Bay), Zone 116 (Elevator Bay), and Zone 413/443
(Nos. 1 and 4 Engines). Of the 19 without detection and suppression systems, some do have overheat
detectors which are intended to detect hot air leaks but are not considered to provide ‘area’ fire detection. In
one area, the bomb bay, there is a fire detection and suppression system on the R1 but only a fire detection
system on the MR2; this distinction is not made clear in the table.
There are no documents shedding light on how such a serious error came to be made and repeated so many
times by Frank Walsh when he was drawing up Annex A. The lack of a proper paper trail is unsatisfactory
and troubling. It suggests, at least, either that the express requirements of the Nimrod Safety Management
Plan (SMP) as to document retention were ignored, or that Annex A was drawn up as a result of an entirely
informal process with no peer review and/or supervision (see Chapter 11).
Frank Walsh had varying explanations as to how he came to make this mistake, all of which were unsatisfactory.
He initially suggested in interview that he would not have entered the references to ‘Aircraft fire detection and
suppression system’ in Annex A “without someone providing me with the information”. But he was unable to
say who the source of the information was. He said he had no clear or independent recollection of events. He
said he thought it was likely that he would have drawn up a list of hazards requiring further consideration,
circulated this by e-mail within the IPT to relevant Desk Officers and then collated the answers, but he had
not retained the e-mails. He said that he could have had a conversation with one of the Desk Officers. He
said he believed that the Airframe Desk would have been the most likely source of the information. He said
in a later statement that there might have been “another source”. I have concluded that his evidence is not
to be relied upon on this aspect.
In my view, it is unlikely in the extreme that anyone on the Airframe Desk could or would have made such
a fundamental mistake. The notion that there was an “Aircraft fire detection and suppression system” in
so many zones on the aircraft was not just wrong, but absurd to anyone with a cursory knowledge of the
Nimrod aircraft, not least because the wings (Zones 522-538 port and 622-638 starboard) beyond the engines
would have no need for such fire detection systems, let alone room for so many fire bottles. As Michael Bell7 powerfully put it in his cross-examination at the Inquest, it was an “absolutely idiotic error” to suggest that
so many zones in the wings would have fire detection and suppression systems.
7 Brother of XV230 crew member, Gerard M. Bell, Deceased.