The Nimrod Review - Official Documents

The Nimrod Review
278
reports, based on total fl eet fl ying hours of 400,000 hours, the probability would equate to 4 x 10 -5 (i.e. 2.5
times greater than “improbable”). In any event, the Review has seen clear evidence of six leaks within a period
of fi ve years (1999 – 2003). 36 It is therefore my conclusion that there was no basis for any assessment of the
probability of a fuel leak as “Improbable”.
11.65 Secondly, there appears to have been no attempt whatsoever to look at in service fault data (as required by
BAE Systems’ proposal), i.e. leaks that were reported as faults but not leading to in-fl ight or ground ‘incidents’.
Fault data comprises those routine technical defects discovered during maintenance which, in themselves, are
not unusual and do not represent a particular threat to the aircraft safety, but which may nonetheless form
part of a trend such as to give rise to a potential airworthiness issue (see the ‘iceberg’ illustration below). Such
fault data is stored on the RAF’s Maintenance Data System (MDS). Whilst it is known to be notoriously diffi cult
to extract any meaningful data from this system, even a cursory examination would have shown “Improbable”
to be a ludicrous label for fuel leaks. Had BAE Systems taken the trouble to examine the fault data (as they had
promised they would do in their Proposal) they would (or ought to) have found the same information extracted
by the BOI, i.e. a leak rate from fuel couplings of around 38 per year since the year 2000.
11.66
Thirdly, BAE Systems’ use of generic MRA4 data was plainly inappropriate in the NSC. The obvious reason why
generic data (taken from the Hawk and Tornado aircraft) was required to be used in relation to the MRA4 was
because it was a new aircraft with no in-service data, hence a generic starting point was required. In the case
of the Nimrod, however, there was in my view no justifi cation for using generic data based on other aircraft
types when there did, in fact, exist years of documented history specifi c to the Nimrod (albeit that even this data
needed to be treated with caution).
BAE Systems continued denial
11.67
Incident Reports
FAULT REPORTS
BAE Systems’ response on these important issues was essentially one of denial that its approach was wrong. The
extent to which this was merely forensic is unclear. BAE Systems has, however, continued to display a disturbing
(apparent) lack of understanding of just how unsatisfactory its approach to the sentencing of risks in the NSC
was. Nor has it appreciated the fundamental need to analyse fault data, as the following paragraph in its written
submissions to the Review illustrates:
“104. It is true that an Incident Database might not capture all minor fuel leaks. On the
other hand, what was relevant to the Safety Case project was the prevalence of fuel leaks
with the capability of causing a catastrophic loss. It was reasonable to assume that the
Incident Database would give an accurate picture of those (subject to limitations arising
from the total fl ight time of the Nimrod fl eet). Coupled with added confi rmation derived
from considering the Tornado/Hawk generic failure rate, a probability assessment of
“Improbable” was tenable.” (emphasis added)
36 Incident Serial No. Kin 114/99, Air Incident Serial No. Kin 120/99, Air Incident Serial No. Kin 95/00, Air Incident Serial No. Kin 104/00, Air Incident
Serial No. Kin 43/03. and Air Incident Serial No. Kin 87/03.