The Nimrod Review - Official Documents

Primary sentencing source was MRA4 data
11.68
Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
The extent to which BAE Systems did in fact use the in-service incident database remains, however, unclear.
A number of BAE Systems’ personnel interviewed by the Review said that they had, or probably would have,
consulted the Incident Report database. In view of the time pressures that they were under, however, and the
frequency with which one fi nds seemingly ‘cut and paste’ statements along the lines of “From in-service data
the potential for fuel pipe leakage is given as improbable” in the various Pro-Formas, I consider it more than
likely that resort was had primarily, if not exclusively, to the generic MRA4 generic data as a simple way of
assessing and sentencing hazards. They were increasingly busy personnel under time pressure who had the
diffi cult job of assessing and sentencing hazards based on no more than a general description of a hazard and
limited photographic evidence. It is clear from BAE Systems’ Pro-Formas, and was admitted by BAE Systems in
its written evidence to the Review, that the BAE Systems’ personnel involved in Phase 2 did indeed proceed to
sentence these risks (including Hazard H73) on the assumption that the risk of a fuel leak from a single fuel
coupling on a Nimrod MR2 or R1 was 1 x 10-6 (i.e. “Improbable”), primarily on the basis of the generic MRA4
data. It should be noted that the Nimrod IPT were told at the Sixth PSWG meeting on 10 November 2004 that
“Hazard ... numerical probabilities have been deliberately not used as the basis for the Nimrod Hazard Log.” We
now know that this was not correct since the numerical probability of 1 x 10-6 derived from the MRA4 generic
data was used.
Assumption of fuel leak risk of 1 x 10 -6 was unreasonable
11.69
11.70
11.71
11.72
In my judgment, it was wrong and unreasonable, in any event, for BAE Systems to have calculated the risk of a
fuel coupling leak in Zone 614 (Hazard H73) as “Improbable” (1 x 10-6 to 10-7 ).
In the fi rst place, the MRA4 generic data fi gure was obviously wrong as far as its applicability to fuel coupling
leak rates in the Nimrod MR2 and R1 fl eets was concerned. It put the risk of a fuel leak from a single fuel
coupling as 1 x 10-6 , i.e. the probability of a fuel leak from a coupling occurring on average only once-in-amillion
fl ying hours. However, anyone with maintenance experience of the Nimrod fl eets would intuitively have
known this was far too optimistic and, if asked, would have pointed out that fuel coupling leaks were known to
occur in the Nimrod fl eets much more often than that. Moreover, a thorough and proper analysis of in-service
incident and fault data should have shown BAE Systems that the risk of a fuel coupling leak was much greater
than 1 x 10-6 .
In the second place, as Witness K [BAE Systems] agreed in interview with the Review, allowance should have
been made for the fact that there were approximately nine or ten fuel couplings in the No. 7 Dry Bay Starboard
in close proximity to, and which could have affected, the Cross-Feed/SCP pipe. Accordingly, the risk would be
in the region of one order of magnitude greater, i.e. “Remote” (1 x 10-5 to 10-6 ). BAE Systems sought to argue
otherwise on the basis that “only fuel leaks capable of being ignited should be considered” in its submissions
to the Review. Common sense would suggest, however, that all nine to 10 fuel couplings should be taken into
account given: (a) the unpredictable nature of fl uid paths means that any fuel leak ought to be considered at
least potentially capable of being ignited; and (b) the fact that the heat sources in the No. 7 Tank Dry Bay are
located at or near to the bottom of the bay, directly below the fuel pipes and couplings.
In the third place, the precautionary principle would suggest that, where the indications are borderline, the
more stringent criteria should always be applied, i.e. “Remote” (1 x 10-5 to 10-6 ). Indeed, the Nimrod Safety
Management Plan (SMP) (which had been provided to BAE Systems by the IPT) expressly provided (at paragraph
27) that, where the indications were borderline, “the more stringent criteria should always be applied to ensure
appropriate management action is taken”. BAE Systems, nevertheless, relied on the generic MRA4 statistical
data to assume that a fuel coupling had a probability of 1 x 10-6 for the purposes of categorising the risk of
Hazard H73 as “Improbable” (1 x 10-6 to 10-7 ), when the more stringent criteria should have been applied, i.e.
“Remote” (1 x 10-5 to 10-6 ).
279