The Nimrod Review - Official Documents

The Nimrod Review
No cross-reference to functional hazard Pro-Forma Hazard H34
11.73
280
No regard or cross-reference seem to have been made to the warning in the functional hazard Pro-Forma
completed for the whole fuel system by Mech Systems on 30 July 2004 (Functional Hazard H34) which listed a
number of fuel leak incidents and stated:
“5. Conclusion…
The design of the fuel system is such that the LRU failures can be tolerated, with the system
being managed by the flight engineer. The trend of incidents with respect to leakage from
fuel couplings and from the Jettison pipe flap areas poses more of a zonal hazard than a
functional one.” (emphasis added)
Leak paths notoriously unpredictable
11.74 BAE Systems further sought to justify the classification of “Improbable” (1 x 10-6 to 10-7 ) to the Review on the
additional basis that “any leak would still have to migrate to a source of ignition, which is clearly always less
than a certainty”. 37 In my view, this sort of ex post facto rationalisation was grasping at straws and unhelpful.
There was no indication that this was a part of the thought process at the time. Nor should it have been, given
the notorious unpredictability of leak paths.
Causation – use of MRA4 generic data
11.75
It is clear, in my view, that the inappropriate use by BAE Systems of MRA4 generic data to sentence MR2 and
R1 hazards was the key factor which led to an incorrect and overly optimistic probability being ascribed to
Hazard H73. It is equally clear that, but for the inappropriate use of MRA4 generic data, the outcome would
have been different. As Witness R [BAE Systems] admitted in interview, without the MRA4 generic data, Mech
Systems would not have been able to progress the sentencing exercise and would have had to go back to
the Airworthiness Department and ask for further information. It is likely that, in these circumstances, the
Airworthiness and Mech Systems Departments would have been forced to look hard at the fault data in the RAF
MDS. Moreover, when BAE Systems came to conduct its review of the Safety Case in 2008 (Safety Case 2), the
maintenance personnel from the Nimrod Servicing Group estimated that the probability of fuel coupling leaks
was far more frequent than the MRA4 generic data suggested.
(13) When presenting the results of its work at the ‘Customer Acceptance Conference’,
BAE Systems misrepresented that it had completed the task and deliberately
did not disclose to the Nimrod IPT or QinetiQ the actual percentage figures for
the large proportion of hazards which it had left “Open” and “Unclassified” or
otherwise draw attention to the large gap remaining in its analysis.
11.76
In my judgment, BAE Systems is open to severe censure for giving the misleading impression at the Customer
Acceptance Conference that it had completed the NSC task satisfactorily and for failing to disclose to the Nimrod
IPT or QinetiQ the known percentage figures for the large proportion of hazards which it had left “Open” and
“Unclassified” (many with only vague recommendations of ‘further work’ being required) and otherwise failing
to draw its customer’s attention to the large gap remaining in its analysis. I am satisfied, for the reasons given
below, that this was a conscious and deliberate decision on the part of the senior BAE Systems personnel
present because the figures were embarrassing and they wanted to avoid any argument with the Nimrod IPT at
the meeting as to whether the NSC task should be signed off or not.
37 BAE Systems’ Written Submissions to the Review.