The Nimrod Review - Official Documents

Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
(3) The Mech Systems Pro-Forma stated that “the Bleed ducting is insulated and so surface temperatures
will be below bleed air temperatures” but failed to note that: (a) there were gaps between the insulation;
(b) some parts of the bleed ducting have no insulation; and (c) the insulation was in poor condition in
some areas.
(4) The Mech Systems Pro-Forma stated that “From in-service data the potential for fuel pipe leakage
is given as Improbable”. I have already discussed above: (a) the obviously erroneous nature of this
assumption; (b) the fact that anyone familiar with Nimrod maintenance would have known that it was
erroneous; and (c) the inappropriateness of using MRA4 generic data in the first place.
(5) The Mech Systems Pro-Forma stated that “From in-service data the potential for bleed air duct leakage
is given as Improbable”. BAE Systems confirmed to the Review that this assessment was also based
on the generic MRA4 data, which gave a failure probability for ECS 45 pipes and clamps as 2E -7 (i.e.
2 x 10 -7 ), and for ECS pipe seals as 1.5E-7 (i.e. 1.5 x 10 -7 ). The author of the Hazard H73 Pro-Forma,
used these generic failure probabilities in his assessment of bleed air duct leakage in order to conclude
that the risk of bleed air duct leakage was within the range of 1 x 10 -6 to 1 x 10 -7 (i.e. “Improbable”).
As stated above, however, this assessment ignored both the early BAe reports of the 1980s and the
evidence presented to the Review which clearly shows that there was a significant history of hot air duct
leakages (see Chapter 7). Against this background, it is most difficult to see how a categorisation of
“Improbable” could ever have been appropriate.
(6) The Mech Systems Pro-Forma failed to pick up on the zonal risk presented by the location and proximity
of the starboard blow-off valve immediately forward of the No. 7 Tank Dry Bay, such that fuel expelled
from the blow-off valve could track back into the No. 7 Tank Dry Bay and ignite.
BAE Systems’ arguments
Fire zone
11.115 BAE Systems argued that there was nothing in the Pro-Forma for Hazard H73 which would suggest that Zone
614 should be treated as a “fire zone”. This is, however, to ignore: (a) section 4L which specifically cites the
requirement of AvP 970 that anywhere where a “single point failure” could lead to a fire should be treated as a
“fire zone”; and (b) section 3 which sets out no less than 15 different “single point failure” scenarios which could
lead to catastrophic fire, explosion or overheating. In my judgment, there is no doubt that Zone 614 should have
been identified and treated as a ‘fire zone’. The factual inaccuracies led, however, to the author ignoring, or
otherwise discounting, the actual risk represented by the Cross-Feed/SCP duct as a serious ‘live’ ignition source
and the risk of a fuel or hydraulic leak onto the Cross-Feed/SCP duct as a single point failure.
Ignition source probability
11.116 There were repeated suggestions from various BAE Systems witnesses, including Witness R [BAE Systems] himself,
that when drawing up section 6 of the Pro-Forma for Hazard H73 a ‘worst case’ scenario for the ignition source
was assumed, i.e. a probability of ‘1’, on the basis that the Cross-Feed/SCP duct was un-insulated and ‘live’ all
the time. In my judgment, this was another piece of ex post facto rationalisation by BAE Systems designed to
downplay the significance, in particular, of the most glaring factual error in the Pro-Forma namely, the statement
that “....the duct is only pressurised when the cross-feed valve is open, i.e. during engine start” (on the ground),
when, in fact, the Cross-Feed/SCP duct was routinely used in flight to power the SCP or to re-start engines after
shut-down in flight. If a probability of ‘1’ had been assumed for the ignition source, there would have been
no need for any detailed analysis of the Cross-Feed/SCP duct, when it was open or shut, or whether it was
insulated or not. It should be noted that, in section 6 of the Pro-Forma for Hazard H73, Witness R [BAE Systems]
went on to refer specifically to the “extreme” situation when the Cross-Feed/SCP duct would be supplied by the
engines on “full power” on a hot day but discounted the risk because “...analysis has shown that the surface
temperature of the insulation in all cases will be below that required for spontaneous combustion of the fuel”.
45 Bleed-air has a number of uses, one of which is to supply the environmental control systems which feed air into the aircraft cabin.
289