The Nimrod Review - Official Documents

The Nimrod Review
290
The engines would only be on full power in the air. This passage would appear, therefore, to conflict with the
earlier (erroneous) suggestion that the Cross-Feed/SCP duct was only pressurised during “during engine start”
(on the ground).
Blow-off valve – not taken into account as potential source of fuel
11.117 There was some suggestion on behalf of BAE Systems that the Pro-Forma for Hazard H73 did not cover the
risk presented by fuel from the blow-off valve because the outside of the fuselage was not considered to be a
‘zone’ and, accordingly, no specific zonal analysis was done on this area on the starboard side forward of the
No. 7 Tank Dry Bay starboard. This is surprising for a number of reasons. First, No. 1 blow-off valve is located
in Zone 127 and, therefore, should have been the subject of inspection and analysis as to what hazard it might
represent to other proximate zones. Second, the ZHA Checklist specifically highlighted the risk which migrating
fluids might represent to other zones. Appendix C3/4 contains a table of ‘generic’ hazards. The table includes
a ‘hot surfaces’ section which refers to “Pipes” and specifically contemplates “Potential for fluid migration from
other bays vertically and laterally”. Accordingly, if any such hazards were identified, the potential for migration
of fluids from other bays “vertically and laterally” should have been carefully checked. Third, some of the risks
associated with Air-to-Air Refuelling (AAR) were contemplated and touched upon in the Mech Systems Pro-
Forma relating to the fuel system and in the Fire & Explosion Report, 46 albeit not the specific risk associated with
fuel venting from No. 1 blow-off valve. Fourth, the risk of fuel entering apertures in the fuselage during venting
from No. 1 blow-off valve during AAR had been highlighted during BAE Systems’ work on the AEW3 project
in 1983 and further investigation by way of dye tests recommended. The failure of BAE Systems to recall this
during the ZHA was a lack of corporate memory by the DA.
Causation
11.118 It was further argued by BAE Systems in their submissions to the Review that the errors which it made in relation
to the use of the Cross-Feed duct and the insulation (and which it admitted) were not, however, causative of
the accident to XV230. This was because the overall probability assessment in the Hazard H73 Pro-Forma was,
in any event, driven by the probability of a fuel leak, which was assessed as “Improbable”. 47 I do not accept this.
First, as explained above, the assumption that a fuel leak was ‘improbable’ was erroneous and derived from
inappropriate data. Second, and in any event, even if a fuel leak was ‘improbable’, it was in my view nonsensical
to assume a risk of ‘1’ for the ignition source and then focus solely on the (im)probability of a fuel leak (as BAE
Systems suggested in evidence they did), since any fuel leak would, by definition, cause a catastrophic fire.
Having identified Zone 614 as a ‘fire zone’, rather than simply assigning a probability to the fuel source, BAE
Systems ought to have focused its attention on addressing the risk of a catastrophic fire itself.
Personal responsibility of Witness R [BAE Systems]
11.119 It is quite clear that, when drawing up the Pro-Forma for Hazard H73, Witness R [BAE Systems] totally failed
to grasp the true nature of the risk presented by the juxtaposition of the Cross-Feed/SCP duct with the fuel
couplings in the starboard No. 7 Tank Dry Bay. The proximity of heat and fuel in this zone represented a serious
catastrophic threat to the aircraft. Witness R [BAE Systems], however, assessed the probability of Hazard H73 as
only ‘improbable’ (1 x 10-6-10-7 ), which equated to a classification of a Category ‘C’ risk, i.e. ‘tolerable’.
11.120 Why did Witness R [BAE Systems] get it so wrong? And why did the Pro-Forma he drew up for Hazard H73
contain such significant errors? In my view, the answer lies in four overlapping reasons:
11.118.1 First, he was someone relatively inexperienced, who had been brought in at a late stage from another
department to a project with which he was previously unfamiliar; he did not have a great knowledge
of the Nimrod and its systems, and had never actually inspected an MR2 or R1; he was under time
pressure; and he was given inadequate guidance as to how to go about the task.
46 e.g. The Mech Systems Pro-Forma for Hazard H34 referred to five incidents during AAR and stated “These incidents have been the result of damage
caused during the refuelling process or ‘dirty basket’. As a functional failure the ability to refuel in flight is not considered flight critical.”
47 BAE Systems stated in writing to the Review: “Given that the risk of a fire/explosion arising from a fuel leak can, as a matter of logic, never be higher
than the risk of a fuel leak itself, it follows that the errors made on the Mechanical Systems pro-forma (i.e. the suggestions that all of the bleed air
ducting was insulated and that the ducting was only pressurised during engine start) had no impact on the overall zonal hazard (H73) probability
assessed by the Mechanical Systems Department, which was one of improbable.”