The Nimrod Review - Official Documents

Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
11.118.2 Second, the information which he had to work on was scant and superficial. The descriptions of the
potential hazards derived from the Phase 1 inspection work did point to potentially serious fire and
explosion risks arising from the close proximity of fuel and heat systems. 48 But the descriptions were
brief, contained little explanation or analysis, and did not materially distinguish between the MR2 and
R1 (only the former had the SCP duct). Moreover, the photographs gave little real clue as to the real
geography of the No. 7 Tank Dry Bay, or the actual continuity or condition of the duct insulation and
‘muffs’.
11.118.3 Third, the rigour of his approach was undermined by the prevailing mind-set that the aircraft was
safe and the NSC task was essentially one of documenting this ‘assumed’ safety. 49 As Witness R [BAE
Systems] himself explained in interview, he saw his ‘target’ as essentially one of showing that the
risks were ‘improbable’. His approach to the task was, therefore, flawed from the outset: rather than
conducting a thorough-going analysis of the real risks, the exercise which he was, in reality, engaged
in was simply looking for evidence to prove or demonstrate what was already assumed to be the
case. In common with his other colleagues carrying out the Phase 2 desk analysis, he was not really
looking out for, let along expecting to find, latent or even patent risks; but rather he was looking to
demonstrate and document what was assumed to be the case, that there were no significant risks.
The Nimrod fleet had, after all, had a long and benign service history from an airworthiness point of
view.
11.118.4 Fourth, the advent of the MRA4 generic data as a simple tool for sentencing risks obviated the
need for detailed or careful risk analysis. The fact that Witness R [BAE Systems] was permitted to
ask for, and then to use, MRA4 generic data as the primary data to sentence risks such as Hazard
H73 meant that, at a stroke, he was able to achieve his ‘target’ of demonstrating ‘improbability’ (1
x 10 -6 ), without needing to be too concerned about any further analysis or the accuracy thereof. His
probability conclusion was essentially driven by a single piece of information: the MRA4 generic data.
Section 6 of the Pro-Forma could have been reduced to the single reference to ‘in-service’ data. 50 I
reject his suggestion that he assumed a ‘worst case’ probability of ‘1’ for the ignition source and that
‘accuracy’ about when the Cross-Feed/SCP was on ‘did not matter’. As I explain above, this was part
of BAE Systems’ ex post facto rationalisation. But, in my view, the fact that he was allowed to use
the MRA4 generic data as a convenient panacea clearly short-circuited the risk analysis process, and
partly explains his undoubted lack of rigour in relation to the ignition part of the equation in section
6 of the Pro-Forma. 51
11.121 Witness R [BAE Systems] was clearly personally at fault in relation to the erroneous content and conclusion in the
Pro-Forma for Hazard H73. His most significant factual mistake was to assume the Cross-Feed/SCP duct was only
used during engine starts on the ground (which he was unable to explain save on the basis that he confused
the MR2 and R1). 52 His probability conclusion was out by at least two orders of magnitude. In my judgment,
however, his conduct and personal responsibility must be judged in the light of the factors outlined above. He
was a relatively junior employee; he was placed in a difficult situation not of his own making; unbeknown to
him, there were factors which militated against him reaching the right answer; he was not particularly familiar
with Nimrods; his work was not closely supervised or checked; at all material times, he was trying his best. For
all these reasons, I have concluded that it would be unfair and disproportionate in all the circumstances to make
any finding of significant culpability against him and name him in this Report. In my view, the real fault and
responsibility for the failure of the NSC lie with his superiors higher up the chain at BAE Systems, and with the
Nimrod IPT and QinetiQ.
48 See section 2 of the Mech Systems Pro-Forma for Hazard H73: potential for fuel leaks from “...No. 7 Tank main feed fuel pipe immediately above
the HP, High Temp engine bleed take-off port or associated ducting” and the potential for hot air, fuel and hydraulic leaks and possible fire exists “in
an area closely packed” (emphasis added) with cables, hydraulics, electrics and hot air ducting.
49 See e.g. BAE Systems’ Proposal for Phase 1 of the NSC dated August 2002: “By virtue of a range of traditional methods (certification and
qualification/ integrity testing), there is already a high level of confidence in the prevailing level of safety of Nimrod types. However, there is currently
a lack of structured argument and supporting evidence formally recorded and maintained.” (emphasis added)
50 Section 6 of the Hazard H73 Pro-Forma contained the repeated sentence:“From in-service data the potential for fuel pipe leakage is given as
Improbable.”
51 On 5 August 2004 he had been sent a coloured diagram of the duct system showing temperatures and the SCP system on the MR2. The same
would also have been apparent from the Aircraft Manual (AP).
52 This would explain the SCP duct but not the use of the Cross-Feed duct for in-flight engine re-starts.
291