The Nimrod Review - Official Documents

(3) Erroneous or poor mitigation analysis
Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
11.130 The Pro-Formas also contained numerous examples of erroneous mitigation of hazards, or mitigation of hazards
which might be considered poor or inefficacious. In particular:
11.128.1 The Electrical Systems Pro-Formas frequently used the formula “it is assumed that appropriate crew
drills have already been considered in dealing with such an event”, when considering the possible
reaction to an incident. However, this formula was even used when considering events which the
crew clearly cannot influence; for example, fire within the No. 5 and No. 6 fuel tank compartments,
the nose gear compartment and the MR2 doppler compartment. 59
11.128.2 The Mech Systems Pro-Formas used a similar phrase: “emergency procedures and general airmanship
are provided for the crew to address the failure as appropriate” and referred the reader to the Aircrew
Manuals as the source of emergency drills. 60 However, the advice was given for such events as fire
or explosion in Rib 1, the No. 7 Tank Dry Bay, the No. 4A fuel tank: all areas for which there are no
published drills, as the crew have no access and there are no fire detection or extinguishing systems.
This strongly suggests that the documents, such as Aircrew Manuals, cited as sources of drills were
not examined in any detail and that the listing of references was little more than an archive search for
documents, with no intent to utilise them in any analysis.
11.128.3 Numerous Pro-Formas stated that “From In-service data the potential for fuel pipe leakage (or
hydraulic pipe leakage/ bleed air duct leakage) is Improbable”. I have already discussed at length
above the errors in this statement. 61
11.128.4 As indicated below, it appears that not all of the data specified in the checklist contained in the
Proposal to Nimrod (ES) IPT (NIM/HX/P1.3/002 dated November 2003) was used in relation to every
hazard.
(4) Low levels of analysis
11.131 The levels of analysis contained in the Pro-Formas varied, but were generally thin, with some containing little
more than the results of a document search. There is no shortage of examples but the following are indicative
of the overall vestigial quality of much of the analysis carried out by BAE Systems:
11.129.1 As indicated in the Pro-Forma for Hazard H73 itself, a number of zonal hazards were identified in the
Mech Systems and Electrical Systems Pro-Formas at Sections 2 and 3, which contravened the design
references quoted at Section 4. No attempt appears to have been made to determine whether or
not these hazards were indeed design contraventions, or the result of degradation over time, or the
result of maintenance lapses. 62 For example, wiring was noted in Zone 114 installed “adjacent and in
line with the tail plane de-icing hot air duct”, with “evidence of heat exposure” to wiring conduits,
in possible contravention of BCARs.
59 BAE Systems acknowledged that the italicised formula did not add substantively to the Pro-Forma but suggested that “a reference to crew drills
does not imply the presence of a fire suppression system in the zone, nor does it imply that the crew have access to the area”. I do not accept either
submission.
60 As above, BAE Systems again acknowledged that the italicised formula did not add substantively to the Pro-Forma but stated that, as the emergency
procedures and general airmanship of the crew were not, in any event, taken into account as mitigation when determining the overall probability for
the hazard, the statement would not have affected the overall probability assessment.
61 In its written submissions to the, BAE Systems stated that “On the basis of the Incident Database (as supplemented where appropriate by the generic
Tornado/Hawk component data accepted for application to the MRA4 platform), BAES had no reason to believe at the time of the Safety Case that
leaks (whether fuel, hydraulic or bleed air) were common on the aircraft”. As stated above, however, the use of MRA4 data was inappropriate and
the frequency of fuel leaks well known by those maintaining Nimrods.
62 BAE Systems’ response to these criticisms was that the NSC assessed the Nimrod aircraft on an “as designed” basis and that it was not the purpose
of the hazard assessment to review compliance with design standards. BAE Systems thus suggested that “it is not surprising that no reference is made
in the proformas to design or maintenance faults”.
295