The Nimrod Review - Official Documents

Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
by the Nimrod IPT to allow QinetiQ to become too involved. As regards the latter point, there are indications of
a disturbing, suspicious attitude towards QinetiQ displayed by George Baber at the Fourth PSWG Meeting on
Friday 21 November 2003 at RAF Wyton, QinetiQ when he accused QinetiQ of just “touting for business” and
also by Frank Walsh, who rejected QinetiQ’s re-write of the Nimrod IPT’s Local Business Instructions (LBI) for the
Safety Cases for modifications to the Nimrod fleet as “gold-plated” and “out of proportion”.
11.245 If QinetiQ had been formally tasked to carry out a full audit of the NSC, the outcome might have been
different.
(10) The Nimrod IPT failed properly to manage the NSC post its production and failed in
any meaningful sense to treat it as a “living” document.
11.246 In my judgment, the Nimrod IPT failed properly to manage the NSC post its production and failed in any
meaningful sense to treat it as a “living” document. Whilst highly regrettable, against the background of
‘assumed’ safety and the paperwork nature of the exercise (see above), it is perhaps not altogether surprising
that there was a less than thorough or pro-active management of the risks identified by the NSC following its
completion.
XV227 duct failure - ‘wake up call’
11.247 In my view, the above criticism is borne out by the manner in which the Nimrod IPT dealt with the two duct
failures on XV227 and XV229 vis-à-vis the NSC. As explained in Chapter 7, on 22 November 2004, Nimrod MR2
XV227 suffered a major hot air duct failure in a section of the Cross-Feed/SCP duct just aft of the ‘elbow’ at the
bottom of No. 7 Tank Dry Bay due to corrosion. 130 The hot air leak of gases up to 420ºC caused serious damage
inter alia to control cables and pulleys, hydraulic pipeline fairleads, numerous fuel seals, and structural members
in the vicinity in No. 7 Tank Dry Bay. It was, in fact, exactly the sort of serious zonal incident envisaged by Hazard
H73: “in an area closely packed with flight control cables and pulleys, hydraulic services, unprotected electrical
cables and hot air ducting there exists potential for hot air ... leaks and possible fire”. 131 As the BOI observed,
“... the incident illustrates the extensive effects of heat damage concomitant on the spread of hot gases within
this area.” 132 XV227 was fortunate not to have been lost entirely.
11.248 In these circumstances, there is no doubt in my mind that the XV227 incident should have been a “wake
up call” (as one Nimrod line maintenance engineer called it) to those responsible for maintaining the NSC.
Unfortunately, it was not.
11.249 The XV227 investigation and the compiling of the NSC were not completely concurrent exercises. As explained
in Chapter 10B, the NSC was effectively ‘signed-off’ by the end of 2004, although a significant number of
hazards remained to be ‘managed’ by the Nimrod IPT in early 2005, and the NSC itself was supposed to be a
‘living’ database. On 26 November 2004, the Nimrod IPT issued an Urgent Technical Instruction133 that the SCP
should be electrically isolated for “Nil use” across the fleet pending further advice from the IPT. Subsequently,
between December 2005 and April 2006, BAE Systems was tasked to conduct a detailed investigation of the
incident. Unfortunately, it would appear that neither the Nimrod IPT (nor BAE Systems), thought to revisit and
fundamentally reconsider the risk categorisation of Hazard H73 in the light of this near-catastrophic incident,
notwithstanding that the Fault Investigation report (MOD Form 761) into the incident noted (‘for reference
only’) that “a bleed air duct failure of this nature, in this aircraft zone, is recognised in the Nimrod Baseline
Safety Case hazard ref. NM/H73”. Whilst Frank Walsh sent a copy of the “Initial Report of Serious Occurrence
or Fault” (Annex A to BP 1301) in respect of the XV227 incident to Witness C [BAE Systems] on 14 December
2004, together with photographs of the damage, he requested merely that these be ‘added’ to CASSANDRA
against Hazard H73.
130 At point in the duct between the Pressure Regulating and Shut off Valve (PRSOV) and the Flow Limiting Venturi.
131 See section 1 of Mech Systems Pro-Forma for Hazard H73.
132 BOI Report, Exhibit E [E-2].
133 UTI/NIM/026, dated 26 November 2004.
319