Edset
Quote:
Hi DV:
Quote:
Following the XV227 incident the SCP was brought back into operation by RTI/NIMROD/119, dated 26th April 05, and was back to its "significant hazard" status at the time of XV230's accident.
Presumably you are quoting the QinetiQ zonal hazard assessment of the fuel system. If that assessment is correct, we can only conclude that, since the day that the MR2 entered service, every time the SCP was switched on the aircraft and the crew were at significant risk of a fire. The SCP was installed before the AAR system, so the BAe designers had a clean sheet to work on. Are you suggesting that BAe designed a dangerous aircraft for the RAF to fly?
Ed
Refering to para 40 of the BoI report:
Quote:
The Board concludes that the formal incorporation of AAR capability within the Nimrod did not identify the full implications of successive changes to the fuel system and was a possible Contributory Factor in the loss of XV230.
As I understand it the SCP was added to the Nimrod build standard first - and fully certified - with the AAR being added later. In this respect you would expect the safety implications of the changes to be assessed as they were introduced. You would not expect the SCP change "team" or process to assess the safety implications of the yet to be fitted AAR system. Hence it is possible (and from what I can see true) that the SCP system was "safely" incorporated into the design.
The AAR change, as per your BoI quote, appears not to have been however. Without the facts and understanding the design process adopted it is not possible to say what went wrong where, but you might have expected the reviews of the AAR design as it progressed to have looked at the potential impact of the AAR system on the rest of the aircraft. Many features of the design suggest that safety, in terms of the AAR system itself, its integration into the fuel system and into the aircraft as a whole was indeed considered to a large extent. What appears to have been missed is the impact of the venting of fuel from one of the tanks. You would have expected the team/process to have asked "are there any safety / hazards associated with venting fuel from the forward tank". Without the facts it is impossible to say whether this question was asked or answered, but it maybe the case that the team/process did ask the question but did not consider the possibility of fuel streaming down the fuselage, re-entering the aircraft and pooling in areas of the fuselage. In hindsight it is easy to say this risk should have been considered and analysed fully, but I think it is plausible that they may have (erroneously) assumed that the fuel would harmlessly stream out and away from the aircraft and discharge the risk. I think I read somewhere that they did consider the risk of fuel entering intakes & vents downstream of the tank vent, so the risks of fuel venting were not ignored.
From what I've gathered in the BoI, and again without the benefit of the full picture, this seems probably the most important safety/design process failure that contributed to the loss of 230. Whilst it is true that the subsequent safety case should also have flagged up this risk, it is perhaps not surprising that if it was missed (i.e. erroneously assumed innocent) in the first place the same assumptions would be made again during the hazard analysis / safety case refresh.
It is perhaps important to recognise that this design / analysis error, once it had been made, would not necessarily be picked up by any of the remaining airworthiness activities and certification. The alledged lapses in airworthiness build standard maintenance, resource issues and other shortcomings oft discussed here would also have no bearing on this design error, once embodied in all aircraft. It is probably likely that tighter integration between the user and the safety case process may have increased the chances of it being picked up in the later review, but I'm not sure any MoD regulations were "broken" as such during the latter safety case process in this respect - this could be an interesting area and certainly a key area for learning lessons.
I'd be interested to know whether any fuel system / aerospace engineers feel that the "fuel re-entering hazard" should have definately been picked up in the first place or whether this is a relatively "new" risk that surprised the fuel system engineering community.
Did users know it was happening, or did they assume the pooling was from a some pipe "leak" somewhere in the aircraft that only manifested itself in flight, and hence was not repeatable on the ground?