Sorry JFZ90, I read it differently (and of course, unless you were there – I wasn’t – we don’t know exactly what was said).
The design “flaw” (I notice the imprecise use of terminology) and the subsequent management of the resultant hazard are two different things. The first was a one-off if you like; the second is the through-life bit.
The hazard may have been graded incorrectly (presumably he means it should have been remote, occasional, probable or frequent – not improbable). The point I made is that this is largely irrelevant. Whatever the probability of occurrence, the severity of harm was “catastrophic” (and so it proved) so the risk had to be reduced to ALARP. It clearly wasn’t and the existence of multiple references to the engineering solution in the airworthiness and safety regs compounds this. This is the long standing and presumably oft-repeated error (due to the requirement for constant review). As for the “design flaw” I deliberately don’t comment on the intricacies of the fuel and AAR systems, only to say that each, in isolation, may be physically safe, but when integrated the “system of systems” may not be functionally safe. (Which is presumably the justification for ceasing AAR and still flying). I confine myself to commenting that this is not unusual, especially when either or both are Service Engineered Modifications. I also state, from a position of personal knowledge (and from being in possession of relevant letters via FoI) that the 4 Star in MoD(PE) and DPA specifically ruled that it was acceptable for such a “system of systems” to be physically safe, but not functionally safe, thus rendering the aircraft not fit for purpose and placing the aircrew in danger. (And, again, so it proved in a separate accident in 2003). In doing so, he was upholding the rulings of various 1 and 2 Stars, some of whose responsibilities included Nimrod.
Hence it is not so much a case here of "MoD not following its own procedures" that led to the loss (though I do not question whether this is potentially another valid issue that you Tuc raise regularly), but seemingly more a case of "MoD/suppliers followed procedures but despite this a design flaw still prevailed in the certified product".
While I know for a certain fact MoD routinely don’t follow these regs, in this case I’m merely repeating what the BoI report says. The main point I make is that this was not a revelation, but a re-iteration of a long known problem. The MoD is trying to compartmentalise the Nimrod accident, but the same failures led to other fatal accidents – again I’m merely citing the BoI reports. I don’t agree MoD followed procedures. The risk was not reduced to ALARP. This is directed policy. It is not left to chance that someone spots these risks/hazards. The regs and Design and Airworthiness Requirements (00-970) are chock full of references to the basic risk and technical reports on the subject, and they are published by D/Stan on their site for all to see.
For me the role of Boscombe (and other safety independants?) in this process failure will be interesting - after all are they not there to pick up on these kind of issues during Design/Safety Case reviews? Isn't this what they are contracted/paid for?
Good question. Were the Design Authorities (not just BAeS) under proper continuous contract to maintain the build standards? I can’t speak for BAeS, but I know the answer to many other DAs. No, they weren’t, and this is a matter of policy going back to 1991 which the IPT can do little about; in fact nothing if the funding and political will does not exist. It’s a case of crossing fingers and hoping. Again, this is a clear failure to implement regs. I am very careful not to condemn the IPT here. Many platform IPTs simply have no control whatsoever over much of the kit in their aircraft. I know what it’s like to assume management of both aircraft and equipment modification programmes only to discover that configuration control, tech pubs, drawings etc are 15 years out of date (something highlighted in the QQ report and which is a serious breach of airworthiness regs). This is not speaking out of turn – it is merely lending credence to a Public Accounts Committee report which, in 1999, said precisely the same thing. The MoD cannot pretend they haven’t been told the regs aren’t being implemented. Ingram signed a letter refuting it! Bet he wishes he hadn’t.