EdSett
Your post displays impressive knowledge and I don’t pretend to know anything about the intricacies of the Nimrod design. But I’m afraid I don’t agree with your conclusions.
You can’t say the risks don’t exist – you identified them. The probability of occurrence may be incredible (e.g. caused by “massive electrical failure”) but as the outcome would be catastrophic that results in a Class C risk – Tolerable if ALARP. Most of what you write is an excellent risk assessment and could be cut and pasted into the Risk Register as evidence of proper management, competency and existence of corporate knowledge – all airworthiness requirements. Your mitigation plan may indeed be “do nothing” as you have assessed the risk as ALARP.
Importantly, the audit trail is maintained and if, sometime in the future, someone tries to put an ignition source next to a kerosene line in “Location xx”, then the chances increase of the conflict being spotted. (Because you will have entered key words like “Location xx” and “fire” in the RR and future designers will tap that into the database and your work will pop up with a flag). Your successors will benefit from this retention of corporate knowledge, as required by JSP553.
Just my way of looking at things. I believe what I describe is very close to what ACM Loader was referring to when he said the regs weren’t implemented. Certainly Air Cdre Baber acknowledged similar data errors in the Hazard log.