Nimrod crash in Afghanistan Tech/Info/Discussion (NOT condolences)

[Distant Voice]

Mick, give up. You are beating your head against an MoD brick wall. We all know, including QinetiQ, that a risk level of "accepatable" has know real meaning. If QinetiQ really thought the system was safe they would have used the correct term "broadly acceptable".

Des Browne and CAS took advange of the lose terminology and mislead MP's, aircrew and the general public.

DV

[JFZ90]

You arent listening really are you JFZ90? Des said QinetiQ had said the fuel system was safe. QinetiQ actually said it was tolerably safe but not ALARP. ALARP is a fundamental part of the MoD's own definition of safe. Under those rules, a system cannot be safe without it. Tolerably safe is not good enough on its own. It must be ALARP. That's not my rules, that's the MoD's own rules.

I note your argument, but respectfully suggest it fails to give the reader the true picture.

The actual words in the QinetiQ report in the conclusion:

"Having considered the evidence referenced in this safety case report, noting that there are outstanding recommendations and the level of risk present to the fuel system is not ALARP, the operation of the fuel system is tolerably safe given the mitigations in place".

Whilst you can pick up on the slight variations in terminology, surely the correct interpretation of QinetiQs statement is that even though there are some aspects that should be followed up, the system in question is assessed as QinetiQ as tolerably safe. Your assertion that it is not and hence Des was lying is totally misleading, as the statement above notes the ALARP aspect you seek to make so much of!!!!

Mick, give up. You are beating your head against an MoD brick wall. We all know, including QinetiQ, that a risk level of "accepatable" has (k)no(w) real meaning. If QinetiQ really thought the system was safe they would have used the correct term "broadly acceptable".

So let me get this right DV - QinetiQ, by saying the risk is "acceptable" are actually communicating in a secret code - by not saying the magic "broadly acceptable" words they really mean it is "totally unsafe". Yes, I see now, your line of thinking makes absolute sense - NOT.

Its really me who should give up - I thought for a moment back there that you had started to question your article, but now I can only conclude it has all been a deliberate misrepresentation. I hope you're comfortable with the 99.9% of your readership who take your articles at face value and will be talking about how "the government lied about Nimrod safety" based on your assertions. Very poor show.

[Mick Smith]

JFZ90
You were going fine until your last paragraph because you were putting across your interpretation - in my view a misinterpretation - but your no doubt honestly held view. Thereafter you accused me of mendacity which I do not accept. My interpretation is not just my interpretation because not being an expert I checked the principle with two separate experts. They were the ones who confirmed that the system has to be ALARP to be safe, not that I and any reader who wants to cannot read it in the defence standards regulations which are very clear, although obviously not to you.

You have a view to which you are entitled. But your last paragraph is complete rubbish. As I said earlier, I very carefully and accurately laid out the point about ALARP in the article and yes I am comfortable that 99.9 per cent of our readers will believe that when Des Browne said the QinetiQ report had found the fuel system to be safe he was not giving an accurate picture. I am not going to accuse him of lying, and the article didn't do that either, because that would imply he knew it was inaccurate. But as the article did say, he certainly appears to have misled MPs.

[JFZ90]

Mick

I admit you are also entitled to hold your view, and I can see how you could interpret things the way you have, even though I feel strongly this is an incorrect interpretation. In this respect I suppose I should give you the benefit of the doubt about whether you sought to mislead readers - so apologies if I did not above.

There is potential for alot of confusion in this area and I think a misconception that demonstrating ALARP is the same as saying something is totally safe. This is absolutely not the case. The best example of why this is not so is probably the Harrier, which whilst it can be regarded as having ALARP safety, it is by design a fundamentally quite hazardous piece of kit (1 very high performance engine, fast jet, etc.). You can argue its ALARP however as to make it safer (e.g. add another engine for redundancy etc.) is not in any way practical, and the risks are tolerable with migitations (ejection seat, careful where you fly it etc.).

I'd be interested to know what background your 2 experts have and whether they really think the QinetiQ report is really suggesting something at odds with what Des said.

[tucumseh]

A couple of random thoughts, accompanied by direct extracts from the MoD’s own literature.

The QinetiQ report refers on a number of occasions to the Hazard Log and also to the lack of an audit trail that can demonstrate airworthiness.

A Hazard Log must contain the following;

Part 1: System data, including information of the build standard (which means it must be maintained), usage, environment etc and Safety requirements (legal, certification, safety elements of the – in this case – Air Staff Requirement and Risk Matrix). By definition, this means the Design Authority and MoD MUST have the ASR. They don’t.

Part 2: Hazard Data (a record on every identified hazard with its description, associated possible accidents, how it is analysed etc).

Part 3: Accident Data (a record on possible accidents for the aircraft, target Risk Class, how it is analysed, assessed Risk Class)

Part 4: Statement of System Safety (the assessed Risk of the aircraft)

Part 5: Journal (the running log or diary of significant events in the Safety programme).


In other words, it’s not a simple “log” but a significant body of work and a major task on a whole aircraft. All this is a through-life process – not a one-off. If you like, the Hazard Log is the heart of the Safety Case system. Like a case in law, the Safety Case is a body of evidence presented as a reasoned argument. However, unlike most areas of law the activities are not presumed safe (innocent) until proven unsafe (guilty). The Safety Case MUST prove that a system is safe. The onus is on the MoD to demonstrate they comply with all the regs and ensure Risks have been mitigated to ALARP. They can’t. This why Des Browne admitted liability.


Those who read my posts will know I bang on about maintaining the build standard. From part 1 above, you will see this is mandated. Maintaining the build standard has 17 core elements;

• Appointment of a Design Authority.
• Investigation of faults
• Design of modifications
• Submission of proposed modifications
• Design incorporation of approved mods and changes, and maintaining configuration control
• Holding and maintenance of master drawings
• Management of Component replacement / unavailability (sometimes, wrongly, called obsolescence)
• Responsibility for complete systems (as opposed to a single “black box”).
• Provision of Technical advice to MoD and their agencies
• Visits to User units (primarily to discuss system performance with users)
• Packaging and handling
• Supply of documents (to IPTs and agencies)
• Management of sub-contractors, and monitoring their capability.
• Preparation of amendments to Technical Publications
• Conduct of Trials Installations
• Holding and maintaining the Sample and Reference systems.
• Dealing with day to day correspondence from MoD, their agencies and suppliers.

Do any Nimrod operators or maintainers see anything in the above that is not carried out? Out of date tech pubs? Drawings not available or out of date? Faults not investigated? Configuration Control not maintained? A contact number at the Design Authority and immediate access? Unavailable spares? If you do then, by definition, there has been a major failure of the Safety Management System. Both QinetiQ reports are, quite simply, a catalogue of such failures.

[Distant Voice]

JFZ90: It is clear from what you say in your second paragraph to Mick Smith that you do not understand the concept of ALARP. Adding a additional engine to a Harrier is not what ALARP is about.

Furthermore, I can assure you that QinetiQ fully understand the the meaning of "Broadly Acceptable". And whilst they are happy to throw in the non-Def Stan term "acceprable", they are not prepared to go all the way and place "broadly" in front of it.

Was this a way of sending a secret message? I have no idea. What I do know is that the report was initially issued in Sept, for comment. It was then published for General Release in Oct. I say "General Release", it has taken the families of the lost crew over four months to get their hands on a report that claims to give the Nimrod system a clean bill of health.

DV

[JFZ90]

JFZ90: It is clear from what you say in your second paragraph to Mick Smith that you do not understand the concept of ALARP. Adding a additional engine to a Harrier is not what ALARP is about.

When I was first taught about ALARP more than 10 years ago the Harrier example was used to highlight the principle quite well I thought. The Harriers loss rate doesn't meet 'normal' safety targets, due in large part to its VTOL / single engine design. The fact that you wouldn't consider e.g. adding another engine to Harrier to improve its loss rate (totally impractical) is exactly what ALARP is all about.

From what you said earlier,

If it is not ALARP it is NOT SAFE.

I was concerned that you or a reader may erroneously draw the conclusion that ALARP = safe from your statement above. I hope the Harrier example shows why this is not the case - it is considered as safe as it can be, but this should not be confused with "it'll never go wrong & crash" which is a different thing.

Was this a way of sending a secret message? I have no idea.

You're kidding right?

[Mick Smith]

I understand entirely what you mean JFZ90. I wasnt intending to simplistically say that it it's ALARP it's safe and I accept that was a possible conclusion that someone might have taken from what I said. As all will by now understand I hope, all I am saying is that if it is tolerable but it isnt ALARP it isn't safe, as shown even more clearly than in the defence standards document in table 7.1 from this document from the MoD website:

http://www.asems.mod.uk/smp07.pdf

[OilCan]

actually Mick - it says

Unacceptable

not -

it isn't safe

...which could say as much about the procedure itself (or lack of) as it does about the actual nuts and bolts.

sorry to nit pick but you guys started it.

carry on chaps

[Da4orce]

Mick,
I found the defence standards document surprisingly easy to read, it provides clear descriptions of ALARP and supports your article on Sunday.

I haven't read the whole document but this stood out amongst the sections that I have read:

10.1.6 The Project should demonstrate any claims that all reasonable steps have been taken to ensure that risk is tolerable and ALARP and demonstrate that they have exercised their common law “duty of care”. The level of evidence required is a function of the level of risk and the domain. This will also involve demonstrating that further risk reduction methods have been actively sought and considered in a systematic way.

I would imagine that this document played a significant role in prompting the apology from the SofS for Defence. It seems reasonable to believe that he was advised that the MoD could not demonstrate that 'steps have been taken to ensure that risk is tolerable and ALARP' and were unable to 'demonstrate that they have exercised their common law “duty of care”.

The Def Stan document is also very clear in identifying those with responsibility for ensuring the procedure:

3.1 Accountability

3.1.1 The IPTL is accountable for the completion of this procedure.

3.2 Procedure Management

3.2.1 The IPTL may delegate the management of this procedure to a member (Safety Manager) or members of the IPT.

I now feel like I have approximately 0.01% of the knowledge that tucumseh has on this subject!

[BEagle]

The Project should demonstrate

'Should' does not imply a mandatory requirement, it merely implies a strong recommendation. The words 'shall' or 'must' imply mandatory requirements.

However, where a strong recommendation is not observed, those to whom it applies must be able to explain the reasoning for not observing the recommendation.

I also found Mick Smith's article clear and concise. He should be lauded for his investigative efforts!

[tucumseh]

Another gem from MoD archives……..


“Pre-requisites to Successful safety Management”


Successful Safety Management requires (MoD) to follow good practices in areas such as;

• Quality (How many resident QARs do we have now?)
• Configuration Management (Funding slashed from 1991-on and now considered a vague concept and, at worst, a “waste of money”).
• Use of suitably qualified and experienced personnel (Difficult, following CDP’s decision in 1996 that such people were not required. He ditched two generations and left us with airfix pilots and physiologists making engineering decisions).
• Management of Corporate and Project Risk (Corporate are on the greasy pole and Projects are denied resources).
• Design Reviews (Ah, a hobby horse of mine, ever since 2* ruled it ok to waive a Critical Design Review knowing critical safety risks were outstanding. Luckily, I ignored him).
• Independent Review (Despite QQ not being truly independent, I have the greatest respect for the likes of Boscombe Down who, consistently, over a long period, have provided what stability and common sense there is in aircraft Safety Management. To paraphrase Beagle, if their recommendations are ignored it should be mandatory for the IPTL to document his/her reasons. I utterly detested being told to ignore them when their recommendations caused embarrassment to my boss’s mate. But, equally, I was disappointed when they withdrew under pressure only to phone me up and say “We were told to withdraw, but can you please make the aircraft safe?”).
• Closed Loop problem reporting and resolution (Closed, in the sense if you report a problem, the door is closed. If you’re on the outside, you’re ignored. If you’re on the inside, you’re on the carpet for a career brief on your brief career).
• Focus on Safety culture (In that the Safety and Risk managers are treated as a nasty culture festering in the corner of the floorplate).

Cynical, moi?

[Chugalug2]

Cynical, moi?

Well certainly moi, tucumseh! Your continuing testimony on the threads of this forum show how the regulations and procedures to provide for and maintain the airworthiness of HM aircraft have been systematically and deliberately ignored or circumvented over the past few decades at the behest, direction and instruction of senior officers. Of course Brown and Co want as much bang for as few bucks as possible. It is the purpose of those regulations and procedures to ensure that the few bucks are not so few as to render military aircraft unfit for purpose, ie unairworthy and as often as not unsafe. It is the responsibility of senior officers to ensure that this does not happen. That responsibility would appear to have been reneged on. The important thing is to reverse this dysfunction and make our aircraft safe and fit for purpose again. How should that be done? At the risk of sounding like the ignored guest at Fawlty Towers endlessly repeating his drinks order to no avail, remove all responsibility and authority for the regulation of Military Airworthiness to a separate and independent MAA with a relationship to the MOD similar to that between the CAA and the civilian operators.

[helgar33]

Can I just butt in here and ask about another part of the Sunday Times article and see if what I understand is correct. The part that concerns me reads: -

''TheQinetiq report found that during air-to-air refuelling fuel was flowing at twice the speed deemed safe for vital parts of the fuel system. It also showed that a light on the flight engineer's panel that would flash if there was too much pressure in the fuel system had been deliberately disconnected''.

''Twice the speed''!!! Putting a huge amount of pressure on the system and possibly causing a fatal leak heh?!

I am now wondering when was the warning light disconnected? Under whose orders? Under what circumstances? I know that the Qinetiq report was released last year but ultimately was the disconnection made before or after 2nd September?

Please discuss.....

Crew 3 family member- please be gentle!

[EdSet100]

Helgar, the light you are referring to is the "5 Tank Overpressure" warning.

When the Nimrod was built, consideration had to be given to mitigation against refuel valves failing to close when their associated tanks reached full while filling them up on the ground. Despite the presence of a ventilation pipe, a tank could rupture under the pressure of fuel being pumped in through the stuck open valve at a greater rate than the vent pipe could handle. Therefore, all the tanks are fitted with blow-off valves, whose diameters match the bore of the refuel pipes. This ensures that if a blow-off valve opens, it has the capacity, together with the vent pipe, to dump the fuel onto the ground at the same rate that it enters the tank, therefore protecting the tank from a rupture. This was designed for ground refuelling only. The No 5 tank is in the fuselage and its blow off valve was fitted just forward of the No 2 engine intake. This is not an issue when the engine is not running, which is always the case when refuelling on the ground.

When the AAR system was installed, it was recognised that a No 5 tank refuel valve might fail to close when the tank became full during AAR and that it's blow off valve might then send copious amounts of fuel down the intake of No 2 engine. Therefore, they installed a pressure switch which would activate the "No 5 Tank Overpressure Warning" light and simulataneously close the 5 tank refuel valve, by interupting its electricity supply.

Mick Smith, please take note:

It was later recognised that the warning system was inadequate: the pressure switch might not work in time to stop fuel passing through the valve, or the valve might be physically jammed open, so no electrical control would have any effect, and, lastly, the crew, having seen the warning, would not be given sufficient time to safely withdraw from the tanker before the fuel entered the engine intake. Further mitigation was then designed as follows:

A restrictor is now fitted into the refuel pipe for No 5 tank, such that the effective bore of the pipe at that point is less than the tank's vent pipe. This ensures that if the refuel valve jams open the vent pipe has the capacity to direct all of the surplus fuel to the vent outlets at the back of the wing at the same rate that it enters the tank. The blow off valve is now redundant and has been removed and blanked off. The warning light will never come on, so it has been "deliberately" removed.

In summary, the RAF/BAe have cleverly replaced a dubious warning system with a far safer arrangement that now completely avoids the possibility of overpresssuring the tank. It is a pain in the neck during AAR because the refuelling rate has slowed considerably, but we recognise the need for it. The modification was carried out in the late 80's.

Helgar, I hope this has helped. I will write another message about the flow rates.

Mick Smith, I urge you or your colleagues to pm me whenever you want to write anything in the Timesonline about anything technical on this aircraft. Helgar is clearly concerned about what has been written. This is yet another needless discussion.

Regards
Ed Sett

[helgar33]

Ed Sett
Thank you for your very thorough description of the tank 5 warning light disconnection. The detail which you went in to was much appreciated and has made things alot clearer for me and hopefully for others who are also following information that concerns XV 230. 'Needless discussions' are needed by us uninformed types! I look forward to part 2.
Regards helgar33.

[dodgysootie]

Ed Sett,

"A restrictor is now fitted into the refuel pipe for No 5 tank,"

Just a thought Ed, with the 5 tank under a normal refuel pressure of 50 psi, what would be the back pressure behind this restrictor acting on the 5 tank refuel line along the Stbd rib 1? As you know the 5 tank is always the last to fill when uplifting a large fuel load and to my mind, when the second to last tank is shut off, would there not be a pressure increase or 'pressure spike' down the 5 tank refuel line as a result?

DS

[Mick Smith]

EdSett. Apologies for not responding sooner.

Mick Smith, I urge you or your colleagues to pm me whenever you want to write anything in the Timesonline about anything technical on this aircraft. Helgar is clearly concerned about what has been written. This is yet another needless discussion.

Thanks for the offer. I took the issues to the MoD three days before the article appeared and was told they couldnt answer them in detail because of the independent inquiry. Your comments would have no doubt informed the article. BUT...

I was reporting what the QinetiQ engineers said was the case and it isnt a needless discussion. It's a very important discussion, not least because the QinetiQ engineers who wrote the report saw it as so important that they said the following recommendation needed to be carried through before the aircraft was ALARP:

Further consideration should be given to the AAR procedures to ensure that tank 5 does not suffer from over-pressurisation, including reinstatement of the tank 5 over pressurisation warning

I now look forward to the flow rate explanation. For the record, the QinetiQ engineers said:

FRS Couplings. It is noted that the maximum permissible flow rate for type /N is 1,052.7 kg/min. Flow rates during AAR have been measured at 2,100 kg/min. It is therefore recommended that assurance is sought that FRS couplings are suitable for use in the Nimrod fuel system for the purpose of AAR given that measured flow rates have been seen at approximately double the qualified flow rates of the FRS coupling.

They also said:

There no longer exists an in-depth knowledge of working on the Nimrod aircraft within NLS and it is not unusual for tradesmen when faced with something that they have never undertaken before to seek advice and support from other areas at Kinloss, FSS are able to provide support but NLS also seek help from FRA on an unofficial 'old boy' approach.

and

Human errors are more likely to occur where experience and manning levels are low. The combination of these factors creates additional tensions and uncertainties. At Kinloss there have been examples of poor practice or human errors occurring which might otherwise have been avoided.

I should stress having re-read my post that the last two quotes are not meant to be a snipe at you, your comments are always useful, only reinforcing the point that, along with the overstatement of the state of risk involved with the fuel system, this was not exactly the ringing endorsement Des Browne painted it as.

[Edited to add final paragraph]

[shona beattie]

Just received the qinetiq report, unfortunately it does not give me the reassurance I was looking for. If this is what Des Browne calls safe, I wonder if I have received the wrong report?

[Da4orce]

It's no consolation I know but if media reports are correct it appears that our current Defence Secretary's days are numbered.

http://www.pprune.org/forums/showthread.php?t=322895