Nimrod crash in Afghanistan Tech/Info/Discussion (NOT condolences)

[MightyHunter AGE]

Beagle quoted:
Although 8 experienced maintenance technicians (not 'engineers')

I am an Engineer according to all my qualifications and my 22 years of experience.

It doesn't say Aeronautical Technician on my certificates it says Engineer and my IEng (Incorporated Engineer) status does not actually say ITech so thank you for degrading my job.

I am in now way degrading what an Air Engineer does but I would argue that I am more of an engineer that a flight 'systems monitor/operator'.

[EdSet100]

Hi DV:

Following the XV227 incident the SCP was brought back into operation by RTI/NIMROD/119, dated 26th April 05, and was back to its "significant hazard" status at the time of XV230's accident.

Presumably you are quoting the QinetiQ zonal hazard assessment of the fuel system. If that assessment is correct, we can only conclude that, since the day that the MR2 entered service, every time the SCP was switched on the aircraft and the crew were at significant risk of a fire. The SCP was installed before the AAR system, so the BAe designers had a clean sheet to work on. Are you suggesting that BAe designed a dangerous aircraft for the RAF to fly?

Ed

[davejb]

Okay -
some of the ground crew are engineers, I would be surprised if the majority were not technicians. Some of the air engineers might well be airborne systems monitoring personnel, some will be engineers - and I doubt any of the former are indifferent to becoming part of the latter. (I'm not an engineer, nor an ex-engineer, but I haven't specifically forbidden my daughter to marry one - although the uglier ones should of course be avoided to prevent undue regression at the attractiveness level. Pilots are another matter).

I doubt Beagle intended offence...he was closer to actuality than the first definition....

All I recall of MR2 conversion on the SCP is a brief mention that it provided extra cooling for all this new kit - that was probably the Janet and John version for the back end lot. I was i/c teapots on alternate tuesdays at the time. I never had a scoobies that this was actually a potential ignition source, was ANYONE briefed during MR1 to MR2 conversion that this addition would probably work best without inflammable materials/liquids in close proximity? I'm completely unaware of any suggestion 20+ years ago that this wouldn't be used in flight - my impression is that this is simply an assumption made by BAe, one they had no reason to make.

Ultimately that would then, in my opinion, make them responsible for the inability, at least, for anyone at Sqn level to join the dots and question the safety of the AAR system when that got plumbed in. Anyone who has seen a few AAR evolutions has probably seen fuel blowing all over the shop - it's only dangerous if you have an ignition source. Neither I, not those I flew with - to my knowledge - were aware of the ignition source being introduced with the MR2.

Dave

(This is also why I believe, TD, that the blame doesn't lie with current or past aircrew - you can only base your decisions on what you've been told and the documentation for the aircraft. It is those who DID have the information, but failed to pass it on or correctly interpret it, that I believe accountable).

[tucumseh]

Davejb

you can only base your decisions on what you've been told and the documentation for the aircraft. It is those who DID have the information, but failed to pass it on or correctly interpret it, that I believe accountable.

This is absolutely correct, and goes to the heart of the issue; with one caveat – the application of engineering judgement, knowledge and good practice; all of which feature heavily in MoD rules covering decision making and delegation of authority.

The trouble is, of course, when someone declares he doesn’t need engineers in posts requiring daily engineering decisions affecting safety and airworthiness, and he’s getting rid of a vast proportion of them from the very department you, at the front line, depend on for continuity and support. I speak, of course, of CDP’s lunatic decision in 1996.

His ruling is a matter of record – I disagree with it. The safety risks were advised and they have come to pass. However, don’t think I’ve got a downer on just one man. This decision was just one of a long line of anti-engineer policies introduced in the 90s, commencing some years before when RAF suppliers at Harrogate were given control of support funding and permitted, nay encouraged, to over-rule engineering decisions to the detriment of flight safety. The first thing they did was slash funding to maintain the build standard (which includes maintaining safety). Their 2 Star threatened dismissal for those engineers who complained. In fact, at one point a ruling was made that ANY admin grade was senior to ANY engineer. A young lady supply manager about 3 grades below me was appointed as my line manager! That lasted about a week (much to her relief), but illustrates the mentality.

Having correct and up to date documentation (APs for example) is an important part of Maintaining the Build Standard, and hence airworthiness. A point I think I may have made before (which absolutely no-one comments on). I’ve demonstrated that knowing the current build standard is a mandated requirement (as it must be detailed in the Hazard Log), yet broad MoD practice is NOT to maintain it. What process, procedures and regulations cover this? Are they implemented properly? No – that is the reason why the Government has accepted liability.

Finally, I never criticise BAeS on this thread. On the face of it, there have been lapses, but you must always remember two things;

• The design is Under Ministry Control (UMC). Read the Def Stan.
• It is therefore the responsibility (duty) of MoD to ensure their appointed Aircraft Design Authority, and all vendor DAs and DCs, are under continuous contract in accordance with the Def Stan. Ant break or reduction in level of cover almost automatically breaks the airworthiness audit trail.

And, preferably, the ADA must have a degree of contractual control over the actions of all other DAs/DCs – including Service DAs who design and embody Service Engineered Mods. This procedure is also laid down in a Def Stan (which at a rough guess about 4 people in MoD could quote).

So, I hesitate to point the finger until I know the answers to these questions. Perhaps Des Browne was briefed properly for a change, and the key is in his admission?

[Wasser]

JFZ90

For offshore platforms, companies normally work to an Individual Risk criteria of one fatality in a thousand years. Risks greater than this have to be evaluated and measures taken to reduce the risk to ALARP.

Workers are grouped by their exposure to risk averaged over a year. Individual Risk figures are then derived from, amongst other criteria, a hazard anaylsis of the work area and number of people in that area.

However as a result of the Texas City Refinery incident, which killed 15 and injured over 100 people, BP were fined by an american court for this method of calculating Individual Risk. Those killed had been in or around temporary accommodation, located close to process plant. The Judge ruled that the Individual Risk should have been calculated on the risk to those in the temporary accommodation at that time and not averaged over one year. I assume by this he meant that had the risk had been calculated by this method, the risk would have been above the acceptable limit and measures would have been taken to reduce the risk, ie move the temporary accommodation away from the hazardous plant.

Findings from the enquiry into the incident can be found here and have lessons for all.

http://business.timesonline.co.uk/to...cle1545068.ece

Because of better platform safety design, one of the greatest contributers to Individual Risks to offshore workers is now helicopter transport, which is why the wearing of survival suits, rebreather sets, PLBs when travelling offshore are mandatory by most companies.

Regards the engineers/technician debate, surely it’s the ability of the individual to perform their role that’s important? As a Chief Technician at Kinloss, I saw the best and worst of Engineers - an ex‑technician converted to an Engineer (how can that happen) on NAEDIT who looked after his technicians and backed them to the hilt when right, apossed to a highly qualified Engineer at NLS who didn’t have a clue about man-management and whose decision making policy was to say “yes” to those above, regardless of the situation .

[JFZ90]

Wasser - interesting. I guess its possible that the "over a year" / "instantaneous" risk calculation issue was really a weak defence by BP for their culpability. By this I mean it would have been quite easy for the judge to show that the BP risk was not ALARP even on a "average yearly" basis - just moving the accommodation block (relatively low cost) had a significant impact on safety (15 confirmed killed, but upto say 100/200 people not exposed to a clear potentially lethal risk during an incident at the refinery).

--------

I wasn't going to enter the engineer / technician debate, but the quote below is perhaps a bit misleading as to what an engineer really is....

All RAF maintenance personnel are engineering technicians and mechanics and know their jobs and are not afraid get their hands dirty. There are too many who call themselves 'engineers' who don't know one of a spanner from the other. These experts are usually engineering managers or so far away from the front line that they have little or no knowledge for which they are responsible. Please be careful not to put down the few professionals we do have.

I do not, in any way, denigrate the dying breed of Air Engineers who are expert and professional system operators.

An Engineer.

'engineers' who don't know one of a spanner from the other.

As far as I'm concerned, if you know how to design a spanner, make it the right dimensions to cope with the stresses it will be subject to without overengineering it, and are able to develop the processes and systems to manufacture the spanner safely, set & test it meets quality criteria, and do the whole thing cost effectively on a large scale with consideration of environmental & political impacts of your enterprise, then you are an engineer, usually with a professional CEng qualification. Such an engineer may have started his/her career as a technician.

If you can do up / loosen nuts with a spanner against a set of laid down procedures (i.e. to a specified torque) but couldn't do all of the above, you are not an engineer, but probably a technician.

I appreciate there are both types in the RAF, but the discrimination above applies to all engineers / technicians and to those who have bothered to acquire the broader set of skills/experience is quite important.

I can use plasters & take pills, but I wouldn't call myself a doctor or a nurse, so technicians shouldn't really call themselves engineers for the same reasons.

[Da4orce]

Edset

Hi DV:
Quote:
Following the XV227 incident the SCP was brought back into operation by RTI/NIMROD/119, dated 26th April 05, and was back to its "significant hazard" status at the time of XV230's accident.

Presumably you are quoting the QinetiQ zonal hazard assessment of the fuel system. If that assessment is correct, we can only conclude that, since the day that the MR2 entered service, every time the SCP was switched on the aircraft and the crew were at significant risk of a fire. The SCP was installed before the AAR system, so the BAe designers had a clean sheet to work on. Are you suggesting that BAe designed a dangerous aircraft for the RAF to fly?

Ed

Refering to para 40 of the BoI report:

The Board concludes that the formal incorporation of AAR capability within the Nimrod did not identify the full implications of successive changes to the fuel system and was a possible Contributory Factor in the loss of XV230.

[JFZ90]

Well I have always called myself an Engineer and im a technician. My insurance company calls me an aircraft engineer too.Im not airborne but ground but nobody knows the difference except us. I have learned Maths Engineering Science , Physics , Chemistry, Design etc you name it and that is part of technician training. Even the aircrew ask for the engineers :/

So dunno where this debate got off track , does it really matter anyway

It is quite possible that technicians are trained to a level in the RAF where they approach "engineer" levels of skill & experience. This is quite possible in some if not all areas of engineering and this may blur the definitions. For me it really hinges on whether, given your training, you feel able to tackle the list of activities confidently in my first list above. In this respect, the originator of this somewhat tangential debate who sort of said "I know how to use a spanner so I'm an engineer" may actually have been selling his own skills a bit short.

Does it matter? Some think so, certainly other countries (such as France) think it does where an engineer has the same social standing (and pay) as a doctor. It seems to matter less to people (including many engineers) in the UK - where public perception means the UKs best known "engineer" is not Brunel but "Kevin from Coronation Street" (clearly a mechanic/technician, not an engineer).

Another way to look at is to ask - do you think Kwikfit fitters should call themselves engineers?

[JFZ90]

Edset

Quote:
Hi DV:
Quote:
Following the XV227 incident the SCP was brought back into operation by RTI/NIMROD/119, dated 26th April 05, and was back to its "significant hazard" status at the time of XV230's accident.

Presumably you are quoting the QinetiQ zonal hazard assessment of the fuel system. If that assessment is correct, we can only conclude that, since the day that the MR2 entered service, every time the SCP was switched on the aircraft and the crew were at significant risk of a fire. The SCP was installed before the AAR system, so the BAe designers had a clean sheet to work on. Are you suggesting that BAe designed a dangerous aircraft for the RAF to fly?

Ed
Refering to para 40 of the BoI report:

Quote:
The Board concludes that the formal incorporation of AAR capability within the Nimrod did not identify the full implications of successive changes to the fuel system and was a possible Contributory Factor in the loss of XV230.

As I understand it the SCP was added to the Nimrod build standard first - and fully certified - with the AAR being added later. In this respect you would expect the safety implications of the changes to be assessed as they were introduced. You would not expect the SCP change "team" or process to assess the safety implications of the yet to be fitted AAR system. Hence it is possible (and from what I can see true) that the SCP system was "safely" incorporated into the design.

The AAR change, as per your BoI quote, appears not to have been however. Without the facts and understanding the design process adopted it is not possible to say what went wrong where, but you might have expected the reviews of the AAR design as it progressed to have looked at the potential impact of the AAR system on the rest of the aircraft. Many features of the design suggest that safety, in terms of the AAR system itself, its integration into the fuel system and into the aircraft as a whole was indeed considered to a large extent. What appears to have been missed is the impact of the venting of fuel from one of the tanks. You would have expected the team/process to have asked "are there any safety / hazards associated with venting fuel from the forward tank". Without the facts it is impossible to say whether this question was asked or answered, but it maybe the case that the team/process did ask the question but did not consider the possibility of fuel streaming down the fuselage, re-entering the aircraft and pooling in areas of the fuselage. In hindsight it is easy to say this risk should have been considered and analysed fully, but I think it is plausible that they may have (erroneously) assumed that the fuel would harmlessly stream out and away from the aircraft and discharge the risk. I think I read somewhere that they did consider the risk of fuel entering intakes & vents downstream of the tank vent, so the risks of fuel venting were not ignored.

From what I've gathered in the BoI, and again without the benefit of the full picture, this seems probably the most important safety/design process failure that contributed to the loss of 230. Whilst it is true that the subsequent safety case should also have flagged up this risk, it is perhaps not surprising that if it was missed (i.e. erroneously assumed innocent) in the first place the same assumptions would be made again during the hazard analysis / safety case refresh.

It is perhaps important to recognise that this design / analysis error, once it had been made, would not necessarily be picked up by any of the remaining airworthiness activities and certification. The alledged lapses in airworthiness build standard maintenance, resource issues and other shortcomings oft discussed here would also have no bearing on this design error, once embodied in all aircraft. It is probably likely that tighter integration between the user and the safety case process may have increased the chances of it being picked up in the later review, but I'm not sure any MoD regulations were "broken" as such during the latter safety case process in this respect - this could be an interesting area and certainly a key area for learning lessons.

I'd be interested to know whether any fuel system / aerospace engineers feel that the "fuel re-entering hazard" should have definately been picked up in the first place or whether this is a relatively "new" risk that surprised the fuel system engineering community.

Did users know it was happening, or did they assume the pooling was from a some pipe "leak" somewhere in the aircraft that only manifested itself in flight, and hence was not repeatable on the ground?

[OmegaV6]

JFZ ... an excellent post IMHO.

May I also add the following view - AAR for the Hercules, and I believe for the Nimrod, was bought in at an exceedingly rapid rate in response to the requirements of the Falklands War. It worked. It worked so well it was continued AFTER the war.

Is it not possible, even probable, that many of these Safety Case/Design Studies etc etc, were simply not done due to the pressures of the time ??

When things were "tidied up" after the war, and became much more a "permanent fixture" .. I wonder how many times it was "assumed" that things had been checked the first time around, when in fact they had not ??

Everything I read in this thread seems to indicate that folks believe the introduction of AAR was done in a long slow and researched process - I don't believe that to be the case.

[davejb]

AAR on the Nimrod MR2 was a very rapid affair, that went from zero to fitted within the period of the Falklands conflict itself.

[Da4orce]

Did users know it was happening, or did they assume the pooling was from a some pipe "leak" somewhere in the aircraft that only manifested itself in flight, and hence was not repeatable on the ground?

I doubt that the data is out there given that it wasn't being looked for but it would be interesting to see whether analysis of historic leaks would provide evidence of the scenario that you describe, given what is now known about the risk of vented fuel entering the fuselage.

Such analysis, if it were possible, may provide a much clearer picture of the level of risk in relation to vented fuel entering the fuselage.

[JFZ90]

There have been a number of discussions on Nimrod threads as to whether the AAR fit was done in a rush, and how it was later 'properly' engineered post the Falklands.

Whilst it is possible that "the mod was rushed" maybe a factor, it is also possible that this had no bearing on the risk being erroneously discharged - it seems clear to me that a lot of systems and safety thinking is evident in the AAR design, so its not as if "safety considerations went out of the window" during its incorporation.

It seems plausible that team/process did ask the question but did not consider the possibility of fuel streaming down the fuselage, re-entering the aircraft and pooling in areas of the fuselage - it seems plausible that this would have been missed whether the mod was rushed or not.

I have no experience of aircraft fuel systems or AAR, but have to say I can certainly see how, in a design review, the "fuel re-entry risk" could either not get raised or be discharged as a remote/improbable or only pertaining to miniscule quantities of fuel re-entering and therefore not needing to be analysed further etc. Does this make the engineers involved incompetent or careless? As I could see myself making such assumptions & discharging this risk, I'd say not necessarily. But then again, I'm no fuel systems / AAR engineer, so it'd been interesting to see what others may think of the "obviousness" of this risk. I don't recall it occurring to anyone else here during the pre BoI speculation which suggests it is perhaps not that obvious a hazard.

[EdSet100]

I said (post #439):

The SCP was definitely a significant hazard to the aircraft and crew in the years leading up to 2004, as demonstrated by the incident on XV227. Thereafter, it was made safe. It still is today.

On reflection, bearing in mind the routing of the crossfeed duct, which is necessarliy open to supply air (at up to 500C, 250psi) to the SCP, I now believe that the aircraft is at considerable risk whenever the SCP is operated with the engines at or above cruise power. This effectively makes the system either useless or dangerous, by design, IMHO.

Furthermore, and far more importantly, whenever the crossfeed duct is open at or above engine cruise power, the aircraft and those on board, are at risk due to possible leakage from nearby fuel or hydraulic pipes. This is why we now have procedures prohibiting us from opening the duct above 80% (air and ground use).

This is basic stuff and should have been identified when the MR1 and R1 aircraft were built, tested (Jimmy Jones) and released into service.

Bottom line: while the SCP system might be safe, as a standalone system, it cannot be used due to the unsafe nature of the crossfeed pipe, when open, in most circumstances.

Ed

PS. While the maritime Nimrod force has been castigated by other operators for many years for flying around with serviceable engines shut down to save fuel, it is now apparent that we were at a greater risk of a fuel/hydraulic fire than we ever were of a loss of thrust. It was only because the engines were shut down that the crossfeed duct was open in flight. Truly ironic.

[Tappers Dad]

davejb

http://www.airsceneuk.org.uk/oldstuf.../falklands.htm


British Aerospace's (BAe) Manchester Division received instructions to design and fit probes to the Nimrod fleet on 14 April (1982 )and Marshall Aerospace of Cambridge received similar instructions in respect of the Hercules the next day. The probes were taken from RAF stocks, being mostly removed from de-commissioned Vulcans, plus some new ones intended for the VC10 tankers that were then under construction. The Nimrod probing programme exemplifies the collapsing of development schedules, BAe Woodford taking just a fortnight to complete the initial installation, thereby enabling the first 'wet' prod to be made on 30 April. The second aircraft with machine-produced parts was rolled out only two days later and service clearance for the kit was obtained on 5 May. An initial batch of sixteen aircraft was modified and designated Nimrod MR Mk2P (for probe). To compensate for the effect of the probe on its handling characteristics a small ventral fin was added beneath the tail along with small finlets that are often mistaken for radio aerials above and below the tailplanes.

[davejb]

TD,
thanks - I was just answering the earlier query... I was on MR2 at the start of the conflict, sans probe, and managed to be back on Ascension before the end on MR2P with probe, for once my fading mental faculties were happy the memory was correct.

Dave

[JFZ90]

On reflection, bearing in mind the routing of the crossfeed duct, which is necessarliy open to supply air (at up to 500C, 250psi) to the SCP, I now believe that the aircraft is at considerable risk whenever the SCP is operated with the engines at or above cruise power. This effectively makes the system either useless or dangerous, by design, IMHO.

Furthermore, and far more importantly, whenever the crossfeed duct is open at or above engine cruise power, the aircraft and those on board, are at risk due to possible leakage from nearby fuel or hydraulic pipes. This is why we now have procedures prohibiting us from opening the duct above 80% (air and ground use).

This is basic stuff and should have been identified when the MR1 and R1 aircraft were built, tested (Jimmy Jones) and released into service.

Bottom line: while the SCP system might be safe, as a standalone system, it cannot be used due to the unsafe nature of the crossfeed pipe, when open, in most circumstances.

Ed

PS. While the maritime Nimrod force has been castigated by other operators for many years for flying around with serviceable engines shut down to save fuel, it is now apparent that we were at a greater risk of a fuel/hydraulic fire than we ever were of a loss of thrust. It was only because the engines were shut down that the crossfeed duct was open in flight. Truly ironic.

Interesting. I take back my initial assumption that the SCP design when embodied was safe. It appears that while not perhaps overtly unsafe, some features of its implementation/operation did include some significant potential safety shortcomings/risks from day 1 that should at least have been recognised.

While I can sympathise with the design team missing the "AAR venting fuel & it re-entering the fuselage" risk, the crossfeed pipe (at 400C) being near a potential (if probably remote) source of a fuel leak is a fairly fundamental risk that probably deserved some tangible mitigation in the first place, irrespective of AAR.

[tucumseh]

Quote:

Bottom line: while the SCP system might be safe, as a standalone system, it cannot be used due to the unsafe nature of the crossfeed pipe, when open, in most circumstances.

Ed


Interesting. I take back my initial assumption that the SCP design when embodied was safe. It appears that while not perhaps overtly unsafe, some features of its implementation/operation did include some significant potential safety shortcomings/risks from day 1 that should at least have been recognised.

Two good posts. Well said. What we're talking about here is, in essence, the difference between Physical and Functional Safety, a basic component of Systems Engineering.

As I've said before, I didn't agree with my 2* (x2) and 4* ruling that the latter was optional. And I don't believe successive Mins(AF) should have been advised to uphold the rulings.

It is one thing to inadvertently miss something like this in a complex system design - but quite a different thing altogether to make a deliberate decision to leave a design functionally unsafe and teach staff (and industry) that it's ok and they will be rewarded for doing so.

So, when the QC looks into the FACT that airworthiness regs weren't implemented properly, I hope he starts at this level of "management", as their rulings set the tone. All too often these things start at the bottom and come to a sudden halt when a scapegoat can be found.

[Da4orce]

Independent article from Sunday 4th May:

Army chiefs 'ignored warnings' spy plane was unsafe to fly...

The Ministry of Defence is bracing itself for what is set to be the most damaging allegations so far over failure to provide service personnel in Iraq and Afghanistan with adequate equipment. An inquest this week into 14 men who died when an ageing Nimrod spy plane exploded in mid-air in 2006 will hear evidence that the MoD ignored repeated warnings from RAF pilots and ground crew that the planes were unsafe to fly.

[airsound]

Nimrod Review Website....

....is finally up and running.

http://www.nimrod-review.org.uk/index.htm

Interesting terms of reference.

I understand the Review will be represented at the Inquest, which starts Tuesday 6 May with a visit to Brize Norton for families, and formally in Oxford on Wednesday 7 May.

airsound