Nimrod crash in Afghanistan Tech/Info/Discussion (NOT condolences)

[JFZ90]

With the suspension of AAR and taking out of use the SCP it's likely that the MK2 is now ALARP and is therefore airworthy

...leading to...

I am afraid this is not the case. These restrictions were already in place when the coroner gave his verdict, and when Gp Capt Hickman confirmed that the aircraft was not ALARP.

The question is, is the risk tolerable, and hence is it reasonable to fly the aircraft until the full recs are practically embodied in due course. Assuming that it is (as it is flying), it would seem that the Gp Capt was either taken out of context or has got his message a bit confused.

If you can give an Airbus 2+ years to embody known ALARP risk measures with respect to Fuel Tank Explosions, why should such a timeline not reasonably apply to the Nimrod in this case? The risks maybe different, but the principle is surely the same?

Nige - whilst I can see much merit in your Fuel Tank Inerting campaign, I think its really a different issue* to the basic airworthiness debate - a whole load of civil aircraft won't have inerting for many many years, if ever.

* Whether any RAF aircraft without fuel tank inerting should be expected to operate at low level (inc take off / landing) in a threat environment in which inerting could help mitigate is a different issue - I concur there is a very valid argument that says they should not.

[Nimman]

nigegilb

Ref your post at #1129 and remarks made. I think you do a disservice to the tradesmen employed by FRA at the NSG. I wouldn't equate them to the workshops that you have managed without yourself having some first hand experience of their method of operation.
Probably 99% are ex military aircraft technicians with the vast majority being ex RAF NCOs/SNCOs with most of those having a lot of experience on Nimrod aircraft. Certainly I would say more corporate knowledge about Nimrod engineering and maintenance problems and how to solve them than that of the current RAF workforce at ISK.

[nigegilb]

JFZ I agree it is a different issue, I got involved in Nimrod because I had some mates flying the Jet who were very unhappy with the events surrounding the accident and also because I believed all along that the aircraft had suffered a fuel tank explosion.

The point about talking about fuel tank protection in airliners is that they never have to go to war and yet Mr Boeing has decided to fit inerting systems to its latest airliners anyway. As you point out Nimrods flying in theatre are at risk from being shot at but XV230 was brought down specifically because of AAR, another discipline not followed outside of the military. AT aircraft self-protection is now receiving more attention but MRA4 has slipped through the net.

My main concerns are that two large aircraft have crashed with the loss of 24 lives and many issues are shared. Tuc believed they read across to other recent accidents as well. We are really talking about aircraft being airworthy but also fit for purpose. Fit to go to war. MRA4 will not be which suggests the MoD is not learning any lessons here.

I do not agree with your conclusions about the Airbus mod. Specifically, "Qinetiq says [of Nimrod],it’s tolerably safe, but not yet ALARP. Doesn’t make sense. While QQ said the aircraft was “tolerably safe” the application should be the risk(s) were tolerable. This still ignores the fact that if the risk is in the tolerable region, and the severity of harm is catastrophic (loss of aircraft/death) then the risk MUST be reduced to ALARP. Nor does it address cumulative risks. I maintain QQ report must have been altered as it more or less ignores the serious airworthiness failures reported in March 2006."

With regard to Airbus can you please state your reference to the severity of harm concerning the AD? And what is the level of risk? And where is the reference to ALARP? Forgive me if it is in your link but I didn't see it.

Remember other measures have already been implemented.

Edited to add, Nimman, I am referring to the QQ report in places, will post up a passage for you to comment when I get time. I also received this- my beef is with the higher ups BTW.

"Attached to the PPRUNE thread is a link to DEF STAN 05-130. This standard is very similar to that of an EASA 145 MRO. Going through the PPRUNE thread alone, if only half of it is true than the organisation / operation would have been shut down months (or years) ago. This is not a slur on the ground or aircrews, but on higher up the food chain.

The DEF STAN 05-130 is the equivalent of a civil aircraft maintenance facilities JAR 145, the European standard for aircraft maintenance, picking up from what used to be the CAA. The DEF STAN 05-130 does cover training, human factors etc and my concern is that the RAF is now falling way short of these standards, in particular on the Nimrod fleet.

MPI are a recruitment company http://www.mpi.ltd.uk/home.asp : my concern here is that the rate offered will not attract the capable and qualified staff that are so obviously needed. They are subbies, with none of the perks that a permanent employee would have. Moto "why do today what can be on overtime tomorrow."

MPI are trying to place more engineers' under contract to work both the line and hangars. If they get some qualified guys then that will help, but, at the rates offered I worry. Currently Subbies would look at the £14:50 per hour, inclusive of B and B. Latest jobs link, http://www.mpi.ltd.uk/viewVacancies.asp?jobCode=X9L6D2&mode=details"

Nimman don't wish to slur anyone, but can you comment on the ability to recruit at those rates? Assume many come in with a pension. Just wondered how the pay compares. PM me if you want a copy of QQ Report Regards,

Nige

[Chugalug2]

He proceeded to 'order' me to fit the bolt to which I said 'charge me for disobeying an order. I am not putting my signature or sending an aircraft flying with that fitted as that bolt is not fit to be fitted to an aircraft and I am advising you not to do so'......
I was then confronted by an non-Nimrod Engo from the base and told in no uncertain terms to ignore the UTI as it had a window of 28 days to be carried out (this in itself was wrong as a UTI only has 7 days validity) and I was to ignore the fact that the pipe was leaking until then!!!!!!!!!!!

MH AGE, thank you for showing us that every one involved in aviation, civilian or military, AC2 to ACM, has the final responsibility to do what is right and to refuse to do what is wrong. From the posts on this thread and others I have a strong suspicion that the wrong has emanated from the higher end of that spectrum. This is a double betrayal at least. The very leaders responsible for maintaining high standards from the past have reneged on their responsibilities rendering a considerable part of the RAF fleet unfit for purpose. They have also compromised others who they command and they in turn attempt to compromise others as MHAGE tells us. This is a rotten system that has to be torn apart root and branch. The first thing to be dismembered from it is Airworthiness Authority. In my view the MOD has shown itself to be fatally compromised and unfit to exercise such responsibility.

[JFZ90]

With regard to Airbus can you please state your reference to the severity of harm concerning the AD? And what is the level of risk? And where is the reference to ALARP? Forgive me if it is in your link but I didn't see it.

As TWA800 exploded due to a fuel tank explosion with the loss of all onboard, you have to conclude that the risks of such an explosion are catastrophic. Other ground based incidents that have happened on (I think) 737s etc. either destroyed the aircraft or took off the wing in a way that would also have led to the loss of the aircraft.

ALARP is a principle. You can deduce how it applies to the Directive I mentioned by thinking about what is behind it. To take an aspect of it, the FAA/CAA/DA etc. have established that the "white clips" carry a greater risk of contributing to wire chaffing and hence possible explosion than "blue clips". The cost of changing these clips during routine servicing is potentially quite low. Hence whilst the risk of chaffing & explosion is probably very very low (as it needs other things to go wrong as in TWA800; the causes can be quite complex), the cost of changing the clips is also quite low - hence it is reasonably practical to undertake this measure. It is by definition therefore an ALARP measure. Should all the affected Airbus/Boeing aircraft be grounded until the clips are changed - in an ideal world you could say yes, as until its done the aircraft risks are not technically ALARP. You could also argue this would be an unreasonable, impractical approach to take, given the massive loss of revenue it would incur on the airlines for what is a very low risk. You could also argue that ensuring that all the clips are changed within say 2 years is taking an ALARP approach as it is reasonable to include consideration of practical embodiment timelines. When you look at the content of the AD, it is pretty clear I think that the last interpretation is what the CAA have adopted.

Remember other measures have already been implemented.

Same as Nimrod - no more AAR, no more hot pipes. The parallels are interesting, no?

[Distant Voice]

JFZ 90, re your #1142

Yes the risk is tolerable but not ALARP. By definition (MoD standards) it is not safe.

Where do you want to go from here?

DV

[Distant Voice]

Nimrods over Afghanistan

I understand that Nimrods are no longer operational over Afghanistan.

DV

[JFZ90]

JFZ 90, re your #1142

Yes the risk is tolerable but not ALARP. By definition (MoD standards) it is not safe.

Where do you want to go from here?

DV

See #1146. Do you think my Airbus example and applicability of ALARP makes sense? It seems logical, no? If so in what way is the principle different for Nimrod?

[Safety_Helmut]

JFZ, I stand to be corrected, but from what I understand, the ALARP principle in the way you describe it in relation to TWA800 is not right. Large civil aircraft are certified against the numerical objectives as stated in FAR25/CS25. The 1x10e-7 hull loss target, which in turn leads to the 1x10e-9 target for critical systems. This is stated in requirement 25.1309 and the Acceptable Means of Compliance (AMC) expands this, see CS AMC25.1309. You can download CS25 from EASA for free. ALARP is not mentioned in the context of certifying an aircraft of this type, you achieve the target or you don't get certification. The ALARP principle is really encapsulated in the target itself, this is based on the historical hull loss rate with a precuationary factor built in.

As I am sure you are aware, ALARP is a principle based in UK case law from 1947, and results from a case involving the coal mining industry. There are variations on this theme, eg AFARP.

S_H

[Safety_Helmut]

As TWA800 exploded due to a fuel tank explosion with the loss of all onboard, you have to conclude that the risks of such an explosion are catastrophic.

I'm going to be pedantic here. In the safety context, risk is not catastrophic. Risk is the product of severity or consequence and probability or likelihood. Therefore, catastrophic is a description of the consequence.

S_H

[JFZ90]

Safety Helmut,

You're right on both counts.

1. As you say, the civil rules have no latitude for ALARP per se, and only work to absolute safety target. But, it raises the supplementary question - what do you conclude from the AD, either:

a) an airbus with white clips doesn't meet the 10-7 hull loss safety targets, or
b) an airbus with white clips meets the 10-7 target anyway, but they are doing it to reduce the risk lower still

If a), then by rights it shouldn't be certified.
If b), then to be flippant why are they bothering as it already meets the targets?

Can you find out which it is?
b) seems more likely to me, and it has the hallmarks of an ALARP based judgement by the CAA as to whether to enforce it on airlines.

2. The risk is not catastrophic, the severity / consequence of the risk is. I was going to apologise, but on reflection that is quite pedantic - you clearly work in the safety field (the right character to have of course)!

[nigegilb]

I would like to set up a link to the QQ Report, I will place it on pprune. There are so many more than 30 issues, a close read of the report will confirm that. I also think the fine people of RAF Kinloss should have open access to the report.

Much distraction on this thread, hopefully a read of the report will dispel a few myths.

Bear with my computer skills.

[Safety_Helmut]

JFZ, it would certainly be interesting to know the answer. But there is obviously a lot more to meeting the standards. One of the requirements is for no SPOF that could lead to catastrophic hull loss, I wonder if this helped drive the AD ?

This is one of those subjects where the misuse of terminology causes confusion and misunderstanding, especially amongst the ill informed. You've only got to read through this thread to see that.

S_H

[nigegilb]

As promised link to QQ Report incl instructions from my IT experts.

The download link is: http://sharebee.com/cea1f5a6

Filename: QQ Fuel Leak Study 170306.pdf Size: 5.56 MB


When you access the basic link, it gives you a choice of which host to use (Megaupload, badongo etc). Click one of them. The megaupload then asks you to type a 3 letter combination - this is a simple security device to defeat automated systems. Then you click the link provided - on Megaupload you click "free download", wait a short period and your browser download window appears giving you the option to open or download the file.

[Mad (Flt) Scientist]

Originally Posted by JFZ90

1. As you say, the civil rules have no latitude for ALARP per se, and only work to absolute safety target. But, it raises the supplementary question - what do you conclude from the AD, either:

a) an airbus with white clips doesn't meet the 10-7 hull loss safety targets, or
b) an airbus with white clips meets the 10-7 target anyway, but they are doing it to reduce the risk lower still

If a), then by rights it shouldn't be certified.
If b), then to be flippant why are they bothering as it already meets the targets?

Can you find out which it is?
b) seems more likely to me, and it has the hallmarks of an ALARP based judgement by the CAA as to whether to enforce it on airlines.

SFAR88, which is the US additional rules relating to risks of fuel tank explosions are a very special case for continuing airworthiness. The risk criteria used in determining actions taken to comply with SFAR88 are very much more stringent than for almost any other hazard type - in effect, the FAA said "no more exploding fuel tanks". The 'classical' 10e-9 etc probability criteria have been abandoned for that specific case. The likelihood is that most, if not all, fuel systems met the standard 25.1309 requirements for hazards before the SFAR came out.

However, as a general comment, the rules of 25.1309 (and equivalent regs in other jurisdictions) apply as an absolute only at the instant of type certification. If an issue is found in-service, you are generally permitted to accept an increased risk during the rectification period - and JAR.39 and the associated ACJ 39.3(b)(4) give a mathematical means to arrive at the level of risk which can be accepted for any given period of time - basically, the more you breach the 25.1309 requirements, the less time you have to get things fixed. Once you get a couple of orders of magnitude worse than the requirement, you usually end up being grounded, or taking other action to entirely eliminate the risk (operational restrictions, for example)

The following is taken from the ACJ

3.8 Thus a 'reaction table' can be created as indicated in Table 1 (the last two columns assuming a typical aircraft design life of 60,000 hours and an annual utilisation of 3000 hours per annum) showing the flying or calendar time within which a defect must be corrected if the suggested targets are to be met.

Table 1

Column 1: Estimated catastrophe rate to aircraft due to the defect under consideration (per a/c hour)
Column 2: Necessary reaction time for each aircraft at risk (hours)
Column3: On a calendar basis

4 x 10e-8 3750 15 months
5 x 10e-8 3000 12 months
1 x 10e-7 1500 6 months
2 x 10e-7 750 3 months
5 x 10e-7 300 6 weeks
1 x 10e-6 150 3 weeks
1 x 10e-5 15 Return to base

apologies for the poor formatting

Therefore an AD with a 2 year compliance period implies that the probability of a catastrophic hazard arising from the item being addressed in the AD is about 2.5*10e-8

[nigegilb]

I am rather impressed by some of the contributions to this thread.

[JFZ90]

Very interesting Mad Scientist. Now I must state upfront I don't know any details here but the interesting thing you could read into the white clip/blue clip AD is that they don't seem to be targetting any specific wires that may chaff and short circuit (e.g. allowing high [spark capable] voltages into low [not spark capable] voltage fuel tank wiring) - so the level of precision for specific failure modes doesn't appear to be behind the analysis. It reads to me like "it might make it safer, its cheap to do, so we should do it" - I think this logic is still sound by the way, but I can't reconcile it with specific numbers.

----

Nige, I've had a flick through the Fuel Report. I'm not sure which bits are particiularly contentious? It reads like a audit to look at some issues with leaks & possible maintenance procedure issues and highlights some aspects that need addressing and some shortfalls in some areas. It does however state:

Notwithstanding all of these difficulties, the repairs achieved by RAMS on XV250 were observed to be of a high standard. The work undertaken on that aircraft was far beyond the usual expectation and encompassed the comprehensive renewal of the fasteners and sealants at the port side rib 7 joint.

This reads quite postively to me - its not the "shut them down its 'Airworks + Tornado F3s' all over again" criticism that I was expecting on opening it.

Also the whole alu / steel bolt issue is not quite as I'd been led to believe by some posts on this thread. It reads as if the alu bolt is not used anymore and the steel bolt is a design approved replacement. QQ speculate about the consequences of its different material properties and what might happen if higher torques where used - but its all conjecture that maybe worth further investigation as I read it - not a criticism per se. I may have missed it but I can't see any statement from the DA that these bolts can't infact be mixed - this was implied by the "engine block" analogy earlier on in this thread.

[nigegilb]

"This reads quite positive to me."

JFZ, don't really know how to say this, but are we reading the same report? It might not be all doom and gloom but I have a marked up version of the report and it appears that you are clutching at positive comment but ignoring the rest. Check out the last page?

My marked up version of the report has;

* 50+ separate references to failures to apply/implement
airworthiness processes, procedures or regulations (which is what
this is all about, because 18 months later the BoI report admitted
such failures, in turn leading to Browne's acceptance of
liability) and,

* a further 20+ references to possible failures and mentions of
issues which the report doesn't explore. (And nobody except DV
discusses any follow-up action and the other reports which are not
available).

Please read the assessment below.



Some of these references are duplicated, but one could view this as emphasis! In short, this is a very damming report and yet has clearly been diluted by QQ management to avoid too much overt criticism of their main source of income (MoD). Long experience teaches you to read between the lines - believe me, this report is horrific for what it doesn't reveal.

As for the bolts, the report makes it clear they were approved by the DA, but it is the detailed engineering / design / servicing aspects which are criticised - i.e. the mandated processes to maintain the build standard. Torque settings. Routine hole/thread inspection. Random bolt changes with no advice on proximity of dissimilar bolts. Dissimilar bolt/thread materials. Stress. On the face of it, Form, Fit and Function are affected to varying degrees. This is the main test when determining whether it is a Change or a Modification. (Briefly, a Change is minor, not requiring a formal modification, perhaps just the Topic 3 calling up an alternate bolt - the inference being it is a Form, Fit and Function drop in replacement - which it clearly is NOT due to the need to amend servicing instructions and consider design stresses).

The report asks questions which should have been addressed as part of the task which resulted in the change, and the information should have been disseminated via the mod leaflet, AP amendments etc. Clearly QQ couldn't find this info, which infers Kinloss don't have it. The statement "It was approved by the DA" is a typical front line view - understandable as they MUST rely on this largely invisible support process working, but they are seldom exposed to the detailed machinations of maintaining the BS and few could explain the process.

In recent years this _observation_ applies equally to IPTs, but importantly it becomes a _criticism_ when talking of them. Their lowest technical grade, service or civilian, should understand this process implicitly, and should be very worried about this report. If ANY of their tech grades don't understand all this (the processes, procedures and regs, not the detailed design issues), then by definition they lack experience and expertise which is an airworthiness issue. This is not a criticism of the individuals, but of the system which for years has permitted inexperienced staffs to occupy these posts. Easy for me to say but I HAD to have at least 10 years on the bench and head down in aircraft, plus 2 years in a design office and 2 years in a HQ "Staff" post before I was even considered for the lowest tech grade in what are now IPTs. Now NONE of this is required yet they are still given the same level of approvals I had. THAT is the bit that can no longer be fixed and will always be the main argument for an independent airworthiness authority. Why can't it be fixed? Because the recruitment grounds have been privatised, witnessed by the ex-RAF / DARA staff working for FR etc.


JFZ a number of people have PM'd me since posting the 2006 QQ Report, I am more convinced than ever that there are very big problems with Nimrod IPT.

Regards,

Nige

[JFZ90]

Nige,

I'm not sure you can decide the report is damning or not in isolation. There is not enough information or context, or crucially DA input.

The steel bolt is DA approved, but it is NOT clear whether the DA has stated that they must not be mixed or if that indeed is permitted. QQ only speculate that it maybe an issue and it maybe wrong to jump a conclusion one way or another. To be fair on QQ they were probably not writing the report expecting someone to jump to that conclusion - they are writing it for a technically competent audience and they are highlighting issues for consideration (and future research perhaps!). You would have ask the DA whether it had been considered, or whether infact the steel bolts had been specified or torque settings changed to create an "equivalent" effect to the alu ones (possible despite the different material characteristics).

I agree it does beg the question as to where the DA information on correct installation is - but no conclusion is really reached in the report for me on this point.

My main point is that I was expecting alot worst, and you'd have to conclude that this quote....

Notwithstanding all of these difficulties, the repairs achieved by RAMS on XV250 were observed to be of a high standard. The work undertaken on that aircraft was far beyond the usual expectation and encompassed the comprehensive renewal of the fasteners and sealants at the port side rib 7 joint.

...does imply that the final result was upto scratch? Isn't that the bottom line, despite all the findings (noting a consultant will always come up with lots of findings to justify their not inconsiderable cost!)

[Squidlord]

I am trying to follow the discussion in this thread but really struggling to keep up. It's clear to me (and many others) that there have been very serious failings in safety management for the Nimrod over a number of years. I believe that these failings are to some extent endemic in MoD air safety management in general. Efforts are being made at senior levels within the MoD to address these failings and I believe that we are likely to see the biggest changes in MoD safety management since the Safety Case concept and culture was adopted (in the early-mid 90s, I think). Whether those changes are sufficiently wholescale to seriously improve MoD safety management and satisfy critics is to be seen.

Notwithstanding the above, I don't know whether the Nimrod is currently safe to fly. But I do believe that many of the claims and arguments being made in this thread in support of the view that it is not currently safe to fly are faulty.

First an absolutely key point.

The concept of safety, as defined by MoD policy and regulation (see Def Stan 00-56, POSMS, etc.), depends crucially on how a system or equipment is used and maintained. It makes no sense to talk of a system or equipment being safe (or that the risks associated with that system or equipment are ALARP) without a context of use and maintenance. Thus, statements about whether or not Nimrods are safe to fly (or whether the associated risks are ALARP) should only be made together with a context of use and maintenance that, for example, defines whether or not AAR happens or not. I suspect all of us fall foul of this issue from time to time, even those of us who understand it very well (and I include Qinetiq in this - see below).

Why do I make this point about context? Because people are talking/writing about things (e.g., Nimrods) being "safe" or "unsafe" when it's often unclear what context of use and maintenance is being referred to. I don't know whether the Nimrods should be flying at the moment. I.e., I don't know whether it is safe to fly Nimrods IN THEIR CURRENT CONTEXT OF USE AND MAINTENANCE (note, not how we used to fly them ... not how we hope to fly them in five years time ... but how we are currently flying them).

Those on this thread who say that the Nimrods are not currently safe to fly cite a number of Qinetiq reports; principally this one:

"Nimrod Fuel System Safety Review Report", Oct 2007, Issue 1

This contains the thirty recommendations that are often cited in this thread. In particular, Distant Voice and davejb (see below) both refer to this report. DV writes:

He, like many of us can not get our heads round the following:

[...]

(2) QinetiQ produce a draft report "for comments" in Sept 2007. This was a most unusual step, because QinetiQ normally issue the report directly.

For what it's worth, there is nothing remotely unusual about QQ issueing a draft report for comment. It happens all the time.

(3) The report was adjusted, where the pharse "tolerbly safe" was added. MoD refuse to comment on this, because they claim the all copies of the draft report have beem destroyed.

This intrigues me. DV, how do you know the insertion of the phrase was an adjustment? I find it all too believable that it was inserted on MoD request. In my experience, several air IPTs are inclined to make statements to the effect that their aircraft are "tolerably safe" (meaning that the risk is tolerable though not necessarily ALARP) as though this was some sort of important achievement. There seems to be a collective desire to ignore the fact that acheiving ALARP is the requirement, not "tolerably safe".

(4) Issue 1 of the report was produced in Oct 2007, in which it is stated that the system is not ALARP, and can not be considered to be ALARP until 30 recommendations are complied with. MoD's Def Stan states, not ALARP then not safe.

I can't find anywhere in the report where it says that all 30 recommendations have to be implemented before the Nimrod fuel system risk is ALARP. The report does state:

"the recommendations [...] should be considered and acted upon, where appropriate, before it can be considered that the equipment risks are ALARP"

The difference between this and what DV wrote is that QQ are only saying that the recommendations "should be considered and acted upon, where appropriate", not that they must be complied with (to achieve ALARP). This is probably because QQ do not know whether all of the recommendations are necessary to achieve ALARP. In general, determining that a risk is ALARP or even just determining whether a particular risk reduction is "practicable" (in the sense of ALARP) is a complex business. As far as I can tell, the QQ report contains no ALARP analysis at all, i.e. for none of the recommendations is there a comparison of the costs and benefits of implementing the recommendation (for many of the recommendations, this is for a very good reason - see below). QQ don't know whether all of the recommendations are "practicable". Consequently, they only conclude that the recommendations "should be considered and acted upon, where appropriate, before it can be considered that the equipment risks are ALARP". Effectively, they are asking the IPT to do the ALARP analysis and consider the costs and benefits of the recommendations. I don't know whether the IPT has done this but their statements concerning the recommendations are, I think, at least consistent with them having done so.

Changing tack, the QQ statement:

"the recommendations [...] should be considered and acted upon, where appropriate, before it can be considered that the equipment risks are ALARP"

is misleading in a few ways, in my opinion. Most importantly, I can not tell what context of use and maintenance is being talked about. If it's missing, this is quite a serious flaw in the report so I hope it's just that I can't find it - does the report clearly state the context of use and maintenance in question? Unfortunately, in the absence of such information, it's difficult to be clear what exactly QQ are saying about the safety of the Nimrod fuel system.

Having said that, I don't believe that the QQ statement above refers to the way that the aircraft was being operated and maintained at the time of the report. Why? Because the very first recommendation is (text in square brackets is mine):

"The current operating limitations imposed by SD [Service Deviation] and the additional maintenance activities invokeds through RTIs [Routine Technical Instructions] mitigate the fuel system risks to acceptable levels. Changes to such mitigating action must be supported by appropriate evidence"

If QQ are saying that the risks are (currently) "acceptable", then they are saying they are ALARP. Thus it seems that QQ are saying that the risk of the Nimrod fuel system, in the context of use and maintenance extant at the time the report was written, is ALARP. Hence they must be talking about some other context of use and maintenance when they state:

"the recommendations [...] should be considered and acted upon, where appropriate, before it can be considered that the equipment risks are ALARP"

Unfortunately, as far as I can tell, QQ don't tell us what that context is (like I say, a serious flaw, in my opinion).

I also think the QQ statement is misleading because I think many of the recommendations are concerned with generic good safety management. They are not directly relevant to the ALARP status of the risk of the fuel system.

Back to DV:

(5) On 4th Dec 2007, Des Browne boasts "QinetiQ has conducted an independent investigation and confirm that, in light of the measures taken since the crash, the fuel system is safe to operate" - Wrong, wrong, so wrong. At the time none of recommendations had been implemented, and AAR was still in opertion at the time the report was written.

In respect of reporting QQ's conclusions, I'm not clear Des Browne was wrong - see above. However, whether QQ's conclusion contained in the first recommendation:

"The current operating limitations imposed by SD and the additional maintenance activities invokeds through RTIs mitigate the fuel system risks to acceptable levels."

was correct or not is another matter. Was it the case that AAR was only still happening due to operational imperative (i.e., in perhaps the only context in which a failure to achieve ALARP could be allowable)?


If I'm right that QQ were claiming that the Nimrod fuel system was ALARP in its context of use and maintenance at the time the report was written, an obvious question is why did the coroner and Nimrod IPTL, Hickman apparently contradict this? The short answer is I don't know. When either of them were making their statements about ALARP, was the context of use that they were referring to well-defined? If not, it is very hard for us to know what they were speaking of. The coroner can only do as well as the evidence he is given so I'll ask the question of Hickman's evidence. Do we know for fact that Hickman was talking in the context of how the aircraft was being operated and maintained at the time he was questioned? If not, his statements on the ALARP status of Nimrod risks have no obvious relevance to the question of whether or not the Nimrods were safe to fly at the time of the inquest (or now).

I think it is entirely possible (I would even say quite likely) that Hickman made his claim about the ALARP status of the risk of flying the Nimrods in the context of how he hopes they will fly when all the QQ recommendations are implemented, not how they were flown at the time.

davejb wrote:

1) The RAF considers an aircraft airworthy provided the risks associated with operating it are reduced to ALARP.

This statement would certainly be correct according to regulation and policy if it said, "The RAF considers an aircraft *safe* provided the risks associated with operating it are reduced to ALARP". I don't really understand "airworthiness". I know the definition in JSP 553 but it is vague and has no obvious connection with ALARP.

2) The RAF asked Qinetic to report on the MR2, and were told there were 30 items to fix to make MR2 ALARP.

Not quite true - see above.

5) 21 (was it?) items have been agreed by the RAF as requiring a fix, but the fixes haven't been done yet - until these are fixed presumably Nimrod MR2 isn't ALARP?

Not necessarily. Let me rephrase (5) as, "until these are fixed presumably the risk of operating the Nimrod MR2 fuel system in its current context of use and maintenance isn't ALARP?" The answer then depends on what (different, I believe) contexts of use and maintenance relate to the recommendations in the QQ report and the way the aircraft is currently operated. It may be that the aircraft is currently operated and maintained in a way that renders QQ's recommendations unnecessary to achieve ALARP.

It's also not necessarily true in another way. As JFZ90 has pointed out a couple of times, the ALARP status of a risk depends crucially on how long that risk is incurred. It's perfectly possilbe for a risk to not be ALARP when considered over the life-time of the Nimrod fleet but to be ALARP over a more limited period, e.g. whilst various recommendations are implemented to make the risk ALARP in the long-term. This would be consistent with legal and MoD regulatory requirements in respect of ALARP.