Executive Summary
Introduction
The extract below is taken from the Haddon Cave report into the accident leading to the loss of the Nimrod XV230 in Afghanistan. It is crown copyright and the full report is available from http://www.official-documents.gov.uk/document/hc0809/hc10/1025/1025.asp
Loss of XV230
1. RAF Nimrod XV230 was lost on 2 September 2006 on a mission over Afghanistan when she suffered a catastrophic mid-air fire, leading to the total loss of the aircraft and the death of all 14 service personnel on board. Investigation of the crash scene had to be curtailed because of enemy presence but, fortunately, photographs were taken and crucial recording equipment recovered. Subsequently,most of the aircraft wreckage disappeared.
History
2. The Nimrod, a derivative of the De Havilland Comet, has a long and distinguished record in maritime reconnaissance and other roles over 40 years, and continues to play an important role in Defence. XV230 was the first Nimrod to enter service with the RAF on 2 October 1969.
Board of Inquiry
3. The Board of Inquiry conducted a seven-month inquiry and, despite the absence of physical evidence, was able to determine that the most probable physical causes of the fire and explosion were: (1) Fuel source: The escape of fuel during Air-to-Air Refuelling, or a leak from a fuel coupling or pipe, led to an accumulation of fuel within the No. 7 Tank Dry Bay; alternatively, although of a lower probability, a hot air leak damaging fuel system seals. (2) Ignition source: Ignition of that fuel by the Cross Feed/SCP duct. The main conclusions of the Board of Inquiry have been confirmed by two leading agencies, the UK Air Accident Investigation Branch and the United States Air Force Safety Center. I am satisfied that the BOI’s findings are a sound basis upon which to found this
Physical Causes
Ignition source
4. There can be no doubt that the ignition source was the Cross-Feed/SCP duct in the starboard No. 7 Tank Dry Bay, and the most probable point of ignition was the SCP muff.
Probable fuel sources
5. I have concluded that the most likely source of fuel was an overflow during Air-to-Air Refuelling. New evidence has come to light which points to this being the most probable cause (Chapter 6).The second most likely source of fuel was a leak from either an FRS or an Avimo fuel coupling in the starboard No. 7 Tank Dry Bay (Chapter 5). The third, and only other viable,11 source of fuel could have been coupling damage caused by a Cross-Feed/SCP duct failure, but this mechanism is much less likely than the other two. (Chapter 7)
Responsibility for design flaws
6. Design flaws introduced at three stages played a crucial part in the loss of XV230. First, the original fitting of the Cross-Feed duct by Hawker Siddeley12 in about 1969 (Chapter 4). Second, the addition of the SCP by British Aerospace13 in about 1979 (Chapter 4). Third, the fitting of the permanent Airto- Air Refuelling modification by British Aerospace in about 1989. (Chapter 6)
Previous incidents
7. There were a number of previous incidents and warning signs potentially relevant to XV230; in particular, the rupture of the SCP duct in Nimrod XV227 in November 2004 should have been a“wake up call”. (Chapter 8)
Nimrod Safety Case
8. The drawing up of a ‘Safety Case’, to identify, assess, and mitigate potentially catastrophic hazards before they could cause an accident, was mandated for military aircraft and other military platforms by regulations introduced in September 2002. (Chapter 9)
Loss of XV230 avoidable
9. The Nimrod Safety Case was drawn up between 2001 and 2005 by BAE Systems (Phases 1 and 2) and the MOD Nimrod Integrated Project Team (Third Phase), with QinetiQ acting as independent advisor. The Nimrod Safety Case represented the best opportunity to capture the serious design flaws in the Nimrod which had lain dormant for years. If the Nimrod Safety Case had been drawn up with proper skill, care and attention, the catastrophic fire risks to the Nimrod MR2 fleet presented by the Cross-Feed/SCP duct and the Air-to-Air Refuelling modification would have been identified and dealt with, and the loss of XV230 in September 2006 would have been avoided.
Lamentable job
10. Unfortunately, the Nimrod Safety Case was a lamentable job from start to finish. It was riddled with errors. It missed the key dangers. Its production is a story of incompetence, complacency, and cynicism. The best opportunity to prevent the accident to XV230 was, tragically, lost. (Chapters 10A and 10B)
General malaise
11. The Nimrod Safety Case process was fatally undermined by a general malaise: a widespread assumption by those involved that the Nimrod was ‘safe anyway’ (because it had successfully flown for 30 years) and the task of drawing up the Safety Case became essentially a paperwork and ‘tickbox’ exercise. (Chapter 11)
Criticisms of BAE Systems
12. BAE Systems bears substantial responsibility for the failure of the Nimrod Safety Case. Phases 1 and 2 were poorly planned, poorly managed and poorly executed, work was rushed and corners were cut. The end product was seriously defective. There was a big hole in its analysis: BAE Systems had left 40% of the hazards “Open” and 30% “Unclassified”. The work was, in any event, riddled with errors of fact, analysis and risk categorisation. The critical catastrophic fire hazard relating to the Cross-Feed/SCP duct (Hazard H73) had not been properly assessed and, in fact, was one of those left “Open” and “Unclassified”. Further, at handover meetings in 2004, BAE Systems gave the misleading impression to the Nimrod IPT and QinetiQ that the task had been properly completed and could be signed off and deliberately did not disclose to its customer the scale of the hazards it had left “Open” and “Unclassified” (many with only vague recommendations that ‘further work’ was required). The Nimrod IPT and QinetiQ representatives were lulled into a false sense of security. These matters raised question marks about the prevailing ethical culture at BAE Systems. (Chapter 11)
Chapter 1 – Introduction and Summary
13. Three key BAE Systems management personnel involved in the Nimrod Safety Case bear primary responsibility for the above matters and are the subject of significant criticism: (1) the Chief Airworthiness Engineer; (2) the Task Leader; and (3) the Flight Systems and Avionics Manager. (Chapter 11)
Criticisms of Nimrod IPT
14. The Nimrod IPT bears substantial responsibility for the failure of the Nimrod Safety Case. The Nimrod IPT inappropriately delegated project management of the Nimrod Safety Case task to a relatively junior person without adequate oversight or supervision; failed to ensure adequate operator involvement in BAE Systems’ work on Phases 1 and 2; failed to project manage properly, or to act as an ‘intelligent customer’ at any stage; failed to read the BAE System Reports carefully or otherwise check BAE Systems’ work; failed to follow its own Safety Management Plan; failed properly to appoint an Independent Safety Advisor to audit the Nimrod Safety Case; and signed-off BAE Systems’ work in circumstances where it was manifestly inappropriate to do so. Subsequently, the Nimrod IPT sentenced the outstanding risks on a manifestly inadequate, flawed and unrealistic basis, and in doing so mis-categorised the catastrophic fire risk represented by the Cross-Feed/SCP duct (Hazard H73) as ‘Tolerable’ when it plainly was not. The Nimrod IPT was sloppy and complacent and outsourced its thinking. (Chapter 11)
15. Three key Nimrod IPT personnel involved in the Nimrod Safety Case bear primary responsibility for the above matters and are the subject of significant criticism: (1) the Nimrod IPT Leader, (2) the Head of Air Vehicle, and (3) the Safety Manager. (Chapter 11)
Criticisms of QinetiQ
16. QinetiQ also bears a share of responsibility for the failure of the Nimrod Safety Case. QinetiQ failed properly to carry out its role as ‘independent advisor’ and, in particular: failed to clarify its role at any stage; failed to check that BAE Systems sentenced risks in an appropriate manner and included risk mitigation evidence in its Reports; sent someone inadequately briefed to the critical handover meeting; failed to read the BAE Systems reports or otherwise check BAE Systems’ work properly; failed to advise its customer properly or ask any intelligent questions at the key handover meetings; and subsequently ‘signed-off’ BAE Systems’ work in circumstances where it was manifestly inappropriate to do so: in particular, without even having read any of the BAE Systems Reports and contrary to relevant regulations and standards.14 QinetiQ’s approach was fundamentally lax and compliant. (Chapter 11)
17. Two key QinetiQ personnel involved in the Nimrod Safety Case bear primary responsibility for the above matters and are the subject of significant criticism: (1) the Task Manager and (2) the Technical Assurance Manager. (Chapter 11)
Organisational Causes
18. Organisational causes played a major part in the loss of XV230. Organisational causes adversely affected the ability of the Nimrod IPT to do its job, the oversight to which it was subject, and the culture within which it operated, during the crucial years when the Nimrod Safety Case was being prepared, in particular 2001-2004.
History of MOD In-Service Support
19. Huge organisational changes took place in the MOD in-service support and airworthiness arrangements for Defence equipment and RAF aircraft in the years prior to the loss of XV230. There were three major themes at work: (a) a shift from organisation along purely ‘functional’ to projectoriented lines; (b) the ‘rolling up’ of organisations to create larger and larger ‘purple’ and ‘throughlife’management structures; and (c) ‘outsourcing’ to industry. (Chapter 12)
Warning in 1998
20. A Nimrod report in 1998 warned of “the conflict between ever-reducing resources and … increasing demands; whether they be operational, financial, legislative, or merely those symptomatic of keeping an old ac flying”, and called for Nimrod management that was “highly attentive” and “closely attuned to the incipient threat to safe standards”, in order to safeguard the airworthiness of the fleet in the future.15 These warnings were not sufficiently heeded in the following years. (Chapter 13)
Organisational trauma 1998-2006
21. The MOD suffered a sustained period of deep organisational trauma between 1998 and 2006, beginning with the 1998 Strategic Defence Review. Financial pressures and cuts drove a cascade of multifarious organisational changes, which led to a dilution of the airworthiness regime and culture within the MOD, and distraction from safety and airworthiness issues as the top priority. There was a shift in culture and priorities in the MOD towards ‘business’ and financial targets, at the expense of functional values such as safety and airworthiness. The Defence Logistics Organisation, in particular, came under huge pressure. Its primary focus became delivering ‘change’ and the ‘change programme’ and achieving the ‘Strategic Goal’ of a 20% reduction in output costs in five years and other financial savings. Airworthiness was a victim of the process started by the 1998 Strategic Defence Review. (Chapter 13)
22. Two senior personnel who presided over the Defence Logistics Organisation during the crucial period 2000-2004 bear particular responsibility for the episode of cuts, change, dilution and distraction and its consequences, and are the subject of significant criticism: (1) the first Chief of Defence Logistics (April 1999 to August 2002); and (2) the second Chief of Defence Logistics (September 2002 to December 2004). (Chapter 13)
Procurement
23. But for the delays in the Nimrod MRA4 replacement programme, XV230 would probably have no longer have been flying in September 2006, because it would have reached its Out-of-Service Date and already been scrapped or stripped for conversion. The history of Procurement generally in the MOD has been one of years of major delays and cost overruns. This has had a baleful effect on In- Service Support and safety and airworthiness generally. Poor Procurement practices have helped create ‘bow waves’ of deferred financial problems, the knock-on effects of which have been visited on In-Service Support, with concomitant change, confusion, dilution, and distraction as occurred in the post-Strategic Defence Review period 1998-2006. As the Rt Hon. John Hutton stated the day before his resignation as Secretary of State for Defence, “we have no choice but to act with urgency” on Procurement. (Chapter 14).
Aftermath
BOI Recommendations and post-XV230 events and measures
24. A large number of steps have been taken post-XV230 in relation to the Nimrod fleet to address the Board of Inquiry Recommendations and other maintenance and airworthiness issues which have since been revealed by subsequent incidents and investigations. I have been kept closely informed of all such developments. Pursuant to my Terms of Reference, I would have issued an immediate interim report if, at any stage, a matter of concern had come to my attention which I felt affected the immediate airworthiness of the Nimrod fleet or safety of its crews. I have not felt it necessary to issue an interim report at any stage. The continued successful deployment and operation of the Nimrod fleet post-XV230 is a tribute to the dedication of the Nimrod community and leadership at RAF Kinloss and RAF Waddington and their parent Headquarters. (Chapter 15)
Coroner’s Inquest
25. The Coroner’s Inquest produced little factual evidence of value to the Review. The Coroner’s finding as to the likely source of fuel did not accord with the realistic probabilities, or the evidence before him, and his Rule 43 recommendation (that the Nimrod fleet should be grounded pending certain repairs) was based on his misunderstanding of the meaning of As Low as Reasonably Practicable(ALARP). The Coroner’s widely-publicised remark that the MOD had a “cavalier approach to safety”was unjustified. The fundamental problems are ones of structure, culture, and procedure, not
indifference. (Chapter 16)
Lessons and Recommendations
26. The lessons to the learned from the loss of Nimrod XV230 are profound and wide-ranging. Many of the lessons to be learned are not new. The organisational causes of the loss of Nimrod XV230 echo other major accident cases, in particular the loss of the Space Shuttles Challenger and Columbia, and cases such as the Herald of Free Enterprise, the King’s Cross Fire, the Marchioness Disaster and BP Texas City. (Chapter 17)
27. Those involved in Military Aviation Airworthiness would benefit from an understanding of Accident Theory. (Chapter 18)
28. The shortcomings in the current airworthiness system in the MOD are manifold and include
(Chapter 19):
(1) a failure to adhere to basic Principles;
(2) a Military Airworthiness System that is not fit for purpose;
(3) a Safety Case regime which is ineffective and wasteful;
(4) an inadequate appreciation of the needs of Aged Aircraft;
(5) a series of weaknesses in the area of Personnel;
(6) an unsatisfactory relationship between the MOD and Industry;
(7) an unacceptable Procurement process leading to serial delays and cost-overruns; and (8) a Safety Culture that has allowed ‘business’ to eclipse Airworthiness.
29. I make Recommendations in the following eight key areas:
(1) A new set of Principles: I recommend adherence to four key principles (Chapter 20):
_ Leadership
_ Independence
_ People
_ Simplicity
(2) A new Military Airworthiness Regime: I make detailed and comprehensive recommendations under 10 headings comprising a blueprint to enable the MOD to build a New Military Airworthiness Regime (under the control of an independent Military Airworthiness Authority), which is effective, relevant and understood, which properly addresses Risk to Life, and which drives new attitudes, behaviours, and a new Safety Culture. (Chapter 21)
(3) A new approach to Safety Cases: I make recommendations for best practice for Safety Cases for the future, which are to be brought in-house, re-named ‘Risk Cases’, and made more focused, proportionate, and relevant. (Chapter 22)
A new attitude to Aged Aircraft: I recommend that generic problems associated with aged and ‘legacy’ aircraft are addressed. (Chapter 23)
(5) A new Personnel Strategy: I recommend that current weaknesses in the area of personnel are addressed. (Chapter 24)
(6) A new Industry Strategy: I recommend that flaws in the current bilateral and triangular relationships between the MOD, BAE Systems, and QinetiQ revealed by the Nimrod Safety Case are addressed. (Chapter 25)
(7) A new Procurement Strategy: I recommend that Bernard Gray’s Report on Procurement is published without delay16 and appropriate action taken as a matter of urgency. (Chapter 26)
(8) A new Safety Culture: I make recommendations for a new Safety Culture comprising a Reporting Culture, a Just Culture, a Flexible Culture, a Learning Culture, and a Questioning Culture.(Chapter 27)
30. I also make a number of further Recommendations. (Chapter 28)
31. The ultimate aim of this Report is to improve Safety and Airworthiness for the Future. The duty of those in authority reading this Report is to bring about, as quickly as possible, the much-needed and fundamental improvements for the Future which I have identified. This is not only for the safety of the men and women in the Services most immediately at risk, but also for the benefit of the effectiveness of Defence generally. A safe and airworthy fleet is also a more capable and effective fleet
.
32. I welcome the setting up by the MOD of the Haddon-Cave Review Implementation Team17 to implement the Recommendations in this Report as rapidly as possible.
Military Covenant
33. In my view, XV230 was lost because of a systemic breach of the Military Covenant brought about by significant failures on the part of all those involved. This must not be allowed to happen again. (Chapter 29)
