Loss of RAF Nimrod MR2 XV230 and the Haddon-Cave Review
The aircraft rendezvoused with an RAF TriStar tanker for air-to-air refuelling (AAR), then turned towards the operational area.
Eleven minutes after the AAR, a bomb bay fire warning and underfloor smoke warning were reported. Smoke entered the aircraft’s cabin. Within a minute the aircraft de-pressurised as fire breached the pressure hull. The crew donned their oxygen masks. The aircraft turned towards Kandahar, the crew declared a MAYDAY and began a descent.
Last radio contact was 5 minutes after the first warning. Shortly after an RAF Harrier GR7 pilot, who was flying several thousand feet above, reported that the Nimrod had exploded. None of the 14 crew survived, the single biggest loss of life of service personnel in one incident in theatre since the 1982 Falklands War.
The Investigations and Inquiries
The accident resulted in an RAF Board of Inquiry, a Coroner’s Inquest and subsequently an independent review of the broader issues surrounding the loss.
The BOI had found that the most probable physical cause of the loss of the aircraft was “the escape of fuel during Air-to-Air Refuelling” after which the fuel was ignited by “contact with an exposed element of the aircraft’s Cross-Feed/Supplementary Cooling Pack (SCP) duct”.
Th Independent Review was then ordered by UK Secretary of State for Defence on 4 December 2007 with the following Terms of Reference:
In light of the Board of Inquiry report:
- To examine the arrangements for assuring the airworthiness and safe operation of the Nimrod MR2 in the period from its introduction in 1979 to the accident on 2 September 2006, including hazard analysis, the safety case compiled in 2005, maintenance arrangements, and responses to any earlier incidents which might have highlighted the risk and led to corrective action;
- To assess where responsibility lies for any failures and what lessons are to be learned;
- To assess more broadly the process for compiling safety cases, taking account of best practice in the civilian and military world;
- And to make recommendations to the Secretary of State as soon as practicable, if necessary by way of interim report.
The review was to be led by London barrister Charles Haddon-Cave QC, who was widely recognised as a leading UK lawyer in the aviation field, having served on the defence team for the 1985 Manchester air disaster and having also represented survivors in the inquiry into The Herald of Free Enterprise ferry disaster.
“Nimrod Review: A Failure of Leadership, Culture and Priorities”
Haddon-Cave agreed with the Board of Inquiry:
…that the ignition source was the Cross-Feed/Supplementary Conditioning Pack (SCP) duct in the starboard No. 7 Tank Dry Bay. As regards the fuel source, new evidence (not available to the Board of Inquiry or other agencies) has come to light which points to an overflow during Air-to-Air Refuelling being the most likely fuel source; although a leak from a fuel coupling remains a realistic possibility.
The Review went on:
There were a number of previous incidents and warning signs, potentially relevant to XV230, which represented missed opportunities. In particular, the rupture of the SCP duct in Nimrod XV227 in November 2004 should have been a “wake up call”.
The Review focused primarily on:
- The inadequacies of the ‘Nimrod Safety Case’ which was prepared between 2001- 2005
- The organisational origins of poor operational safety oversight, e.g.:
- Conflicts of interest between operational delivery and commercial pressures to make programme savings;
- Airworthiness management becoming a part-time duty; and
- Loss of technical skills
- Missed opportunities to learn from lesser incidents which had occurred prior to the accident
A central part of the report is the failure of a retrospectively prepared Nimrod Safety Case (which cost £400,000) to identify the latent hazards within the design of the type that were instrumental in the loss of XV230. The way this safety case was produced and reviewed was subject to considerable criticism in the report:
The best opportunity to capture the serious design flaws in the Nimrod was during the preparation of the Nimrod Safety Case in 2001-2005. The very purpose of a Safety Case is to identify, classify and mitigate potentially catastrophic hazards before they can cause an accident.
If the Nimrod Safety Case had been drawn up with proper skill, care and attention, the catastrophic fire risks dormant within the Nimrod MR2 fleet would have been identified and dealt with, and the loss of XV230 in September 2006 would have been avoided.
Unfortunately, the Nimrod Safety Case was a lamentable job from start to finish. It was riddled with errors. It missed the key dangers. Its production is a story of incompetence, complacency and cynicism. The best opportunity to prevent the accident to XV230 was, tragically, lost.
The Nimrod Safety Case process was fatally undermined by a general malaise: a widespread assumption by those involved that the Nimrod was ‘safe anyway’ (because it had successfully flown for 30 years) and the task of drawing up the Safety Case became essentially a paperwork and ‘tick-box’ exercise.
He writes that problems with ‘a significant proportion’ MOD Safety Cases’ were:
- Bureaucratic length
- Obscure language
- Wood-for-the-trees (failing to concentrate on major hazards)
- Archaeology (interpretation of data for legacy platforms)
- Routine outsourcing (‘to consultants who have little practical knowledge of operating or maintaining the platform, who may never even have visited or examined the platform type in question, and who churn out voluminous quantities of Safety Case paperwork (‘bumpf’ and outsized GSN charts) in back offices for which [the MOD] are charged large sums of money’).
- Lack of vital operator input
- Disproportionate (at a cost which is simply out of proportion to the risks)
- Ignoring ageing issues
- Compliance only (drawn up to give the answer desired, i.e. that the platform is safe)
- Audits (tend to simply look at the safety case production process rather than its product)
- Self-fulfilling prophesies (confirming safety not unearthing and managing risks – see item 9)
- Not living documents (shelf-ware – a topic we have discussed previously)
Haddon-Cave goes on:
Organisational causes played a major part in the loss of XV230, adversely affecting the ability of the MOD IPT to do its job, the oversight to which it was subject and the culture within which it operated, during the crucial years when the Nimrod Safety Case was being prepared.
Financial pressures and cuts drove a cascade of multifarious organisational changes which led to a dilution of the airworthiness regime and culture within the MOD and distraction from vital safety and airworthiness issues…
There was a shift in culture and priorities in the MOD towards ‘business’ and financial targets, at the expense of functional values such as safety and airworthiness.
Poor Procurement practices have created ‘bow waves’ of deferred financial problems…
Airworthiness was a casualty of the process of cuts, change, dilution and distraction…the failures were both a failure of leadership, and collective failures to keep safety and airworthiness at the top of the agenda…
As one former Senior RAF Officer said to the Review: “There was no doubt that the culture at the time had switched. [Previously] you had to be on top of airworthiness. By 2004, you had to be on top of your budget, if you wanted to get ahead”.
Comparisons are drawn to previous ‘organisational accidents’ and in particular the loss of the Space Shuttle Columbia, which itself has close parallels with the previous loss of the Challenger. In particular:
- The ‘can do’ attitude and ‘perfect place’ culture.
- Torrent of changes and organisational turmoil.
- Imposition of ‘business’ principles (note this factor is not well justified in the report).
- Cuts in resources and manpower.
- Dangers of outsourcing to contractors (relates to eroding in-house capability to be an intelligent customer).
- Dilution of risk management processes.
- Dysfunctional databases (relates to multiple, cumbersome databases).
- PowerPoint engineering’ (relates to a lack of rigor in analysis and decisions made without examination of the underlying data).
- Uncertainties as to Out-of-Service date.
- ‘Normalisation of deviance’ (relates to unexpected poor service experience actually being used to justify the robustness of the system rather than being seen as a warning sign).
- ‘Success-engendered optimism’ (similar to normalisation of deviance coupled with complacency and unjustified over confidence).
- ‘The few, the tired’ (so quality, performance and standards drop).
Haddon-Cave identified the following shortcomings in the then current airworthiness system:
- A failure to adhere to basic Principles;
- A Military Airworthiness System that is not fit for purpose;
- A Safety Case regime which is ineffective and wasteful;
- An inadequate appreciation of the needs of Aged Aircraft;
- A series of weaknesses in the area of Personnel;
- An unsatisfactory relationship between the MOD and Industry;
- An unacceptable Procurement process leading to serial delays and cost over-runs;
- A Safety Culture that has allowed ‘business’ to eclipse Airworthiness.
Haddon-Cave concluded that major changes were required to better manage military air safety.
He made this recommendation:
Recommendation 20.1: In the light of the lessons learned from previous Chapters, I recommend that the MOD should promulgate and adhere to the following Four Key Principles, in order to help assure and ensure an effective Safety and Airworthiness regime in the future:
✓People (not just Process and Paper).
These can be best considered as set of ‘values’ to underpin the implementation of the other recommendations. In particular they link to the desired safety culture. These ‘values’ stem from Haddon-Cave’s assessment of a lack of leadership & commitment to safety, a conflict of interests in the current airworthiness organisation, ‘comfort in compliance with a process’ over rigorous oversight by competent professionals and a Byzantinely complex process.
In particular he notes:
The fundamental failure was a failure of Leadership. As preceding Chapters have shown, lack of Leadership manifested itself in relation to the way in which the Nimrod Safety Case was handled, in the way in which warning signs and trends were not spotted, and in relation to inexorable weakening of the Airworthiness system and pervading Safety Culture generally. For these reasons, Leadership is a key principle for the future.
We have previously discussed leadership here: The Power of Safety Leadership and in this pre-Haddon-Cave case study: ‘Beyond SMS’ by Andy Evans (our founder) & John Parker, published by the Flight Safety Foundation in May 2008.
There followed a series of recommendations on the topics of:
- Creation of a a military aviation regulator, with sufficient, competent regulators with suitable status
- Readable and concise regulation
- Clearly identified Duty Holders in the Front Line Commands
- Coherent flight safety management across each service
- A proper system of mandatory reporting and analysis (including an error management system concept introduced into maintenance by the UK CAA in March 2000 in AN71).
- A joint service accident investigation process (more akin to a civil air accident investigation branch)
- New in-house safety cases:
- These are to be “Succinct, Home-grown, Accessible, Proportionate, Easy to understand and Document-lite (SHAPED)”, that are a “reasonable confirmation”, “focused on actively managing risk”, “produced and maintained with major involvement of front line staff” and “modified with service experience”
- Clarifying the role of the Project Teams who procure and support air systems
- Reappointment of an RAF Chief Engineer
- A new approach to ageing aircraft
- A new MOD personnel strategy to address weaknesses in the development of specialist engineering skills (especially safety engineering), the status of engineers, military HR policy and motivation
- A new MOD industry strategy which relates to being an intelligent customer
- A new MOD procurement strategy, and ultimately:
- A new safety culture (a topic we have discussed on several occasions: How To Develop Your Organisation’s Safety Culture, Chernobyl: 30 Years On – Lessons in Safety Culture and Safety Intelligence & Safety Wisdom)
Many of these lessons and truths may be unwelcome, uncomfortable and painful; but they are all the more important, and valuable, for being so. It is better that the hard lessons are learned now, and not following some future catastrophic accident.
The UK Military Aviation Authority (MAA) was formed in April 2010 and the MAA Regulatory Publications (MRP) was issued in August 2011. Five years on from the Haddon-Cave report being published we wrote this article: Regulatory Reflections & Resisting the Seduction of the Risk Management Process. The MAA’s vision and mission for 2016 to 2021 has been published.
Haddon-Cave himself presented at a UK CAA event in 2010 and to the Piper 25 conference (marking the 25th anniversary of Piper Alpha offshore disaster in the North Sea, in which 167 workers died). His paper was entitled “Leadership and Culture, Principles and Professionalism, Simplicity and Safety – Lessons from the Nimrod Review”:
UPDATE 22 September 2016: NTSB Board Member Robert L. Sumwalt presented Lessons from the Ashes: The Critical Role of Safety Leadership to an audience in Houston, TX. Its worth noting the emphasis made of safety as a ‘value’ and of alignment across an organisation.
UPDATE 1 March 2017: Safety Performance Listening and Learning – AEROSPACE March 2017
Organisations need to be confident that they are hearing all the safety concerns and observations of their workforce. They also need the assurance that their safety decisions are being actioned. The RAeS Human Factors Group: Engineering (HFG:E) set out to find out a way to check if organisations are truly listening and learning.
The result was a self-reflective approach to find ways to stimulate improvement.
Coincidentally 2 September is also the anniversary of:
- The loss of RAF Nimrod XV239 during an air display in Canada in 1995
- The loss of Swissair MD-11 HB-IWF off Canada in 1998 due to a fire. According to the TSB: “It was determined that the fire most likely started from an electrical arcing event that occurred above the ceiling on the right side of the cockpit near the cockpit rear wall. The arcing event ignited the flammable cover material on nearby metallized polyethylene terephthalate (MPET) covering on the thermal acoustic insulation blankets. As the fire spread across the surface of the insulation blankets, other flammable materials became involved, including silicone elastomeric end caps, hook-and-loop fasteners, foams, adhesives, thermal acoustic insulation splicing tapes, and metallized polyvinyl fluoride (MPVF) insulation blanket cover material. The fire progression was rapid, and involved a combination of these materials that together sustained and propagated the fire. Reconstruction of the wreckage indicated that a segment of arced electrical cable associated with the in-flight entertainment network (IFEN) had been located in the area where the fire most likely originated. The Board concluded that the arc on this electrical cable was likely associated with the fire initiation event. The Board also concluded that it is likely that one or more additional wires were involved in the lead arcing event, and that the additional wire or wires could have been either IFEN or aircraft wires. Therefore, it could not be concluded that the known arcing event on the IFEN cable located in the area where the fire most likely originated was by itself the lead event. During the lead arcing event, the associated circuit breaker or breakers did not trip. The Board concluded that, although the type of circuit breakers used in the aircraft, including those used for the IFEN, were similar to those in general aircraft use, the circuit breakers were not capable of protecting against all types of wire arcing events. The Board recommended that a certification test regime be mandated that evaluates aircraft electrical wire failure characteristics under realistic operating conditions, and against specified performance criteria, with the goal of mitigating against the risk of igniting nearby flammable material.”
UPDATE 7 November 2016: Airworthiness problems have occurred in the RAF Boeing E-3D Sentry AWACS fleet: RAF fleet of Sentry aircraft grounded by electrical fault. This was only shortly after: Northrop Grumman Awarded Extension for Support of British Sentry Fleet (described here). The earlier contract was discussed by the NAO in 2013.
UPDATE 19 December 2016: UK Begins Testing Sentry, Post Repairs “The six strong fleet of airborne early warning jets was deemed unserviceable earlier this year and effectively grounded after a routine inspection revealed major issues with some electrical wiring and cabin conditioning systems. Defense News exclusively reported the entire fleet had been grounded Nov 4. Later media reports said some underfloor wiring was arcing creating a potential fire risk. Fire blankets on the aircraft were also found to not be fireproof, said the reports.”
UPDATE 18 October 2017: At an IET seminar at MOD Abbey Wood on Sustaining Airworthiness in Ageing Aircraft, the continued use of MEPT blankets on Sentry (18 years after the MD-11 accident), Kapton wiring, poor EWIS maintenance standards and “the use of safety reporting [i.e DASORs] to intimidate management” were discussed. This does cause one to question progress since 2006, although the positive action taken by a new TAA, supported by new safety advisors was clear.
UPDATE 13 November 2018: Inadequate Maintenance, An Engine Failure and Mishandling: Crash of a USAF WC-130H
UPDATE 17 November 2018: Investigation into F-22A Take Off Accident Highlights a Cultural Issue
UPDATE 27 December 2018: Inadequate Maintenance at a USAF Depot Featured in Fatal USMC KC-130T Accident
UPDATE 25 April 2021: A Second from Disaster: RNoAF C-130J Near CFIT