| Previous Section | Index | Home Page |
1 July 2008 : Column 212WH—continued
“Only recently, another Nimrod aircraft suffered a serious fuel leak and it has proved impossible fully to understand why it happened. It is also a cause for concern that the inquiry confirmed the loss of experienced engineering personnel from RAF Kinloss. Will the Secretary of State confirm that the Ministry of Defence will do everything in its power to restore confidence in the Nimrod fleet, which performs such a vital military role?”
The Secretary of State answered:
“I have no hesitation in giving him the reassurance that he seeks. The safety of those who fly in these aircraft is our priority; it is not secondary to any other consideration. I have given careful thought to the issue of age and to all the other issues identified in the BOI as contributory factors. I am assured—and I accept those assurances—by those who have the vast technical ability and experience to understand these matters, and having gone into them in detail myself, that this aircraft is safe to fly and airworthy. I would not allow it to fly if I did not believe that to be the case.—[Official Report, 4 December 2007; Vol. 468, c. 693-94.]
That statement of confidence by the Ministry of Defence was followed in May by the coroner’s inquest. During the proceedings, which I attended, the court heard about the development of the Nimrod in the 1950s from the world’s first jet airliner, the de Havilland Comet. To make the Nimrod into a military aircraft, the Hawker Siddeley company added extra fuel tanks and a whole new bottom half to the Comet’s fuselage. Crucially, it also changed the engines, which meant installing a hot air pipe system to start the new Spey engines.
The hot pipe system crosses the centre section of the aircraft to enter the wings, where the engines are, passing through an area called dry bay 7, which was to become well known to the inquest. It is the area around the new No. 7 tanks, and it also contains fuel feed pipes. That should not have been a problem, as the hot air system was used only for engine starting. However, when the early Nimrod MR1 was developed into the MR2 version in the late 1970s, an extra cooling pack was added for all the new electronic equipment. Such packs work off hot air, from the cross feed pipe, which meant that the pipe had to be used continuously.
In dry bay 7, the cross feed pipe, operating at temperatures of 400º C to 500º C, was next to the large fuel feed pipes. That was a serious fire hazard, and it should have alerted the continuous safety assessment systems operated by the RAF and BAE Systems, the present aircraft maker, to the potential hazards. The coroner, Andrew Walker, said:
“I am satisfied that the design modifications to the MR2 made the aircraft unsafe to fly. This serious flaw in the design was not discovered despite a baseline safety case study undertaken by the (Nimrod) Integrated Project Team and the manufacturer.”
Mr. Walker added that in a previous incident to a Tornado aircraft, fuel had been drawn into the lagging around a hot pipe and had ignited, causing the loss of the aircraft. There had been no follow-up on the Nimrod, despite a recommendation from the RAF board of inquiry. He said:
“This cavalier approach must come to an end. In my view, it was this very source of ignition that, on the balance of probability, caused the loss of Nimrod XV230 with all souls on board.”
The coroner went on to detail failures of the so-called Cassandra hazard log, another matter to which I shall return. Had failures been recorded properly in the log and dealt with, the design flaw in the Nimrod fleet would have been discovered. He said:
“I simply do not understand”
how the Cassandra system could have assumed that there was a fire detection and suppression system in dry bay 7 when there was clearly no such system and there never had been. That meant that the crew of XV230 could do nothing to prevent the fire from developing into an explosive ignition of fuel in tank 7 in the wing root. The coroner added in his final verdict that
“the deaths were in part the result of failures...on the part of the aircraft manufacturer and those responsible for the safety of the aircraft”.
Mr. Walker recommended to the Defence Secretary that the whole Nimrod fleet should not fly again until the risks thrown up by the inquest have been reduced to a level known as ALARP, or as low as reasonably practicable. The Nimrod integrated project team leader, Group Captain Hickman, had already said in evidence that that was not expected to happen until the end of 2008. Asked if the process could be speeded up, Group Captain Hickman replied:
“No, it is driven by resources.”
I appreciate that the situation presents the MOD with a huge problem. The Nimrod performs an important role for the UK armed forces and coalition allies. It is also true that there is no replacement aircraft immediately available for the work and that the replacement Nimrod MRA4 is a few years off. Nevertheless, it was a surprise to all who attended the coroner’s inquest that literally within minutes of his lengthy summing-up, the Minister issued a statement refusing to accept the inquest’s main recommendation. It was, in my view, a rushed reaction. It cannot have been considered, and it illustrates my concerns about the developments.
I shall highlight three areas on which there has been precious little considered information from the MOD. In the 15 minutes that the Minister has following my contribution, he has an opportunity to provide details that I hope will reassure everybody about the safety concerns with regard to risk management, the hazard log and responsibility. First, on risk management, as I have already outlined, the Secretary of State assured the House that Nimrod was safe, citing a report by QinetiQ, the defence consultancy. To establish whether that was factually correct has been difficult, and it took an FOI request to establish that the report said that the aircraft would not be fully safe until its 30 recommendations were carried out. All but one of those related to a failure to implement mandatory airworthiness regulations.
The inquest heard that, if the risk of something going wrong on a plane is only “tolerable”, MOD rules stipulate that it must be further reduced to make it
“as low as reasonably practicable”
before the plane can be declared safe. In a letter to me on 19 May 2008, the Defence Secretary said that of the 30 recommendations, 21 have been accepted by the MOD and are still being implemented, six relate to air-to-air refuelling, which is no longer done with Nimrods, and three more are still being considered.
On 26 May, I wrote to Secretary of State asking:
“Please could you make a status report on all 24 recommendations which do not relate to Air-to-Air refuelling? How many have been implemented in full already? When specifically do you expect the remaining recommendations to be implemented in full?”
I am still waiting for an answer! Two weeks ago, in the defence procurement debate, I asked the very same questions, and the Under-Secretary of State for Defence, the hon. Member for Halton (Derek Twigg), said he would write to me. Again, I am still waiting for an answer. Today, Minister, I expect answers, and the questions are the same: how many of the 30 QinetiQ safety recommendations have been implemented in full, and when specifically does the MOD expect the remaining recommendations to be implemented in full?
Secondly, as the Minister must know, QinetiQ has already raised an issue relating to the structure of the Cassandra hazard log and linking of hazards to causes, controls and supporting evidence. It proved very difficult, if not impossible, to track the accident from the hazard back to the cause and the corresponding controls, and then to establish whether the controls had been fully implemented. In addition, it was found that the assessment of probability made assumptions concerning the implementation of recommendations that proved not to be valid, and supporting evaluations were found to be contradictory.
It was unclear which recommendations and controls required implementation to support the hazard probability. Furthermore, hazard controls often did not apply to all causes of hazard and, therefore, did not mitigate the hazard in full, but mitigated only specific causes. It proved impossible, therefore, to validate the hazard probability. QinetiQ recommended that the hazard log be restructured to facilitate ease of further review. It argued that that would clarify hazard-accident risk controls, the hazard causes to which they apply and the status of their implementation, which would in turn clarify the argument underpinning the evaluation of risk. In view of the importance placed on the Cassandra hazard log in determining Nimrod safety, what steps have been taken by the MOD and the integrated project team to implement QinetiQ’s important recommendations? With the current hazard log in such a confusing state, how can anyone claim that Nimrod is safe to operate?
My third point is simple, but crucial, and relates to responsibility: has any action been taken in relation to those with delegated responsibility for Nimrod airworthiness at the time of the Nimrod crash? Safety worries about the Nimrod fleet will remain as long as concerning incidents continue. With more than 111 fuel leaks since the crash of XV230, and the regular grounding of aircraft, those concerns remain and will remain until the MOD maintains its aircraft to its own applicable risk standard which must be as low as reasonably practicable, and for as long as it fails to restore confidence in the Nimrod fleet as promised.
Visits to RAF Kinloss by the Secretary of State are welcome—I have said that on the Floor of the House—and his participation in a Nimrod test flight was a statement of confidence, but that is not enough. Ministers have failed to make written or oral statements to the House of Commons when necessary, have imparted key information only after a coroner demanded it and released key studies only after freedom of information requests were made. Asserting from a television studio that the
Nimrod fleet is safe is not good enough. I know that the Minister wants the best for our service personnel, as do I, and I strongly urge him to answer my questions, because otherwise this matter will not rest.
12.45 pm
The Minister for the Armed Forces (Mr. Bob Ainsworth): I congratulate the hon. Member for Moray (Angus Robertson) on securing this debate on the safety of the Nimrod fleet and thank him for the opportunity to respond, on the record, to the important issues that he raises.
I repeat the condolences offered in the House by my right hon. Friend the Secretary of State for Defence and myself to the families, friends and colleagues of the brave crew of the Nimrod XV230. It is clear from the board of inquiry and the recent coroner’s inquest that the crew of the XV230 acted with the utmost professionalism in the face of a tragic incident. We owe them, and all those who serve in our armed forces, a continuing debt of gratitude. I would also like to repeat the apology given by the Secretary of State, which he made on behalf of the Ministry of Defence, for the failings that contributed to this tragic incident. I was astonished, therefore, that the hon. Gentleman said that we made assertions from a television studio. The Secretary of State came to the House and made a statement in the House. He apologised for the failings and set up a further inquiry to get behind the issues that had not been addressed by the board of inquiry. Yet the hon. Gentleman feels able to say effectively that we have failed to be responsible to Parliament. I find that unjustifiable.
Angus Robertson: Will the Minister give way?
Mr. Ainsworth: No, I shall give way at the end of the debate, if I have time.
The board of inquiry into the crash was rigorous and exhaustive, and the deputy assistant coroner for Oxfordshire subsequently conducted an inquest into the incident. The inquest, and the MOD’s response, raised further concerns, not least for the families and friends of those killed in the crash, which I should like to try to address.
I turn first to the very important issue of the level of safety that applies to the Nimrod today. Many people are concerned that the aircraft is still flying despite being described as “tolerably safe”. They say—I have a statement from one of the family members to this effect—that Nimrod must be 100 per cent. safe. I, the hon. Gentleman and any other lay person, including the families and friends of those who died in the Nimrod XV230, would expect an aircraft, or any other vehicle, to be completely safe. However, the problem lies in the language and terminology. Our technical experts do not use words such as “completely safe”. Nobody connected with aircraft safety would talk about equipment being “completely safe” or “100 per cent. safe”. That is not in their vocabulary. Those people, who constitute the technical expertise available to the Royal Air Force, the integrated project team, QinetiQ and BAE Systems, judged Nimrod, as it is today, safe to fly.
MOD standards and policy on safety are derived from Health and Safety Executive policy guidance. They have not been invented by us, the MOD or the IPT. The guidance specifies three levels of risk: unacceptable, tolerable and broadly acceptable. In that terminology,
which is necessarily used by technicians, and is the language used to classify equipment risk, there is no such standard as 100 per cent. safe. Our technical experts do not use such language. Indeed, I am told that the consequences of a fire or an explosion in any military aircraft means that the risk can never be reduced below the formal categorisation of “tolerable”, no matter how unlikely the hazard or how comprehensive the mitigation. That applies not only to the Nimrod, but to the Harrier, the Tornado and the C-130. It applies across military aircraft, irrespective of age. “Tolerably safe” is the level at which military aircraft must be to be allowed to fly.
Another term that causes confusion—and I understand why—is ALARP or “as low as reasonably practicable”. I used to think—and one’s intuition makes one think this—that ALARP is a level of safety below perfection, but it is not. It is part of a process derived from the HSE policy guidance. We make ALARP judgments on an ongoing basis to ensure that we continually drive down the level of risk to equipment. The MOD, having carefully considered all those issues, has declared that all reasonably practicable measures have been taken to reduce to ALARP the risk to the Nimrod aircraft. It is the view of all those involved in the equipment safety and environmental working group, which includes QinetiQ, BAE Systems, the RAF and the IPT, that the Nimrod is tolerably safe and ALARP, and is therefore safe to fly. No member of the group demurs from that view.
In the June debate on procurement, the hon. Gentleman talked about the QinetiQ independent fuel system safety review, and stated that
“the report said that the aircraft would not be fully safe until its 30 recommendations had been implemented.”
He also stated, and he has repeated this assertion today:
“All but one of those recommendations related to a failure to implement mandatory airworthiness regulations.”—[Official Report, 19 June 2008; Vol. 477, c. 1173.]
I am told that that is not correct. I do not know where he got that information from, but I am more than happy to talk to him about this subject outside the Chamber, or to brief him on it. He has made that statement twice, but the technical expertise available to me asserts that what he says is incorrect. I am prepared to try to give him the level of understanding that I have tried to establish for myself over a period of time.
Of the 30 recommendations in the report, six related to air-to-air refuelling, which no longer takes place. Three of the recommendations have not been taken forward—two of them because appropriate systems that satisfied the recommendations were considered already to be in place by the operators of the aircraft. The third recommendation that has not been taken forward was that we should consider producing a system-level statement of design for the fuel system, which would be a highly structured suite of documentation that would be maintained throughout the life of equipment to retain a complete record of its design evolution. Given the level of scrutiny that the fuel system has already undergone, it would not be a sensible use of expert resources to collate that documentation retrospectively.
The remaining 21 recommendations have all been accepted. They relate to processes and procedural issues, and do not impact on the immediate risk of flying the aircraft. We are implementing them as soon as is reasonably
practicable to ensure that the aircraft remains ALARP throughout its life. Let me give some examples of what the recommendations are, lest people ask why we have not implemented them yet. One recommendation is that we clarify the publication management arrangements, which are currently being revisited, to ensure the quality of technical information and to confirm that they satisfy corporate guidance. Another recommendation is to formalise a service level agreement between the integrated project team and the release to service authority. Another recommendation is to review the hazard log structure, giving consideration to adapting the way in which accidents are recorded to improve the visibility of dominant risks.
The recommendations will all be implemented by next June, and QinetiQ is happy with that. We are not taking that decision in isolation. It is being taken with the engineering staff and the people who fly the aircraft, and with the expertise that is available to the RAF. QinetiQ is exposed to that decision; indeed it is part of the conversation and is happy with our approach to taking those recommendations forward. I have only a few minutes left, and I shall try to allow some time at the end, but I have not answered all the hon. Gentleman’s points—there is at least one left to address. I should like to put on the record an additional point that he made about the timing of my statement on the day of the coroner’s verdict. I know that the speed with which that statement was made upset the families and friends of those who were killed in the crash. Given the way in which it was presented, I do not blame them and the hon. Gentleman for thinking that we had not taken any time to consider the coroner’s verdict. Understandably, he repeats that allegation today.
While I regret any distress that our response to the coroner’s verdict caused to the families, I want to reassure them, and the hon. Gentleman, that it was carefully considered and was based not only on the verdict but on
the evidence that was heard during the inquest, which I followed closely. We had two people permanently in the coroner’s court and I had a daily brief. We anticipated the verdict from the evidence to which we listened. The day before the coroner’s verdict, I went home 90-odd per cent. certain of what it would be, and I had already discussed potential verdicts with the Chief of the Air Staff, the RAF’s chief engineer and others. The inquest did not reveal anything that changed the view that we had already reached, following the board of inquiry: that the aircraft remained safe to fly. Our statement was considered, and we thought it important to reassure our people as soon as possible, particularly those who fly the plane, that it remained safe to fly. I am pleased to have had the opportunity to put that on the record, because I know that people were very upset on the day.
Before the inquest, I wrote to all the families, offering to meet them afterwards if there were any issues that they wished to discuss. A number of families have taken me up on that, and I plan to meet them. I hope that I will be able to explain that point to them in person. The only other point that the hon. Gentleman has raised that I have not answered stems from his question about what action had been taken. A board of inquiry does not lay blame on anyone. He knows that there is an ongoing inquiry by Mr. Haddon-Cave, QC, that will consider the wider issues of what happened to the Nimrod, over time, and will make recommendations. Mr. Haddon-Cave has said that if he needs to make an interim report he will do so.
That is where we ought to leave matters. We have an eminent QC considering the more detailed issues of how we got to where we were with the Nimrod. That inquiry was set up by the Secretary of State, and is designed to answer some of the questions that the hon. Gentleman justifiably asks. However, I am more than happy to brief him outside the Chamber and to help him to get to the point that I have tried to get to on this complex issue.
| Next Section | Index | Home Page |