Summary of the BOI into the crash of XV230 on 2nd September 2006
NB: this is an HTML version of the MoD document Nimrod XV230 - Additional Briefing (PDF). The full (sanitised) BOI report is at Board of Inquiry (BOI) into the loss of NIMROD MR2 XV230
NB: all times are Zulu, or GMT. Local Afghan time is Zulu + 4.5 hours.
0913 Nimrod XV230 and its crew departed for a mission over Afghanistan, in support of coalition forces engaging the Taliban. No problems were raised during the ‘see-off’ of the aircraft.
1100 Crew 3 rendezvoused with a Tri-Star tanker and received fuel in an air-to-air refuelling procedure that lasted 10 minutes. Air-to-air refuelling appeared to pass without incident and XV230’s crew prepared to turn east, towards their operational area.
1111:33 A bomb bay fire warning, either coincident with, or followed immediately by, an elevator bay underfloor smoke warning, was reported. The crew also reported smoke entering the aircraft’s cabin, from both elevator and aileron bays.
A ‘fire-wire’ runs around the perimeter of the bomb bay (Fig. 1) and will activate visual and aural warnings in the aircraft cockpit if affected by heat.
Within the aircraft pressure hull, but under the cabin floor, are 3 under floor bays (Fig 2) each of which holds elements of the aircraft’s hydraulic systems. As there is a fire risk inherent in any hydraulic system, each bay is fitted with a smoke detector and any can be connected to a fire extinguisher. All Nimrod crews practise dealing with smoke or a fire within these bays.
The air flow under the cabin floor is forced from front to rear by fans. If smoke appears from 2 or more under floor bays, the forward bay is probably the source of the problem. Crew 3 appear to have reached this conclusion, as they began to conduct the drill for smoke in the aileron bay.
1112:26 The aircraft depressurised as the fire breached the aircraft’s pressure hull requiring the crew to don their oxygen masks.
Approximately 1114:00 A number of events occurred:
- A crew member reported a fire ‘from the rear of the starboard engines’. He was extremely precise and appeared to be indicating that the fire was not actually from the starboard engines.
- Another crew member, using a portable oxygen mask as part of the under floor drill, reported a fire within the aileron bay.
- The captain, who had already begun to turn the aircraft towards Kandahar Airfield, declared a MAYDAY and began a descent. The position and the rate of descent were correct for an approach to Kandahar.
1115:43 The aircraft’s accident data recorder and mission tape abruptly ceased recording data; probably because the fire had disrupted their power supplies.
1116:34 Marked the final transmission from the crew, who acknowledged the Kandahar Airfield weather for landing; the Board of Inquiry therefore concluded from this that at this time the crew clearly still believed that they were in control of their aircraft and that they would reach Kandahar Airfield. 1116:54 XV230 was observed, in what appeared to be a controlled descent, by a Harrier GR7 pilot, who was several thousand feet above. He reported an intense fire close to the starboard fuselage and stretching out between where the wing joins the aircraft fuselage to the starboard engine; there was a second fire that stretched behind the aircraft from a point on the side of the rear body of the aircraft. Very shortly after the Harrier pilot’s sighting, members of a Canadian army unit saw the aircraft as it passed their position and described a fire very similar to the Harrier pilot, but on the port side of the aircraft. Detailed analysis and expert consultation determined that the Canadians’ range and viewing angle probably led them to misinterpret what was by now a fairly large fire on the Nimrod’s starboard side as coming from the side nearest to them.
1117:39 The Harrier pilot reported that he saw the Nimrod explode. Analysis of photographs of the crash site by the Air Accident Investigation Board indicated that XV230 had broken into 4 sections, at a height of between 750 feet and 1000 feet. The crash was not survivable. Action Immediately Following the Crash: A Combat Search and Rescue team deployed to the site and established that there were no survivors. The Canadian unit which had observed the crash reached the scene and secured the area; they were subsequently reinforced by members of 34 Squadron RAF Regiment based at Kandahar. The priorities for the 2 units were to recover the crew’s bodies, their personnel effects and any classified material. The following morning the Canadian unit was withdrawn to support other Coalition forces engaged in fighting with the Taliban, at which point several hundred locals began to enter the site. The security situation began to deteriorate rapidly and at 0910 the RAF Regiment patrol was withdrawn by air, some 21 hours after the initial arrival of ground forces. The security situation prevented any return to the crash site. The majority of the wreckage was removed within a short period of time, probably by local nationals.
A Board of Inquiry (BOI) was convened to investigate the crash with an experienced ex-Nimrod Wing Commander nominated as its President, supported by two Squadron Leaders from the Nimrod Force Headquarters at RAF Kinloss. The Board of Inquiry reached Kandahar the following day, but in view of the security situation was unable to deploy to the crash site.
RECONSTRUCTION OF EVENTS LEADING TO THE CRASH OF NIMROD XV230 ON 02 SEPTEMBER 2006
From its investigation the Board was now able to reconstruct what it believed probably happened to XV230 on the day of the crash. As air-to-air refuelling drew to a close, fuel escaped from one of two possible sources: the action of a pressure-relief device in the main fuel tank, which led to an overflow of fuel during Air to Air Refuelling, or a leaking fuel coupling. The escaped fuel entered the No 7 tank dry bay, accumulated on its lower panel and contacted the Supplementary Conditioning Pack (SCP) pipe, after entering a gap between 2 types of insulation. The fuel ignited in under a minute. Combustion products from the fire entered the bomb bay and triggered its fire wire. The fire also heated the aileron bay causing smoke which triggered the elevator bay alarm. After 50 seconds the fire under the aileron bay burnt through into the pressure cabin and the aircraft depressurised. The rush of escaping cabin air strengthened the fire, increasing the rate at which it burnt through the aircraft’s wing panels. After 5 minutes the fuel within No 7 tank (the small fuel tank in the wing fillet) began to boil; the fuel remained in liquid form at much higher temperatures than normal, as it was contained by the tank walls. Eventually the No 7 tank began to breach and fuel under pressure escaped; this fuel was ignited by the fire and was probably the second fire observed by the Harrier pilot. The fire would now probably have begun to damage the aircraft’s hydraulic systems and flight control system. The extent of the damage will never be precisely known, but the aircraft’s flight path in its final moments suggests that some damage had certainly occurred. Very shortly before the crash the No 7 tank suffered significant disruption, and the highly pressurised fuel within it expanded rapidly and ignited, in a phenomenon known as a Boiling Liquid, Expanding Vapour Explosion or BLEVE; this was probably the explosion observed by the Harrier pilot and the Canadians. Whether the BLEVE was provoked by the aircraft breaking up, or the BLEVE provoked the break-up is impossible to determine.
ACTIONS TAKEN TO REDUCE RISK TO NIMROD OPERATIONS
Following the loss of XV230 a number of measures were taken immediately by the Royal Air Force to reduce the risk to crews continuing to fly the Nimrod. These included:
- Turning off all possible ignition sources wherever possible.
- Increasing inspections of the area to detect any faults at as early a stage as possible; during this process no evidence of any fleet-wide problems was identified.
- Immediately after the crash, a fleet wide examination was conducted of areas where flammable materials such as fuel or hydraulic fluid may be placed in relative proximity to potential sources of ignition should a leak occur. These examinations include visual inspections of the inboard wing and bomb bay areas, and pressurised functional checks of the aircraft’s fuel system.
- When the Board determined the most likely point of ignition it confirmed that the aircraft’s hot air system should remain off in the air.
- The Board worked with the Nimrod operating authorities to amend procedures to ensure that blow-off should not occur.
OVERVIEW OF THE BOARD’S FINDINGS
The Board noted that Crew 3 was faced with a series of complex and demanding emergencies. Throughout these events they acted with calm professionalism, conducting well-practised drills in an attempt to save their aircraft. The loss of 14 courageous Servicemen from all 3 Services is a tragedy, for the families and for their comrades throughout the United Kingdom. The Ministry of Defence takes seriously the duty of care it owes to its Servicemen and women, and will consider the lessons to be learned from the sad loss of this aircraft and its crew.
The Board made 33 recommendations as a result of its investigations. The main aim of these recommendations is to ensure safety measures are formally incorporated within Nimrod procedures and that all possible means to continue to ensure the safety of the Nimrod fleet and its crews are taken. These recommendations are being tracked to ensure that there is a clearly visible audit trail to highlight the means by which the Board’s aim is fulfilled.
As the Board was unable to inspect the wreckage of XV230 it used the evidence available, together with their aircraft system knowledge and logical analysis, to determine the most likely seat of the fire – the place where fuel had met a point of ignition.
The bomb-bay could not have been the seat of the fire: The Board ruled out the possibility that the fire on XV230 was initiated in the bomb bay. The equipment stored in the bomb bay appeared to be undamaged, militating against the possibility of a fire in the forward bomb bay, whilst the photographic evidence analysed by the Board showed no evidence that the rear bulkhead door had been subjected to a sustained fire.
The engines were not the seat of the fire: The closest engine to the aircraft’s fire was the No 3 engine. However, the aircraft’s accident data recorder indicated nothing amiss with any of the aircraft’s engines and no engine fire warnings were reported by the crew, making it most unlikely that any of the engines was the seat of the fire.
The seat of the fire was between the No3 engine and the fuselage: The Board determined that the seat of the fire must have been between the No 3 engine and the aircraft fuselage. The following areas were considered:
Rib 1 Area. This area contains some fuel systems and electrical
components. However, fuel leaks are relatively rare in this area and
the high power electrical components would have been turned off at
the time the fire began. Expert advice also noted that it was extremely
difficult to ignite fuel electrically at the altitude XV230 was flying. It was
thus possible, but unlikely, that this area had been the seat of the fire.
No 7 Tank Dry Bay Area Contained Elements Which Could Provide a Source of Fire. Immediately to the rear of Rib 1 the No 7 tank dry bay contains a number of elements which could have contributed to a fire. The bay contained hot air pipes linked to the aircraft’s conditioning system. This air pipe is at a temperature of approximately 400 Degrees Celsius which can ignite aviation fuel in less than a minute. Although the pipe was insulated in a steel-coated jacket examination of other Nimrods found gaps in the insulation that could allow fuel to reach the pipe’s surface. The rear of the bay was occupied by the aircraft’s starboard No 7 fuel tank, with its fuel feed and refuel valves and pipes - elements of which could provide a source of fuel.
The Board believed that the No 7 tank dry bay was the most likely location for the seat of the fire.
No 7 dry tank bay relationship to bomb bay and other bays - Triggering of alarms: There is an opening between the No 7 tank dry bay and the bomb bay itself; the bomb bay’s fire wire routes around this opening and thus the hot products of a fire in the No 7 tank dry bay would naturally expand into this area and trigger the fire wire. Any fire in the dry bay would heat the adjacent aileron bay; all under floor bays contain some residual hydraulic fluid and this would have begun to boil and emit smoke, explaining the possibly simultaneous triggering of the bomb bay and under floor alarms.
Most Likely Ignition Point - A Gap Between 2 Types of Insulation Potentially Allowing Fuel to Contact the Bare Metal at Approximately 400 Degrees Celsius: A pipe leads from the main hot air pipe and exits the aircraft fuselage at the rear floor of the No 7 tank dry bay to feed the Supplementary Conditioning Pack, or SCP. On a number of Nimrods examined by the Board there was a gap between 2 types of insulation, which could potentially allow fuel to contact the bare metal at approximately 400 degrees Celsius. The insulation could have then held the fuel against the pipe enabling auto ignition. Fuel leaking into the dry bay would naturally gravitate to this pipe and its vulnerable insulation gap. The Board determined that this was the most likely ignition point.
Likely Sources of Fuel Leak: There are 2 likely means by which fuel could have reached the probable point of ignition. The Board decided that it did not have the evidence to determine which of the 2 means was the most likely and that they were equally possible. The 2 likely means considered were:
A Leak from a Fuel Coupling: The most obvious source was the fuel system
itself and its 3 principal components: tanks, pipes and the couplings that join
lengths of pipe, or join pipes to fuel tanks. The Board examined several
thousand records to determine system leak rates from 1983 to 2005.
Although fuel tanks had shown an increase in leaks in the 1990s, the rate had
reduced in recent years and, in any case, such leaks tended to vent to
atmosphere, or to areas away from any ignition points. The Board also noted
that fuel pipes leaked rarely and had shown no increase in leak rate over time.
However, the Board’s analysis of the leak rates from fuel couplings showed a
fourfold increase in the period examined, despite a decreasing fleet size.
Although the majority of these leaks would have been relatively small,
perhaps only noticeable by a slight wetting of the coupling body, the Board felt
that such an increase suggested that a leak from a fuel coupling could be a
likely source within the fuel system.
Impact of Air-to-Air Refuelling on Fuel Couplings: Importantly the couplings within the aircraft’s refuel system would be under increased pressure during air-to-air refuelling and thus more likely to leak in this situation than any other. Operation of the No 1 Fuel Tank Blow-off Valve: After landing from one sortie, in the period prior to its loss, it was noticed that there was a little fuel in XV230’s No 1 tank blow-off valve outlet pipe and that fuel appeared to have tracked from it back along the exterior of the fuselage. The No 1 fuel tank is located in the centre of the fuselage, and can hold up to 16 000 pounds of fuel. Each of the Nimrod’s 13 fuel tanks possesses a blow-off valve, which is a safety device designed to prevent over pressure during refuelling. Should pressure within the tank reach a preset level, fuel will be expelled from the tank to the atmosphere by the blow-off valve. This was assessed by the air and ground crews as the normal operation of a safety device. Following the crash, to ensure that there was no further risk of the No 1 tank being overpressurised, all air engineers were briefed only to fill the No 1 tank to no more than 10 000 pounds of fuel.
Impact of Air to Air Refuelling on Operation of No1 Blow-off Valve: The Board commissioned a model of the No 1 fuel tank, which indicated that, because of its design, during air-to-air refuelling, there was a possibility that the blow-off valve would function and eject fuel from the tank. The significance of this is that the previously mentioned SCP pipe lies just behind the No1 tank blow-off valve. Fuel exiting the vent will naturally run along the fuselage side and could enter the fuselage through gaps between fairings and panels. In such a manner it could contact the SCP pipe within its fairing and ignite.
Comparison of Fuel Leak Possible Sources: The Board spent much time considering whether or not the ejection of fuel through the No 1 tank blow-off valve or the leakage of fuel from a fuel coupling was the most likely source of fuel for the aircraft fire. The blow-off had been seen to happen on previous sorties and was likely to occur as the No 1 tank approached full during air-to-air refuelling. However, its occurrence depended on many factors and so might not always occur. Fuel system couplings had experienced an increased leak rate over the life of the Nimrod and those within the refuel system would be under pressure during air-to-air refuelling and thus, if degraded in some way, would be more prone to leakage then. On balance the Board decided that it did not have the evidence to determine which of the 2 was the most likely and that they were equally possible.
SUMMARY OF BOI RECOMMENDATIONS
|1||The Nimrod Maintenance Policy is reviewed to ensure that maintenance procedures reflect the increasing age of the aircraft.||This recommendation has been accepted.|
|2||The Nimrod Ageing Aircraft Audit (the AAA process examines the rate at which the fatigue life of an airframe is being consumed over time) is reviewed to include aircraft systems.||This recommendation has been accepted.|
|3||The Nimrod Safety Case is reviewed, reassessing the factual data used for interpretation and categorization of hazard and risk.||This recommendation has been accepted.|
|4||A safety review of the Nimrod fuel and hot air systems is completed.||This recommendation has been accepted.|
|5||A life for the FRS Series 1 fuel seal be determined, based on the designer’s recommendation that fitted seals are replaced after 25 years. (An FRS seal is the rubber component which forms the internal seal in a fuel coupling. A coupling joins 2 sections of pipe in a fuel system and consists of 2 metal halves which are screwed together with the FRS rubber seal in the middle.)||The recommendation that FRS fuel seals be given a specific life has not been accepted because experts advise the life of seals will vary considerably, according to the conditions of their installation in the aircraft. Further studies have yet to identify any predictable ageing mechanism and it has therefore been impossible to define a common finite life to the 400 plus seals fitted to the Nimrod aircraft. Experience shows that replacing fuel seals may actually introduce more problems than it solves, thereby having a detrimental effect on safety.|
|6||A maximum installed life for fuel seals of other material types is determined.||This recommendation is under consideration. A review is being conducted to determine whether the regulations for the lifing of seals are adequate.|
|7||A one-off inspection of the integrity of each Nimrod’s fuel system, between Ribs 3 starboard and port, be conducted with access panels removed and the system pressurised. (Rib 3 is a section of the wing about half way between the fuselage and the wing tip.)||This recommendation has been accepted.|
|8||An inspection regime for fuel seals be initiated as recommended by Eaton Aerospace.||This recommendation has been accepted. A comprehensive inspection of fuel couplings is also underway.|
|9||A procedure is developed to pressure test the fuel vent system at the fuselage to wing interface.||This recommendation has been accepted. Aircrews will be briefed effectively to expect the difference between actual fuel rates delivered in the air and those represented in the simulator.|
|10||Detailed instructions for the correct fitting and locking of FRS couplings and seals be incorporated formally within the Nimrod AMM and publicized widely.||This recommendation has been accepted.|
|11||Hot Air System. Existing limitations, prohibiting the use of the Supplementary Conditioning Pack (SCP) and of the cross-feed pipe in the air be continued. (The Supplementary Conditioning Pack is one of 3 air conditioning systems. It uses engine bleed air (surplus air taken off the engine) to pressurise and condition the cabin. The crossfeed pipe is a duct which distributes very hot air (over 400 deg C) around the airframe for air conditioning, pressurisation, and anti icing.)||This recommendation has been accepted.|
|12||Nimrod air-to-air refuelling (AAR) procedures are reviewed in the light of the Board’s report, to establish appropriate levels and rates of refuel, which will prevent overspill of fuel from tanks.||This recommendation has been accepted.|
|13||A study be initiated to determine the cause of pressure surges (a pressure surge is a momentary increase in pressure beyond normal operating pressure of 50psi) during air-to-air refuelling and their long-term effect on aircraft fuel systems.||The feasibility of the recommendation is being examined and a technical proposal on how this could be implemented has been requested.|
|14||A statement specifying that the maximum normal operating pressure of 50 psi during air-to-air refuelling be reintroduced into the Nimrod Aircrew Manual.||The recommendation has been accepted.|
|15||Air-to-air refuelling refuel rates in the dynamic simulator are changed to reflect actual refuel rates to provide more realistic training.||This recommendation is under consideration.|
|16||Existing limitations, prohibiting the use of the No 7 fuel tanks, introduced following the loss of XV230, be discontinued.||This recommendation has been accepted.|
|17||A study be undertaken into the utility of parachute escape on the Nimrod MR2.||This recommendation has not been taken forward. The Nimrod has no airborne escape system as it was not designed for the deployment of parachutes. It is highly likely that any attempt to abandon the aircraft from the front or rear exit would result in either being pulled into the engine or hitting the tail of the aircraft.|
|18||Nimrod Standard Evaluation Team (STANEVAL) consider the lessons identified at Annex P (Description of crew actions during the emergency) and their potential impact on crew emergency procedures.||This recommendation has been accepted|
|19||The port rear emergency oxygen bottle is relocated to a more central position, or another oxygen bottle is provided in this position.||The feasibility of the recommendation is being examined and a technical proposal on how this could be implemented has been requested.|
|20||The design of No 1 fuel tank is reviewed to reduce the effect of asymmetric filling.||It is not currently intended to review the design of the No1 fuel tank as this problem has been resolved by only refuelling the No 1 tank to a level well below that which could initiate the safety valve.|
|21||The outlet pipes for fuselage fuel tank blow-off valves be modified to ensure that blown-off fuel cannot run down the exterior of the fuselage.||The feasibility of the recommendation is being examined and a technical proposal on how this could be implemented has been requested.|
|22||The connections of the No 1 tank vent pipes be modified to reduce the risk of fuel leakage.|
|23||The drainage of the lower panel in the No 7 tank dry bay be improved to prevent any accumulation of fuel.||The feasibility of the recommendation is being examined and a technical proposal on how this could be implemented has been requested. In the meantime the likelihood of a hazard arising from fuel pooling in this area has been significantly reduced by suspending the use of the Supplementary Conditioning Pack and Cross-feed pipe system and introducing the enhanced inspection regime.|
|24||A crash-protected means of recording aircraft position and intercom voice is introduced to the Nimrod.||This recommendation is under consideration.|
|25||The Defence Aviation Safety Centre (DASC) should investigate the provision of details of type specific emergency equipment (ADR, etc) and key internal components (for example the ADR tape unit and housing) on their website to enable Post Crash MOD Incident Officer (PCMIO) to provide guidance to search teams.||This recommendation has been accepted.|
|26||Instructions for PCMIO are revised to provide guidance when attending crash sites that are likely to become inaccessible.||This recommendation has been accepted.|
|27||Instructions for PCMIO at crash sites which are likely to become inaccessible should include advice to make every effort to ensure the widest possible photographic coverage of the crash site, at the highest possible resolution. This should take priority over all other tasks for any photographic team.||This recommendation has been accepted.|
|28||DASC should increase their current stock of post-crash BOI kits.||This recommendation has not been accepted. We currently hold 4 post crash BOI kits, if, in the unlikely circumstances that a fifth BOI post crash kit is required the RAF could borrow a kit from one of the other Services.|
|29||Body bag fluid proof liners should be stored within the outer ruggedised bags in crash kits to ensure that they always arrive on scene together.||This recommendation has been accepted.|
|30||The Nimrod MOD Form 700 Sections 2 and 3 (F703/F704) should be copied and retained before the document is carried on the aircraft.||This recommendation has been accepted.|
|31||The use of non-approved mission system panel blanks be discontinued.||This recommendation has been accepted.|
|32||Consideration be given to reinstating the SO1 (Wg Cdr) engineering post in Forward at RAF Kinloss to provide senior oversight of station engineering matters.||This recommendation has been accepted.|
|33||A review of engineering training is undertaken to identify those areas which, while relevant to Nimrod capability, are not encompassed within existing formal training courses.||This recommendation has been accepted.|
POSSIBLE CONTRIBUTING FACTORS TO THE LOSS OF NIMROD XV3230
The Board of Inquiry identified a number of factors which possibly contributed to the loss of XV 230 as follows:
Age: While the Board considered that the Ministry of Defence had done all that was required of it to cater for the increasing age of the Nimrod, the Board was unable to discount the age of the seals as a possible cause of the increase in leaks from fuel couplings and of the condition of the hot air pipes’ insulation. The Board acknowledged, however, that other factors might have been responsible for their condition.
Maintenance Policy. The Board also considered that maintenance policy in relation to the Nimrod’s fuel system was a possible contributory factor, as it did not detect a gradual increase in fuel leaks over time, nor did it prevent that increase. Maintenance policy for the aircraft’s hot air system was seen as a contributory factor, due to a lack of guidance on the allowable condition for hot air pipe insulation.
Failure of Hazard Analysis and Lack of a Fire Detection and Suppression System. The Nimrod Safety Case identified the hazards associated with the No.7 Tank Dry Bay but incorrectly quantified the SCP Duct hazard. Consequently, the risk was underestimated. Had the risk been correctly estimated it is almost certain that a range of risk-reduction options which would have reduced the likelihood of fire would have been considered and these may have included a redesign to fit fire suppression in the dry bay – although it is more likely that action to mitigate the risk by removing the potential ignition source would have been taken.
Not Identifying the Full Implications of Successive Changes to the Fuel System and Associated Procedures. The Board also felt that the formal incorporation of an air-to-air refuelling capability on the Nimrod in 1989 did not identify the full implications of successive changes to the fuel system and associated procedures.
|<<< Images of MRA.4||Top||Acknowledgements >>>|