The past few decades have seen a significant number of catastrophic aircraft accidents which frequently have broader failures associated with the overall organisational approaches to keeping aircraft airborne and serviceable and not just the final cause from the ‘sharp end’ failures concerning the Pilots, operators or engineers. Ergonomics/Human Factors has an important emphasis on this systems approach which is based on the idea that complex systems such as large design or organisational teams involve many different processes and components that combine to complete a final objective. Systems Ergonomics has a holistic approach which focusses on the design of a system, and people’s interactions with it, rather than concentrating on an individual part of it. (Wilson,2014) This thinking has led to root causes of incidents and accidents being traced back to latent and organisational failures arising in the upper echelons of the systems in question. (Reason,1995)
It is common to see accident sequences beginning due to negative consequences of organisational processes, for example, planning decisions, scheduling, designing, maintaining, regulating and communicating. These factors themselves are the products of financial, economic or political constraints placing pressure within the organisation. In addition, these failures can transmit through the organisational and departmental pathways into the workplace which causes the commission of error and violation producing conditions. Such examples may include high workload, time pressure and fatigue. Unsafe acts are likely to be committed in high numbers throughout organisational and workplace levels but only a limited number will penetrate the defences and produce damaging outcomes. (Reason,1995)
Within the investigation of aircraft accidents, it is very easy to employ a ‘blame culture’ attitude focussing on the initial causation factor without exploring the human causes across a whole system. Widely distributed human causes relating to accidents are very common, not only in aviation but in nuclear and maritime with evidence for ‘organisational errors’ extensively available in numerous enquiry reports. A particularly convincing example Is the investigation into the Dryden Accident of 1989. At first sight this accident was a case of straightforward ‘human/pilot error’ however the investigation uncovered major failings including top level safety commitment, conflicts between commercial and safety goals, blurred safety responsibilities, poor training, inadequate maintenance management and regulatory failings. (Moshansky,1992) This accident can be likened to the organisational causes that combined to cause the loss of XV230 in Afghanistan. The cause was leaking fuel being ignited by an exposed hot cross-feed pipe. It was a pure technical failure which could not have been prevented by the pilots or their operating procedures but could have been avoided by stringent organisation and management of the aircraft. (Haddon–Cave,2013)
Background
The Nimrod was based on the 1950’s De Havilland Comet and had a long, distinguished record in maritime intelligence and reconnaissance in addition to other roles over a 40-year period. XV230 entered service with the RAF on October 2nd 1969.
RAF Nimrod XV230 was lost on the 2nd September 2006 on a routine mission over Helmand province in Southern Afghanistan after suffering a tragic mid-air fire following air-to-air refuelling when leaking fuel ignited leading to the total loss of the aircraft and the death of all 14 personnel on board. It was the biggest single loss life of British service personnel since the Falklands war.
Timeline of Events
0913 XV230 Departs from the Deployed Operational Base (DOB). No problems were noted during the ‘See-off’ of the aircraft.
1100 XV230 rendezvoused with a Tri-Star tanker and received fuel during an air-to-air refuelling procedure that lasted 10 minutes. The procedure appeared to pass with no problems and the crew of XV230 prepared to turn East, towards the operational area.
1111:33 A bomb bay fire warning was followed immediately by an elevator bay underfloor smoke warning. The crew reported smoke entering the aircraft’s cabin from both elevator and aileron bays. The crew begin to conduct drills for smoke in the aileron bay.
1112:26 The aircraft depressurised as the fire breached the aircrafts pressure hull. This required the crew to put on their oxygen masks.
1114:00 The following events occurred:
1115:43 The aircrafts data recorder and mission tape abruptly cease recording data. A likely cause is because the fire had disrupted their power supplies.
1116:34 The final transmission from the crew was received which was landing acknowledgement for Kandahar airfield weather.
1116:54 XV230 was observed by a Harrier GR7 pilot in what appeared to be a controlled decent. He reported an intense fire close to the starboard fuselage. There was a second fire that stretched behind the aircraft from a point on the side of the rear body of the aircraft.
1117:39 The Harrier pilot reported that the Nimrod had exploded.
Immediately following the crash, a combat search and rescue team was deployed to the site where it was established there were no survivors. Members of the RAF Regiment were deployed to the site in order to secure the area, recover sensitive documents and equipment that may benefit the investigation. Several hundred locals proceeded to enter the site and security began to deteriorate rapidly, unfortunately the RAF Regiment were withdrawn 21 hours after the initial arrival of ground forces.
Human Factors Issues
It is evident that even before the aircraft became airborne there were serious organisational and management failings within time management, Leadership and Priorities, lack of challenge and a misunderstanding in people, process and cultural safety. In addition, the organisations involved in the Nimrod programmes were unsuccessful in recognising the importance of learning from previous incidents, resulting in missed learning opportunities. The outcome of XV230 would not have been prevented by the actions of the pilots which was already destined for fate before flight. The following highlight some of the most important Human Factors Issues associated in this accident:
Leadership, Culture and Priorities
Throughout the years of 1998 to 2006 the MOD suffered significant organisational damage due to defence budget cuts and changes in spending. Huge financial pressures were placed on the MOD which included savings, efficiencies and strategic targets. These new targets drove negative organisational change and a dilution of important air worthiness regimes and culture in the MOD generating a distraction from safety and airworthiness issues. These factors inherently produced an organisational shift from high safety culture to encouraging good business and meeting financial targets at the expense of aviation safety.
In 1998 an important ‘Nimrod Airworthiness Team Report’ was written which emphasized concerns of ‘declining experience’, the perception of being ‘overstretched’ and failing morale and also the hazard of sustaining operations. This report highlighted the problems associated with ever diminishing resources and increased demands operationally and financially. The management were inattentive in exploring the concerns stressed in this report and the threat against maintaining safe standards. The management provided evidence of their failures to safeguard the airwort
hiness of the Nimrod fleet amidst the increased financial pressures. Safety and Airworthiness had clearly fallen off the top of the agenda.
Poor Safety Culture / ‘Can do Attitude’
The Nimrod safety cases were documents that were required by regulations and served a purpose to identify, assess and mitigate potentially catastrophic hazards which might occur to an aircraft. Unfortunately, the Nimrod safety cases were undermined as the involved organisations had the assumption the Nimrod was ‘safe anyway’ because it had flown successfully for 30+ years. Those compiling the safety case believed that they were documenting something they already knew and it fundamentally became a paper exercise with no real investigational work.
The organisations and individuals involved should have known to be cautious about making assumptions without being fully satisfied or reliably ensuring the assumptions are valid, rational or still reasonable especially after making design changes. The safety cases had led to an increase in ‘paper safety’ at the expense of real safety and from start to finish was unsatisfactory as it was riddled with errors and missed key dangers. The safety cases displayed severe complacency and could have been paramount in highlighting the Nimrod fire risk and preventing the loss of XV230.
Time pressure
Throughout the late 1900’s and early 2000’s there was a significant increase in operational use of the Nimrod. This operational increase exacerbated the distraction from airworthiness and safety with rushed decisions and focus set on value for money and business decisions.
In the early 2000’s the Nimrod safety case fell behind on schedule and BAE systems who were the design authority failed respond to this appropriately. The IPT ‘integrated Project Team’ was not given a suitable extension of the deadline and therefore the quality of work greatly suffered. Pressure was put on staff to finish the case by the end of August 2004 which led to corners being cut, inappropriate data being used to assess hazards and contractually required data was not used. More surprisingly the IPT were told that there would be an internal review of the work, but, this never materialised. The commercial motivation to complete the safety case by the deadline with the hope of winning bids for similar work had superseded the importance of completing a comprehensive review of
aircraft safety.
Missed Learning Opportunities (Not Learning from previous experiences)
There were a substantial number of previous incidents in the years prior to the loss of XV230 which contained essential warning signs for the issues and problems that could be relevant to XV230 and the rest of the Nimrod fleet. Unfortunately, the majority of these incidents were treated as ‘one-offs’ without further consideration given to the future ramifications. These incidents had the potential to spot risks, patterns and potential problems with the fleet.
...(download the rest of the essay above)