Six minutes
On 2 September 2006 a Royal Air Force Nimrod MR2, registration XV230, took off at 09:13 to fly a mission over Afghanistan. It was the first Nimrod to enter Royal Air Force service, on 2 October 1969, which made it a month short of thirty-seven years old. Mid-morning it took on fuel from a TriStar tanker, which was routine, and which it had done many times before.
About ninety seconds after the refueling was complete, it caught fire.
- Fire warning in the bomb bay, together with a smoke and hydraulic mist warning in the elevator bay.
- The aircraft depressurized.
- The camera operator reported flames coming from the rear of the engines on the starboard side.
- Mayday transmitted. The crew turned for Kandahar.
- A Harrier GR7 pilot watched the aircraft descending with flames at the starboard wing root.
- It exploded at roughly 3,000 feet above the ground.
Six minutes and six seconds from the first warning. The Review records a full crew complement of twelve on board together with two mission specialists. All fourteen were killed: twelve Royal Air Force personnel, a Royal Marine and a soldier. It was the biggest single loss of life suffered by the British military since the Falklands War.
What burned was fuel. What lit it was a duct carrying air at up to 420 degrees Celsius. The two were inside the same compartment, a space called the No. 7 Tank Dry Bay, and they had been sharing it for years.
A bay that filled up over twenty years
No single decision put them there. Three separate ones did, taken by different people, in different decades, each sensible on its own terms.
Around 1969, Hawker Siddeley fitted a Cross-Feed duct. Air from the auxiliary power unit is ducted into it, and it runs across the bomb bay between the port and starboard engines, used for engine starting. Its route takes it through the starboard No. 7 Tank Dry Bay, where fuel pipes already ran. A hot pipe near fuel pipes is not an oversight. It is a normal packaging compromise in a crowded airframe, managed with insulation, routing and separation.
Around 1979, during the upgrade from MR1 to MR2 standard, British Aerospace added a Supplementary Cooling Pack to cool new electronic equipment. It drew bleed air from the Cross-Feed duct. The Review records that with engines at high power at low altitude, the temperature of the air in the SCP duct could be in the region of 470 degrees Celsius. The important consequence was not the extra heat. It was that the duct, which had previously been hot only briefly during an engine start, was now hot for extended periods whenever the cooling pack ran. Its duty cycle had changed completely, and that change belonged to a different system.
In 1982, during the Falklands conflict, eight aircraft were hurriedly fitted with air-to-air refueling probes so they could reach the South Atlantic. The modification was made permanent around 1989. It introduced fuel at pressure, and with it the possibility of overflow and blow-off during refueling, in an aircraft never designed to take fuel in flight.
Each change was reviewed. None of the reviews was looking at the other two. The Nimrod Review, the independent inquiry led by Charles Haddon-Cave QC that reported in 2009, described the result in a phrase worth keeping:
the insidious manner in which several potential weaknesses can weave into a dangerous design over time
The Nimrod Review, 2009
There was one near-miss. In 1985 the trials team working on the Nimrod AEW3 variant recommended investigating the risk of fuel blow-off during air-to-air refueling. The AEW3 program was cancelled. The Review records that the recommendations stayed on the shelf, and that the potential sources of fuel overflow during refueling remained unremedied. The right question was asked twenty-one years before the accident, by people who had no idea what they were looking at, and it died with the project that asked it.
Nobody knows which leak it was
Here is the detail that makes this accident useful rather than merely sad. The investigation never established where the fuel came from.
The Review sets out three candidate sources and ranks them. An overflow during air-to-air refueling is the most likely. A leak from a fuel coupling is the realistic alternative. A hot air leak damaging fuel system seals is the third and, in its words, only other viable source. The Board of Inquiry was unable definitively to determine which it was, and the Review narrows the field by deduction and experiment rather than by proof.
Now set that against what the Review says about the ignition:
There can be no doubt about the probable ignition source and seat of the fire.
The Nimrod Review, 2009
No doubt. The high temperature Cross-Feed and SCP duct, with the most likely ignition point at the SCP elbow.
That asymmetry is the argument of this whole piece in one paragraph, and it is ours rather than the Review's. Three plausible ways for fuel to arrive, no way to tell which one did, and one ignition source about which there is no argument at all. The hazard was never that a particular coupling might leak. The hazard was that this bay contained fuel and something hot enough to light it, and the aircraft did not care which pipe failed.
Which means the analysis did not need to solve the leak either. It needed to ask what was in that space and what those things could do to each other. That question has one answer, and you can reach it without knowing anything about blow-off valves. The investigators spent years narrowing three possible sources. The hazard could have been stated in an afternoon, twenty years earlier.
The hazard was on the list
This is the part that separates XV230 from most accident write-ups, and it is why we chose it for this series.
The Nimrod Safety Case was not skipped. It was commissioned and produced between 2001 and 2005 in three phases. BAE Systems did the first two. The MOD's Nimrod Integrated Project Team ran the third, with QinetiQ appointed as independent advisor. It existed, and it had a contractor, a customer and an independent check.
And the hazard was found. The catastrophic fire risk from the Cross-Feed and SCP duct was identified, written down, and given a reference: Hazard H73. Somebody looked at that bay, understood what the duct could do to the fuel system, and recorded it.
Then nothing happened to it. The Review's finding is specific. H73 had not been properly assessed, and was one of the hazards left Open and Unclassified. It was not alone. Of the hazards in the safety case, BAE Systems left forty percent Open and thirty percent Unclassified. Later, the Nimrod IPT categorized H73 as Tolerable, which the Review says it plainly was not.
So the record of the thing that destroyed the aircraft reads: identified, left open, left unclassified, then called tolerable. Four states, no action at any of them.
Haddon-Cave's overall verdict on the document is quoted often and deserves to be:
a lamentable job from start to finish. It was riddled with errors. It missed the key dangers.
The Nimrod Review, 2009, on the Nimrod Safety Case
If you run a hazard log, that sequence should be uncomfortable reading, because every hazard log has open items in it. Open is not a failure state. It is the normal condition of work in progress. The failure is having no mechanism that distinguishes an open item which is waiting on a test result from an open item which is the one that kills you.
Two sentences that stopped being true
Underneath the organizational failure sit two specific technical errors. Neither was wrong when it was written. Both became wrong later, because something elsewhere in the aircraft changed and nothing carried the change across.
The first is a wrong operating state. The safety case recorded that the Cross-Feed duct was pressurized only during engine start. That had been true in 1969. It stopped being true in 1979, when the Supplementary Cooling Pack began drawing from it, and the Review notes the case did not take into account the lengthy periods the duct can be pressurized, at a working temperature of up to 420 degrees Celsius, when feeding the SCP.
Read as an engineer rather than as a reader. A duct that is hot only during engine start is a transient. The fuel system has to coincide with a short, identifiable window for anything to happen, and you can argue the probability of that coincidence. A duct that is hot whenever the cooling pack runs is a permanent condition. There is no coincidence left to argue about. Any leak, at any time, finds a hot surface waiting.
One sentence moved the hazard from a sequence of events to a standing condition, and the analysis never noticed because the sentence lived in the Cross-Feed duct's description and the change that invalidated it lived in the cooling pack's.
The second is a credited barrier that did not exist. For the hazards in Zone 6, the safety case recorded fire detection and suppression as mitigation. The Review states flatly that neither existed within Zone 6.
This one is worse, because it is not a judgment that turned out wrong. It is a statement of fact about the aircraft that was not true, and it was load-bearing. Strike it out and the risk cannot be argued down, because nothing is standing between the hazard and the outcome. The argument held together only because nobody checked whether the thing it leaned on was installed.
No single analysis failed
It is tempting to look for the one analysis that was missing, because that would be a tidy conclusion and an easy thing to sell against. It is not what happened. The pieces were there. There was a hazard log, and the hazard was in it with a number. There was a zonal assessment covering Zone 6, which is why we know what it credited as mitigation. There was a review chain with a contractor, a customer and an independent advisor.
What was missing was anything joining them up.
Consider how the three facts needed to see this coming were distributed. The geometry, that a hot duct and fuel pipes share the starboard No. 7 Tank Dry Bay, belonged to the installation. The operating state, that the duct is hot for long periods rather than briefly at engine start, belonged to the cooling pack fitted ten years later. The mitigation, that fire detection and suppression would contain anything that started, belonged to the zonal assessment, and was not true of that zone. Three facts, three owners, three different decades. Each one is individually unremarkable. Only together do they describe an aircraft that will burn.
This is what system safety is actually for, and it is why the discipline carries the word system. The functional hazard assessment follows the functions. The fault tree follows the architecture. The failure modes analysis follows the parts list. The zonal assessment follows the geometry. The particular risks analysis follows the events you take as certain. Each of those is a different projection of the same aircraft, and the safety of the aircraft is not a property of any one of them. It is a property of whether they agree.
On XV230 they did not agree, and nothing was built to notice. The duct's description said one thing about its duty cycle and the cooling pack's design said another. The zonal assessment credited equipment the aircraft did not carry. The hazard log held H73 in a state that implied someone was working on it when nobody was. Each document was internally consistent. The set was not, and consistency across the set is the only thing that would have mattered.
Haddon-Cave's phrase for the design history applies just as well to the analysis of it, weaknesses weaving together over time. The design drifted apart from its own description, in small increments, each of them signed for.
The Review's finding on scale is worth sitting with before moving on. No more than 0.3 of a litre of fuel, it states, would have been required to sustain a fire large enough to disrupt other elements of the fuel system in the starboard No. 7 Tank Dry Bay. Not a rupture. Not a catastrophic failure of anything. A third of a litre, in a bay where twenty years of individually sensible decisions had quietly arranged for it to meet something hot.
Nobody read the reports
It would be comfortable to conclude that the analysis was simply too hard. It was not. The Review's findings on how the document was produced are brutal, and they are about reading rather than engineering.
BAE Systems' first two phases were, in the Review's words, poorly planned, poorly managed and poorly executed, with work rushed and corners cut. At the handover meetings in 2004 the Review found that BAE Systems gave the misleading impression that the task had been properly completed.
QinetiQ, the independent advisor, failed to clarify its role at any stage, sent someone inadequately briefed to the critical handover meeting, and failed to read the BAE Systems reports or otherwise check BAE Systems' work properly.
The Nimrod IPT inappropriately delegated project management to a relatively junior person without adequate oversight or supervision, failed to act as an intelligent customer at any stage, failed to read the reports carefully, failed to follow its own safety management plan, and signed off BAE Systems' work in circumstances the Review describes as manifestly inappropriate.
Three organizations, two of them there specifically to check, and the controlling document passed through all of them without being read properly. The Review identifies why, and it is the most transferable sentence in the whole report:
a widespread assumption by those involved that the Nimrod was ‘safe anyway’
The Nimrod Review, 2009
The aircraft had flown for thirty years without catching fire. Everyone knew it was safe. The safety case was therefore a document to be produced rather than an analysis to be performed, and the Review says it became, in its words, essentially a paperwork and tick-box exercise.
There is a hard lesson in that for anyone selling or buying analysis tooling, and we would rather say it than skirt it. A review that consists of one person reading another person's prose is a review that can be skipped, and when it is skipped nothing downstream notices. That is not a failure of diligence that better people would have avoided. It is a property of the method. The only checks that survive schedule pressure are the ones that are computed, because a computed check does not get tired, does not assume the aircraft is safe anyway, and produces the same answer whoever runs it. Determinism is not an elegance argument. It is what makes a check survive the week before a deadline.
Why it stays relevant
XV230 is not a story about an old airframe or a defense procurement culture, though it is partly both and the Review spends many pages on the second. Strip those away and the mechanism is ordinary, and it is waiting in any program being modified over time.
A system is added. It changes the operating state of a system that already exists, in a compartment neither team is thinking about. The paperwork describing the original system is now wrong, and nothing connects the change to the sentence it invalidated. Years later a third change puts a new source of fluid into the same space. No single person ever holds all three facts at once, because no single document contains them.
That is a records problem wearing an engineering costume, and it is the normal condition of any aircraft that stays in service long enough to be modified. The fix is not more diligence, because diligence is exactly what runs out first. It is that the aircraft and its analysis have to be the same object, so that changing one re-evaluates the other without anyone remembering to ask. A duct whose duty cycle changes should change every finding that depends on its duty cycle, in the same pass, the same day, wherever those findings happen to live.
The 1998 Nimrod report, eight years before the accident, warned of the conflict between ever-reducing resources and increasing demands, and called for management to be closely attuned to the threat to safe standards. Somebody saw it coming and wrote that down too. It went the same way as Hazard H73.
What they recommended, and what it asks of anyone writing one
The Review did not conclude that safety cases should be abandoned. It concluded that the form they had taken was the problem. Its recommendations were that they should be made more focused, proportionate and relevant, that the work should be brought back in-house rather than contracted out and signed for, and,
tellingly, that they should be renamed Risk Cases, so that the word in the title describes the thing being managed rather than the outcome being assumed.
That last point is not cosmetic. A document called a safety case announces its conclusion in its own name. Everyone who opens it already knows how it ends. A document called a risk case announces an open question.
Underneath the renaming is a harder requirement. A safety case is supposed to be an argument: here is the claim, here is the evidence, here is why the evidence supports the claim. What the Nimrod Safety Case had become was a volume. Hazards enumerated, sections completed, boxes filled, four years of work, and no thread you could follow from a claim about Zone 6 back to the physical fact that there was no suppression system in it.
The test is simple and uncomfortable. Pick any mitigation credited anywhere in your safety case. Can you get from that credit to the thing itself, the part number, the installation, the test that proves it works, without asking a person? If the chain runs through somebody's memory, it is not an argument. It is an assertion with references.
What the Review actually produced
It is worth saying what happened next, because the Review was not filed and forgotten.
The Nimrod MR2 was withdrawn from service in March 2010. The MRA4 that was to replace it was cancelled on 19 October 2010 in the Strategic Defence and Security Review. And on 1 April 2010, in response to Haddon-Cave's recommendations, the Ministry of Defence established the Military Aviation Authority, a single regulator responsible for air safety across all branches of the British armed forces, later folded into the Defence Safety Authority.
Read that as an engineer. The Review did not conclude that the safety case needed a better template, or more reviewers, or a longer checklist. It concluded that the organization which produced the document could not be trusted to regulate itself, and a separate regulator was created. That is an extraordinarily expensive answer, and it is the one an independent judge reached after reading everything.
Three questions worth asking on Monday
None of this is useful unless it turns into something you can do. Three questions, each one aimed at a specific thing that went wrong on XV230, and each one answerable this week on your own program.
One. Pick any mitigation your safety case credits, at random. Can you get from that credit to the physical thing, the part, the installation, the test that shows it works, without asking a person? Zone 6 credited fire detection and suppression that was not installed in Zone 6, and the argument held because nobody followed the chain to the end.
Two. List every hazard whose status has not changed in twelve months, and name the person doing the work on each. If you cannot name them, the status is not a status, it is a hope. H73 sat Open and Unclassified while the aircraft kept flying, and the word Open implied that somebody was working on it.
Three. Take your most recent modification and write down which analyses it should have invalidated. If that list is empty, either the modification genuinely changed nothing, or nobody checked. The cooling pack changed the duty cycle of a duct that lived in another system's drawings, and nothing in the process connected the two.
If those three questions are uncomfortable to answer, that is the finding. It is the same finding on most programs, and it has nothing to do with how good the engineers are.
What we are and are not claiming
We are not claiming that software would have saved XV230. It would be a cheap thing to say and it would not be true. The Review is clear that the deeper causes were organizational: financial pressure, a dilution of the airworthiness regime, and a shift in priorities toward business and financial targets at the expense of safety. It names individuals. No tool fixes any of that, and a tool in that environment would have been clicked through the same way the reports were skimmed.
The narrower claim is the one we will stand behind. Every fact needed to see this accident coming was written down somewhere by somebody. What did not exist was anything that held them in the same place at the same time, so that a change to one would disturb the others. That is not a judgment call and it is not a question of diligence. It is a question of whether the analysis lives as a connected model or as a set of documents that agree only for as long as nobody changes anything. When it is a model, a modification to one system re-evaluates every finding that depends on it, in the same pass, on the day it is made. When it is documents, the aircraft and its description drift apart quietly, and the drift is invisible until something burns.
Hazard H73 was on the list. That is the part worth carrying away. The analysis is not finished when the hazard has a number. It is finished when the hazard has an answer.
We build the tooling for this, and we do the analysis itself. If you are building an aircraft and the safety work is not keeping pace with the design, we are happy to look at it with you.
Sources. All factual material is from the published public record.
The Nimrod Review: an independent review into the broader issues surrounding the loss of the RAF Nimrod MR2 Aircraft XV230 in Afghanistan in 2006, Charles Haddon-Cave QC, HC 1025, published 28 October 2009, London: The Stationery Office. Crown copyright, reproduced under the Open Government Licence.
Royal Air Force Board of Inquiry into the loss of Nimrod MR2 XV230, Ministry of Defence, 2007.
2006 Royal Air Force Nimrod crash, for the casualty breakdown by service and XV230's entry into service.
Quotations are short extracts attributed to the Review. Every figure, temperature, clock time and percentage in this article is as stated in the Review. Where the Review gives no figure, none is given here. The illustration is our own and is schematic.
See it on your own program
Fault trees and requirements generated deterministically from your architecture, common cause worked out on your model, every number traceable.
More from Safety Lab Aero
- October 19, 2026Air France 4590: the words were "sufficiently low"
- October 12, 2026737 MAX: the number that changed and the analysis that didn't
- October 6, 2026United 232: the word was independent
- September 28, 2026TWA 800: two things nobody drew together