What to do About Creeping Change

A new hazard identification methodology can identify creeping changes, potentially averting catastrophic consequences

ON the morning of 2 September 2006, RAF Nimrod XV230, crewed by 14 service personnel, was performing routine aerial reconnaissance over Afghanistan’s Helmand province to support ground-based NATO and Afghani troops. At 11:11, approximately 90 seconds after completion of air-to-air refuelling, smoke and flames were observed emerging from the engines on the right-hand side of the aircraft. At 11:17 Nimrod XV230 exploded.

This tragic incident, and many others – including the explosion at BP’s Texas City oil refinery, the King’s Cross Underground fire; and the loss of the space shuttle Columbia – may be partly or wholly attributable to a phenomenon known as “creeping change”.

Creeping change has only recently been recognised as a significant contributor to major incidents. It is the accumulation of small changes which often go unnoticed, but which over time can ultimately add up to a significant change. Due to their gradual nature, hazard identification or risk assessment studies are often not performed.

The fate of the RAF Nimrod clearly illustrates how a series of tiny, individual changes that are either ignored or become accepted as ‘the norm’ over time can lead to devastating consequences. Historically, small fuel leaks on larger and older aircraft were viewed as inevitable and such aircraft are designed to be ‘leak tolerant’, even though it is impossible to control all ignition sources. However, between 1983 and 2006 there was a four-fold increase in the number of fuel leaks on Nimrod XV230. This increase happened gradually over 23 years, with each
individual leak viewed as a separate incident that, in itself, wasn’t considered safety critical. Ultimately, the accumulation of fuel leaks that had previously gone unnoticed resulted in the ignition of a fire that could not be controlled, and subsequent catastrophic explosion.