The Nimrod Review - Official Documents

Chapter 9 – Background to Safety Cases
(1) cross-audit by another IPT; (2) D Technical; and (3) Airworthiness Design Requirements and Procedures
(ADRP). 120 Internal audits were to include assessment of compliance with, inter alia, JSP318B, Def-Stan 00-56
and BP1201, and also assessment of risk management, including hazard capture and identification, risk analysis
and identification, and risk control and elimination. The audits that were carried out, however, tended to be of
process rather than product.
The Safety Case and Hazard Log
9.85
As indicated above, the Head of Air Vehicle (Nim(ES)Av) had a pivotal safety role under the SMP. His responsibilities
included acting as “Safety Advisor” and it was Nim(ES)Av who ‘owned’ the Safety Case. He was also the ‘Key
Administrator’ appointed to facilitate implementation of the SMP and to carry out risk assessments and progress
control and mitigation actions for hazards and accidents. 121 In terms of the availability of the Safety Case, the
IPTL was required to ensure that its content, including the Hazard Log, was available to all those who had a
requirement to use it, including the Release to Service Authority (RTSA), members of the PSWG, other IPTLs
responsible for similar platforms, commodity IPTs and unit staff, i.e. the operator. In actual fact, however, the
NSC was never made available to unit staff. Indeed, those at RAF Kinloss were unaware of its very existence until
learning about it after the XV230 accident.
Appointment of Safety Manager in 2003
9.86
9.87
In August 2003, Frank Walsh was appointed to the post of Nimrod Safety Manager (Nim(ES)Safety). He
subsequently amended the SMP to reflect this appointment. The organogram set out above was amended to
insert Nim(ES)Safety as “Safety Advisor” in lieu of Nim(ES)Av. Paragraph 24 of Annex C was also changed so
that the first reference to “Nim(ES)AV” was changed to “Nim(ES)Safety” but the other references remained. This
meant that the job of raising a document to record a decision by the IPTL ex-committee signing off a Category
‘A’ or ‘B’ risk would no longer be carried out by a LOD holder, the Head of AV, but by the more junior Safety
Manager, who was not a LOD holder. This was a significant downgrading of an important step in the safety
process.
As I shall explain in more detail later, it is regrettable that the detailed procedures laid down in the Nimrod SMP
were not followed in relation to the NSC and the sentencing of risks.
Conclusion
9.88
The drawing up of a Safety Case for the Nimrod fleet was mandated by the military regulations in force in 2001.
As I explain in Part II of this Report, Nimrod MR2 and R1 aircraft contained inherent design flaws which gave
rise to serious fire risks. These were precisely the sort of embedded hazards which the Safety Case process was
intended to capture and control. These design flaws should have been identified by the NSC which was drawn
up in the period 2001-2005. They were not. The reasons why not are set out in Chapters 10 and 11.
120 Ibid, Annex D, paragraphs 1, 3, 5 and 7. See further Chapter 12.
121 Ibid, Annex C, paragraph 23.
187