The Nimrod Review - Official Documents

The Nimrod Review
10A.15
194
The essential aim of the NSC was straightforward, as the Nimrod IPT explained to BAE Systems at an early
meeting on 1 August 2001: “A Safety Case should be a safety argument which highlights risks.”
4 October 2001: Internal BAE Systems meeting
10A.16
10A.17
On 4 October 2001, an internal BAE Systems meeting was held at Warton to discuss the requirements of PDS
Task AV(PDS)814. 12 The file note of that meeting13 records a number of points of discussion. First, the MOD
were looking to spend only c. £100,000 – £200,000 over a period of six months on the NSC, whereas the
Harrier ‘Safety Case’ cost £3 million and took over two years. This apparent concern as to the limited budget
did not seem to be taken further. Second, it was agreed that BAE Systems should assist the MOD to develop
‘strategies’ for the development of the NSC. Third, it was agreed that BAE Systems should suggest to the
MOD that the PDS Task ought to be re-written to read: “Construct the explicit Safety Case by documenting
the Implicit Safety Case, using the Strategy developed in 1a above.” This amendment was never, in fact,
made; but it does encapsulate BAE Systems’ essential (flawed) approach to the task (see further below).
Fourth, hazards with ‘seemingly unacceptable’ Hazard Risk Indices could be considered ‘acceptable’ based
on 20 years historical evidence ‘as per the Harrier Safety Case’. Fifth, it ‘may be possible’ to use the Nimrod
MRA4 Hazard Log and Accident Model as a starting point for the NSC.
Three of these suggestions are of particular concern, and bear the seeds of the flawed approach to the NSC
adopted by BAE Systems which was subsequently to bedevil its production:
10A.17.1 First, the suggestion that the PDS Task ought to be re-written to read “Construct the explicit
Safety Case by documenting the Implicit Safety Case...” 14 is illuminating. It indicates that, from
the very beginning, BAE Systems viewed the process of constructing an “explicit” Safety Case
as one of just documenting the “implicit” Safety Case, i.e. it was essentially a documentary or
paperwork exercise, in which the hazards were more theoretical than real, the object being
merely to populate the ‘CASSANDRA’ database. 15
10A.17.2 Second, the suggestion that hazards with “seemingly unacceptable” Hazard Risk Indices could
nevertheless “be considered for acceptance based on 20 years historical evidence, as per Harrier
Safety Case”, gives cause for concern. It indicates a flawed mindset for legacy aircraft: ‘if it has not
happened in the past, it is unlikely to happen in the future’. Further, as will be seen, the Nimrod
fleet did not have sufficient total flight hours to provide a satisfactory historical incident base.
10A.17.3 Third, the suggestion that it might be possible to use the Nimrod MRA4 Hazard Log as a “starting
point” for a Safety Case for the MR2 and R1 was misconceived. The Nimrod MRA4 was a new
build prototype. It was based on the Nimrod fuselage but was essentially a new aircraft. Its
systems had little in common with the MR2 and R1 and it was unlikely to prove a reliable basis
for a safety case for its 30-year-old predecessors (as, indeed, Chris Lowe of BAE Systems himself
later acknowledged). 16
9 October 2001: QinetiQ Task Review Meeting
10A.18
17 At a QinetiQ Task Review Meeting (TRM) on 9 October 2001, it was suggested that the Nimrod IPT might
task QinetiQ to review the draft Nimrod SMP and take on the role of an “Independent Safety Auditor”.
An “Independent Safety Auditor” was defined in Defence Standard (Def-Stan) 00-56 (Part 1)/3 Annex A
(Definitions), dated 19 December 2004 as:
12 BAE Systems Task No. 16-3151.
13 File Note written by the Airworthiness/Regulations Manager – FSTA, 4 October 2001.
14 Strategy item 1c on the PDS Task AV(PDS)814.
15 Cassandra (´ ) was the beautiful daughter of King Priam and Queen Hecuba of Troy. Apollo granted her the gift of prophecy but, when
she spurned his love, he placed upon her the curse that no-one would ever believe her predictions.
16 At the First PSWG Meeting on 18 March 2003.
17 QinetiQ Task Review Meetings were held regularly (mostly quarterly) between QinetiQ and Nimrod IPT representatives at Boscombe Down to
monitor QinetiQ’s numerous on-going tasks for the Nimrod IPT.