The Nimrod Review - Official Documents

Chapter 10A – Nimrod Safety Case: The Facts (Phases 1 and 2)
10A.28 The Feasibility Study explained that the methodology to be employed was the “top level down” approach
considered acceptable for legacy aircraft by BP1201 and the Nimrod SMP. 29 Fault Tree Analysis (FTA) was
recommended. Goal Structured Notation (GSN) (an illustrative technique which provides a useful structured
way of presenting a complex safety argument) 30 would be used to demonstrate the achievement of the
relevant goals supported by strategies and evidence. The key goals were:
10A.29
Top level goal: “The aircraft is deemed acceptably safe to operate and maintain within specified
contexts” (Goal 1);
First sub-goal: “All identified potential safety hazards risks be demonstrated as having been
mitigated to a level that is [ALARP] or eliminated where appropriate” (Goal 2); and
Second sub-goal: “All relevant safety and certification requirements and standards are demonstrated
as having been met” (Goal 3).
The Feasibility Study promised a Baseline Safety Case Report (BLSC Report) which would be a ‘snapshot in
time’ in which “all potential safety hazards will have been identified and appropriately addressed”. 31 The substrategy
to achieve the first sub-goal included “Each potential safety hazard mitigated to a level of ALARP
or eliminated where possible.” 32 A three-stage ‘iterative’ process33 was envisaged, which Witness A [BAE
Systems] explained in interview with the Review was to be based on “best engineering judgment”, namely:
(a) identify hazard; (b) quantify and assess hazard risk; and (c) mitigate hazard as necessary.
Warning regarding Nimrod in-service statistical data
10A.30
The Feasibility Study sounded a strong note of caution in relation to the use of statistical data in isolation. It
warned that the small Nimrod fleet size and low statistical population “... lead to relatively low confidence
levels in any statistical data based on in-service failure rates of a unit or system”. 34 Regrettably, this warning
was eventually ignored by BAE Systems itself and the Nimrod IPT, as explained below.
Joint Working Group
10A.31
10A.32
The Feasibility Study recommended the setting up of a Safety Case Working Group jointly composed of BAE
Systems and Nimrod IPT “Specialist Engineers close to both projects”. It was envisaged that the joint Working
Group would meet regularly to ensure joint input into all stages of the Safety Case process, i.e. the identification
of hazards, determining their cause and effect, the mitigation of all hazards and the consequent population
of the hazard log. 35 The setting up of a joint Safety Case Working Group consisting of approximately eight
people “split between BAE Systems and MoD chosen for their genuine specialist knowledge” to carry out the
“identification and addressing of all hazards”, was subsequently highlighted by Chris Lowe at the Inaugural
Nimrod PSWG Meeting on 18 March 2002. 36 Unfortunately, the NSC process turned out to be far from
joint: save for the preparation of the Fault Tree Analysis, BAE Systems did all three stages leading to the NSC
without significantly involving the Nimrod IPT or Nimrod operators. This was a fundamental mistake.
The upbeat tone of BAE Systems’ Feasibility Study would have given the IPT further confidence that BAE
Systems was indeed ready, willing and able to carry out the NSC task as required. It was understandable
that the IPT should have confidence in BAE Systems. It was, after all, the DA for the Nimrod and the Original
Equipment Manufacturer (OEM) for both Nimrod types. It retained ownership of the original certification
for the civil certification for the Comet, and much of the design data and sub-data that was part of the
civil certification. BAE Systems was also carrying out an increasing amount of Nimrod Line 4 (i.e. deep)
29 Ibid, paragraph 2, page 7.
30 www.yellowbook-rail.org.uk/site/events/ybug2007/yellow%20book%20gsn%20presentation%20-%20kelly.ppt
31 Ibid, paragraph 3, page 7.
32 Ibid, paragraph. 6.6
33 Ibid, page 9.
34 Ibid, paragraph 8.1.3.
35 BAE Systems Proposal to Nimrod (ES) IPT – Nimrod Baseline SC (Phase 1) (August 2002) (and see paragraph 10.2 of the Feasibility Study).
36 Chris Lowe’s presentation to the Inaugural Nimrod PSWG Meeting 18 March 2002.
197