The Nimrod Review - Official Documents

The Nimrod Review
14 August 2002: Nimrod IPT confirm BAE Systems to be tasked
10A.46
200
By way of a letter dated 14 August 2002, the Nimrod IPT confirmed its intention in principle to instruct
BAE Systems to go ahead with both Phase 1 and Phase 2 of the NSC programme utilising the CASSANDRA
software tool. 39 (There had been discussion as to the relative merits of CASSANDRA and SMART software
packages as a management tool for the Hazard Log. BAE Systems expressed concerns at the suitability of
CASSANDRA and a preference for SMART and a common Hazard Log database with the VC10. But since
the VC10 IPT had already chosen CASSANDRA, the decision was taken that it should also be used for the
Nimrod. 40 There is no evidence that the choice of software materially affected the quality of the Safety Case
that was eventually produced by BAE Systems.)
14 October 2002: Second PSWG Meeting
10A.47
At the Second PSWG Meeting on 14 October 2002, Chris Lowe and Richard Oldfield gave a presentation on
behalf of BAE Systems on how Phase 1 and 2 of the NSC would be carried out. The meeting was chaired by
George Baber. There were 20 people present, including representatives from the Nimrod IPT and QinetiQ.
November 2002: Fault Tree analysis
10A.48
10A.49
10A.50
The first substantive step in the NSC process was the preparation of a Fault Tree Analysis (FTA) by the joint
NSC Working Group. FTA is a ‘top down’ Boolean logic model that depicts the relationships between specific
events and leads to a final outcome. FTA is a useful and well-known analytical tool and can be used to create
an accident loss model. The software used was ‘Fault Tree Plus’.
The joint Working Group met between 19 and 21 November 2002 at Chadderton and carried out various
workshops. There were three members of the Nimrod IPT team: Witness D [MOD] (an RAF officer in the IPT
as Nim(ES)AV(A)), Witness E [MOD] (then RTSA and an experienced Nimrod pilot), and Witness F [MOD] (an
MOD Civil Servant on the NIM(ES)AV(AV)1 desk)). The BAE Systems team was headed by Chris Lowe. The
joint group, of approximately 12 people, sat together in one room working through the various lines of the
fault tree, which were then documented using Fault Tree Plus. A print out of these fault trees subsequently
formed Annex A to the Preliminary Hazard Identification report provided to the IPT on the completion of
Phase 1. 41 It was invaluable having the various specialists from different disciplines and the designers and
operators discussing the issues together, in the interests of cross-fertilisation and building up a complete
picture of the Nimrod.
The FTA identified five main hazards which could cause the loss of a Nimrod or loss of life, including an
“Uncontrolled Fire/Explosion”:
39 Letter from ES(Air) to Richard Oldfield of BAE Systems re: CASSANDRA Hazard log, dated 14 August 2002.
40 Internal BAE Systems memorandum, dated 24 April 2002.
41 Appendix A to BAE Report MBU-DEF-C-NIM-SC0539. Nimrod Task 26-3244 Equipment Safety Management Nimrod MR MK2 and R Mk1.
Preliminary Hazard Identification Report – Phase 1 Completion (April 2003).