The Nimrod Review - Official Documents

Chapter 10A – Nimrod Safety Case: The Facts (Phases 1 and 2)
Where suitable data is available the assessment of risk severity and probability levels will
be evaluated numerically. Where this is not possible the risk severity and probability levels
will be evaluated qualitatively by best engineering judgment combined with in-service
experience.
In these cases the severity and probability criteria will be estimated by reference to
descriptive equivalents (e.g. Remote, improbable etc.) as defined within ES(AIR)BP1201
Issue 2 and the resultant hazard risk index will be accordingly annotated “qualitative” in
the CASSANDRA hazard log. The source of mitigating evidence utilized within this work
will be documented against the following check list for each hazard:
(a) Design configuration e.g. redundancy features in system
(b) Test Reports (BAE SYSTEMS, Vendor, QinetiQ etc)
(c) Technical analysis reports
(d) Maintenance/Operating Procedures & appropriate Training
(e) Service history i.e. Incident & Fault Reports, RAF IRDS data (assumed to be
provided GFE)
For hazards able to be mitigated by existing evidence to a level that is ALARP these
(subject to acceptance by the NIM(ES)IPT) be classed as “Managed” in the CASSANDRA
hazard log. For hazards which mitigating evidence is not readily available then these will
be classed as “Open” in the CASSANDRA hazard log and a statement issued to NIM(ES)
IPT recommending further action/work to enable the hazard to become “Managed”. It is
understood that such additional work is outside the scope of this programme and will be
completed under separate tasking.” (emphasis added)
10A.95 In my view, the terms of BAE Systems’ “Statement of Work” were tolerably clear: (1) BAE Systems agreed to
assess or estimate “the risk severity and the probability levels” of each hazard identified in Phase 1. This was to
be done either quantitatively (if suitable data was available) or qualitatively (using “best engineering judgment
combined with in-service experience” and the descriptive equivalents in BP1201, e.g.“Remote”, “Improbable”
etc.); (2) In order to carry out this evaluation, BAE Systems would conduct an analysis of each hazard utilising
each of the five categories of documents in the checklist; (3) These equated to five areas which would be
considered in the analysis of whether each hazard could be mitigated to ALARP, namely Design, Testing,
Technical Analysis, Procedures/Training and Service History; 56 and (4) Where it was not possible to mitigate a
hazard to ALARP because the mitigating evidence was not “readily available”, the hazard would be classed as
“Open” and further work would be recommended which would be outside the scope of the contract.
10A.96
BAE Systems’ Phase 2 Proposal document rated the risk of there being insufficient evidence to mitigate the
risks to ALARP as “Medium-High”; but went on to reassure that hazards left open would be “highlighted” to
the Nimrod IPT as soon as possible so that appropriate action could be taken in accordance with the Nimrod
SMP. 57 It will be recalled that the Proposal was made against a background where BAE Systems had said that
it had a “high level of confidence” that it could complete the NSC task in a cost effective manner. Whilst there
was said to be a “Medium-High” risk of there being insufficient mitigation evidence to manage all the hazards
to ALARP, at no stage was there any suggestion that the number of hazards left open would be significant.
The risk that the relevant specialist engineer might not be available to support the NSC programme full-time
due to modifications etc. was, however, rated as “High”. This was due in part to the increased operational
demands on the Nimrod as a result of the various conflicts in which the fleet was engaged. The Gantt Chart
which was attached indicated a completion date of May 2004.
BAE Systems’ man-hours estimate
10A.97 The risk of the man-hours estimate for Phase 2 being incorrect was rated as “Low-Medium” on the basis
that a ‘best’ man-hour estimate had been produced against the above statement of work by each specialist
department. The man-hours estimate in fact proved to be inadequate by a considerable margin. Richard
56 As Chris Lowe confirmed to QinetiQ at a meeting on 19 May 2003.
57 BAE Proposal to Nimrod (ES) IPT (November 2003), paragraph 5.0.
211