The Nimrod Review - Official Documents

1 March 2004: BAE Systems strategy meeting
Chapter 10A – Nimrod Safety Case: The Facts (Phases 1 and 2)
10A.110 Concern at the lack of clarity of approach was voiced by Eric Prince at the first Phase 2 internal Baseline Safety
Case (BLSC) Design Review meeting on 1 March 2004, attended by those personnel who were tasked to carry
it out. It should be noted that the minutes of that meeting also record a concern as to sensitivities “after an
accident”.
10A.111 The person in the best position to determine the approach to be employed was Chris Lowe. He was the
head of the Airworthiness Department and in overall charge of drawing together the technical aspects of the
NSC. At the initial BAE Systems’ NSC team meeting on 1 March 2004, however, he gave advice of only a very
general nature. He explained that, whilst there were potentially two million fire/explosion risks, there were
only eight or nine zones where fire risks were “high”, including the cabin cockpit, underfloor, engine bays
and the bomb bay. He also seems to have assumed, at least initially, that the majority of relevant mitigation
would be found in documents such as the Declaration of Design Performance (DDP). 60 This subsequently
proved to be mistaken. Chris Lowe was also noted to have said at the meeting that even where there was a
source of ignition such as a transformer next to a fuel pipe, it might be considered acceptably safe in service
after 30 years. He said that a cost/benefit exercise needed to be carried out in order to determine whether
further analysis was necessary, but it was not clear that this was ever done.
Witness K [BAE Systems]’s ideas
10A.112 Present at this initial meeting was Witness K [BAE Systems], a meticulous, hardworking and able employee.
He clearly did not think that a limited trawl for certification, qualification and test documents was enough to
amount to a Safety Case. Following the meeting on 1 March 2004, off his own bat, he produced an outline
of the process which he thought should be followed, namely, first, searches of: (1) the local archive; (2) the
deep archive; (3) the microfilm archive; (4) the IPT databases for in-service failure rates and modes; (5) the
fault investigations for relevant design reports; (6) the drawings database; (7) the AP technical publications;
and (8) the PDS task reports, the fruits of which would provide the basis for, second, a “Technical Report”
on each hazard which would comprise argument and methodology identifying and addressing all hazards
and showing compliance with all appropriate standards. On 9 March 2004 he sent his ideas in the form of
slides to Chris Lowe and Witness C [BAE Systems] in the Airworthiness Department and asked for guidance
on whether a technical report format he had received from Witness P [BAE Systems] complied with the
Airworthiness Department’s requirements. He received by return an e-mail from Chris Lowe stating that Mech
Systems’ job was confined to “digging out” relevant reports and the safety case argument should be left to
him, Chris Lowe, to write. These were the first seeds of disagreement between Witness K [BAE Systems] and
Chris Lowe which subsequently led to serious tensions in the team.
Man-hours estimate proved inadequate
10A.113 Meanwhile, Witness K [BAE Systems] had set about carrying out his first hazard mitigation exercise in relation
to the airbrakes (Hazard H8). His early report to an internal meeting on 10 March 2004 was that the task
might take him 40 man-hours, of which two days were dedicated to the archive search. The original estimate
by Mech Systems allowed however, for only 650 hours to be spent analysing 120 hazards i.e. about five manhours
per hazard. If the 40 hours was repeated for every hazard this would inevitably “blow the budget”. 61
10A.114 It transpired, therefore, that the man-hours estimates had been calculated on an incorrect basis. Mech
Systems had given a man-hours estimate on the basis of a document search only, 62 not a detailed analysis, 63
nor, for instance, producing “a design configuration statement/complete set of test reports and in depth list
of all relevant maintenance and operating procedures or service history.” This was Witness K [BAE Systems]
and Eric Prince’s view at the time. Eric Prince in interview with the Review sought to deny this; but the
60 See Witness K [BAE Systems]’s manuscript notes of the meeting of 1 March 2004.
61 See Witness Q [BAE Systems]’s subsequent note.
62 Not including a search of the drawings archive (see the statement by Eric Prince at the meeting of 2 April 2004).
63 See internal e-mail dated 11 March 2004 from Witness K [BAE Systems] to Eric Prince.
215