The Nimrod Review - Official Documents

10A.149
Chapter 10A – Nimrod Safety Case: The Facts (Phases 1 and 2)
Unfortunately, neither QinetiQ nor the Nimrod IPT checked to see whether all the risk mitigation evidence
was included in the final safety case reports delivered by BAE Systems. In fact, BAE Systems included none.
Early July 2005: Mech Systems only 20% completed
10A.150 On 5 July 2004, Witness K [BAE Systems] reported to Eric Prince that six out of 20 Functional Pro-Formas and
three out of 33 Zonal Pro-Formas had been completed. He estimated that Mech Systems’ task was only about
20% complete and that a further nine weeks of manpower would be required to complete the remaining 14
Functional Pro-Formas and a further 17 weeks of manpower would be required to complete the remaining
30 Zonal Pro-Formas. In an attempt to address the resource problem, Eric Prince arranged for a further BAE
Systems engineer, Witness R [BAE Systems], to be brought in from Woodford to help Witness K [BAE Systems]
with some of the load in Mech Systems. Witness R [BAE Systems] worked on the Mech Systems Pro-Formas.
It was Witness R [BAE Systems] who was to complete the Mech Systems Pro-Forma for Hazard H73.
10A.151 On 7 July 2004, a Safety Case Review Meeting took place. Witness K [BAE Systems] gave his status report on
behalf of Mech Systems. It was reported that, in total, only 41 out of 104 hazards had been returned and 63
still remained to be done. The ‘best’ case scenario for completion was the second week of August using 600
hours and the ‘worst’ case scenario was the end of August using 900 hours. A major problem was summer
holidays.
10A.152 On 8 July 2004, a TTRO Engineering Integration Meeting took place. Witness B [BAE Systems] was not present
so the meeting was chaired by Richard Oldfield. The NSC does not appear to have featured significantly at
this meeting save for a mention that “Resource reviewed and new estimate to completion issued.”
8 July 2004: MRA4 Generic Data obtained to sentence hazards
10A.153 At an internal BAE Systems NSC meeting on 8 July 2004, Witness R [BAE Systems] inquired whether there were
“standard values” which could be used to sentence hazards. Witness S [BAE Systems] of the Airworthiness
Department and Eric Prince said there were and agreed to try to find them. Later the same day, Witness S
[BAE Systems] circulated an e-mail attaching MRA4 generic probability data which he said had been extracted
from the Nimrod MRA4 System Safety Working Practices (Annex K) AWN/NIM/897 Issue 7 (Re 7 Ver 2). He
explained that the significance of this data was that “the Customer has extracted the figures”. The e-mail
was copied to Chris Lowe but neither he, nor anyone else, raised any objection to the use of such MRA4 data
(notwithstanding his earlier rejection of the use of any MRA4 data).
10A.154 The MRA4 generic data (used to make probability assessments in the MRA4 project) gave a standard failure
probability rating for a number of common failure types. A failure of a “fuel pipe and associated coupling”
was ascribed a failure probability of 1E-6, viz:
Failure Type Failure
Probability
…
Hydraulic pipe and associated coupling 1E-6
Fuel pipe and associated coupling 1 E-6
ECS pipe seal 1.5E-7
10A.155 The use of MRA4 generic data to sentence MR2 hazards was inappropriate for the reasons given by Chris
Lowe when the idea was first raised at the Inaugural PSWG Meeting on 18 March 2002, namely because
the two aircraft were “significantly different in roles and systems”. Furthermore, the generic probability given
for a coupling failure was absurdly low: 1E-6 or 10-6 = one-in-million flying hours which equated to one
fuel coupling failure in approximately 66 Nimrod years. Any Nimrod line engineer would have said this was
absurd, if asked. Failures of fuel couplings were not a rare occurrence.
223