The Nimrod Review - Official Documents

The Nimrod Review
234
that there were a large number of “Unclassified” hazards, including Hazard H54. It is not clear, however, how
long these pages were posted on the screen for or whether those watching could or would have appreciated
or been able to count the number of “Unclassified” hazards. Witness K [BAE Systems]’s notes record an
explanation being given that “Unclassified” meant insufficient evidence to make a probability assessment.
“Approved” meant that the hazard was formally recognised as a hazard and properly included in the Hazard
Log. At some stage, Chris Lowe assisted Witness C [BAE Systems] by posting up on the screen the draft of
the ‘Recommendation Table’ which was to become Annex C to the BLSC Report. Witness K [BAE Systems]
said in evidence: “I think that I would have remembered if we had gone through hazards line-by-line. I would
have made a note.”
10A.200 Witness C [BAE Systems] said in interview that he recalled sending out a copy of the ‘Post Mitigation
Probability’ table to Frank Walsh before the Customer Acceptance Conference meeting. His recollection is
mistaken. A search of the e-mail records shows no such e-mail was sent. Nor does it appear that hard copies
were handed out at the meeting itself, unlike Richard Oldfield and Chris Lowe’s PowerPoint presentations
which did form hand-outs at the meeting.
Chris Lowe’s “review” of the Draft BLSC Report
10A.201 Witness K [BAE Systems]’s notes show that Chris Lowe also gave a further lengthy presentation after his
PowerPoint presentation on safety cases on the first morning. Curiously, the formal minutes make no
reference to this. His presentation comprised a “review” of the draft BLSC Report. It seems probable that
he used slides. His review was, however, limited to the text of the general parts of the BLSC Report, i.e.
the text of Chapters 1 to 12. These chapters merely contained general information about the objectives,
scope, definition, methodology of the NSC etc. but no detail as to the actual findings. In his presentation,
Chris Lowe highlighted certain aspects of the text, including the structure of the safety case argument, and
explained how the ‘Top Level Goal’ was “demonstrated as being met”. The text of paragraph 9.2.5 of the
BLSC stated in terms:
10A.202
“All identified hazards were assessed for initial (pre-mitigation) risk imposed, and
appropriate mitigation of those risks identified by the relevant DA engineering disciplines.
Wherever possible, hazards have been shown as having been eliminated by design. Where
this was not possible, towards mitigation of those hazards to a level that is considered
...ALARP, the following evidence was primarily considered...”
78 Then listed were the five categories of evidence set out in the Phase 2 Proposal. The text then went on:
“Where this approach was not considered appropriate or complete, the following additional
mitigating evidence has, where available and applicable, been presented...”.
10A.203 Then listed were a further nine categories of evidence, including e.g. ground, flight and EMC/EMI reports,
which (it is presumed) were to be found in the archives. It is far from clear, however, as to how much use was
in fact made of this material for mitigation purposes. Paragraph 9.2.6 of the text then explained that each
identified hazard had been “assessed after mitigation” to determine its “hazard severity” and “qualitative
probability” by reference to the HRI in order to determine the “Acceptability of Risk towards decision having
achieved ALARP”; and added that where existing mitigation was “inadequate or unavailable”, the BLSC
Report contained “appropriate recommendations for further corrective/ mitigation evidence”. Paragraph
9.2.8 contained a comprehensive table listing all 105 functional and zonal hazards. He commented that
probabilities had been determined by looking at service records and using “best engineering judgment”. His
presentation stopped at paragraph 12.0.
10A.204 Significantly, his presentation did not cover or touch upon the contents of the Executive Summary, Conclusion,
or Appendices (which apparently had not been finalised). It appears that, at no stage did he tell his audience
what was likely to be contained in the Executive Summary and Conclusion of the final version of the BLSC
Reports. He did not mention that 43 out of 99 hazards were to be left “Open” and a significant proportion
“Unclassified”.
78 (1) Design configuration and established design best practices; (2) historic service reliability/ experience of system; (3) periodic test/inspection/
maintenance procedures; (4) crew training and flight operational procedures; and (5) maintenance/service personnel training.