The Nimrod Review - Official Documents

Chapter 10B – Nimrod Safety Case: The Facts (Third Phase)
he was now looking to sentence a total of 33 separate hazards because questions might have been raised as
to why these had not been raised at the Sixth PSWG, where he had identified only a handful. One plausible
scenario is that Frank Walsh, acting on his own initiative, looked up Zone 113 (Aileron Bay) in the AP manual
(which does have a fire detection and suppression system) and, assuming that the same must be the case
for the rest, then simply cut and pasted the same wording it into all 21 of the “Interacting Systems” hazards.
(It is noteworthy that the Zone 113 entry (Hazard H45) appears at the top of page 2 of Annex A and is the
first of the 21 identical “Interacting Systems” Hazards H45-H80). Another possible scenario is that Frank
Walsh did, at some stage, speak to someone on the Airframe Desk, or even to someone at BAE Systems on
the phone, and asked a general question along the lines of: “What sort of measures does the Nimrod have
for preventing fires on board?”, to which he got a general answer: “Proper maintenance and fire detection
and suppression systems” and he then simply applied this across the board. In any event, he clearly did not
frame a series of detailed questions about the fire controls available in each of the 21 zones relating to the
21 “Interacting Systems” Hazards H45 to H80 either orally or in writing. If he had done so, it is likely that he
would have elicited the right answer for all (or at least most) of the zones, at least from the notable experts
on the Airframe Desk.
Second Error: ‘Systems maintained iaw Nimrod maintenance procedures AP101B-0503-1.’
10B.59 The other purported mitigation measure entered in the Control column was “Systems maintained iaw [in
accordance with] Nimrod maintenance procedures AP101B-0503-1”. This should not have been relied upon
as a hazard control measure. It was not a control measure in any relevant sense since proper maintenance of
equipment in accordance with the aircraft Maintenance Manual procedures was assumed, as the Feasibility
Study had made clear from the outset. 10 This assumption was further reiterated in the first line of the Summary
of the Mechanical Systems (Mech Systems) Pro-Forma for Hazard H73: “It is assumed that the aircraft is
maintained in accordance with ADA approved procedures …”. There was, therefore, no sense in which the
maintenance of the aircraft had any part to play as a hazard control measure.
‘Remote’
10B.60
10B.61
In Annex A, Frank Walsh purported to ascribe a ‘Post Control Status’ (PCS) to the 33 hazards which BAE
Systems had originally marked open and “Unclassified in Annex B to the BLSC Phase 2 Report, as follows:
“Occasional” to two hazards, “Remote” to 22 hazards (including Hazard H73), and “Improbable” to eight
hazards. All 21 “Interacting Systems Hazards” were given a PCS of “Remote”, i.e. a probability of 10-5 . The
basis for this has not been easy to divine. The fact that 24 hazards remained at a classification of “Remote”
or above meant that they could not be ‘closed’ but had to be further ‘managed’.
Frank Walsh said in interview that even though in the BLSC Phase 2 Report itself BAE Systems had marked
32 of the 43 “Open” hazards as “Unclassified” (the other 11 “Open” hazards being classed as “Remote”),
he noticed when he went on CASSANDRA that each of the 32 ostensibly “Unclassified” hazards had in fact
been ascribed ‘initial probabilities’ on the database. He said that he decided to use these to populate the
PCS column of the 32 hazards dealt with in Annex A. The pattern is, however, not consistent. The use of the
‘initial probabilities’ appears to have repeated for only 24 out of the 33 hazards in Annex A. If one looks at
the following three of the 21 “Interacting Systems” hazards marked “Remote” in Annex A:
Hazard H45: The historical data on CASSANDRA shows Hazard H45 was first ascribed an initial probability
of “Occasional” on 6 April 2004, with a post probability of “Unclassified”. On 25 August 2004, the post
probability was revised to “Probable”, then “Improbable” on 6 September 2004, before being revised
back to “Unclassified” on 8 September 2004. It was then, changed to “Remote” on 3 February 2005
following the receipt of Frank Walsh’s 1 February 2005 letter.
Hazard H62:
The historical data on CASSANDRA shows that on, 15 April 2004, Hazard H62 was ascribed
an “Initial Probability” of “Occasional” with a post control probability of “Unclassified”. It was not given
a “Post Probability” on CASSANDRA of “Remote” until 3 February 2005, after BAE Systems received
Annex A from Frank Walsh.
10 Feasibility Study, paragraph 6.2.
253