The Nimrod Review - Official Documents

10B.67
10B.68
Chapter 10B – Nimrod Safety Case: The Facts (Third Phase)
CASSANDRA Hazard Log following receipt of the baseline safety case from BAE Systems” and agreed with
the status of the hazards set by BAE Systems and enclosed the evidence to set the rest in the form of Annex A
attached to Frank Walsh’s letter of 1 February 2005, save for three hazards (Hazards H86, H87 and A6) which
required further work (see below). There seems little doubt that a copy of Annex A (expressly referenced in
the letter) was in fact attached to the letter. The letter concluded:“BAE Systems are to accept this letter as the
approval to set the CASSANDRA hazards in accordance with Reference A and the status of all hazards and
accidents with the exception of H86, H87 and A6 to managed”.
It is, on the face of it, puzzling that this letter came to be written and signed at all at this stage. The letter
was, on any view, inappropriate and premature because the risks listed could not properly be considered
as “Managed” at this stage. All 33 hazards listed in Annex A were potentially “Catastrophic” risks. The 21
“Interacting systems hazards”, together with three others listed in Annex A, were given a PCS of “Remote”.
These 24 hazards were, therefore, to be classified as category ‘B’ or “Undesirable” risks in the HRI, i.e. they
required management action to introduce control measures and “shall only be acceptable once reduced
to ALARP”. There were seven hazards in Annex A which had been given a PCS of “Improbable” and were,
therefore, properly to be classified as category ‘C’ or “Tolerable” risks, i.e. tolerable only if further risk reduction
was “impracticable or……grossly disproportionate”. Furthermore, there were two hazards in Annex A (H86
and H87) which had been given a PCS of “Occasional” and were, therefore, properly classified as category
‘A’ or “Unacceptable” risks on the HRI, i.e. requiring “Urgent management action since such risk cannot be
justified save in extraordinary circumstances”. The Nimrod SMP provided that, in relation to category ‘A’ or
‘B’ hazards, it was (only) when control and mitigation actions had been approved by the PE/IPTL and where
the PE/IPTL “…is satisfied that the actions are progressing to plan”, that he/she could change a hazard from
“Approved” to “Managed”. The two category ‘A’ risks (Hazards H86 and H87) were expressly left at the
“Approved” stage. However, the 24 category ‘B’ risks were described in the letter as “Managed”. There is no
evidence, however, of any approved management ‘actions’ being in progress to introduce further mitigating
control measures for any of these 24 hazards. Accordingly, these 24 hazards should not properly have been
referred to as “Managed” in any relevant sense. (The same is true for the 16 other hazards which BAE Systems
had also classified as “Remote” in Annex B to the BLSC Phase 2, properly classified as ‘B’ or “Undesirable”).
There is, however, an air of finality about the letter of 22 February 2005 which suggests that Frank Walsh and
George Baber considered the management of all but two of the hazards in Annex A as finished. They were
wrong about this.
In these circumstances, two questions arise. First, why did Frank Walsh draft the letter in this way and attach
Annex A? The most likely explanation is that he did not know what he was doing. He was simply out of his
depth. He had never done this sort of exercise before, having never come across a Safety Case or Hazard Log
of this type. He had had little or no training or guidance as to how to go about it or the level of rigour that
was required. Second, why did George Baber sign the letter? The answer is almost certainly simply because
it was put in front of him by a junior officer whom he assumed did know what he was doing, and he did not
check that it was correct. I discuss these issues of responsibility in more detail in Chapter 11.
16 March 2005: Frank Walsh ‘manages’ remaining hazards down to ‘Improbable’
10B.69
10B.70
At some stage, Frank Walsh realised that, notwithstanding the letter of 22 February 2005 purporting to give
BAE Systems approval to set the status of the vast majority of the hazards listed in Annex A as “Managed” in
CASSANDRA, it remained necessary to manage a large proportion of hazards in Annex A to acceptable levels,
i.e. an HRI of ‘C’. There were a total of 24 Class A and B hazards in Annex A: 22 hazards (including Hazard
H73) had been ascribed a PCS of “Remote”, and 2 hazards had been ascribed a PCS of “Occasional”. The
eight hazards which had been ascribed a PCS of “Improbable” fell into Class C category and were, therefore,
the only ones which could properly be set as “Managed”. Frank Walsh clearly recognised that the remainder
could not remain as class ‘A’ or ‘B’ risks.
Precisely how and when Frank Walsh came to this realisation again is not clear. It may be that he picked this
up during a conversation with someone at BAE Systems. In any event, at some stage on or before 16 March
2005, he drew up a revised version of Annex A. He admitted in interview that he prepared this document
255