The Nimrod Review - Official Documents

Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
(20) BAE Systems was in breach of contract for: (1) failing to exercise reasonable skill and care;
(2) failing to use appropriate data when sentencing risks; and (3) leaving the NSC task
incomplete.
(21) If BAE Systems had properly planned, managed and carried out the NSC, the risk of a catastrophic
fire in the No. 7 Tank Dry Bay would have been identified, assessed and mitigated to ALARP,
such that the accident which subsequently befell XV230 would have been avoided.
(22) BAE Systems is a company in denial – and its defensive attitude has delayed the Review by
many months.
(23) BAE Systems has failed to live up to its expressed UK ethics 2002 policy of “accountability,
integrity, honesty, openness and respect”.
Detailed analysis and criticisms of BAE Systems
11.15
I analyse and explain each of these criticisms in turn in detail below.
(1) BAE Systems’ attitude to the NSC was flawed from the outset: it assumed that the
Nimrod was ‘safe anyway’ because of its long record and approached the NSC as
essentially a documentary, rather than an analytical, exercise.
Prevailing malaise: flawed assumption that the Nimrod was ‘safe anyway’
11.16
In my judgment, BAE Systems’ attitude to the NSC was fundamentally affected by the prevailing malaise (outlined
above) that, because the Nimrod had operated safely for over 30 years, it could be assumed that the Nimrod
was ‘safe anyway’ and that, therefore, the NSC exercise did not really matter. Thus it was that BAE Systems’
approach to the NSC was flawed and undermined from the outset: it approached the task assuming ‘safety’
and viewed the NSC task as essentially a documentary or paperwork exercise aimed at proving something that
it already knew, i.e. that the Nimrod was safe.
Merely making ‘explicit’ what was ‘implicit’
11.17
8 BAE Systems’ approach involved essentially making ‘explicit’ that which was ‘implicit’, namely. to construct an
‘explicit’ Safety Case by documenting the ‘implicit’ Safety Case. In other words, it viewed its task as being that
of finding the documents to evidence the safety of the aircraft, which could be assumed on the basis of its
30 years’ service record. 9 BAE Systems argued in its written submissions to the Review that “[t]here is nothing
wrong with describing the creation of a Safety Case for a legacy aircraft with a good safety record as an
exercise in making explicit what has previously been implicit”. I disagree. A Safety Case is pointless if it is simply
an exercise in making explicit what is (assumed to be) implicit, i.e. documenting the past. As the Zonal Hazard
Analysis course which the BAE Systems employees attended highlighted, “system safety emphasises analysis
rather than past experience and standards” (emphasis added).
‘Archaeological exercise’
11.18
BAE Systems initially embarked upon what is best described as an ‘archaeological’ exercise with regard to the
original certification of the aircraft, i.e. demonstrating that, at the time the aircraft was designed and built, it
complied with relevant safety and certification requirements. 10 A number of witnesses from BAE Systems (as
well as the IPT and QinetiQ) sought to justify the validity of such a documentary exercise to the Review. I remain
wholly unconvinced as to its utility. Whilst a failure to comply with relevant regulations and standards may, of
8 Chapter 10A, paragraphs 10A.16 and 10A.17.
9 Note the Nimrod Safety Management Plan (SMP) envisaged that the existing available evidence would be ‘supplemented’ by further analysis and a
structured assessment of the risks.
10 As exemplified by the second sub-goal identified in the Feasibility Study (“all relevant safety and certification requirements and standards are
demonstrated as having been met”).
267