The Nimrod Review - Official Documents

(2) BAE Systems failed to carry out a proper ‘feasibility study’.
Assertion rather than research
11.23
Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
In my judgment, BAE Systems is at fault for failing to carry out a proper ‘feasibility study’ prior to pitching to
the Nimrod IPT. The BAE Systems document entitled “Safety Case and Baseline Report Feasibility Study”, dated
March 2002, drafted by Chris Lowe was based on assertion rather than research. In my view, there was little
proper justification for BAE Systems’ bold assertion therein that it had “a high level of confidence” that it could
undertake the preparation of the NSC itself and the Baseline Safety Case Reports (BLSC Reports) for the MR2
and R1 “in an effective, competent, expedient and cost-effective manner”. None of the BAE Systems personnel
involved in the production of the NSC had ever done a Safety Case before. Very few, if any, had any experience
of Zonal Hazard Analysis (ZHA). No proper ‘feasibility’ study had been carried out. BAE Systems had not even
undertaken any initial assessment of the current availability of appropriate Hazard Data and Fault Tree Analysis
data, as required under PDS Task AV(PDS)814. (It was not until March 2004 that Witness K [BAE Systems], acting
on his own initiative, even began his search of the archives held by BAE Systems.)
Commercial ‘puff’
11.24
BAE Systems explained to the Review that it had drawn on a number of previous in-service safety assessments
(on the Jaguar, Harrier and Tornado aircraft and Failure Mode Effect Analyses (FMEAs) on the Nimrod’s flight
safety critical systems), BP1201 and the White Booklet, plus other advisory material available from aerospace
industry steering bodies, such as the Society of British Aerospace Companies (SBAC). 17 The SBAC Guidance
contained little more than a re-statement of the MOD policies and requirements promulgated in JSP318B,
Def-Stan 00-56 and BP1201. There was little underlying basis or justification for BAE Systems’ statement of
confidence. No proper investigation or ‘feasiblity’ work had, in fact, been carried out. Attempts by BAE Systems
to suggest that success was ‘not assured’ and little reliance could be placed on the “Feasibility Study” because
detailed costs and timing had still to be worked out, miss the point: the clue is in the name, “Feasibility Study”.
As BAE Systems’ Chief Airworthiness Process Engineer and Deputy Head of Airworthiness, Witness A [BAE
Systems], accepted during interview with the Review, the title “Feasibility Study” was something of a misnomer.
In my view, it was no more than a commercial ‘puff’ to secure the business.
(3) BAE Systems failed to ensure its personnel were properly trained, experienced and
competent for the task.
11.25
In my judgment, the majority of the BAE Systems personnel involved in the NSC were incompetent to carry out
the task. They were insufficiently trained and experienced in Safety Cases and the techniques they were required
to employ, in particular, as to how to carry out a Zonal Hazard Analysis (ZHA) or how to carry out the analysis
and risk classification required to produce a Safety Case.
Lack of training and experience
11.26
Apart from Chris Lowe, it appears that few, if any, of the BAE Systems personnel had received any significant
training on how to produce a Safety Case, beyond attending the short internal BAE Systems course on ZHA, 18
or a general two week system safety course run by York University for BAE Systems. Richard Oldfield, who led
the Phase 1 inspection team, had never done a ZHA before, and was not aware that any of his team had done
one before, save possibly Witness C [BAE Systems]. Chris Lowe had written an MSc thesis on Fire Safety Cases
(entitled “The Everlasting Fire Threat – A Review of the Overall Fire/Explosion Risk in Commercial Transport
Airframe Design and Operation” 19 ) but does not appear extensively to have consulted other departments in BAE
Systems who may have carried out similar projects. Further, it is not clear that any of the BAE Systems personnel
involved even had any significant training or qualifications in ‘safety engineering’ itself.
17 SBAC guidance entitled “Issues to be addressed by industry in the provision of an air systems safety case”.
18 Chapter 10A, paragraph 10A.56.
19 Lancaster University Engineering Department, September 2003.
269