The Nimrod Review - Official Documents

Review’s audit of the Pro-Formas
Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
11.127 My concern at the catalogue of errors in the Mech Systems Pro-Forma for Hazard H73 led me to decide that
a careful audit should be carried out of all the other Pro-Formas produced by BAE Systems. A thorough and
painstaking audit was accordingly carried out by the Review of all the other Pro-Formas prepared by BAE
Systems in respect of the other 104 hazards. This revealed that the errors in the Hazard H73 Pro-Forma were not
one-off, but representative of a wider malaise affecting the whole of the work of BAE Systems on the NSC. The
Review’s analysis of the hazard Pro-Formas revealed: (1) a lack of consistency; (2) significant errors of fact; (3)
erroneous or poor identification of hazard mitigation; (4) generally low levels of analysis; and (5) the increasingly
deleterious effect of time constraints on the quality of the Pro-Formas, and the use of much ‘cut-and-paste’
and vague phrases such as “further analytical techniques are required…”. I expand on each of these findings
below.
(1) Lack of consistency
11.128 The aim of the hazard Pro-Formas was, it must be assumed, to produce a consolidated, consistent, structured
analysis of the risk presented by hazards associated with each particular function or zone. The Pro-Formas actually
prepared by BAE Systems, however, varied significantly in their form, content and the analysis undertaken by
different BAE Systems engineers. It is therefore most difficult to see how the underlying aim could be achieved.
In particular:
11.126.1 The Pro-Formas used by Mech Systems and Electrical Systems were superficially similar, but there
were significant differences in the headings used in their tables. For example, section 3, column 4 of
the Mech Systems Pro-Forma was headed “Failure Level”, while the comparable Electrical Systems
Pro-Forma column was headed “Failure Mechanism/Possible Effect”. Similarly, section 2, column 6
of the Mech Systems Pro-Forma was headed “Cause”, while the comparable Electrical Systems Pro-
Forma column was headed “Possible Effect”. This led to different information being entered and a
differing output from the two tables.
11.126.2 The manner in which key potential operating hazards were determined from subsumed Phase 1
installation hazards was not consistent between the Electrical and Mech Systems Pro-Formas. For
example, although both the Mech Systems and Electrical Systems Pro-Formas for Hazard H55 listed
12 subsumed hazards, the former deduced 19 key potential operating hazards, while the latter
deduced only three. This cannot be explained simply by asserting that the difference followed directly
from the differing modes of examination of the two engineering divisions.
11.126.3 There was repeated confusion at Section 2, Column 5 of the Mech Systems and Electrical Systems
Pro-Formas as to which Nimrod was being referred to: the terms “MR” (or “Mk2” or “MR2”), “R” (or
“RMk1” or “R1”), “Nimrod” and “Both” were used. As a result of this, the Mech Systems Pro-Forma,
for example, attributed a given hazard to the MR2, whilst the Electrical Systems Pro-Forma attributed
it to the R1, or faults were attributed to one mark only when they applied to both, or vice-versa.
11.126.4 The Pro-Formas produced by Aerodynamics were of a different template entirely and contained little
analysis and minimal contribution to the safety argument. Indeed, the majority of information within
the supplemental sheets to the Aerodynamic analysis consisted of no more than a summary of the
Aircrew Manual Book 3 Notes to Users.
In short, therefore, there were numerous differences and discrepancies, and a divergence of data and
analysis between the different Engineering divisions’ Pro-Formas.
293