The Nimrod Review - Official Documents

Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
11.201 If intelligent questions had been asked during the Customer Acceptance Conference, it is likely that they
would have elicited answers which would have revealed what was appears to have been the actual status of
the project, namely: (i) BAE Systems had left over 40% of the hazards “Open” and unsentenced, many with
no recommendation beyond simply that “Further analytical techniques are required” before they could be
sentenced and closed; (ii) BAE Systems had left over 30% of the hazards “Unclassified” and uncategorised,
with no recommendation beyond simply that “Further analytical techniques are required” before they could be
classified; (iii) BAE Systems had not completed drafting the BLSC Phase 2 Reports, in particular the Executive
Summary, Conclusion and Annexes B and C thereof; (iv) BAE Systems had not completed work on all the
hazards (e.g. Hazards H78, H79 and H63); and, in the circumstances, PDS Task 06-3409 and the ‘Top Level Goal’
of the NSC could not be said to have been fully and satisfactorily completed.
‘Consensus’
11.202 Nevertheless, the Nimrod IPT (and QinetiQ) became party to a ‘consensus’ on the final day of Customer
Acceptance Conference that “the aims and objectives of the project had successfully been achieved” and Frank
Walsh formally agreed on behalf of the Nimrod IPT that “PDS Task -06-3409 could be considered closed by the
issue of the minutes of this Conference”.
11.203 In my judgment, Michael Eagles (as Head of Air Vehicle, responsible for the project management of the NSC)
and Frank Walsh (as Safety Manger), are liable to criticism for failing to take any, or any adequate, steps to
satisfy themselves that the NSC work had been satisfactorily carried out and completed by BAES. As a result, the
Nimrod IPT singularly failed to ensure that the NSC task has been fully and properly completed by BAE Systems.
The task was far from complete or satisfactory, and manifestly so. The Nimrod IPT displayed a remarkable
lassitude.
Cosy and complacent atmosphere
11.204 How and why did this regrettable situation come about? In my view, it is not difficult to discern. There are, I
believe, four principal reasons. First, the acceptance of the Phase 2 work at the meeting effectively hinged on
Frank Walsh and he was out of his depth (as explained above). Second, the relationship between BAE Systems
and Frank Walsh had become ‘too cosy’. As he and Chris Lowe were at pains to explain in evidence to the Review,
they had worked ‘very closely’ together in the months leading up to the Customer Acceptance Conference. As
Richard Oldfield told the Review: “We were very close to Frank Walsh on this programme. The primary point
of contact was Frank Walsh.” This closeness manifested itself in a joint reluctance to accept criticism from third
parties. This is illustrated, e.g., by BAE Systems’ and Frank Walsh’s response to an “Air Environment IPTs Hazard
Log Review” dated 7 April 2005 produced by Echelon Consulting Limited. The Echelon report noted inter alia
(section B.4) that the “Nimrod IPT’s reliance on the BAES Fault Tree has relegated Cassandra to a position where
it is little more than a high-level management reporting tool” and that “the detail contained in the hazards and
accidents descriptions is insufficient to reason about the legitimacy of the relationship” .113 Frank Walsh sent a
copy of the report to BAE Systems on 20 April 2005, prompting an angry response from Chris Lowe. 114 That
response was echoed by Frank Walsh who, on 26 April 2005, wrote to Chris Lowe stating “I believe that I have
returned Echelon to their box and screwed the lid on ...”.
, 11.205 Third, there was a co-incidence of interest between the Nimrod IPT and BAE Systems. They shared the same
goal, namely it suited everyone to get the project signed off within the deadline: the Nimrod IPT because it
was required to have a Safety Case within the timeframe prescribed in BP1201 and its own SMP; BAE Systems
because it wanted to be finished on time and be paid for its work; and both, because they wanted to ‘trumpet’
the fact that they had successfully completed the first major military aviation platform case.
113 It is worth noting that the Echelon report further stated in paragraph 8 of section B4: “The initial hazard and accident classifications (e.g. accidents
all Cat ‘C’s) is unhelpful, and occurs because the initial hazard probabilities reflect significant prior mitigation not recorded in the log. This was
apparently carried out to reduce the amount of data in the log, and was approved by QinetiQ, but it does not allow visibility of their nature. It also
means that the ‘extra’ controls being added – which are apparently the newly identified ones – do not visibly affect the risk rating, and this is reflected
in having hazard post-control statuses the same as the initial, while often accident post-control statuses are undefined. The use of status histories
to add extra controls is also unhelpful. Again, it is assumed that approach adopted for initial hazard and accident classifications reflects that used by
BAES when populating the Fault Tree.”
114 In an internal e-mail dated 21 April 2005, Chris Lowe stated to Richard Oldfield and his superiors “Please see this [expletive] sent to NIM IPT Safety
desk by Echelon ... Frank is indeed fuming ...”.
311