The Nimrod Review - Official Documents

The Nimrod Review
11.319 For the reasons given above, it is particularly unfortunate that QinetiQ supported the sign-off of the NSC. Had
it refused to do so, until a proper ISA review had been carried out in accordance with JSP553 and Def-Stan
00-56, it is possible that the many errors and defects contained it in would have been unearthed, including that
in relation to Hazard H73.
(10) QinetiQ failed to understand the meaning of ALARP
11.320 In my view, it is also a matter of concern that leading experts such as QinetiQ do not seem to understand basic
concepts such as the meaning of ALARP (As Low As Reasonably Practicable).
11.321 The Executive Summary to QinetiQ’s Nimrod Fuel System Safety Review Report (QINETIQ/EMEA/IX/ SCR0702915,
October 2007, Issue 1) stated:
334
“Having considered the evidence referred to within this safety case report, noting that
there are outstanding recommendations and the level of risk present to the fuel system is
not ALARP, the operation of the fuel system is tolerably safe given the mitigation currently
in place.” (emphasis added)
11.322 This report sowed much confusion. There is no such thing as ‘tolerably safe but not ALARP’. Risks are either
‘tolerable and ALARP’ or intolerable:
This is clear from Def-Stan 0056 (Part1)/4 Annex A (Definitions):
Term Definition
Tolerable A level of risk between broadly acceptable and unacceptable that may be tolerated when it has been
demonstrated to be ALARP.
This is clear from BP1201 (Risk Classification Table):
Risk Classification
‘C’ Tolerable - The residual risk is tolerable only if further risk reduction is impracticable or requires action
that is grossly disproportionate in time, trouble and effort to the reduction in risk achieved.
11.323 The ‘R’ in ALARP includes a temporal as well as a financial element (see Chapter 9). As made clear in Edwards
v National Coal Board [1949] 1 KB 704: a computation must be made in which the quantum of risk is placed on
one scale and the sacrifice, whether in time, money or trouble, involved in the measures necessary for averting
the risk is placed in the other.
Criticisms of individuals at QinetiQ
11.324 I am satisfied that two individuals bear particular responsibility for the failures of QinetiQ in relation to its role
in respect of the NSC.
Martyn Mahy
11.325 Martyn Mahy was the QinetiQ Task Manager for the NSC Project from about October 2003. It was his duty on
behalf of QinetiQ to ensure that the Nimrod IPT was properly advised in respect of the NSC project. He failed
to do so.
11.326 Martyn Mahy bears immediate responsibility on behalf of QinetiQ for: (1) failing to formalise QinetiQ’s
appointment as ISA or otherwise to clarify its role at any stage; (2) failing to check that BAE Systems sentenced
risks in an appropriate manner, i.e. using appropriate data; (3) failing to check that BAE Systems included risk
mitigation evidence in the BLSC Reports; (4) failing to brief and de-brief Witness O [QinetiQ] adequately before
the Customer Acceptance Conference; (5) failing to read the NSC reports or otherwise check BAE Systems’