The Nimrod Review - Official Documents

The Nimrod Review
422
between the engine bays and including the fuselage under-floor compartments) would be the starting point for
the further analysis to satisfy the BOI recommendation.
The problems identified
15.27
15.28
Having examined the existing Pro-Formas for the 11 priority zones, the front line operators from Kinloss
reported that they found the Pro-Formas difficult to follow and raised a number of observations, including the
following:
15.27.1 There was a lack of standard terminology in the Pro-Formas.
15.27.2 BAE Systems’ recommendations in respect of the “further work” that was required needed to be
clearly identified.
15.27.3 There was a lack of standard format for the zonal Pro-Formas.
15.27.4 Some of the Pro-Formas contained erroneous mitigation.
15.27.5 Some of the Pro-Formas showed a confusion between the MR2 and R1.
Following discussions at the SC2 meetings, it was decided between the Nimrod IPT and BAE Systems that the
structure of the Pro-Forma would be modified. The original Pro-Forma for each hazard included all possible
causes of the hazard and all mitigations; this led to difficulty in identifying which mitigation applied to which
cause. In order to improve the clarity of the Pro-Formas, it was decided that individual causes and their specific
mitigations should be separated out and placed in their own individual Pro-Forma.
QinetiQ input
15.29
15.30
15.31
During the course of the early SC2 meetings, the QinetiQ Capability Leader – Safety raised a number of issues
and concerns about the underlying structure of the Safety Case with the Nimrod IPT. 37 These included the
following:
15.29.1 It was difficult to see the linkage between accidents and hazard controls.
15.29.2 The subsuming of individual hazards into one hazard made the linkage of hazards to accidents
incorrect.
15.29.3 It was difficult to identify what the specific controls were, and the status of their implementation.
15.29.4 Accident controls had been incorrectly applied to hazards, resulting in an incorrect definition of hazard
probabilities, e.g. fire extinguishers may mitigate the severity of the accident but do not mitigate the
probability of a hazard occurring.
At the meeting on 5 February 2008, QinetiQ also suggested that the method by which the accident probability
was defined was incorrect. QinetiQ had additionally highlighted in a Platform Safety Review, 38 that the existing
Hazard Log used the worst-case hazard probability as the overall accident probability. The overall accident
probability for a zone is, however, a combination of the probability of all the potential hazards and their causes,
not just the probability of the worst-case scenario occurring.
It is, therefore, apparent that, contrary to what BAE Systems sought to suggest, the early meetings identified
problems with the NSC which went far beyond the mere correction of a few factual errors and re-categorisation
of associated hazards. Rather, it was discovered and determined that there were significant underlying structural
issues to be addressed, coupled with flaws in the logical analysis.
37 QINETIQ/EMAE/lx/SES/Nimrod/597732/009/Platform Safety Review.
38 Ibid.