The Nimrod Review - Official Documents

The Nimrod Review
22.27
22.28
542
The physical implementation of OSS&E, and concomitant airworthiness, is achieved through the Weapon
System Integrity Programme. This programme is composed of a number of sub-programmes, considering
specific areas: the Aircraft Structural Integrity Programme (ASIP), the Mechanical Equipment and Subsystems
Integrity Programme (MECSIP)/Functional Systems Integrity Programme (FSIP), 37 the Avionics/Electronic Integrity
Process (AVIP) and the Engine Structural Integrity Programme (ENSIP). 38 Through a pro-active and reactive series
of examinations (including aircraft tear-downs) and the examination of maintenance data, airworthiness is
monitored and, for example, component fatigue lives can be calculated. A key component of the Weapon
System Integrity process is frequent interaction between maintainers, operators and planners. Within the ASIP,
individual aircraft are monitored through an Individual Aircraft Tracking Programme, which is used to determine
maintenance requirements. These programmes are providing the data to enable the USAF to predict that the
B52 and KC135 could continue to operate until 2040, despite having an average fleet age of 47 in 2008.
Although there is no direct comparison between the programmes by which the US and UK seek to assure
airworthiness, the MOD’s Safety Case and Ageing Aircraft Audit regime appears to have much in common
with the USAF OSS&E. The UK Safety Case currently focuses on the mechanical/technical aspects of the mission
system; however, the operator will operate the system within the limitations imposed by its Release-to-Service
(RTS) and, as long as this is done, the system will be operated within a safe range of parameters. Specific
consideration to theatre-specific risk is given by the operational commander. Suitability and Effectiveness are
dealt with in the UK as part of the acquisition process lines of development; thereafter the Operating Authority
considers these topics as part of its in-service management. Should changes to an aircraft’s role change the
assumptions made on entry to service, they are dealt with by the operational commander as part of the normal
staffing process. Nonetheless, accepting the disparity in scales and resource between the UK and US, the
procedures followed exhibit parallels, without displaying significant differences of intent or process.
UK Military equipment Safety Cases
22.29
In my view, however, MOD military equipment Safety Cases have become too elaborate. They should not seek
to mimic Safety Cases in relation to major industrial installations or activities. Military equipment Safety Cases
are generally concerned with a much more limited problem, both in scope and scale. The issue is simply: “Is this
piece of equipment safe to operate?”.
‘Operational’ Safety Cases and ‘Hierarchy’ of Safety Cases
22.30
22.31
The Review has heard much discussion about the ‘hierarchy’ of different types of Safety Case. The hierarchy
of Safety Cases is said to include five layers: 39 (1) OEM40 Safety Case; (2) IPT Equipment Safety Case; (3) RTSA
Operational Safety Case; (4) AOA Operating Safety Case; and (5) Whole Aircraft Safety Case (WASC).
The Review has heard much discussion, in particular, about ‘Operational’ Safety Cases, especially from the
Directorate (Air Systems) and those in Industry who advocate their benefits, such as QinetiQ. It is envisaged
that Operational Safety Cases would apply elaborate Safety Case techniques, not just to the Platform ‘As
Designed’, but also to analysing: (1) Weapons systems ‘As Flown’; (2) Peacetime Training ‘Steady State’; and (3)
Contingent Operations/Transition to War/War-Fighting. 41 As an academic exercise, there might be some sense
in taking the Safety Case concept to its logical conclusion. But I remain firmly sceptical as to the real benefit of
Industry generating yet more warehouses of inaccessible and impenetrable paper anticipating and analysing
the myriad of potential operational events and environments which platforms might encounter in the future.
Currently, when (for example) commanders switch platforms such as the Nimrod from a wet/cold maritime to
an entirely new a hot/dry desert role, they naturally ensure that an analysis is carried out of the new risks that
operating the platform in a different environment might engender before deployment. The pragmatic and
37 The FSIP is an attempt to apply the MECSIP, originally intended for new mission systems, to the sustainment of existing systems. It has a wide ambit,
including hydraulic systems, engine conditioning systems and electrical/lighting systems.
38 USAF Military Handbooks describe each of these programmes, but are for guidance and cannot be mandated on a contractor.
39 BAE Systems September 2004, Baseline Safety Case Report.
40 Original Equipment Manufacturer.
41 QinetiQ Brief to the Nimrod Review dated 13 February 2009.