SECRETARY OF STATE MINISTRY OF DEFENCE FLOOR 5, ZONE D, MAIN BUILDING WHITEHALL LONDON SWIA 2HB Ministry Telephone 020 7218 9000 of Defence Fax: 020 721 87140
4.3.11.2 2 September 2018 M , A_+ Thank you for sending us a copy of your report and recommendations following the inquest into the tragic death of Corporal Mathew Hatfield and Corporal Darren Neilson: hope that the information provided below offers assurances that the findings of your investigations and the areas you have highlighted for the prevention of future deaths have prompted action and been the focus of the Ministry of Defence's continuing commitment to improving the safety of all military exercises. Matter of Concern 1 "I remain concerned that soldiers are not clear about when to use the Prove The Gun drill and the meaning of the word "work" in the drill: This was supported by the evidence of Lt Col Ridgway who stated there was still a lack of clarity: The MOD should ensure that soldiers are clear about the meaning of the word work in the drill and when the drill should be undertaken. Immediately following the tragic accident; ban on all 12Omm training ammunition natures was ordered by Defence General Munitions ("DGM"). Once all live fire training on Challenger 2 ("CR2") tanks was halted, an Extraordinary Safety and Environmental Management Panel ("SEMP") was convened: The SEMP held a series of four extraordinary meetings (20 June, 12 July, 24 July and August 2017) to investigate the incident; These meetings were chaired by the then Brigadier (now Major General) in his role at the time as Land Equipment Vehicle Support Team Leader in Derence Equipment and Support ("DE&S"): The panel consisted of Subject Matter Experts ("SMEs") involved in all aspects of the CR2 capability; Defence Equipment and Support ("DE&S" (Heavy Vehicle Support, Weapons Engineering;, Defence General Munitions, safety experts) , Defence Ordnance Safety Group, the Armoured Fighting Vehicle Mrs Louise Hunt HM Senior Coroner RECEIVES Birmingham & Solihull Areas 50 Newton Street 4 OcT 2010 Birmingham B4 6NE BY:

Technical Training School (AFVTTS) Gunnery Wing, Capability Directorate Ground Manoeuvre ("Cap GM") GM and the representatives Of the manufacturer of the CR2, BAE Systems Ltd. The SEMP reviewed the procedures in the Army Equipment Support Publications ("AESPs") "2350-P-102-201 Tank; Combat; 120mm Gun Challenger 2 Operating Information' and '2350-P-102-601 Tank; Combat; 120mm Gun Challenger 2 Maintenance Schedule' . The SEMP concluded that had the extant procedures detailed in the AESPs been followed, the absence of the obturator assembly (consisting of the Bolt Vent Axial, thrust housing and shim) would have been identified. However, it also concluded that the accident could be repeatable and there were areas where procedures could be adjusted to reduce the risk of a re-occurrence of the accident_ The SEMP directed that: Changes be made to the AESPs to be explicitly clear when the before use checks should be conducted, particularly the requirement to prove the gun; Changes be made to the AESPs to include additional verification, visual and physical; that the obturator assembly is fitted; BAES to be tasked by DE&S to explore the viability of a physical or electronic safety mechanism to prevent the gun being fired when the obturator assembly was not fitted; (iv) The hazard log for CR2 to be reviewed: A separate panel of SMEs was convened at the Armoured Fighting Vehicle Technical Training School ("AFVTTS") Gunnery Wing to consider the changes required in the AESPs and how best to train these to crews_ The panel consisted of: Gunnery Wing Schools Instructors (Sls) teaching at the AFVTTS; Gunnery Training and Advisory Team (GTAT) staff (also Sls but employed to advise on and assure the standard of gunnery training in the Field Army); (iii) Capability Directorate Ground Manoeuvre staff; (iv) Technical publication authors; DE&S representatives: The panel of gunnery SMEs recommended specific adjustments to the AESPs; These recommendations were presented to the SEMP, examined in detail and then endorsed_ The changes have been fully implemented in to the current AESPs and all documents which support the delivery of training: Prior to implementation, the AFVTTS School's Instructors tested the new drills and procedures: The new procedures were then cascaded down to Regimental

Instructors Gunnery ("RIG's") who then trained the CR2 crews. It is policy that CR2 commanders and loaders must pass a Weapons Handling test ("WHT") on both L3OAT 12Omm gun and L94 chain gun no more than 6 weeks before any live firing: This training is further assured by the GTAT conducting a re-test of WHTs of a random sample of 15% of the firing crews in the 6 weeks leading up to live This assurance was conducted on the crews after they had been trained in the revised drills and procedures: All CR2 crews are now comprehensively trained in the amended AESP's. The bans on both use of 12Omm training ammunition and the firing of the L3OA1 gun were lifted on 18 August 2017 . The bans were lifted only after the SEMP was satisfied that all the new procedures and drills had been implemented in the AESPs, the training of crews in these procedures and drills had been fully delivered and assured, and a review of the hazards of operating CR2 had taken place _ This was in place by 18 August 2017 . The changes to the AESP's included: AESP's "2350-P-102-201 Tank; Combat; 120mm Gun Challenger 2 Operating Information' Chapter 2-8-2 Prove the Gun These drills establish that the gun is clear of any ammunition and while previously the loader was required to check that the BVA was clear of any TVEs by running his fingers down the back of the BVA (Paragraph 6.13), they were adjusted to specifically check for the presence of the BVA, obturator and shim (Paragraph
6.19 and Paragraph 7). Paragraph 5 of Chapter 2-8-2 previously stated: "Before any work is carried out on the gun it must be 'proved', that is to say, it must be checked to ensure that it is clear of any ammunition and Is therefore safe to work on: The revised AESPs eliminate the requirement for individuals to interpret the definition of "work" The completion of the 'prove the gun' drill is now mandated in specified circumstances (see below): Nevertheless, the AESP's were updated to ensure clarity. Paragraph 5 now reads: "Before thegun is operated in any way or_before any maintenance is carried out it must be 'proved', that is to say, it must be checked to ensure that it is clear of any ammunition and is therefore safe to work on As part of the ongoing assurance regime the 'prove the drill has now been included into the CR2 Weapon Handling Test ("'WHT") In line with extant policy, loaders and commanders will be required to pass their WHTs in the six weeks leading up to any live training: So far as relevant to a live firing exercise the 'prove the gun' drill is mandated in the following circumstances: AESP '2350-P-102-601 'Tank; Combat; 120mm Gun Challenger 2 Maintenance Schedule' Table 1 Before Use Maintenance Army firing: gun' Army fire

This maintenance must be carried out before the vehicle is used. Ser 19 mandates the loader to complete the 'prove the drill in accordance with AESP's "2350-P-102-201 Chapter 2-8-2. AESP '2350-P-102-601 'Tank, Combat; 120mm Gun Challenger 2 Maintenance Schedule' Table 2A During Use Takeover individual Crew Member: This maintenance is to be carried out when rotating vehicles between crews during use If there is no 'hand over take over' ("HOTO") between crews or the HOTO is deficient in any respect the crew is obliged to complete a full 'Table Before Use Maintenance' , including 'prove the gun' drill In all circumstances (i.e: even where there is comprehensive HOTO) the crew is obliged to complete Table 2A. Serial 8 of Table 2A mandates the loader to complete the 'prove the gun' drill in accordance with AESP's '2350-P-102-201 Chapter 2-8-2 Further checks and assurances have been implemented to ensure that the main gun cannot be fired without the BVA: AESP's "2350-P-102-201 Tank; Combat; 120mm Gun Challenger 2 Operating Information Chapter 2-8-2 Going to Action with both the breach open (Paragraph 10) and closed (Paragraph 9). These drills dictate the procedures to load the gun on receipt of the order Action Load" Paragraphs 9.6 and 10.6 provide that the loader must: "Check that the BVA obturator and shim are fitted" and report the result of that check to the commander: The commander is then obliged to carry out a secondary check of the BVA, obturator and shim to ensure they fitted Only if all components are fitted the commander give the order Carry on. AESP's "2350-P-102-201 Tank;, Combat; 120mm Gun Challenger 2 Operating Information' Chapter 2-8-2 The Tube Vent Electric Display Unit ("TVEDU") Red - No Vent Tube (Paragraph 33) or TVEDU No Display ("Paragraph 37"). Paragraph 33 has been updated to recognise that the absence ofa BVA may cause a TVEDU Red indication. Paragraph 34.6.2 of the TVEDU Red drill now mandates the loader to check for the presence of the BVA by checking through the Firing Needle Assembly ("FNA") aperture. There is now no scenario in which a crew could proceed to fire the main gun without first having completed the 'prove the drill which mandates a specific check for the presence of the BVA, obturator and shim (Paragraph 6.19) Even if the 'prove the gun' drill was not adequately completed the presence of the BVA; obturator and shim would be rechecked upon 'going to action' and again upon receiving a 'TVEDU ~ Red Indication or No Display' (an inevitable consequence if the BVA is missing). gun' are will gun'

The SEMP and the panel of SMEs convened at the AFVTTS Gunnery Wing consider that the changes made to the AESPs have reduced the_risk to a level which is as low as reasonably practicable ("ALARP"): AlI CR2 crews are appropriately trained on the new drills, there is no lack of clarity about when dril must be completed; the delivery of that training and the crew's understanding of that training is appropriately assured and any risk of reoccurrence is ALARP. Matter of Concern 2 "One of the contributing factors to this tragedy was that the RCO, the person in charge of the live firing exercise, did not know the state of the tanks on the range and therefore allocated stripped-down tank for a live firing exercise. remain concerned that it is vital that the person in charge of such exercises has up to date knowledge about the status of the tanks on the range; The MOD should look at what communication can be put in place to ensure the RCO is in fact in; charge and has all the correct information to make decisions during the exercise. The Range Conducting Officer ("RCO") is responsible for the safe conduct of the firing; in accordance with the planned activity as laid out in the Range Actionand Safety Plan ("RASP") which is produced for all live firing activities; However, a live firing exercise is a dynamic and fluid environment: A plan for the exercise is determined in advance but it is necessarily flexible to take account of changing circumstances, for example: crews failing certain exercises and having to repeat them; equipment developing faults requiring repair; routine but essential maintenance of equipment; civilian violations within the safety zone or inclement weather preventing firing: However, the primary duty of the RCO is the supervision of the Armoured Fighting Vehicles (AFVs) that are at action and firing on the range and any distractions from this duty must be minimized. It is essential that the RCO is focused on delivering safe live firing exercise. Any requirements for the RCO to keep contemporaneous records on the state of the tanks would detract from his focus on the safety of the range as a-whole The use of a whiteboard or similar system to allow the forward planning is only a planning aid. It allows the RCO, squadron sergeant major and crews to anticipate what AFVs likely to be used, what ammunition is required and the order in which exercises are conducted: However, for the reasons indicated above, the situation can and does frequently change quickly and therefore the plan will need to be adjusted:. Such a whiteboard must therefore not be relied upon aS an authority for maintenance states on every AFV on that range; it is extremely difficult to guarantee that it is accurate on a minute by minute basis. It is also important to note that the process used on fixed arc ranges (such as Castlemartin) must be mimicked as closely as possible during the delivery of Live Fire Tactical Training on field firing ranges: The majority of these ranges are conducted at the British Army Training Unit Suffield (BATUS) in Canada but can, and routinely are, conducted elsewhere. This is an essential part of the Army's ability to train around the world which not oly maintains the Army's readiness but also contributes to deterring contlict in pursuit of the UKs national interest_ These ranges have no fixed arcs or control tower: At these ranges the RCO and safety supervisors are mounted on 4x4 vehicles and control the range from their vehicles as the training AFVs conduct a live firing range in a tactical are they

scenario over several kms (some exercises see AFVs manoeuvring over ranges in excess of 4Okm): Maintaining such a white board during Live Fire Tactical Training would not be practical Not only would such rigid system distract the RCO from his duties, be impractical to maintain as an authoritative source of equipment maintenance status and be impractical t0 implement on all ranges, it will also reduce the responsibility that is quite rightly placed on crews to manage their own safety: Ultimately, crews are training for warfighting operations where crew changes between vehicles often occur at short notice The need for crews to take responsibility for their safety must be instilled throughout the training progression to prepare crews to deploy on operations at short notice: A centrally managed system in training where the responsibility for monitoring the maintenance status of AFVs rests, either explicitly or implicitly, with the RCO is likely to introduce complacency with crews_ The crew are likely to have an expectation that if the whiteboard says an AFV is ready to fire and the RCO has allocated it to a crew; therefore the crew assume it is ready to fire. This therefore creates a reliance on others to ensure the vehicle is ready to fire in training: However; there is no RCO or any other safety supervision on warfighting operations beyond that imposed by the crew commander: Such a reliance on the RCO or a centrally managed system in training, widens the gaps between training and operations and therefore transfers risk from training into operations. The Army judges that any potential risk presented by the RCO not being aware of the state of tanks on the range is ALARP As indicated above the revised drills and procedures erisure that there is no scenario in which a crew could proceed to fire the main gun without first having completed the 'prove the gun' drill which mandates specific check for the presence of the BVA, obturator and shim (Paragraph 6.19). Even if the 'prove the drill was not adequately completed the presence of the BVA, obturator and shim would be checked again upon 'going to action' and if necessary again upon receiving a 'TVEDU Red Indication or No Display' (an inevitable consequence if the BVA is missing). In addition to the above drills a 'Do not use' cover has been introduced This cover which is red in colour is now placed over the breach of the gun during maintenance (i.e if any part of the gun is removed; including the BVA) to provide clear indication that the gun is in an unsafe state_ Any oncoming crew would be immediately aware that the gun was not ready to fire and would not conduct further investigation until the reason for the cover being present is identified and rectified These changes are highlighted throughout the AESP's. As of 26 July 2018, there are sufficient covers to meet the requirement for the circa 107 tanks that are in daily use across the Army: The Army invests considerable time and resource to ensure its CR2 crews are highly trained professionals. CR2 crew commanders undergo particularly demanding training over and above the rest of the crew which reflects their responsibility to command their tank and supervise their crew during both training and operations: The crews' ability to determine the readiness state of a tank without external supervision is not only well within their capability but also essential to maintain the flexibility that is required on operations The system gun' very

comprehensive training; based upon the revised drills and procedures in the amended AESPs, and the supervision provided by experienced and well trained crew commanders ensures that the risk of a tank being without safety critical components fitted is ALARP. Finally, Defence Equipment & Support (DEXS) tasked BAES to conduct a safety review of the L3OA1 CR2 Main Armament The BAES response was received by DE&S on 20 June 2018. The findings of that response are set out below. Matter of Concern 3 "Mr Sime from the HSE confirmed that had applied advanced or developed risk assessment techniques been undertaken then it would have been identified in the design and manufacture of the gun that it could fire without the BVA assembly present when undertaking the TVEDU red drill. BAE and the MOD should look at their process to ensure that their risk assessments are suitable and importantly that drills are actively considered when assessing risk and identifying hazards during manufacture. As discussed previously, the SEMP directed, as part of their recommendations, that BAES be tasked by DE&S to explore the viability of a physical or electronic safety mechanism to prevent the gun being fired when the obturator assembly was not fitted, This task was placed on BAES in August 2017 and the BAES response was received by DE&S on the 26 June 2018. BAES were directed to:
a. Conduct a Failure Mode Effects and Criticality Analysis (FMECA) on the L3OAT, considering lessons learnt from this incident,, to identify potential failure modes: The report by BAES confirmed the omission of the BVA as the only failure mode allowing the L3OA1 gun to be fired with catastrophic loss of obturation;
b. Conduct a feasibility study into the introduction of a physical mechanism to prevent firing with key components not fitted (to improve the level of safety above procedure and drills): The report identified several possible design solutions for a physical mechanism to prevent firing with key components not fitted, exploring two candidate designs in further detail; and C. Produce a Human Factors report into the operation of the CR2 Main Armament in relation to the AESP changes made' . The report assessed there to be no anticipated musculoskeletal related issues or effect on system performance from the additional tasks placed on the Loader/Operator to physically check critical obturator components and conduct handoverltakeover checks Equipment Support Publication (AESP) 201 (Operating Information) has been amended to reflect the introduction of additional L3OAT loader drili to include physical (as opposed to visual) check of critical components and AESP 601 (Maintenance Schedules) has been amended to reflect the introduction of formal HandoverfTakeover checks for the CR2 Main Battle Tank Army

As above, two design options were identified that could potentially provide safe and reliable mechanisms to prevent the gun being fired without the BVA being fitted. However, following further review of the BAES report and discussion with a wider stakeholder group; including the user community, work is now under way to:
a. Mature the additional options identified through further tasking on BAES; b_ Review four design solutions identified by the Design Authority to decide which; if any, will be taken forward for further development and testing; and Assess the effectiveness of all controls relating to obturation, taking full account of the potential for human failure Progress against these tasks will be presented to the CRZ SEMP on 11 October
2018. Furthermore, in response to advice offered by the HSE during our ongoing engagement relating t0 this incident and their investigation;athe Landhonaonz have reviewed all heavy weapon systems for the potential failure of obturation; The review concluded that AS9O is the only other system using 'rear obturation' but due to the design it is physically impossible to fire without the obturator fitted This is consistent with the findings of the related Service Inquiry?. Work is also in hand to ensure that future procurement of all Land_Systems considers these matters fully: As direct example CR2 Life Extension Programme has requirement for FMECA to be produced during the Assessment Phase as part of the wider Safety Documentation set required by the MOD. From a wider safety perspective, it is worth noting that we have, through this process, identified three systemic issues that we are now working to resolve across DE&S: These are: a, Recognising where mitigations for significant risks are solely orTheavily reliant on human controls and reviewing how this is documented. This will be subject to review to ensure that additional technical mitigations are considered, as appropriate, to reduce this reliance;
b. The need of the MOD to get honest feedback on the behaviour of the crew and their opinion on their role in safety, particularly when operating in high risk situations; and The Land Domain is a 3" Organisation within DERS led by Chief of Material (Land) and comprises four 2" led Operating Centres; Land Equipment; Logistic Delivery. Weapons and Support Enablers; Service Inquiry Challenger 2 Incident at Castlemartin Ranges, Pembrokeshire 14 Jun 17,Page 116 para 1.4.195 & 1.4.196

C. The need to review all Land Systems Safety Cases in conjunction with the Front Line Command and other interested parties to ensure that we are using the appropriate risk assessment methodology; proportionate to the level of the risk and further ensuring that this is documented with the supporting rationale. The three issues above will take time to resolve but there is firm commitment the Senior Leadership within DE&S to drive this work forward in close collaboration with the Army (and other Front Line Commands as appropriate) , the Defence Safety Authority, our internal Regulator and our industry partners, such as BAES. hope that the information provided offers assurances that the findings %f your investigations and the areas you have highlighted for the prevention of future deaths have prompted action and been the focus of our continuing commitment to improving the safety of all military exercises. 3 THE RT HON GAVIN WILLIAMSON CBE MP from

Dear Madam, Inquest into the Deaths of Matthew Karl Hatfield
- Deceased and Darren Paul Neilson
- Deceased We refer to the Regulation 28 Report to Prevent Future Deaths following the completion of the Inquest into the deaths of Matthew Hatfield and Darren Neilson. The information below is intended to provide assurance that the issue raised through the findings of your investigation, has been fully reviewed and adequately addressed by BAE Systems. The Report raises three matters of concern. This letter responds on behalf of BAE Systems to the third concern which is directed to both MoD and BAE Systems (the other two matters of concern being directed to MoD alone). The Inquest heard evidence that
-
• the gun was designed by the Government owned Royal Armaments Research and Development Establishment (R.ARDE) and that thereafter it was brought into production by the Government owned Royal Ordnance Factory Board, working together with RARDE.
• there was a Design Freeze in 1987. After that date any modifications to the design had to be approved by MoD.
• the safety of the gun design and its suitability for use was separately assessed by the MoDs Ordnance Board in 1989 and 1994. In your narrative setting out the Circumstances of Death you accurately summarise that evidence above “The gun was designed and manufactured in the I 980s coming into use in Challenger 2 in 1994”. BAE Systems, as you are aware, had no involvement with the gun during this period and did not come into existence until 1999. British Aerospace, a predecessor company of BAE Systems, bought Royal Ordnance plc in 1987 after the design freeze was in place for the gun. As detailed above, the work carried out prior to Design Freeze by Royal Ordnance in productionising the gun was carried out when it was in government, rather than private ownership. You also heard evidence that BAE Systems was not tasked by the MoD during the safety case reports that were undertaken for the tank in 2010 and the gun in 2014 to review the original design itself, as they were “in service” assessments based on user experience and upon assumptions that training/procedures would be followed.

BAE SYSTEMS We set out such matters not because they diverge from your findings (they do not), but because this letter maybe published by the Chief Coroner and we therefore wish to make the position clear, so that it is not misunderstood. Following your findings of fact at the conclusion of the inquest, there was some general misreporting in the media that BAE Systems had designed the gun, when in fact it had not. We understand, therefore, that your concern directed at BAE Systems relates to the company’s role in any future design or design review of such armaments, and to seek reassurance that the risk assessment processes that will be undertaken on those occasions will be suitable and will take into account the way they will be used according to the army’s drills. We can confirm that, were BAE Systems to be contracted in the future to design any such armament, it would follow a thorough design analysis, in conformity with the current design standards identified by HM Principal Inspector of Health and Safety (Explosives). As part of that process, SAE Systems would apply the current MoD Defence Standard (07-085), which in relation to obturation specifically states “It should not be possible to fire the ordnance if any component of the obturation system is missing”. The Standard goes on to reference how ideally the design should prevent that from happening. Accordingly, the current Design Standard, which BAE Systems, or any other designer, is currently required to follow specifically identifies the issue you are concerned about. It requires the designer to consider design solutions and their adherence to the relevant Standard, which would prevent the issue from arising, whether in combination with the undertaking of a TVEDU red drill, or otherwise. We can also confirm that any such design or assessment of design would take account of the foreseeable use of the armament in practice, which would incorporate the army drills for training and operations. The specific content of those drills is obviously a matter for the MoD but they would be considered as part of any design process. However as explained above, such a gun designed today in accordance with the relevant Standard should not be able to fire at all if a component of the obturation system is missing. While the concern expressed in your letter was to cover future designs, after the incident in June 2017 the MoD and BAE Systems are developing a design solution to eliminate the risk of this happening again and to bring the current Challenger 2 gun up to date with the Standard outlined above. At the Inquest two potential engineering solutions to prevent the gun being fired without the BVA Assembly being present were highlighted. Following the inquest two additional proposals are now also being considered further. Progress on all four solutions will be reviewed by the MoD Challenger 2 Safety and Environmental Management Panel in October 2018. We trust that the information contained in this letter and our commitment to continue working jointly with the MoD on future solutions helps to address your concern.