Engineered to Fail · Part 6 of 6

A Land Systems Safety Regulator: What the Nimrod Loss Taught the Air Domain

Durable fixes to the human problem in capability come from an independent authority with power over design approval and release. They rarely come from a better programme.

Dr Anthony Walker, PhD in thermal and occupational physiology. Founder and Managing Director, Optimised Human Performance.
Published 28 September 2026.

What did the Nimrod loss produce?

In December 2009, after the Nimrod Review, the UK Defence Secretary told Parliament: "we are creating a new independent military aviation authority that will regulate, audit and assure all military aviation activity." He said "the new authority will begin its work from April next year." The Military Aviation Authority still describes its origin in those terms. It "was established in response to the recommendations made by Mr Justice Haddon-Cave in his Nimrod Review which called for a radical overhaul of military airworthiness regulation. As the single regulatory authority responsible for regulating all aspects of air safety across the DAE, the MAA has full oversight of all defence aviation activity."

Fourteen people died before that authority existed. It still operates today, and its value lies in the fact that it does not depend on any one programme choosing to do the right thing.

What was the land domain told in 2021?

This series began with Ajax, so it ends there. In December 2021 the Ministry of Defence published its review of Ajax noise and vibration. Finding 15 read: "The level of assurance from the Defence Land Safety Regulator (DLSR) appears to be well below the scale in the Air and Maritime domains." The review explained why: "DLSR regulations mandate the use of a safety case and its structure, but they are not involved in safety case approvals, nor is there any form of certification for bespoke military platforms."

Its Recommendation 15 was specific: "The DSA through the Defence Land Safety Regulator should be resourced to provide Third Line of Defence safety assurance/certification of land environment capability, modelled on the high-quality standard set by the Military Aviation Authority."

The same review recorded what had happened when the safety authority raised the alarm earlier. In May 2020 the Defence Safety Authority produced a report entitled "Serious Safety Concerns with AJAX". Three days later, "The written report was retracted by DSA due to concerns over evidence quality and lack of consultation on 7 May 2020."

The minister told Parliament that "The MOD accepts all those relating specifically to armoured vehicle procurements, the regulation of safety for land equipment and the broader approach to safety in defence." Today the Land regulator describes itself as "responsible for regulating specified risk to life hazards across the Land domain." I have not found an official statement that it now approves safety cases or certifies land platforms to the aviation standard. Four and a half years after that recommendation was accepted, Parliament’s Public Accounts Committee was still asking the Department to "Explain why it believes the current required operating parameters and restrictions for Ajax vehicles are realistic and appropriate".

Who can refuse to certify a platform on human grounds?

I have spent my career in fire services and, more recently, supporting Defence capability development, including as a human performance lead. I have researched design problems to death and given my advice to the teams. And yet to this day I have no idea who in a capability team holds the authority to refuse a platform on human grounds. On the face of it the systems are safe, but if nobody is accountable for that judgement, and nobody looks at the second and third order effects of a safety decision, we are destined to keep repeating this pattern.

If you can name the person or the office, I would like to know. That is a serious invitation rather than a rhetorical one, and an answer would improve the book.

Why is the fix institutional rather than programme by programme?

Durable fixes to the human problem in capability are institutional. They come from an independent authority with power over design approval and release, and they rarely come from a better programme. The air domain got its authority after fourteen deaths. The land domain was told in 2021 that it needed one built to that standard.

This is also the problem the Crucible Method was built for: locating where the human sits in a capability’s assurance, and testing it, before an inquiry has to. Across six articles I have tried to set out the argument of Engineered to Fail in public before it goes to print. Tell me which claim failed for you, and why. That is the feedback that will shape the book.

Dr Anthony Walker holds a PhD in thermal and occupational physiology and served fifteen years in operational firefighting, including station officer command. He is Founder and Managing Director of Optimised Human Performance, a specialist consultancy in human systems integration and work system design for Defence, aviation, emergency services and resources clients.