The Nimrod Review - Official Documents

The Nimrod Review
174
9.41.6 In all cases of retrospective application of the Standard, the Safety Case should contain well organised
and reasoned justification clearly showing that: (a) existing or supplemental analysis is sufficient to
demonstrate that the system is tolerably safe; and (b) service history is applicable and changes to the
referenced system configuration have been appropriately controlled and documented (paragraph D.3).
Issue 3 of Def-Stan 00-56
9.42
9.43
As explained above, Issue 3 of Def-Stan 00-56 was issued in December 2004. It purported to abandon the
prescriptive approach of earlier issues in favour of a ‘goal-based’ approach (although the change of approach
is not readily apparent save for the covering words to Part II that “THIS GUIDANCE IS NOT MANDATORY”). Part
1 of Issue 3 set out mandatory key safety management requirements, including over-arching objectives and
principles and Part II, which was not mandatory, provided guidance on establishing a means to comply with the
requirements of Part I.
The MOD explained to the Review that Issue 3 was intended to reflect a review of project safety management
issues and incorporate changes in MOD policy and safety management good practice, and to take account of
lessons learnt from Issue 2. The key changes introduced in Part 1 ‘Requirements’ (Issue 3) were said to be as
follows:
(1) The adoption of the ALARP principle for managing risks. 65
(2) The introduction of an MOD Duty Holder who has specific responsibilities for Safety Management of the
system. 66
(3) The setting of objective and specific requirements to enable the acquisition of equipment that is compliant
with both safety legislation and MOD safety policy. 67
(4) The adoption of the principle of safety management requirements as opposed to the safety programme
requirements used in Issue 2. Effectively, Issue 3 no longer mandated the procedures to be used. 68
(5) The provision of a definition of what a system is considered to be and the application of Def Stan 00-56 to
all acquisition scenarios and all systems. 69
(6) Placing the requirement on the contractor to demonstrate compliance. 70
(7) Placing the onus on the contractor to identify all the safety legislation, regulations, standards and MOD
policy relevant to the safety of the system. 71
(8) The introduction of the requirement that, if the duty holder or a delegated representative does not chair
the Safety Committee, then the Safety Committee can only make recommendations to the Duty Holder,
i.e. formal Duty Holder agreement is required before proceeding on ALARP judgments. 72
(9) Placing the requirement on the contractor to produce a Safety Case for the system on behalf of the Duty
Holder. 73
(10) The introduction of the need to establish tolerability criteria for forming the basis for assessing whether a
risk is broadly acceptable, or tolerable and ALARP. 74
(11) The appointment of an Independent Safety Auditor. 75
65 Def-Stan 00-56 (Part 1)/Issue 3, paragraph 0.1.
66 Ibid, paragraph 0.2.
67 Ibid, paragraph 0.3.
68 Ibid, paragraph 1.1.
69 Ibid, paragraph 1.2
70 Ibid, paragraph 1.7.
71 Ibid, paragraph 6.
72 Ibid, paragraph 7.4.2.
73 Ibid, paragraph 9.2.
74 Ibid, paragraph 10.7.1.
75 Ibid, paragraph 4.3.3.