The Nimrod Review - Official Documents

The Nimrod Review
9.47 In terms of the evidence required to support the Safety Case, Issue 3 of Def-Stan 00-56, required “compelling”
and “diverse” evidence but made it clear that the quantity and quality of evidence should be “commensurate
with the potential risk posed”. It provided as follows:
9.48
176
“11.3.1. Within the Safety Case, the Contractor shall provide compelling evidence that
safety requirements have been met. Where possible, objective, analytical evidence shall
be provided. The quantity and quality of the evidence shall be commensurate with
the potential risk posed by the system and the complexity of the system. For safety
requirements that lead to the realization of mitigation strategies, the quantity and quality
of the evidence shall be commensurate with the level of Risk Reduction from that safety
requirement.
11.3.2. The Contractor shall provide diverse evidence that safety requirements have been
met, such that the overall safety argument is not compromised by errors or uncertainties
in individual pieces of evidence. The strategy for providing diverse evidence shall be
agreed with the Duty Holder.
11.3.3. The Contractor shall integrate within the Safety Case the evidence that shows
that safety requirements have been met for elements of the system, to demonstrate that
the overall safety requirements have been met.”
It appears that some may have taken or mistaken the definition of a Safety Case as something of a green light
to undertake what was, in effect, an ‘archeological’ document trawl into the original design documents. This,
however, was not an appropriate, sensible or fruitful use of time or resources and tended to detract from the
key element of a safety analysis for legacy aircraft, namely the carrying out of a thorough Hazard Analysis. I
discuss this issue further in Chapter 11. In my view, it is important that the evidence to support a safety case is
(a) proportionate and (b) relevant to current risks.
Issue 4 of Def-Stan 00-56
9.49
The latest version of Def-Stan 00-56 is issue 4 which was issued on 1 June 2007. The Part 2 guidance is again
said not to be mandatory, as before.
Appointment of ISA
9.50 The appointment of an “Independent Safety Auditor” (ISA) in relation to the preparation of a Safety Case was
mandated by JSP553 to ensure that the Safety Case was independently assessed. It required both an audit
to ensure compliance with the Safety Management Plan (SMP) and a technical evaluation of the Safety Case
Report. The assessment was to be carried out by an “Independent Safety Auditor” (ISA) in accordance with Def-
Stan 00-56, or an alternative independent competent organisation (see JSP553, Chapter 2, paragraph 2.58).
There was also a requirement under Def-Stan 00-56 that an ISA was to be formally tasked in all cases where a
Preliminary Hazard Analysis identified class A or B risks (and class B risks were deemed tolerable) and that terms
of reference for the ISA and an audit plan should be drawn up (see Def-Stan 00-56, paragraph 5.3.4). I discuss
this issue further below.
BP1201
As indicated above, JSP318B and Def-Stan 00-56 were essentially procurement focused,
9.51 i.e. aimed at the
Defence Procurement Agency (DPA). Whilst they both indicated that the Safety Case concept should also
be applied to older systems and mature or ‘legacy’ aircraft, this was not their primary focus, which was the
application of the Safety Case concept to all new or modified systems. This reflected the ideal that a Safety
Case should be developed concurrently with the design of an aircraft to ensure that the design is influenced
by the Safety Case. Applying Safety Cases to a legacy aircraft obviously does not offer the same opportunity.
Pursuant to JSP318B, however, all IPTs were required to adopt an Equipment Safety Management System and