The Nimrod Review - Official Documents

9.52
9.53
9.54
Chapter 9 – Background to Safety Cases
JSP318B further prescribed that its requirements should be applied to mature systems as far as was “reasonably
practicable” (see above). With this in mind, Equipment Support (Air) (ES(Air)) within the Defence Logistics
Organisation 77 published ES(Air) Business Procedure 1201 (BP1201) to provide direction to the in-service IPTs.
BP1201 set out the mandatory core content of a Safety Management System (SMS) and prescribed that all
IPTLs were to ensure that Project Engineers (PEs) were to produce and maintain an Equipment SMP (ESMP) for
all equipment for which they had airworthiness and safety responsibility. 78 It also provided for a Project Safety
Working Group (PSWG) to be formed within each IPT to support each Project SMS and to co-ordinate the
ESMP. 79 Every SMS was also to be subject to assurance and audit processes to provide evidence that safety was
being properly managed. 80 Annex E detailed the essential elements of the audit regime, providing for either
internal self audit, internal independent audit or external audit at least twice a year.
In relation to Safety Cases, BP1201 provided that a Safety Case: (1) was to remain the responsibility of the
Project Engineer (PE); (2) was to be maintained throughout the life of the equipment; and (3) was to continue
to provide the justification that the equipment remained tolerably (targets achieved and ALARP demonstrated)
safe. 81 It set out a pyramid structure for a “credible, complete, consistent, and comprehensible Safety Case”,
which comprised four levels:
9.53.1 Safety Evidence: This is the foundation of the Safety Case and includes the Hazard Log. Safety evidence
includes safety targets, standards, design and development data, analysis, simulation and modelling,
test results and service experience.
9.53.2 Safety Argument: The analysis and justification that the Safety Evidence is sufficient to demonstrate that
the equipment is tolerably safe.
9.53.3 Safety Case Report: A summary of the Safety Argument that supports the Safety Statement, includes all
salient issues from the Safety Argument and includes recommendations for future work.
9.53.4 Safety Statement: The certificate by the IPTL that the equipment is “tolerably safe”.
BP1201 explained that all hazards identified from any source were to be managed through the Hazard Log,
which was fundamental to the Safety Case. The setting of accident severity categories and probability categories
was to be based on those in Def-Stan 00-56 but categories were to be chosen that permitted the adoption of
the Risk Classification Table at Annex D to BP1201 (see further below). 82
Legacy Aircraft and ‘Implicit’ Safety Cases
9.55
9.56
Regrettably, it may be said that it was in BP1201 that the seeds of a fundamentally flawed approach to the
application of Safety Cases to legacy platforms were sown.
BP1201 recognised that most aircraft in (then) current service did not enjoy a formal Safety Case and further
stated that it was not necessary for a full retrospective safety case to be prepared, for much of the effort would
be nugatory. It permitted, therefore, what it called an “implicit Safety Case”, namely, that the PE responsible for
the legacy system could accept the current Release to Service (RTS) as an implicit Safety Case by conducting a
general safety assessment to assure that there were no known reasons not to accept the current clearances and
underlying safety evidence. 83 In other words, the fact that an aircraft had been built to a standard applicable
at its build date, had received the necessary clearances and operated satisfactorily since then could be taken
as acceptable in lieu of an explicit Safety Case, provided that a general safety assessment did not reveal any
evidence to the contrary.
77 See Chapter 12.
78 BP1201, paragraph 5.
79 Ibid, paragraph 6.
80 Ibid, paragraph 11.
81 Ibid, paragraph 7.
82 Ibid, paragraph 8.
83 Ibid, paragraph 9.
177