The Nimrod Review - Official Documents

The Nimrod Review
9.57
178
BP1201 recognised that such an ‘implicit’ Safety Case was less desirable than an ‘explicit’ one and set out in
Annex C a strategy for the safety assessment of legacy systems. The ‘strategy’ laid down in BP1201 comprised
four phases:
9.57.1 Phase 1 – Form a strategy for constructing the Safety Case: This phase was to culminate in the completion
of an ESMP for the Safety Case which had been reviewed and endorsed by the PSWG.
9.57.2 Phase 2 – Form a strategy for managing the acceptability of safety throughout the aircraft’s operational
life: This would rely upon the implicit Safety Case and subsequent changes being acceptably demonstrated
within an explicit Safety Case.
9.57.3 Phase 3 – Construct the Safety Case: The explicit Safety Case structure was to contain the following
components: (i) Safety Management Plan; (ii) (Limited) Safety Assessment; (iii) Hazard log; and (iv) Safety
Case Report. It was to contain a safety assessment which provided an assurance that all the top level
hazards presented by the aircraft had been satisfactorily managed during its operational life.
9.57.4 Phase 4 – Manage the acceptability of safety throughout the aircraft’s operational life: Current
airworthiness related management systems, i.e. change control and reporting procedures, would have
to be adapted to support the explicit Safety Case.
9.58 In my view, there are a number of fundamental problems with, or objections to, the notion of an ‘ implicit’ Safety
Case. First, it is something of an oxymoron: one either prepares a proper ‘Safety Case’ or one does not. Second,
the concept of an “implicit Safety Case” does not comply with Lord Cullen’s concept of a “thorough assessment”
of the risks posed by a platform. This is because, in effect, the notion assumes that a legacy aircraft is safe merely
because it was built to design and has been operating without mishap for a number of years. Third, the very
fact that BP1201 expressly permitted such an assumption is, perhaps, undesirable in itself, because it may tend
to undermine the resolve of those carrying out the Safety Case. 84 It is also troubling that the ‘Phase 1 strategy’
in Annex C of the original BP1201 referred to above included the statement: “make the basic assumption that
the aircraft is already operating to acceptable levels of safety and determine that level of safety.” Any genuine
assessment should, however, be a matter of engineering judgment, not assumption. Otherwise, the process is
self-defeating.
9.59
It should be noted that Issue 2 of BP1201, published in September 2002, did not include the guidance contained
in the former Annex C, although it continued to endorse the notion of an implicit Safety Case for legacy
systems. Otherwise, it largely followed the original BP1201, with the addition of the further comment that the
purpose of a hazard Log was “to provide a ‘corporate memory’ for IPT managers, and potentially, operators, of
the hazards, associated safety risks and mitigating action”. 85
84 C.f. the reference to the NSC being “underpinned” by the in-service history in BAES Equipment Safety Case Baseline Report No. MBU-DEF-C-NIM-
SC0713 dated September 2004, page 4.
85 BP1201, Issue 2, paragraph 14.