The Nimrod Review - Official Documents

The Nimrod Review
180
9.62.2 Another change was to the Risk Classification Table contained in the annexes – the newer edition
included a further Accident Probability Category of “Incredible”.
9.62.3 Issue 3 also included in the annexes a Generic Hazard Log Flowchart which set out a generic process
that IPTs should adopt to ensure that the information recorded within the hazard log was correct.
Guidance for Safety Cases
9.63 Given the deadline in Issues 2 and 3 of BP1201, just what guidance was available to the Nimrod IPT as to how in
fact to implement the requisite SMS, carry out the required risk analysis, and ultimately produce the Safety Case?
9.64 As indicated above, in terms of practical guidance ( i.e. explaining how to actually produce a Safety Case), the
relevant military regulations dealing with Safety Cases were somewhat thin, focusing instead on the aims of the
Safety Case and the guiding principles to be applied. Indeed, in paragraph 0.4 of Issue 2 of Def-Stan 00-56,
it was expressly stated “This Standard assumes a working knowledge of the techniques for hazard analysis
and safety assessment”. This ‘assumption’ is perhaps what led Frank Walsh (the Nimrod IPT Safety Manager)
to complain to ES(Air) in relation to a draft version of Issue 3 of Def-Stan 00-56 about the “lack of a hazard
assessment framework” and “the lack of any suggested Hazard Log format”. 89 That said, arguably the best
practical guidance in terms of the relevant military regulations was in fact to be found in the Guidance in Part 2
of Def-Stan 00-56, Issue 2 which, amongst other things:
9.65
9.66
Provided a suggested Hazard Log structure and a breakdown of the information that it should
include; 90
Sought to explain how to carry out Hazard Identification, including explaining the concepts, tasks and
requirements involved in Preliminary Hazard Analysis, System Hazard Analysis, Functional Analysis and
Zonal Analysis;
Sought to explain the objective, formulation and application of safety criteria, including the different
severity and probability categories; and
Sought to explain risk estimation, including how to identify accident sequences and how to categorise
accidents.
Whilst this Guidance was undoubtedly more helpful than the very limited contents of JSP318B, the reader could
be forgiven for still wondering how best to go about actually performing e.g. a functional or zonal analysis. The
same may be said of earlier, non-regulatory guidance, such as the “Guidance for the provision of an aircraft
Safety Case” 91 produced by the Defence Evaluation and Research Agency (DERA) 92 and issued back in March
1998. 93 Again, this identified the guiding principles and purpose of a Safety Case but did not specify just how
one was to go about identifying the possible hazards which could arise. A balance needs to be struck between
pure ‘goal-based’ regulations and overly prescriptive regulations.
It is nonetheless clear that, at least by 2002, there was an understanding within (at least parts of) the MOD of
the fundamental aims and philosophy that should underpin a Safety Case. The very least that can be said is that
there was material available which set out the aims of Lord Cullen’s recommendations in the Piper Alpha report.
Most notably in this respect, in 2002, Advantage Technical Consulting under contract to the MOD produced
Issue 1 of “An Introduction to System Safety Management & Assurance”. This has come to be known as the
‘White Booklet’ and is still freely available today (as amended) 94 on the MOD intranet, 95 described as an “entrylevel
reference for system safety management”, its stated purpose being to provide an introduction to system
safety management concepts, terms and activities.
89 Email from Frank Walsh to ES(Air), dated 1 March 2004.
90 Def-Stan 00-56 (Part 2), Issue 2, paragraph 5.8.
91 DERA/AT&E/MC/TR0005/1.0.
92 Forerunner to QinetiQ.
93 See, in a similar vein, “Scoping Study for a Generic Specification on the Retrospective Application of Safety Cases to UK Military Helicopters”, Report
Number 305E287/1, dated June 1999, prepared by BMT Reliability Consultants Limited for the Defence Helicopter Support Authority.
94 The current edition is Issue 2, dated July 2005, which expands slightly upon the earlier version.
95 http://www.mod.uk/DefenceInternet/AboutDefence/CorporatePublications/DefenceEstateandEnvironmentPublications/ASEG/
ThewhiteBookletAnIntroductionToSystemSafetyManagementAndAssurance.htm