The Nimrod Review - Official Documents

The Nimrod Review
9.68
182
9.67.8 The Safety Case is a “live, working document and shouldn’t just gather dust in a cupboard”. Further,
not all Safety Cases are good. The HSE has reviewed many real safety cases in its role as a regulator and
some of the problems it has found with poor examples include: (i) they contain assertions rather than
reasoned argument; (ii) there are unjustified and implicit assumptions; (iii) some major hazards have not
been identified and are therefore never studied; and (iv) ownership of the Safety Case is not always
clear. 103
9.67.9 The MOD has a policy of requiring a retrospective assessment of safety for existing systems. This
assessment should be documented in a format which is essentially the same as for a Safety Case. 104
The White Booklet, therefore, provided useful general guidance as to what was required and expected with
respect to a Safety Case.
Nimrod Safety Management Plan
9.69
9.70
As explained above, pursuant to JSP318B, each platform was required to develop a Safety Management Plan
(SMP). In relation to the Nimrod IPT, the preparation of a SMP was regarded as a priority by the previous IPTL. He
delegated the task of drawing it up to the then Head of Air Vehicle, who explained in evidence that he used the
Jaguar/Canberra SMP as a template and as evidence of ‘best practice’. He felt he needed time to concentrate
on the task and so devoted part of his annual holiday to drawing it up. Leaving aside the assumption of safety
that I refer to below, he did a creditable job. The Nimrod SMP, which was issued by the IPTL in February 2002,
comprised a detailed and comprehensive set of rules and procedures for the safe management of the Nimrod.
It defined the Safety Management System (SMS) for ensuring the safety of the platform and set out: (1) the IPT
philosophy and system for safety; (2) the IPT SMS, including organisation, committees, documents and processes
through which hazards are identified, evaluated, managed and monitored; (3) the Safety Case and strategy for
the platform, setting a baseline for the legacy aircraft and a structure for ongoing safety development; (4) the
audit programme by which the SMS efficacy would be monitored; and (5) a programme of work to implement
the SMS. The SMP’s treatment of topics is outlined in further detail below. The Nimrod SMP was revised in
August 2003 by Frank Walsh on his appointment as Safety Manager (see further below).
The Executive Summary of the SMP stated:
105
“By virtue of a range of traditional methods, there is a high level of corporate confidence
in the safety of the Nimrod aircraft. However, the lack of structured evidence to support
this confidence clearly requires rectifying, in order to meet forthcoming legislation and to
achieve compliance with JSP 318B.” (emphasis added)
9.71 Lord Cullen explained that a Safety Case was, primarily, a matter of a company assuring itself that its operations
were safe, and only secondarily a matter of demonstrating this to the regulatory authorities. 106 The problem
was that those involved in producing the NSC embarked on the process believing the Nimrod type was safe (c.f.
the repeated statements by the Nimrod IPT and BAE Systems that “...there is a high level of confidence in the
safety of the Nimrod...”). For this reason, therefore, there was no real need for them to assure themselves of
something that they assumed to be the case, i.e. that the Nimrod was safe. This attitude was unfortunate and
served to undermine the integrity and rigour of the Safety Case process itself (see further Chapter 11).
103 Ibid, pages 16–17.
104 Ibid, page 17.
105 Nimrod SMP, Executive Summary, page 3.
106 Cullen, paragraph 17.35.