The Nimrod Review - Official Documents

The Nimrod Review
11.6 Second, the NSC became a documentary exercise and an end in itself. As explained in Chapter 9, the
raison d’etre of a ‘Safety Case’ is to ‘identify, assess and mitigate’ all potential significant hazards to pieces
of equipment, platforms or installations, including hidden, or previously unidentified, hazards. Lord Cullen
regarded the drawing up of a ‘Safety Case’ as merely a means to achieving this end, i.e. it was intended to
provide a structure for critical analysis and thinking, or a framework to facilitate a thorough assessment and
addressing of serious risks. Unfortunately, in the case of the NSC, the production of a ‘Report’ became an end
in itself. Critical analysis descended into a paperwork exercise. Compliance with regulations was the aim. This
was partly because thinking on all sides was fatally undermined that by the assumption that the Nimrod was
safe anyway.
11.7 Third, the seeds of these problems were partly sown by BP1201 which espoused an “ implicit Safety Case”
for legacy aircraft based on a “basic assumption that the aircraft is already operating to acceptable levels of
safety.” 3 The notion of an “implicit” Safety Case is, however, something of an oxymoron. A Safety Case is
intended to be an exercise in critical thinking and actual assessment of risk. An “implicit” Safety Case, based on
the assumption there are no actual risks, is the antithesis of this. First, contrary to the philosophy expounded by
Lord Cullen, 4 an “implicit” Safety Case sanctions reliance on past success as a guarantee of future safety in lieu
of a proper risk analysis based on sound engineering practice. Second, it encourages ‘documenting’ the past
rather than carrying out a fresh assessment of the potential risks in the future, and thus is an invitation to those
inclined to paperwork exercises.
11.8
264
5 Fourth, as Professor John McDermid pointed out to the Review, there is also a danger in merely contracting for
a Safety Case ‘report’, as opposed to a proper ‘risk analysis’. If one contracts for the former, then this is precisely
what one is likely to get. The Nimrod IPT contracted for a “Safety Case report” to comply with its obligations
under BP1201. The Nimrod IPT’s own Safety Management Plan (SMP) highlighted that there was already a
“high level of corporate confidence in the safety of the Nimrod aircraft”, but a lack of “structured evidence”
to support that confidence. This was the context in which the Nimrod IPT instructed BAE Systems to develop a
baseline safety case report. 6
3 Chapter 9, paragraph 9.58.
4 Subsequently recognised in the White Booklet in 2002, which stated that the non-occurrence of an accident was no guarantee of a safe system.
5 Professor of Software Engineering and leader of the High Integrity Systems Engineering Group within the Department of Computer Science at the
University of York.
6 Cf. to similar effect the comments of the (then) IPTL at the Inaugural PSWG meeting on 18 March 2002, see paragraph 10.45 of Chapter 10A.