The Nimrod Review - Official Documents

The Nimrod Review
Introduction
22.1 The background to Safety Cases and the MOD Safety Case regime is set out in Chapter 9 of this Report.
22.2 A Safety Case itself is defined in the military context as “a structured argument, supported by a body of
evidence, that provides a compelling, comprehensible and valid case that a system is safe for a given application
in a given environment”. 2
22.3
22.4
22.5
22.6
534
I am concerned that the Safety Case regime has lost its way. Many Safety Cases are not currently achieving the
purpose for which I believe they were originally intended. As Lord Cullen pointed out in the Ladbroke Grove
Rail Inquiry, the purpose of the Safety Case regime was to “encourage people to think as actively as they can to
reduce risks”. 3 Instead, in some instances, Safety Cases seem to be achieving the opposite effect: giving people
a false sense of security that a Safety Case is some sort of paper ‘vault’ into which risks may be safely deposited
and forgotten about. There is a pervading sense that the mere fact of a Safety Case means the platform is
safe.
I am concerned that the exponential growth of ‘the Safety Case industry’ has led to a culture of ‘paper safety’
at the expense of real safety.
I am concerned that the growth of Safety Cases has led to a significant diversion of resources and reasoning
away from the platform or equipment itself; time, money, and manpower which would be better spent on more
hands-on attention, maintenance, checks and/or upgrades for the platform itself.
It is easy to produce vast quantities of paper; it is more difficult to focus on the key hazards and think about
them.
Current Shortcomings
22.7
The current shortcomings of a significant proportion of Safety Cases include:
(1) Bureaucratic length: Safety Cases and Reports are too long, bureaucratic, repetitive and comprise
impenetrable detail and documentation. This is often for ‘invoice justification’ and to give Safety Case
Reports a ‘thud factor’.
(2) Obscure language: Safety Case language is obscure, inaccessible and difficult to understand.
(3) Wood-for-the-trees: Safety Cases do not see the wood for the trees, giving equal attention and treatment
to minor irrelevant hazards as to major catastrophic hazards, and failing to highlight, and concentrate on
the principal hazards.
(4) Archaeology: Safety Cases for ‘legacy’ platform often comprise no more than elaborate archaeological
exercises of design and compliance documentation from decades past.
(5) Routine outsourcing: Safety Cases are routinely outsourced by Integrated Project Teams (IPTs) to outside
consultants who have little practical knowledge of operating or maintaining the platform, who may never
even have visited or examined the platform type in question, and who churn out voluminous quantities of
Safety Case paperwork (‘bumpf’ 4 and outsized GSN charts) in back offices for which IPTs are charged large
sums of money.
(6) Lack of vital operator input: Safety Cases lack any, or any sufficient, input from operators and maintainers
who have the most knowledge and experience about the platform. In his comments on the Nimrod XV230
BOI Report the Commander-in-Chief Air Command, Sir Clive Loader, said, correctly in my view, that any
review of the Nimrod Safety Case (NSC) “must involve appropriate air and ground crews in order to ensure
that current practices are fully understood; those personnel, after all, both know most about how our
aircraft are operated and flown, and also have the greatest personal interest in having levels of safety with
which all involved are comfortable.” 5 Operators at RAF Kinloss were not even aware of the existence of
the original Nimrod Safety Case.
2 Defence Standard 00-56, paragraph 9.1.
3 Ladbroke Grove Rail Inquiry Part 2 Report, paragraph 7.19.
4 The term used by one of BAE Systems’ employees drawing up the Nimrod Safety Case in 2004.
5 BOI, Part 5, Commander-in-Chief Air Command’s Comments dated 2 November 2007.