The Nimrod Review - Official Documents

Chapter 22 – Best Practice for Safety Cases
Processes
Action 12: Ensure that the independence of Airworthiness from the Project Team is established.
Action 13: Ownership of the methodology for undertaking the SC Review is to be clearly defined.
Action 14: Ensure greater awareness of Cassandra hazard log content at analyser level.
Action 15: Photographs of zones assessed to be available for reviewers.
Action 16: All processes to be clearly defined and documented.
Action 17: Ensure that the assessment processes are under configuration control.
Action 18: Ensure that all team members are working to the latest processes.
Action 19: Processes to be reviewed and approved by key stakeholders.
Action 20: Process to be developed for identifying quality and husbandry issues during the ZHA surveys.
Action 21: Advise the NimIPT immediately of any safety related issues discovered.
Action 22: Method of escalating issues to be defined, in particular in relation to “out of scope issues”.
Action 23: Cross-zonal interactions to be addressed by “Integration Assessments”.
Action 24: Clearer definition of A,D&Es and any limitations to be established.
Action 25: A Stakeholder Group Technical Review, with representatives from all Stakeholders, to be established
to review all SC products.
Action 26: The breakdown of zonal interactions into individual mechanisms to be documented.
Action 27: Review the approach, within the Cassandra hazard log, for the method of identifying differences
between MR2 and R1.
Action 28: Ensure zonal differences between MR2 & R1 zones are fully understood.
Action 29: Seek additional sources of information for determining failure rate.
Action 30: Ensure that there is one owner for each hazard who is responsible for collating information from
supporting Functions when compiling the assessment.
Action 31: Ensure that a full description of hazard to be analysed is included within the assessment (to avoid
misinterpretation).
Action 32: Separate assessment to be undertaken for each hazard cause.
Action 33: Investigate alternative video technologies that could be used to support the assessments.
Action 34: Ensure that photographs of zones are clearly annotated with the aircraft orientation.
Action 35: All zonal hazard assessors to visit the aircraft when reviewing the aircraft zone.
Action 36: Assessments of zonal hazards to include maintainer input.
Deliverables and Acceptance
Action 37: Define the approach to be taken by the NimIPT and by BAES in relation to any “Open” hazards.
Action 38: Establish a clear point of ownership transfer to the NimIPT for the deliverables from SC2.
Action 39: Refine the handover process for the deliverables from SC2.
Action 40: Evidence of concurrence from the ITE (QinetiQ) should be obtained for each hazard.
Action 41: A record of the acceptance of the hazard assessment by the Stakeholder Group Technical Review
should be maintained.
Action 42: Review the technical accuracy of any NimIPT mitigation actions, against the hazards, prior to entry
into Cassandra hazard log.”
The University of York
22.16
Leading experts and service personnel charged with reading Safety Case material have expressed concerns
to me as to whether Safety Cases are, in fact, improving safety and whether they are a cost-effective means
of so doing. I share these concerns. Professor John McDermid’s Department at the University of York is a
centre of excellence and the world’s largest academic research group looking at safety critical systems. Professor
McDermid made a number of pertinent points to me about Safety Cases:
537