The Nimrod Review - Official Documents

Aid to thinking
Chapter 22 – Best Practice for Safety Cases
22.24 The overriding theme which emerges from the Piper Alpha Report is that Lord Cullen wanted organisations to
think more clearly and logically about the risks inherent in their installations and activities. He saw Safety Cases
as a sensible means of achieving this end. Lord Cullen reiterated these views to me when I had the privilege of
visiting him in Edinburgh to discuss his Piper Alpha and Ladbroke Grove Reports. He emphasised to me: “Safety
Cases were intended to be an aid to thinking about risk, not an end in themselves”.
Civil Sector and other Military Fleets do not use Safety Cases
22.25
The Civil Sector does not use Safety Cases as an airworthiness management tool. Nor do the US Air Force
(USAF), Canadian Air Force or Australian Air Force use Safety Cases. They were unaware of the concept. They
each manage airworthiness in slightly different ways but aimed at the same general effect in terms of risk
identification and mitigation.
US Air Force Airworthiness Model (OSS&E)
28 22.26 The USAF concept of assuring Operational Safety, Suitability and Effectiveness (OSS&E) provides an allencompassing
structure within which the USAF governs the airworthiness of its mission systems, 29 whether
passenger carrying commercial derivative aircraft, hybrid commercial derivative aircraft, 30 or pure military aircraft
developments. OSS&E is intended to apply throughout the life of a product, from initial design to eventual
retirement. It is applied retrospectively to those systems whose conception predates OSS&E. Operational Safety, 31
Operational Suitability, 32 and Operational Effectiveness33 are established by ‘base-lining’ system characteristics
and airworthiness documentation at programme initiation, preserving them throughout project life and updating
them when required and authorised. The concept strives to achieve clear responsibility and accountability
by designating a Single Project Manager (SPM), who is “responsible for ensuring and preserving the OSS&E
throughout the operational life of the system and end items they manage, in support of the operational
commands and other users”. 34 He is responsible for approving all configuration and maintenance changes, and
modifications to the systems he manages. The SPM is required to work closely with the operational commands
that operate the system to promote a coherent and effective approach to ensuring that the system provides
the capability required. OSS&E is governed by a systems engineering (SE) process, 35 which in turn focuses on
configuration management, operational risk management and system safety. At the technical level the SPM
is assisted by a Project Chief Engineer. The Project Chief Engineer is the SPM’s designated technical authority
in the disciplined execution of the SE process, including development of the Systems Engineering Plan. He is
responsible to the SPM for the establishment, implementation, management, and control of the SE activities
necessary to develop and field robust products and systems that exhibit attributes of system security, OSS&E
and Mission Assurance36 . It should be noted that USAF acquisition projects (and SPM responsibility) transfer
from the acquisition agency to a logistics centre (responsible for the long-term support of the mission system)
as the project enters service. However, the acquisition agency will retain responsibility for the acquisition and
introduction of new equipment to the fielded mission system. This differs from the UK position in which a single
IPT will be responsible for a weapons system throughout its acquisition and life.
28 Detailed in Air Force Planning Document (AFPD) 63-12, Air Force Instruction (AFI) 1201 and Military Handbook (Mil Hdbk) 514.
29 The term mission systems encompasses aircraft, weapons and support equipment.
30 For example the E3 AWACs aircraft derived from a Boeing 707 airliner.
31 Operational Safety—The condition of having acceptable risk to life, health, property, and environment caused by a system or end-item when
employing that system or end-item in an operational environment. This requires the identification of hazards, assessment of risk, determination of
mitigating measures, and acceptance of residual risk.
32 Operational Suitability—The degree to which a system or end-item can be placed satisfactorily in field use, with consideration given to availability,
compatibility, transportability, interoperability, reliability, wartime use rates, maintainability, full-dimension protection, operational safety, human
factors, architectural and infrastructure compliance, manpower supportability, logistics supportability, natural environmental effects and impacts, and
documentation and training requirements.
33 Operational Effectiveness—The overall degree of mission accomplishment of a system or end-item used by representative personnel in the
environment planned or expected (e.g., natural, electronic, threat) for operational employment of the system or end-item considering organization,
doctrine, tactics, information assurance, force protection, survivability, vulnerability, and threat (including countermeasures; initial nuclear weapons
effects; and nuclear, biological, and chemical contamination threats).
34 AFPD 63-12, paragraph 3.9.1.
35 SE may be referred to as a discipline, a methodology, an approach, a practice, a process, a set of processes and sub-processes, or various other terms;
however, its fundamental elements – systematic technical processes and measurements – remain the same regardless of the collective nomenclature.
AFI63-1201 23 July 2007, paragraph 1.1.
36 AFI63-1201 23 July 2007, paragraph 1.1.2.2.
541