The Nimrod Review - Official Documents

22.32
Chapter 22 – Best Practice for Safety Cases
sensible time to do this exercise, however, is as and when such new operational challenges present themselves.
With limited resources available, spending money on theoretical paper exercises should be firmly discouraged.
Full Operational Safety Cases of the type proposed to the Review would require a pile of paper the size of the
Tower of Babel. 42
Equally, I do not think it is useful to have a ‘Russian doll’ series of separate Safety Cases along the lines of the
‘hierarchy’ suggested above. It seems to me that the most effective arrangement is the simplest: to have a single
Safety Case for each platform covering the risks of operating the platform which can be used: (a) to inform
and influence the daily management of a platform’s Airworthiness; and (b) to underpin the aircraft’s Release to
Service.
What is the best value for money?
22.33
22.34
As Counsel to the Inquiry put it to one witness, the essential question is ‘what is the best value for money?:
“MR PARSONS QC: … How do you improve safety and get the best value? …You have
a pot of money which will always be limited, and in the present climate it is going to be
even more limited. What is the best activity you can do to actually improve safety for the
people who fly these aeroplanes or use them? Is this kind of quite formal document-heavy
process, that requires a lot of time and effort to produce, the very best way of doing that,
or is there a better way to go forward?”
I do not believe that the current Safety Case regime represents value for money in terms of the net benefit
to Airworthiness for the MOD’s financial outlay. Much of this money would be better spent on improving
Airworthiness in other ways. The costs being charged by Industry for Safety Cases are very substantial. BAE
Systems’ charges for Nimrod Safety Case 2, for instance, are in excess of £3 million (which at the standard rate
advertised by BAE System for safety engineers of £40 per hour amounts to 75,000 man hours). As one former
QinetiQ safety engineer commented: “It’s a phenomenal sum of money. You could get some of the best safety
engineers in the country. You could employ York University to do that work and still make a massive profit and
end up with a safety case at the end of it that is absolutely thorough, that you could hang your hat on.”
Safety Case concept has a useful role
22.35
In my view, although it is not used by other fleets, the Safety Case concept has a useful role to play as an
Airworthiness management tool for MOD military platforms. It provides a useful vehicle and reference point for
risk management and, properly applied, should “encourage people to think as actively as they can to reduce
risks”, as Lord Cullen envisaged. 43 But the current Safety Case regime needs to be brought in-house, slimmed
down and re-focused in accordance with the Recommendations below.
Current definition of Safety Case is unhelpful
22.36
44 The situation has not been helped by the definition of “Safety Case” in Defence Standard (Def-Stan) 00-56 ,
which tends to encourage a laborious, discursive, document-heavy ‘argument’ (“a structured argument”, “a
body of evidence”) aimed at justifying a self-fulfilling prophesy (“system is safe”). Further, the tenets in BP1201
that Safety Cases must be“Credible, Consistent, Complete, Comprehensible and Changeable” are, in my view,
too amorphous to inject real rigour and focus into the process.
42 According to Genesis Chapter XI, the Tower of Babel was built in Nimrod’s kingdom by the survivors of the flood and their descendants. However,
as the Tower was built out of vanity for the glory of man, God dispersed the people throughout the world and made them speak different languages
to spread confusion. Hence the dictionary definition of Babel includes “a foolishly conceived lofty structure” and “a scene of confusion”.
43 Ladbroke Grove Rail Inquiry Part 2 Report, paragraph 7.19.
44 See further Chapter 9.
543