The Nimrod Review - Official Documents

Chapter 22 – Best Practice for Safety Cases
(11) Care needs to be taken to define the process whereby new hazards can be added to the Risk Case,
incorporated in the Hazard Log, and dealt with in due course, and how original assumptions about hazards
or zones are to be re-examined in light of new events. In the case of the XV227 incident in 2004, for
example, although the fact of the incident was entered in the CASSANDRA Hazard Log in relation to Hazard
H73 (‘no further action’), there is no evidence to suggest that the original assumptions of probability and
risk were ever looked at.
(12) Do not assume that, simply because an aircraft has flown safety for five or 25 years, it is safe (i.e. ‘implicit’
safety). The right attitude is a questioning attitude, as the former QinetiQ Safety Engineer, Witness L
[QinetiQ], emphasised to the Review:
MR PARSONS QC: The trouble is, if you start with the assumption that it is safe, you don’t
ask the questions.
WITNESS L [QinetiQ]: Yes. You should start with the assumption this aircraft isn’t safe.
You start with the assumption it is a fatigued aircraft. Prove to me that the wings are going
to stay on. Prove to me that the engines will keep flying. Prove to me that the engineers
that are servicing these engines have not become complacent because they have been
working on them so long. Regularly, when I joined QinetiQ, people would say: this is
a steam driven aircraft, nothing can go wrong with it, it is all hard wired, there is virtually
no software, there is very low risk, it is a very safe aircraft. That is the wrong position to be
in, especially if you are a safety engineer.
(13) The key question to be asked at all stages is: ‘What if?’
547