Operational Safety Cases

1. Operational Safety Cases

2. 2 Safety policy and airworthiness regulations fail to address adequately safety in operation: Deliver �Fit-to-Fight� Improving proactively MOD�s reputation, legislative compliance and public perception Introduction of Operational Safety Cases will improve operational and safety investment decision-making Implementation of an explicit, defensible and consistent �operational� safety management framework will require: Clarity of Duty Holder roles and responsibilities Processes for the transfer of responsibility for, and acceptance of, risk Safety Case argument/evidence update to �operational� standard Emphasise for bullet one that the proposed approach in this brief is consistent with: DE&S Business Strategy 2008-12 Strategic Objective SO 1, 4 and 5 (need for robust operational safety management process that meets legislation and commands confidence in the safety of the equipment and services DE&S provides) and Continuous Development priority in Para 2.7. DIS Para B.4.22 (Safe and lawful operation of aircraft, mitigating legislative, financial and operational pressures) DIS v2.0 (damage to reputation by public perception/media and). Defence Environment and Safety Board Safety Environment and Scientific Risk Report 2007 Para 16 (managing reputation is defined as a strategic risk). A recommendation in the Nimrod BOI regarding the need for operational safety cases. Emphasise for bullet one that the proposed approach in this brief is consistent with: DE&S Business Strategy 2008-12 Strategic Objective SO 1, 4 and 5 (need for robust operational safety management process that meets legislation and commands confidence in the safety of the equipment and services DE&S provides) and Continuous Development priority in Para 2.7. DIS Para B.4.22 (Safe and lawful operation of aircraft, mitigating legislative, financial and operational pressures) DIS v2.0 (damage to reputation by public perception/media and). Defence Environment and Safety Board Safety Environment and Scientific Risk Report 2007 Para 16 (managing reputation is defined as a strategic risk). A recommendation in the Nimrod BOI regarding the need for operational safety cases.

3. 3 Lines of Development

4. Risk Owning, Managing & Transferring

5. 5 Safety: Health & Safety at Work Act: Section 2(1) & 3: Employer�s duty to protect employees Section 6: Manufacturer�s duty to provide safe goods Corporate Manslaughter and Corporate Homicide Act: Corporate duty to ensure activities are managed or organised to ensure safety of others Assets: Safeguarding of assets Operational Capability Military Aircraft: Naval, military or air force aircraft of any country, and: Any aircraft being constructed under contract entered into by SofS, and: Any aircraft that SofS determines should be treated as a Military Aircraft. Military Aircraft: Naval, military or air force aircraft of any country, and: Any aircraft being constructed under contract entered into by SofS, and: Any aircraft that SofS determines should be treated as a Military Aircraft.

6. 6 Duty Holders

7. 7 Duty Holders & Risk Transfer Material Duties holder should seek to reduce hazards to the lower left and should be empowered to accept them if they are below a set level (C&D). Where risk can�t be mitigated by a change by a material change to the Materiel or Services, then acceptance of that risk should be by the People Duty Holder. However the People Duty holder can only achieve risk acceptance if fully furnished with the facts that surround any transferred risk. Foe example, plans to make material changes impact exposure etc. The People Duty Holder might wish also mitigate the risk through an operational change or limitation. Material Duties holder should seek to reduce hazards to the lower left and should be empowered to accept them if they are below a set level (C&D). Where risk can�t be mitigated by a change by a material change to the Materiel or Services, then acceptance of that risk should be by the People Duty Holder. However the People Duty holder can only achieve risk acceptance if fully furnished with the facts that surround any transferred risk. Foe example, plans to make material changes impact exposure etc. The People Duty Holder might wish also mitigate the risk through an operational change or limitation.

8. 8 Common Understanding of Risk

9. 9 Temporal Nature of ALARP

10. 10 Development of Risk Processes Material Duties holder should seek to reduce hazards to the lower left and should be empowered to accept them if they are below a set level (C&D). Where risk can�t be mitigated by a change by a material change to the Materiel or Services, then acceptance of that risk should be by the People Duty Holder. However the People Duty holder can only achieve risk acceptance if fully furnished with the facts that surround any transferred risk. Foe example, plans to make material changes impact exposure etc. The People Duty Holder might wish also mitigate the risk through an operational change or limitation. Material Duties holder should seek to reduce hazards to the lower left and should be empowered to accept them if they are below a set level (C&D). Where risk can�t be mitigated by a change by a material change to the Materiel or Services, then acceptance of that risk should be by the People Duty Holder. However the People Duty holder can only achieve risk acceptance if fully furnished with the facts that surround any transferred risk. Foe example, plans to make material changes impact exposure etc. The People Duty Holder might wish also mitigate the risk through an operational change or limitation.

11. 11 Risk Issues Define process for owning, managing and transfer risk between Duty Holders Dependent on: Clear understanding of Duty Holder relationships (Industry, IPT, AOA, RTSA & other DLODs) Lexicon of Risk Classification Determining ALARP

12. SMS Providing Governance

13. 13 DLS Guidance draws attention to legal view on �Duty Holders�: Section 3 HSWA - The duty holder can exercise control over both the conditions of work and where the activity takes place Section 37 (1) HSWA - The person to be appointed as duty holder, should at the very least be of the equivalent position of �director, manager or other similar officer� Section 1(3) CMCHA - Provides that �an organisation is guilty of an offence �. only if the way in which its activities are managed or organised by its senior management is a substantial element in the breach �.� ECHR Article 2 - Details �an individual�s right to life�� Highlight: HSWA Section 3 �This Section also places a ��general duty on employers to conduct their undertakings in such a way as to ensure, as far as is reasonably practicable, that persons other than themselves or their employees are not exposed to risks to their health and safety.� (NB Current allegation that Met Police commanders did not provide sufficient safety to the public during Stockwell shooting - potential read-across to an aircraft accident). ECHR Article 2 �an individual�s right to life� - Nimrod crew dependents currently alleging that MOD was in breach of ECHR Article 2. Note: CMCHA - Corporate Manslaughter and Homicide Act 2007 and ECHR - European Convention on Human RightsHighlight: HSWA Section 3 �This Section also places a ��general duty on employers to conduct their undertakings in such a way as to ensure, as far as is reasonably practicable, that persons other than themselves or their employees are not exposed to risks to their health and safety.� (NB Current allegation that Met Police commanders did not provide sufficient safety to the public during Stockwell shooting - potential read-across to an aircraft accident). ECHR Article 2 �an individual�s right to life� - Nimrod crew dependents currently alleging that MOD was in breach of ECHR Article 2. Note: CMCHA - Corporate Manslaughter and Homicide Act 2007 and ECHR - European Convention on Human Rights

14. 14 Interlinking SMS

15. 15 Managing Risks

16. 16 SMS Issues Need for Interlinking SMS downwards and upwards Congruent processes Clear understanding of Duty Holders, Roles & Responsibilities

17. Safety Cases Building Logical Arguments

18. 18 Safety Through Prescription Most High Risk Industries traditionally relied upon: A Prescriptive approach to Safety Regulation With a Safety Culture based on Compliance Where Compliance requires conformance to : Detailed Regulations Accepted Codes of Practise

19. 19 Why Prescriptive Approach Failed Prescriptive regimes require: Well established technologies Well understood failure modes Risk of failure when: Belief exists that �safety� is achieved when standards met Novelty & Complexity leads to unforeseen failure modes Prescriptive standards can no longer match pace of change Those writing the standards: Either no longer �understand� technology Or, so involved, no longer independent

20. 20 Safety Case Top-down �Goal Orientated� approach: Starts by defining final output level of safety Not technical means of achievement Demonstrates why an activity is safe Operator/Manufacturer develops specifically to match manner of operation Requires Quantitative and/or Qualitative Risk Assessment Greater risk: Tends towards Quantified Risk Assessment (QRA) Defined Risk Targets

21. 21 Prescription v Safety Case

22. 22 Safety Case

23. 23 Goal Structured Notation

24. 24 Goal Structured Notation

25. 25 Definition of Operational Safety Case All parties working together cohesively in clearly understood roles to deliver safe and effective operational capability to the front-line An Operational Safety Case includes�the Safety Case�detailing�the organisation and�risk management�structure surrounding the management of the RTS (ac SC) in an operational environment� - i.e. the ac SC is at the heart of the OSC. An Operational Safety Case includes�the Safety Case�detailing�the organisation and�risk management�structure surrounding the management of the RTS (ac SC) in an operational environment� - i.e. the ac SC is at the heart of the OSC.

26. 26 Operational Safety Case

27. 27 Operational Safety Case

28. 28

29. 29 Implementation Choices

30. 30 Operational Safety Case Issues Define breadth & depth of Safety Case DLODs Where does �End� start & finish in E2E? Provision of �Standard� GSN Need & Value of OSCs to Legacy, Enduring & New Capabilities

31. 31 Workstreams No 1: Amendment of policy, procedures, plans and guidance documentation No 2: Duty Holder roles and responsibilities for safety risk ownership (including Role of RTSA) No 2: Owning, transferring and managing safety risks & mitigations No 4: Upskilling & competence No 5: Delivery of OSC based on high-level argument structure