The Illusion of Safety: When Every Box Is Ticked but Nothing Is Safe

October 30, 2026

On 2 September 2006, RAF Nimrod MR2 XV230 caught fire in mid-air over Afghanistan and came down. Fuel had escaped during air-to-air refuelling, most likely through an overflow, and found its way to one of the aircraft's hot air ducts. All 14 crew on board were killed.

Five years earlier, the Ministry of Defence had commissioned a Safety Case for the Nimrod fleet. It took the best part of four years and cost around £400,000 to produce, built by the aircraft's manufacturer and checked by an independent adviser. It identified hazards. It carried risk assessments. It was reviewed and signed off.

It still missed the one fault that brought the aircraft down.

What paper safety actually looks like

The independent review into the loss of XV230, led by Charles Haddon-Cave QC, is one of the bluntest safety documents a UK public inquiry has produced. His verdict on how the Safety Case itself had been put together was that its production was "a story of incompetence, complacency, and cynicism."

Three organisations shared the work. BAE Systems built the first two phases of the Safety Case, the Ministry of Defence's own Nimrod project team built the third, and QinetiQ was brought in as independent adviser to check all of it. Between them they produced a document with a hole at its centre. BAE Systems had marked 40% of the hazards it identified as still "Open" and a further 30% as "Unclassified", meaning nobody had worked out how serious they were. The catastrophic fire risk from the Cross-Feed/SCP duct, the exact fault that killed the crew of XV230, sat inside that unresolved pile. At the handover meeting in 2004 where the work was signed off, BAE gave the Ministry of Defence team and QinetiQ the impression that everything had been properly completed, without disclosing how much had actually been left open.

The Ministry of Defence's own project team then went further. Looking at the one hazard BAE had left unresolved that mattered most, they formally rated the fire risk from the Cross-Feed/SCP duct, the fault that killed XV230's crew, as "Tolerable." Not unassessed. Not pending. Tolerable.

Look at what the Safety Case actually got wrong and the gap stops being abstract. The Safety Case rated the chance of a fuel system leak as "Improbable", a category meant for something that might happen to one or two aircraft in a whole fleet's service life. The fleet's own maintenance records showed an average of 40 fuel leaks a year between 2000 and 2005. It described the duct feeding the Supplementary Conditioning Pack as pressurised only briefly, during engine starts, when in practice it ran hot for long stretches of every flight. And it listed a fire detection and suppression system as a safeguard for the bay where the fire started, in a zone where no such system existed.

The document existed. It had the right title, the right sign-offs, the right structure. It was, in every formal sense, complete. It simply wasn't connected to what was actually true about the aircraft. Compliance and control are not the same thing, and the Nimrod Safety Case is what happens when an organisation stops noticing the difference.

Why nobody stopped to check

It would be easier to accept if the people involved had been careless or indifferent. They weren't. Haddon-Cave was explicit that the deeper failure sat in the culture around them.

Two things made the Safety Case believable even as it was failing. The first was history. The Nimrod had flown for three decades without this kind of loss, and that record quietly became its own argument: it had always been safe, so it probably still was. A Safety Case built on that assumption doesn't go looking for what might have changed.

The second was pressure that had nothing to do with engineering. The 1998 Strategic Defence Review set off a long run of cuts and reorganisation inside the Ministry of Defence, and the review found that business and financial targets had steadily crowded out safety and airworthiness as a priority through the years the Safety Case was being written.

And there was a specific, earlier warning. On 22 November 2004, the same hot-air duct ruptured on a sister aircraft, XV227, serious enough that the airframe was retired early. The review itself judged this should have been treated as a wake-up call for the rest of the fleet and for the Safety Case already underway. Instead it passed without reopening either question.

None of this required anyone to lie. It only required enough people, at enough points, to accept a conclusion that matched what they already expected to find. Haddon-Cave titled his report A Failure of Leadership, Culture and Priorities, not a failure of design. The duct and the fuel line were the mechanism. Leadership, culture and priorities were the cause, and that is exactly where he placed the responsibility.

His fix wasn't more paperwork. He recommended Safety Cases be renamed Risk Cases, brought back in-house, and judged against six tests remembered in the industry by the acronym SHAPED: succinct, home-grown, accessible, proportionate, easy to understand, and document-lite. Smaller and more honest, not thicker. The instinct after any failure is to write more down. The review's own conclusion ran the other way: the Safety Case regime had become ineffective and wasteful in its existing form, and the way back wasn't more compliance volume. It was fewer documents that someone actually had to stand behind.

The same pattern, every industry

Most sites will never write a document as formal as a military Safety Case. But the same risk assessment failures show up anywhere a piece of paper is allowed to stand in for a live question in process safety management.

Four places this shows up on an ordinary chemical site:

Tank overfill protection. A high-high level switch is listed as the control, but nobody has checked it's independent of the normal control system, still works, or has ever been proof-tested.
Management of Change. The modification is signed off and filed, but the paperwork never asked how it interacts with the equipment already on the line — the same gap at the heart of Drawn in Chalk.
COSHH. The assessment is current and signed, but the process it describes has since changed suppliers, flow rates or exposure conditions — see The COSHH assessment is not the control.
Permit to work. The permit is correctly completed, but nobody has independently checked the isolation against how the plant is actually configured today, the gap 7 Things Your Permit Training Left Out walks through in detail.

None of these are forged documents. They're real documents describing a plant that no longer quite exists. A document is not a control. The control is whatever actually stops the accident, whether or not it's described correctly on paper.

The Management of Health and Safety at Work Regulations 1999 don't ask for a risk assessment that was once suitable and sufficient. Regulation 3 requires it to be reviewed when there is reason to believe it is no longer valid, which includes a change in the work itself, not only a change in the calendar. The legal duty tracks reality, not paperwork. The gap between the two is exactly where Nimrod sat for four years.

The idea of tolerability of risk, and the ALARP principle that sits under it, assumes the organisation is continuously asking whether a control still reduces risk as far as reasonably practicable, not whether it was signed off once. A document that only confirms what everyone already believed, rather than testing it, is decoration by the time anyone reads it.

Five things to check tomorrow

Physically verify one safeguard. Pick a critical control named in a live risk assessment or HAZOP and go and check it exists, is correctly specified, and does what the paperwork says it does.
Ask what the risk rating is actually based on. Real failure data and operating history, or an assumption carried forward from the last version of the document.
List what's changed since the assessment was last written. Modifications, raw materials, suppliers, shift patterns, personnel, maintenance history.
Trace one near miss connected to the hazard. Find out whether it changed the assessment, or just got logged and closed.
Find out who's allowed to disagree. Can anyone question the conclusion without it costing them something?

The question worth asking

The people who wrote the Nimrod Safety Case weren't dishonest, and they weren't fools. They were working inside a process that had quietly stopped asking real questions and started confirming the answer everyone expected. Ninety recommendations later, the lesson wasn't about aircraft maintenance. It was about what happens when an organisation lets a document do the work that only genuine scrutiny can do.

Which document on your site would still say "safe" if nobody ever looked past the cover page, and when did anyone last try?

Related reading: for the distinction between a safety case and the basis-of-safety reasoning underneath it — and why a safety case can fail even when it technically exists — see The Paperwork Said It Was Safe, which looks at the same Nimrod investigation from the document-structure side.