On 2 September 2006, RAF Nimrod XV230 was on a routine surveillance mission over Helmand province, Afghanistan, when fuel leaking from a coupling in one of its bays met a hot air duct and ignited. The aircraft caught fire in mid-air and crashed near Kandahar. All fourteen people on board were killed — Britain's biggest single loss of life in one incident since the Falklands War.
The investigation ran for 22 months. When Charles Haddon-Cave QC delivered the Nimrod Review in October 2009, he didn't point to a missing document. The Nimrod fleet had a Safety Case. It existed. It had been reviewed. It had been signed off.
It just hadn't done its job. Haddon-Cave found that budget pressure inside the Ministry of Defence, building for years before the crash, had pushed the whole process toward box-ticking — a huge volume of paperwork that satisfied the requirement for a Safety Case without ever properly testing whether the aircraft's real hazards, including a long-known pattern of fuel leaks, had actually been understood and controlled.
Safety case and Basis of Safety aren't the same document
The two terms get used almost interchangeably on sites, and that's part of the problem.
A Basis of Safety is usually scenario-level. It answers one question at a time: why do we believe this particular hazard is controlled? It sets out the credible scenario, the safeguard relied on, and the technical justification — the calculation, the test, the standard applied — that shows the safeguard is actually adequate.
A safety case is the bigger structure those pieces are meant to sit inside. It's a formal argument — a claim that risk is adequately controlled, the reasoning behind that claim, and the evidence that the reasoning holds — usually built across a whole site or system, not just one hazard.
Put simply: a Basis of Safety is one of the building blocks. A safety case is what those building blocks are supposed to add up to.
Why a safety case can fail even when it exists
The uncomfortable lesson from Nimrod is that having a safety case — even a large, formally approved one — guarantees nothing by itself.
Haddon-Cave's review found that the process behind it had drifted into something closer to an administrative exercise than a technical one: reviewers working through an enormous volume of paperwork, much of the analysis contracted out with limited independent challenge, and warning signs — including a known pattern of fuel leaks on the Nimrod fleet going back years — that never translated into a hard stop.
The real gaps were in the individual Basis of Safety reasoning underneath it, hazard by hazard, system by system. A safety case built on top of weak or incomplete basis-of-safety work is still weak, however complete the finished document looks. Size and formality aren't the same as rigour.
What this means for a site
If you're building either document, the question to keep asking is the same one at every level: is this claim backed by real technical reasoning, or does it just look complete?
A safety case assembled from solid, individually justified Basis of Safety arguments is worth having. A safety case assembled mainly to produce a document — with the underlying technical justification thin, inherited, or untraceable — creates exactly the kind of false confidence Haddon-Cave described.
Five things to check tomorrow
- Pick one claim in your safety case or safety report and trace it down to the actual Basis of Safety behind it. If there isn't one, you've found the gap.
- Check who did the technical work behind a key safeguard, and whether anyone independent actually challenged it.
- Look for a known, recurring fault or near-miss — a leak, a stuck gauge, a nuisance alarm — and ask whether it was ever formally weighed against the safety case's assumptions, or just quietly worked around.
- Ask whether your safety case has grown by volume rather than by rigour — more pages, not more justification.
- Pick one document on the shelf nobody's opened in a while, and check whether it would survive someone asking "why do we actually believe this?"
The question worth asking
The Nimrod Safety Case existed. It was large, formally reviewed, and officially signed off. Fourteen people still died because it didn't actually prove what it claimed to.
So: if someone asked you to defend one claim in your safety case — not read it aloud, defend it — could you?
Related reading: for how that same Safety Case rated the fault that killed the crew as "Improbable" and "Tolerable" while the fleet logged 40 fuel leaks a year, see The Illusion of Safety, which looks at the same investigation from the compliance-versus-control side.
Sources
Want this built into your training programme? See our Basis of Safety Training Course.