This may help or confuse the situation :
The ALARP (As Low As Reasonably Practicable) principle provides a means for assessing the tolerability of risk. In essence, it says that if the cost of reducing a risk outweighs the benefit, then the risk may be considered tolerable.
Ergo.a risk is ALARP if the cost of any reduction in that risk is grossly disproportionate to the benefit obtained from the reduction.
However if the risk to the aircraft is explosion or fire, then the benefit of reducing the risk is great. It follows that the cost of reducing the risk would have to be very high in order to say it was tolerable.
This is where I think the term tolerably safe stems from, I didn't see anywhere either in the BOI or Safety Case where the cost of reducing a risk was discussed or assessed.
I believe therefore that the XV230 was neither 'tolerably safe' nor ALARP as the risk in Dry Bay 7 was never assessed correctly and the mitigation put forward was erroneous.
To use a simple analogy, if the brakes need doing on your car because they won't stop the car, the risk to those on board is high and the cost is £300 say they have to be fixed to make it ALARP.
If there is danger to life or limb then even if the cost was £3000 it would not outweigh the risk. It can only be tolerable if the car is never driven or moved.
HSE guidance is that risks should be reduced unless the cost is “grossly disproportionate” to the benefit.
What cost would be “grossly disproportionate” to save the lives of 14 men and one Nimrod Mk2?
Having read most of Haddon-Caves report it is clear that certain companies wished to appear in a good light in order to 'please' the customer. This may explain the apparent anomaly between the first and second version.
Chapter 19 of thee HC review says:
(3) The meaning of “Airworthiness” is not sufficiently understood;
(4) The meaning of ALARP is not sufficiently understood;
Which says it all really.
He went on to say.
(10) QinetiQ failed to understand the meaning of ALARP
11.320 In my view, it is also a matter of concern that leading experts such as QinetiQ do not seem to understand basic concepts such as the meaning of ALARP (As Low As Reasonably Practicable).
11.321 The Executive Summary to QinetiQ’s Nimrod Fuel System Safety Review Report (QINETIQ/EMEA/IX/ SCR0702915,
October 2007, Issue 1) stated:
“Having considered the evidence referred to within this safety case report, noting that there are outstanding recommendations and the level of risk present to the fuel system is not ALARP, the operation of the fuel system is tolerably safe given the mitigation currently in place.” (emphasis added)
11.322 This report sowed much confusion. There is no such thing as ‘tolerably safe but not ALARP’. Risks are either ‘tolerable and ALARP’ or intolerable: