Engineered to Fail · Part 1 of 6

Defence Safety Cases and the Human Operator: When Safe, Provided Becomes a Condition of Use

A safety case certifies a machine against its design envelope. When the operator enters that case as a condition of use, any injury can be reclassified as a failure to comply, and the documentation stays correct while people are hurt.

Dr Anthony Walker, PhD in thermal and occupational physiology. Founder and Managing Director, Optimised Human Performance.
Published 28 September 2026.

What did the Ajax safety documentation actually certify?

In July 2020, the British Army’s trials team began reporting injuries from noise and vibration in the new Ajax armoured vehicle. The UK National Audit Office later set out what happened next: "one month later the Army and DE&S signed off safety documentation that said, with some limitations on use, the vehicles were safe to commence training."

That sentence is the reason for this series, and for the book behind it.

When the Public Accounts Committee asked about Exercise TITAN STORM in March 2026, the Department’s answer was precise. It said it "had no safety concerns about Ajax provided it was operated and maintained correctly within its design parameters", and that the incident occurred because the vehicles "had not been operated or maintained within those parameters." Under questioning, it accepted that cross-country driving, during which track tension alters, "was not wilful ignorance, but a normal part of operating in armoured vehicles." Its immediate solution was to instruct soldiers to do maintenance checks every time they stop the vehicle.

Read together, those statements expose the logic of the assurance process. The safety case certifies the machine against its design envelope, and the soldier enters that case as a condition of use. Once the human is written in as a condition, any injury can be reclassified as a failure to comply, and the documentation stays correct while people are hurt. The Committee’s summary named the operational consequence: "Armoured vehicles which injure soldiers when they are operated outside rigid parameters will be of little use on the modern battlefield."

Was the problem known before soldiers were injured?

The NAO found the Ministry of Defence "knew of noise and vibration issues before soldiers reported injuries but was not aware of the severity of potential problems", and that reporting from trials was "limited and slow, meaning that safety concerns were not shared or escalated". The Department later told Parliament’s Public Accounts Committee it was "unforgivable" that soldiers had been injured because of shortcomings with its safety processes.

The NAO recorded that the Department’s initial planning assumption was for the vehicles to be in service in 2017. On 6 November 2025 the Ministry announced that Ajax had declared Initial Operating Capability, and the minister described "a vehicle that is safe, effective and truly cutting-edge". In that same month, Exercise TITAN STORM was stopped when 33 soldiers reported symptoms from noise and vibration after operating in Ajax.

Why does treating the operator as a fixed input fail?

I have seen this time and time again. In my time on fire trucks we climbed into and out of appliances wearing breathing apparatus, under considerable stress. In Defence capability projects I have heard the same thinking expressed as a shrug: we will just get what the Americans give us, so why bother trying.

This is the premise of the book I am writing, Engineered to Fail. Across the programmes I have examined, the human is the highest-consequence system in the capability and the one Defence most reliably declines to engineer. The operator is treated as a fixed input, accommodated at the margins with limitations on use. A body has measurable tolerances, and a design either respects them or transfers the load onto the person inside it.

Can a system be redesigned around the operator instead?

It can, and there is a documented case. In October 2015 the US Air Force restricted pilots weighing less than 136 pounds from flying the F-35A "due to concerns of possible neck injuries that could result during ejection seat procedures." At first this was the same move as Ajax: define the operator the system can tolerate, and exclude everyone else. The exclusion was not marginal. According to the Air Force, "Over 50 percent of female pilots in the Air Force weigh below 136 pounds."

In May 2017, three modifications were implemented to the F-35A ejection system and the restriction was removed, about nineteen months after it began. The system was changed to fit the people who would fly it.

That contrast is the test. When a system exceeds the body, an institution can redefine the operator or redesign the system. My argument is that Defence reaches for the first by default, and arrives at the second only when the exclusion becomes impossible to sustain.

Where would this argument be wrong?

This series tests the book’s argument before it goes to print, one claim per issue. The claim in this first piece is that in Defence assurance, the human appears as a condition of use, where they should appear as a system to be designed for.

If you have sat on a safety or assurance board and watched the human designed for from the outset, I want that example. It is the evidence that would weaken my case, and I would rather find it now.

Dr Anthony Walker holds a PhD in thermal and occupational physiology and served fifteen years in operational firefighting, including station officer command. He is Founder and Managing Director of Optimised Human Performance, a specialist consultancy in human systems integration and work system design for Defence, aviation, emergency services and resources clients.