Module 1 Safety Management Fundamentals - acac · At the end of this module, ... concepts and principles from the ICAO SMM (Doc 9859, 3rd Ed) ... 9 Integration of management systems

10/01/2017

1

Copyright © 2015 CAAS. No part of it may be used, circulated, quoted, or reproduced for distribution outside CAAS without prior written permission. Every care has been taken to ensure that the

information contained here is accurate. Nonetheless, CAAS does not warrant the currency, accuracy or completeness of the information contained in this document, nor does CAAS accept liability

for loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from reliance on the information contained in this presentation.

Module 1Safety Management Fundamentals

Copyright © 2015 Civil Aviation Authority of Singapore. All rights reserved.

Module 1: Safety Management Fundamentals- Overview

Provide participants with the knowledge on fundamental

safety management principles and concepts, including the influence of human as well as organizational factors in safety management.

2

10/01/2017

2


At the end of this module, you will be able to describe

and explain the fundamental safety management

concepts and principles from the ICAO SMM (Doc 9859,

3rd Ed)

Module 1 Objective

3


1 Concept of safety

2 Evolution of safety

3 Accident causation

4 People, context and safety

5 Error & violation

6 Safety culture

7 The management dilemma

8 Change management

9 Integration of management systems

10 Safety reporting & investigation

11 Safety data collection, analysis & SPIs

12 Hazard identification & risk mitigation

13 Prescriptive & performance based requirements

Module 1: Sections

4

10/01/2017

3


Section 1:The concept of safety

5


What is safety

� Zero accidents?

� Freedom from hazards?

� Error avoidance?

� Good organizational safety culture?

� Regulatory compliance?

6

10/01/2017

4


Considering the facts

� Total elimination of accidents (and serious incidents) is unachievable

� Failures will still occur, despite the most accomplished prevention efforts

� No human activity or human-made system can be guaranteed to be absolutely free from hazard and operational errors

Therefore…

7


Definition of Safety

The state in which risks associated with aviation activities, related to, or in direct support of the operation of aircraft, are reduced and controlled to an acceptable level

- Annex 19 (2nd ed, Jul 2016)

8

10/01/2017

5


The concept and definition of safety in Annex 19 is -

a) The total elimination of accidents and serious incidents

b) Absence of hazards and threats

c) Absence of errors and violations

d) Due diligence in safety risk management to achieve an

acceptable level of safety performance

The concept of safety – Quiz

9


Section 2: Evolution of safety

10

10/01/2017

6


The evolution of safety thinking

11

TO

DA

Y

1950s 2000s1970s 1990s

TECHNICAL FACTORS

HUMAN FACTORS

ORGANIZATIONAL

FACTORS

Source: James Reason


The focus of today’s safety management approach should be on:

a) Technical factorsb) Human factorsc) Organizational factors

d) All of the above

Evolution of safety – Quiz

12

10/01/2017

7


Section 3: Accident causation

13


The concept of accident causation

14

Accidents due to combination of inadequate defences(D), active failures(P),

hazards, threats, unsafe situations(W) and latent conditions(O).

10/01/2017

8


Bow-Tie Accident Causation Model

15


Practical drift & Accident causation

System

design

Baseline performance

Practical drift

Operational

deployment

Baseline performance

Practical drift

Early detection

by SMS-SSP Proactive/ Predictive

Monitoring processes

(eg HIRM, SPIs, etc)

System

design

Operational

deployment

16

10/01/2017

9


Which of the following can contribute to accidents?:

a) Active failures by operational personnel

b) Hazards, threats, unsafe situations

c) Latent conditions such as organization and human factors

d) All of the above

Accident causation – Quiz

17


The concept of practical drift involves:

a) The deviation of a system or equipment from its

designed performance capabilityb) The evolution of procedures by operational personnel to

accommodate system deviationsc) The capture and analysis of information pertaining to

system deviations in order to control and mitigate their associated risks

d) All of the above

Accident causation – Quiz

18

10/01/2017

10


Section 4:

People, Context and safety

19


The SHEL(L) model

20

S

H L L

E

Understanding the relationship between people and operational contexts

� Software

�Hardware

� Environment

� Liveware

� Liveware, other persons

10/01/2017

11


The SHEL(L) model

21

The SHELL Model is a conceptual tool used to analyse the interaction of multiple system components

�Software (S): procedures, training, support, etc.;

�Hardware (H): machines and equipment;

�Environment (E): the working environment in which

the L-H-S system function; and

�Liveware (L): humans in the workplace.


The SHEL(L) model

22

� According to the SHELL Model, a mismatch between the

Liveware and the other four components can contribute to

human error, hazards, threats, unsafe situations and latent

conditions.

� Thus, these interactions must be assessed and considered in all

sectors of the aviation system.

� This is especially so with regard to the assessment of contributing

factors in accident investigations as well as escalation factors and

escalation controls during HIRM.

10/01/2017

12


Human performance is likely to be compromised by a mismatch

between Liveware and:

a) Liveware

b) Software

c) Environment

d) Hardware

e) All of the above

People, Context and safety – Quiz

23


In the SHELL Human performance model, the “Environment” component is essentially referring to weather conditions :

a) TRUEb) FALSE

People, Context and safety – Quiz

24

10/01/2017

13


Section 5: Error & Violation

25


Error & Violation - Definitions

� Error is - An action or inaction by an operational person that leads to deviations from organizational or the operational

person’s intentions or expectations – SMM 2.5.3 [unintentional].

� Violation is – A deliberate act or omission to deviate from

established procedures, protocols, norms or practices –SMM 2.5.6 [intentional].

� In today’s “Just Culture” environment, enforcement

decisions and actions should distinguish between Error & Violations

26

10/01/2017

14


Two categories of Error

1. Slips and lapses

2. Mistakes

27


Three types of safety strategies to control errors

1. Reduction strategies

2. Capturing strategies

3. Tolerance strategies

28

10/01/2017

15


Error reduction strategies

Error reduction strategies intervene at the source of the

error by taking into consideration –

� Human-centred design

� Ergonomic factors

� Environmental factors

� Others

29


Error capturing strategies

Error capturing strategies intervene once the error has already been made, capturing the error before it generates

adverse consequences –

� Checklists

� Task cards

� Flight strips

� …

30

10/01/2017

16


Error tolerance strategies

Error tolerance strategies intervene to increase the ability

of a system to accept errors without serious consequence –

� System redundancies

� Structural redundancies

� Duplicate inspection

� Dual pilots…

31


Violations

32

There are 3 categories of violations which may not amount to “a deliberate act of willful misconduct or omission” -

� Situational violations

� Routine violations

� Organizationally induced violations

10/01/2017

17


Three categories of violations

o Situational violations - are committed in response to factors

experienced in a specific context, such as time pressure or high

workload.

o Routine violations - become the normal way of doing business within

a work group. Such violations are committed in response to situations

in which compliance with established procedures makes task

completion difficult. This may be due to practicality/workability issues,

deficiencies in human-technology interface design and other issues that

cause persons to adopt “workaround” procedures, which eventually

become routine.

� Organizationally induced violations - may be considered as an

extension of routine violations. This type of violation tends to occur

when an organization attempts to meet increased output demands by

ignoring or over stepping its safety defenses

33


An “Error” is intentional whilst a “Violation” is unintentional::

a) TRUE

b) FALSE

Error & Violation – Quiz

34

10/01/2017

18


An organization’s enforcement or disciplinary procedures

should take into account the type and circumstance of a

violation, before deciding on eligibility or scope of action to be

taken:

a) TRUE

b) FALSE


35


Safety strategies to control errors:

a) Are likely to prevent violations as well

b) Include reduction, capturing and tolerance strategiesc) May involve the use of checklists, parallel systems and

reduction of environmental distractionsd) All of the above


36

10/01/2017

19


Section 6: Safety culture

37


What is safety culture?

Safety culture is characterized by the safety-related beliefs,

values, biases and their resultant behaviour that are shared by members of an organization

- SMM 2.6.1

38

10/01/2017

20


Three influencing components

1. Organizational culture

2. Professional culture

3. National culture

39

Safety culture

Reporting

culture

Organization

Risk Profile


Organizational culture

Organizational culture refers to the characteristics and

perceptions among members interacting within a

particular organization.

40

10/01/2017

21


Professional culture

Professional culture differentiates the characteristics of

particular professional groups

41


Three influencing components of safety culture

National culture -

�differentiates the characteristics of particular nations

�forms an intrinsic component of personal beliefs

�may affect organizational culture

42

10/01/2017

22


Reporting culture

An organization’s reporting culture:

�pertains to personal beliefs about and attitudes toward

the benefits and potential detriments associated with

reporting systems

�characterized by distinction between errors and

violations

�assessed by effectiveness of an organization’s

voluntary reporting system

43


The Health of a Reporting culture

Possible descriptions of an organization’s safety

reporting culture:

�Pathological – ignore or hide the information

�Bureaucratic – restrain or barricade the information

�Generative – objective analysis and sharing of

information

44

10/01/2017

23


Safety culture & organization risk profile

An organization’s safety culture:

� pertains to personnel and organizational beliefs and

attitudes toward safety and quality matters

� is characterized by the balance between production

and protection

� affects an organization’s SMS/ QMS effectiveness and

its reporting systems

� affects an organization’s safety risk profile

45


A healthy Safety Culture

A healthy safety culture is characterized by –

� a generative reporting culture

� active hazard identification and risk mitigation activities

� top management commitment to safety responsibilities

� the pursuit of continuous improvement

�a positive organization risk profile

46

10/01/2017

24


Safety culture promotion & assessment

�A healthy safety culture and organization risk profile cannot be enforced

�Promotion through voluntary assessment and reward schemes possible

Note:

SMM chapter 2 Appendix 1 has a safety culture and risk profile assessment illustration

>>> 19_AOC ORP Chklist

47


A characteristic of healthy safety culture is -

a) an effective voluntary reporting system

b) an effective mandatory reporting systemc) an effective hazard identification & risk mitigation system

d) all of above

Safety Culture – Quiz

48

10/01/2017

25


An unhealthy organizational safety culture may be

characterized by:

a) Top Management is not accountable for Safety/ Quality

matters

b) Production and operational personnel are not involved in

hazard identification and risk mitigation issues

c) An undesirable or unacceptable organization risk profile

d) All of above


49



The status of a Reporting culture is sometimes expressed as follows (Drag the correct answers into place):

a) Pathological ______________b) Bureaucratic ______________

c) Generative ______________

1) objective analysis and sharing of information2) restrain or misappropriate the information

3) ignore or hide the information

S#44 / M1-S6-3

50

(c)

(a)

(b)

10/01/2017

26



A service provider’s undesirable safety culture or risk profile -

a) may contribute to latent conditions or hazards

b) may ultimately impact operational safety

c) is an indication that greater regulatory surveillance is

required over that service provider

d) all of above

M1-S6-4

51


Section 7: The Management dilemma

52

10/01/2017

27


Production & Protection

53

�Production – drive to increase capacity and productivity

�Protection – drive to increase safety risk controls

�Management Dilemma -

Balancing Production & Protection


Under Protection

Protection

Production

Catastrophe

+ Resources

54

10/01/2017

28


Over Protection

Protection

Production

Bankruptcy

+ Resources

55


Balancing Production-Protection

Protection Production

ResourcesResources

56

10/01/2017

29


Safety space

Bankruptcy

Catastrophe

Production

Pro

tect

ion

57


Under Protection within an organization can be a situation whereby:

a) excessive resources is allocated to the Safety/ Quality function

b) risk assessment projects consistently exhibit adequate

preventive controls and recovery measures c) insufficient resources is allocated to Production/ Operational

functions

d) None of the above

The Management dilemma – Quiz

58

10/01/2017

30


Over Protection within an organization can result in:

a) catastrophe

b) risk mitigation projects consistently exhibit excessive

preventive controls and recovery measures

c) sufficient resources being allocated to the Production/

Operational function

d) None of the above


59


Production and Operational personnel’s involvement in risk mitigation projects will:

a) contribute to the Management’s Production-Protection dilemma

b) result in Under Protection of operational processes c) promote their participation in developing Protection

provisions

d) result in over Protection within Production processes


60

10/01/2017

31


Section 8: Change Management

61


Change Management: What & Why?

� All aviation systems, processes or equipment are continually subject to changes

� Changes are likely to impact existing hazards or safety risk mitigation strategies of the affected

system

� Process for management of change must therefore include the review of safety risk mitigation strategies

62

10/01/2017

32


Management of Change

The procedure for managing change to aviation safety related

processes should include:

�evaluation of previous or existing hazard identification and risk mitigation records of the affected process/ equipment, where available.

�an initial hazard identification and risk mitigation project to be performed for the affected process/ equipment, if none is available.

�Documentation of such Change Management related hazard identification and risk mitigation review outcomes.

Note: More information on MoC in Module 3.

63


Change management in the context of safety management pertains to:

a) the review of safety strategies before the introduction of new equipment

b) the possibility of new hazards being introduced by changes

to an existing operational process. c) The possibility of existing defences or recovery measures

becoming irrelevant from modification to an installation

d) All of above

Change Management – Quiz

64

10/01/2017

33


The process of Change management in the context of a SMS

is primarily concerned with the review and continuing validity of

the affected equipment/ system/ process’ hazard identification

and risk mitigation status:

a) TRUE

b) FALSE

Change Management – Quiz

65


Section 9:

Integration of management systems

66

10/01/2017

34


Typical management systems

67

� Quality management system (QMS)

� Environment management system (EMS)

� Occupational health and safety management system

(OHSMS)

� Safety management system (SMS)

� Inventory management system (IMS), etc


Benefits of integration

68

� reduction of duplication and therefore of costs;

� reduction of overall organizational risks and an increase in profitability;

� balance of potentially conflicting objectives; and

� elimination of potentially conflicting responsibilities and relationships.

10/01/2017

35


SMS & QMS Integration

�From a safety management perspective, it is important for

organizations to recognize the pertinent correlation between

its safety management system and other systems such as its

quality management system, etc.

� It is particularly important that an organization’s safety

management system (SMS) should be properly integrated

with its quality management system (QMS). This subject is

further elaborated in the SMS module.

69


Benefits of integrating certain management systems may include:

a) balancing potentially conflicting objectives b) promotion of internal safety information sharing

c) better efficiency and productivityd) All of above

Integration of Management Systems – Quiz

70

10/01/2017

36


The following job title is an indication of management systems

integration:

a) Workshops Manager

b) Finance Manager

c) Production Manager

d) Quality & Safety Manager


71


In the context of a SMS, integration is crucial between:

a) QMS & Inventory Mgmt Sys

b) OSHE & QMSc) Environmental Mgmt Sys & Inventory Mgmt Sys

d) SMS & QMS


72

10/01/2017

37


1 Concept of safety

2 Evolution of safety

3 Accident causation

4 People, context and safety

5 Error & violation

6 Safety culture

7 The management dilemma

8 Change management

9 Integration of management systems

10 Safety reporting & investigation

11 Safety data collection, analysis & SPIs

12 Hazard identification & risk mitigation

13 Prescriptive & performance based requirements

Module 1: Sections 1-9 completion

73


Section 10: Safety reporting and investigation

74

10/01/2017

38


Safety reporting systems

75

� Accident reporting (A13)

� Mandatory incident reporting (A19-2, 5.1.2)

� Voluntary hazard/ incident / self-disclosure reporting

(A19-2, 5.1.3)


Accident reporting (A13)

Aviation system accidents is the highest consequence occurrence and must be reported to the CAA, its independent

investigation authority as well as ICAO. [Annex 13]

76

10/01/2017

39


Mandatory incident reporting (A19-2, 5.1.2)

� These are the types of serious incidents (apart from

accidents) which a CAA will define as reportable

(mandatory basis) by service providers to the CAA.

� Such reports may also be required by the CAA to be

submitted to relevant organizations such as the State of

Design & Manufacturing as well as ICAO.

77


Voluntary hazard/ incident / self-disclosure reporting (A19-2, 5.1.3)

� Voluntary (non mandatory) reporting system.

� Capture hazards, threats, unsafe situations, self disclosures (errors/ violations)

� Safety information otherwise not within purview of a

mandatory reporting system

Note:

A19-2, 5.1.3 has changed the term “voluntary incident

reporting” to “voluntary safety reporting”.

78

10/01/2017

40


Information

People are knowledgeable about the human, technical and

organizational factors that determine effective safety reporting.

Flexibility

People can adjust, when facing unusual circumstances, shifting from the established to a direct mode thus allowing information to quickly reach the appropriate decision-

making level.

Learning

People have the competence

to draw conclusions from

safety reporting and implement

appropriate reforms.

Willingness

People are willing to

report their errors and

experiences.

Accountability

People are encouraged to report essential safety-related information.

However, there is a clear line that differentiates between acceptable and

unacceptable behaviour.

Effective safety reporting

Effective safety reporting – pre-requisites

79


Investigation of accidents & incidents

80

Purpose:

� establish cause, events and contributing factors to an

occurrence

� assess whether safety defenses may have been compromised

� Identify corrective actions to prevent recurrence

� Identify hazards which may be uncovered during investigation process

10/01/2017

41


Integration of safety investigation & HIRM process

81

� Occurrence investigation may uncover hazards, threats or

latent conditions

� Such hazards, threats or latent conditions may need follow

up risk mitigation

� Integrate occurrence investigation process with HIRM

process as appropriate (details in M3-S12)


Safety reporting and investigation – Quiz

Select the valid reporting system:

a) Voluntary mandatory reportingb) Voluntary accident reporting

c) Mandatory hazard reportingd) Voluntary hazard/ incident reporting

82

10/01/2017

42



A voluntary safety reporting system is essentially meant for

reporting:

a) Accidents only

b) Hazards only

c) Mandatory occurrences only

d) Hazards, threats, latent conditions, incidents, errors or

mistakes

83



Hazards, threats or unsafe situations uncovered in the

process of incident/ accident notification or investigation should be:

a) ignored if they are not directly relevant to the incident/ accident

b) annotated in the occurrence notification/ investigation

report for information only

c) captured in the occurrence notification/ investigation report and duly integrated with the organization’s HIRM process.

84

10/01/2017

43


Section 11: Safety data collection & analysis

85


Safety data quality

86

� Validity

� Completeness

� Consistency

� Accessibility

� Timeliness

� Security

� Accuracy

10/01/2017

44


Safety data types

87

� accident investigation data;

� mandatory incident investigation data;

� voluntary reporting data;

� continuing airworthiness reporting data;

� operational performance monitoring data;

� audit findings/reports;

� safety studies/reviews; and

� safety data from other States or regional organizations , etc.


Safety data analysis

88

� assist in deciding what additional information are

needed;

� ascertain latent conditions underlying safety deficiencies;

� assist in reaching valid conclusions;

� monitor and measure safety trends or performance.

10/01/2017

45


Analytical methods and tools

89

a) Statistical analysis

b) Trend analysis

c) Normative comparisons

d) Simulation and testing

e) Expert panel/ group

f) Cost-benefit analysis


Safety information system requirements

90

a) include a user-friendly interface for data entry and query;

b) have the capability to transform large amounts of safety data into useful information that supports decision

making;

c) reduce the workload for managers and safety personnel;

and

d) operate at a relatively low cost.

10/01/2017

46


Features of database system

91

a) log safety events under various categories;

b) compile analyses, charts and reports;

c) capability to check individual reports;

d) allow safety data sharing with other organizations;

e) monitor individual report status or closure, etc


Considerations for protection of safety data

92

a) Information accessibility;

b) Safety management requirements;

c) Disciplinary/ enforcement requirements;

d) De-identification or confidentiality requirements;

e) Security of information systems; and

f) Safety information sharing and exchange.

10/01/2017

47


Safety performance indicators (SPIs)

93

Number of reportable

(MOR) incidents

0.00

1.00

2.00

3.00

4.00

5.00

747-400

A330

A320

B737-300

A340

Beta Airline — Year 2009

<< Fig 1:

Basic data chart

0.00

Jan Feb Mar Apr May June July Aug Sept Oct Nov Dec

2009 Alpha Airline monthly reportable

incident rate (per 1 000 FH)

0.10

0.20

0.30

0.40

0.50

0.60

0.70

0.80

Fig 2:>> Continuous

monitoring chart


0.00

Jan Feb Mar Apr May June July Aug Sept Oct Nov Dec

2009 Alpha Airline monthly reportable

incident rate (per 1 000 FH)

0.10

0.20

0.30

0.40

0.50

0.60

0.70

0.80

Number of reportable

(MOR) incidents

0.00

1.00

2.00

3.00

4.00

5.00

747-400

A330

A320

B737-300

A340

Beta Airline — Year 2009

SPI Chart - with safety performance markers

94

^ Fig 3:

SPI with Alert & Target

settings >>> SPI-ALosP

>details in M3-S15

10/01/2017

48


Purpose of Safety Data Analysis & SPIs

� The essential purpose of a safety database is to support

the development of safety performance indicators in order

to measure and monitor the service provider organization

or aviation system’s safety performance

95


Safety data collection & analysis – Quiz

A service provider organization’s safety database should include safety information such as:

a) Global accident investigation reportsb) Voluntary safety reports received from its own personnel

c) Mandatory reports submitted to the CAA by the organizationd) (b) & (c)

96

10/01/2017

49



A regulatory (CAA) organization’s safety database(s) should

include the following safety information:

a) Mandatory incident reports received from all service

providers of its aviation system

b) Global accident reports

c) Voluntary safety reports received from any service provider

or individuals within its aviation system

d) (a) & (c)

97



The essential purpose of a SMS/ SSP safety database is to enable the development of Safety Performance Indicators to

measure and monitor safety performance:

a) TRUEb) FALSE

98

10/01/2017

50


Section 12: Hazard identification & risk mitigation

99


Hazard definition

100

Hazard is a condition or an object with the potential to

cause death, injuries to personnel, damage to equipment

or structures, loss of material, or reduction of the ability to

perform a prescribed function

-SMM 2.13.2

10/01/2017

51


HAZARD, Unsafe Event & Consequence -correlation

101

Ultimate

ConsequenceHazard

Unsafe

Event


Hazards, Threats & Unsafe Situations

102

10/01/2017

52


Hazard identification methodologies

103

Methodologies:

� Reactive - analysis of past outcomes or events

� Proactive - existing or real-time operational situations


Hazard identification

104

Hazards can be identified from:

• Accident/ incident investigation reports (Reactive)

• Audit, inspection or survey reports (Proactive)

• Voluntary hazard/ incident reports (Proactive)

• Operational data monitoring systems, etc (Proactive)

Differentiate between:

• Hazards & Threats• Temporary & Permanent hazards

� Corrective action & systematic SRM action

10/01/2017

53


Identify Hazards, Top Events & Consequences – 3 Approaches

105

UC-5

H-1

TE-2

TE-1

UC-1

UC-2

UC-3

UC-4

1. Identify Top

Events &

Consequences

from a Hazard

H-1 UC-1

H-2 TE-1 UC-2

H-3 UC-3

2. Identify

Hazards &

Consequences

from a Top

Event

TE-1

TE-2

H-1

H-4

H-2

UC-1

H-33. Identify Top

Events &

Hazards from a

Consequence


Hazard Escalation/ Transformation

106

Component MRO

Engine MRO

Hangar MRO

Airline

- MRO sector

10/01/2017

54


Hazard Escalation/ Transformation [HIRM W/sht 11(a)

107

- all

sectors

OPS

AIS

AMO

ATO

ANSPDMO

ATM

Engine

Aircraft

C UE H

C UE H

SAR-FF

AGA

CNS

Ground Control

Ground services

C UE H Comp

UE

C UE H

H

C UE HLine

Maint

H

UE

H

C UE HHangar

MaintC UE H

HC

Cargo /

DG handling

C UE HC UE HEngine

Maint

C

Fuel Suppliers

UE HCUE HComp

Maint

H UE

C UE

C UE

UE

C

C

H UC UEC HH UE C

H UE H

C UE

Define H>US>C in

your own

operational

context - within

the aviation

system

C

Details in M-4


Hazard and Risk Management database

108

>Details in M3-S9 & M4 HIRM Wsht-11

Sheet 11 Hazard & Risk Management Database (Register) 22Sep16 <<<

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

Generic Hazard/

Threat

(Original Report)

Source of

Information*

Specific Hazard/

Threat*

Hazard

ID Code

Corrective

Action*

[Yes/ No]

SRM

Action*

[Yes / No]

SRM Priority

Level*

(H, M, L)

Dept / SectProject

I/C

Date

Activated

Date

Completed

/ Rpt Ref

Existing RI &

Tolerability

(UE/UC)

Resultant RI &

Tolerability

(UE/UC)

Next

Review

Date

Ex

am

ple

A320 aircraft

operation.

Cabin crew reported one

large rat sighted in

aircraft rear galley area

during cruise.

Inflight

incident

notification

report ref:

A320/ OPS/

012/ 2005.

[H] - Rats

infestation of

A320 aircraft

OPS-

ALPHA-

H1-M-

013

Nil Projected - Aircraft

wiring/ equipment

damage by rats.

No Yes Medium A320

Operations

ABC

1

2

3

Hazard ID Code:

Sector (1) - Organization (2) - Hazard No (3) - Priority Level (4) - Year (5)

1

2 Organization: Five letters code (eg ALPHA - Alpha Airline)

3

4

5

Hazard ID Code Illustration:a) OPS-ALPHA-H001-M-013 [Air Operations - Alpha Airline - Hazard #1 - Moderate Priority - Year 2013]

b) AGA-GATB-H005-L-012 [Aerodrome - Timbaktu Airport - Hazard #5 - Low Priority - Year 2012]

1

2

3

4

5

6

7

Sector: AGA / ANS / OPS / DMO / AMO / MDO* (*MDO - Materials Distribution Organizations, including fuel distribution)

*Explanatory Notes:

Reported/ Projected (UE/ C): Annotate UE/ C description as a "Reported" occurrence or a "Projected" occurrence. If multiple H>UE>C combinations involved, register each combination under a new Row (Each single H>UE>C

combination will constitute one potential SRM Task)

Priority Level: Hazard prioritization Level [High (Accident), Medium (Serious Incident), Low (Incident)].

Hazard No: Hazard number (eg H001) as assigned by the organization concerned within a given Year.

Year: Year when the Hazard was registered in the organization's Hazard Register.

Source of Information: Hazard information as may be extracted from - Voluntary Hazard Rpt, Occurrence Notification/ Investigation Rpt, Internal Audit Rpt, External Audit Rpt, Hazard Survey Rpt, Operational Data Review Rpt

Corrective Action: If the Hazard can be effectively eliminated through conventional corrective action (eg disposal, repair, replacement, modification), annotate YES with the action taken/ recommended. Otherwise annotate NO.

SRM Action: Annotate YES to indicate systematic SRM action is recommended (or has been taken already). Annotate NO if systematic SRM action is not recommended (or not necessary).

SRM Project Registration: This column for registration of assigned (new) SRM project, or a previously completed SRM project (with respect to the specific H>UE>C thread).

Specific Hazard/ Threat: If more than one Hazard/ Threat identified, register such additional Hazard/ Threat under new row/ item

Priority Level: SRM or Corrective Action Priority Level based on (Annex 13) occurrence category of the projected (or reported) Unsafe Event or Consequence. Accident - High; Serious Incident - Medium; Incident - Low.

Hazard Registration

Recommended ActionArea/

Operation/

Equipment

Ite

m

Hazard [H] / Threat [T]

SRM Project Registration*

SRM Project Assignment SRM Project CompletionUnsafe-Event [UE]

(Reported /

Projected)*

Consequence [C]

(Reported /

Projected)*

10/01/2017

55


Distinguishing Aviation and OSHE hazards

109

� Aviation hazard:

eg - Birds in vicinity of aerodrome

� OSHE hazard:eg - Persistent hydraulic fluid exposure within a workshop

� Aviation + OSHE (Compound) hazard:

eg - Lightning activity around aircraft transit gates

Note: Generic Hazard examples in >>> 1_Hazard Taxonomy examples


Hazard prioritization

110

� Initial source/ location categorization

� Prioritization by severity of projected consequence

� Prioritization by severity & likelihood of projected

consequence

Note: More information in M3-S9 & M4

10/01/2017

56


Safety risks

111

Definition:

Safety risk is the predicted probability and severity of the

consequences or outcomes of a hazard

– Annex 19-2


Safety risk probability

112

10/01/2017

57


Safety risk severity

113


Safety risk index

114

1. Insignificant 2. Minor 3. Moderate 4. Major 5. Catastrophic

A.

(exceptional/

impossible)

Negligible (1A) Negligible (2A) Low (3A) Low (4A) Moderate (5A)

B.

(unlikely/

improbable)

Negligible (1B) Low (2B) Low (3B) Moderate (4B) Moderate (5B)

C.

(possible/ Low (1C) Low (2C) Moderate (3C) Moderate (4C) High (5C)

D.

(likely/

occasional)

Low (1D) Moderate (2D) Moderate (3D) High (4D) Extreme (5D)

E.

(certain/ Moderate (1E) Moderate (2E) High (3E) Extreme (4E) Extreme (5E)

LikelihoodSeverity

10/01/2017

58


Safety risk tolerability

115

Risk Index Risk Tolerability

5D, 5E, 4E - Extreme

RiskSTOP OPERATION OR PROCESS IMMEDIATELY. …

5C, 4D, 3E - High Risk WARNING.

Ensure that risk assessment has been satisfactorily

completed and declared preventive controls are in place.

5A, 5B, 4B, 4C, 3C, 3D,

2D, 2E, 1E - Moderate

Risk

CAUTION.

Perform or review risk mitigation as necessary.

Departmental approval of risk assessment required.

4A, 3A, 3B, 2B, 2C, 1C,

1D - Low Risk

REVIEW.

Risk mitigation or review is optional.

2A, 1A, 1B -

Negligible Risk

NO ACTION REQUIRED.

Acceptable as is. No formal risk mitigation required.


Safety risk mitigation (SRM)

116

The safety risk is

acceptable

subject to

adequate

mitigation.

Acceptableregion

Intolerable region

Tolerable region

The safety risk is

unacceptable as

it currently

stands

The safety risk is

acceptable as it

stands

AsLowAsReasonablyPracticable

10/01/2017

59


Risk mitigation documentation (basic) – H>UC/UE

117

Existing Preventive Controls

Existing Risk Index

Existing Tolerability

New Preventive Controls

Resultant Risk Index

Resultant Tolerability

Ha

za

rd D

es

cri

pti

on Existing

Preventive Control

No 1

New Preventive

Controls

Ult

ima

te C

on

se

qu

en

ce

O

R U

ns

afe

Eve

nt

Existing

Preventive Control

No 2

New Preventive

Controls

Existing

Preventive Control No 3

New Preventive

Controls


Risk mitigation documentation (basic): H>US>UC

118

Hazard

Existing

Preventive

Controls

Existing RI &

Tolerability

New

Preventive

Controls

New RI &

Tolerability

Unsafe

Situation

Existing

Recovery

Measures

Existing RI &

Tolerability

New Recovery

Measures

New RI &

Tolerability

Ultimate

Consequence

Possible

foreign

objects

debris on

the runway

Weekly FOD

runway

inspection

program

Aerodrome

operations

manual section 4.2.1

Likelihood: 4

Severity: B

Safety risk

index: 4B

Safety risk

tolerability:

Unacceptable

under the

existing

circumstances

To increase

runway

inspection to

daily

program

Likelihood: 3

Severity: B

Safety risk

index: 3B

Safety risk

tolerability: Risk

control/mitigatio

n requires

management

decision

Undetecte

d FOD on

operating

runway

Procedure

available to act

on pilots’ report

of FOD sightings

on runway

Aerodrome

operations

manual section 4.2.5

Likelihood: 4

Severity: B

Safety risk

index: 4B

Safety risk

tolerability:

Unacceptable

under the

existing

circumstances

To install

automatic

Runway FOD

detection and

warning system

Safety risk

index: 1B

Safety risk

tolerability:

Acceptable

Aircraft,

engine or tyre

damage due to

foreign

objects on

runway during

take-off.

10/01/2017

60


Risk mitigation documentation (advance)

119

Table A Hazard Identification & Risk Mitigation (HIRM) Worksheet [Risk mitigation illustration] Jun16 Sht 13

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59

1. E

merg

ency

Pro

cedure

2. B

ackup

Syste

m

3. A

bnorm

al

Pro

cedure

4. S

OP

5. S

pecia

l

Inspn

6. G

M

7. P

rocess

Appro

val

8. P

ers

onnel

Appro

val

9. T

RN

G

10. O

thers

Escala

tion

Facto

r [E

F]

Escala

tion

Contr

ol [

EC

]

Severity

x

Lik

elih

ood

Ris

k L

evel

1. E

merg

ency

Pro

cedure

2. B

ackup

Syste

m

3. A

bnorm

al

Pro

cedure

4. S

OP

5. S

pecia

l

Inspn

6. G

M

7. P

rocess

Appro

val

8. P

ers

onnel

Appro

val

9. T

RN

G

10. O

thers

Escala

tion

Facto

r [E

F]

Escala

tion

Contr

ol [

EC

]

Severity

x

Lik

elih

ood

Ris

k L

evel

1. E

merg

ency

Pro

cedure

2. B

ackup

Syste

m

3. A

bnorm

al

Pro

cedure

4. S

OP

5. S

pecia

l

Inspn

6. G

M

7. P

rocess

Appro

val

8. P

ers

onnel

Appro

val

9. T

RN

G

10. O

thers

Escala

tion

Facto

r [E

F]

Escala

tion

Contr

ol [

EC

]

Severity

x

Lik

elih

ood

Ris

k L

evel

1. E

merg

ency

Pro

cedure

2. B

ackup

Syste

m

3. A

bnorm

al

Pro

cedure

4. S

OP

5. S

pecia

l

Inspn

6. G

M

7. P

rocess

Appro

val

8. P

ers

onnel

Appro

val

9. T

RN

G

10. O

thers

Escala

tion

Facto

r [E

F]

Escala

tion

Contr

ol [

EC

]

Severity

x

Lik

elih

ood

Ris

k L

evel

E-

PC

1

EF>E-

PC1

EC1>EF

>E-PC1

N-

PC1

EF>N-

PC1

EC>EF>

N-PC1

E-

RM1

EF>E-

RM1

EC>EF>

E-RM1

N-

RM1

EF>N-

RM1

EC>EF>

N-RM1

EF>E-

PC2

EC>EF-

F-PC2

N-

PC2

EF>N-

PC2

EC>EF>

N-PC2

EF>E-

RM2

EC>EF>

E-RM2

N-

RM2

EF>N-

RM2

EC>EF>

N-RM2

EF>E-

PC3

EC>EF>

E-PC3

EF>N-

PC3

EC>EF>

N-PC3

EF>E-

RM3

EC>EF>

E-RM3

EF>N-

RM3

EC>EF>

N-RM3

EF>E-

PC4

EC>EF>

E-PC4

EF>N-

PC4

EC>EF>

N-PC4

EF>E-

RM4

EC>EF>

E-RM4

EF>N-

RM4

EC>EF>

N-RM4

Description of New Preventive Controls [N-PC] Description of Existing Recovery Measures [E-RM] Description of New Recovery Measures [N-RM]

<<<

4. ULTIMATE CONSEQUENCE [UC]: Multiple aircraft system(s) failure or malfunction (due to electrical wiring damage by rats).

1. AREA/ OPERATION/ EQUIPMENT: Pest control within A320 aircraft fuselage/ cabin.

2. HAZARD / THREAT [H/T]: Rat (s) infestation within an operational A320 aircraft fuselage/ cabin Hazard Code: OPS-ALPHA-H1-L2-013

3. UNSAFE EVENT [UE]: Rat (s) infestation confirmed through rat sightings or evidence of aircraft wiring damage by roden activities.

Table B

1

Hazard

/ T

hre

at >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Unsafe Event Mitigation (as applicable) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Un

safe

Ev

en

t

Ult

ima

te

Co

nse

qu

en

ceExisting Preventive Controls [E-PC] Existing

RI & TNew Preventive Controls [N-PC]

Resultant

RI & TExisting Recovery Measures [E-RM]

Existing

RI & TNew Recovery Measures [N-RM]

Resultant

RI & T

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Ultimate Consequence Mitigation (as applicable) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Ra

t (s

) in

fest

ati

on

wit

hin

an

op

era

tio

na

l A

32

0 a

ircr

aft

fu

sela

ge

/

cab

in

2E

R3

- M

od

era

te R

isk

2D

R3

- M

od

era

te R

isk

Mu

ltip

le a

ircr

aft

sy

ste

m(s

) fa

ilu

re o

r

ma

lfu

nct

ion

(d

ue

to

ele

ctri

cal

wir

ing

da

ma

ge

by

ra

ts).

Act

ua

l ra

t si

gh

tin

gs

or

ev

ide

nce

of

rat

dro

pp

ing

s w

ith

in a

ircr

aft

ca

bin

.

3E

R2

- H

igh

Ris

k

3C

R3

- M

od

era

te R

isk

N-RM2: A routine "C" Check Maintenance Job Card has been raised

to call for inspection of all opened aircraft internal fuselage

compartments for evidence of rat droppings and necessary follow

up action. Ref: MJC-1C-53-45; SI/ A320/ 25/ 112.

Description of Existing Preventive Controls [E-PC]

E-PC1: Flight, cabin and maintenance personnel are normally

expected to report any rat sightings within an aircraft.

N-PC1: SOP to be put in place to require flight crew and

maintenance personnel to report rats sighting within aircraft

cabin.

E-RM1: Any operational aircraft reported with rat sighting is

normally subjected to a cabin inspection by maintenance

personnel during stayover check.

N-RM1: Special Inspection sheet (Ref SI/ A320/ 25/ 112) has been

raised to require any operational aircraft with reported sighting or

evidence of rats infestation to be scheduled for de-infestation

action by approved Pest Controller upon aircraft return to main

base.

EF>E-PC1: No documented procedure/ instruction for such

reporting expectation.

N-PC2: SOP to be put in place to require that all aircraft

fuselage doors to be closed or sealed during silent hours,

especially when undergoing hangar maintenance checks.

EF>N-PC2: There may be occasions where fuselage doors

cannot be closed due to their being removed or dismantled

for maintenance.

EC>EF>N-PC2: For such cases, aircraft maintenance steps

leading to such doors shall be removed or backed-off from

the door by at least 3 feet, during silent hours.

>details in M3 & M4

>>> 2_HIRM Wsht CBSV


Human factors and risk mitigation

120

� Risk mitigation process may require HF analysis support

� SRM procedure should address circumstances when HF analysis is appropriate

� Assessment of hazards and defenses involving complex

human to system interfaces should consider HF (SHELL) analysis

10/01/2017

61


Risk mitigation and CBA

121

� High impact risk mitigation projects may require cost &

benefits analysis (CBA)

� SRM procedure should address circumstances when

CBA is necessary

� Mitigating actions involving major organizational change

or financial impact should consider CBA


Hazard identification & risk mitigation – Quiz

To a pilot, an unstable approach due to bad weather during his aircraft landing phase may be deemed to be:

a) A hazardb) An unsafe event/ situation

c) An ultimate consequenced) A latent condition

122

10/01/2017

62



The essential purpose of hazard identification is to ensure that

those hazards which cannot be eliminated through

conventional corrective actions may be followed up with a

systematic risk mitigation process:

a) TRUE

b) FALSE

123



Hazards which have potential aviation safety as well as OSHE consequences:

a) Should be totally ignored by aviation SMS personnelb) May be managed in conjunction with the organization’s

certified OSHE inspectorsc) Can be managed by the organization’s certified OSHE

inspectors only

d) Must be managed by aviation SMS personnel only.

124

10/01/2017

63



Safety risk index refers to the:

a) severity value of a hazard

b) severity and likelihood values of a hazard

c) severity and likelihood values of a consequence

d) likelihood value of an unsafe event.

125


Hazard identification & risk mitigation – Quiz 6

The purpose of safety risk mitigation is to drive the risk index

of a projected consequence:

a) towards the intolerable region

b) towards the tolerable regionc) to as low as reasonably practicabled) To the unacceptable region

126

10/01/2017

64



The purpose of documenting each completed safety risk

mitigation project is to:

a) Serve as a record of its accomplishment

b) Facilitate future review of the identified hazard and its

mitigating actions

c) Evidence of the organization’s due diligence in addressing

the identified hazard.

d) All of above

127


Section 13: Prescriptive & performance based requirements

128

10/01/2017

65


Understanding performance-based requirements

129

Prescriptivvironment

Regulations as prescribed controls

�Rigid regulatory

framework

�Reactive occurrence

investigations

�Compliance audits

�Foundational

Prescription-basedenvironment

Requirements as safety risk controls

�Dynamic

requirements

�Proactive HIRM

�Safety performance monitoring

�Supplementary

Performance-basedenvironment


Prerequisites for performance-based requirements

�SSP and SMS frameworks in place

�Process for agreement on system’s safety

performance markers/ levels

�Process for continuous regulatory monitoring

130

10/01/2017

66


Baseline & Equivalent level of safety

�An equivalent or better safety performance level is

expected with performance based requirements

when compared with the baseline safety performance

level of a prescriptive environment.

�Performance-based requirements should be

measured and monitored through appropriate SPIs

131


Performance-based monitoring and measurement

�Use data-based safety/ quality performance

indicators

�Set SPI alert and target levels as performance markers

where applicable

�Aggregate the package SPIs’ performance, where

appropriate

132

10/01/2017

67


Auditing performance-based requirements

� Inspector awareness of performance based requirements

and expectations

� More interaction, monitoring and collaboration (between

regulator and service providers)

� Assessment of the system and related processes for

Effectiveness, apart from compliance (PSOE)

133


Prescriptive & performance based requirements – Quiz

Performance based regulations or requirements are meant to:

a) replace conventional prescriptive regulationsb) complement conventional prescriptive regulations

c) deregulate the aviation industryd) prevent unhealthy competition amongst service providers

134

10/01/2017

68



The introduction of SMS requirements for service providers is:

a) a prescriptive regulation

b) a performance based requirement

c) to replace service providers’ quality management systems

d) b & c are correct

135



SPIs is associated with performance based requirements because it:

a) is a data based process to facilitate monitoring of a system’s safety performance

b) allows the service provider to define its own SPIsc) allows the service provider to set its own safety

performance markersd) all of above

136

10/01/2017

69


Module 1: Safety Management Fundamentals

137


Congratulations for completing Module 1:

Safety Management Fundamentals

You are now able to describe and explain the

fundamental safety management concepts and

principles addressed in SMM Doc 9859 (3rd Ed,

2013).

138

Module 1 Safety Management Fundamentals - acac · At the end of this module, ... concepts and principles from the ICAO SMM (Doc 9859, 3rd Ed) ... 9 Integration of management systems

Documents