1. Aviation Safety Management Systems
Tony Cramp
Senior Advisor (Americas)
17th May 2005
Lafayette
File Title
4/15/2017

2. Underlying Safety Beliefs
How many factors need to be removed to prevent the accident? Theoretically only one, but with each factor removed the probability for an accident is lowered
The fundamental requirements for accident prevention are thus (i) the ruthless hunting out and elimination (the identification and management) of risk factors and (ii) using systems of work that are inherently safe
Everyone can contribute to causing an accident, we can also contribute to preventing one
A fundamental requirement for this is effective collaboration between line personnel and ‘management’
These are 3rd Generation Safety beliefs

3. Safety Paradigms: 3rd Generation
Safety is a corporate value. Safety practices consider the organizations particular “way of doing business” as well as corporate’s possibilities and constraints. What works well for one airline does not necessarily work equally well for others.
Accidents are caused by systems flaws. The failures observed at the “front end” of aviation operations are considered symptoms of deficiencies in the architecture of the aviation system.
Human error as a symptom. Error is accepted as normal component of human performance, unavoidable but manageable. Human error is a clue, which indicates where the safety investigation process must begin rather than end.
Proaction. Attention is focused on the processes incurred by the aviation system, regardless of the outcome of these processes.

4. Safety Paradigms: 3rd Generation
The finding of ‘human error’ should be the starting point of an investigation, not its conclusion

5. Safety Management Systems
Defences in Depth
If we have these beliefs then the foundation of a strategy for preventing accidents would be to introduce controls at Organizational (Systemic), Team and Personal levels so as to achieve Organizational defenses in depth:
A Systemic approach to the management of safety:
Safety Management Systems

6. Safety Management Systems
The formal goals of an SMS are as follows:
To produce fully airworthy aircraft, in a safe working environment, that are subsequently operated safely
To ensure and demonstrate that safety is being managed as formally as any other critical business function
To ensure and demonstrate that the Organization is ‘responsible’ and exercising ‘due care’ (the counter to offence of ‘Corporate Killing’)
But what is the bottom line?

7. SMS is Not New!
The concept and practice of ‘System Safety’ was first introduced consequent to the Apollo 204 pad fire in 1967 and has been embedded in engineering ever since.
The Basic Principles of ‘System Safety in Engineering’ are:
The assurance of safety is gained through the competence and safety-orientated procedures used by each individual engineer, however:
In complex systems it is easy to ‘overlook the wood for the trees’: there must be an autonomous, safety oversight process that has the ‘big picture’ and a ‘watchdog’ function, and:
There must be a system enforcing the effective communication of safety-critical information, and:
There must be a ‘Facilitative function’ that ensures hazard identification and resolution
This engineering / astronautics approach then migrated into the Nuclear, Maritime, Rail, Oil/Chemical industries and has shown considerable benefits

8. SMS in Aviation: The Challenge
Aviation is lagging some 15 years in implementing formal SMS: flight operations already heavily regulated and traditional Flight Safety methods have a high degree of effectiveness
SMS has been developed primarily outside of aviation: past experience e.g.CRM and QA, shows that systems from outside are not always introduced correctly or tailored correctly to aviation culture
Have to get past the SMS language used by other disciplines, mainly the ‘speak’ of HSE and Quality Assurance
BUT: SMS is rapidly becoming a Regulatory requirement (UK CAA, Transport Canada, FAA moving in this direction etc) as well as a Customer requirement (Shell, ExxonMobil)
The challenge is to take the benefits of SMS distilled to date and adapt and apply them to aviation in such a way that SMS is accepted and is demonstrated to add value

9. SMS Primary Components
Accident cause ⌗ 1.
Inadequate Procedural Baseline

10. SMS Primary Components
Ops Manual, GMM/MPM,
Ramp Procedures, Fuel Quality,
OSHA Compliance ①
Procedural baseline to assure safety in work

11. SMS Primary Components
The manual forms a ‘road map’, has an integrative function and if the SMS Manual consists of a template of the ‘ideal’ system, then it can be used for both assessment and development purposes ②
SMS Manual
SMS Manual can be written bottom- up, or preferably as a template ‘top-down’, gives the big-picture, highlights any major ‘holes’ in SMS Component ⌗1
Any holes? ①
(Full spectrum of policies, procedures, methods, practices to assure safety in work)

12. SMS Primary ComponentsX
Cause ⌗ 1. Inadequate Procedural Baseline
Cause ⌗ 2. Uncontrolled Hazards

13. SMS Primary Components③
Safety Management Program ②
SMS Manual ①
Procedural baseline to assure safety in work

14. Systems are for People?
“Even the most well-considered safety system can be wrecked by the idiosyncratic behaviour of a single individual”

15. SMS Component ⌗3: Safety Program Management
Proactive Safety Management
Encouraging and developing Management commitment
Creation of a Safety Culture
Safety structure and resources, committees and meetings
Ongoing hazard identification and management (HEMP)
Safety education (training, information dissemination)
‘ Watchdog’ function
2. Reactive Safety Management
Occurrence investigation (‘occurrences’, incidents, accidents)
Data analysis
Continuous learning

16. SMS Primary Components③
Safety Program Management ②
SMS Manual ④
Safety Case ①
Procedural baseline to assure safety in work

17. SMS Component ⌗ 4: The Safety Case
A Safety Case is a formal, organizational risk management exercise conducted proactively (e.g. prior to contract launch), or reactively (e.g. to gain control over the risks in current operations)
An aviation ‘Safety Case’ is defined as “The documented description of the major hazards that the aircraft operator faces and the means employed to control these hazards”
As opposed to the SMS Manual, which gives ‘big picture’ inputs, a Safety Case gives detailed inputs into the procedural baseline. It identifies individual controls required.
A Safety Case is a specific application of the HEMP
A safety case functions at Management, Supervisor and Line levels: a Living document.

18. SMS Primary ComponentsX
Cause ⌗ 1. Inadequate Procedural Baseline X
Cause ⌗ 2. Uncontrolled Risk Factors / Hazards
Cause ⌗ 3. Failures in Communication

19. SMS Primary Components
⑤ SIS ③
Safety Program Management ②
SMS Manual ④
Safety Case ①
Procedural baseline to assure safety in work

20. Safety Information System
The fifth primary element is the Organization’s ‘Safety Information System’ (SIS)
Several studies have shown that in the vast majority of (aircraft) accidents there was always a piece of information available somewhere that had it been in the right place at the right time, the accident might well have been prevented
A SIS may take a variety of forms, from the basic verbal / written communication of safety information across the organization to sophisticated company ‘intranets’.
Examples:
Hazard report forms
Regular safety meetings, with minutes recorded and distributed.
Company newsletters
Effective, updated notice boards
Intranet employee notices

21. SMS Primary ComponentsX
Cause ⌗ 1. Inadequate Procedural Baseline X
Cause ⌗ 2. Uncontrolled Risk Factors / Hazards X
Cause ⌗ 3. Failures in Communication

22. Next Challenge!
How to integrate these components:

23. Integrating Principles
After 200 years of industry and 100 years of flight surely there must be a package of elements or principles that if applied will give a high level of assurance of safety?
Currently, there is agreement that these elements and principles are best described in systems developed by the science of ‘Quality Assurance’
The most current definition of an SMS is thus:
‘A system for the proactive management of safety that is appropriate to the Operator’s size and complexity and integrates operations, maintenance, human resources and finance and draws upon quality principles’

24. SMS Primary Components
⑥ Quality System
⑤ SIS ③
Safety Program Management ②
SMS Manual ④
Safety Case ①
Procedural baseline to assure safety

25. A Typical Safety-Orientated ‘Quality’ System
Principles
& Policy
Management
Review
Objectives
Strategy
Targets & Plans
Customer
Satisfaction
Standards
Feedback
Check Do
Plan
Remedial Action
Accountability &
Competence
Culture
Investigation
& Follow-up
Product
Management
COMMUNICATION
Incident Reporting
Risk Assessment
Hazard
Management
Monitoring
Audit
Review

26. SHELL ‘Model’ HSSE-MS Elements

27. ③ ① SMS Booklet ② SMS Summary See ‘Model Manual’ 33 Sub-Elements ④
⑥ Quality System
⑤ SIS ③
Safety Program Management
See ‘Model Manual’
33 Sub-Elements ②
SMS Manual ④
Safety Case ①
Procedural baseline to assure safety
SMS Booklet

28. The Safety Case
A Safety Case is a formal, organizational risk management exercise conducted proactively (e.g. prior to contract launch), or reactively (e.g. to gain control over the risks in current operations)
An aviation ‘Safety Case’ is defined as “The documented description of the major hazards that the aircraft operator faces and the means employed to control these hazards”
As opposed to the SMS Manual, which gives ‘big picture’ inputs, a Safety Case gives detailed inputs into the procedural baseline. It identifies individual controls required.
A Safety Case is a specific application of the HEMP
A safety case functions at Management, Supervisor and Line levels: a Living document.

29. Hazards, Incidents, Accidents
Byrd’s Triangle
Eliminate hazards and you will eliminate accidents
1 Accident
10 Incidents
600 Hazards

30. Hazard Identification: Fundamental Requirements
The fundamental requirements for effective hazard identification are:
To get past perceptions and to quantify wherever possible
To tap into the vast reservoir of knowledge that exists within Aviation and other complex industries
To ‘think outside the box’
Be paranoid: believe everything and believe nothing: continually test for the truth

31. Which hazards? Type specific Hazards Major Aviation Safety Hazards
Company Specific
Hazards
Aviation Safety Case
Generic Aviation Safety Hazards + =
Operation Specific
Hazards
Significant
Workplace
Hazards
Workplace
Safety
Procedures
(Defined in
HSE-MS)
Generic HSE
Hazards
The important point to take from this model is that only major hazards should be included in a Safety Case. Significant workplace hazards are, as the process is developed, managed through the workplace safety procedures
Location Specific
Hazards

32. Primary Sources for Identifying Hazards
Safety Critical Processes
External Sources
Internal Sources
Formal Hazard Models
Hazard Register

33. Hazard and Effects Register

34. Risk Analysis Process
When identified and objectively analyzed, each hazard shall be subjected to a risk analysis. This shall accomplished by using a risk matrix of a format commonly found in the industry
The matrix is self-explanatory and even though some of the aspects may well be subjective, it at least allows the partial quantification of risk factors.
The hazards are then ranked in terms of the rating obtained by use of the matrix
In terms of the Shell model, all hazards ranked as ‘intolerable’ shall be subjected to a ‘bow-tie’ analysis.

35. The Risk Grading (Threat Analysis) Matrix

36. The ‘Bow-Tie’ Process

37. The Bow-Tie Process
For those hazards assessed as being ‘Intolerable’, develop ‘controls in depth’ as follows:
Identify the Threats that might release the hazard
Identify Controls to contain the Threats
Identify factors that could prevent the Controls from being effective: Escalation Factors
Develop controls to contain the Escalation Factors: Escalation Controls
The hazard is released, but it’s consequence has not yet occurred: what controls make detection and recovery possible: Recovery Measures
Identify Escalation Factors hampering detection and recovery
Identify a final layer of Escalation Controls
Identify measures to mitigate the effects of the Consequence
These are the basic steps of Hazard/Risk management.
It identifies hazards and threats and evaluates the risk exposure. From this the means of control of the threats and in due course return the situation to normal safe operations. This whole process is documented in the SMS.

38. T H E B O W - T I E Hazardous Event Slide 15 HAZARD THREAT CONTROL
ESCALATION
CONTROL
T H E
B O W -
T I E
Hazardous
Event
RECOVERY
Tiger in the cage !!
Hazard = Tiger in the cage
Threats = Door unlocked, corroded bars
Controls = double locking, corrosion protection
Escalations = non competent staff, corrosive atmosphere, lack of maintenance.
Escalation controls = training, maintenance programme
Top event = Tiger out of the cage!
Recovery = Shoot the tiger, or drive back into cage
Escalations = miss the tiger, or tiger outwits keeper
Escalation controls = marksman available, competent keepers
Consequence = Tiger bites the keeper (death or serious injury)
Mitigation's = First aid, emergency response, hospitalisation,
letter of regret to the keepers widow, workers compensation programme.
Slide 15
ESCALATION
CONTROL
CONSEQUENCE
MITIGATION MEASURES

39. Hazard Threat Control Escalation Tiger out of the Cage
Cage Door Locking System
Twin Locks & Warning Lights
Unserviceable Warning System
Records & Maintenance
Tiger out of
the Cage
T H E B O W - T I E
Recovery
Escalation
Control
Consequence
Mitigation
Shoot Tiger, or drive back in cage
If a company knows what it is that it needs to manage then it now need a means of assuring that the controls are in place and embedded in the normal working systems within the company.
That is what a safety management system is for assuring continuing application of safety in the completion of the day job (that what you normally do).
So what is so different about a Safety Management System, is it something new?
Slide 16
Miss Tiger, or Tiger Evades Keeper
Competent Keepers
Tiger Bites Keeper
Effective Emergency Response Plan

40. Human Error Inappropriate pilot control input
Hazard
Threat
Control
Escalation
PEOPLE
Errors, Mistakes, Violations
Competence, Procedures, Systems
Non Compliant Pactice
Monitoring and Feedback
T H E B O W - T I E
Human Error
Inappropriate pilot
control input
Recovery
Escalation
Control
Consequence
Mitigation
Make corrective control selection
If a company knows what it is that it needs to manage then it now need a means of assuring that the controls are in place and embedded in the normal working systems within the company.
That is what a safety management system is for assuring continuing application of safety in the completion of the day job (that what you normally do).
So what is so different about a Safety Management System, is it something new?
Slide 17
Input can not be made it time
Competence & Awareness
Aircraft Crashes
Effective Emergency Response

41. Percentage of Accidents Reported in NASA Study Preventable by Individual Mitigation Measures
Seven Key
Initiatives
Requires development work

42. Hazard and Effects Register

43. So What is an SMS?
An SMS is a suite of standards, policies, procedures, practices etc that will assure the safe and effective execution of work (‘Quantitative’ Quality elements)
An SMS contains a structure for dynamic and flexible identification and control of risk to ALARP (‘Quantitative’ procedures and methods for the proactive management of safety: safety cases). This includes the requirement for a Safety Information System.
An SMS requires the application of Human Factors: communication, leadership and followership, conflict management, cultural aspects, motivation & commitment (‘Qualitative’ elements)
An SMS should encompass flight safety, ramp and maintenance safety, industrial (workplace) safety, occupational health, environmental protection and security
An SMS Manual should give the ‘big picture’ regarding safety management in the organization

44. Conclusion
SMS is not a magic bullet: it is a set of tools and guidelines that if tailored to the Organization and diligently applied so that the probability of an accident will be reduced to a level that is as low as is reasonably practicable (ALARP)
Apply these tools and guidelines and you will have done all that can be reasonably expected of you as aviation professionals and as a ‘responsible operator’

45. QUESTIONS
File Title
4/15/2017