Air Traffic Organization

1 Safety Management System manual April 2019 Air Traffic OrganizationFOREWORD The fundamental mission of the Air Traffic Organization (ATO) is to ensure the safe provision of air Traffic services in the National Airspace System (NAS). Thanks to its employees, the ATO operates the safest, most efficient air Traffic system in the world. As the ATO helps build the Next Generation Air Transportation System, the resulting cross-organizational changes to the NAS require an intensive, proactive, and systematic focus on assuring safety.

2 ATO uses the Safety Management System (SMS) to achieve this. The SMS constitutes the operating principles that support the ATO in objectively examining the safety of its operations. This document is the result of an ATO-wide effort, and reflects current international best practices and intra- agency lessons learned. It marks an important next step toward a mature and integrated SMS in the FAA. Therefore, it is important that all ATO personnel work diligently to uphold and follow the procedures and guidance in this SMS manual to manage safety risk and help promote a positive safety culture in the ATO and the FAA.

3 Teri Bristol Chief Operating Officer Air Traffic Organization i Contents Management System About the SMS manual Establishment and Continuous Support of the ATO SMS SMS Continuous Improvement Measuring NAS-Wide ATO Safety Performance SMS Benefits The Four Components of SMS SMS Components Safety Culture and Promotion: Valuing Safety in the ATO Overview of Safety Culture, Safety Assurance, and SRM Safety Programs and Initiatives SMS Policy SMS Policy Derivations ICAO SMS Policy FAA SMS Policy AOV Order ATO SMS Policy and Requirements Policy Compliance with SMS FAA Documents Related to SMS Requirements Safety Reporting Facilities and Equipment Management Hardware and Software System Development Safety Management and Risk Assessment Safety Risk in a System of SRM and Safety Introduction to Managing System Safety Safety Assessment Using the Tenets of SRM and Safety Assurance

4 SRM: Proactive and Reactive Hazard and Risk Reduction Safety Assurance: Identifying and Closing Safety Gaps Audits and Assessments ATO quality Assurance and quality Control Identifying and Addressing System Vulnerabilities System Gaps and Hazard Defenses Overview and Causes of System Gaps Hazard Defenses The Human Element s Effect on Safety Closing Gaps Using SRM and Safety Assurance Principles and Processes Safety Order of Precedence ii Safety Analysis and Risk Mitigation Overview of the SRM Process SRM Safety Analysis Phases Scope of the SRM Process When to

5 Perform a Safety Analysis When a Safety Analysis May Not Be Required Overview NAS Change Proposal Examples of NAS Changes Unlikely to Require a Safety Analysis DIAAT Phase 1: Describe System Overview Bounding and Scoping Safety analyses Bounding Safety analyses in an Integrated NAS Required Depth and Breadth of the Analysis Involving Other FAA LOBs Setting the Scope of the Analysis Defining the System / NAS Change Describe the System and the NAS Change Overview Considerations when Defining the System 5M Model Method DIAAT Phase 2.

6 Identify Hazards Overview Potential Sources of Hazards Existing Hazards Identified but Not in the Scope of an Ongoing NAS Change Hazards Identified by Audits Hazards Identified by Top 5 Emergency Modifications Existing High-Risk Hazards Elements of Hazard Identification Techniques for Hazard Identification and Analysis Developing a PHL Developing a HAW Other Accepted Tools and Techniques Causes and System State Defined Addressing Hazards that Cross FAA Lines of Business Hazard Escalation and Reporting DIAAT Phase 3: Analyze Risk Overview iii Controls Defining a Credible Hazard Effect Defining Risk How to Define and Determine Risk Determining Severity Assessing Severity of NAS Equipment Hazard Effects Using the NAS Equipment Worst Credible Severity Table Determining Likelihood Likelihood versus Frequency What to Consider When Defining Likelihood Calculating Likelihood with Quantitative Data Determining Likelihood When No Data Are Available DIAAT Phase 4.

7 Assess Risk Overview Risk Levels and Definitions High Risk Medium Risk Low Risk Plotting Risk for Each Hazard DIAAT Phase 5: Treat Risk Overview Risk Management Strategies Risk Control Risk Avoidance Risk Transfer Risk Assumption Documenting Safety Requirements Determining Predicted Residual Risk Safety Performance Targets and Monitoring Developing Safety Performance Developing the Monitoring Monitoring Activities Frequency and Duration Monitoring Post-SRM Monitoring Monitoring and Current Risk Predicted Residual Risk Is Not Met Predicted Residual Risk Is Met Residual Risk Monitoring and Tracking of

8 Changes Added to the Operating NAS iv , Performing, and Documenting a Safety Safety Analysis Process Preparing a Safety Planning and Initial Decision-Making Scope Detecting Potential for Hazards Preparing for In-Depth Safety analyses SRM Panel Facilitator SRM Panel Co-Facilitator Facilitation by AJI Safety Case Leads Pre-SRM Panel Assessment of the Scope of the Analysis Involving AOV during a Safety Analysis SRM Panel Membership Overview SRM Panel Guidance for Bargaining Unit Participation Participation on SRM Panels Outside of a Service

9 Unit or the ATO Primary SRM Panel Roles Examples of Skills and Backgrounds for SRM Panel Members Performing a Safety Analysis SRM Documents Administering the SRM Panel Meeting Factors that Jeopardize Safety Assessment Results SRM Panel Deliberations Safety Risk Management Documentation Hazard Analysis Worksheet Monitoring Plan SRM Documents Safety Finding With Hazards Safety Finding Without Hazards Writing the SRM Document Executive Summary SRM Document Signatures Current System Description of Change / Existing Safety Issue Rationale for a Safety Finding Without Hazards (If No Hazards Are Identified) Hazard and Risk Analysis (If Hazards Are Identified) Monitoring Plan (If Hazards Are Identified)

10 Dissention v SRM Panel Attendees Appendices SMTS Implementation Dates in SMTS Special SRM Efforts/Considerations Deactivation, Removal, or Decommissioning of NAS Equipment Emergency Modifications Existing High-Risk Hazards Documentation, Review, and Approval Process for Waivers to Separation Minima Initiate the Request for a New Waiver or Waiver Renewal Waiver Development Guidance: Identify Appropriate Hazards Relationship between the Waiver Request and the SRM Document Waiver Renewals Waiver Approval Acceptance and Safety Documentation Risk Acceptance and Approval and Scope of NAS Local Approving Safety Appropriate Signatories Endorsing Implementation of Safety Requirements Safety Requirements Not Planned for Implementation Safety Requirements Planned for Implementation Safety Recommendations Risk Acceptance Authority to Accept Safety Risk Risk Acceptance Outside