SAFETY MANAGEMENT SYSTEM

1 SAFETY MANAGEMENT SYSTEMSMS Aerodrome WorkshopNov 2018, CairoMohamed ChakibRegional Officer, SAFETY Implementation, International Civil Aviation Organization (ICAO), MID Office27 November 20182 SAFETY MANAGEMENT -AerodromeModule 2: Risk Assessment27 November 20183 INTRODUCTIONSMS FrameworkRisk MANAGEMENT PrinciplesHAZARD ANALYSISO bjectiveBOW TIE ModelBOWTIE XPRISK ASSESSMENT & MITIGATIONRisk Assessment MatrixInherent & Residual riskDecisions on mitigationsDOCUMENTATIONH azard LogCONCLUSIONS27 November 20184 SMS Framework27 November 20185 SSP Framework27 November 20186 HAZARD IDENTIFICATION WHEN AND WHEREHAZARD ANALYSIS CAUSES AND CONSEQUENCESCONSEQUENCES RISK ANALYSIS: SEVERITYLIKELIHOOD RISK ANALYSIS: FREQUENCYTOLERABILITY RISK ANALYSIS: EVALUATIONACTIONS TO TAKE RISK CONTROL: MITIGATIONRisk MANAGEMENT Process27 November 20187A structured hazard analysis should address these is the hazard?

2 Events can produce it? hazardis released? how can we reverse the situation? can the SYSTEM propagate into an accident?5. How canweavoid suchadverse outcome?Objective27 November 20188 Bowtie ModelHazard Analysis27 November 20189 Q3: OUTCOME Q2: CAUSES Q4: PREVENTIVE CONTROLS Q1: WHAT IS THE HAZARD? BOW TIE SAFETY EVENT 1 CONSEQUENCE 1 SAFETY EVENT 2 UNSAFE STATE CONSEQUENCE 2 SAFETY EVENT 3 CONSEQUENCE 3 SAFETY EVENT 4 HAZARD Q5: RECOVERY CONTROLS CONSEQUENCE 4 Bowtie Model27 November 201810 Bowtie model with examples27 November 201811 Winter OPS: Airplane wing contamination on the groundA/C commences TOwith contaminated flyingSurfaces or enginesContamination of Airframe surfaceWhile on groundContamination of engine intake on groundLOC-IReduced performanceREGround staff de/anti-icingCrew perform AFM proceduresfor engines iceRTOSOPRESAAERPE xample27 November 201812 Bowtie XP.

3 ADREP Taxonomy ADREP is the name of a common reporting taxonomy, which is periodically updated by ICAO in cooperation with relevant parties ADREP is aimed to achieve international harmonization, and thereby enable the exchange and aggregation of SAFETY occurrences data To achieve thatgoal,safetymanagementsoftwaretoolsne edto be compatible with ADREP27 November 201813 Bowtie XP: Components27 November 201814 BOWTIEXP: TOP EVENTS tate when control is lost over the hazardAlso known as undesired state or unsafe event: Thefirsteventin a chainofnegativeeventsleadingto unwanted consequences It is not a catastrophe yet, but now there is exposure to the potential harm of the hazard However, it should be possible to bring the situation under control again27 November 201815 BOWTIEXP: SAFETY EVENTSA possible cause that can release the hazard byproducingthetopeventAlso knownasthreats, causesortriggeringevents: therecanbemultiplesafety eventsforonetopevent eachsafetyeventrepresentsa single scenario thatcouldindependently leadto thetopevent.

4 Direct means causally direct (not necessarily in terms of time)27 November 201816 BOWTIEXP: SAFETY EVENTSA possible cause that can release the hazard byproducingthetopeventSufficiency and independency :Each SAFETY event (SE) itself, should in theory, be sufficient to directly cause the top event. If two SEs need to occur together for them to cause the top event, They need to be reformulated into one independent SAFETY event27 November 201817 BOWTIEXP: CONSEQUENCESAn unwanted event resulting from the release of the hazardAls o knownaspotentialoutcomes: Consequencesareeventsthatarecausedbythet opevent What weultimately wantto prevent27 November 201818 BOWTIEXP: CONSEQUENCESU ltimateConsequences: Makingconsequencesspecificfora topeventwillleadtomorespecificbarriersla ter on,andhelp to get moreoutofthe bowtie Trytoclassifyeventsbasedintypeofaccident sorseriousincidents( taxonomy), November 201819 BOWTIEXP: BARRIERSS afetybarriersarephysicaland/ornon physicalmeansplannedtoprevent, control , ormitigateundesiredeventsoraccidentsAlso known ascontrolsormitigations.

5 There arethreedifferentplacesforbarriers: Betweena safetyeventandthetopevent(preventivebarr iers alsoknownasproactivebarriers) Betweenthetopeventanda consequence(recoverybarriers, alsoknownasreactiveordefensebarriers) Betweena barrierandanescalationfactor(escalationf actorbarriers)27 November 201820 BOWTIEXP: BARRIERSP reventivebarriers: actagainst asafety event/topevent. its effecttakes placebeforethetopeventhashappened(always presentontheleftsideofthebowtiediagram). itcanfollowtwostrategies:oelimination. removethesafetyeventandmakesurethatthere isnothing(orless)tocausethetopevent(they shouldappearto theleftof thesafetyevent, butforsimplicitypurposes theyarelocatedtotheright)oprevention. stop thesafetyeventfrombecominga topevent, eitherby blockingthecausaleffectofthesafetyevento rdirectlystoppingthetopeventfromhappenin gWildlife activityWildlife radar detection/alertWHCM-PDegradedSafetymargi n27 November 201821 BowtieXP: Recovery Barriers:Aimed at regaining control once it is lost (top event has occurred).

6 They act on the likelihood or severity of a potential consequence through: Control: Prevents the consequence from happeningMitigation: Does not prevent the consequence from happening, but lessens the severity of theconsequence27 November 201822 Bowtie XP: Barriers Type27 November 201823 BowtieXP: Barriers EffectivenessBarrier effectiveness is a way to assess how well a barrier performs. The purpose of rating control effectiveness is to highlight areas of strength and weakness within the bowtie, potentially using this information as a basis for a matrix based risk assessment The results are typically displayed according to a color code ( redfor poorthrough to green at for good). when creating your effectiveness scale consider the usefulness of allocating average as a score27 November 201824 BowtieXP: Barriers criticalityNotallcontrolswillhavethesame importancewithregardtothemanagementofa greaterdepthofdetailintermsofescalationf actorconsideration27 November 201825 BowtieXP: Escalation factorsA condition that leads to increased risk by defeating or reducing the effectiveness of a barrierThe following three escalation factor categories can be used :Human factors: anything a person does to make a barrier less effectiveAbnormal conditions: anything in the environment that causes a barrier to be put under strainLoss of critical services: if a barrier relies on an outside service, losing that service might cause it to lose effectiveness27 November 201826 BowtieXP.

7 Escalation factors barriers Barrier that managesthe conditionswhichreducetheeffectivenessofo ther barriers Escalation factor barrie rs ar e the same concept as al l the previously discussedbarriers,but nowtheydo notprevent/mitigatea topeventor consequencefromhappening,buttheypreventa barrierfromfailing. Thesameprinciples that apply to normalbarriers also apply to escalation factor barriersESCALATION FACTORS BARRIERS:27 November 201827 Bowtie in simple way during brainstorming sessions27 November 201828 HAZARD: Human Error: Delay pilot recognition of RI by departurepilot because the departure Pilot mistakes the incurring aircraft for one safely on the EATSAFETY EVENTSPREVENTIVE CONTROLS/BARRIERSUNSAFE (TOP) EVENTRECOVERY CONTROLS/BARRIERSPOTENTIAL OUTCOME / ULTIMATE CONSEQUENCESF light crew do not comply with procedures-ATCOMONITORS&SOLVESPOTENTIALC ONFLICT-CRM -SOPC onflict between aircraft taking off and aircraft taxiing on the EAT-Compliance with procedures-AERP.

8 High severity of RI on the with other aircraft on the EATA ircraft / equipment heavy damages, fatalitiesIneffective Flight crew communications27 November 201829 BOWTIE: Added valueBowtie providebenefitsto SAFETY MANAGEMENT processes due to: Effective, visual depiction of hazard components Balanced overview for internal and external stakeholders (including third party risks) Increased awareness and understanding of the hazards leading to accident scenarios. Best practice guidance material for SAFETY risk MANAGEMENT at an operational and regulatory level. Identification of critical risk controls and an assessment of their effectivenessRisk Assessment and MitigationRisk Assessment and MitigationRisk is the composite of thepredicted probability (or likelihood) and severityof each possible consequence. Source: ICAO SMM Doc. 9859 Chp. Risk Management31 RiskAssessmentHazard= A ConditionPossibleConsequence#1 Risk = Probability SeverityPossibleConsequence#2 PossibleConsequence#3 Risk = Probability SeverityRisk = Probability SeverityAviation Risk Management3227 November 201833 Risk Concept SAFETY IS ASSOCIATED TO THE CONCEPT OF RISK, DEFINED AS A COMBINATION OF THE ANALYSIS OF TWO TERMS.

9 O o RISK LIKELIHOOD CONSEQUENCES IS SUBJECT TO AN OBJECTIVE PROCESS FURTHER EVALUATION THAT DECISION ALLOWS MAKING (ACCEPTANCE OR REJECTION) 27 November 201834 RISK ASSESSMENT MATRIXA riskmatrixis justused forrankingeventsandde cide whetheryouneedto accept theris k orreduce it throughmitigationsDecisions need to be based on an underlying analysis (such as a bowtie diagram), that will tell what will cause the unsafe event and what an organization is already doing to control Risk SeveritySafety Risk Probability27 November 201835 RISK ASSESSMENT MATRIXThe risk matrix may be customized to reflect the context of each service provider, and aviation activities, and may be subject to the agreement with its regulatory authorityElements to be considered for customization areQualitative and quantitative criteria to define: Likelihood depending on the availability of the historical data series Severity, depending on the nature of the supplied serviceFAA27 November 201836 VALUE SEVERITY ICAO SMM (Fig )

10 A CATASTROPHIC Equipment destroyed Multiple deaths B HAZARDOUS A large reduction in SAFETY margins, physical distress or a workload such that the operators cannot be relied upon to perform their tasks accurately or completely Serious injury Major equipment damage C MAJOR A significant reduction in SAFETY margins, a reduction in the ability of the operators to cope with adverse operating conditions as a result of an increase in workload or as a result of conditions impairing their efficiency Serious incident Injury to persons D MINOR Nuisance Operating limitations Use of emergency procedures Minor incident E NEGLIGIBLE Few consequences -Complete loss of aircraft and/or facilities or fatal injury in passenger(s)/worker(s); - or Complete unplanned airport closure and destruction of critical facilities; or- Airport facilities and equipment destroyed- Severe damage to aircraft and/or serious injury to passenger(s)/worker(s).