SMS for AviAtionA PrActicAl Guide Safety ManageMent SySteM baSicS

Safety Management Systems

contents
Introduction
Why SMS? Case study: a tale of two siblings SMS whats in it for you? Business benefits parallels between business, safety and quality management

01
01 02 04 05

Safety culture where does your organisation sit? ICAO framework components of an SMS
Safety policy and objectives Safety risk management Safety assurance Safety promotion

05 07
08 09 11 15

The role of human factors in an SMS Toolkit for safety management

Index of toolkit items Jargon busters abbreviations, acronyms and definitions References
2012 Civil Aviation Safety Authority For further information visit www.casa.gov.au

16 17
18 19 24

This work is copyright. You may download, display, print and reproduce this material in unaltered form only (retaining this notice) for your personal, non-commercial use or use within your organisation. Apart from any use as permitted under the Copyright Act 1968, all other rights are reserved. Requests for further authorisation should be directed to: Safety Promotion, Civil Aviation Safety Authority, GPO Box 2005 Canberra ACT 2601, or email [email protected] This kit is for information purposes only. It should not be used as the sole source of information and should be used in the context of other authoritative sources. The case studies featuring Bush Air and Bush Maintenance Services are entirely fictitious. Any resemblance to actual organisations and/or persons is purely coincidental. 1105.1511

Safety Management System basics

introduction
This resource kit contains advisory material for aviation operators and organisations. It provides guidance on, or best practice examples of, various safety management system (SMS) elements for you to consider when you are implementing or updating your SMS. This kit is designed for small to medium-sized air operators certificate (AOC) holders involved in regular public transport operations, as well as for approved maintenance organisations, but other aviation organisations may also find it useful. The broad principles apply to all operators and organisations. The structure and content of an SMS will essentially be the same for them all. However, the detail will need to reflect the size and complexity of the specific organisation, as well as the risks unique to its location and operation. SMS is scalable, so your system needs to reflect what you do, your specific risks, and what you are doing about them. Above all, the way you manage safety needs to be systematic. There are six booklets in the SMS for Aviation a practical guide resource kit. This booklet: 1. Safety management system basics and booklets 26: 2. Safety policy and objectives 3. Safety risk management 4. Safety assurance 5. Safety promotion 6. Human factors

Booklets 25 follow the International Civil Aviation Organization (ICAO) framework for SMS. At the back of each of these are templates and checklists to guide organisations in developing and implementing their SMS. Booklet 6 Human factors looks at the role human factors play in safety management.

Why SMS?
Dr Tony Barrell, a former CEO of the UK Health and Safety Executives Offshore Safety Division, (the offshore petroleum safety regulator), who led the development of the regulatory response to the 1988 Piper Alpha disaster, in which 167 men died, observed:

there is an awful sameness about these incidents they are nearly always characterised by lack of forethought and lack of analysis and nearly always the problem comes down to poor management
Anybody with a passion for aviation knows that safety is as important to the industry as oxygen is to breathing. Poor or ineffective safety management can be disastrous and lead to public outrage, exhaustive inquiries and drawnout legal action. Safety management is not a dark art its central concepts are simple. In fact, safety management was succinctly described at a recent ICAO working group as organised common sense.

a safety management system (SMS): a businesslike approach to safetya systematic, precise and proactive process for managing safety risks.
transport canada

Safety Management Systems

01

The following tale illustrates the benefits of a structured approach to safety management:

Case Study: A tale of two siblings

A father wants to give his two children a good start to their working lives. Both are qualified pilots and are keen to run an aviation business together. However, they cannot agree on where to base their business, as one wants to live in Sydney and the other loves Melbourne. The father purchases two Metro III aircraft and gives one to each child, who both apply for an air operators certificate (AOC). On receiving an AOC, the Sydney-based sibling secures some regular contract work flying mining workers to and from regional centres. The Melbourne-based one is able to sign a contract with the Victorian government for regular scheduled services throughout the state. Over the next few months both businesses grow and take on more pilots, ground handling, engineering and maintenance, and administration staff to cope with additional passenger numbers and extra services. Their fleet size also expands to meet these demands. While each business continues to be successful, their proud father notices their approaches to safety management are very different. The Sydney-based sibling adopts a formal safety management system (SMS) based on six simple strategies: 1. Appointing one of the best line pilots as a parttime safety officer

2. Regular staff meetings to identify safety risks to the operation and controls to manage these 3. Establishing a confidential safety reporting system for staff to report safety hazards 4. Weekly safety meetings to manage and resolve identified safety issues 5. Central recording and capture of safety information to identify emerging safety risks 6. Regular distribution of safety information to staff, reinforcing a safety-first culture. In contrast, the Melbourne-based operation relies on less formal methods to manage safety. These tend to be on the run. Eight months later, the father asks an independent auditor to have a look at each business. While both businesses are financially sound, the auditor finds evidence that the Sydney-based operation has a stronger safety culture than the Melbourne-based one, as in the results on the right:

02

Safety Management System basics

evaluation criteria Staff views about whether there is a positive safety culture in the business

Sydney Staff have confidence that safety is well managed.

Melbourne Staff do not think that enough is being done to manage safety.

Staff are strongly motivated and willing to There is a general reluctance report safety hazards and give consistent to report safety issues and management provides little feedback on safety performance. information on safety action. Staff are satisfied with the way Staff have little confidence that management address safety issues. management are serious about safety. Only nine safety hazard reports are Safety reporting A total of 48 safety hazard reports are submitted, five times fewer than culture submitted over the eight-month period. the Sydney-based group. Some of This suggests staff confidence and the reports are not safety issues, commitment to safety. but gripes about management. Staff attitudes remain unchanged Staff perception about Staff believe there is now less potential about the potential (likelihood) for aviation safety risks (likelihood) for specific aviation safety hazards to result in a significant accident. specific aviation safety hazards to result in a significant accident. Staff believe that some safety Strong action taken on long-standing Positive action on issues are difficult to resolve, and safety issues resulting safety issues, which in some cases there is little opportunity to identify reduces operational costs: in some operational more efficient and safe practices. cost savings Use of the maintenance release by pilots. Better understanding of in-flight turbulence procedures. Better control over pedestrian traffic on the tarmac. Reduced flight crew workload during passenger loading/unloading.

Based on a study conducted at the Sydney and Melbourne operational bases of Kendall Airlines by Edkins, G.D. (1998). The INDICATE safety program: A method to proactively improve airline safety performance. Safety Science, 30: 275-295.

this story shows the vital role safety culture plays in the safety and operational success of an organisation. a small to medium-sized operator on a limited budget does not have to spend large amounts of money to improve its safety culture. in fact, implementing safety management programs will help to improve operational safety, reducing inefficiencies and leading to reduced operating costs.
Safety Management Systems 03

SMS whats in it for you?

The business benefits of an SMS Those in business know that a structured approach to safety management is something that complements and supports good management, engineering and human factors practices. Some of the generally accepted benefits of an SMS include: Reduction in the direct cost of incidents, aircraft and component damage, aircraft recovery and lost time injuries Reduction in indirect costs such as insurance, business reputation etc. What does an SMS cost? Yes, setting up and maintaining an SMS will cost depending on the size and complexity of your organisation, but an accident will cost far more - potentially your business. History shows that organisations which have had fatal accidents often do not survive. The cost of developing an SMS is estimated at about A$20,000 to $30,000 for small and medium-sized airlines with ongoing annual operating expenditures of between $15,000 and $17,000.These costs would be much less if an operator already has a functioning SMS. You have to weigh these costs against the direct and indirect costs of accidents and incidents. For a small maintenance organisation, this figure is likely to be halved.

Direct costs There are obvious, easily measured, on-the-spot costs. These mostly relate to physical damage, and include things such as rectifying or replacing equipment, or compensating for property damage or injuries. For example, the direct cost of damage from a propeller strike on a light twin aircraft may range from A$15,000 to $20,000 for overhaul and engine strips. Recovery and clean-up costs for a 20-seat regional turbo prop aircraft are estimated at $200,000 per aircraft. Indirect costs Indirect costs are usually higher than direct costs, but are sometimes not as obvious and are often delayed. Even a minor incident will incur a range of indirect costs. These costs include: Loss of business and damage to the reputation of an organisation Legal and damage claims Increased insurance premiums Loss of staff productivity Recovery and clean-up Cost of internal investigations Loss of use of equipment Cost of short-term replacement equipment. As well as the direct costs of $15-20,000 in the propeller strike on a light twin aircraft example mentioned previously, indirect costs for aircraft cross hire, rescue and ferry activities could add a further $20,000. The above figures suggest that an SMS is likely to produce a number of business benefits, the most obvious being a reduction in accidents and incidents, and in the longer term a reduced insurance rate. An effective SMS will also help to create a more positive working environment, resulting in better productivity and morale.

the other positive about a good SMS is that if you take the word safety out of it, its a good management system. it improves the way you do business.
Lindsay Evans, Network Aviation

04

Safety Management System basics

Business benefits parallels between business, safety and quality management

Business and safety management both involve goal setting, establishment of policies, measurement of performance and continuous improvement. However, an SMS goes beyond a business/ quality management system (QMS) because it focuses on how people contribute to the safety outcomes of a business. In other words, it focuses on protection; while a QMS focuses on the products and services of an organisation on production. This people focus underlines the importance of integrating human factors in all parts of an SMS.

Those in senior positions foster a climate in which there is a positive attitude towards criticism, comments and feedback from lower levels of the organisation There is an awareness of the importance of communicating relevant safety information to all levels of the organisation (and with outside entities) There is promotion of appropriate, realistic and workable rules relating to hazards, to safety and to potential sources of damage, with such rules being supported and endorsed throughout the organisation Personnel are well trained, and fully understand the consequences of unsafe acts. Safe organisations generally: Pursue safety as an organisational objective and regard it as a major contributor to achieving production goals Have appropriate risk management structures, which allow for an appropriate balance between production and risk management Enjoy an open and healthy corporate safety culture Possess a structure which has been designed with a suitable degree of complexity Have standardised procedures and centralised decision-making consistent with organisational objectives and the surrounding environment Rely on internal responsibility, rather than regulatory compliance, to achieve safety objectives Put long-term measures in place to mitigate latent safety risks, as well as acting short term to mitigate active failures.

Safety culture - where does your organisation sit?

A safety culture within an organisation is generally thought to be a set of beliefs, norms, attitudes or practices which reduce the exposure of all people in and around the organisation to conditions considered dangerous or hazardous. According to the International Civil Aviation Organization (ICAO: 1993), the characteristics of a safe culture, which should guide decisionmakers in modelling corporate safety culture, include the following: Senior management places strong emphasis on safety as part of the strategy of controlling risks Decision makers and operational personnel hold a realistic view of the short- and long-term hazards involved in the organisations activities Those in senior positions do not use their influence to force their views on other levels of the organisation, or to avoid criticism

Safety culture has as much definitional precision as a cloud

James Reason

Safety Management Systems

05

The five key ingredients of an effective safety culture fLeXibLe cULtURe An organisation can adapt in the face of high-tempo operations or certain kinds of danger - often shifting from the conventional hierarchical mode to a flatter mode. infORMeD cULtURe Those who manage and operate the system have current knowledge about the human, technical, organisational and environmental factors that determine the safety of the system as a whole. JUSt cULtURe There is an atmosphere of trust. People are encouraged (even rewarded) for providing essential safety-related information, but they are also clear about where the line must be drawn between acceptable and unacceptable behaviour. LeaRning cULtURe An organisation must possess the willingness and the competence to draw the right conclusions from its safety information system and be willing to implement major reforms. RePORting cULtURe An organisational climate in which people are prepared to report their errors and near-misses.
Managing the risks of organisational accidents. Aldershot, UK, Ashgate. Reason, J. (1997).

Other benefits of an effective safety culture An effective safety culture not only helps to meet your moral and legal obligations (such as providing a safe work environment for employees), but also has other benefits, including: Return on investment: A positive safety culture provides a much greater control over losses. In turn, this allows your organisation to operate in inherently risky environments where the return on investment is the greatest. trust: A positive safety culture will generate trust on the part of other customers and other aviation organisations, potentially generating more business though alliances. improved audits: A positive safety culture will welcome audits as an important source of external information and/or confirmation about how well your organisation is performing. There is a strong relationship between safety culture and a safety management system. A safety management system consists of a number of defined minimum standards. However, standards are just words on paper. As Professor Patrick Hudson says:

Sound systems, practices and procedures are not adequate if merely practised mechanically. they require an effective safety culture to flourish. improvements in safety culture are needed to move off the plateau of performance.
While safety culture can be considered to be the oil that lubricates the engine parts (elements of the SMS), ultimately, safety culture is the link between behaviour (errors and violations) and the effectiveness of the SMS. An SMS will not be effective unless there is a positive safety culture, which in turn determines how your people will contribute to the SMS and what they think about it.

06

Safety Management System basics

icAo framework components of an SMS

There are now significant community expectations that aviation organisations must not only take safety seriously, but also demonstrate that they are doing this by having a formal safety management system. Globally, the International Civil Aviation Organization (ICAO) sets the standard for aviation safety management. ICAO member states such as Australia must ensure operators implement an acceptable safety management system. There is also a requirement for human factors and non-technical skills (NTS) for maintenance personnel, flight crew, cabin crew and other safety-critical personnel. In Australia, CASA reflects these through Civil Aviation Safety Regulation (CASR) Part 119 (AC119-1), requiring air transport operators to implement a safety management system (SMS) in their organisations and integrate human factors (HF) into their SMS processes. Under CASR Part 145 approved maintenance organisations must introduce and maintain safety management, human factors and quality assurance systems. AC139-16 lists SMS requirements for aerodromes, and there are existing requirements for high-and low-capacity RPT operators. Therefore, aviation organisations, both large and small, must be able to demonstrate an effective approach to safety management.

There are four major components of the required SMS: Safety policy and objectives Safety risk management Safety assurance Safety promotion

The two key words here are safety and management. Safety: is the state in which the probability of harm to persons or property is reduced to, and maintained at, a level which is as low as reasonably practicable (ALARP) through a continuing process of hazard identification and reduction. Management: requires planning, resourcing, directing and controlling.

So, safety management involves managing your business activities in a systematic, coordinated way so that risk is minimised.
System: a coordinated plan of procedure.

Having an SMS just because the regulations say you have to is the worst reason for doing it.
Senior management need to be committed to safety, and need to pursue SMS improvement in the same way they strive for increased profits. Organisations must develop and implement systems to ensure risks are managed to a level considered to be as low as reasonably practicable (ALARP).

Safety Management Systems

07

According to ICAO, a safety management system is an organised approach to managing safety, including the necessary organisational structures, accountabilities, policies and procedures. As with all management systems, it involves goal setting, planning, documentation and the measuring of performance goals. It also involves: adopting scientifically based, riskmanagement methods systematic monitoring of safety performance creating a non-punitive work environment which encourages hazard and error reporting senior management commitment to pursue safety as vigorously as financial results adopting safe practices and safety lessons learned stringent use of checklists and briefings to ensure consistent application of standard operating procedures (SOPs) integrating human factors in safety training to improve error management skills.

1. Safety policy and objectives

Safety policy A safety policy outlines what your organisation will do to manage safety. Your policy is a reminder of how we do business around here. Safety policy statements typically include: The overall safety objectives of the organisation The commitment of senior management to provide the resources necessary for effective safety management A statement about responsibility and accountability for safety at all levels of the organisation Managements explicit support of a just culture, as part of the overall safety culture of the organisation. Safety objectives The safety objectives should state an intended safety outcomewhat you are going to do. These objectives may be expressed in terms of short-, medium- and long-term safety goals. To be able to measure the effectiveness of operational safety objectives, they should be SMaRt (specific, measurable, achievable and realistic; and have a specified timeframe within which they are to be achieved).

Hazards exist in the operating environment.

08

Safety Management System basics

SMS implementation SMS implementation involves spelling out all aspects of developing and implementing the SMS. It is expected that the SMS program will mature over time through a process of continuous improvement. Organisations should conduct a gap analysis to determine which parts of their safety management system are currently in place, and which parts need to be added to, or modified, to meet their own, as well as regulatory, requirements. The chief executive officer (CEO) of the organisation should demonstrate a commitment to safety by: recruiting a management team appropriate to the size and complexity of the organisation developing and disseminating a safety policy and safety objectives establishing a safety strategy and safety goals creating and adequately resourcing the SMS program specifying the roles, responsibilities and accountabilities of the management team in relation to aviation safety. for more information about safety policy and objectives, see booklet 2 in this kit.

2. Safety risk management

Risk management is a key component of an SMS and involves two fundamental safety activities: 1. Identifying hazards 2. Assessing risks and mitigating their potential to cause harm. To determine what controls you use to mitigate risk, you apply the ALARP (as low as reasonably practicable) principle. In other words, you mitigate the risk to the point where the cost grossly outweighs the benefit. However, while it has been used for some time in risk mitigation, there are limitations to the ALARP principle. In the very near future, ALoSacceptable level of safetywill replace ALARP. Risk management is simply a careful examination of what could cause harm, so that you can weigh up whether you have taken enough precautions, or should do more to prevent harm. Identifying hazards A hazard is anything which may cause harm to people, or damage to aircraft, equipment or structures. Examples of aviation hazards are: bad weather, mountainous terrain, wildlife activity near an aerodrome, FOD, contaminated fuel, poor workshop lighting and fatigue. You have to identify and manage organisational hazards so they do not compromise the safety of your operation. Generally, the hazard exists now: while the risk associated with that hazard might occur in the future. A large number of white ibis at the landfill centre adjacent to the aerodrome is a present hazardthey are sizable birds. The future risk is that if they are involved in a bird strike, they could cause engine failure and an aircraft crash.

Safety Management Systems

09

Risk assessment Risk is the chance, high or low, that somebody could be harmed by various hazards, together with an indication of how serious the harm could be. Dont overcomplicate the process. Many aviation organisations know their hazards well and the necessary control measures are easy to apply. If you run a small organisation and you are confident you understand what is involved, you can do the assessment yourself. Risk management is an integral component of safety management and involves five essential steps: safety risk management Equipment, procedures, organisation, eg. Analyse the likelihood of the consequence occurring Evaluate the seriousness of the consequence if it does occur Is the assessed risk(s) acceptable and within the organisations safety performance criteria? Hazard identification Risk analysis probability Risk analysis severity

Poor meal choice Mike, a captain working for a small Essendon airport-based charter operation, meets some friends at a seafood restaurant. He chooses the curried prawns and does not drink any alcohol. As the night wears on, Mike starts to feel unwell and leaves, going to bed early. However, he is up for most of the night with food poisoning and manages to get only two hours sleep. He arrives at work early the next morning dehydrated and fatigued, and does not pay enough attention to the NOTAMs forecasting low cloud and thunderstorms en route. Mike is forced to divert around the unexpected weather and with the extra miles tracked, nearly runs out of fuel before reaching his destination airport. Mike made a number of errors (unsafe acts). He chose to come to work knowing he was not fit for duty (mistake) and he paid little attention to the NOTAMs (slip). His errors resulted from fatigue (workplace condition). However, as with most incidents, there is more to it than that. During investigation, we discover that Mikes fellow pilots also admit to coming to work not fit for duty, and not declaring it, because of management pressure not to call in sick because of a shortage of pilots. So its not just Mike. His not declaring he was unfit for duty can now be considered as a routine violation (cultural practice). This operators fitness-for-duty policy is ineffective. It is an example of an absent/ failed defence. The pressure management imposes on pilots demonstrates a poor safety culture (organisational factor).

Risk assessment and tolerability

Yes, accept the risk/s

No, take action to reduce the risk/s to an acceptable level

Risk control/ mitigation

for more information about safety risk management, see booklet 3 in this kit.

10

Safety Management System basics

3. Safety assurance
Safety assurance involves establishing a systematic process for assessing and recording an organisations safety performance. This includes activities such as safety investigation, change management, monitoring, analysis and continuous improvement. Safety investigation and SMS Investigating incidents and accidents in a structured way is fundamental to an effective SMS. If you do not investigate incidents thoroughly, you cannot learn from them, and therefore will miss opportunities to identify risks to your operation. James Reason has formulated one of the most widely accepted and respected theories of how and why accidents happen. Reason says accidents have multiple causes and involve many people operating at different levels of an organisation. After Reasons ground-breaking work, it is now generally accepted that accidents do not result from a single cause, but are due to multiple contributing factors. The scenario on page 10 opposite, illustrates how even a simple meal choice involves multiple contributing risk factors.

These multiple contributing factors arose from failures in three broad areas: Organisational factor Poor safety culture Workplace condition Fatigue Unsafe act Fails to report in sick, misses NOTAM Defences Ineffective fitness-for-duty policy nearly runs out of fuel

There are many factors you might like to take into considerationthe following pages detail these.

the only real mistake is the one from which we learn nothing
John Powell

for more information about safety assurance, see booklet 4 in this kit.

Safety Management Systems

11

1. Organisational factors the organisation establishes the work practices environment. Organisational processes can affect safety through: robust, clear work procedures providing appropriate time and resources to do the job providing adequate and appropriate supervision or training positive organisational culture. example: Poor pilot induction training can result in inadequate knowledge of company procedures. 2. Workplace conditions task, equipment, environment or human limitations that increase the likelihood of human error. These errorproducing conditions can include: Inappropriate, poor or faulty, equipment high workload unfamiliar tasks fatigue excessive noise or temperature inclement weather use of prescribed medications or AOD personal or financial stress lack of proficiency. example: An airport closed due to fog means the flight crew must make a decision about the best alternate airport.

3. Unsafe acts actual errors or violations made by those doing the job. Unsafe acts are usually the last elements of the chain of accident causation and include: operating equipment outside limitations forgetting a crucial step in a procedure misdiagnosing a problem wilfully breaking a work-related rule or procedure. example: The flight crew incorrectly calculate the fuel required to divert to the chosen alternate airport. As well as these three elements, there is a critical fourth area: defences. 4. Defences are barriers or safeguards against errors, and can range from hard-engineered safety devices (seatbelts, electronic warning and detection systems) to soft defences, such as standard operating procedures (SOPs), or raising staff awareness through education or training programs. There are usually multiple defences within any system. example: The flight operations policy of loading additional fuel ensures that the incorrect fuel calculation does not result in fuel starvation during aircraft diversion. On their own, each of the four types of failures will not usually result in an accident. However, a breakdown at each failure level can create opportunity for an accident to occur. Flawed defences: Swiss cheese James Reasons approach to accident causation is often referred to as the Swiss cheese model. The model illustrates that an organisations defences (slices of Swiss cheese) move around constantly, but if their holes align a hazard can pass through multiple layers of defences (or slices of cheese). According to the Swiss cheese model, some of the holes in defences are due to errors (active failures) made by employees who are typically on the front line.

12

Safety Management System basics

Other holes in the defences are caused by organisational factors (latent conditions), or other error-producing conditions in the workplace. The Swiss cheese analogy suggests that no defences are perfect. However, the critical task in maintaining safety is to find the holes in the defences, and build stronger and better layers of defence.

Hazards

accident
The following airline safety incident illustrates the Swiss cheese model: What life raft? In August 1998, a Boeing B737-300 aircraft was diverted to Adelaide due to poor weather at Melbourne Airport. During the overnight service in Adelaide, the engineering and maintenance staff performed an over-water-return check on the aircraft, which should have included the removal of only one life raft. However, due to high workload and the unfamiliarity of Adelaide engineering staff with the permanent life raft modification program, all three life rafts on the aircraft were removed instead. The aircraft then operated to Sydney, via Melbourne, where another over-water preparation check was conducted before the aircraft flew the Sydney to Wellington service. This check normally includes an inspection of the two permanent life rafts and the loading of one additional life raft. However, while the usual process of fitting the additional life raft took place, the engineering staff did not check to see if the two permanent life rafts were fitted, as they assumed that the permanent life raft installation program had been completed. Before departure, the captain completed his pre-flight walk around, which included checking to ensure that all life raft equipment was on board. This involved looking through a narrow inspection or viewing hole. Shortly after boarding, the customer service manager (CSM) received a report from two flight attendants that the emergency equipment, including life rafts, had been checked. The aircraft subsequently flew over water to Wellington without the legally required life rafts. This Boeing 737-300 incident is significant if you consider the implications of a trans-Tasman ditching without sufficient life rafts.

Safety Management Systems

13

If we apply the four elements of the Swiss cheese model, we can quickly see that the incident involved more than just a series of errors by aircrew: absent/failed defences life raft removal and maintenance is usually carried out in either Melbourne or Sydney. Because the aircraft was diverted to Adelaide, the engineers were not familiar with the procedure. The wording of the engineering instruction: remove all over-water equipment was also misleading. The engineering system was not flexible enough to cope with a change in normal procedures and so this defence failed. The aircraft technical log also did not indicate that the life rafts had been removed. Unsafe acts the captain, the cabin crew and the engineer in Adelaide all made errors. The captain said he had inspected the life rafts, but for some reason, missed that they had been removed. The CSM relied on the information provided by two flight attendants that they had checked the life raft equipment correctly. The Adelaide engineer misunderstood the engineering instructions, relying on how the procedure used to be done, and as a result, removed all three life rafts instead of the required one. Workplace conditions Fog in Melbourne, and the subsequent diversion to Adelaide, set up the incident to occur. High workload is a common workplace factor, often increasing the likelihood of human error. Engineering staff in Adelaide faced a high workload with unscheduled maintenance on several aircraft diverted from Melbourne. The cabin crew bus was 15 minutes late, meaning they were under time pressure to complete all their checks before passengers boarded. A misleading placard located adjacent to the raft inspection hole also stated: life rafts permanently fitted This might have created an expectation among the crew that the life rafts

were never removed. To complicate matters further, the design of the raft inspection hole was poor. It was very narrow, and crew members had to position themselves directly beneath the hole to view the contents of the overhead bin clearly. Organisational factors the investigation revealed a number of deficiencies in crew training on how to check emergency equipment, as well as the checking procedures themselves. For example, the technical crew manual indicates how many life rafts are required on a B737, but does not lay down a set procedure for checking them. The crew also reported vast differences in their emergency equipment check training. Senior managements decision to modify the life raft equipment on the B737 over an extended period increased the opportunity for error. The life raft incident clearly illustrates breakdowns at each failure level; but had just one of those failures not occurred, the outcome might have been different. For example, despite engineering staff in Adelaide misinterpreting the life raft removal procedures, the operating crew in Sydney had the opportunity to identify the lack of life rafts. The life raft incident shows that one person alone usually does not cause an accident. Rather, an accident is the result of a combination of failures, not just by crew, but throughout the entire company and beyond. While you may have limited control over the actions of others, there are many things you can do to prevent the holes in the Swiss cheese lining up. reference
What life raft? Edkins, G. (2001).

14

Safety Management System basics

Swiss cheese model for the life raft incident Organisational factors Training deficiencies in life raft checking procedures Protracted life raft modification process Workplace conditions Poor weather at Melbourne Time pressure on aircrew and engineers Placard read: life raft permanently fitted Unsafe acts errors & violations Captain missed the life raft removal Cabin crew missed the life raft removal Adelaide engineer misunderstood the job task card Defence failures Adelaide engineering staff unfamiliar with over-water return procedure Ambiguous wording of entry into service (EIS) instruction

4. Safety promotion
Effective safety promotion and training foster awareness and understanding of the SMS throughout the organisation, helping to create a positive safety culture. Safety training provides skills and knowledge, as well as raising awareness of risk issues. Safety promotion sets the tone for individual behaviour, giving a sense of purpose to safety efforts. It fosters communication, keeping the whole organisation informed. Both activities help the organisation to adopt a culture that goes beyond merely avoiding accidents or reducing the number of incidents. It becomes more about doing the right thing at the right time in response to both normal and emergency situations. Safety training and promotion help to foster safety best practice.

Mishaps are like knives that either serve us or cut us, as we grasp them by the blade or the handle.
James Russell Lowell

for more information about safety promotion, see booklet 5 in this kit.

Safety Management Systems

15

the role of human factors in an SMS

What are human factors?
The study of human factors is about understanding human behaviour; integrating HF principles is critical to an effective SMS. Human factors (HF) is a broad term referring to the study of peoples performance in their work and non-work environments. Human factors aim to optimise the fit between people and the system in which they work, to improve both safety and efficiency. Regulation and safety management systems are merely mechanical unless the safety behaviour of people, through human factors principles, is clearly understood. Organisations should avoid a stand-alone human factors policy that sits gathering cobwebs on a shelf. Human factors is as much a part of SMS activities as are issues such as cost, risk and resources. However, the human contribution to an accident must be understood in context to avoid an oversimplistic label of operator error.

Errors are as normal as breathing oxygen, and about as certain as death and taxes. A key strategy in managing human error is to provide operational staff with human factors training to enhance their non-technical (e.g. decision making and social) skills. As a minimum, you should integrate human factors principles into the following areas of your SMS: identifying hazards and reducing risk to be ALARP managing change designing systems and equipment designing jobs and tasks training of operational staff safety reporting and data analysis investigating incidents. For a more detailed discussion of human factors and SMS, see booklet six in this kit.

Human factors: all the people issues we need to consider to assure the lifelong safety and effectiveness of a system or organisation.
British Rail Safety and Standards Board

for more information about human factors and aviation, see booklet 6 in this kit.

16

Safety Management System basics

to o l kit
InDex oF ToolkIT ITeMS JARgon buSTeRS ABBrevIATIOnS, ACrOnyMS And defInITIOnS ReFeRenCeS

Safety Management Systems

17

index of toolkit items

This is your safety toolkit with some best-practice tips and practical tools that can be adapted to meet your organisations needs. We hope you find them useful, whether you are further developing your SMS, starting an SMS from scratch, or simply looking for some ideas to improve your existing SMS. This list summarises the checklists/templates you will find at the back of each of the respective booklets. This is not an exhaustive list of resources. There are many systems and products across various industries, so this toolkit can only include a very small sample of practices and/or tools for information. Inclusion of materials does not imply endorsement or recommendation. Each organisation must select the most appropriate products for its individual and specific needs. booklet 1 basics Jargon busters References Booklet 2 - Safety policy and objectives tools SMS organisation checklist Safety policy statement Safety managers job description Role of the safety committee SMS implementation plan Ten steps to implementing an SMS SMS gap analysis checklist An effective emergency response plan (ERP) Language and layout of procedures/ documentation Document register Sample safety leadership rules Aviation safety lifesavers policy Just culture procedure

Appendix A Workflow process for applying the just culture procedures Appendix B Bush Air counselling/discipline decision chart booklet 3 - Safety risk management tools Error prevention strategies for organisations Risk register Sample hazard ID Guidance on job and task design A six-step method for involving staff in safety hazard identification Hazard reporting form booklet 4 - Safety assurance tools Generic issues to be considered when monitoring and measuring safety performance Audit scope planner Basic audit checklist Information relevant to a safety investigation Event notification and investigation report Aviation safety incident investigation report Corrective/preventative action plan Checklist for assessing institutional resilience against accidents (CAIR) Practical safety culture improvement strategy Safety culture index Booklet 5 - Safety promotion tools How to conduct a training needs analysis Sample safety information bulletin on fatigue How to give a safety briefing/toolbox talk Aviation safety toolbox talk Safety briefing/toolbox meeting attendance form

18

Safety Management System basics

Jargon bustersabbreviations, acronyms and definitions

Abbreviations
A ac aLaR aLaRP aLoS aMe aOc aQf Advisory circular Approach-and-landing accident reduction As low as reasonably practicable Acceptable level of safety (will replace ALARP in the near future) Aircraft maintenance engineer Air Operators Certificate Australian Qualification Framework fDa fDaP fMaQ fRMS ftO g Civil Aviation Advisory Publication Checklist for assessing institutional resilience against accidents Civil Aviation Order Civil Aviation Publication (United Kingdom) Civil Aviation Safety Authority Civil Aviation Safety Regulation Critical decision method Chief executive officer Crew resource management Crew resource management instructor Crew resource management instructor examiner ifR iRM iRS iSO gaPan giHRe H Hf HMi I icaM icaO Incident cause analysis method International Civil Aviation Organization Instrument flight rules Immediately reportable matter Internal reporting system International Organization for Standardization Human factors Human-machine interface Guild of Air Pilots and Air Navigators Group interaction in high-risk environments D DeeWR e eRP eSb F faa Federal Aviation Administration (United States) Flight data analysis Flight data analysis program Flight management attitudes questionnaire Fatigue risk management system Flight training organisation Emergency response plan Effective safety behaviours Department of Education, Employment and Workplace Relations

aS/nZS Australian/New Zealand Standard atSb b bitRe C caaP caiR caO caP caSa caSR cDM ceO cRM cRMi cRMie Bureau of Infrastructure, Transport and Regional Economics Australian Transport Safety Bureau

Safety Management Systems

19

J JaR-OPS Joint Aviation Requirements Operations l LaMe LOe LOft LOS LOSa M MeDa MOS MoU n ntS o OH&S P POH Q QMS Quality management system Pilots operating handbook Occupational health & safety Non-technical skills, see also Human factors Maintenance Error Decision Aid Manual of standards Memorandum of understanding Licensed aircraft maintenance engineer Line operational evaluation Line-oriented flight training Line operational simulation Line operations safety audit

R RPt RRM S Sag SLa SM SMM SMS SOP SRb T teM tna u Ut V VfR Visual flight rules University of Texas Threat and error management Training needs analysis Safety action group Service level agreement Safety manager Safety management manual Safety management system Standard operating procedure Safety review board Regular public transport Routinely reportable matter

20

Safety Management System basics

definitions
accident: an occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with intention of flight until such time as all such persons have disembarked, in which: a person is fatally or seriously injured as a result of: - being in the aircraft, or - direct contact with any part of the aircraft, including parts which have become detached from the aircraft, or - direct exposure to jet blast, except when the injuries are from natural causes, self-inflicted by other persons, or when the injuries are to stowaways hiding outside the areas normally available to the passengers and crew, or the aircraft sustains damage or structural failure which - adversely affects the structural strength, performance or flight characteristics of the aircraft, and - would normally require major repair or replacement of the affected component, except for engine failure or damage when the damage is limited to the engine, its cowlings or accessories; or for damage limited to propellers, wing tips, antennas, tyres, brakes, fairings, small dents or puncture holes in the aircraft skin; or the aircraft is missing or is completely inaccessible. Notes 1. For statistical uniformity only, an injury resulting in death within thirty days of the date of the accident is classified as a fatal injury by ICAO 2. An aircraft is considered to be missing when the official search has been terminated and wreckage has not been located. aLaRP: as low as reasonably practicable, means a risk is low enough that attempting to make it lower, or the cost of assessing the improvement gained in an attempted risk reduction, would actually be more costly than any cost likely to come from the risk itself. aLoS: acceptable level of safety. Will replace ALARP in the very near future. assessment: process of observing, recording, and interpreting individual knowledge and performance against a required standard. behavioural marker: a single non-technical skill or competency within a work environment that contributes to effective or ineffective performance. change management: a systematic approach to controlling changes to any aspect of processes, procedures, products or services, both from the perspective of an organisation and of individuals. Its objective is to ensure that safety risks resulting from change are reduced to as low as reasonably practicable. competency: a combination of skills, knowledge and attitudes required to perform a task to the prescribed standard. competency-based training: develops the skills, knowledge and behaviour required to meet competency standards. competency assessment: The process of collecting evidence and making judgements as to whether trainees are competent. contract: an arrangement or agreement between two or more parties enforceable by law. A contract is a legal document which describes commercial terms and conditions. Note: The term contract is also taken to mean the following: leasing arrangements service level agreement (SLA).

Safety Management Systems

21

consequence: outcome or impact of an event. There can be more than one consequence of one event. Consequences can be positive or negative. Consequences can be expressed qualitatively or quantitatively. Consequences are considered in relation to the achievement of objectives. crew resource management (cRM): a team training and operational philosophy designed to ensure the effective use of all available resources to achieve safe and efficient flight operations. Dispatch includes any personnel whose responsibilities involve services, data and or instructions directly affecting the operation or performance characteristics of the aircraft, such as flight planning or fuel quantity calculations. These include: flight planners, crewing officers - schedulers ops controllers flight following; management of aircraft movements including disruption; people responsible for distribution of MET data or fuel carriage advice load controllers anyone involved in producing final load sheets, pilots, load masters. facilitator: person who enables learning in a student-centred environment by guiding participants through discussions, interactions, structured exercises and experiences. error: an action or inaction leading to deviations from an organisations or individuals intentions or expectations. error management: the process of detecting and responding to errors with countermeasures to reduce or eliminate their consequences and diminish the probability of further errors. flight data analysis: a process for analysing recorded flight data in order to improve the safety of flight operations.

Hazard: a source of potential harm. Human factors (Hf): the minimisation of human error and its consequences by optimising the relationships between people, activities, equipment and systems. incident: an occurrence, other than an accident, associated with the operation of an aircraft which affects, or could affect, the safety of operation. inter-rater reliability: the extent to which two or more coders or raters agree, helping to ensure consistency of a rating system. Just culture: an organisational perspective that discourages blaming the individual for an honest mistake that has contributed to an accident or incident. Sanctions are only applied when there is evidence of a conscious violation, or intentional, reckless, or negligent behaviour. Likelihood: a general description of probability or frequency that can be expressed qualitatively or quantitatively. Line-oriented flight training (LOft): aircrew training which involves a full mission simulation of line operations, with special emphasis on communications, management and leadership. Line operational simulation: widely used to provide opportunities for crews to practise CRM concepts in realistic and challenging simulated flight situations. Line operational safety audit (LOSa): behavioural observation data-gathering technique to assess the performance of flight crews during normal operations. Management: planning, organising, resourcing, leading or directing, and controlling an organisation (a group of one or more people or entities) or effort for the purpose of accomplishing a goal. non-technical skills (ntS): Specific HF competencies such as critical decision-making, team communication, situational awareness and workload management.

22

Safety Management System basics

Operational safety-critical personnel: perform or are responsible for safety-related work, including being in direct contact with the physical operation of the aircraft, or having operational contact with personnel who operate the aircraft. Operational safety-related work: safety-related activity in one or more of the following work areas: maintenance flying an aircraft cabin crew operations dispatch of aircraft or crew development, design, implementation and management of flight operations, safety-related processes (including safety investigations) any other duties prescribed by an AOC holder as flight operations safety-related work. Quality management system (QMS): a set of policies, processes and procedures required for planning and execution (production/development/ service) in the core business areas of an organisation. Risk: the chance of something happening that will have an impact on objectives. A risk is often specified in terms of an event or circumstance and any consequence that might flow from it. Risk is measured in terms of a combination of the consequences of an event, and its likelihood. Risk can have a positive or negative impact. Risk assessment: the overall process of risk identification, risk analysis and risk evaluation. Risk identification: the process of determining what, where, when, why and how something could happen. Risk management: the culture, processes and structures directed towards realising potential opportunities whilst managing adverse effects.

Safety: the state in which the probability of harm to persons or property is reduced to, and maintained at, a level which is as low as reasonably practicable through a continuing process of hazard identification and risk management. Safety culture: an enduring set of beliefs, norms, attitudes, and practices within an organisation concerned with minimising exposure of the workforce and the general public to dangerous or hazardous conditions. A positive safety culture is one which promotes concern for, commitment to, and accountability for, safety. Safety manager (SM): person responsible for managing all aspects of an organisations safety management system. Safety management system (SMS): a systematic approach to managing safety, including the necessary organisational structures, accountabilities, policies and procedures. Stakeholders: those people and organisations who may affect, be affected by, or perceive themselves to be affected by, a decision, activity or risk. Systemic: relating to or affecting an entire system. System safety: the application of engineering and management principles, criteria and techniques to optimise safety by identifying safety-related risks, and eliminating or controlling them (by design and/or procedures), based on acceptable system safety precedents. threat: events or errors beyond the influence of an operational person, which increase operational complexity and should be managed to maintain the safety margin. threat and error management (teM): the process of detecting and responding to threats with countermeasures to reduce or eliminate their consequences, and mitigate the probability of errors.

Safety Management Systems

23

training: the process of bringing a person to an agreed standard of proficiency by practice and instruction. training needs analysis (tna): identification of training needs at an employee, departmental, or organisational level, so the organisation performs effectively. Unit of competency: under Australian national standards, a defined group of competencies required for effective performance in the workplace. A competency specifies the required knowledge and skill for, and applies that knowledge and skill at an industry level to, the standard of performance required in employment. Usability: the effectiveness, efficiency and satisfaction with which users can achieve tasks in a particular environment of a product, equipment or system. Violation: intended or deliberate deviations from rules, regulations or operating procedures. A person committing a violation does so deliberately. Violations can be: routinecommon violations promoted by an indifferent environment, we do it this way all the time optimisingcorner-cutting based on the path of least resistance, I know an easier/quicker way of doing this exceptional or situationalone-off breaches of standards/regulations dictated by unusual circumstances that are not covered in procedures, we cant do this any other way acts of sabotageacts of harmful intent to life, property or equipment.

references
Safety behaviours: Human factors for pilots. Civil Aviation Safety Authority, Australia. (2009) Safety behaviours: Human factors for engineers. Civil Aviation Safety Authority, Australia. (due 2013) The INDICATE safety program: A method to proactively improve airline safety performance. Edkins, G.D. Safety Science, 30: pp 275-295. (1998) What life raft? Edkins, G. D. Qantas Flight Safety, Issue 2: Spring, pp5-9. Qantas Airways. Sydney, (2001). Safety culture and human error in the aviation industry: In search of perfection. Hudson, P.T.W. in B. Hayward & A. Lowe (eds.) Aviation Resource Management. Ashgate, UK. (2000) Human factors, management and organization. Human Factors Digest No. 10 ICAO, Montreal, Canada. (1993). Human factors and error management training manual, Produced in conjunction with IIR Executive Development, Sydney. NTC (2007) Leading Edge Safety Systems (2010). Human Error. Reason, J. Cambridge University Press, Cambridge (1992). Managing the Risks of Organisational Accidents. Reason, J. Ashgate, Aldershot, UK. (1997). Incident Cause Analysis Method (ICAM) Pocket Guide (Issue 5, October), Safety Wise Solutions, Melbourne (2010).

24

Safety Management System basics

Safety Management Systems

25

www.casa.gov.au 131 757

26 Safety Management System basics