Module 1 - Safety Management Fundamental

10/01/2017
Module 1
Safety Management Fundamentals
Copyright © 2015 CAAS. No part of it may be used, circulated, quoted, or reproduced for distribution outside CAAS without prior written permission. Every care has been taken to ensure that the
information contained here is accurate. Nonetheless, CAAS does not warrant the currency, accuracy or completeness of the information contained in this document, nor does CAAS accept liability
for loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from reliance on the information contained in this presentation.
Module 1: Safety Management Fundamentals

- Overview
Provide participants with the knowledge on fundamental

safety management principles and concepts, including the
influence of human as well as organizational factors in safety
management.
2
Copyright © 2015 Civil Aviation Authority of Singapore. All rights reserved.
1
10/01/2017
Module 1 Objective
At the end of this module, you will be able to describe

and explain the fundamental safety management
concepts and principles from the ICAO SMM (Doc 9859,
3rd Ed)
3
Module 1: Sections
1 Concept of safety
2 Evolution of safety
3 Accident causation
4 People, context and safety
5 Error & violation
6 Safety culture
7 The management dilemma
8 Change management
9 Integration of management systems
10 Safety reporting & investigation
11 Safety data collection, analysis & SPIs
12 Hazard identification & risk mitigation
13 Prescriptive & performance based requirements
4
2
10/01/2017
Section 1:
The concept of safety
5
What is safety
Zero accidents?
Freedom from hazards?
Error avoidance?
Good organizational safety culture?
Regulatory compliance?
6
3
10/01/2017
Considering the facts

Total elimination of accidents (and serious incidents)
is unachievable
Failures will still occur, despite the most accomplished
prevention efforts
No human activity or human-made system can be
guaranteed to be absolutely free from hazard and
operational errors
Therefore…
7
Definition of Safety
The state in which risks associated with aviation

activities, related to, or in direct support of the
operation of aircraft, are reduced and controlled
to an acceptable level
- Annex 19 (2nd ed, Jul 2016)
8
4
10/01/2017
The concept of safety – Quiz
The concept and definition of safety in Annex 19 is -
a) The total elimination of accidents and serious incidents

b) Absence of hazards and threats
c) Absence of errors and violations
d) Due diligence in safety risk management to achieve an
acceptable level of safety performance
9
Section 2:
Evolution of safety
10
5
10/01/2017
The evolution of safety thinking
TECHNICAL FACTORS
TODAY
HUMAN FACTORS
ORGANIZATIONAL
FACTORS
1950s 1970s 1990s 2000s
Source: James Reason

11
Evolution of safety – Quiz
The focus of today’s safety management approach should be

on:
a) Technical factors
b) Human factors
c) Organizational factors
d) All of the above
12
6
10/01/2017
Section 3:
Accident causation
13
The concept of accident causation
Accidents due to combination of inadequate defences(D), active failures(P),

hazards, threats, unsafe situations(W) and latent conditions(O).
14
7
10/01/2017
Bow-Tie Accident Causation Model
15
Practical drift & Accident causation
System Baseline performance

design Practicaldrift
Practical drift
Operational
deployment
Early detection
by SMS-SSP
Proactive/ Predictive
Monitoring processes
(eg HIRM, SPIs, etc)
16
8
10/01/2017
Accident causation – Quiz
Which of the following can contribute to accidents?:
a) Active failures by operational personnel

b) Hazards, threats, unsafe situations
c) Latent conditions such as organization and human factors
d) All of the above
17
Accident causation – Quiz
The concept of practical drift involves:
a) The deviation of a system or equipment from its

designed performance capability
b) The evolution of procedures by operational personnel to
accommodate system deviations
c) The capture and analysis of information pertaining to
system deviations in order to control and mitigate their
associated risks
d) All of the above
18
9
10/01/2017
Section 4:
People, Context and safety
19
The SHEL(L) model
Understanding the relationship between people and operational

contexts
Software
S Hardware
H L L Environment
Liveware
E Liveware, other persons
20
10
10/01/2017
The SHEL(L) model
The SHELL Model is a conceptual tool used to analyse the

interaction of multiple system components
Software (S): procedures, training, support, etc.;
Hardware (H): machines and equipment;
Environment (E): the working environment in which

the L-H-S system function; and
Liveware (L): humans in the workplace.

21
The SHEL(L) model
According to the SHELL Model, a mismatch between the

Liveware and the other four components can contribute to
human error, hazards, threats, unsafe situations and latent
conditions.
Thus, these interactions must be assessed and considered in all

sectors of the aviation system.
This is especially so with regard to the assessment of contributing

factors in accident investigations as well as escalation factors and
escalation controls during HIRM.
22
11
10/01/2017
People, Context and safety – Quiz
Human performance is likely to be compromised by a mismatch

between Liveware and:
a) Liveware
b) Software
c) Environment
d) Hardware
e) All of the above
23
People, Context and safety – Quiz
In the SHELL Human performance model, the “Environment”

component is essentially referring to weather conditions :
a) TRUE
b) FALSE
24
12
10/01/2017
Section 5:
Error & Violation
25
Error & Violation - Definitions

Error is - An action or inaction by an operational person that
leads to deviations from organizational or the operational
person’s intentions or expectations – SMM 2.5.3
[unintentional].
Violation is – A deliberate act or omission to deviate from
established procedures, protocols, norms or practices –
SMM 2.5.6 [intentional].
In today’s “Just Culture” environment, enforcement
decisions and actions should distinguish between Error &
Violations
26
13
10/01/2017
Two categories of Error
1. Slips and lapses

2. Mistakes
27
Three types of safety strategies to control errors
1. Reduction strategies
2. Capturing strategies
3. Tolerance strategies
28
14
10/01/2017
Error reduction strategies

Error reduction strategies intervene at the source of the
error by taking into consideration –
Human-centred design
Ergonomic factors
Environmental factors
Others
29
Error capturing strategies

Error capturing strategies intervene once the error has
already been made, capturing the error before it generates
adverse consequences –
Checklists
Task cards
Flight strips
…
30
15
10/01/2017
Error tolerance strategies

Error tolerance strategies intervene to increase the ability
of a system to accept errors without serious consequence –
System redundancies
Structural redundancies
Duplicate inspection
Dual pilots…
31
Violations
There are 3 categories of violations which may not amount to

“a deliberate act of willful misconduct or omission” -
Situational violations
Routine violations
Organizationally induced violations
32
16
10/01/2017
Three categories of violations

o Situational violations - are committed in response to factors
experienced in a specific context, such as time pressure or high
workload.
o Routine violations - become the normal way of doing business within

a work group. Such violations are committed in response to situations
in which compliance with established procedures makes task
completion difficult. This may be due to practicality/workability issues,
deficiencies in human-technology interface design and other issues that
cause persons to adopt “workaround” procedures, which eventually
become routine.
Organizationally induced violations - may be considered as an

extension of routine violations. This type of violation tends to occur
when an organization attempts to meet increased output demands by
ignoring or over stepping its safety defenses
33
Error & Violation – Quiz
An “Error” is intentional whilst a “Violation” is unintentional::
a) TRUE
b) FALSE
34
17
10/01/2017
An organization’s enforcement or disciplinary procedures

should take into account the type and circumstance of a
violation, before deciding on eligibility or scope of action to be
taken:
a) TRUE
b) FALSE
35
Safety strategies to control errors:
a) Are likely to prevent violations as well

b) Include reduction, capturing and tolerance strategies
c) May involve the use of checklists, parallel systems and
reduction of environmental distractions
d) All of the above
36
18
10/01/2017
Section 6:
Safety culture
37
What is safety culture?
Safety culture is characterized by the safety-related beliefs,

values, biases and their resultant behaviour that are shared by
members of an organization
- SMM 2.6.1
38
19
10/01/2017
Three influencing components

1. Organizational culture
2. Professional culture
Safety culture
3. National culture
Organization Reporting
Risk Profile culture
39
Organizational culture
Organizational culture refers to the characteristics and

perceptions among members interacting within a
particular organization.
40
20
10/01/2017
Professional culture
Professional culture differentiates the characteristics of

particular professional groups
41
Three influencing components of safety culture
National culture -
differentiates the characteristics of particular nations

forms an intrinsic component of personal beliefs
may affect organizational culture
42
21
10/01/2017
Reporting culture
An organization’s reporting culture:

pertains to personal beliefs about and attitudes toward
the benefits and potential detriments associated with
reporting systems
characterized by distinction between errors and
violations
assessed by effectiveness of an organization’s
voluntary reporting system
43
The Health of a Reporting culture
Possible descriptions of an organization’s safety

reporting culture:
Pathological – ignore or hide the information
Bureaucratic – restrain or barricade the information
Generative – objective analysis and sharing of

information
44
22
10/01/2017
Safety culture & organization risk profile
An organization’s safety culture:

pertains to personnel and organizational beliefs and
attitudes toward safety and quality matters
is characterized by the balance between production
and protection
affects an organization’s SMS/ QMS effectiveness and
its reporting systems
affects an organization’s safety risk profile
45
A healthy Safety Culture
A healthy safety culture is characterized by –
a generative reporting culture

active hazard identification and risk mitigation activities
top management commitment to safety responsibilities
the pursuit of continuous improvement
a positive organization risk profile
46
23
10/01/2017
Safety culture promotion & assessment
A healthy safety culture and organization risk profile

cannot be enforced
Promotion through voluntary assessment and reward

schemes possible
Note:
SMM chapter 2 Appendix 1 has a safety culture and risk profile
assessment illustration
>>> 19_AOC ORP Chklist
47
Safety Culture – Quiz
A characteristic of healthy safety culture is -
a) an effective voluntary reporting system

b) an effective mandatory reporting system
c) an effective hazard identification & risk mitigation system
d) all of above
48
24
10/01/2017
An unhealthy organizational safety culture may be

characterized by:
a) Top Management is not accountable for Safety/ Quality

matters
b) Production and operational personnel are not involved in
hazard identification and risk mitigation issues
c) An undesirable or unacceptable organization risk profile
d) All of above
49
The status of a Reporting culture is sometimes expressed as

follows (Drag the correct answers into place):
a) Pathological ______________
b) Bureaucratic ______________
c) Generative ______________
1) objective analysis and sharing of information (c)

2) restrain or misappropriate the information (b)
3) ignore or hide the information (a)
S#44 / M1-S6-3
50
25
10/01/2017
A service provider’s undesirable safety culture or risk profile -
a) may contribute to latent conditions or hazards

b) may ultimately impact operational safety
c) is an indication that greater regulatory surveillance is
required over that service provider
d) all of above
M1-S6-4
51
Section 7:
The Management dilemma
52
26
10/01/2017
Production & Protection
Production – drive to increase capacity and productivity
Protection – drive to increase safety risk controls
Management Dilemma -
Balancing Production & Protection
53
Under Protection
+ Resources
Protection
Production
Catastrophe
54
27
10/01/2017
Over Protection
+ Resources
Production
Protection
Bankruptcy
55
Balancing Production-Protection
Resources Resources
Protection Production
56
28
10/01/2017
Safety space
Protection
Bankruptcy
Catastrophe
Production
57
The Management dilemma – Quiz

Under Protection within an organization can be a situation
whereby:
a) excessive resources is allocated to the Safety/ Quality

function
b) risk assessment projects consistently exhibit adequate
preventive controls and recovery measures
c) insufficient resources is allocated to Production/ Operational
functions
d) None of the above
58
29
10/01/2017
Over Protection within an organization can result in:
a) catastrophe
b) risk mitigation projects consistently exhibit excessive
preventive controls and recovery measures
c) sufficient resources being allocated to the Production/
Operational function
d) None of the above
59
Production and Operational personnel’s involvement in risk

mitigation projects will:
a) contribute to the Management’s Production-Protection

dilemma
b) result in Under Protection of operational processes
c) promote their participation in developing Protection
provisions
d) result in over Protection within Production processes
60
30
10/01/2017
Section 8:
Change Management
61
Change Management: What & Why?
All aviation systems, processes or equipment are

continually subject to changes
Changes are likely to impact existing hazards or

safety risk mitigation strategies of the affected
system
Process for management of change must therefore

include the review of safety risk mitigation strategies
62
31
10/01/2017
Management of Change
The procedure for managing change to aviation safety related
processes should include:
evaluation of previous or existing hazard identification and risk

mitigation records of the affected process/ equipment, where
available.
an initial hazard identification and risk mitigation project to be
performed for the affected process/ equipment, if none is
available.
Documentation of such Change Management related hazard
identification and risk mitigation review outcomes.
Note: More information on MoC in Module 3.
63
Change Management – Quiz
Change management in the context of safety management

pertains to:
a) the review of safety strategies before the introduction of

new equipment
b) the possibility of new hazards being introduced by changes
to an existing operational process.
c) The possibility of existing defences or recovery measures
becoming irrelevant from modification to an installation
d) All of above
64
32
10/01/2017
Change Management – Quiz
The process of Change management in the context of a SMS

is primarily concerned with the review and continuing validity of
the affected equipment/ system/ process’ hazard identification
and risk mitigation status:
a) TRUE
b) FALSE
65
Section 9:
Integration of management systems
66
33
10/01/2017
Typical management systems
Quality management system (QMS)

Environment management system (EMS)
Occupational health and safety management system
(OHSMS)
Safety management system (SMS)
Inventory management system (IMS), etc
67
Benefits of integration
reduction of duplication and therefore of costs;

reduction of overall organizational risks and an increase in
profitability;
balance of potentially conflicting objectives; and
elimination of potentially conflicting responsibilities and
relationships.
68
34
10/01/2017
SMS & QMS Integration

From a safety management perspective, it is important for
organizations to recognize the pertinent correlation between
its safety management system and other systems such as its
quality management system, etc.
It is particularly important that an organization’s safety

management system (SMS) should be properly integrated
with its quality management system (QMS). This subject is
further elaborated in the SMS module.
69
Integration of Management Systems – Quiz
Benefits of integrating certain management systems may

include:
a) balancing potentially conflicting objectives

b) promotion of internal safety information sharing
c) better efficiency and productivity
d) All of above
70
35
10/01/2017
The following job title is an indication of management systems

integration:
a) Workshops Manager
b) Finance Manager
c) Production Manager
d) Quality & Safety Manager
71
In the context of a SMS, integration is crucial between:
a) QMS & Inventory Mgmt Sys

b) OSHE & QMS
c) Environmental Mgmt Sys & Inventory Mgmt Sys
d) SMS & QMS
72
36
10/01/2017
Module 1: Sections 1-9 completion

1 Concept of safety
2 Evolution of safety
3 Accident causation
4 People, context and safety
5 Error & violation
6 Safety culture
7 The management dilemma
8 Change management
9 Integration of management systems
10 Safety reporting & investigation
11 Safety data collection, analysis & SPIs
12 Hazard identification & risk mitigation
13 Prescriptive & performance based requirements
73
Section 10:
Safety reporting and investigation
74
37
10/01/2017
Safety reporting systems
Accident reporting (A13)

Mandatory incident reporting (A19-2, 5.1.2)
Voluntary hazard/ incident / self-disclosure reporting
(A19-2, 5.1.3)
75
Accident reporting (A13)
Aviation system accidents is the highest consequence

occurrence and must be reported to the CAA, its independent
investigation authority as well as ICAO. [Annex 13]
76
38
10/01/2017
Mandatory incident reporting (A19-2, 5.1.2)
These are the types of serious incidents (apart from

accidents) which a CAA will define as reportable
(mandatory basis) by service providers to the CAA.
Such reports may also be required by the CAA to be

submitted to relevant organizations such as the State of
Design & Manufacturing as well as ICAO.
77
Voluntary hazard/ incident / self-disclosure

reporting (A19-2, 5.1.3)
Voluntary (non mandatory) reporting system.

Capture hazards, threats, unsafe situations, self
disclosures (errors/ violations)
Safety information otherwise not within purview of a
mandatory reporting system
Note:
A19-2, 5.1.3 has changed the term “voluntary incident
reporting” to “voluntary safety reporting”.
78
39
10/01/2017
Effective safety reporting – pre-requisites

Information Flexibility
People can adjust, when

People are knowledgeable about the human, technical and facing unusual circumstances,
organizational factors that determine effective safety reporting. shifting from the established to
a direct mode thus allowing
Willingness information to quickly reach
the appropriate decision-
People are willing to making level.
report their errors and
Effective safety
experiences.
reporting
Learning
People have the competence
to draw conclusions from
Accountability safety reporting and implement
People are encouraged to report essential safety-related information. appropriate reforms.
However, there is a clear line that differentiates between acceptable and
unacceptable behaviour.
79
Investigation of accidents & incidents
Purpose:
establish cause, events and contributing factors to an

occurrence
assess whether safety defenses may have been
compromised
Identify corrective actions to prevent recurrence
Identify hazards which may be uncovered during
investigation process
80
40
10/01/2017
Integration of safety investigation

& HIRM process
Occurrence investigation may uncover hazards, threats or

latent conditions
Such hazards, threats or latent conditions may need follow

up risk mitigation
Integrate occurrence investigation process with HIRM

process as appropriate (details in M3-S12)
81
Safety reporting and investigation – Quiz
Select the valid reporting system:
a) Voluntary mandatory reporting

b) Voluntary accident reporting
c) Mandatory hazard reporting
d) Voluntary hazard/ incident reporting
82
41
10/01/2017
A voluntary safety reporting system is essentially meant for

reporting:
a) Accidents only
b) Hazards only
c) Mandatory occurrences only
d) Hazards, threats, latent conditions, incidents, errors or
mistakes
83
Hazards, threats or unsafe situations uncovered in the

process of incident/ accident notification or investigation
should be:
a) ignored if they are not directly relevant to the incident/

accident
b) annotated in the occurrence notification/ investigation
report for information only
c) captured in the occurrence notification/ investigation
report and duly integrated with the organization’s HIRM
process.
84
42
10/01/2017
Section 11:
Safety data collection & analysis
85
Safety data quality
Validity
Completeness
Consistency
Accessibility
Timeliness
Security
Accuracy
86
43
10/01/2017
Safety data types
accident investigation data;

mandatory incident investigation data;
voluntary reporting data;
continuing airworthiness reporting data;
operational performance monitoring data;
audit findings/reports;
safety studies/reviews; and
safety data from other States or regional
organizations , etc.
87
Safety data analysis
assist in deciding what additional information are

needed;
ascertain latent conditions underlying safety
deficiencies;
assist in reaching valid conclusions;
monitor and measure safety trends or performance.
88
44
10/01/2017
Analytical methods and tools
a) Statistical analysis
b) Trend analysis
c) Normative comparisons
d) Simulation and testing
e) Expert panel/ group
f) Cost-benefit analysis
89
Safety information system requirements
a) include a user-friendly interface for data entry and query;

b) have the capability to transform large amounts of safety
data into useful information that supports decision
making;
c) reduce the workload for managers and safety personnel;
and
d) operate at a relatively low cost.
90
45
10/01/2017
Features of database system
a) log safety events under various categories;

b) compile analyses, charts and reports;
c) capability to check individual reports;
d) allow safety data sharing with other organizations;
e) monitor individual report status or closure, etc
91
Considerations for protection of safety data
a) Information accessibility;
b) Safety management requirements;
c) Disciplinary/ enforcement requirements;
d) De-identification or confidentiality requirements;
e) Security of information systems; and
f) Safety information sharing and exchange.
92
46
10/01/2017
Safety performance indicators (SPIs)
Num ber of reportable

5.00 << Fig 1:
(M OR) incidents
4.00
3.00 Basic data chart
2.00
1.00
0.00
40
00
20
30
-3 0
A3
A3
7-4
A3
37
74
B7
Beta Airline — Year 2009
0.80
0.70
0.60
0.50
0.40
0.30
Fig 2:>> 0.20
0.10
Continuous 0.00
monitoring chart Jan Feb Mar Apr May June July Aug Sept Oct Nov Dec
2009 Alpha Airline monthly reportable

incident rate (per 1 000 FH)
93
SPI Chart - with safety performance markers
5.00
0.80
0.70
^ Fig 3:
Number of reportable
0.60
(MOR) incidents
4.00
SPI with Alert & Target

0.50
3.00
0.40
2.00
0.30
1.00 0.20
0.00 0.10
0.00
settings >>> SPI-ALosP

00
40
20
0
0
40
33
-3
A3
A3
A
7-
37
74
Jan Feb Mar Apr May June July Aug Sept Oct Nov Dec
B7
Beta Airlin e — Year 2 009 2009 Alpha Airline monthly reportable

incident rate (per 1 000 FH)
>details in M3-S15
94
47
10/01/2017
Purpose of Safety Data Analysis & SPIs
The essential purpose of a safety database is to support

the development of safety performance indicators in order
to measure and monitor the service provider organization
or aviation system’s safety performance
95
Safety data collection & analysis – Quiz
A service provider organization’s safety database should

include safety information such as:
a) Global accident investigation reports

b) Voluntary safety reports received from its own personnel
c) Mandatory reports submitted to the CAA by the organization
d) (b) & (c)
96
48
10/01/2017
A regulatory (CAA) organization’s safety database(s) should

include the following safety information:
a) Mandatory incident reports received from all service

providers of its aviation system
b) Global accident reports
c) Voluntary safety reports received from any service provider
or individuals within its aviation system
d) (a) & (c)
97
The essential purpose of a SMS/ SSP safety database is to

enable the development of Safety Performance Indicators to
measure and monitor safety performance:
a) TRUE
b) FALSE
98
49
10/01/2017
Section 12: Hazard identification & risk mitigation
99
Hazard definition
Hazard is a condition or an object with the potential to

cause death, injuries to personnel, damage to equipment
or structures, loss of material, or reduction of the ability to
perform a prescribed function
-SMM 2.13.2
100
50
10/01/2017
HAZARD, Unsafe Event & Consequence -

correlation
Unsafe Ultimate
Hazard
Event Consequence
101
Hazards, Threats & Unsafe Situations
102
51
10/01/2017
Hazard identification methodologies
Methodologies:
Reactive - analysis of past outcomes or events
Proactive - existing or real-time operational situations
103
Hazard identification
Hazards can be identified from:

• Accident/ incident investigation reports (Reactive)
• Audit, inspection or survey reports (Proactive)
• Voluntary hazard/ incident reports (Proactive)
• Operational data monitoring systems, etc (Proactive)
Differentiate between:
• Hazards & Threats
• Temporary & Permanent hazards
Corrective action & systematic SRM action
104
52
10/01/2017
Identify Hazards, Top Events & Consequences – 3 Approaches
UC-1 2. Identify H-1 UC-1
TE-1 Hazards &

UC-2 Consequences H-2 TE-1 UC-2
from a Top
H-3 UC-3
H-1 UC-3 Event
UC-4
H-1
TE-2
TE-1
UC-5
H-2
1. Identify Top
UC-1
Events & 3. Identify Top
H-3
Consequences Events &
from a Hazard Hazards from a TE-2
Consequence H-4
105
Hazard Escalation/ Transformation
- MRO sector
Airline
Hangar MRO
Engine MRO
Component MRO
106
53
10/01/2017
Hazard Escalation/ Transformation [HIRM W/sht 11(a)

Define H>US>C in C UE H Comp C UE H AIS
your own
operational
context - within C UE H Engine C UE H CNS
the aviation
system
C UE H Aircraft C UE H ATM
DMO H UE C C UE H ANSP
ATO H UE C H UE UC C UE H SAR-FF
OPS
AMO H UE C C UE H AGA
Line
C UE H C UE H Ground Control
Maint
- all C UE H
Hangar
Maint
C UE H Ground services
sectors C UE H
Engine
C UE H Fuel Suppliers
Maint
Comp Cargo /
C UE H C UE H
Maint DG handling
Details in M-4
107
Hazard and Risk Management database

Sheet 11 Hazard & Risk Management Database (Register) 22Sep16 <<<
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Hazard Registration SRM Project Registration*
Hazard [H] / Threat [T] Recommended Action SRM Project Assignment SRM Project Completion
Area/ Unsafe-Event [UE] Consequence [C]
Item
Operation/ Generic Hazard/ (Reported / (Reported / Corrective SRM SRM Priority Date Existing RI & Resultant RI & Next
Source of Specific Hazard/ Hazard Project Date
Equipment Threat Projected)* Projected)* Action* Action* Level* Dept / Sect Completed Tolerability Tolerability Review
Information* Threat* ID Code I/C Activated
(Original Report) [Yes/ No] [Yes / No] (H, M, L) / Rpt Ref (UE/UC) (UE/UC) Date
A320 aircraft Cabin crew reported one Inflight [H] - Rats OPS- Nil Projected - Aircraft No Yes Medium A320 ABC
operation. large rat sighted in incident infestation of ALPHA- wiring/ equipment Operations
Example
aircraft rear galley area notification A320 aircraft H1-M- damage by rats.
during cruise. report ref: 013
A320/ OPS/
012/ 2005.
1
2
3
Hazard ID Code:
Sector (1) - Organization (2) - Hazard No (3) - Priority Level (4) - Year (5)
1 Sector: AGA / ANS / OPS / DMO / AMO / MDO* (*MDO - Materials Distribution Organizations, including fuel distribution)
2 Organization: Five letters code (eg ALPHA - Alpha Airline)
3 Hazard No: Hazard number (eg H001) as assigned by the organization concerned within a given Year.
4 Priority Level: Hazard prioritization Level [High (Accident), Medium (Serious Incident), Low (Incident)].
5 Year: Year when the Hazard was registered in the organization's Hazard Register.
Hazard ID Code Illustration:
a) OPS-ALPHA-H001-M-013 [Air Operations - Alpha Airline - Hazard #1 - Moderate Priority - Year 2013]
b) AGA-GATB-H005-L-012 [Aerodrome - Timbaktu Airport - Hazard #5 - Low Priority - Year 2012]
*Explanatory Notes:
1 Source of Information: Hazard information as may be extracted from - Voluntary Hazard Rpt, Occurrence Notification/ Investigation Rpt, Internal Audit Rpt, External Audit Rpt, Hazard Survey Rpt, Operational Data Review Rpt
2 Specific Hazard/ Threat: If more than one Hazard/ Threat identified, register such additional Hazard/ Threat under new row/ item
3 Reported/ Projected (UE/ C): Annotate UE/ C description as a "Reported" occurrence or a "Projected" occurrence. If multiple H>UE>C combinations involved, register each combination under a new Row (Each single H>UE>C
combination will constitute one potential SRM Task)
4 Corrective Action: If the Hazard can be effectively eliminated through conventional corrective action (eg disposal, repair, replacement, modification), annotate YES with the action taken/ recommended. Otherwise annotate NO.
5 SRM Action: Annotate YES to indicate systematic SRM action is recommended (or has been taken already). Annotate NO if systematic SRM action is not recommended (or not necessary).
6 Priority Level: SRM or Corrective Action Priority Level based on (Annex 13) occurrence category of the projected (or reported) Unsafe Event or Consequence. Accident - High; Serious Incident - Medium; Incident - Low.
7 SRM Project Registration: This column for registration of assigned (new) SRM project, or a previously completed SRM project (with respect to the specific H>UE>C thread).
>Details in M3-S9 & M4 HIRM Wsht-11

108
54
10/01/2017
Distinguishing Aviation and OSHE hazards
Aviation hazard:
eg - Birds in vicinity of aerodrome
OSHE hazard:
eg - Persistent hydraulic fluid exposure within a workshop
Aviation + OSHE (Compound) hazard:

eg - Lightning activity around aircraft transit gates
Note: Generic Hazard examples in >>> 1_Hazard Taxonomy examples
109
Hazard prioritization
Initial source/ location categorization

Prioritization by severity of projected consequence
Prioritization by severity & likelihood of projected
consequence
Note: More information in M3-S9 & M4
110
55
10/01/2017
Safety risks
Definition:
Safety risk is the predicted probability and severity of the

consequences or outcomes of a hazard
– Annex 19-2
111
Safety risk probability
112
56
10/01/2017
Safety risk severity
113
Safety risk index
Severity
Likelihood
1. Insignificant 2. Minor 3. Moderate 4. Major 5. Catastrophic
A.
(exceptional/ Negligible (1A) Negligible (2A) Low (3A) Low (4A) Moderate (5A)
impossible)
B.
(unlikely/ Negligible (1B) Low (2B) Low (3B) Moderate (4B) Moderate (5B)
improbable)
C.
Low (1C) Low (2C) Moderate (3C) Moderate (4C) High (5C)
(possible/
D.
(likely/ Low (1D) Moderate (2D) Moderate (3D) High (4D) Extreme (5D)
occasional)
E.
Moderate (1E) Moderate (2E) High (3E) Extreme (4E) Extreme (5E)
(certain/
114
57
10/01/2017
Safety risk tolerability
Risk Index Risk Tolerability

5D, 5E, 4E - Extreme
STOP OPERATION OR PROCESS IMMEDIATELY.…
Risk
5C, 4D, 3E - High Risk WARNING.
Ensure that risk assessment has been satisfactorily
completed and declared preventive controls are in place.
5A, 5B, 4B, 4C, 3C, 3D, CAUTION.
2D, 2E, 1E - Moderate Perform or review risk mitigation as necessary.
Risk Departmental approval of risk assessment required.
4A, 3A, 3B, 2B, 2C, 1C, REVIEW.
1D - Low Risk Risk mitigation or review is optional.
2A, 1A, 1B - NO ACTION REQUIRED.
Negligible Risk Acceptable as is. No formal risk mitigation required.
115
Safety risk mitigation (SRM)

The safety risk is
unacceptable as
Intolerable region it currently
stands
As The safety risk is

Low Tolerable region acceptable
As subject to
adequate
Reasonably mitigation.
Practicable
Acceptable
region The safety risk is
acceptable as it
stands
116
58
10/01/2017
Risk mitigation documentation (basic) – H>UC/UE
Existing
Existing Risk Existing New Preventive Resultant Risk Resultant
Preventive
Index Tolerability Controls Index Tolerability
Controls
Ultimate Consequence
Existing
Hazard Description
New Preventive
Preventive Control
OR Unsafe Event
Controls
No 1
Existing
New Preventive
Preventive Control
Controls
No 2
Existing
New Preventive
Preventive Control
Controls
No 3
117
Risk mitigation documentation (basic): H>US>UC

Ultimate
Existing New Existing Consequence
Existing RI & New RI & Unsafe Existing RI & New Recovery New RI &
Hazard Preventive Preventive Recovery
Tolerability Tolerability Situation Tolerability Measures Tolerability
Controls Controls Measures
Possible Weekly FOD Likelihood: 4 To increase Likelihood: 3 Undetecte Procedure Likelihood: 4 To install Safety risk Aircraft,
foreign runway Severity: B runway Severity: B d FOD on available to act Severity: B automatic index: 1B engine or tyre
objects inspection Safety risk inspection to Safety risk operating on pilots’ report Safety risk Runway FOD damage due to
debris on program index: 4B daily index: 3B runway of FOD sightings index: 4B detection and Safety risk foreign
the runway program on runway warning system tolerability: objects on
Aerodrome runway during
operations Aerodrome Acceptable take-off.
Safety risk Safety risk Safety risk
manual operations
tolerability: tolerability: Risk tolerability:
section 4.2.1 manual section
control/mitigatio
4.2.5
Unacceptable n requires Unacceptable
under the management under the
existing decision existing
circumstances circumstances
118
59
10/01/2017
Risk mitigation documentation (advance)

Table A Hazard Identification & Risk Mitigation (HIRM) Worksheet [Risk mitigation illustration] Jun16 Sht 13
1. AREA/ OPERATION/ EQUIPMENT: Pest control within A320 aircraft fuselage/ cabin.
2. HAZARD / THREAT [H/T]: Rat (s) infestation within an operational A320 aircraft fuselage/ cabin Hazard Code: OPS-ALPHA-H1-L2-013
3. UNSAFE EVENT [UE]: Rat (s) infestation confirmed through rat sightings or evidence of aircraft wiring damage by roden activities.
4. ULTIMATE CONSEQUENCE [UC]: Multiple aircraft system(s) failure or malfunction (due to electrical wiring damage by rats).
Table B
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Unsafe Event Mitigation (as applicable) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Ultimate Consequence Mitigation (as applicable) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Hazard / Threat
Consequence
Unsafe Event
Existing Resultant Existing Resultant
Existing Preventive Controls [E-PC] New Preventive Controls [N-PC] Existing Recovery Measures [E-RM] New Recovery Measures [N-RM]
Ultimate
RI & T RI & T RI & T RI & T
1. Emergency
1. Emergency
1. Emergency
1. Emergency
8. Personnel
8. Personnel
8. Personnel
8. Personnel
3. Abnormal
3. Abnormal
3. Abnormal
3. Abnormal
Control [EC]
Control [EC]
Control [EC]
Control [EC]
Factor [EF]
Factor [EF]
Factor [EF]
Factor [EF]
Risk Level
Risk Level
Risk Level
Risk Level
Procedure
Escalation
Procedure
Escalation
Procedure
Escalation
Procedure
Escalation
10. Others
Severity x
10. Others
Severity x
10. Others
Severity x
10. Others
Severity x
2. Backup
Procedure
Escalation
2. Backup
Procedure
Escalation
2. Backup
Procedure
Escalation
2. Backup
Procedure
Escalation
Likelihood
Likelihood
Likelihood
Likelihood
5. Special
5. Special
5. Special
5. Special
9. TRNG
9. TRNG
9. TRNG
9. TRNG
Approval
Approval
Approval
Approval
System
System
System
System
7. Process
7. Process
7. Process
7. Process
4. SOP
4. SOP
4. SOP
4. SOP
6. GM
6. GM
6. GM
6. GM
Inspn
Inspn
Inspn
Inspn
Approval
Approval
Approval
Approval
Multiple aircraft system(s) failure or

malfunction (due to electrical wiring
E-
operational A320 aircraft fuselage/
rat droppings within aircraft cabin.

Actual rat sightings or evidence of
EF>E- EC1>EF N- EF>N- EC>EF> E- EF>E- EC>EF> N- EF>N- EC>EF>
PC
Rat (s) infestation within an
PC1 >E-PC1 PC1 PC1 N-PC1 RM1 RM1 E-RM1 RM1 RM1 N-RM1
1
R3 - Moderate Risk
R3 - Moderate Risk
R3 - Moderate Risk
damage by rats).
R2 - High Risk
EF>E- EC>EF- N- EF>N- EC>EF> EF>E- EC>EF> N- EF>N- EC>EF>
PC2 F-PC2 PC2 PC2 N-PC2 RM2 E-RM2 RM2 RM2 N-RM2
cabin
2E 2D 3E 3C
EF>E- EC>EF> EF>N- EC>EF> EF>E- EC>EF> EF>N- EC>EF>
PC3 E-PC3 PC3 N-PC3 RM3 E-RM3 RM3 N-RM3
EF>E- EC>EF> EF>N- EC>EF> EF>E- EC>EF> EF>N- EC>EF>

PC4 E-PC4 PC4 N-PC4 RM4 E-RM4 RM4 N-RM4
Description of Existing Preventive Controls [E-PC] Description of New Preventive Controls [N-PC] Description of Existing Recovery Measures [E-RM] Description of New Recovery Measures [N-RM]
E-PC1: Flight, cabin and maintenance personnel are normally N-PC1: SOP to be put in place to require flight crew and E-RM1: Any operational aircraft reported with rat sighting is N-RM1: Special Inspection sheet (Ref SI/ A320/ 25/ 112) has been
expected to report any rat sightings within an aircraft. maintenance personnel to report rats sighting within aircraft normally subjected to a cabin inspection by maintenance raised to require any operational aircraft with reported sighting or
cabin. personnel during stayover check. evidence of rats infestation to be scheduled for de-infestation
action by approved Pest Controller upon aircraft return to main
base.
EF>E-PC1: No documented procedure/ instruction for such N-PC2: SOP to be put in place to require that all aircraft N-RM2: A routine "C" Check Maintenance Job Card has been raised
reporting expectation. fuselage doors to be closed or sealed during silent hours, to call for inspection of all opened aircraft internal fuselage
especially when undergoing hangar maintenance checks. compartments for evidence of rat droppings and necessary follow
up action. Ref: MJC-1C-53-45; SI/ A320/ 25/ 112.
EF>N-PC2: There may be occasions where fuselage doors

cannot be closed due to their being removed or dismantled
for maintenance.
EC>EF>N-PC2: For such cases, aircraft maintenance steps

leading to such doors shall be removed or backed-off from
the door by at least 3 feet, during silent hours. <<<
>details in M3 & M4
>>> 2_HIRM Wsht CBSV
119
Human factors and risk mitigation
Risk mitigation process may require HF analysis support
SRM procedure should address circumstances when HF

analysis is appropriate
Assessment of hazards and defenses involving complex

human to system interfaces should consider HF (SHELL)
analysis
120
60
10/01/2017
Risk mitigation and CBA
High impact risk mitigation projects may require cost &

benefits analysis (CBA)
SRM procedure should address circumstances when

CBA is necessary
Mitigating actions involving major organizational change

or financial impact should consider CBA
121
Hazard identification & risk mitigation – Quiz
To a pilot, an unstable approach due to bad weather during his

aircraft landing phase may be deemed to be:
a) A hazard
b) An unsafe event/ situation
c) An ultimate consequence
d) A latent condition
122
61
10/01/2017
The essential purpose of hazard identification is to ensure that

those hazards which cannot be eliminated through
conventional corrective actions may be followed up with a
systematic risk mitigation process:
a) TRUE
b) FALSE
123
Hazards which have potential aviation safety as well as

OSHE consequences:
a) Should be totally ignored by aviation SMS personnel

b) May be managed in conjunction with the organization’s
certified OSHE inspectors
c) Can be managed by the organization’s certified OSHE
inspectors only
d) Must be managed by aviation SMS personnel only.
124
62
10/01/2017
Safety risk index refers to the:
a) severity value of a hazard

b) severity and likelihood values of a hazard
c) severity and likelihood values of a consequence
d) likelihood value of an unsafe event.
125
Hazard identification & risk mitigation – Quiz 6
The purpose of safety risk mitigation is to drive the risk index

of a projected consequence:
a) towards the intolerable region

b) towards the tolerable region
c) to as low as reasonably practicable
d) To the unacceptable region
126
63
10/01/2017

The purpose of documenting each completed safety risk
mitigation project is to:
a) Serve as a record of its accomplishment

b) Facilitate future review of the identified hazard and its
mitigating actions
c) Evidence of the organization’s due diligence in addressing
the identified hazard.
d) All of above
127
Section 13: Prescriptive & performance based

requirements
128
64
10/01/2017
Understanding performance-based requirements
Prescription-based Performance-based
Prescriptivvironment
environment environment
Regulations as Requirements as
prescribed controls safety risk controls
Rigid regulatory Dynamic
framework requirements
Reactive occurrence Proactive HIRM
investigations Safety performance
Compliance audits monitoring
Foundational Supplementary
129
Prerequisites for performance-based requirements
SSP and SMS frameworks in place

Process for agreement on system’s safety
performance markers/ levels
Process for continuous regulatory monitoring
130
65
10/01/2017
Baseline & Equivalent level of safety
An equivalent or better safety performance level is

expected with performance based requirements
when compared with the baseline safety performance
level of a prescriptive environment.
Performance-based requirements should be

measured and monitored through appropriate SPIs
131
Performance-based monitoring and measurement
Use data-based safety/ quality performance

indicators
Set SPI alert and target levels as performance markers
where applicable
Aggregate the package SPIs’ performance, where
appropriate
132
66
10/01/2017
Auditing performance-based requirements
Inspector awareness of performance based requirements

and expectations
More interaction, monitoring and collaboration (between
regulator and service providers)
Assessment of the system and related processes for
Effectiveness, apart from compliance (PSOE)
133
Prescriptive & performance based requirements – Quiz
Performance based regulations or requirements are meant to:
a) replace conventional prescriptive regulations

b) complement conventional prescriptive regulations
c) deregulate the aviation industry
d) prevent unhealthy competition amongst service providers
134
67
10/01/2017
The introduction of SMS requirements for service providers is:
a) a prescriptive regulation
b) a performance based requirement
c) to replace service providers’ quality management systems
d) b & c are correct
135
SPIs is associated with performance based requirements

because it:
a) is a data based process to facilitate monitoring of a

system’s safety performance
b) allows the service provider to define its own SPIs
c) allows the service provider to set its own safety
performance markers
d) all of above
136
68
10/01/2017
Module 1: Safety Management Fundamentals
137
Congratulations for completing Module 1:

Safety Management Fundamentals
You are now able to describe and explain the

fundamental safety management concepts and
principles addressed in SMM Doc 9859 (3rd Ed,
2013).
138
69

Module 1 - Safety Management Fundamental

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Module 1 - Safety Management Fundamental

Încărcat de

Drepturi de autor:

Formate disponibile

10/01/2017

Module 1: Safety Management Fundamentals

Provide participants with the knowledge on fundamental

At the end of this module, you will be able to describe

Considering the facts

The state in which risks associated with aviation

- Annex 19 (2nd ed, Jul 2016)

The concept of safety – Quiz

The concept and definition of safety in Annex 19 is -

a) The total elimination of accidents and serious incidents

The evolution of safety thinking

1950s 1970s 1990s 2000s

Source: James Reason

Evolution of safety – Quiz

The focus of today’s safety management approach should be

The concept of accident causation

Accidents due to combination of inadequate defences(D), active failures(P),

Bow-Tie Accident Causation Model

Practical drift & Accident causation

System Baseline performance

Accident causation – Quiz

Which of the following can contribute to accidents?:

a) Active failures by operational personnel

Accident causation – Quiz

The concept of practical drift involves:

a) The deviation of a system or equipment from its

The SHEL(L) model

Understanding the relationship between people and operational

The SHEL(L) model

The SHELL Model is a conceptual tool used to analyse the

Software (S): procedures, training, support, etc.;

Hardware (H): machines and equipment;

Environment (E): the working environment in which

Liveware (L): humans in the workplace.

The SHEL(L) model

According to the SHELL Model, a mismatch between the

Thus, these interactions must be assessed and considered in all

This is especially so with regard to the assessment of contributing

People, Context and safety – Quiz

Human performance is likely to be compromised by a mismatch

People, Context and safety – Quiz

In the SHELL Human performance model, the “Environment”

Error & Violation - Definitions

Two categories of Error

1. Slips and lapses

Three types of safety strategies to control errors

Error reduction strategies

Error capturing strategies

Error tolerance strategies

There are 3 categories of violations which may not amount to

Three categories of violations

o Routine violations - become the normal way of doing business within

Organizationally induced violations - may be considered as an

Error & Violation – Quiz

An “Error” is intentional whilst a “Violation” is unintentional::

Error & Violation – Quiz

An organization’s enforcement or disciplinary procedures

Error & Violation – Quiz

Safety strategies to control errors:

a) Are likely to prevent violations as well

What is safety culture?

Safety culture is characterized by the safety-related beliefs,

Three influencing components