International Civil Aviation Organization

STATE SAFETY PROGRAME (SSP)

SAFETY MANAGEMENT SYSTEM (SMS)

Mexico City, June 2013

Outline

1. Introduction 2. SSP 3. SMs 4. Annex 13, requirements 5. Managing Safety Performance 6. Safety Management Process 7. Occurrence Classification

The first ultra-safe industrial system

Ultra-safe system (mid 1990’s onwards) Business management approach to safety (SMS) Routine collection and analysis of operational data

10-3

10-5

10-7

Fragile system (1920’s -1970’s) Individual risk management & intensive training Accident investigation

Safe system (1970’s – mid 1990’s) Technology & regulations Incident investigation

Global Aviation Safety Roadmap - GASR

• There is no ATM / ATC technology that directly addresses safety management. However, ATC can contribute to enhance safety

• Implementation of technologies upon specific ATM requirements

• Improve safety Education and Training programmes

SMS SARPs – Applicability Roadmap

Safety Management SARPs for Service Providers Annex Intended Audience Denomination Date Applicable

11 Air traffic services providers

Safety Management Programme

Nov, 2001

14 Certified Aerodromes Safety Management Programme

Nov, 2001

2005 – Harmonization of Safety Management SARPs 6, 11 and 14 A/C Operators & AMOs SMS Jan, 2009

2008 – 2nd Harmonization of Safety Management SARPs 1 Training Organizations SMS Nov, 2010 8 Manufacturers SMS Nov, 2013

1, 6, 11, 14 SMS Framework Nov, 2010

Safety Management SARPs for States Annex States Denomination Date Applicable

2005 – Harmonization of Safety Management SARPs 6, 11 and 14 States Safety Programme Nov, 2006

2008 – 2nd Harmonization of Safety Management SARPs 1, 8 and 13 States SSP Nov, 2010

1, 6, 8, 11, 13, 14 States SSP Framework * Nov, 2010 *Attachment

OPERATIONAL FLEXIBILITY DIFFICULT BECAUSE OF BUDGET MECHANISMS

BUDGETS REFLECT STRATEGIES

ANALYSES INTERNAL & EXTERNAL FACTORS AS IMPACT ON OPERATIONS

INTERNAL & EXTERNAL FACTORS TRIGGERS STRATEGIC THINKING

PROGRAMME & CLIENT EMPHASIS NOT ALWAYS CLEAR

CLEAR CHOICES MADE ON PROGRAMME & CLIENT PRIORITIES

DELIVERABLES ARE PROSCRIPTIVE AND USEABILITY IS DIFFICULT

DELIVERABLES ARE CONCISE, PRACTICAL & INCORPORATE PERFORMANCE MONITORING

POSITIONING OF THE ORGANIZATION IN THE “PUBLIC PLACE” NOT EVIDENT

DEFINES THE STRATEGIC POSITIONING OF PROGRAMMES, SERVICES & CLIENTS IN THE “PUBLIC PLACE”

TRADITIONAL STRATEGIC PLANNING

PERFORMANCE BUSINESS PLANNING APPROACH

vs

Collect Data

Re-evaluate Situation

Implement Strategies

Assign Responsibilities

Approve Strategies

Collect Additional Data

Develop Strategies

Prioritize Unsafe Conditions

Analyze Data

Safety Management

Process

Safety Management Process

STATE SAFETY PROGRAMME (SSP)

States shall require, as part of their SSP, that an ATS provider implement a safety management system acceptable to the State , as a minimum: a) identifies safety hazards;

b) ensures that remedial action necessary to maintain safety performance is implemented;

c) provides for continuous monitoring and regular assessment of the safety performance; and

d) aims at a continuous improvement of the overall performance of the safety management system.

A SMS shall clearly define lines of safety accountability throughout the air traffic services provider, including a direct accountability for safety on the part of senior management

Annex 11 Provisions (2)

• States shall establish a SSP, in order to achieve an acceptable level of safety in civil aviation – SMM, Doc 9859

• States shall require that an ATS provider implement a SMS acceptable to the State that: – a) identifies safety hazards;

– b) ensures the implementation of remedial action necessary to maintain

agreed safety performance;

– c) provides for continuous monitoring and regular assessment of the safety performance; and

– d) aims at a continuous improvement of the overall performance of the safety management system.

WHY Performance Driven ?

• Performance Based Approach is based on the following three principles: – Strong focus on desired/required results. – Informed decision making, driven by the

desired/required results. – Reliance on facts and data for decision

making.

Strong focus on desired/required results

• In stead of prescribing solutions, desired/required performance is specified.

• Management attention is shifted from a resource and solution centric view (how will we do it) towards a primary focus on desired/required (performance) results (what is the outcome we are expected to achieve).

• This implies finding out – what the current performance situation is, – what the most appropriate results should be, – clarifying who is accountable for achieving those results.

Performance-Based System

Ecological – The world as it is • Aviation system – as pre-specified – is imperfect • Performance based • Process oriented Safety data captured from daily, normal operations

Deterministic – The world as it should be Aviation system – as pre-specified – is perfect Compliance based Outcome oriented Accident/serious incident investigation

Performance-Based Safety: The ABC

A. Senior management’s commitment to the management of safety

B. Initial analysis of system design and risk controls (safety risk management)

C. Continuous safety monitoring and analysis of safety data from normal operations (safety assurance)

Operational drift

Managing Safety Performance

Operational deployment

System design

Operational drift

Baseline performance

Safety Pyramid

Fatal Accidents

Reportable Occurrences

Serious Incidents

ICAO ADREP System (Annex 13)

Accidents

Incidents Additional Prevention

without any harmful consequence

Data collection and forecasting

Quantification of current/expected performance

Application of Performance Policy

Global categorization framework

Tim

e, lo

catio

n an

d st

akeh

olde

r spe

cific

What performance policy will focus on

Definition of Performance Policy

11 standard KPAs

Supporting Metrics

Performance Indicators

Performance Targets

Focus Areas

Instantiated Objectives

Generic Objectives

KPAs

When Where Who

What (specific definition of what will be improved)

What (less general)

What (very general)

Indicator Values

Data

Definitions and qualitative statements

Numbers with a context (time, location, etc.)

(data aggregation + indicator value calculation)

Performance Measurement Taxonomy

Linkage SSP - SMS

SMS • ANSPs Risk Management Process

SSP • CAA Safety Management = ALoSP

Linkage SSP - SMS

CNS

AGA

ATS

AIS

MET

SAR

QA

SMS Safety performance indicators / targets

Values associated with

• Accuracy

• Availability

• Integrity

• Continuity

Risk assessment

Risk probability

Risk severity

Catastroph

ic

A

Hazardou

s

B

Major

C

Minor

D

Negligibl

e

E

5 – Frequent 5A 5B 5C 5D 5E 4 – Occasional 4A 4B 4C 4D 4E 3 – Remote 3A 3B 3C 3D 3E 2 – Improbable 2A 2B 2C 2D 2E

1 – Extremely improbable 1A 1B 1C 1D 1E

Risk management

Intolerable region

Acceptable region The risk is acceptable

as it currently stands

The risk is unacceptable at any level

Tolerable region If the risk can be mitigated, it is acceptable. Cost benefit

analysis required.

As Low

Reasonably Practicable

As

Mayor

Mayor

Minor

ANS Deficiencies - GANDD

• translate into risks against safety of the international civil

aviation

– “U” priority = Urgent requirements having direct impact on

safety and requiring immediate corrective actions

– “A” priority = Top priority requirements necessary for air

navigation safety

– “B” priority = Intermediate requirements necessary for air

navigation regularity and efficiency

Annex 11 ATS Safety Assessment:

2.27.5 Any significant safety-related change to the ATC system, including implementation of a reduced separation minimum or a new procedure, shall only be effected after a safety assessment has demonstrated that an acceptable level of safety will be met and users have been consulted. When appropriate, the responsible authority shall ensure that adequate provision is made for post-implementation monitoring to verify that the defined level of safety continues to be met. Note — When, due to the nature of the change, the acceptable level of safety cannot be expressed in quantitative terms, the safety assessment may rely on operational judgment.

• RVSM = TLS of 5 x 10-9 fatal accidents /aircraft flight hour

Trails

Simulation

Flight validation / verification

PANS-ATM Safety Assessment

PANS-ATM Safety Assessment

Vertical Separation

25

Target Level of Safety (TLS)

• ICAO developed quantitative safety metric • Expressed in terms of fatal accidents per flight hour • Adopted by Regional Planning Groups • RMAs estimate safety risk against TLS using ICAO methodology • All RVSM implementations have taken place with estimates of safety risk

that were lower than the TLS • Post-implementation estimates of risk in some regions have exceeded

TLS • Risk estimates against TLS drive all important remedial actions to reduce

safety risk

• An estimate of risk expressed in fatal accidents per flight hour is not a measurement of actual safety

Accident Incident investigation

ICAO Requirements – Annex 13

State of occurrence or conducting investigation. Accident and serious incident

Notification Preliminary report (ADREP)

Final Report Data Report

State of Registry All aircraft Accident > 2,250 All aircraft

State of the Operator All aircraft Accident > 2,250 All aircraft

State of Design All aircraft Accident > 2,250 All aircraft

State of Manufacture All aircraft Accident > 2,250 All aircraft

ICAO >2,250 or turbojet

Accident > 2,250 > 5,700 Acc > 2,250 Inc > 5,700

Others (interests, fatalities, information)

Accident > 2,250 All aircraft

ICAO Requirements – Annex 13

1. State safety policy and objectives 1.1 State safety legislative framework 1.2 State safety responsibilities and accountabilities 1.3 Accident and incident investigation 1.4 Enforcement policy

2. State safety risk management 2.1 Safety requirements for service providers SMS 2.2 Agreement on service providers safety performance

3. State safety assurance 3.1 Safety oversight 3.2 Safety data collection, analysis and exchange 3.3 Safety data driven targeting of oversight on areas of greater concern or need

4. State safety promotion 4.1 Internal training, communication and dissemination of safety information 4.2 External training, communication and dissemination of safety information

ICAO State Safety Programme (SSP) Framework

ICAO Requirements - SSP

Why ECCAIRS ? Implements fully the ADREP taxonomy Contains full suite of tools to collect, analyze, and

exchange safety data Currently being used/evaluated by 53 States and 16

International Organizations representing all regions FREE for: - States - Int’l Organizations - Civil aviation related entities

Why ECCAIRS ?

ECCAIRS as an Enabler Supports culture

• Confidence to use the system • Trust in the information - Danger : loss of integrity • Respect the limitations - Danger : simplification

Measure a limited set of Safety Indicators HOWEVER, Does NOT set Safety Targets, does not

identify safety improvements

Suite of products providing: Data entry and retrieval Analysis Utilities System tools Data integration Data dissemination

Why ECCAIRS ?

ECCAIRS Usage

Incident

Investigation

Analysis Data entry

Initial Notification

As an investigation tool Can be used as a checklist. Contains most of the required topics of a final

report. Is able to support analysis and conclusions Includes safety recommendations

ECCAIRS Usage

Factual information example

Format • History of flight:

– Flight number – Type of operation – Last point of departure – Time of departure (local time or

UTC) – Point of intended landing. – Flight preparation – Description of the flight and

events leading to the accident, including reconstruction of the significant portion of the flight path, if appropriate.

– Location (latitude, longitude, elevation)

– Time of the accident (local time or UTC), whether day or night.

ECCAIRS

Chain of Events

Safety recommendations

Occurrence Classification

Class: According to severity

Category: Accident/incident types

Occurrence Classification

Accident Serious incident Incident Major incident Significant incident

Occurrence without safety effect Not determined

Occurrance…

• Identify the occurrence class – Controlled flight into terrain only marginally avoided. – Aborted take-offs on a closed or engaged runway, on a taxiway1

or unassigned runway. – Landings or attempted landings on a closed or engaged runway,

on a taxiway1 or unassigned runway. – Gross failures to achieve predicted performance during take-off

or initial climb. – Events requiring the emergency use of oxygen by the flight crew. – Multiple malfunctions of one or more aircraft systems seriously

affecting the operation of the aircraft. – Flight crew incapacitation in flight. – Fuel quantity requiring the declaration of an emergency by the

pilot.

Occurrence Categories

36 categories Representative of the occurrence More than one can be selected

List of categories

1. ADRM: Aerodrome 2. AMAN: Abrupt maneuvre 3. ARC: Abnormal runway contact 4. ATM: ATM/CNS 5. BIRD: Birdstrike 6. CABIN: Cabin safety events 7. CFIT: Controlled flight into terrain 8. CTOL: Collisions with obstacle (s) during take-off or landing 9. EXTL: External load occurrences 10. EVAC: Evacuation 11. F-NI: Fire/Smoke (non-impact) 12. F-POST: Fire/smoke (post-impact)

13. FUEL: Fuel related 14. GCOL: Ground collision 15. GTOW: Glider towing related events 16. ICE: Icing 17. LALT: Low altitude operations 18. LOC-G: Loss of control – ground 19. LOC-I: Loss of control – inflight 20. LOLI: Loss of lifting conditions en-route 21. MAC: AIRPROX/near miss/midair collsion 22. RAMP: Ground handling 23. RE: Runway excursion 24. RI-A: Runway incursion – animal

List of categories

25. RI-VAP: Runway incursion – vehicle, a/c or person 26. RI-O: Runway incursion – other 27. RI-VA: Runway incursion – vehicle or a/c 28. SCF-NP: System/component failure or malfunction (non-

powerplant) 29. SCF-PP: Powerplant failure or malfunction 30. SEC: Seurity related 31. TURB: Turbulence encounter 32. UIMC: Unintended flight in IMC 33. USOS: Undershoot/overshoot 34. WSTRW: Windshear or thunderstorm 35. OTHR: Other 36. UNK: Unknown or undetermined

List of categories

Delivering ALoS – Safety action plans

• Tools and means to deliver the safety targets of an SSP: 1. Regulations 2. Training 3. Technology

45

SMS implementation phases – Summary

PHASE I

Planning SMS Elements:

1.1; 1.2; 1.3 and 1.5 ; [and 1.4]

PHASE II

Implementation of reactive safety management

processes Elements: 2.1 and 2.2

PHASE III

Implementation of proactive and

predictive safety management

processes Elements: 2.1 and 2.2

PHASE IV

Implementation of operational safety

assurance Elements:

1.1; 3.1; 3.2 ;3.3 4.1 and 4.5

Timeline

Develop documentation – Element 1.5

Develop and establish means for safety communication – Element 4.2

Develop and deliver training – Element 4.1

46 14/06/11

System today

47

State Civil Aviation Authority

State Civil Aviation Authority

Safety

measurement

Capture

Storage

Service providers

Airport N° 1

Airport N° 2

Airport N° 3

Initial ALoS

48

State Civil Aviation Authority

State Civil Aviation Authority

Safety

measurement

Capture

Storage

Service providers

Airport N° 1

Airport N° 2

Airport N° 3

Initial ALoS

Initial ALoS

49

State Civil Aviation Authority

State Civil Aviation Authority

Protected safety

data

Capture

Storage

Process

Analysis

Service providers

Airport N° 1

Airport N° 2

Airport N° 3

Initial ALoS

Exchange of protected safety data

Safety data collection & processing system

Mature ALoS

50

State Civil Aviation Authority

State Civil Aviation Authority

Protected safety

data

Capture

Storage

Process

Analysis

Service providers

Airport N° 1

Airport N° 2

Airport N° 3

Initial ALoS

Exchange of protected safety data

Safety data collection & processing system

Summary

51

Set o

f act

ivitie

s Se

t of a

ctivi

ties

ATS Service provider

Aerodrome operator AMO Aircraft

operator N° 1

SSP (ALoS)

ATS Service provider

Aerodrome operator AMO

Aircraft operator N° 2

Training organization

SMS SMS SMS SMS SMS

State accepts and oversees individual service providers’ SMS

Safety performance

State accepts and oversees individual service providers’ SMS

State agrees and supervises individual service provider’s SMS safety performance

Safety performance Safety performance Safety performance Safety performance

Safety performance Safety performance Safety performance Safety performance Safety performance

Training organization

SMS SMS SMS SMS SMS

52