ICAO SMS Module #2 - Basic Safety Concepts 2008-11 (E)

Building an SMS
Safety Module 10
Phased approach to
Management SMS Implementation
System
Module N 2 Basic Module 8 Module 9
SMS planning SMS operation
safety concepts
Module 5 Module 6 Module 7
Risks SMS regulation Introduction to SMS
Module 1 Module 2 Module 3

Introduction Module 4
SMS course Basic safety to safety
introduction concepts Hazards
management
Revision N 11 ICAO Safety Management Systems (SMS) Course 29/09/08 Module N 2 ICAO Safety Management Systems (SMS) Course 2
Objective Outline
Concept of safety
At the end of this module, participants will be able to
The evolution of safety thinking
explain the strengths and weaknesses of traditional A concept of accident causation Reason model
The organizational accident
methods to manage safety, and describe new perspectives People, context and safety SHEL(L) model
and methods for managing safety. Errors and violations
Organizational culture
Safety investigation
Questions and answers
Points to remember
Exercise N 02/01 The Anytown City Airport accident
(See Handout N 1)
Module N 2 ICAO Safety Management Systems (SMS) Course 3 Module N 2 ICAO Safety Management Systems (SMS) Course 4
ICAO Safety Management Systems (SMS) Course

Module N 2 Basic safety concepts
Concept of safety Concept of safety
What is safety Consider (the weaknesses in the notion of perfection)

Zero accidents (or serious incidents)? The elimination of accidents (and serious incidents) is
unachievable.
Freedom from danger or risks?
Failures will occur, in spite of the most accomplished
Error avoidance prevention efforts.
Regulatory compliance? No human endeavour or human-made system can be
? free from risk and error.
Controlled risk and controlled error is acceptable in
an inherently safe system.
Concept of safety (Doc 9859) Safety

Traditional approach Preventing accidents
Focus on outcomes (causes)
Safety is the state in which the risk of harm to persons or
Unsafe acts by operational personnel
Attach blame/punish for failures to perform safely
property damage is reduced to, and maintained at or below,
Address identified safety concern exclusively
an acceptable level through a continuing process of Identifies:
WHAT? WHO? WHEN?

hazard identification and risk management.
But not always discloses:
WHY? HOW?

The evolution of safety thinking A concept of accident causation
Organization Workplace People Defences Accident
Tec
hno
Ma n Tr lo g
Wo Erro Reg aining y
d e c a g e me rs
HUMAN FACTORS is con rking a ula
orga ions a nt viola nd
tion
TODAY
ditio s
niz nd ns tion
proc ationa s
es s l
es
1950s 1970s 1990s 2000s Latent conditions trajectory

Source: James Reason
The organizational accident The organizational accident
Organizational processes
Policy-making Inadequate hazard

Planning identification and risk
Communication management
Allocation of resources Normalization of
Supervision deviance
...
Activities over which any organization has a reasonable degree Conditions present in the system before the accident, made evident
of direct control by triggering factors.

Organizational processes
Workforce stability
Latent
conditions
Qualifications and
experience
Technology Morale
Training Credibility
Regulations Defences Ergonomics
...
Resources to protect against the risks that organizations involved Factors that directly influence the efficiency of people in
in production activities generate and must control. aviation workplaces.
Improve Identify
Monitor
Reinforce
Contain
Errors
Violations
Actions or inactions by people (pilots, controllers, maintenance

engineers, aerodrome staff, etc.) that have an immediate adverse effect.

People and safety A
Aviation workplaces involve

complex interrelationships
among its many Understand
components. human performance
To understand operational within the
performance, we must operational context
understand how it may be
where it takes place
affected by the
interrelationships among
the various components
of the aviation work places.
B
Processes and outcomes The SHEL(L) model

Understanding the relationship between people and operational
contexts
Causes and Software
consequences
of operational S
S Hardware
errors are not
linear in their Environment
magnitude HH L LLL
Liveware
E
E Liveware, other
persons

Operational performance and technology Understanding operational errors
In production-intensive Human error is considered
industries like contributing factor in most
contemporary aviation, aviation occurrences.
technology is essential.
As a result of the massive Even competent personnel
introduction of technology, commit errors.
the operational Errors must be accepted as a
consequences of the normal component of any
interactions between system where humans and
people and technology are technology interact.
often overlooked, leading to
human error.
Errors and safety A non linear relationship Accident investigation Once in a million flights
Flap Che Unh

s om cklis eede
itted t fail d wa
Statistically, millions of u re rning
operational errors are made

before a major safety
breakdown occurs
Degradation/
Error Deviation Amplification breakdown

Three strategies for the control of human
Safety management On almost every flight error
Error reduction strategies
Flap Che Effe intervene at the source of the
s om cklis ctive
itted t wo
rk s warn
ing error by reducing or
eliminating the contributing
factors.
Human-centred design
Ergonomic factors
Degradation/
Training
Error Deviation Amplification breakdown
Three strategies for the control of human Three strategies for the control of human
error error
Error capturing strategies Error tolerance strategies
intervene once the error has intervene to increase the
already been made, capturing ability of a system to accept
the error before it generates errors without serious
adverse consequences. consequence.
Checklists System redundancies
Task cards
Structural inspections
Flight strips


Understanding violations Are we ready? Culture
High hno
log
y
g
Accident Culture binds people together as members of groups and
Tec rainin s Incident
T tion
ula
Reg Systems provides clues as to how to behave in both normal and
production
objective(s)
unusual situations.
Exceptional violation space

Risk Culture influences the values, beliefs and behaviours that
people share with other members of various social groups.
Violation space
Safety space
Low
Minimum System output Maximum
Three cultures Three distinct cultures

National National culture encompasses the value system of
particular nations.
Organizational/corporate culture differentiates the values
and behaviours of particular organizations (e.g. government
Organizational vs. private organizations).
Professional culture differentiates the values and
National behaviours of particular professional groups (e.g. pilots, air
Professional traffic controllers, maintenance engineers, aerodrome staff,
etc.).
No human endeavour is culture-free

Organizational/corporate culture Safety culture
Sets the boundaries for acceptable behaviour in the A trendy notion with potential for misperceptions and
workplace by establishing norms and limits. misunderstandings
Provides a frame work for managerial and employee A construct, an abstraction
decision-making It is the consequence of a series of organizational
This is how we do things here, and how we talk processes (i.e., an outcome)
about the way we do things here. Safety culture is not an end in itself, but a means to
Organizational/corporate culture shapes among many achieve an essential safety management prerequisite:
others safety reporting procedures and practices by Effective safety reporting
operational personnel.
Effective safety reporting Five basic traits Three options Source: Ron Westrum
Information Flexibility
People are knowledgeable about the human, technical and People can adapt reporting
when facing unusual
Organizations and the management of information
organizational factors that determine the safety of the system circumstances, shifting from
as a whole. the established mode to a
direct mode thus allowing
Pathological Hide the information
Willingness information to quickly reach
the appropriate decision-
People are willing to making level. Bureaucratic Restrain the information
report their errors and
Effective safety
reporting
experiences.
Learning Generative Value the information
People have the competence
to draw conclusions from
Accountability safety information systems
and the will to implement
People are encouraged (and rewarded) for providing essential
major reforms.
safety-related information. However, there is a clear line that
differentiates between acceptable and unacceptable behaviour.

Three possible organizational cultures Safety investigation
Source: Ron Westrum
For funereal purposes
Pathological Bureaucratic Generative
To put losses behind
Information Hidden Ignored Sought
To reassert trust and faith in the system
Messengers Shouted Tolerated Trained
To resume normal activities
Responsibilities Shirked Boxed Shared To fulfil political purposes
Reports Discouraged Allowed Rewarded For improved system reliability
Failures Covered up Merciful Scrutinized To learn about system vulnerability
New ideas Crushed Problematic Welcomed To develop strategies for change
Resulting Conflicted Red tape Reliable To prioritize investment of resources
organization organization organization organization
Investigation Investigation
The facts ... The facts
An old generation four engine turboprop freighter flies While attempting to conduct an emergency landing, all
into severe icing conditions. electrical power is lost.
Engines 2 and 3 flameout as consequence of ice All that is left to the flight crew is the self-powered
accretion, and seven minutes later engine 4 fails. standby gyro, a flashlight and the self-powered engine
The flight crew manages to re-start engine number 2. instruments.
Electrical load shedding is not possible, and the The flight crew is unable to maintain controlled flight,
electrical system reverts to battery power. and the aircraft crashes out of control.
...

Findings ... Findings
Crew did not use the weather radar. Crew did not use correct phraseology to declare
emergency.
Crew did not consult the emergency check-list.
Poor crew resource management (CRM).
Demanding situation requiring decisive thinking and
Mismanagement of aircraft systems.
clear action.
Emergency checklist presentation and visual
Conditions exceeded certification condition for the
information.
engines.
Flight operations internal quality assurance procedures.
Did not request diversion to a closer aerodrome.
...
Causes Safety recommendations
Multiple engine failures
Incomplete performance of emergency drills Authority should remind pilots to use correct
Crew actions in securing and re-starting engines phraseology.
Drag from unfeathered propellers Authority should research into most effective form of
Weight of ice
presentation of emergency reference material.
Poor CRM
Lack of contingency plans
Loss of situational awareness

The facts ... The facts
An old generation two engine turboprop commuter
Upon reaching MDA, the flight crew does not acquire
aircraft engaged in a regular passenger transport
operation is conducting a non-precision approach in visual references.
marginal weather conditions in an uncontrolled, non- The flight crew abandons MDA without having acquired
radar, remote airfield.
visual references to pursue the landing.
The flight crew conducts a straight-in approach, not
following the published approach procedure. The aircraft crashes into terrain short of the runway.

Findings But
The crew made numerous mistakes. The company had consistently misinterpreted
regulations.
But
Level of safety was not commensurate with the
Crew composition legal but unfavourable in view of
requirements of a scheduled passenger operation.
demanding flight conditions.
Aerodrome operator had neither the staff nor the
According to company practice, pilot made a direct
approach, which was against regulations. resources to ensure regularity of operations.


But But
Lack of standards for commuter operations. Conflicting goals within the authority.
Lack of supervision of air traffic facilities. Lack of resources within the authority.
Authorities disregard of previous safety violations. Lack of aviation policy to support the authority.
Legislation out of date. Deficiencies in the training system.
Causes Safety recommendations

Tip-of-the-arrow recommendations.
Decision to continue approach below MDA without
visual contact.
But
Review the process of granting AOC.
Performance pressures.
Review the training system.
Airlines poor safety culture. Define an aviation policy which provides support to the
task of the aviation administration.


Investigation Errors ...
But
Reform aviation legislation.
Reinforce existing legislation as interim measure.
Improve both accident investigation and aircraft and

airways inspection processes.
are like mosquitoes

To fight them
Basic safety concepts
Questions and answers
... drain their breeding swamps.


Questions and answers Questions and answers
Q: How is safety defined in document 9859? Q: Enumerate the five building blocks of the organizational
A: accident.
Safety is the state in which the risk of harm to persons A:

or property damage is reduced to, and maintained at or
below, an acceptable level through a continuing process
of hazard identification and risk management.
Slide number: 7
Slide number: 16
Questions and answers Questions and answers

Q: Explain the components of the SHEL(L) Model. Q: Enumerate three basic traits underlying effective safety
reporting.
A: A: Information Flexibility
People are knowledgeable about the human, technical and People can adapt reporting
Software organizational factors that determine the safety of the system as a when facing unusual
whole. circumstances, shifting from the
S Hardware Willingness
established mode to a direct
mode thus allowing information
to quickly reach the appropriate
Environment People are willing to report
their errors and
Effective safety
reporting
decision-making level .
experiences. Learning
H L L Liveware People have the competence to
draw conclusions from safety
Accountability
Liveware, other People are encouraged (and rewarded) for providing essential safety-
information systems and the will
to implement major reforms.
E persons related information. However, there is a clear line that differentiates
between acceptable and unacceptable behaviour.
Slide number: 20 Slide number: 35


Questions and answers Points to remember
Q: How can organizations be characterized, depending 1. The organizational accident.
upon their management of safety information?
A: 2. Operational contexts and human performance
Pathological Hide the information 3. Errors and violations.

Bureaucratic Restrain the information 4. Organizational culture and effective safety reporting.
Generative Value the information 5. The management of safety information.
Slide number: 36
The Anytown City Airport accident

In the late hours of a summer Friday evening, while landing
on a runway heavily contaminated with water, a twin-engine
jet transport aircraft with four crew members and 65
passengers on board overran the westerly end of the
runway at Anytown City airport.
The aircraft came to rest in the mud a short distance
Basic safety concepts beyond the end of the runway.
Exercise 02/01 The Anytown City There were no injuries to crew or passengers, and there
was no apparent damage to the aircraft as a consequence
Airport accident (Handout N 1) of the overrun. However, a fire started and subsequently
destroyed the aircraft.

The Anytown City Airport accident The Anytown City Airport accident
Group activity: required task:
A facilitator will be appointed, who will coordinate the From the investigation report of the above accident,
discussion. you should identify:
A summary of the discussion will be written on flip 1. Organizational processes that influenced the
operation and which felt under the responsibility of
charts, and a member of the group will brief on their
senior management (i.e. those accountable for the
findings in a plenary session.
allocation of resources);
Required task: 2. Latent conditions in the system safety which
Read the text related to the accident of the twin-engined became precursors of active failures;
jet transport at Anytown City Airport. 3. Defences which failed to perform due to
weaknesses, inadequacies or plain absence;
The Anytown City Airport accident The organizational accident

required task:
4. Workplace conditions, which may have influenced

operational personnel actions; and
5. Active failures, including errors and violations
When you have concluded the above, your task is to

complete the Table 02/01 Analysis (Handout N 1)
classifying your findings in accordance with the
organizational accident model.

Module N 2 Basic
safety concepts
Revision N 11 ICAO Safety Management Systems (SMS) Course 29/09/08


ICAO SMS Module #2 - Basic Safety Concepts 2008-11 (E)

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ICAO SMS Module #2 - Basic Safety Concepts 2008-11 (E)

Uploaded by

Copyright:

Available Formats

Building an SMS

Module 1 Module 2 Module 3

ICAO Safety Management Systems (SMS) Course

What is safety Consider (the weaknesses in the notion of perfection)

Concept of safety (Doc 9859) Safety

WHAT? WHO? WHEN?

ICAO Safety Management Systems (SMS) Course

1950s 1970s 1990s 2000s Latent conditions trajectory

The organizational accident The organizational accident

Policy-making Inadequate hazard

ICAO Safety Management Systems (SMS) Course

The organizational accident The organizational accident

Actions or inactions by people (pilots, controllers, maintenance

ICAO Safety Management Systems (SMS) Course

Aviation workplaces involve

Processes and outcomes The SHEL(L) model

ICAO Safety Management Systems (SMS) Course

Flap Che Unh

operational errors are made

ICAO Safety Management Systems (SMS) Course

ICAO Safety Management Systems (SMS) Course

Exceptional violation space

Three cultures Three distinct cultures

ICAO Safety Management Systems (SMS) Course

ICAO Safety Management Systems (SMS) Course

ICAO Safety Management Systems (SMS) Course

ICAO Safety Management Systems (SMS) Course

ICAO Safety Management Systems (SMS) Course

Legislation out of date. Deficiencies in the training system.

Causes Safety recommendations

ICAO Safety Management Systems (SMS) Course

Reform aviation legislation.

Reinforce existing legislation as interim measure.

Improve both accident investigation and aircraft and

are like mosquitoes

Basic safety concepts

Questions and answers

... drain their breeding swamps.

ICAO Safety Management Systems (SMS) Course

Safety is the state in which the risk of harm to persons A:

Questions and answers Questions and answers

Slide number: 20 Slide number: 35

ICAO Safety Management Systems (SMS) Course

Pathological Hide the information 3. Errors and violations.

The Anytown City Airport accident

ICAO Safety Management Systems (SMS) Course

The Anytown City Airport accident The organizational accident

4. Workplace conditions, which may have influenced

5. Active failures, including errors and violations

When you have concluded the above, your task is to

ICAO Safety Management Systems (SMS) Course

Revision N 11 ICAO Safety Management Systems (SMS) Course 29/09/08

ICAO Safety Management Systems (SMS) Course

You might also like