SMS for AviAtion –A PrActicAl Guide Saety RiSk ManageMent
Safety Management Systems
i
3
cs What s safet rs manaement?
01
identfn identf n safet hazards
01
Rs assessm assessment ent and mtaton
05
ALARP
09
Case stud – fatue rs manaement
12
Toolt – Safet rs manaement
17
© 2012 Civil Aviation Saety Authority For urther inormation visit www.casa.gov.au This work is copyright. You may download, display, print and reproduce this material in unaltered orm only (retaining this notice) or your personal, non-commercial use or use within your organisation. Apart rom any use as permitted under the Copyright Act 1968, all other rights are reserved. Requests or urther authorisation should be directed to: Saety Promotion, Civil Aviation Saety Authority, GPO Box 2005 Canberra ACT 2601, or email sa
[email protected] This kit is or inormation purposes only. It should not be used as the sole source o inormation and should be used in the context o other authoritative sources. The case studies eaturing ‘Bush Air’ and ‘Bush Maintenance Services’ are entirely fctitious. Any resemblance to actual organisations and/or persons is purely coincidental. 1105.1511
Safety Risk Management
Wha s say s maagm? Saety risk management: the identication, analysis and elimination (and/or mitigation to an acceptable or tolerable level) o the hazards, as well as the subsequent risks, that threaten the viability o an organisation. (ICAO Doc. 9859) Beore an SMS can be eectively built or improved, you must identiy the saety hazards to your operation and ensure you have controls in place to manage risk. An SMS should be risk based. For example, the risks involved in operating helicopters regularly at low level are quite dierent to those o an RPT service, so each operator’s SMS will need to refect that. Saety risk management is a careul examination o what, in your work, could cause harm, so that you can weigh up whether you have taken enough precautions, or should do more to prevent harm. History shows that aircrat accidents not only ruin lives, but also aect business i output is lost, assets or equipment are damaged, insurance costs increase, or you have to go to court. Legally, you must assess the risks to sae operations in your workplace, and implement a plan to control those risks. Saety risk management is a key component o an SMS and involves two undamental saetyrelated activities: 1. Identiying saety hazards 2. Assessing the risks and mitigating them (reducing the potential o those risks to cause harm).
iyg say hazas A hazard is anything that could cause harm, damage or injury, or have a negative consequence, such as bad weather, mountainous terrain, FOD, lack o emergency equipment, high workload/atigue or use o alcohol and other drugs. There are many ways o identiying hazards and quantiying risks, but to do it successully you have to think laterally, unencumbered by past ideas and experiences. Operational hazards can be obvious, such as lack o training, or they may be subtle, such as the insidious eects o longterm atigue.
thr r svrl usul mhods o d hzrds: » Brainstorming - small discussion groups meet to generate ideas in a non-judgmental way » Formal review o standards, procedures and systems » Sta surveys or questionnaires » One person standing back rom the operation and monitoring it critically and objectively » Internal or external saety assessments » Hazard reporting systems. Hazard identication generally involves three steps: 1. Stating the generic hazard (hazard statement) e.g. atigue/high workload, bad weather 2. Identiying specic components o the hazard e.g. errors because o atigue 3. Identiying project-specic risk/s associated with each hazard e.g. maintenance errors resulting rom atigue, especially at times o Circadian low (2am-6am), CFIT, uel exhaustion because o bad weather.
Safety Management Systems
01
I you are a small aviation organisation with only a ew sta, you simply need to apply discipline and make the time to examine all acets o your operations and identiy their hazards. You need to either eliminate the hazards where possible, vary the operation, or redesign in a practical way to protect rom the hazards. You need to be able to be satised that all risks are acceptable. For larger organisations, setting up discussion groups with as many sta and line managers as possible is a good way o identiying hazards. The group discussions will also encourage sta to become more actively involved in establishing or improving your SMS. To avoid accidents and incidents any organisation should have multiple layers o controls or deences in place. However, controls are never oolproo – or example, having well-trained maintenance engineers does not ensure that aircrat components are always tted correctly, and standard operating procedures or fight crew are only as eective as those who ollow them. Regularly identiy what deences you have against recognised saety hazards.
Sx smpl sps r susd s rl wr s ssm: 1. Identiy saety hazards across your operations that could harm people, equipment, property or the environment. 2. Rank the likelihood and severity o these hazards 3. Identiy the current deences/controls in place to manage them 4. Evaluate the eectiveness o each deence/control 5. Identiy additional deences/controls where required 6. Record/(and continue to monitor) all this inormation in a hazard register.
02
Safety Risk Management
Step 1: identf safet hazards Focus group discussions should ask participants to brainstorm the types o saety hazards they think may threaten the saety o passengers, employees or contractors. The group should also consider those hazards which could damage equipment, or harm the environment. For example, or fight crew, uel exhaustion would be a hazard that could result in the loss o both an aircrat and its passengers. For maintenance engineers, atigue might be a hazard during night shit operations. There may also be systemic hazards – organisational actors that could result in the loss o an aircrat, or injury to or the death o passengers. These hazards include: insucient training; lack o policies or procedures; and people not ollowing these policies or procedures.
Step 2: Ran and assess the severt of the safet hazards Assess the hazards critically. Factors to consider are the likelihood (how oten the hazard might result in a saety occurrence), and the severity (how bad the outcome would be) o any consequences. For example, a serious in-fight re might be an unlikely occurrence, but it would be catastrophic i it were to occur. It would rank above a bird strike which, although much more likely to occur, tends to be less severe. Keep the process simple and get global views about how signicant an issue the hazard really is, in the context o all the hazards identied.
Step 3: identf the controls/defences n place to manae the hazards Once you list the hazards and rank their order o risk, you should identiy possible deences (hazard controls) against them. One deence against an in-fight re is a re extinguisher; a deence against aircrat uel contamination is correct uel ltration procedures and regular uel testing. This step should provide a list o current controls/deences against each hazard: some controls will deend against multiple hazards.
Step 4: Assess the eectiveness of the current controls/defences
Step 5: identf further controls/ defences requred
How eective is each hazard control/deence? Would the control prevent the occurrence (i.e. does it remove the hazard?), or just minimise the likelihood or the consequence? You can determine how eective a hazard control is by asking, or example: ‘Does the crew know how to use the re extinguishers, and are the extinguishers correctly maintained?’ You will then have a list o eective controls, as well as a list o which controls need improvement.
Examine each hazard and its control/s to determine whether the risk is adequately managed or controlled. I it is, the operation can continue. I not, consider how to improve the hazard control, or to remove or avoid the hazard entirely. For example, you could provide recurrent training or crew in the correct use o re extinguishers. You should manage the risk to a point o ALARP—as low as reasonably practicable. You should consider/apply all possible means o mitigation until the cost o mitigation is grossly disproportionate to the benet you obtain. In some instances, there could be a range o solutions to manage a risk. Typically, some are engineering solutions (e.g. redesign), which, although probably the most eective, may also be expensive. Others involve control (e.g. operating procedures) and personnel (e.g. training) and might be less costly. The solution need not be costly to be eective.
Bush Maintenance Services has a close call involving engine cowl asteners. Trevor Brown, the saety ocer and senior LAME, hears rom the apprentice, Ryan Johnson, that an aircrat went out with the asteners missing. The other LAME, Geo White, was due to nish the service on his shit, but had ooty practice or the nals that weekend, and let in a rush, saying over his shoulder as he raced out o the hangar, ‘Mate, she’s all done. Just give her a wipe-over; the doc will be here in the morning’. Ryan had done double shits— 16 hours straight—and had to have the Beechcrat nished or the local doctor to fy to the city in the morning. During the graveyard shit, he wipes away an oil leak on the hydraulics, but bone tired, does not notice the missing asteners.
When the GP arrives in the morning, he discovers the missing asteners on his walkaround, and is understandably unimpressed. ‘I you can’t get this right, what else have you missed?’ he asks pointedly. Bruce Jones calls a toolbox meeting. ‘There are things that stand between us and an accident. We’ve got to make sure they’re working properly. How do we learn rom this, and make sure it doesn’t happen again? Bush Air won’t want us doing any more o their maintenance, nor will Outback Exploration, i we can’t show more proessionalism.’
Safety Management Systems
03
Step 6: Record all ths nformaton n a hazard rester This is important not only or your internal risk management processes, but also in case you ever need to provide inormation to CASA, the ATSB or other regulators. Ater completing these steps, you should have the ollowing:
» A list o saety hazards identied by employees, ranked in order o importance » A list o current controls/deences in place to manage these hazards » A list o urther controls/deences required to improve saety across the operation » Sta involvement in identiying saety deciencies and priority areas or improved risk management » Who is going to do it.
Hazard identication checklist SMS
iteMS
Hazard » The organisation has established identication various ways to proactively processes identiy hazards through discussion groups (condential where possible – in some smaller organisations this may be dicult or impossible), reporting, or surveys.
» The organisation uses the database o reported hazards to: - identiy hot spots needing particular attention - conduct trend analysis which can help to improve hazard identication. » Procedures are maintained or the internal and external reporting and recording o hazards and other saety-related issues to enable analysis and organisational learning. » The organisation has processes in place to ensure identied hazards are dealt with in a timely manner, and the results o any actions are ed back to sta.
04
Safety Risk Management
rs assssm a mga The term risk reers to the chance that somebody could be harmed by various hazards, together with an indication o how serious the harm could be. Risk management is an integral component o saety management and involves ve essential steps:
safet rs manaement Equipment, procedures, organisation, e.g. Analyse the likelihood o the consequence occurring Evaluate the seriousness o the consequence i it does occur Is the assessed risk/s acceptable and within the organisation’s saety perormance criteria?
Yes, accept the risk/s
No, take action to reduce the risk/s to an acceptable level
Hazard identication Risk analysis probability
Risk analysis severity
I you work in, or run a larger organisation, you can ask an advisor to help you. I you are not condent, ask someone competent or advice. In all cases, you should make sure that you involve your sta or their representatives in the process. They will have useul inormation about how the work is done that will make your risk assessments more thorough and eective.
Step 1: identf the hazards Work out how sae operations could be harmed. The hazard identication methods already mentioned are a good start. However, when you are in your workplace day ater day, it is easy to overlook hazards, so here are some tips to help you identiy the ones that matter:
» Walk around your workplace looking or things that could reasonably be expected to cause harm. Involve your employees: they may have noticed things that are not immediately obvious to you.
Risk assessment » Review your accident records—they can oten help to identiy less-obvious hazards. and tolerability
Risk control/ mitigation
Do’ ovrcomplc h procss . You should already have a good idea o the risks and o any control measures that you can easily apply. You probably already know whether, or example, you have employees who commute a long distance to work areas, or areas o maintenance which are more prone to risk. I so, check that you have taken reasonable precautions to avoid incidents.
» Review previous saety occurrences and maintenance errors. These will help in understanding risks and their potential likelihood and consequences. » Review CASA or ATSB reports. » Ask similar organisations what they ound and have done about it. exmpl: One o the saety concerns or air transport operators is incorrect loading o passengers or reight on the aircrat, which can lead to accidents.
I you run a small organisation and are condent you understand what’s involved, you can do the assessment yoursel. You do not have to be a risk specialist.
Safety Management Systems
05
Step 2: Decde what mht be harmed and how the harm mht be caused
Wh?
For each hazard you need to be clear about what might cause harm. This will then help you identiy the best way to manage the risk. That doesn’t mean listing everyone by name, but rather identiying groups o people (e.g. fight crew, cabin crew and passengers).
Cuss?
In each case, you should identiy what might occur. You will also need to identiy the possible reasons (root causes) o the hazard. An online search or SMS sotware will provide numerous potential suppliers o aordable sotware to manage all this.
Incorrect aircrat loading can aect the saety o fight crew, cabin crew, passengers on board and people on the ground.
Incorrect aircrat loading can result rom:
» Poor weight and balance calculations » Failure to weigh baggage correctly » Miscommunication between fight crew and aircrat loading sta » Failure to secure reight properly » Loading o the wrong baggage/reight on the fight » Inormation entered incorrectly into the fight management system.
Identication of the severity/consequence of the event Take into account any current mitigation measures and assess the severity in terms o the worst possible realistic scenario.
Lvl Svr/ Cosquc
Dscrpor
5
Severe
Catastrophic (at least one atality, huge nancial loss)
4
Major
Major (extensive injuries to one or more people, major nancial loss
3
Moderate
Moderate (medical treatment required, high nancial loss)
2
Minor
Minor (rst aid treatment at the workplace, medium nancial loss)
1
Negligible
Insignicant (no injuries, low nancial loss)
Lelhood of occurrence Take into account any current mitigation measures and assess the likelihood/probability o the risk occurring.
Lvl Llhood
Dscrpor
5
Almost certain
Imminent–is expected to occur in most circumstances
4
Likely
Once in the next month, will probably occur in most circumstances
3
Possible
Once in the next 12 months, might occur at some time
2
Unlikely
Once in the next 1–5 years, could occur at some time
1
Rare
Once in the next 10 years–may occur only in exceptional circumstances
The saety manager/ocer will enter the results into the saety report and hazard log.
06
Safety Risk Management
Use the risk tolerability matrix to assess how tolerable the risk is using the results obtained rom the assessment o the consequences and likelihood.
practice and see i there is more you should be doing to bring yoursel up to standard. Ask yoursel:
Cosquc 1 e l b i g i l g e N d o o h i l e k i L
2
3
4
5
e t a e r r r e r o d o j e n i o a v e M M M S
5
Almost certain
6
7
8
9
10
4
Likely
5
6
7
8
9
3
Possible
4
5
6
7
8
2
Unlikely
3
4
5
6
7
1
Rare
2
3
4
5
6
>7
exrm rs
Detailed treatment plan required
6 to 7
Hh rs
Needs senior management attention and treatment plan as appropriate
4 to 5
Mdum rs
Manager-level attention and monitoring as appropriate
<4
Low rs
Manage by local-level procedures
The saety manager/saety ocer will enter the results into the hazard register
Step 3: Evaluate the rss Having identied the hazards, you then have to decide what to do about them. You must ‘do everything reasonably practicable’ to mitigate the risks o identied hazards. You can work this out or yoursel, but the easiest way is to compare what you are doing with good practice and/or with what your competitors are doing. Examine what you are already doing. Think about what controls you have in place and how the work is organised. Then compare this with good
» Can I eliminate the hazard altogether? I not, how can I control the risks so that harm is unlikely? » Can I try a less risky option? Prevent access to the hazard? Reduce exposure to the hazard? Improving saety need not cost an enormous amount. For instance, placing a mirror on a dangerous blind corner o the airport apron to help prevent vehicle accidents is a low-cost precaution, considering the risks. Failure to take simple precautions can be much more costly i an accident does happen.
evlu rs lvl – An important task in analysing risk is to determine the risk level based on its likelihood and consequence . Likelihood consists o two parts:
» The likelihood o a single event occurring » The likelihood o the event occurring based on exposure and repetition (how oten the task is perormed, such as cycles o aircrat maintenance etc.) A simple way to determine the likelihood is to rank the hazard based on its potential requency o ocurrence. This can be done on a simple vepoint scale, rom ‘rare’ to ‘almost certain’. Consequence is the potential impact or outcome that may result rom the hazard. This can range rom insignicant to catastrophic.
arcr lod s rulr cv, so h likelihood o corrc lod o h wro hold s ssssd s ‘possbl’ d h potential consequence c b ‘modr’, rsul ‘corrc lod’ b corsd s ‘hh’, v h pol or dm o rcr srucur, or h rcr b ou o wh d blc olrcs.
Safety Management Systems
07
Dcd o prcuos – Once you determine the risk levels, assess the saety deences or controls in place to work out how eective they are against the hazard or hazardous event. Saety deences/controls in place to prevent incorrect aircrat loading:
» Standard industry weights used or passengers » Securing cargo more eectively » Cargo and baggage weighed separately » Standard load sheet used by pilots to calculate weight and centre o gravity o the aircrat » Correctly calibrated scales
Step 4: Record your ndings and mplement them Having assessed the risk and the deences in place, decide how to implement your risk management plans. You may avoid the risk, accept the risk in order to pursue an opportunity, remove the risk, or share the risk with another party (see ISO 31000:2009). Putting the results o your risk assessment into practice will make a dierence when looking ater people and your business. Record the results o your risk assessment and share them with your sta. It is important to document what you have done so that you can review it at a later date i anything changes.
I, as in many organisations, you nd that there are a number o improvements to be made, both large and small, do not try to do everything at once. Make a plan o action to deal with the most signicant risks rst. CASA inspectors acknowledge the eorts o aviation organisations that are clearly trying to make improvements. However, you cannot continue operations i a risk is assessed as ‘intolerable’, until that risk is mitigated to acceptable level. You need to allocate tasks to the right people, with timelines or getting the job done. One large successul operator makes sure things are done by having the CEO as the only person who can approve extensions. There must be a very good reason or any extension request. A good plan o action oten includes a mixture o dierent things. There may be a ew costeective or easy improvements you can do quickly, perhaps as a temporary solution until more reliable controls are in place. Remember to prioritise and tackle the most important things rst. As you complete each action, tick it o your plan. While the majority o saety deences/controls in place were assessed as eective, additional measures are required, which are detailed in a risk management plan outlining short-and longer-term measures:
Shor-rm » Extra nets and straps to be made available to secure cargo correctly
A risk assessment does not have to be perect, but it must be suitable and sucient. You need to be able to show that:
» Standard load sheet to be held in the cockpit at all times.
» you made a proper check
» Standard training or all people involved in baggage handling.
» you asked who might be aected » you dealt with all the signicant hazards, taking into account the number o people who could be involved » your precautions are reasonable and any residual risk is low » you involved your sta, or their representatives, in the process. 08
Safety Risk Management
Lo-rm
Step 5: Monitor the eectiveness of our mplementaton Monitor your agreed implementation solutions to make sure they are working, and i they are not, reassess.
Step 6: Revew our assessment and update f necessar Few workplaces stay the same. Sooner or later, you will bring in new equipment and procedures which could lead to new hazards. It makes sense, thereore, to review what you are doing regularly. As a minimum, once a year you should review where you are, to make sure you are still improving, or at least not sliding back. Review your risk assessment. Have there been any changes? Are there improvements you still need to make? Have your workers spotted a problem? Have you learnt anything rom accidents or near misses? Make sure your risk assessment stays up to date. When you are running a business it is all too easy to orget about reviewing your risk assessment, until something goes wrong and it is too late.
S rvw d or hs rs ssssm. Wr dow d o our dr s ul v, or r our ol cldr. During the year, i there is a signicant change, don’t wait. Check your risk assessment and, where necessary, amend it. I possible, think about the risk assessment when you are planning the change – that way you can be more fexible and proactive. Monitoring process documented:
» Internal audit conducted every six months on aircrat loading procedures » Date or an independent annual audit noted in diary » Sta to be reminded ormally at least twice in scheduled monthly saety briengs about the saety reporting process in place to report aircrat loading issues » Results o reports communicated to sta through company education program.
AlArP* Where risk is concerned, there is no such thing as absolute saety. Risk management is oten based on the concept o ALARP or ‘as low as reasonably practicable’. There is wide acceptance that not all risk can be eliminated. There are practical limits to how ar the industry and the community will go in paying to reduce adverse risks. The concept o ALARP will be replaced by ALoS (acceptable level o saety) in the very near uture.
th aLaRP prcpl d cos-bf lss » All eorts should be made to reduce risks to the lowest level possible until a point is reached at which the cost o introducing urther saety measures signicantly outweighs the saety benet. » A risk should be tolerated only i it can be demonstrated that there is a clear benet in doing so (i.e. there is a compelling operational need in the organisation). The ALARP principle identies three categories o risk: 1. Uccpbl Risks are classied as unacceptable regardless o the benets associated with the activity. An unacceptable risk must be eliminated or reduced so that it alls into one o the other two categories, or there must be exceptional reasons or the activity or practice to continue. 2. tolrbl Risks that people are generally prepared to tolerate to secure their benets. Tolerable risks must be properly assessed and controlled to keep the residual risk ALARP, and must be reviewed periodically to ensure they remain that way (e.g. the potential risk o pedestrians, walking between the terminal and the aircrat, being struck by a moving vehicle is only tolerated IF appropriate barricading, security escort and lighting are in place). * the concept o ALARP will be replaced by ALoS (acceptable level o saety) in the very near uture
Safety Management Systems
09
The ALARP approach
Unacceptable region
Risk cannot be justied unless in extraordinary circumstances Risk is tolerable only i:
Tolerable region s k s i r l s a n r u e d i c v n i o d c n l i a g t e n i i s c a o s e r d c n n a I
» Society desires the benet o the activity, given the associated risk Broadly acceptable region
Level o residual risk regarded as negligible and urther measures to reduce risk not usually required. No need or detailed working to demonstrate ALARP
nlbl rs
3. Brodl ccpbl Risks are considered suciently low and well controlled. Further risk reduction is required only i reasonably practicable measures are available. Broadly acceptable risks are those that people would regard as insignicant or trivial in their daily lives, or which exist, but have no practicable mitigator (e.g. most organisations accept that sta could be injured on their way to work, but have little control over what happens on public roads). To determine whether a risk is tolerable (in the ALARP approach), you need to consider a number o criteria:
» Ll rqurms Aviation organisations must comply with applicable CASA and relevant state-based legislation. A control based on a legal requirement must always be considered ‘reasonably practicable’. » expr judm A proposed control should be considered reasonably practicable i an appropriate group o experts has established it has a clear saety benet, and the costs associated with its introduction are considered reasonable.
10
» Further risk reduction is impracticable or i its cost is grossly disproportionate to the improvement gained,
Safety Risk Management
» Cos-bf lss Where expert judgement or contemporary good practice does not provide clear evidence that a specic control or group o controls are reasonably practicable, a cost-benet analysis may be necessary. This establishes whether the cost o implementing a specic control is grossly disproportionate to its saety benet. » idusr ood prcc I the proposed control represents current, relevant, established good practice, that is sucient evidence to conclude that it is reasonably practicable. For example, it: - complies with aviation industry standards, rules or procedures - is a practice o other operators that are similar in scale and operation to your own - is established and widely implemented in another industry sector - matches other countries’ legislated enorcement o the practice - is proven to have demonstrably improved saety, or can be implemented without signicant modication or cost.
ALARP applcaton 1. idfco o hzrd A small certied aerodrome operator, located in outback Australia, identies a saety hazard – wildlie wandering on to the runway, and potentially colliding with aircrat. Hazard = wildlie on runway, specifcally wallabies, eral camels and donkeys. 2. Dcd who should b volvd h ssssm procss Aircrat operations during taxiing, take-o and landing are exposed to this hazard. The hazard is caused by inconsistent wildlie management, seasonal conditions and the absence o a perimeter ence. 3. evlu h rss d dcd o prcuos Discussions with aircrat operators and other stakeholders using the aerodrome reveal no identied incidents involving wildlie have resulted in a collision. However, over the last six months there have been ve near-miss reports, two o which involved minor evasive action (braking by the pilot in command) to avoid collision. The risk is assessed as ‘moderate’, based on a combination o ‘possible’ (likelihood) and ‘minor’ (consequence). The aerodrome operator decides that two controls could manage the risk: an improved wildlie management program, including possible seasonal eradication o animals; and constructing an aireld perimeter ence to prevent wildlie access. The airport operator decides the airport perimeter ence is the most eective control o the two available, and applies ALARP to determine i this is justiable. They consider the ollowing to determine whether the risks are tolerable: Legal requirements This is a certied aerodrome under CASR Part 139, with only one weekly RPT service and a variety
o charter and general aviation operations. Thereore, there is no explicit aviation regulatory requirement or a perimeter ence. Expert judgement Stakeholders consulted about the possible construction o a ence agree that it is an eective control, but the ence must be maintained and inspected regularly. Cost beneft analysis The cost o the perimeter ence construction and ongoing maintenance program is determined to be beyond the unds o the aerodrome operator, and local government is unable to assist with nances. The small number o incidents thereore suggests that the cost is not justiable. Industry practice A quick survey o similarsized registered aerodromes suggests that not all have perimeter ences, and some are only partially enced. While perimeter encing is recommended, industry practice suggests that this is not consistent. 4. Rcord our fds d mplm hm The aerodrome operator decides thereore that a perimeter ence is not justied, based on its cost to build, that such a ence is not consistent with industry practice, and that there is a limited risk o wildlie on the runway colliding with an aircrat. However, to ensure that the risks are ‘acceptable’ based on ALARP principles, they decide to improve wildlie management through a more targeted seasonal wildlie management program – keeping the grass down to minimise ood supplies and regular sweeps o the runway to deter wildlie. 5. Rvw our ssssm d upd cssr They review the wildlie management program annually, with aerodrome users reminded to report wildlie activity on or near the aerodrome. They also contact CASA or resources to assist in wildlie identication and management, and develop a wildlie hazard management plan.
Safety Management Systems
11
Rs mtaton checlst SMS
iteMS
Risk mitigation processes
» The organisation has a ormal saety risk management process used to: - identiy hazards associated with the organisation’s operations - analyse and assess the risks associated with those hazards - implement controls to prevent uture accidents, incidents or occurrences. » This saety risk management process meets the ollowing risk management requirements to: - (a) communicate and consult
cas sy – ag s maagm What s fatue? Fatigue is an experience o physical and/or psychological weariness. I you become atigued, the eect can be the same as i you have consumed alcohol. Fatigue can, or example, aect your ability to react quickly to emergencies; communicate clearly and determine the sae limits o your actions; as well as your ability to operate productively. Managing atigue is an important component o saety management, given that it is a signicant and preventable actor in transport incidents/ accidents. For example, 20-30 per cent o road incidents and 5-15 per cent o all atal road accidents involve driver atigue.
What causes fatue?
- (b) establish the context
Both work-and non-work-related actors aect atigue.
- (c) identiy risks
Work-related atigue actors:
- (d) analyse risks - (e) evaluate risks
» The hours you have to work (and the impact o these hours on the opportunity to sleep)
- () treat/mitigate risks
» The timing and duration o breaks within shits
- (g) monitor and review. » There is a ormal record o each stage o the risk management process, including assumptions, methods, data sources, analysis, results and reasons or decisions.
» The work you do » Your work environment. Non-work-related atigue actors:
» Long commutes to and rom work » Sleep disorders aecting the quantity and/or quality o your sleep recovery » Your amily and social responsibilities » Having a second job.
12
Safety Risk Management
Consequences of fatue
Fatue manaement countermeasures
General consequences can include:
Counter measures to prevent atigue-related errors are listed below:
» Lapses in attention/concentration » Poor risk assessment, and incomplete or inaccurate assessment o potential consequences » Ineciency in production, on-time perormance, resource use (e.g. uel), and/or motivation » Impaired or delayed decision making » A higher likelihood o ocusing on the most obvious data or stimuli, to the exclusion o other equally important inormation.
Nappn Generally, the longer the nap the greater its recovery value. Naps should provide at least 20 minutes o sleep, but no longer than two hours, to be o the greatest benet. Longer naps can lead to ‘sleep inertia’ - the groggy eeling you have when someone wakes you up during a deep sleep. So, beore returning to work ater such a nap, people should have 10-20 minutes o ‘recovery’ to overcome the eects o sleep inertia.
The table below indicates the typical behavioural symptoms o atigue. I an employee has experienced three or more o the specied symptoms in a 15-minute period they are likely to be atigued.
Behavoural smptoms of fatue PHySiCaL SyMPtOMS
MentaL SyMPtOMS
» Yawning
» Diculty concentrating on the current » More quiet or withdrawn work task than normal
» Heavy eyelids » Eye rubbing » Head drooping » Inappropriate or unintentional napping » Falling asleep » Poor coordination
eMOtiOnaL SyMPtOMS
» Lapses in attention » Diculty remembering what you are meant to be doing » Failure to communicate important inormation to a colleague » Failure to anticipate events or actions
» Lethargic or lacking in energy » Lacking in motivation to do the task well » Irritable or bad-tempered behaviour with colleagues, amily or riends
» Unintentionally doing the wrong thing (errors o commission) » Unintentionally ailing to do the right thing (errors o omission)
Safety Management Systems
13
Small- to medium-sized air transport operators do not currently need custom-built crew rest acilities or napping on their aircrat. Consider a simple but eective strategy used by one helicopter charter operator:
Nappn faclt A Bankstown-based helicopter charter operator recognises that ater long and demanding operations, its aircrew get into their cars and in some cases drive or up to two hours to get home. To oset the risk o atigue, all aircrew have access to a dedicated rest acility located at the rear o the maintenance hangar. The chie pilot believes that this allows his crew to take naps, and is one o their most valuable atigue countermeasures.
Supervsor and co-worer montorn I your workers are at increased risk o a atiguerelated error, you may be able to ask peers or supervisors to monitor atigue-related behaviours. However, you need to guide people about what to look out or. You must provide this inormation in advance, to minimise misperceptions that people are being watched. You can make monitoring as simple as more requent verbal contact (or example, regularly throughout the shit), or you can make it more ormal by mandating veried additional supervisory checks (at hourly intervals during night shit work, or example) or saety-critical duties.
14
Safety Risk Management
nOte Mc r pr moor Look out or the ollowing symptoms that may indicate you or your co-workers are atigued:
» Communication that goes unanswered, or checklists that go unchecked » Diminished motor skills – writing that trails o into nothing, poor concentration, impaired driving skills » Obvious tiredness – drooping head, eyes hal closed or staring » Diminished vision – diculty in ocusing » Slow reactions » Short-term memory problems – unable to remember inormation you have just been told » Channelled concentration – xation on a single, possibly unimportant issue, neglecting others, and unable to maintain an overview o the job » Easily distracted by trivia or, at the other extreme, xation on a single issue » Poor or clumsy handling o tools/operation o equipment » Increased mistakes – making poor decisions, or no decisions at all » Abnormal moods – mood swings, depressed, periodically elated and energetic, diminished standards.
I you notice any o these symptoms, what should you do?
» Deal with the problem within your own team rst by raising it (do not accuse) with the person concerned. ‘I notice you are looking very tired; is everything OK?’ » Try to nd out why the person is atigued
Sutable overnht accommodaton and meals I your organisation conducts overnight operations, you may want to organise minimum accommodation requirements with your customers to ensure your sta have adequate ood and rest acilities. A small aircrat charter organisation has the ollowing policy:
» Ask how you can help » I the problem continues, reach agreement with the person that their supervisor should be involved to allow or more ormal atigue countermeasures » Emphasise that atigue is a saety-critical issue, and work cannot continue until it is dealt with.
Tas rotaton and/or tas reallocaton Task rotation has signicant potential as a atigue control measure. In many cases, workload can be made more engaging by varying the tasks undertaken across a shit. Task rotation can be more dicult in small organisations with limited numbers o skilled sta. However, where you have groups o skilled sta, and particular rosters are known to be more susceptible to atigue, or a saety-critical task is under time pressure, a tag team approach to the job can be useul. You might be able to alternate sta between doing the job and quality control cross-checking. When atigue-related symptoms are recognised, either by sel-assessment or supervisor monitoring, consider task reallocation, especially where there are high risks to the individual, to peers, and/or to the general public. For example, less risky tasks might be simple procedural tasks, word and data processing, quality checks and basic communication. This control only reduces exposure to high-impact hazards, but does not mitigate the atigue itsel.
Mnmum accommodaton requrements for all overnht operatons To ensure aircrew have the best opportunity or good-quality sleep during overnight operations, they require the ollowing minimum accommodation:
» A single room or each aircrew member, which: - has easy access to the worksite - is air conditioned - is comortable, clean and to a high standard. - has access to quality in-house meals. I these minimum conditions are not met, please inorm the chie pilot immediately.
Strategic use of caeine Caeine can provide a short-term improvement in alertness. How intense and long lasting that eect is depends on how much caeine the body is used to, and how oten it is consumed. Not surprisingly, the more requent and the higher the caeine intake, the less noticeable will be the improvement in alertness, so it should only be used (with caution) as a contingency.
Reulator requrements Two principal regimes require Australian aviation operators to manage atigue: the various state Occupational Health and Saety (OH&S) Acts and CASA regulations. The various Occupational Health and Saety Acts adopt a generalised ‘duty-o-care’ approach – employers must ensure that their workplaces are as ree rom risk o harm as reasonably possible. The broad ormulation o this duty covers the risks posed by atigue.
Safety Management Systems
15
Under CASA requirements, air transport operators can choose to operate entirely under prescriptive limits based on Civil Aviation Order (CAO) Part 48 Flight Time Limitations ; apply or a standard industry exemption to CAO 48 and operate under a atigue risk management system (FRMS); or operate under a combination o both (where some parts o the operation, one feet or example, operate under an FRMS and the rest do not). There is also relevant material or maintenance organisations in Part 145.
SMS and FRMS compared An FRMS is really a saety management approach to dealing with the risks imposed by atigue, so there are similarities between the components o an SMS and FRMS, as shown on the next page.
Fatue rs manaement sstem (FRMS) Fatigue risk management systems are increasingly being adopted by air transport operators to control the risks o atigue-related accidents and incidents. An FRMS is simply a component o the overall saety management system and includes controls such as:
» Polc d procdurs – documents how atigue risk is managed and by whom » evluo d rvw – measures program eectiveness and recommends improvements » aud – assesses operational compliance with the atigue program policy, procedures documents and ongoing legislative requirements » Rcord p – provides documented evidence o atigue risk management and is one element o an evaluation and review process » educo d r – trains individual employees and stakeholders to manage atigue risk competently » Commuco d cosulo – communicates and coordinates inormation about atigue.
16
Safety Risk Management
An eective atigue program requires multiple atigue countermeasures or deences:
» Provide sucient sleep opportunities to all employees. Employees should take advantage o these. Adopting prescriptive duty time limitations and designing rosters to manage atigue are other possible controls. » Ensure employees take responsibility or obtaining sucient sleep, and report to you i that has not been possible. Encourage employees to report any atigue risk issues through their direct supervisor, or by using a more ormal saety occurrence report orm. » Train your employees to recognise their own (and others’), atigue-related behavioural symptoms, and manage them appropriately. Provide atigue management training at induction, as well as ongoing atigue management rereshers or employees, contractors and stakeholders. This ramework reduces the likelihood that an individual will be exposed to atigue-related risk. However, atigue-related risk cannot be eliminated. Implement countermeasures such as task rotation, task allocation, strategic use o caeine, napping and co-worker/peer monitoring to reduce the risk o atigue-related errors. Once a atigue-related incident has been reported, carry out a thorough investigation to identiy any additional risk controls or risk management strategies required. Busy liestyles, long commuting distances and amily responsibilities can lead to atigue. Thereore, it is important to acknowledge that no one is immune to atigue. All sta and contractors have a role to play in contributing to managing and mitigating its potentially hazardous eects.
toolkit SAFETy RiSk MANAgEMENT
Safety Management Systems
17
ix ms This is your saety toolkit with some best-practice tips and practical tools that can be adapted to meet your organisation’s needs. We hope you nd them useul, whether you are urther developing your SMS, starting an SMS rom scratch, or simply looking or some ideas to improve your existing SMS. This list summarises the checklists/templates you will nd at the back o each o the respective booklets. This is not an exhaustive list o resources. There are many systems and products across various industries, so this toolkit can only include a very small sample o practices and/or tools or inormation. Inclusion o materials does not imply endorsement or recommendation. Each organisation must select the most appropriate products or its individual and specic needs.
Boolet 1 – Bascs » Jargon busters » Reerences
Boolet 2 - Safet polc and objectves tools » SMS organisation checklist » Saety policy statement » Saety manager’s job description » Role o the saety committee » SMS implementation plan » Ten steps to implementing an SMS » SMS gap analysis checklist » An eective emergency response plan (ERP) » Language and layout o procedures/ documentation » Document register » Sample saety leadership rules » Aviation saety liesavers policy » Just culture procedure
18
Safety Risk Management
» Appendix A – Workfow process or applying the just culture procedures » Appendix B – Bush Air counselling/discipline decision chart
Boolet 3 - Safet rs manaement tools » error prvo srs or orsos » Rs rsr » Smpl hzrd iD » gudc o job d s ds » a sx-sp mhod or volv s s hzrd dfco » Hzrd rpor orm
Boolet 4 - Safet assurance tools » Generic issues to be considered when monitoring and measuring saety perormance » Audit scope planner » Basic audit checklist » Inormation relevant to a saety investigation » Event notication and investigation report » Aviation saety incident investigation report » Corrective/preventative action plan » Checklist or assessing institutional resilience against accidents (CAIR) » Practical saety culture improvement strategy » Saety culture index
Boolet 5 - Safet promoton tools » How to conduct a training needs analysis » Sample saety inormation bulletin on atigue » How to give a saety brieng/toolbox talk » Aviation saety toolbox talk » Saety brieng/toolbox meeting attendance orm
e p sags gasas Three strategies aimed at error prevention, which is actually a orm o risk mitigation, are briefy outlined below. These strategies are relevant to fight operations, air trac control, or aircrat maintenance.
error rduco srs are intended to intervene directly at the source o the error itsel, by reducing or eliminating the contributing actors to it. They seek improved task reliability by eliminating any adverse conditions leading to an increased risk o error. Error reduction is the most requently used strategy. » Examples o error reduction strategies include improving the access to a part or maintenance, improving the lighting in which the task is to be perormed and providing better training. error cpur assumes the error has already been made. The intent is to ‘capture’ the error beore any adverse consequences o the error are elt. Error capturing does not directly reduce or eliminate the error. » Error capturing strategies include post-task inspection, verication or testing, or example, cross-checking a checklist. (However, a possible drawback to this error prevention strategy is that people may be less vigilant when they know there is an extra deence in place to capture their errors.)
gudance on error preventon/rs mtaton ssues to be consdered b oransatons ICAO advocates some undamental strategies aimed at error prevention, which is a orm o risk mitigation. These include:
» An open and transparent error-reporting program (not one ocusing on culpability and blame) » Human actors training provided with the specic application o error identication, capture and management » Non-jeopardy-based observational auditing programs that examine the threat and error management skills o saety-critical workers » The organisation advocating strict adherence to standard operating procedures (SOPs) and standard communication phraseology » Equipment design being human-centred » Systems to continually learn the lessons o previous occurrences » Consideration given to using automation where possible, particularly or routine and monotonous tasks relying heavily on operator vigilance.
error olrc reers to the ability o a system to accept an error without serious consequence. For example, as a strategy to prevent the loss o both engines on an aircrat involved in extended twin-engine operations, some regulatory authorities prohibit the same maintenance task being perormed on both engines prior to a fight. » Examples o measures to increase error tolerance are the incorporation o multiple hydraulic or electrical systems on the aircrat, and a structural inspection program allowing multiple opportunities to detect a atigue crack beore it reaches critical length.
Safety Management Systems
19
rs gs [sr m o orso] The risk e c n e r e f e r r t e r b o p m e u R n
• What can happen? • How can this happen?
Date: xx/xx/xxxx
20
Rs rsr Existing controls
n i d e r e t n r e e t s e t i a g D e r
Version: x
Safety Risk Management
Lo umbr
The consequences o an event happening
y t i r e v e S
d o o h i l e k i L
Form SMS 3
k s i r f o l e v e L
Additional mitigation required
Residual risk
y t i r e v e S
d o o h i l e k i L
Action and owners k s i r f o l e v e L
Monitoring and review requirements
Smpl hzrd iD Hzrd iD
Sh hdovr & u
Mitigators
Eectiveness
Reason
Further controls/ deences required
Responsibility
Shit handover procedures
No
In a manual in Bruce’s oce – nobody reads them
Hal-hour overlap between shits to allow or proper brieng, and or log to be ully completed
Cheryl Jones
Shit handover log
No
Not in central enough place – goes missing
To be transerred to hangar PC, and completed online
Cheryl Jones
Regular sta No saety meetings
Not held consistently enough
Schedule regular ortnightly toolbox meetings.
Trevor Brown (saety ocer)
Rostering
No
Not enough sta to cover the required shits
With planned growth, take on new sta
Bruce Jones
Recording
No
Ad hoc system – is only Hazard & risk register Trevor Brown & done sometimes on hangar PC. Everyone Cheryl Jones gives and receives eedback
Safety Management Systems
21
Ga jb a as sg Job and task design can contribute to system saety. Improving the design o jobs and tasks, and the workspaces in which they are perormed, can signicantly improve human perormance and reduce the potential or human error. Task design is essentially about matching the person and the task - making sure that tasks and activities are appropriate and suited to the human operator’s or team’s capabilities, limitations and personal needs. For example, tasks that involve excessive time pressure, complex sequences o operations, reliance on memory, are physically or mentally atiguing etc. are likely to have a negative impact on perormance. A typical approach may be to: 1. identiy saety-critical tasks, and those who perorm them 2. design the task objectives, sequences and actions to be perormed 3. structure the task so it supports the sae perormance by the individual or team 4. consider the working environment so it supports the sae perormance o the task 5. assess the potential risks associated with non compliance, human capabilities and limitations 6. implement risk management strategies to manage identied risks 7. evaluate saety perormance against the stated objectives.
22
Safety Risk Management
Examples o design elements that can be included are:
» procedures and rules » equipment, tools and materials » human machine interace (HMI) » inormation requirements » manning and workload » workspace » capabilities and skills required » team structures » communication links » rostering » rewards and incentives » supervision.
A sx-sp mh involving sta in safety hazard identication » To avoid accidents and incidents, any organisation should have multiple layers o controls or deences. However, controls are never oolproo – or example, having well-trained maintenance engineers does not ensure that aircrat components are always tted correctly. Standard operating procedures or fight crew are only as eective as those who ollow them. Air transport operators and maintenance organisations should regularly identiy what deences they have to contain recognised saety hazards as an early warning saety system. » To achieve this, six simple steps are suggested:
4. Evaluate the eectiveness o each deence/control 5. Identiy additional deences/controls where required 6. Record all this inormation in a hazard register. Ater completing these steps, you should have the ollowing:
» A list o saety hazards identied by employees, ranked in order o importance » A list o current controls/deences in place to manage these hazards » A list o urther controls/deences required to improve saety across the operation » Sta involvement in identiying saety deciencies and priority areas or improved risk management.
1. Identiy saety hazards across your operations that could harm people, equipment, property or the environment. 2. Rank the likelihood and severity o these hazards 3. Identiy the current deences/controls in place to manage them
Safety Management Systems
23
Haza p m Rpord b: Name: __________________________________ Position: _________________________
Subjc: [ ] Workplace hazard
[ ] Hazardous work practice
[ ] Public hazard
[ ] Aviation saety hazard
Dscrpo o hzrd d co : ____________________________________________________________________________________________ ____________________________________________________________________________________________
is urhr co rqurd? ys [ ] no [ ] Rpord o: Aviation saety ocer: _______________________________ Saety committee/rep: yes/no Reporting person’s name: ____________________________Signature: _______________________________ Date: ___________________________________
Suprvsor us ol Date report received:__________________ Action taken or recommended: ____________________________________________________________________________________________ ____________________________________________________________________________________________ Date implemented: ___________________ Name: ____________________________________________ Signature: _______________________________
24
Safety Risk Management
Safety Management Systems
25
www.asa.g.a 131 757 26
Safety Risk Management
