40TH ANNUAL CONFERENCE, Geneva, Switzerland, 19-23 March 2001WP No. 157Safety Management Systems (SMS) |
Introduction
The inexorable increase in air traffic throughout the world, year on year, has focussed attention on aviation safety in general, and ATM safety in particular. The perceived wisdom is that if the current safety level remains constant and traffic increases continue as projected then the number of accidents will reach unacceptable proportions. Consequently, there is an overriding requirement to improve safety levels.
Related to this overall safety concern is the fact that there is an increasing number of ATM providers being commercialised or privatised. This process has identified the further safety requirement that the functions of ATM provision and ATM safety regulation should be totally separate entities and completely independent of each other’s role and structure.
These two factors combined with the increasing globalisation and complexity of the ATM/CNS system have lead ICAO and Eurocontrol to the conclusion that it is necessary to mandate the introduction of Safety Management Systems for ATM providers by the year 2003.
This paper, relying on the UK application and experience of SMS, will consider the function and structure of a SMS for ATM and outline the issues that will impact on controllers as a result of SMS implementation.
Discussion
In the 1980’s, there were a number of highly publicised disasters ranging from Bhopal in India, Challenger in the US, Herald of Free Enterprise and Piper Alpha in the UK. Also, two particular transport accidents in UK at Clapham and Kings Cross raised major issues about public safety. All these disasters, with heavy loss of life in some cases, had a common thread connecting them. This was that “management failure” was cited as a significant contributory cause (factor(s) which made the accident more likely to occur). The resulting reports and investigations lead to the conclusion that safety was an issue that had to managed in the same way as other aspects of business. Within ATM, it has been acknowledged that risk is ever present and cannot be eliminated unless you ground all the aircraft! The acceptance of this fact has identified that risk in the ATM/CNS system must be reduced to a level that is “as low as is reasonably practicable”. The purpose of a Safety Management System is to provide an ATM provider with a management tool, which will ensure a systematic approach to safety throughout the whole ATM organisation.
Before continuing, it is worth considering the risk within ATM. The primary threat, particularly in the public’s eyes, is that of a mid air collision. The provision of a safe ATC service is governed by the requirement to meet established mandatory levels of safety such as separation minima, aircraft performance and equipage to ensure that the system meets an agreed target level of safety. However, this in itself does not guarantee that the system is immune from the possibility of an accident because we have to consider how the safety requirements and standards are applied and the competence of those applying them. Also, mid air collisions are not the only risk that exists within the ATM system: CFIT, runway incursions, and collision with vehicles or aircraft on the ground are examples of the risks that have to be mitigated to ensure that loss of life does not occur. So far, the safety track record for the ATM system has been good but the levels of traffic are increasingly at such a rate that demand continues to outstrip capacity thus placing the issue of system safety high on the agenda. Arguably, it could be said that in the past, the safety of the ATM system remained very much in the operational orbit and that the buck stopped with the controller or the pilot. Hence the very emotive issues that arise from the conclusions of the accident investigations concerning pilot or controller error. However, it is being recognised in many quarters that ATM system safety involves the organisation as a whole and not just the front line operators. This introduces the second important point about SMS and that is the encouragement and development of a safety culture throughout the ATM organisation starting at the highest executive level.
Safety culture is a philosophy that impacts on the successful implementation of the SMS. The following is an excellent definition of safety culture:
“The safety culture of an organisation is the product of individual and group values, attitudes, perceptions, competencies, and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organisation’s safety management.
Organisations with a positive safety culture are characterised by communications founded on mutual trust, by shared perceptions of the importance of safety and by confidence in the efficacy of preventive measures”
The rationale for the introduction of the SMS is that the prime responsibility for the safety of the ATM service rests with the service provider. Within the overall management of the service, the ATM provider has a responsibility to ensure that all the relevant safety issues have been satisfactorily dealt with, and to provide assurance that this has been done. In general terms, an effective SMS will contain the following key elements:
a) Policy
b) Organising
c) Planning and Implementing
d) Measuring Performance
e) Reviewing Performance
f) Auditing of the above elements
Policy statements define the components of an organisation’s SMS. They can be considered as a hazard checklist for identifying any potential risks of management failures causing or contributing to an accident. The following should be borne in mind:
a) Almost all activities or initiatives to maintain or improve an organisation’s safety performance can be accommodated within the policy statements.
b) In the development of an SMS designed to manage all the risks associated with ATM, it needs to be constantly borne in mind that the risks being managed are those associated with causing or contributing to an aircraft accident.
Examples of a SMS Policy Statements could be as follows:
a) A statement of intent about maintaining or improving current safety performance.
b) A statement of intent to minimise the risks of an accident occurring – probably with the “as far as is reasonably practical” caveat.
c) A statement of intent to implement an effective formal safety management system.
d) A statement about the priority ascribed to flight safety relative to commercial, operational, environmental and working practice pressures.
e) A statement about compliance with safety standards and regulatory requirements.
f) A statement about individual and management responsibility for safety performance.
g) A statement about ensuring sub-contractors meets the organisation’s standards and requirements.
Organising
One of the aspects of a formal SMS is that it is essentially a set of rules and guidance that are documented to ensure traceability, standardisation, and communication. It is likely that a Safety Management Manual would be produced promulgating an organisation’s SMS Policy and Principles, senior managers’ safety accountabilities and procedures derived from the P&Ps that are common to the whole organisation. In addition to these safety accountabilities and responsibilities being defined, structures and processes are needed which:
a) establish and maintain management control within the organisation;
b) secure co-operation between individuals and those with specific safety responsibilities;
c) ensure communication throughout the organisation;
d) secure the competence of individuals.
Planning
Planning is essential for the implementation of safety policies. Adequate control of risks can only be achieved through the co-ordinated action by all members of the organisation. An effective planning system for safety requires the ATM provider to establish a SMS which will control risks, react to changing demands, and sustains a positive safety culture. It is within part of SMS that processes such as hazard identification and risk management will be defined, safety analysis and safety surveys will be undertaken, and the establishment of training and competency schemes are achieved.
Measuring Performance
Measurement is essential to maintain and improve safety performance. There are two ways to generate information on performance:
a) active systems which monitor achievement of plans and the extent of compliance with standards and requirements;
b) reactive systems which monitor accidents and incidents.
Effective procedures are needed to capture both sorts of information. The SMS should ensure that methods are in place to detect changes in systems or operations which suggest any element is approaching a point at which acceptable standards of safety can no longer be met and that corrective action has to be taken. Equally, a comprehensive incident/accident investigative procedure should be in place to ensure immediate response and that any necessary corrective action is taken. Another valuable tool in monitoring performance is trend analysis, which should be a required SMS procedure.
Reviewing Performance
The SMS should incorporate within its structure processes for the review of performance. The ATM provider can set performance indicators as a measure, which are subject to a periodic review or detail other processes to examine performance such as auditing. The purpose of reviewing performance is to ensure that the ATM provider can maintain and improve his ability to manage risks by learning from experience from the use of performance reviews and audits.
Auditing
The ATM provider should include a process for internal auditing within the SMS. However and in addition, the SMS should be subject to external auditing by the Safety Regulator. The prime objective of the external audit is to provide assurance to the regulator that the ATM provider is providing a safe ATM service through the appropriate application of the SMS and national regulatory requirements. To achieve this, the auditor will undertake “a structured process of collecting independent information on the efficiency, effectiveness, and reliability of the total safety management system and, in partnership with the ATM Provider, drawing up plans for corrective action”.
Implications for Controllers
The introduction of SMS will require the participation of all personnel within an ATM organisation. The holistic approach covers three important elements: people, procedures, and equipment. There is an obvious inter-relationship between all three and it is a function of the SMS to encompass the interaction of these elements. The safety accountabilities and responsibilities of individuals within the organisation cascade down so that executive and operational positions will be identified with certain responsibilities. An important by-product of this structure is to eliminate internal divisions such as those that may exist between management and operational staff or controllers and technicians. Many of the processes that are inherent in a SMS such as Safety Surveys, Hazard Analysis and Risk Management, and Safety Improvement require operational experience and judgement. The experience within UK units employing SMS indicates that there is a high level of controller and technician participation in all these processes – indeed without it, the SMS would not function properly. However, it should be emphasised that appropriate training for operational personnel in the various aspects of Safety Management Systems is essential so that the maximum benefit is extracted from that operational experience.
Health Warning
The fact that an ATM Provider has a SMS in place does not by its existence guarantee that safety standards will be maintained. The requirement is that the ATM organisation is committed to safety at the highest level from the Chief Executive to ensure that the right attitude is implanted at all levels creating a positive safety culture. Lip service from the top or a suggestion that the SMS is in place to protect senior management from responsibility for accidents or incidents will create an atmosphere of distrust and a lack of commitment from the staff. Also, by the very nature of the requirement to document all procedures, there is always a concern that the SMS will become over bureaucratic and disappear under the weight of its own administration. In doing so, it would inevitably lose the support of the operational staff. These are concerns that can be properly monitored by the MA or by individuals.
Conclusion
Eurocontrol, through the approval of ESARR 3 (Eurocontrol Safety Regulatory Requirement), has mandated that all providers of ATM services within the ECAC states shall introduce Safety Management Systems by 2003. The next amendments of Annex 11 and PANS-RAC (Doc 4444) will introduce SARPs providing for the implementation of ATS safety management programmes by the contracting states. These SARPs will come into effect on 27 November 2003.
Introduced correctly and in a pro-active manner, Safety Management Systems will, through the implementation of policies, principles, and processes, furnish ATM providers with a powerful tool to ensure that the risks inherent in the ATM system are contained to level which is as low as reasonably practical. Furthermore, IFATCA should support the global introduction of SMS because it encourages controller participation in all aspects of the ATM operation and the accompanying positive safety culture. In this acceptance of SMS, IFATCA should also be cognisant of the negative aspects that can manifest themselves if the ATM provider does not apply the policies and principles in the appropriate and proactive manner.
Recommendation
It is recommended that:
IFATCA supports the introduction of Safety Management Systems (SMS) for the purpose of ensuring a systematic approach to the reduction of risk within the ATM system.
ATM providers should be encouraged from the outset to utilise the available operational expertise already existing within their organisations when developing SMS.
ATM providers should make available training in safety related subjects such as hazard analysis and risk assessment for selected operational personnel to maximise the effectiveness of the SMS processes.
References
Systematic Safety Management in Air Traffic Services: Richard Profit, Euromoney Publications 1995.
ESARR 3: Use of Safety Management Systems by ATM Service Providers 2000 Successful Health and Safety Management: HSE Books 1997.
Guidance for Developing and Auditing a Formal Safety Management System: UK CAA SRG 2000.
The Management of Safety: UK CAA SRG 1998.
Last Update: September 29, 2020