1.5 When reference is given to ‘the manual’ or ‘this manual’ it is directly referring to the SMM. When reference is given to ‘chapter’ it is referring to chapters contained within the manual.

“Note — Guidance on safety programs and on defining acceptable levels of safety is contained in the ICAO Safety Management Manual (Doc 9859)”

2.1.4  As stated earlier, the purpose of the SMM is to support States with implementation of these new provisions. It has been based on ‘world’s best practise’ with the world’s leading experts on safety.

2.1.5  Application of this guidance material was never intended for the limited use of operational personnel but is relevant to the full spectrum of stakeholders in safety, including senior management.

2.1.6  This material, while very complex in nature, is aimed at those people who are responsible for the design, implementation and management of safety. Specifically;

a) Government officials with responsibilities for regulating the aviation system;

b) Management of operational organizations, such as operators, Air Traffic Service (ATS) providers, aerodromes and maintenance; and

c) Safety practitioners, such as safety managers and advisers.

2.1.7 The manual is not intended to be prescriptive but to provide philosophy, principles and practises for organisations to develop an approach to safety management.

The manual is not designed to be read from cover to cover but to help provide States with guidance at any particular stage, applicable to the State, in the implementation of their ’Safety Management System’.

As discussed earlier, the manual has been established with a broad range of potential audience members in mind. While ‘Safety Management’ has been a part of ATC operations for many years, it has not been in isolation and would be argued could not exist in isolation. It is, therefore, with careful appreciation we assess the information included in the manual.

2.2 Safety Management Manual Structure

2.2.1  The basic structure of the SMM is similar in design to many other reference manuals.

2.2.2  In part one it introduces the concept of ‘Safety’ and ‘Safety Management’ including the responsibility of ‘Managing Safety’ and the ‘State Safety Program’.

2.2.3  Part two is on ‘The Management of Safety’ and looks at the concepts of understanding safety; the basics of risk management; hazard and incident reporting; safety investigations; safety analysis and safety studies; safety performance monitoring and emergency response planning.

2.2.4  Part three looks at ‘Safety Management Systems’ and includes a detailed look at establishing these by safety assessments; safety auditing, and an in depth look at the ‘Practical Considerations for Operating a Safety management System’ which details the role of a ‘Safety Office’ and the training and promotion of safety information.

2.2.5  Part four is titled ‘Applied Safety Management’ and introduces specific detail in relation to industry specific needs. This includes aircraft operations; Air Traffic Services; aerodrome operations and aircraft maintenance.

2.3.1.1 Applying safety related principles in a dynamic ATC environment is a challenging prospect. The delicate balance of maximum traffic throughput with required safety, happens with the correct balance of human factors with automation and technology.

2.3.1.2  The ‘future capacity demand’ presents an enormous challenge for those associated with managing safety. This will be especially evident with the required changes to systems, procedures and technology essential to allow this increase. The complexity of ATC in the management of multiple runways and approach paths, environmental constraints, sovereign and international military requirements and the ever increasing demands of security of aircraft operations will only be managed with an increase in the capacity of managers, supervisors and line personnel to understand the human elements of safety and its application.

2.3.1.3  This can be further complicated by the changes to the way that States may structure themselves internally; this can include ‘corporatising’ the ATC business or managing airspace which is not sovereign to the country beneath it (Air Services Australia with Honiara; or the expected Functional Airspace Blocks (FABs) in Europe).

2.3.1.4  The business like approach taken by many ANSP’s has driven a desire for capacity increase. This desire for technological improvements to capacity has renewed interest in safety, understanding that without safety there is no ATC business. Likewise the ‘philosophy’ of managing the acceptable risk of this increased capability has also changed with a pro-active (not just regulatory driven) mindset in the application of safety.

2.3.1.5  Safety in ATS requires a systematic approach to safety management and today’s ATS systems provide multi-layered defences, through things as:

a)  Rigid selection criteria and training for controllers;

b)  Clearly defined performance standards, such as separation criteria;

c)  Strict adherence to proven Standard Operating Procedures (SOPs);

d)  Significant international co-operation;

e)  Utilization of technological advances; and

f)  Continuing system of evaluation, monitoring and improvement.

2.3.2 ICAO Requirements

2.3.2.1. ICAO Air Traffic Services Annex 11 requires that Air Traffic Service Providers (ATSPs) implement an approved safety management system to ensure safety in the provision of ATS. Such a safety management system shall ensure that actual and potential hazards can be identified, necessary remedial actions implemented and that continued monitoring ensures that an acceptable level of safety is being achieved.

2.3.2.2 ICAO PANS ATM Doc 4444 provides guidance for safety management in ATS. Inter alia, safety management in ATS should include the following:

a)  Monitoring of overall safety levels and detection of any adverse trends;

1) Collection and evaluation of safety-related data;

2) Review of incident and other safety-related reports.

b)  Safety reviews of ATS units;

1) Regulatory issues;

2) Operational and technical issues;

3) Licensing and training issues.

c) Safety assessments in respect of the planned implementation of airspace reorganization, the introduction of new equipment, systems, or facilities, and new or changed ATS procedures; and

d) Mechanisms for identifying the need for safety-enhancing measures.

2.4.1.3  In order to determine what ‘an acceptable level of safety’ is, it is first necessary to decide on an appropriate safety performance indicator, and then to decide on what represents an acceptable outcome. The safety performance indicator chosen need to be appropriate for the application. Typical measures which could be used in safety management in ATS include:

a)  Maximum probability of an undesirable event, such as collision, loss of separation or runway incursion;

b)  Maximum number of incidents per 10,000 aircraft movements;

c)  Maximum acceptable number of separation losses per 10,000 trans-Atlantic crossings; and

d)  Maximum number of short-term conflict alerts (STCA) per 10,000 aircraft movements.

2.4.1.4  Safety indicators derived from the maximum number of accidents would not be a fair indication as these are rare events. What are to be investigated are the inherent factors of an ATC system that may be ‘ripe for an accident’. Often the incident rate(s) for many associated outcomes may be more useful indicators, understanding that the information gathered is only as good as the reporting systems that support this.

2.4.1.5  This is why the establishment of correct procedures in the collection and analysis of this vital information has been fully supported by IFATCA with a major emphasis on the establishment of a ‘just culture’. This is supported by further information in Chapter 4 (Understanding Safety) and the limitations on the use of this data from voluntary incident reporting systems in Chapter 7 (Hazard and Incident Reporting).

2.4.2 Risk Management

2.4.2.1  Risk management is defined as:

“The identification, analysis and elimination (and/or mitigation to an acceptable or tolerable level) of those hazards, as well as the subsequent risks that threaten the viability of an organization.”

2.4.2.2  The risk management process commences with the identification of hazards. These can be derived from many sources including system design, procedures and operating practices, communication, personnel and organizational factors, work environment etc.

2.4.2.3  In a mature safety management system, hazard identification should arise from a variety of sources as an on-going process. However, there are times as an organization that special attention to hazard identification is warranted. Safety assessments (Chapter 13) provide a structured and systemic process for hazard identification when:

a)  There is an unexplained increase in safety-related events or safety infractions;

b)  Major operational changes are planned, including changes to key personnel, or other major equipment or systems, etc.;

c)  The organization is undergoing significant change, such as rapid growth or contraction; or

d)  Corporate mergers, acquisition or downsizing is planned.

2.4.2.4  Risk assessment is the backbone of the analytical approach required to assess these hazards. This includes establishing the ‘probability of the hazard’, the ‘severity of the potential adverse consequences’ and the ‘rate of exposure to the hazard’. In other words it is the ‘loss potential’, established by the probability and severity of the potential outcome. This can be complex in its application both in the development of a matrix (to cross reference the probability and the severity of the hazard) and its consistent use.

2.4.2.5  Whatever methods are used, there are various ways by which risks may be expressed. For example:

a)  Number of deaths, loss of revenue, or loss of market share (i.e..absolute numbers);

b)  Loss rates (e.g. number of fatalities per 1,000,000 seat miles flown);

c)  Probability of serious accidents (e.g. 1 every 50 years);

d)  Severity of outcomes (for example, injury severity); and

e)  Expected dollar value of losses vs. annual operating revenue (e.g. $1 million loss per $200 million revenue).

2.4.2.6  The risk acceptability will be determined by the resultant of the matrix (as referred to in paragraph 2.4.2.4 and see example below). This acceptability will then be managed by policy determined by the user. This may determine who can be responsible for this risk (line manager, centre manager or SM) this will also provide an accountability link for the process.

2.4.3.2  There are many different reporting systems that go to improve the overall safety of a system. These include:

• Mandatory incident reporting systems: These are where employees are required to report certain occurrences. This necessitates detailed regulation into what should be reported and how this will be done. Often resulting in “if in doubt – report it”.
• Voluntary incident reporting systems: ICAO Air Traffic Services Annex 11 recommends States introduce this type of reporting. This is where there may be an incentive to report, i.e. that no enforcement action be taken for unintentional violations that are reported.
• Confidential reporting systems: These systems aim to protect the individual reporting the incident. This is by de-identifying the person and returning any information that may have identified them, keeping no record of this. This information is often used to collect data on human error and can be used to serve the wider community by gaining insight into areas that otherwise may not have been known.

2.4.3.3  The philosophy of structured ‘reporting systems’ may certainly be a requirement for modern ATS safety systems, but to make these work effectively you need to have the following ingredients:

• Trust: This trust relates not only to voluntary reporting systems but also relates to mandatory. This trust comes in the form of a ‘fair and equitable’ approach to the management of these reports, allowing the ‘system’ to be trusted.
• Non-Punitive: This relies on being ‘confident in the confidence’ and knowing that there is structure in place to allow a ‘positive flow of negative information’.
• Inclusive reporting: While knowing one side of the story will give you some answers, knowing all sides of the story will give the investigator all the answers.
• Independence: Experience has shown that ‘voluntary reporting’ benefits from a trusted ‘third party’ managing this system. Away from the administration that is responsible for the enforcement of the regulations.
• Ease of reporting: The availability of forms and the simplicity in their detail, allowing for straightforward entry and completion.
• Acknowledgement: As they take time and honesty by the individuals reporting, they also require appropriate acknowledgement.
• Promotion: the information gathered in reporting systems needs to be for the wider community and must be promulgated appropriately and used to benefit others.

2.4.4 Emergency Response

2.4.4.1 ATS personnel must be prepared to continue to provide services through all circumstances including such events as after an accident, a power or communication failure and security threats etc. Emergency procedures must be in place to guide operations without further compromising safety. This requires an emergency response plan. This should be a collaborative plan between management and operational personnel who will have to execute it, in particular the controllers. Procedures must be in place and regularly tested to ensure the continued provision of services – perhaps at a degraded level.

3.4 In review of current IFATCA policy, the SMM supports many of the ideals and strategies that have been placed in the IFATCA Manual over the last few years. While most of the current IFATCA policy may be supported by the SMM, ICAO PANS-ATM Doc 4444 and the changes to ICAO Air Traffic Services Annex 11; not all of the policy intent is covered. This will result in part of the policy being eligible for deletion but more importantly the need for policy to be amended.