# Presentation: 910943

## Introduction to Safety Management Systems (SMS)

- 135 Seminar

- Elwyn Jordan, Aviation Safety Inspector

- April 18 & 19, 2007

## SMS Definitions

**AOC – Air Carrier Operating Certificate**
**AMO – Aviation Maintenance Organization**
**ATO – Aviation Training Organization**
**ASAP - Aviation Safety Action Program**** **
**FAA AVS – FAA Aviation Safety Division**
**FA Act – FAA Aviation Act of 1958**
**FOQA – Flight Operational Quality Assurance**
**ICAO – International Civil Aviation Organization**
**QMS – ISO 9000 Quality Management System**
**SASO – Systems Approach to Safety Oversight**
**SMS – Safety Management System**

## SMS Purpose and Methods

**The purpose of a safety management system is to provide a ****systematic**** way to ****control risk**** and to provide ****assurance**** that those risk controls are effective**

**Notes:**
Notice the “golden words.”
The SMS approach is systems-based
The core objective is to control risk
The SMS allows us to have greater confidence (assurance) that system risk is under control

## A Managerial Approach: ICAO view

**Safety should be approached in the same way as any other important objective – through careful, effective management**
**Safety management combines system safety and quality management (US Translation)**
- Safety Risk Management
- Safety Assurance

**Notes:**
The FAA is also a proponent of the use of modern management methods to set and meet organizational objectives.

Beginning in the Flight Standards Organization, the Office of the Associate Administrator for Aviation Safety (AVS) has achieved registration under the quality standards of ISO-9001-2000.

The SMS concept applies proven quality management methods to problems of risk control and, therefore, safety management.

## FAA Support of the SMS Concept

**U.S. Response to the Annex 6 proposal endorsed the SMS concept**
**Prior U.S. implementation of system safety-based oversight systems**
- ATOS
- SASO
**FAA (AVS) will also apply safety management concepts to oversight activities**

**Notes:**
The U.S. fully endorsed the ICAO initiative to require SMSs for holders of  air operator certificates

The FAA has long been a proponent of system safety. SMS is a means of brining system safety methods to the operator’s organization.

FAA also plans to use the same SMS principles and concepts of risk management and safety assurance to our own oversight system processes.

## ICAO Annex 6 Requirements

**“...****a safety management system acceptable to the State of the Operator that, as a minimum:**
_**identifies**_ safety _**hazards**_;
- ensures that _**remedial action**_ necessary to maintain an acceptable level of safety is implemented; and
- provides for _**continuous monitoring**_ and _**regular assessment**_ of the safety level achieved.”
*...**and, aims to make **continuous improvement** to the overall level of safety (proposed amendment)*

**Notes:**
As of January 1, 2009, “States” (governments, in our case the FAA) must have requirements for SMSs for air operators and aviation maintenance organizations. So far, only initial planning has been conducted but the FAA has stated that it intends to implement this requirement.

## Annex 6 requirements (cont.)

**“****An accepted safety management system shall clearly **_**define lines of safety**_** **_**accountability**_** throughout the operator’s organization, including a direct accountability for safety on the part of senior management.”**

## Safety and Other Business Objectives

**Safety is **_***not***_** the primary objective of any business enterprise—businesses exist to ****perform a mission**** and ****fulfill customer requirements**
**Safety ****must be managed**** like, and in conjunction with, other ****business objectives**
**An effective management system can help ****balance****:**
- Safety (Prevent injury and damage)
- Quality (Prevent delivery of defective products & services)
- Efficiency (Prevent waste)

## SMS or QMS?  SMS & QMS

**Quality Management System (QMS) requirements are based on ****customer requirements**** for products & services**
**Requirements for protective (risk management) systems such as Safety Management Systems (SMS) are based on ****objective determination of risk**
**Both types of systems should ****assure**** ****consistency**** of meeting requirements**

## Risk Acceptance

**Risk is inherent**** in aviation operations**
**Aspects of the ****environment**** and ****operational activities**** determine risk**
**Operator is responsible for risk management**** (Title 49 – FA Act)**
**A fundamental concept of risk management is ****acceptance of risk**
_**Risk management is fundamental to the SMS**_

## Role of the Regulator

**U.S. Legislation (Statutory Law) gives specific responsibilities and authority to the FAA and to operators**
**FAA is responsible for:**
- Promulgating regulations and standards
- Issuing A.O.C.s to organizations who show the ability to meet regulatory requirements
- Providing for continuing operational safety through oversight functions

**Notes:**
AOC = AIR CARRIER OPERATING CERTIFICATE
The ICAO vision of a safety program consisting of the combined efforts of the government regulator’s oversight system and the operator's SMS is also fully supported in existing U.S. safety legislation (statutory law – the FA Act as currently codified in Title 49 U.S.C.).

SMS concepts of formal systems for risk management and safety assurance will give a more systematic method of meeting these legal requirements.

Holders of A.O.C.s will be required to show initial and continuing capability to manage risk and the FAA will have a more structured method of assuring that operators have and maintain this capability.

## Role of the Operator

**Operators must meet the regulatory requirements to obtain and hold an A.O.C.**
**Operators must maintain the “highest level of safety in the public interest.”**
**A Safety Management System gives the operator’s management a structured system to meet their legal and regulatory requirements**

**Notes:**
SMS will give operators a formal means to plan, organize, direct, and control the resources necessary for successful risk management and safety assurance activities.  

At the same time, the use of a functionally-defined standard as a requirement will allow operators to tailor their management systems as much as possible into their own unique business models. The SMS standard specifies “what” functions must be incorporated into the operator’s SMS rather than “how” these requirements will be met.  

## FAA/Operator Relationship

**The FAA believes that a closer, more collaborative relationship with more sharing of information will lead to a more effective, efficient management of both FAA and operator safety responsibilities.**

**Notes:**
The Office of the Associate Administrator for Aviation Safety (AVS) is building a set of plans for an integrated safety management system consisting of safety management requirements and processes for both government and industry.

This is fully consistent with ICAO’s vision of a comprehensive safety program.

The regulator/operator relationship is envisioned as a closely coupled system that allows for the free exchange of essential safety information while maintaining clear delineation of the roles and responsibilities of both government and industry participants.

We feel that this integrated approach will facilitate a more proactive working relationship that emphasizes sharing of data.

## SMS/Oversight Relationships

- Outputs =
- Products/
- Services

**Objective: Serve customer requirements**

**Objective: Control safety risk**

- Process

- Inputs

- Operator’s Safety Management System for
- Production

_**Protection**_

_**Production**_

**Objective: Public Safety**

- Direct sampling
- (e.g. surveillance)

**SMS/Oversight Relationships**

**Notes:**
This diagram shows, at high level, the relationships between the functions of both regulator and operator/service provider participants in the safety management system.  

For certificated organizations such as Part 135, 141, and 145 organizations, their certificate oversight team or office participates in safety management through review and acceptance or approval of procedures and through surveillance.  

The FAA’s objective for the SMS concept to combine system-safety based oversight systems and operator Safety Management Systems into a cooperative relationship.  

Above this level are the safety risk management and safety assurance processes involved in maintaining the regulations, industry standards, and safety policies that are also essential components of the safety system. 

Developers (FAA and Industry) must view future regulations and their applications as risk controls that result from a detailed analysis of the hazards in the aviation system and an evaluation best ways to control risks resulting from these hazards.  

## Four “Pillars” of SMS

- 1. Risk
- Mgmt.

- 2. Safety
- Assurance

- 3. Policy:
- (Structure)

- 4. Safety Promotion:
- (Culture)

**Four “Pillars” of SMS**

|  |
| --- |

**Notes:**
The safety risk management and safety assurance pillars are the primary functional processes of the SMS.

These two pillars combine system safety and quality management into a single interactive process.

The policy pillar defines top management’s objectives and requirements (policies) and 
provides procedures to accomplish the policies and 
controls that ensure compliance with those procedures 
(procedures and controls are essential attributes in the design of robust safety systems).  

The safety promotion pillar provides processes such as non-punitive employee information and feedback systems that support a sound safety culture. The safety culture of the organization is part of the environment that surrounds the entire safety management effort.  

Organizational Culture is a set of shared values and beliefs that interact with an organization’s structures and control systems to produce behavioral norms.  

EVERY ORGANIZATION HAS A SAFETY CULTURE

Commitment to Safety, Shared Perceptions about safety, communication

Can be negative:  Discount risks, assume risks decrease over time, ignore warning signs, “Prove it is Unsafe” 

## The SMS Standard

**First FAA SMS standard was delivered on June 22, 2006 in Advisory Circular AC 120-92.**
**SMSs are currently voluntary in the United States**
**The standard is organized around the “four pillars”**
**The standard is based on an extensive review of existing SMSs around the world**
**The format of the SMS standard is similar to that of the ISO standards**

**Notes:**
The FAA, in conjunction with the U.S. Joint Planning and Development Office (JPDO), drafted a safety management standard, similar in scope and format to the ISO quality and environmental management standards as well as several third party occupational safety standards.

The FAA Flight Standards Service adapted this generic aviation service provider standard into an Advisory Circular that delivers an SMS standard for air operators. Further adaptations of the SMS standard for other types of service providers are planned.

A research and development (R&D) process preceded the standard development effort. The R&D project consisted of literature reviews of available materials and on-site interviews with both government and airline personnel in several countries.

The FAA also sought domestic industry input through a focus group associated with the R&D program, the JPDO, and the U.S. Air Line Pilots Association (ALPA).

## SMS Processes

- Safety
- Risk
- Management
- (SRM) Cl. 5

- Safety
- Promotion (Culture)
- (SP) Cl. 7

- Safety
- Assurance
- (SA) Cl. 6

- Policy
- Cl. 4

- Risk
- Analysis

- Risk
- Assessment

- Risk
- Control

- Data

- Analysis

- Prevention & Corrective Action

- Communication

- Training

- Procedures

- Process
- Controls

- Audits
- Invest.
- Reports

- Assessment

- Hazard
- Recognition

- System
- Description

**Notes:**
This diagram breaks the four pillars down into an additional level of detail as expressed in the AC (AC 120-92).

## Integration with Existing Programs

**Current SMS standard is aligned with existing FAA AC 120-59A *****Internal Evaluation Programs***
**The standard is designed to be compatible with other voluntary programs such as ASAP and FOQA**
**Future SMS development will establish commonality of oversight system and SMS practices and tools**

**Notes:**
Another objective of the FAA’s SMS development process is to use it as an integrating mechanism – a “backbone” – for existing voluntary safety programs.

In some instances, these voluntary programs can be integrated directly into the SMS as components (e.g. Internal Evaluation Programs (IEPs)), as optional means of meeting SMS standard requirements (e.g. Aviation Safety Action Programs (ASAP)), or as optional accessories to further enhance the integrated SMS (e.g. Flight Operational Quality Assurance (FOQA) programs – which are voluntary in the U.S.

## Examination of Existing Regulations

**FAA is evaluating current and anticipated conditions, and current regulations, standards, and policies to determine the need changes to the regulations**
**The FAA will develop new guidance material and training courses throughout 2007-2008**

**Notes:**
IN order to meet the ICAO scheduled implementation date for SMS requirements (Jan 1, 2009), the FAA is currently reviewing its existing set of regulatory documents and programs to determine what additional requirements, if any will be needed to support SMS implementation.

## Rulemaking Effort

**Rulemaking Project Record (RPR) opened Sep/Oct 2006**
**Rulemaking Project Team assigned Dec 2006**
**Proposed strategy:**
- Align regulations within ICAO
- Draft acceptance criteria (similar to present voluntary standard) in policy documents
- Set implementation milestones in regulatory language

## Proof of Concept

**A set of proof of concept trials will commence in 2007**
**These trials will consist of voluntary SMS development and interface with oversight systems**
**The purpose is to gather data to be used in further development of guidance material, risk management and audit tools, and implementation strategies**

**Notes:**
During the next two years, the FAA will conduct a series of proof of concept trials of voluntary SMSs.

Several sizes and types of operators and other service providers will work with the FAA in voluntary SMS implementation.

Data will be collected across the group of participants in order to better refine final requirements and methods.

## Proof of Concept (continued)

**Three projects are being conducted under a single Proof of Concept Master Plan**
- Part 121 Commercial Aviation (AFS-900 Lead)
- General Aviation and Air Taxi (FAAST Lead)
- Maintenance Organizations (Joint Lead)
**Master Plan will be used by the Steering Committee to coordinate projects and:**
- Track lessons learned
- Coordinate Orientation and Outreach

## SMS Implementation

**Implementation should follow a phased approach**
**The processes underlying the four pillars will be modularized**
**Growth and increasing maturity will then be emphasized for each process and the system as a whole**
**Maturity model similar to Capability Maturity Model (CMM) used in software and systems development and management**

**Notes:**
A phased implementation is currently favored to allow SMS programs to be built incrementally, starting with basic processes and growing both in terms of additional processes as well as the level of sophistication of those processes until the full intent of the SMS standard is met.

This methodology is similar to the model that was developed by the Carnegie-Mellon University for software and systems development activities.

## SMS Maturation Process (Notional)

- SMS Maturation Process (Notional)

**Notes:**
Here is a notional view of an SMS maturity model. On the upper side, the attributes related to the technical processes of the operator (e.g. processes for flight ops, maintenance, training, etc) are shown. On the lower side of the diagram, the SMS capabilities are developed. The maturity of the SMS and, therefore, the dependence on it for safety management grows in each step.

For example, at step two, the carrier has the capability to react in a positive manner to problems discovered in their operations but may not be fully able to take a proactive stance. To do this, they must have fully developed procedures and controls for Aviation Safety activities.

They must also have data repositories and processes developed to collect and process incident data and to document corrective actions. As the mature, these data systems will be used in increasingly proactive roles.

It will be necessary to design specific criteria to validate attainment of these criteria for advancement out of each step and into the next. These criteria will then be continuously monitored by the FAA as part of the oversight process.

## Safety Management in AVS

**The Aviation Safety Division (AVS) intends to employ the four pillars of safety management in the oversight process.**
**Consistent with ICAO “managerial approach” and “safety program”**

## Critical Elements of Oversight (ICAO)

**Primary ****legislation**
**Specific operating ****regulations**
**State ****civil aviation system**** and safety oversight functions**
**Tech personnel ****qualifications and training**

**Tech ****guidance****, tools, and provision of safety critical ****information**
**Licensing, ****certification****, authorization, and approval obligations**
**Surveillance**** obligations**
**Resolution**** of safety concerns**

## “Carelessness and overconfidence are more dangerous than deliberately accepted risk”Wilbur Wright, 1901

**Notes:**
As we pointed out at the beginning of this briefing, the Wright brothers recognized the need for risk management. This quote from Wilbur Wright, written two years before the famous powered flight on December 17, 1903 exemplifies the Wrights’ attitude. It is clear that their attitude toward risk management was a key element in their ultimate success.

## 1935 Federal Aviation Commission Study

*“**It seems to us in any case  unreasonable to expect that governmental responsibility should extend to the provision of a minute and detailed inspection system in every [operation]....”  “To superpose a governmental inspection on [an operator’s] own is to increase the costs and to encourage the manufacturer to transfer the responsibility to government by slacking off on his own supervision.” *

## 1935 Federal Aviation Commission Study

*“**We believe that the aim should be to encourage [operators] to exert the largest possible measure of control over their own [operation] in the interest of their own reputation, and that where there is adequate evidence of a proper sense of responsibility and a proper control system the government is justified in relaxing its own supervision.” *