PROTECTING DATA COLLECTED FOR SAFETY PURPOSES ICAO · volume 61 number 6, 2006 icao journal...

V O L U M E 6 1 NUMBER 6 , 2006

ICAOJ O U R N A L

PROTECTING DATA COLLECTED FOR SAFETY PURPOSES

GLOBAL APPROACHUNLOCKS POTENTIALOF SMS

SAFETYMANAGEMENT

38701.P1 12/7/06 9:35 PM Page 1

38701.P2 12/7/06 9:35 PM Page 2

NOVEMBER/DECEMBER 2006VOL. 61, NO. 6

ICAO JournalThe magazine of the International Civil Aviation Organization

FEATURES

6 Initiative promotes a global approach to SMS implementationWith an emphasis on achieving worldwide implementation, ICAO’s initial effortsto foster safety management have focused on the development of new regulatoryprovisions, guidance material and a special training programme …

9 Concept of safety management system embraced by many countriesIn the United States, a newly issued SMS standard for use by air operators is the product of extensive research and collaboration involving industry,labour and government safety regulators …

14 Business model focused on risk management enhances decision-makingTransport Canada’s adoption of a business model for managing its safetyprogramme evolved out of recognition that aviation safety is best served byanalysing and controlling the risks …

18 Airport operator espouses practical approach to safety managementOne strategy for ensuring success is to implement a basic safety managementsystem in stages and gradually win over the trust of operating personnel andmanagement …

22 Implementation of ATM safety management systems remains priority for EuropeCentral to Europe’s efforts to improve ATM safety is the widespread promotion of the principles of safety management …

26 Guidance material addresses concerns about protection of safety dataLegal guidelines developed recently by ICAO focus on enactment of nationallaws and regulations that safeguard data collected for safety purposes while also allowing for justice to take its course …

29 Information gleaned from recent accidents provides basis for improvementsFinal reports issued by investigation authorities, plus a safety alert arising from the August crash of a regional jet transport, serve the aviation communityby underscoring various safety issues …

UPDATE31 ICAO addresses security concern raised by failed terrorist plot

• SMS implementation leads to safety enhancement despite strong industry growth• Pandemic influenza guidelines now available at website• ICAO and the Republic of Korea announce training programme• Symposium puts spotlight on ATM safety• Experts to discuss performance framework for air nav system

COVER (Photo by R. Ian Lloyd/Masterfile)

Several of the feature articles in this issue are dedicated to the topic of safetymanagement systems, a tool that provides performance-based approaches to the management of safety. Under ICAO provisions that took effect in November2006, airport operators, aerodrome operators, ATS providers and maintenanceorganizations worldwide are required to implement such systems.

WWW.ICAO.INT

THE ICAOCOUNCIL

PresidentROBERTO KOBEH GONZÁLEZ

1st Vice-PresidentI. M. LYSENKO

2nd Vice-PresidentDr. A. SIPOS

3rd Vice-PresidentJ. E. ORTIZ CUENCA

SecretaryDr. TAÏEB CHÉRIFSecretary General

Argentina – D. O. Valente

Australia – S. Clegg

Austria – S. Gehrer

Brazil – P. Bittencourt de Almeida

Cameroon – T. Tekou

Canada – L. A. Dupuis

Chile – G. Miranda Aguirre

China – T. Ma

Colombia – J. E. Ortiz Cuenca

Egypt – S. Elazab

Ethiopia – T. Mekonnen

Finland – L. Lövkvist

France – J.-C. Chouvet

Germany – Dr. K. Kammann-Klippstein

Ghana – K. Kwakwa

Honduras – A. Suazo Morazán

Hungary – Dr. A. Sipos

India – Dr. N. Zaidi

Italy – S. Monti

Japan – H. Kono

Lebanon – H. Chaouk

Mexico –

Mozambique – D. de Deus

Nigeria – Dr. O. B. Aliu

Pakistan – M. Rauhullah

Peru – J. Muñoz-Deacon

Republic of Korea – G. Shin

Russian Federation – I. M. Lysenko

Saint Lucia – H. A. Wilson

Saudi Arabia – S. A. R. Hashem

Singapore – K. P. Bong

South Africa – M. D. T. Peege

Spain – L. Adrover

Tunisia – M. Chérif

United Kingdom – M. Rossell

United States – D. T. Bliss

38701.P3 12/7/06 9:47 PM Page 3

ICAO JOURNAL4

Editor: Eric MacBurnie Production Clerk: Arlene BarnesEditorial Assistant: Regina Zorman Design Consultant: François-B. Tremblay

THE OBJECTIVES of the Journal are to provide a concise account of theactivities of the International Civil Aviation Organization and to featureadditional information of interest to ICAO Contracting States and the inter-national aeronautical world. Copyright ©2006 International Civil AviationOrganization. Unsigned and Secretariat material may be reproduced in fullor in part provided that it is attributed to ICAO; for rights to reproduceother signed articles, please write to the editor.

OPINIONS EXPRESSED in signed articles or in advertisements appearing inthe ICAO Journal represent the author’s or advertiser’s opinion and do notnecessarily reflect the views of ICAO. The mention of specific companies orproducts in articles or advertisements does not imply that they are endorsedor recommended by ICAO in preference to others of a similar nature whichare not mentioned or advertised.

Published in Montreal, Canada. Second class mail registration No. 1610. ISSN1014-8876. Date of publication of Issue 6/2006: 13 December 2006. Publishedsix times annually in English, French and Spanish.

SUBSCRIPTIONS: $40 per year (Order No. 3101-A). Single copies availablefor $10 (Order No. 310019). Prices in U.S. funds. For subscription andcirculation inquiries, please contact ICAO Document Sales Unit.Telephone: +1 (514) 954-8022; Facsimile: +1 (514) 954-6769; E-mail:[email protected]. Important Note: The current issue may be viewed in PDFformat without delay at ICAO’s website (http://icao.int/icao/en/jr/jr.cfm).Issues dated 2005 or earlier are viewable using the downloadable DjVureader. Planned publication dates for 2007 are 16 February, 23 April,15 June, 13 August, 14 September and 20 December.

ADVERTISING REPRESENTATIVE: Yves Allard, FCM Communications Inc., 835Montarville St., Longueuil, Quebec, Canada J4H 2M5.Telephone: +1 (450) 677-3535;Facsimile: +1 (450) 677-4445; e-mail: fcmcommunications@ videotron.ca.

EDITORIAL OFFICE: International Civil Aviation Organization, 999 Univer-sity St., Room 1205, Montreal, Quebec, Canada H3C 5H7. Telephone:+1 (514) 954-8222; Facsimile: +1 (514) 954-6376; e-mail: [email protected].

GRAPHIC ART/DESIGN: Bang Marketing (www.bang-marketing.com).

PRINTING: Transcontinental-O’Keefe Montreal (www.transcontinental-printing.com).

ICAO HEADQUARTERS: 999 University St., Montreal, Quebec, Canada H3C 5H7.Telephone +1 (514) 954-8219; Facsimile +1 (514) 954-6077; e-mail: [email protected].

www.icao.int VISIT ICAO’s website for a wealth of information includingpast issues of the ICAO Journal, information on advertising in ICAO’s maga-zine, the latest news releases, a complete listing of ICAO publications andaudio visual training aids, the ICAO aviation training directory, Secretariat jobvacancies, technical cooperation project postings, and much more.

ICAO PUBLICATIONS: The Catalogue of ICAO Publications and Audio-VisualTraining Aids contains a list of all document titles as well as abstracts andindicates the availability of language versions. The catalogue is issued annu-ally in hard copy. Monthly supplements list new publications and audio-visual training aids as they become available, as well as amendments andsupplements. Most ICAO publications are issued in English, French,Russian and Spanish; Arabic and Chinese are being introduced on a gradualbasis. (The most efficient way to order an ICAO publication is online athttp://www.icao.int using VISA or Mastercard. All transactions conducted onthis server are encrypted and secure.)

ICAO ESHOP (www.icao.int/eshop): eSHOP is a commercial website offeringonline access to ICAO documentation for an annual fee. A subscription givesaccess to the full texts of international conventions and protocols, all annexesto the Convention on International Civil Aviation (the Chicago Convention),publications pertaining to air traffic management, and the annual reports ofthe ICAO Council.

DGCA DIRECTORY: ICAO has developed an electronic database of informationon national civil aviation administrations from around the world. The Directoryof National Civil Aviation Administrations (Document 7604) is continuouslyupdated, based on information received from ICAO’s 189 Contracting States.The online directory is available through ICAO’s website at an annual subscrip-tion fee of U.S. $150. For further information, please contact the DatabaseAdministrator ([email protected]).

ICAO Journal

AfghanistanAlbaniaAlgeriaAndorraAngolaAntigua and BarbudaArgentinaArmeniaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBhutanBoliviaBosnia and

HerzegovinaBotswanaBrazilBrunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCentral African

RepublicChadChileChinaColombiaComorosCongoCook IslandsCosta RicaCôte d’IvoireCroatiaCubaCyprusCzech RepublicDemocratic People’s

Republic of KoreaDemocratic Republic

of the Congo

DenmarkDjiboutiDominican RepublicEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFijiFinlandFranceGabonGambiaGeorgiaGermanyGhanaGreeceGrenadaGuatemalaGuineaGuinea-BissauGuyanaHaitiHondurasHungaryIcelandIndiaIndonesiaIran (Islamic

Republic of)IraqIrelandIsraelItalyJamaicaJapanJordanKazakhstanKenyaKiribatiKuwaitKyrgyzstanLao People’s

Democratic RepublicLatviaLebanonLesothoLiberiaLibyan Arab

Jamahiriya

LithuaniaLuxembourgMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall IslandsMauritaniaMauritiusMexicoMicronesia

(Federated States of)MonacoMongoliaMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew ZealandNicaraguaNigerNigeriaNorwayOmanPakistanPalauPanamaPapua New GuineaParaguayPeruPhilippinesPolandPortugalQatarRepublic of KoreaRepublic of MoldovaRomaniaRussian FederationRwandaSaint Kitts and NevisSaint LuciaSaint Vincent and

the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi Arabia

SenegalSerbiaSeychellesSierra LeoneSingaporeSlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSpainSri LankaSudanSurinameSwazilandSwedenSwitzerlandSyrian Arab RepublicTajikistanThailandThe former Yugoslav

Republic of Macedonia

Timor-LesteTogoTongaTrinidad and TobagoTunisiaTurkeyTurkmenistanUgandaUkraineUnited Arab EmiratesUnited KingdomUnited Republic

of TanzaniaUnited StatesUruguayUzbekistanVanuatuVenezuelaViet NamYemenZambiaZimbabwe

ICAO Headquarters

999 University StreetMontreal, QuebecCanada H3C 5H7Telephone: 514-954-8219Facsimile: 514-954-6077E-mail: [email protected]: www.icao.int

REGIONAL OFFICES

Asia and Pacific OfficeBangkok, ThailandTelephone: + 662-537-8189Facsimile: + 662-537-8199E-mail:[email protected]

Eastern and Southern African OfficeNairobi, KenyaTelephone: + 254-20-7622-395Facsimile: + 254-20-7623-028E-mail: [email protected]

European and North Atlantic OfficeParis, FranceTelephone: + 33-1-46-41-85-85Facsimile: + 33-1-46-41-85-00E-mail: [email protected]

Middle East OfficeCairo, EgyptTelephone: + 202-267-4841Facsimile: + 202-267-4843E-mail: [email protected]: www.icao.int/mid

North American, Central Americanand Caribbean OfficeMexico City, MexicoTelephone: + 52-55-52-50-32-11Facsimile: + 52-55-52-03-27-57E-mail: [email protected]

South American OfficeLima, PeruTelephone: + 51-1-575-1646Facsimile: + 51-1-575-0974E-mail: [email protected]: www.lima.icao.int

Western and Central African OfficeDakar, SenegalTelephone: + 221-839-93-93Facsimile: + 221-823-69-26E-mail: [email protected]

Promoting the Development of International Civil AviationThe International Civil AviationOrganization, created in 1944 to promotethe safe and orderly development of civilaviation worldwide, is a specialized agency ofthe United Nations. Headquartered in Montreal,ICAO develops international air transport standardsand regulations and serves as the medium for cooperation in all fields of civil aviation among its 189 Contracting States.

ICAO CONTRACTING STATES

38701.P4 12/7/06 9:36 PM Page 4

38701.P5 12/7/06 9:36 PM Page 5

OMPLIANCE with ICAO stan-dards and recommended prac-tices (SARPs) is a cornerstone of

international civil aviation safety.However, a rapidly expanding industryand limited resources at oversightauthorities make it increasingly difficultto efficiently and effectively sustain a pre-scriptive approach to the management ofsafety based upon regulatory complianceexclusively. This is why it is essential tocomplement the regulatory approach tosafety management with a performance-based approach.

A performance-based approach to safe-ty management can be presented as athree-step process. In the initial stage,

SMS IMPLEMENTATION

ICAO initiative promotes globalapproach to SMS implementation

With an emphasis on achieving worldwide harmonization, the organization’s initial efforts to foster safety management have focused on the development of new regulatory provisions, guidance material and a special training programme

VINCE GALOTTI • ARUN RAO

DANIEL MAURINO

ICAO SECRETARIAT

C

oversight authorities, operators and serv-ice providers agree on the level of safetythat operators and service providers areexpected to achieve. This safety perform-ance may be expressed in complex quan-titative terms using collision risk model-ling and associated target levels of safety.However, simpler quantitative approach-es as well as qualitative methods — oreven a combination of the two — areincreasingly being used as effectivemethods for determining and measuringsafety performance.

During the second step of the process,oversight authorities, operators and serv-ice providers decide on the safetyrequirements necessary to achieveagreed targets. These requirements usu-ally include the array of tools and meansavailable to operators and serviceproviders. In the third and final step,oversight authorities ascertain whether

the envisaged safety performance hasbeen achieved, after which operators andservice providers propose measures forcorrecting any deviations.

Senior management accountability is afundamental component of the perform-ance-based approach, since the frequen-cy of prescriptive inspections and reviewsby oversight authorities can conceivablydecrease. In this sense, operations andsafety managers assume a bigger stake inensuring safety.

Performance-based approaches to themanagement of safety are best exempli-fied by the safety management system(SMS), and the mature concepts thatform the building blocks of an SMS allowfor its implementation on a global basis.Indeed, under ICAO provisions that tookeffect in November 2006, aircraft opera-tors, aerodrome operators, air trafficservices providers and maintenanceorganizations worldwide are required toimplement safety management systems.

Management of safetyThe efficient and effective management

of any aviation organization, regardless ofthe nature of its functions or size, requiresthe management of basic businessprocesses such as financing, budgeting,communicating, allocating resources, andso forth. In recent years, managing safetyhas been added to this list. Managing safe-ty should now be as much a part of run-ning an aviation organization as managingany other business process. Moreover, ithas been well established that effectivemanagement of safety is good business.

Traditional systems for addressingsafety issues are usually set in motiononly after some triggering event such as

6 ICAO JOURNAL

In companies where management is truly committed to enhancing safety as a core business activity, employees will not be afraid to bring forward their safety concerns

Ran

dK

.Pec

k

38701.P6 12/7/06 9:36 PM Page 6

an accident or incident discloses a safetyconcern. While such efforts will alwaysserve an important purpose, identifyingsafety concerns through forensic means,they need an outcome in order to reactand engage the safety managementprocess. In these systems, responsibilityfor monitoring outcomes and reacting tothe safety concerns related to outcomesmay be spread around the organizationdepending on the type of activity involved(e.g. flight operations, maintenance, rampand cabin). Furthermore, those account-able for monitoring safety and addressingconcerns may not always be clearly identi-fied, and often when they are readily iden-tifiable, the individuals held accountablefor safety are only at a middle manage-ment level.

The trend today is towards greateremphasis on proactive and predictive sys-tems to manage safety. SMS involves theongoing routine collection and analysis ofsafety data during the course of the activi-ties that an organization must pursue everyday while conducting its core businessfunctions, in addition to reacting to the datacollected. The SMS may be consideredprocess-driven and proactive. It continu-ously collects and analyses sizable volumesof data that provide a principled basis forthe definition of activities and the allocationof resources to address safety concerns ina proactive manner. The term “system”conveys the notion of an integrated set ofprocesses aimed at managing safety thatcrosses intra-departmental boundaries,thus addressing safety concerns from anintegrated and broad perspective.

An SMS thus comprises a systemicapproach to the management of safetythat puts in place the necessary organiza-tional structure, accountability, policiesand procedures. In order to reinforce theconviction that safety management is amanagerial business process, basic SMSrequirements should include provisionsfor an organization to establish lines ofresponsibility for safety throughout theorganization, beginning with the seniormanagement level.

In addition to the systemic and proac-tive nature of managing safety, which is

SMS IMPLEMENTATION

NUMBER 6, 2006 7

HE ICAO business plan and theorganization’s new focus on safetymanagement might seem as two

unrelated efforts born roughly in the sametimeframe. On closer inspection, however,one realizes that the two initiatives have acommon conceptual anatomy: both arebased on the achievementof measurable results,both emphasize accounta-bility, and both feature aperformance review pro-cess that can lead to self-improvement. This simi-larity is not a coincidence,but was born out of thenecessity to accept twoemerging realities: the lim-its on resources, and ashift from a reactive andprescriptive methodologytowards a preventive andperformance-based one.

Expeditious implemen-tation of safety manage-ment systems is one of the key activitiesarising from ICAO’s safety-oriented busi-ness plan. Safety management system(SMS) implementation around the worldis one of the “pillars” that make up thehigh-level strategy through which thesafety of international civil aviation is tobe advanced.

The overall tactical deployment ofICAO’s resources in the sphere of safetymanagement is aligned and managedthrough the business plan with the goalof delivering a consistent and harmo-nized global approach to the conceptsand implementation of SMS and theimplementation of performance-basedsafety regulations. These anticipatedresults are complemented by a definedset of measurable indicators throughwhich the effectiveness and efficiency ofthe ICAO initiative will be monitored.

SMS is thus firmly embedded within

the safety component of the organiza-tion’s business plan, a symbiosis that ismutually beneficial. The business planindependently measures the effective-ness of the SMS programme, while theimplementation of SMS by States allowsbetter input and response to the other

safety strategies supported by the busi-ness plan. This input is enhancedthrough the collection of safety data,while response is enhanced through animproved safety culture.

The way forward for both the businessplan and safety management programmedemands a commitment to safety man-agement systems from the highest levelsof an organization, with transparentaccountability. Just as ICAO’s businessplan evolved from institutional actionsparked by its member States, the inter-national standards that apply to safetywill require States to implement pro-grammes that include acceptable levels ofsafety as defined by authorities, operatorsand air navigation services providers.

For these two interlinked initiatives tosurvive, patient attention is required fromall civil aviation stakeholders. Perhaps

BUSINESS PLAN UNDERSCORES COMMITMENT TO SAFETY MANAGEMENT

ICAO’s efforts to advance implementation of SMSacross all aviation disciplines are in step with theorganization’s business-like approach to safetyenhancement

Jim

Jorg

enso

n

continued on page 38

T

38701.P7 12/7/06 9:36 PM Page 7

relatively concrete and understandable,the evolution to a more managedapproach to safety and to the SMS alsorequires a change in the way that peoplethink about safety, a collective perceptionthat may be referred to as culture.Although culture cannot be regulated orimplemented in the way that more con-crete systems and rules may be, manage-

ment philosophy can be transmitted inclear and unambiguous terms through-out an organization.

Once convinced that SMS is good busi-ness and that it should become an integralpart of an organization, managementshould take definitive measures to ensurethat its commitment to managing safety asa core business activity is recognized bythe staff. Over a period of time, staffshould feel at ease about bringing forwardsafety-related information. The combina-tion of rules and regulations and concreteaction — together with an explicit changein management philosophy — shouldresult in a greatly improved safety culture.

ICAO actionICAO’s strategic objectives for the peri-

od up to 2010 include the enhancement ofglobal civil aviation safety, a goal that callsfor the organization to support implementa-tion of safety management systems acrossall safety-related disciplines in all States.

SMS IMPLEMENTATION

While many States and organizationshave been involved in implementing safe-ty management systems over the years,ICAO has noticed some discrepanciesconcerning the key terms, concepts andhypotheses they appropriate. This wasevident, for example, in the way thatStates attempted to adapt the notion of an“acceptable level of safety.” Discrepancies

were also apparent in the use of variousterms, as well as in regulatory develop-ment and in the manner that SMS wasbeing explained and taught.

The organization initiated a substantialeffort in 2005 to harmonize these con-cepts and terms and to combine all of itssafety management guidance into a sin-gle comprehensive document entitled theSafety Management Manual (ICAODocument 9859). It also began to coordi-nate, research and study those ideas thatwere vaguely understood. The result wasa clear and common perception of SMSand its components, and a comprehen-sive guidance document for SMS imple-mentation. The next step involved devel-oping common material to support train-ing and ensure that operational and safe-ty managers, as well as operating person-nel, more fully understand fundamentalsafety and human factors concepts suchas “just” culture, the role of latent condi-tions, and aspects of human error.

The point of all these efforts has been tofacilitate a harmonized global approach tothe implementation of SMS. Harmoniza-tion will lead to a better and commonunderstanding of SMS, extensive sharingof information and data, rapid expansion ofsafety management systems, commoncourse material and readily adaptablemodel regulations, among other things.

Very importantly, one way ICAO hassupported SMS implementation has beento amend SARPs to establish harmonizedsafety management requirements in spe-cific annexes to the Chicago Convention.*The Safety Management Manual, a centralsource of safety management information,offers essential guidance material con-cerning these harmonized provisions. Itincludes a section on generic safety man-agement concepts applicable across avia-tion activities, as well as sections on thespecific activities of operators, mainte-nance organizations, ATS providers andaerodrome operators.

In continuing its initiative, ICAO willhave to complete several critical tasks bythe autumn of 2007. All ChicagoConvention annexes, for example, willhave to be assessed to determine the fea-sibility of developing SARPs compatiblewith a performance-oriented regulatoryapproach to safety management. Modelregulations will be required to supportadoption of a performance-based regula-tory approach by States. Material will beneeded to guide national oversightauthorities in integrating safety manage-ment practices and to assist aviationorganizations in applying SMS. Finally, aprogramme of training courses to assist

8 ICAO JOURNAL

* The amended annexes are Annex 6, Operation ofAircraft (Part I, International Commercial Air Transport— Aeroplanes and Part III, International Operations —Helicopters); Annex 11, Air Traffic Services; and Annex14, Aerodromes (Volume I, Aerodrome Design andOperations). In all, 18 annexes to the Chicago Conventioncontain provisions for the safe, secure, orderly and effi-cient development of international civil aviation.

All three authors are employed in the Air NavigationBureau at ICAO headquarters, Montreal, where VinceGalotti is Chief of the Air Traffic Management (ATM)Section; Arun Rao is Chief of the Aerodromes, AirRoutes and Ground Aids (AGA) Section; and Capt.Daniel Maurino, of the Flight Safety (FLS) Section, isthe Coordinator of the Flight Safety and HumanFactors Programme.


In recent years safety management has been added to the list of traditional businessprocesses that are required to run any aviation organization

Jim

Jorg

enso

n

38701.P8 12/7/06 9:36 PM Page 8

safety management system(SMS) standard for use by aircraftoperators of all types and sizes

was issued by the Federal AviationAdministration (FAA) in late June 2006.The new standard is the product of exten-sive research as well as inputs from indus-try, labour, and both U.S. and other govern-ment safety regulators, and is described inan FAA advisory circular entitledIntroduction to Safety Management Systemsfor Air Operators.

Under an ICAO provision that tookeffect on 24 November 2006, memberStates are required to ensure that aircraftoperators, aviation maintenance organiza-tions, air traffic services providers andaerodromes implement safety manage-ment systems. The United States, amongmany other nations, has enthusiasticallyendorsed the SMS concept.

Product of necessityThe current operating environment for

commercial aviation is characterized bycomplexity and almost constant change.This requires that air operators and avia-tion service providers constitute open sys-tems, continually adapting to this dynamicenvironment in order to survive. The mod-ern aviation system is best viewed as a“system of systems” with complex interde-pendencies and a variety of business mod-els and adaptable relationships.

SMS STANDARDS

Concept of safety management systemembraced by many countries

In the United States, a newly issued SMS standard for use by air operators is the product of extensiveresearch and collaboration involving industry, labour and government safety regulators

The FAA, together with ICAO, recog-nizes the need not only for a more sys-tems-oriented approach to safety than hasbeen previously practised, but for a moremanagerial approach to safety on the partof both government and industry.Notwithstanding the FAA’s responsibilityto promulgate regulations and standards,progress in aviation safety can beenhanced with a more integrated andcooperative relationship with industryversus a legalistic, adversarial approach.Safety management is, therefore, morerightly viewed as a shared effort by gov-ernment and industry.

Trends in management theory indicatethat a structured approach to manage-ment, where clear goals and requirementsare set and where man-agement processes areput in place to assureattainment of these goals,are more reliably effec-tive than other approach-es. The FAA is in theprocess of instituting acompletely systems-based approach for aircarrier oversight. Both the agency andindustry recognize that this transition can-not be effective through the regulator’sactions alone. System safety must beinfused into the management systems ofair operators and other service providersif it is to have the desired effect on safetyoutcomes.

It is to this end that the SMS standardwas developed. The standard is designedto be used by operators to develop a man-agement framework for safety risk man-agement and safety assurance. Moreover,the standard postures the safety manage-ment efforts in such a manner that they

can be integrated with the other manage-ment systems of the airline as well as pro-vide an interface with the regulatoryoversight system.

The processAt the time that the FAA began consid-

ering development of SMS standards andimplementation by U.S. airlines, severalother countries had already developedmaterial on the subject, as had the AirLine Pilots Association (ALPA) and sever-al U.S. airlines. A number of other innova-tive quality management and system safe-ty efforts were also in play that employedmany of the concepts seen in a typicalSMS. It was clear at the outset that thefuture system would benefit from com-

monality and harmo-nization with existingsystems, and so theFAA/industry teamcommenced a processof research to avoidreinventing the wheel.However, the FAA/industry team has alsomade its own unique

contribution along the way.The research project was conducted

under contract to the FAA TechnicalCenter after a review of requirementsusing a focus group with representativesfrom different FAA entities, several majorairlines and ALPA.

The research project entailed adetailed literature search of documentedaviation safety management systems, aswell as existing management systemsdeveloped for quality assurance, occupa-tional safety and health, and environmen-tal protection. Beyond the literaturesearch, site visits and interviews were

NUMBER 6, 2006 9

Risk Mgmt.Safety

Assurance

Safety Promotion: Culture/Environment

Policy:(Structure)

DR. DON ARENDT

FEDERAL AVIATION ADMINISTRATION

CAPT. WILLIAM YANTISS

UNITED AIRLINES

CAPT. ANA VEGEGA

AIR LINE PILOTS ASSOCIATION

(UNITED STATES)

Figure 1. The relationship of majorelements of an SMS

38701.P9 12/7/06 9:36 PM Page 9

conducted with representatives of regula-tory agencies and operators in Australia,Canada, New Zealand, and the UnitedKingdom. Interviews were also conduct-ed with representatives of the JointAviation Authorities (JAA) and severalthird-party industry groups.

The research team also considered thework of several contemporary aviationtheorists, notably, Dr. James Reason, andseveral other common sources of systemsafety background, such as the U.S. mili-tary standard Mil-Std 882.

Standard development. As the projectprogressed, a growing recognition of theneed for a universal standard emerged.The FAA/industry team perceived thatthere was a need for conceptual harmo-nization across the various serviceproviders in the aviation system. A teamwas formed under the FAA’s JointPlanning and Development Office(JPDO) to develop a universal SMS stan-dard template that was designed forbroad applicability across all types of avi-ation service providers. This approach

allowed for discussion among representa-tives of the component industries of thesystem and their respective oversightorganizations, and provided a forum forreview of the emerging documents.

Structure and functions. The standardis designed to take a functional orienta-tion; that is, requirements are laid out todelineate what processes are expectedrather than how they will be implement-ed. This allows operators the maximum

SMS STANDARDS

latitude to build programmes that alignwith their existing or proposed businessand management models while assuringa common set of SMS processes acrossoperators.

The individual processes in the stan-dard’s clauses were organized under thestructure of the “four pillars” defined inthe draft SMS manual for the U.S. AirTraffic Organization (ATO), which wasalready under development because of anearlier ICAO mandate for implementationof safety management systems in the airtraffic management (ATM) field. Thefour pillars constitute policy, safety riskmanagement, safety assurance, and safe-ty promotion. Of these cornerstones, therisk management and safety assurancepillars define the two principal, interac-tive processes of the SMS. The policy pil-lar provides structural documentation ofthe system, including a requirement forassignment of responsibility and authori-ty for management processes and provi-sion of related procedures. The proce-dure for safety promotion, along with cer-

tain policy require-ments, provides for anorganizational environ-ment that supports ahealthy safety culture.Figure 1 shows therelationship of theseelements in the SMS.

Systems must alsofacilitate audits by bothoperators and thirdparties. For this rea-son, the general formatof the ISO standardswas favoured as a pat-tern. The environmen-

tal standard, ISO 14001, was chosen asthe basic template. This standard wasselected because the system require-ments for environmental protection, likethose required for safety, are based moreon objective assessments of the impacton system users and on the public thanon customer satisfaction. At the sametime, the safety assurance processes ofthe SMS drew heavily on the auditing,analysis and preventive/corrective action

processes defined in ISO 9000.Therefore, ISO 9000 was used as thebasic template in these areas.

Figure 2 provides a functional descrip-tion of the SMS standard’s clauses, show-ing the organization of the document andthe relationships of its principal elements.Clauses four through seven constitutethe four pillars of the SMS as describedabove. Clause 4 (policy) contains arequirement for procedures and organi-zational controls to be defined through-out the system. A number of individualprocesses also call for measurable crite-ria. The remainder of the figure showssubprocesses that are described withineach major clause.

Safety policy is the underpinning of theSMS. Effective safety managementbegins with policies that convey to allstaff members the top management’semphasis on safety and their objectives.These policies include assignment ofresponsibility and authority throughoutthe organization with respect to all safety-related functions. Policies must also betranslated into procedures to providestaff with clear instructions for accom-plishing their safety-related functions aswell as organizational controls to ensurethat these functions are performed asintended.

Safety management is founded on riskmanagement. The fundamental objectiveof any safety programme is to identifyhazards, analyse and assess associatedrisks, and design and implement controlsfor those hazards and risk factors. Thesafety risk management (SRM) pillar inthe FAA’s SMS standard for air operatorsis based upon a model that is used in sev-eral popular system safety training cours-es, including the course taught at theFAA Academy. The FAA’s SMS standardstarts with a careful analysis of the orga-nization’s systems and goes on to providestructured processes that result in thedevelopment of risk controls. The princi-pal steps in the SRM process include sys-tem and task analysis, identification ofhazards, and risk analysis, assessmentand control. Each of these steps isdescribed in brief below.

10 ICAO JOURNAL

PolicyCl. 4

ProcessControls

Procedures

Safety RiskManagement(SRM) Cl. 5

RiskControl

SystemDescrip

HazardIdent

RiskAnalysis

RiskAssmt

Data Audits

Invest.

ReportsAnalysis

Comm

Training

Assmt

P/CAction

SafetyAssurance(SA) Cl. 6

SafetyPromotion(SP) Cl. 7

Figure 2. Functional description of the FAA SMS standard

38701.P10 12/7/06 9:36 PM Page 10

• System/task analysis: Both physical(e.g. equipment, aircraft, facilities) andorganizational systems are to be definedin order to gain a thorough understand-ing of the conditions in which hazardsmay arise.• Hazard identification: Systems, process-es and tasks are analysed to identify theexistence or conditions thatcould create hazards to per-sonnel or property.• Risk analysis: Hazardsare further analysed todetermine factors relatedto risk severity and likeli-hood. These will laterbecome the basis of riskcontrols.• Risk assessment: Overallrisk is evaluated for itsacceptability. The FAA’sSMS advisory circular, AC120-92, uses a risk matrixbased upon severity andlikelihood definitions pro-vided in the ICAO SafetyManagement Manual.• Risk control: Where necessary, con-trols are developed to eliminate hazardsor to reduce their potential effects. Thesecontrols then become system require-ments, which will be continuously evalu-ated by the safety assurance function ofthe SMS, a process that operates similarto a quality management system.

Safety assurance, the third cornerstoneof the safety management system,involves safety, quality and integratedmanagement. Risk controls developedunder the safety risk management pillarnow become organizational systemrequirements. Safety assurance involvestaking these requirements and applyingquality management techniques to theprocess of ensuring that these controlsare being correctly implemented and thatthey are producing the desired results.

The group that developed the standardkept in mind that airlines are really a col-lection of systems. There are the techni-cal systems that make up flight opera-tions, ground operations, maintenanceand training, as well as other manage-

SMS STANDARDS

ment systems that must be in place forthe business enterprise to run. Moreover,other areas of health and safety must bemanaged by these businesses, such asoccupational safety and health manage-ment systems and environmental man-agement systems. While the focus of theSMS is on safety, the standard was draft-

ed in full recognition of the need for air-lines to balance requirements and tomake them fit together with a minimumof duplicated effort.

Safety promotion, the final pillar, is thefoundation of a sound safety culture. Itwas developed with recognition of theimportance of a sound safety culture tothe safety management process.Employee knowledge, involvement andmotivation are crucial to safety manage-ment success.

The safety promotion pillar stressestraining and awareness, communication,and active participation. It also sets thegroundwork for support of a “just cul-ture” in which employees are encouragedto report safety deficiencies with confi-dence that their management will be fairand responsive to their input, and withoutfear of punitive actions.

A sound, just safety culture recognizesthat well trained, motivated and responsibleemployees are nonetheless vulnerable tomaking errors and emphasizes correctionof safety deficiencies rather than apportion-

ing blame and punishment. The safety pro-motion pillar is also closely integrated withthe SRM and SA pillars, as it is an importantsource of information for both.

The foundation of a healthy safety cul-ture is based on well-designed operationalprocedures that are harmonized cross-functionally and then fully engrained into

employee behaviours usinga robust employee train-ing programme. This isclearly a responsibility ofthe management team.However, the conduct ofoperational activities in asafe manner rests on theshoulders of each employ-ee as they perform techni-cal and service-relatedtasks. Safety is, therefore,both an individual andcorporate responsibility.Safety promotion is lacedthroughout all initial andrecurrent training acti-vities and also throughoutall operations so that it can

continue to nurture the organization’ssafety culture.

Programme integrationThe SMS standard was developed with

the understanding that various safety pro-gramme components might already existseparately in an organization. The SMSconcept provides a framework for inte-grating all of these government andindustry programmes into a comprehen-sive system. Most of the existing pro-grammes are treated as optional, but cur-rent and future efforts will be directedtoward more seamless integration.

Several programmes have more exten-sive requirements that are over andabove the minimum requirements of theSMS standard. For example, the standardrequires participating operators to have aconfidential employee reporting systemand to use these reports in the safetyassurance process. The Aviation SafetyAction Programme (ASAP), for example,provides such a process with detaileddata collection, review, analysis and data

NUMBER 6, 2006 11

The final version of the FAA’s SMS standard and associated guidancematerial will be based on feedback and data analysis involving adiverse group of operators and service providers

Jim

Jorg

enso

n

38701.P11 12/11/06 6:55 PM Page 11

management functions. ASAP wasdesigned for large- to medium-sized oper-ators and the requirements may bebeyond the resources of many smallerorganizations. Thus, the SMS standardwas created with fundamental require-ments while treating the more extensive-ly developed programmes such as ASAPas an optional means of meeting therequirements for those organizationscapable of making the necessary invest-ments. ASAP is one non-punitive report-ing system, but other systems can also bedesigned to meet the requirements of thestandard.

The standard is written so that a com-pany can develop an integrated manage-ment system to tie safety and quality dis-ciplines together by harmonizing sup-porting programmes with the organiza-tion’s risk management efforts. Since

each of these programmes can identifyand assess risk from a unique perspec-tive, integration of management systemscan be highly beneficial. The role of aninternal evaluation programme (IEP), forexample, is to assure the safety of opera-tional activities, verify regulatory compli-ance, ensure conformance to organiza-tional procedures, and identify opportuni-ties for improvement. An IEP will bemore effective if it evaluates safety issuesidentified by programmes such as ASAPand Flight Operations Quality Assurance(FOQA) or other sources of safety infor-mation that may also be in place in thecompany. Corrective actions are imple-mented for these safety/quality issues

SMS STANDARDS

and system effectiveness is again meas-ured by these component programmes,thus continuing the cycle. Senior man-agement is able to track the organiza-tion’s health when the information gener-ated by these programmes is effectivelyintegrated and analysed.

Oversight systemThe FAA fully supports the ICAO posi-

tion that safety should be addressed by amanagerial approach, and furthermorethat there are distinct roles for both gov-ernment regulators and the businessentities that they oversee. The FAAbegan a movement to a more systems-ori-ented method of oversight in 1998 withthe advent of the Air TransportationOversight System (ATOS). Since then,the agency has encouraged operators touse the same tools that are used by FAA

inspectors to design and evaluateorganizational systems. Safety ismost effectively achieved though anopen and collaborative approach,wherein information moves freely notonly inside the oversight system andthe airline, but between them as well.

Figure 3 depicts the general rela-tionship between the three main enti-ties in the safety equation. The firstdistinction made in the model is thatbetween production and protection, aconcept brought forward by Dr.James Reason, a prominent organiza-tional theorist. In traditional over-

sight, most of the interaction between theoversight system and the business entityoccurs along the diagonal line, direct,interventionist approach. In the safetymanagement approach, safety assuranceby the regulator is primarily carried outvia the relationship with the operator’sSMS. Safety risk management, which isprimarily the responsibility of the opera-tor’s management, is carried out in theSMS. However, the continuous and openrelationship facilitates close collaborationon both risk management and safetyassurance.

The depiction of protective and produc-tive functions does not, however, imply amatching organizational structure. In

fact, the most important functions of theSMS are carried out by line management,those who are responsible for productionand who have the authority to direct activ-ity and allocate resources.

The futureSafety management systems are cur-

rently voluntary in the United States, andAC 120-92, the current SMS document,describes an optional process for air opera-tors. However, the FAA came out in favourof the recent amendment to ICAO Annex6, including a new requirement for Statesto ensure that aircraft operators implementsafety management systems, and it intendsto implement the Annex 6 provisionsaccording to the prescribed schedule.

To this end, the FAA is in the processof organizing a proof-of-concept withfeedback and data analysis across adiverse set of sizes and types of operatorsand other service providers. In this man-ner, both industry and government par-ticipants can learn important lessonswhile the systems are still voluntary andcan consequently be tailored more freely.

A collaborative approach among theFAA and industry groups, including rep-resentatives of management, labourorganizations such as ALPA and otherindustry advocacy groups, will be usedover time, and analysis of the proof-of-concept experiences will allow for betterimplementation of the SMS conceptacross the industry. The final version ofthe standard and associated guidancematerial will be drafted and edited basedon experience.

12 ICAO JOURNAL

FAA’s SafetyManagement

(Oversight) System

OBJECTIVE:PUBLIC SAFETY

Operator’s SafetyManagement

System

OBJECTIVE:CONTROL

SAFETY RISK

Process

OBJECTIVE: SERVECUSTOMER

REQUIREMENTS

Direct sampling(e.g. surveillance)

Outputs = Products/services

PROTECTION PRODUCTION

Inputs

Dr. Don Arendt is Manager, FAA Flight Standards SafetyAnalysis Information Center. Capt. William Yantiss is(Acting) Vice President for Safety, Security and QualityAssurance for United Airlines, and Capt. Ana Vegega is anAirbus A320 captain for United Airlines and Director of theSMS Project for the Air Line Pilots Association. Others whocontributed to this article include Scott VanBuren and CarlMarquis, of the FAA Air Traffic Oversight Service, the lead-ers of the SMS standard development team; Linda Sollars,Director of System Safety for JetBlue Airways, who chairedthe FAA/industry focus group that oversaw the initial SMSresearch project; Dr. Douglas Farrow, who represented theFAA Flight Standards Voluntary Programs Branch; andMichael Lenz, FAA Commercial and General AviationDivision, who represented general aviation interests andoversaw production of the FAA’s SMS advisory circular.

Opinions expressed in this article are those of the authorsand are not necessarily the official position of the FAA orother organizations with which the authors are affiliated.


Figure 3. Relationships between an operator’sSMS and the oversight system

38701.P12 12/7/06 9:37 PM Page 12

YOU’D BE SURPRISED WHERE YOU FIND US

As airspace gets more crowded, you’ll findThales taking control.

ATM systems face the same challenge worldwide:

economic growth means more air traffic, putting

dangerous pressure on existing systems. Thales

is the safe choice for future

development. We can

take on prime

contractorship

and deliver

complete turnkey

solutions, gate

to gate. We

already control the

airspace in 170

countries: our EUROCAT

ATM system is the industry standard. In technology,

we lead the way with Mode S radars and Automatic

Dependant Surveillance-Broadcast (ADS-B).

In European initiatives we’re partners in the Single

European Sky (Sesar) and Galileo satellite programmes.

Fully equipped for the present; alreadyplanning for the future. If you’re looking

for the safest route forwards, call Thales.

The world is safer with Thales www.thalesatm.com

38701.P13 12/7/06 9:37 PM Page 13

DOPTION of a business model,as Transport Canada has discov-ered, is an effective way to deliv-

er and manage a civil aviation pro-gramme, in part because it applies equal-ly to safety as to other broader manage-ment issues.

The business model introduced recent-ly by Transport Canada Civil Aviation(TCCA), which is based on the manage-ment of risks, will help the organizationmake better decisions in an environmentthat is forever beleaguered by competingdemands for limited resources.

While regulatory authorities may findthe business model approach worthy ofcloser examination, aviation companiesmay as well, because risk management isan integral part of a safety managementsystem (SMS). The tactics and strategiesused to mitigate risk may be different,but the processes used to arrive at suchtactics and strategies are the same.

Although the focus of this article is onaviation safety, the business model hasbroad applicability: it can apply to securi-ty or environmental topics, and can alsoapply to other modes of transport or man-agement issues.

TCCA’s adoption of the business modelthat is described below evolved out ofrecognition that safety is not an absolutecondition, but rather one where risks aremanaged to acceptable levels.

Safety defined Although Transport Canada has long

emphasized the paramount importance ofsafety, the word “safety” is not defined in

SMS IMPLEMENTATION

Business model focused on risk managementenhances safety programme decision-making

Regulator’s adoption of a business model for managing its safety programme evolved out of the recognition that aviation safety is best served by analysing and controlling the risks

Canadian aviation legislation or depart-mental policy documents.

The dictionary is equally unhelpful inthis regard. The Concise OxfordDictionary defines safety as: “freedomfrom danger or risk; being sure or likelyto bring no danger; being safe.” The dic-tionary describes an absolute conditionwhile few, if any, situations are complete-ly free from danger or risk. Like allhuman enterprises, aviation is fraughtwith risk.

The absence of an operational defini-tion of safety has been problematic forcivil aviation. It is susceptible to wide,subjective interpretation, which can leadto conflicting priorities and the conse-quent allocation of resources to lesserissues; it hinders consistency in the deliv-ery of regulatory programmes and quan-titative performance measurement.

Simply put, in the absence of a formal,operational definition of safety, the dictio-nary’s version cannot apply in an aviationcontext, or any other low-probability,high-consequence industry for that mat-ter. Perhaps it was in a similar light thatWilliam W. Lowrance defined safety as “ajudgement of the acceptability of risk, andrisk, in turn, as a measure of the probabil-ity and severity of harm to humanhealth.”* He summarizes by stating that“a thing is safe if its risks are judged to beacceptable.”

For the reasons stated above, in Flight2010 — TCCA’s current strategic plan —a working definition of safety is providedas “the condition where risks are man-aged to acceptable levels.”

The new mission. Having defined safetyin terms of risk, TCCA refined its missionstatement, which aligns with the largerdepartmental mission, as follows: “To

develop and administer policies and regu-lations for the safest civil aviation systemfor Canada and Canadians, using a sys-tems approach to managing risks.”

That safety is the condition where risksare managed to acceptable levels is notnew. It has been implied in the aviationindustry for many years. However, thewider, explicit use of this definition is a rel-atively recent phenomenon. Defining safe-ty in context and expressing the mission interms of risk helps clarify the regulator’srole and limitations. This new missionstatement provides clarity of purpose: notonly does it spell out TCCA’s goal, but italso states how and for whom the organi-zation is delivering its programme.

The business model. All parties involvedin delivering on the mission must be ableto see the whole, understand how thingsshould work, and, more importantly, howthey contribute to value creation. Thebusiness model was developed to articu-late and illustrate how this works.

Some may argue that, as a governmententity, TCCA does not need a businessmodel; it is not a business, as it is notinvolved in value creation. But the publicvalues safety. Both the public and con-sumers of aviation services in particularlook to TCCA to act as their safety advo-cate, ready to intervene in the sector asnecessary to ensure appropriate meas-ures are taken to manage aviation risks.This is value creation, and TCCA’s newmission statement is its value proposition.

A business model incorporates all criti-cal activities needed to deliver the valueproposition. To deliver on its new missionand focus its interventions where they canhave the most impact despite increasinglylimited resources, TCCA has adopted abusiness model that governs all activities

14 ICAO JOURNAL

BRYCE FISHER

TRANSPORT CANADA

A

38701.P14 12/7/06 9:37 PM Page 14

and processes in the delivery and manage-ment of its oversight programme.

As shown in Figure 1, TCCA’s businessmodel incorporates five phases: initiation,preliminary analysis, risk estimation andrisk evaluation, risk control and interven-tion, and impact measurement and com-munication.

Initiation and preliminary analysis.Except for those circumstances requiringthe immediate tactical intervention onthe part of the regulator to stop a situa-tion that poses an immediate threat to avi-ation safety or respond to an accident orsignificant incident, the application of thebusiness model requires, first and fore-most, the acquisition of safety intelli-gence before making any decisions.

Safety intelligence is simply the datathat are analysed to produce informationnecessary to understand the risk. Whenvisualized as a pyramid, safety intelligenceincorporates data at the bottom layer ofthe pyramid, from which information,knowledge and wisdom are derived inhierarchical fashion. Through an analyti-cal process, these data are transformedinto information; the synthesis of thisinformation leads to knowledge, and overtime this body of knowledge becomes theaccepted wisdom.

Data collection includes both reactivedata obtained from occurrences, plusproactive data that may originate fromhazard reports. These data are analysed

SMS IMPLEMENTATION

to derive meaningful information fromwhich decisions about risk can be made.

Ideally, risk analysis should address alldimensions that could lead to an individ-ual, organizational or systemic accident.These accident dimensions can be broad-ly categorized as active failures and latentconditions. Regulators must take thebroadest view and assume that latent con-ditions affecting individual behaviour,workplace conditions and organizationalfactors transcend the boundaries of a par-ticular aviation company and encompassthe legislative, socio-economic and politi-cal dimensions. Culture must also be con-sidered in the analysis since professional,organizational, industry and national cul-tures may influence the decisions, behav-iours and actions of the players involved.

The SMS approach is being imple-mented to encourage the proactive man-agement of conditions that could lead toaccidents. These dimensions can beapplied to normal working situations, haz-ards, incidents or accidents. By analysingdata from each dimension, the output issafety intelligence regarding the actual oremerging hazard expressed in terms ofrisk, specifically its probability, severityand the degree of exposure.

Risk estimation and risk evaluation.Once the hazard — both the likelihood ofits manifestation and its severity — isunderstood, the question is then asked:“Are the risks associated with the hazard

tolerable or acceptable?” If the answer isaffirmative, the risks are consideredacceptable and no intervention is required.However, the organization enhances moni-toring and contributes to continuous learn-ing by producing a report and storing thisin a safety intelligence repository forfuture use. If the answer is negative, therisks are deemed not acceptable, and thefollow-on question becomes: “How do weintervene to bring the hazardous condi-tions into the range of acceptability?” Inexploring possible solutions, the dimen-sion of cost-benefit is examined in the con-text of risk mitigation. The purpose is toestablish whether the benefits of any pro-posed risk mitigation strategy offset thecosts of its implementation.

Risk control and intervention. Gener-ally, there are three strategies for man-aging risk: eliminate the hazardous con-dition, mitigate the risks, or transfer therisk by, for example, requiring carriageof liability insurance. In terms of mitiga-tion, regulators can design and executeintervention strategies that address oneor more components of the risk equa-tion, in particular the probability, severi-ty or amount of exposure associated withthe risk.

Typically, aviation authorities can availthemselves of legislative or policy meansto develop a strategy that can be used tovarying degrees to mitigate the risks.The accompanying table (Figure 2) sum-

NUMBER 6, 2006 15

Immediatemajor concern?

Understandthe hazardsand risks?

Do we need tointervene?

Report Report

Have risks been mitigated

and resultscommunicated?

Continuous monitoring of

system and specific issues

Filter and analysisof micro and macrodata to identify andunderstand issues

Transfer

Terminate/Eliminate

Treat/Mitigate

the risk

NO YES YES

NO: Tolerate/Acceptthe Risk YES

NO

NO

YES

Diagnosis

New data may be captured when implementing a mitigation strategy

ReactiveData

ProactiveData

INITIATION PRELIMINARYANALYSIS

RISK ESTIMATIONRISK EVALUATION

RISK CONTROLAND INTERVENTION

MEASURE IMPACTAND COMMUNICATE

Figure 1. Business model used by TCAA as a means of managing safety through risk management

38701.P15 12/7/06 9:37 PM Page 15

marizes some of the more frequent tac-tics employed in the legislative or policyareas. Such tactics can be effectivewhether used in whole or in part.

In designing an intervention, careshould be taken to ensure that theapproach adopted holds promise of miti-gating the risks to within acceptable lev-

els, meaning that the outputs, intermedi-ate and ultimate outcomes must beobservable and measurable. In addition,the strategy must be commensurate to thelevel of risk in terms of its cost-benefit.

The execution of the risk mitigationstrategy should be managed as a projectwith a team and a project plan thatincludes project accountability, timelines,resources and performance measures.

Aviation companies have a myriad ofstrategies at their disposal to mitigaterisk as well. These include engineeredsystems; organizational, procedural, andbehavioural fixes, such as training andeducation; and/or personal protectionfrom hazards. Safety literature would,however, encourage aviation companiesto not rely solely on one strategy, butrather, as espoused by James Reason, acombination of strategies that achievedefences in depth.

Measure impact and communicate.After a time, the results of the risk mitiga-tion strategy should be ascertained. Thisis done to determine whether theplanned interventions are achieving thedesired results and whether any adjust-

SMS IMPLEMENTATION

ments to the original plan need to bemade. It is also important to justify cur-rent or future resource expenditures.

If the risks are managed to acceptablelevels, a report is prepared and stored inthe safety intelligence repository. Theproject team may then be disbanded, butthe issue at hand must continue to be

monitored. The lessons learn-ed in the execution of the riskmitigation strategy can pro-vide further intelligence andhelp identify the triggers thatenhance monitoring capability.

If the risk mitigation strate-gy failed in achieving thedesired results, this leads to adiagnostic exercise to discov-er where in the application ofthe business model the fail-ure occurred. The answermay lie in the design or exe-cution of the mitigation strate-gy, the decision-making pro-cess (i.e. the misapplication

or inappropriateness of risk criteria), orthe analysis or data-capturing phases.

Regardless of the outcome, an assess-ment of what worked, how well it worked,and what did not work, should be carriedout — if for no other reason than to learnfrom each experience and improve theprocesses of the business model itself.

Case study: runway incursions In 1997, Transport Canada and Nav

Canada, the country’s private air navi-gation services provider, noticed a significant increase in the number ofrunway incursions. Runway incursiondata was collected, validated andanalysed. The result of this analysis wasa better understanding of the active failures and latent conditions behindrunway incursions.

The level of risk posed by runwayincursions was deemed unacceptable. Tomitigate the risk, a number of both short-and long-term risk mitigation tactics wereinitiated, including regulatory and proce-dural changes, increased oversight activi-ties, and launch of an awareness cam-paign, to name but a few. A team known

as the Incursion Prevention Action Team,made up of a cross-section of aviation spe-cialists, was created to manage the riskmitigation project.

After several years, the risk mitigationstrategy has proven successful: the num-ber of runway incursions has stabilized,and more importantly, the severity of run-way incursions has decreased. (For moreon this safety initiative, see “Study onrunway incursions identifies contributingfactors and recommends solutions,”Issue 1/2002, pg. 13; and “Problem ofrunway incursions among most urgentissues facing aviation community,” Issue3/2002, pp. 26-27.)

Challenges and benefits. The opera-tional definition of safety and the busi-ness model it calls for do raise severalbroad questions. What are the risksinherent in aviation? Who is at risk? And,if the risks are to be managed to accept-able levels, what level of risk is accept-able to those at risk?

Answering questions such as these isnot easy, but Transport Canada is pre-pared to meet this challenge. Out ofnecessity, it will perform the required cal-culations to arrive at a benchmark level ofrisk or risk profile from which it canestablish goals, design and executeappropriate mitigation strategies, andmeasure and report on the results.

The rigorous application of the busi-ness model will enable TCCA to target itsinterventions where they can have themost impact for the safety of consumersof aviation services. It will enable betterand more empirical performance meas-urement, allowing air travellers to con-nect TCCA’s actions with visible out-comes. In this way, Transport Canada willbe able to achieve its twin objectives ofimproving aviation safety while enhanc-ing confidence in its oversight pro-gramme. nn

16 ICAO JOURNAL

Rule-making Promotion and Education

Regulatory Oversight Strategic Investments/Divestiture

The making, amending, or repealing of:• Laws • Regulations• Standards

The issuance/withdrawal of orders, exemptions, decrees or other items

• Conferences, symposia, colloquiums• Newsletters, journals, papers • Briefings• Multi-media safety products

• Educating for compliance• Monitoring • Inspection• Audits• Enforcement

• Privatize• Commercialize• Nationalize• Subsidize

Legislative Policy

Authorizations (certification) Strategic Leverage

The issuance, or withholding the issuance,of certificates, licences, permits, or otherauthorizing documents

• Public/Private Partnerships• Industry empowerment

* Of Acceptable Risk, by William W. Lowrance (1976)

Bryce Fisher is the Manager of Safety Promotion andEducation in the System Safety office at TransportCanada Civil Aviation, Ottawa. This text is an adaptationof an article published in Transport Canada’s AviationSafety Letter (Issue 2/2006), which is distributed to alllicensed pilots in Canada.

Figure 2. Regular risk mitigation strategies fall underlegislative or policy areas

38701.P16 12/11/06 6:55 PM Page 16

SMS IMPLEMENTATION

NUMBER 6, 2006 17

HERE has been much talk in avi-ation circles in the past fewyears about safety management

systems as if they were something com-pletely new. This is far from the case.The safety management system has along history in the areas of occupationalsafety and health, the chemical manufac-turing sector, nuclear power generationand research, the environment and else-where. It is true that broad application ofthe safety management system in avia-tion is a relatively recent event, but theestablishment of safety management sys-tems in the provision of air traffic servic-es has been a requirement in Europe,Australia and New Zealand for sometime, and the subject has been the focusof many aviation conferences and semi-nars.

Armed with the knowledge gainedfrom other sectors’ experience withSMS, one would have expected aviation’sadaptation of safety management sys-tems to be a relatively effortless affair.The opposite seems to have been true, asdifferent aviation disciplines or jurisdic-tions have adopted inconsistentapproaches. While some have opted forengineering models, others have chosenhuman factors models, or hybrids, andstill others have embraced ISO standardsbased on the tenet that quality and safetyare two sides of the same coin. Somecompanies have achieved positiveresults, others have not.

This may not be an indication of anyfailing, but rather evidence of the lack ofan underlying and universally acceptedconstruct for safety management sys-tems. As a subject, safety managementsystems have received their fair share oftreatment by various experts. These trea-tises, however, have tended to examinethe concept through a coloured lens, be ita safety, business, legal or other perspec-tive. Rarely have these and other aspectsof safety management systems been

Notwithstanding the absence of a uni-versally accepted construct for an SMS, acomparison of some of the “SMS stan-dards” that have been around for a while,notably in the provision of air traffic serv-ices and the nuclear and environmentalindustries, reveals certain universal prin-ciples. What follows is an expose of theprinciples that formed the basis ofTCAA’s safety management system brief-ing campaign, which began in 2001. Fora presentation of these concepts andprinciples, visit the Transport Canadawebsite (www.tc.gc.ca/civilaviation/SMS/Breeze/menu.htm).

The term safety management systemhas many definitions. But in a speech ata safety conference in Toronto inNovember 2000, Prof. José Blancoexplained it simply by breaking the termdown to its constituent parts: the term“safety” is used to mean the condition

where risks are managed toacceptable levels; the term“management” — to distil itto its purest form — can bedefined as the allocation ofresources; and the term“system” refers to anorganized set of things thatinteract to form a whole(typically interrelated pro-

cesses supported by policies, proce-dures and tools) which is required forthe delivery of goods or services.

Turning this upside down, we couldsay that a safety management system isan organized set of interrelated process-es to allocate resources to achieve thecondition where risks are managed toacceptable levels.

A safety management system canincorporate three strategies focusedrespectively on safety, management, andbusiness. Safety strategies concern them-selves with the achievement of two majorgoals: they concern compliance with both

broached between the same covers.Some hold the view that an SMS is a

framework for the prevention or reduc-tion of personal injury or death in theworkplace. Others view it as a systemwithin which risk management operates.From a financial perspective, account-ants and managers believe it is a combi-nation of tactics that contributes to thebottom line. Human factors expertsthink of it as a system that eliminates,reduces or otherwise attempts to controlthe conditions within systems andorganizations that are conducive tohuman error.

From a regulatory perspective, an SMSis a means for incorporating measures toensure compliance with safety legislation.Viewed in a legal light, the SMS is anapproach that attempts to minimize law-suits. For a marketing executive, however,it comprises strategies that will translateinto a larger market share.Quality assurance adherentssee safety management sys-tems as a continuous im-provement loop-type processthat aims to reduce failures.There are, in a word, endlessviewpoints to consider.

Some experts would arguethat these different percep-tions of safety management systemswork at cross-purposes or are otherwiseincompatible, or that safety performancecan only be enhanced at the expense ofother efforts, as if it were a binary func-tion. Meanwhile, regulators and stan-dards-making bodies must search for anapproach to safety management thatwould be relatively easy to institute andenforce.

It may be that a safety managementsystem is all of these things or has thepotential, at a minimum, to embody allthese viewpoints. In other words, diverseperspectives can contribute to a fullyfunctioning SMS.

SAFETY MANAGEMENT SYSTEMS 101

One would haveexpected aviation’s

adaptation of SMS to be a

relatively effortless affair


T

38701.P17 12/7/06 9:37 PM Page 17

VER the past few years the focuson safety management and safetymanagement systems has sharp-

ened distinctly. There have been numer-ous articles on the subject, as well astraining courses and conferences, but allthis attention has ironically made the sub-ject appear to be more complicated than itneed be. Simply put, a functional safetymanagement system (SMS) enables anorganization to address safety issues in astructured way.

A practical approach to safety, such asthat adopted by Copenhagen AirportsA/S (CPH), the aerodrome operator atCopenhagen Airport, can be effectivewithout being complicated. Copenhagen’sexperience, which stresses the impor-tance of comprehensibility, might serveas an example for other aerodrome oper-ators that are uncertain about how tomanage safety.

Copenhagen Airports A/S, like manyother international airport operators,recently established an SMS to complywith an airport certification requirementthat ICAO introduced in 2001.

CPH began developing its safety man-agement system in January 2005. Fromthe earliest stage there was a dialoguebetween the Danish Civil AviationAdministration (DCAA) and the airportmanagement. Recognizing that a safetymanagement system can hardly be imple-mented overnight, the DCAA agreed withCPH on what kind of documentationshould be provided in order to qualify fora renewal of its aerodrome certificate.

AIRPORT SAFETY

Airport operator espouses practicalapproach to safety management

One strategy for ensuring success is to implement a basic safety management system in stages andgradually win over the trust of operating personnel and management

THOMAS LAU CHRISTENSEN

COPENHAGEN AIRPORTS A/S(DENMARK)

O

The first steps in a process thatrequired that CPH change its approach tosafety were taken by the aerodrome man-ager and the operator’s senior manage-ment. Before proceeding, it was critical todemonstrate that senior managementopenly supported the entire process fordeveloping and introducing an SMS. Theaerodrome manager then appointed asafety manager to take charge of theprocess. Lastly, a number of activitieswere undertaken to encourage and pro-mote a positive safety culture. Amongthese was a presentation about apronsafety which was given to all ground han-dling agencies, including flight caterers.A total of 1,500 persons, all working air-side, have attended the presentation sofar, and as a result there has been anoticeable improvement in airside safetyconsciousness.

One reason the first steps were soimportant was because they underscoreda sincere desire by management tochange CPH’s safety philosophy. Insteadof simply reacting to safety concerns,safety was to be approached in a moreformal, systematic and proactive manner.

From the beginning, CPH managementmandated that the SMS must be practical,effective and easily understood by staff. Inother words, the system had to be kept sim-ple. This quality has proven to be the mostimportant criterion for success, encourag-ing the staff and managers together toclaim ownership of the system. An “easy tounderstand” mantra that governed thedevelopment and implementation processproved crucial, for under no circumstancescould CPH allow the process to result in amere theoretical study.

In keeping it simple, as much as possi-ble CPH has adapted safety management

processes that already were in place atCopenhagen Airport. Integrating thesepractices within the SMS eased the intro-duction of the system.

To develop and then implement anSMS in accordance with CPH’s statedphilosophy, a working group was formed,chaired by the newly appointed safetymanager. The working group consisted

mainly of operational personnel andreported to a steering committee, whichwas chaired by the aerodrome manager.

When CPH initiated this process,extensive guidance material on safetymanagement was available, but guidancerelevant to airport operation was verylimited. Although the Manual onCertification of Aerodromes (ICAODocument 9774) outlines the require-

18 ICAO JOURNAL

Arn

eV

.Pet

erse

n

38701.P18 12/7/06 9:37 PM Page 18

ments for an aerodrome operator’s safetymanagement system, it does not providespecific guidance on its implementation.

The newly released Safety ManagementManual (ICAO Document 9859) may beregarded as a comprehensive referencefor airport operators, but this source wasnot at hand in early 2005, and with littledirection, CPH decided to develop an SMSbased on the industry’s best practices.

The foundation of the CPH safety man-agement system is a policy that spells outCPH’s safety management goals. Thedraft policy was presented to the CPHBoard of Directors early in the develop-ment process, as high-level approval wasrequired to confirm the direction thatCPH should take.

The CPH safety policy calls for the air-

port operator to work in a systematic,structured and proactive manner toachieve its overall safety goal, which isto reduce the probability of an incidentat the airport. This goal goes a stepbeyond the industry’s best practices,which focus on reducing the probabilityof an accident.

If considered in isolation, of course,CPH’s safety policy cannot exert an influ-

AIRPORT SAFETY

ence on safety at Copenhagen Airport.While essential, a policy is still only astatement, and it cannot have effectunless it is supported by concrete workprocesses and requirements that are col-lectively known as safety strategy. Hence,the safety strategy outlines the tactics tobe used to realize the goals articulated bythe policy.

CPH’s safety strategy is based on 12strategic principles that fall under threebroad categories, namely to achieve, tomaintain, and to improve on a high stan-dard of safety.

CPH’s safety management system isdepicted in the accompanying table (page20). Much thought has gone into thedevelopment of the system, since it wasimportant to ensure it could be easily

understood. It is believed that the finallayout of the SMS is very pedagogical.

CPH opted to document the SMS in astandalone publication rather than as partof the aerodrome manual. The manual isdeliberately concise since personnelmight be discouraged from using a largedocument. The CPH Safety Manual allo-cates one page for elaborating each prin-ciple, describing the related processes

and requirements. DCAA approval for themanual was granted prior to 24November 2005, the ICAO deadline forhaving an SMS in place.

Implementation processCPH is in the midst of implementing

the 12 strategic principles, whichinevitably will have an impact on currentwork procedures. Besides introducingchanges to daily routines, the implemen-tation process also calls for the commit-ment of organizational resources. Thus,to ensure a successful and practicalimplementation, CPH has adopted a prin-ciple-by-principle approach.

Why not just implement all of the prin-ciples instantaneously and obtain safetybenefits from Day One? There is no short

answer to this question. However, to cre-ate actual safety benefits, both short- andlong-term, it is vital first for staff and man-agement to become the custodians of thesafety management system.

While building trust among staff mem-bers cannot be achieved in a day, it isessential to eventually win their confi-dence. Without this, the SMS is destinedto fail very early in the implementationeffort. Possible resistance from thosewho might view the SMS as just “anotherbureaucratic management system” wouldbe detrimental to the objectives.

Because the SMS imposes newrequirements on some work routines, anew level of competence is imperative.For example, the most radical change isthe requirement to complete risk assess-ments. For this to be done properly, train-ing needs to be provided, and of coursetraining takes time.

An SMS implementation plan wasdeveloped detailing the sequence forintroducing the strategic principles. Theinitial focus has been on three of the prin-ciples, specifically the reporting andanalysis of safety occurrences, the defini-tion of safety levels, and risk assessment.

NUMBER 6, 2006 19

View of Copenhagen Airport’s Terminal 3.The airport operator expects to fullyimplement a safety management systemby the end of 2007.

38701.P19 12/7/06 9:38 PM Page 19

These principles were selected for theirtactical advantages, since they provide theorganization with positive safety benefitsat an early stage of SMS implementationwithout being a burden on resources.Moreover, obtaining early safety benefitshelps foster support among managementand staff. The three principles are alsoconsidered as precursors to implementa-

tion of the other nine principles. Forexample, without reports on safety occur-rences (a goal of the first principle) itwould not be possible to perform safetytrend monitoring, nor would it be realisticto ensure that defined safety levels areachieved or to set new safety goals.

With CPH’s incremental approach toSMS implementation, it is envisaged thatall 12 strategic principles will have beenput into effect by the end of 2007. Afterreaching that milestone, development ofthe SMS will not cease entirely. The SMSis perceived as a living mechanism thatneeds to continually adapt to the changes

AIRPORT SAFETY

in the surrounding environment. In addi-tion, a significant period of time must bedevoted to the effort to infuse the safetyculture among all airport personnel.

To facilitate implementation within theorganization, CPH arranged for a numberof presentations on SMS and its impact.Individual meetings were held with man-agers who are accountable for specific

safety performance. Support has beenprovided by a number of key personnelappointed from each department. In addi-tion, risk assessment training courseshave been held internally, and some per-sonnel have received accident and inci-dent investigation training.

Organizational elements. The appoint-ed safety manager fills a support functionfor the CPH aerodrome manager.Besides being responsible for develop-ing, implementing and maintaining thesafety management system, the CPHsafety manager must ensure that theaerodrome manager is aware of any

undesirable trends. According to theDanish regulatory requirements for safe-ty management systems, responsibilityfor internal investigations of safety occur-rences also rests with the safety manager.

An important detail is to establish clearlines of responsibility for safety. Overlapsor uncertainty about such responsibilitiesmust not be allowed to exist. To ensurethat managers are accountable for safety,CPH has begun to document all of theirsafety responsibilities, a major task as itinvolves defining accountability at thesenior management level down throughthe organization to individual staff func-tions. So far, CPH has defined the roles ofthe aerodrome manager as well as seniorand middle-level management.

Occurrence reporting and analysis. Asearly as 2001, the DCAA had establisheda mandatory and non-punitive occur-rence reporting system, thus taking thefirst step to create a just safety culturewithin Denmark’s aviation industry.

Stakeholders are obliged to report allsafety-related occurrences to the DCAA.In return, the reporter is protected fromdisciplinary action or punishment by thenon-punitive policy. Without a positivesafety culture in place, occurrencereporting would be restrained and CPHwould have insufficient means for ade-quately monitoring safety at the airport.

A number of reporting systems hadalready existed at the airport when theprocess of developing SMS began. Theseincluded reports on airside security, birdcontrol, foreign object damage (FOD)and runway inspections. At the time,most reports were used individually toassess the current state of a specific prob-lem, and were not used systematicallyand collectively — in a proactive manner— to recognize significant safety trends.

Considered as a whole, CopenhagenAirport is a complex entity, with morethan 20,000 persons distributed among400 companies involved in its operations.On such a scale it is difficult to establisha singular reporting system that willwork. Having this as the ultimate goal,CPH decided to use the informationavailable from existing reporting sys-

20 ICAO JOURNAL

SAFETY POLICY

Means to achieve a high level of safety

ACHIEVING A HIGH STANDARD OF SAFETY

ORGANIZATIONAL ELEMENTS

ALLOCATION OF SAFETYRESPONSIBILITY

Ensuring an unambiguous distribution of safety responsibility.

COMPETENCE AND QUALIFICATIONS

Ensuring qualified, motivated andcompetent personnel.

EXTERNAL SERVICESExternal suppliers and associatesshall comply with safety standards

defined by CPH.

SAFETY ACTIVITIES

SAFETY LEVELSQuantitative safety levels shall be

established when possible.

RISK ASSESSMENTAll changes shall be risk assessed.

REPORTING AND ANALYSIS OFSAFETY OCCURRENCES

All safety occurrences shall bereported and analysed internally

at CPH.

Means to improve safety

IMPROVING THE STANDARD OF SAFETY

Means to maintain a high level of safety

MAINTAINING A HIGH STANDARD OF SAFETY

CONTROLLING SAFETY RISKS

AUDIT OF SAFETY PERFORMANCE

Safety performance shall be audited internally.

SAFETY TREND MONITORINGFlight safety shall be monitored toidentify undesirable safety trends.

DOCUMENTATION OF SAFETY ACTIVITIES

DOCUMENTATION FOR IMPLEMENTATION OF SAFETY INITIATIVES

Documentation shall verify that safety initiatives are implemented

(e.g. corrective actions and risk mitigations).

DOCUMENT AND DATA CONTROLAll safety documentation shall be

recorded and controlled.

CREATING A CONTINUOUSIMPROVEMENT OF SAFETY

CULTURE

SETTING SAFETY GOALS Safety goals shall be defined to

ensure a continuous improvement of safety.

PROPOSALS FOR IMPROVING SAFETY

All personnel are obliged to focus on improving flight safety.

SAFETY STRATEGY

The safety management system developed by Copenhagen Airports A/S is based on 12 strategic principles

38701.P20 12/7/06 9:38 PM Page 20

tems in order to avoid disrupting thereporting process.

CPH developed a basic database to logall safety occurrences. These data will beused in the future to perform trend mon-itoring, one of the organization’s strategicprinciples and another element of SMS. Adaily drill has now been established toreview all incoming reports with the pur-pose of highlighting significant occur-rences. All occurrences are assessed andclassified in terms of their impact on safe-ty using an occurrence severity classifica-tion scheme. Subsequently, they areanalysed with the aim of decidingwhether to undertake an investigation.

The objective of such investigations isto identify what went wrong in a particu-lar incident and determine how a reoc-currence can be prevented. The purposeis not to allocate blame, as this is con-trary to the goal of creating a just safetyculture. The investigative process takeson a wide perspective with the intent ofaddressing the specific cause of theoccurrence.

An Airside Safety Task Force has beenestablished by Copenhagen Airports A/S.This is chaired by the safety manager, whois in direct contact with the aerodromemanager. The intention of the new taskforce is to conduct incident investigationsand recommend corrective actions. Themembers are selected on the basis of theirin-depth knowledge of specific operationalor technical fields. Five of the task force’s11 members have attended incident inves-tigation training courses.

The Runway Safety Team has alsobeen established. This is chaired by theaerodrome manager, with representa-tives from the air traffic services (ATS)provider and domestic air carriers. Thefocus within the team is to reduce thenumber of runway incursions atCopenhagen Airport.

With only limited guidance materialavailable to aerodrome operators whenCPH began introducing its SMS, theorganization opted to develop its ownaerodrome occurrence severity classifica-tion scheme for classifying the impact ofoccurrences. The structure of this scheme

AIRPORT SAFETY

was derived from the ICAO model, anduses a scale ranging from AA (AircraftAccident) to E (Not Determined).

Safety levels. It was decided early in theimplementation process to not define andpublish an overall quantitative level ofsafety, at least not for the present. Theorganization does not yet possess eitherthe expertise or extensive knowledgebase needed to define an overall quantita-tive level of safety. Instead, CPH relies ona top-ten list of the most significant safetyrisks, enumerated in order of priority.The risks are discerned using informationfrom existing reporting systems and trendmonitoring. For each risk, a goal is definedas well as a roadmap forreaching the goal. Examplesof risks identified are runwayincursions, problems associ-ated with FOD, and taxiwayincursions.

Available data are beingreviewed to ensure that thepriority list is up-to-date,along with the associated goals androadmaps. Once fully implemented, thelist will become integrated in the dailymanagement of the airport.

A primary requirement when defininggoals is to ensure that they are practicaland measurable. In addition, sufficientdata needs to be on hand.

Risk assessment. The requirement forrisk assessment represents the most rad-ical change associated with a safety man-agement system. Risk assessments arean important means of ensuring proactivesafety management. With this element inplace, no change affecting the airport’soperation may proceed without a riskassessment showing that all risks aremaintained at an acceptable level. Wherethis is not the case, an appropriate meansof mitigating the risks must be found.

If not implemented and then controlledproperly, the introduction of risk assess-ments may jeopardize the successful appli-cation of the safety management system,especially considering the system’s directimpact on daily work routines. CPH hastherefore planned the year-long imple-mentation process very carefully. During

this period Copenhagen Airports A/S willconduct internal risk assessment coursesto ensure that relevant personnel are com-petent enough to make the assessments,which will be based on qualitative, insteadof quantitative, data. It will also developpractical material to guide staff in per-forming their daily work regimen.

The responsibility for making riskassessments currently rests with the proj-ect manager and/or the manager respon-sible for the particular airside activity.

Route to successBased on the experience gained by

CPH in implementing its SMS, these area few key recommendationsthat other aerodrome opera-tors might consider in theevent they are just beginningthis process.• Do not reinvent the wheel.Extensive literature is avail-able on the subject of safetymanagement systems, includ-

ing information tailored to the aviationindustry. ICAO’s newly released Document9859 is a comprehensive work of reference.

Adopt what is known as best practicesand integrate this into the current organi-zation’s regimen. It is important to pres-ent safety management as a tool focusedon improving flight safety at the aero-drome. An SMS uses many of the sameprinciples found today in quality manage-ment and environmental managementsystems. The aerodrome SMS has aproactive approach to aviation safety; thatis, it focuses on accident preventionrather than preventing reoccurrences fol-lowing an aircraft accident.• Ensure senior management support. Thedecision to implement an SMS must betaken by senior management, and must bebased on a sincere desire to work proac-tively to advance safety and not simply awish to fulfil a regulatory requirement.Management support is essential, as SMSintroduces procedures that have an effect

NUMBER 6, 2006 21

Thomas Lau Christensen, the Safety Manager for Copen-hagen Airports A/S, has been a speaker at recent ICAO seminars on runway safety and ATS safety management.


Risk assessmentsare an important

means of ensuringproactive safety

management

38701.P21 12/11/06 6:55 PM Page 21

LTHOUGH aviation is amongthe safest means of transport,risk is a constant reality — as is

true with any human activity — and thefact remains that any aviation operationcan lead to an accident.

To promote safe operations, ICAO hasdeveloped many standards and recom-mended practices (SARPs), and otherorganizations, such as Eurocontrol,develop regulations and issue guidancematerial for their implementation.However, despite every effort to enhanceair safety, accidents still occur.

Early in this decade serious accidents inEurope served as a wake-up call to domore to enhance air traffic management(ATM) safety. In October 2001, a runwayincursion at Milan’s Linate Airport causedheavy loss of life (see “Numerous factorscontributed to fatal runway incursion atMilan Linate Airport,” Issue 2/2004, pp 18-19); in July 2002, a mid-air collisionoccurred over Germany (“Accident reportunderscores critical importance of com-

ATM SAFETY

Implementation of ATM safety managementsystems remains a priority for Europe

Following two serious aircraft collisions in recent years, European States have intensified their efforts to improve safety in the area of air traffic management. Central to this effort is the widespreadpromotion of the principles of safety management.

EUROCONTROL

Aplying with ACAS resolution advisories,”Issue 5/2004, pp 18-20). Not since 1976had Europe suffered such disasters.

Eurocontrol took immediate action toaddress the safety issues arising fromthese accidents. It instigated a pro-gramme to raise awareness of ATM safe-ty requirements and to speed up imple-mentation of ATM safety managementsystems across Europe.

Eurocontrol is actively involved inimproving the safety of ATM operationsin European airspace. Indeed, much workhas been done over the past decade or soto enhance ATM safety by harmonizing— as far as possible — airspace struc-ture, ATM procedures and technology.This work has been undertaken in coop-eration with the European Civil AviationConference (ECAC), an inter-govern-mental body set up in 1955 to promotethe continued development of a safe, effi-cient and sustainable European air trans-port system.

Recent ATM safety enhancements inEurope have been achieved through sev-eral programmes requiring the collabora-tion of ECAC member States. The current

strategy foresees many changes inthe way airspace is managed andmuch closer cooperation betweenEuropean States. Recently, theEuropean Union (EU) launched alegislative initiative to create a“Single European Sky” (SES), adevelopment that will eventuallymean that the airspace over EUmember States will be treated as asingle continuum (see box, page23). This concept will have implica-tions for the way that air traffic man-agement in Europe is regulated.

Regulatory contextSince the early 1990s Europe has

sought to ensure strong safety oversightby separating safety regulation from itsmanagement, and by instilling safetywithin a gate-to-gate concept. This frame-work has allowed European States todevelop ATM safety systems based on acommon, agreed format.

With respect to ATM, safety regulationis based on a core structure of sixEurocontrol safety regulatory require-ments (ESARRs). ESARRs and other EUrules require that States take certainactions to ensure that safety systems aredeveloped in a controlled way, with acommon baseline. Safety systems mustalso form the basis for oversight of theATM system. The foundation for thedevelopment of the European ATM safe-ty framework, ESARRs complement andoften exceed ICAO standards.

In addition, ECAC member States areaudited by Eurocontrol. The audits focuson the timely, uniform and effectiveimplementation of ESARRs at the Statelevel, as well as on the safety oversightcapability of States in terms of air trafficmanagement. This latter activity isaligned with the safety oversight auditsthat are conducted by ICAO. To minimizeany overlap between the Eurocontrol andICAO audits, the two organizations workin unison, having signed a memorandumof cooperation in 2005.

In Europe, the progressive separationof the provision of air navigation services(ANS) from other government activitieshas led to the establishment of agenciesand corporations, both publicly and pri-vately owned, operating in an increasing-ly market-orientated way. This, in turn,

22 ICAO JOURNAL

Mat

urity

Scor

e(%

)

100

80

60

40

20

00 0.2 0.4 0.6 0.8 1

State number divided by number of participating ANSPs

200220042006

Figure 1. ATM safety frameworks implementedby service providers within ECAC States havematured significantly in recent years

38701.P22 12/7/06 9:38 PM Page 22

has given rise to the emergence of nation-al or regional bodies needed to regulatethis new ATM environment.

The European Commission has alsosignalled its intention to expand the roleof the European Aviation Safety Agency(EASA) to include ATM and airport safe-ty regulation. Since September 2003,when it became operational, EASA hastaken over several regulatory functionspreviously exercised by the national civilaviation administrations of EU memberStates. Although its role expansion willnot occur for a few years yet, preparationof the essential requirements for ATMhas now commenced. To ensure a com-prehensive approach, Eurocontrol isestablishing working links with EASA tomanage ATM safety regulatory issueswithin the context of current institutionalresponsibilities.

Safety management systemsSafety may be defined as the state in

which the risk of harm to persons orproperty is reduced to, and maintained ator below, an acceptable level through acontinuing process of hazard identifica-tion and risk management.

In the past, aviation safety has focusedon compliance with an increasingly com-plex set of regulations whose implemen-tation was overseen by regulators. Whilethis situation still exists, the steadyincrease in air traffic means that thenumber of accidents can be expect-ed to rise even if the accident ratedoes not change, a situation thatcalls for systematic and structuredsafety management. To maintain apublicly acceptable level of riskdespite increased activity, the air-craft accident rate must be reduced,a goal that can only be met by adopt-ing a more proactive approach tosafety.

Risk is best managed by implement-ing a dedicated system for managingsafety. Both ICAO and Eurocontrolrecognize the importance of this.ICAO Annex 11 requires that air traf-fic services (ATS) providers world-wide have a safety management sys-

ATM SAFETY

tem (SMS) in place, while ESARR 3 specifi-cally requires that Eurocontrol memberStates (and ECAC member States on a vol-untary basis) ensure that all serviceproviders have an SMS in place.

An SMS provides a management struc-ture within which safety roles and respon-sibilities of organizations and individualsare clearly set out. Guidance is given tomanagers on how their responsibilities arebest put into practice, and best practicesare identified. Training requirements areset down and the use of safety tools, suchas risk assessment, is explained.

An SMS is required to make safety anexplicit activity within an organization. Itserves to systematically identify all safetyrisks and implement appropriate mitiga-

tion measures. The SMS must provideconsistent, efficient and practical supportfor organizational projects as well asdemonstrate regulatory compliance. Itmust support effective operations whileadequately addressing safety. With anSMS in place, safety improvements arecontinuously identified and prioritized.

In early 2006 ICAO issued the first edi-tion of its Safety Management Manual, adocument aimed at all sectors of the avia-tion industry. For ATM it covers not onlythe actions required by service providers,but also those entities involved in acci-dent investigation and safety oversight.The document lists many important fac-tors in the overall management of safety.No single factor will meet today’s expec-

tations for risk management, but anintegrated application of most of thefactors will increase the aviation sys-tem’s resistance to unsafe acts andconditions.

Failure to implement a robustsafety management system couldresult in safety activities not beingcarried out, or being carried out atthe wrong time or at high cost. If thiswere to occur, the accident rate maynot decline.

Safety enhancementAs a direct result of the aircraft

collisions cited above, Eurocontrolinstituted a review of ATM safetywithin ECAC member States. Thisstudy led to three fundamental con-

NUMBER 6, 2006 23

Organize

Facilitate

EUROCONTROLAgency

Publishedprocedure(s)

Follow-up

Help Desk

Identification of awarenessrequirements

Draft procedure(s)

Identification oftraining needs

Identification ofactions required

e.g. coordination with regulator or consultation

with staff

Workshop(s)

Field activities

Carry outactions required

e.g. coordination with regulator or consultation

with staff

Get the training done

Conduct of awareness

initiatives

FEEDBACKNext step

Figure 2. The SASI Project was designed to help ANS providers implement the basicelements of an SMS

MUCH PUBLICITY has been given to the forma-tion of the Single European Sky that will trans-form the currently fragmented approach to airtraffic management in Europe. It is anticipatedthat in the longer term this will lead to fewer serv-ice providers and therefore fewer air traffic con-trol units.

Eurocontrol is providing support to theEuropean Commission in drawing up the meas-ures for implementing the Single Sky regulations.Eurocontrol is also providing harmonized guid-ance and direct support to States, national super-visory authorities and ANS providers to help

SINGLE EUROPEAN SKY


38701.P23 12/11/06 6:55 PM Page 23

clusions: firstly, that leadership and com-mitment to safety in many States — forboth regulation and safety management— needed to be strengthened; secondly,that resources, particularly trained andqualified personnel, required bolstering;and thirdly, that the level of implementa-tion of ATM safety management systemsacross Europe was uneven. It was alsoconcluded that until those issues hadbeen resolved, little substantial progresscould be made on other issues.

A strategic action plan was drawn up toenhance safety in areas where it wouldhave the most direct impact and, in partic-ular, the areas highlighted by the twomajor accidents. There were some techni-cal issues, too: It was found, for example,that some guidance material for airbornecollision avoidance system (ACAS) proce-dures was unclear, and in some instancesmisleading. Early action was thereforetaken, in conjunction with ICAO, toimprove that situation. Ground-based safe-ty “nets,” particularly the short term con-flict alert (STCA), were also addressedbecause the appropriate standards andguidance material were not yet in place.Since 2002, much work has been under-taken by Eurocontrol on bothairborne and ground-basedsafety protection, which willresult in the introduction ofEuropean standards forground-based safety nets dur-ing 2007. However, funda-mental to the enhancementof aviation safety in Europewas a heightened awarenessof ATM safety requirementsand the importance of intro-ducing an ATM SMS.

Eurocontrol’s objective is to raise thelevel of SMS implementation acrossEurope to at least 70 percent of the safetyrequirements being met. To that end, astrategic safety action plan was in effectfrom February 2003 until the end ofJanuary 2006, an initiative that was fol-lowed by a new European safety pro-gramme for ATM. With the strategic safe-ty action plan in effect, ATM safety frame-works within ECAC States matured sig-

ATM SAFETY

nificantly, as illustrated in Figure 1 (page 22).A number of activities related to these

safety programmes, as described below,contribute to the overall aim of fullyimplementing a European ATM safetyframework.

SMS implementation support for ANSproviders. In 2004, as part of its strategicsafety action plan, Eurocontrol launcheda project to provide support to ANSproviders. The main objective of the SASIProject, as it is known, is to help serviceproviders implement the basic elementsof an SMS. This is a fundamental step inenhancing ATM safety in the ECAC area,and currently support is being providedto service providers in 21 ECAC memberStates, with more planned for 2007.

The SASI Project consists of a series ofworking sessions followed by a 16-weeklong field implementation in the ANSprovider’s own environment, with sup-port from Eurocontrol experts. It aims atachieving basic ICAO Annex 11/ESARR3 compliance (as a first step) by mid-2007.

The first SASI activities cover thedevelopment of a meaningful and cus-tomized safety policy, the implementationof the fundamental principles of safety

occurrence reporting, inves-tigation and competency,and lastly the progressiveintroduction of safety assess-ment and surveys (seeFigure 2, page 23).

This approach requires astrong commitment fromthe management at eachservice provider, notably byencouraging and supportingdesignated safety managers

in implementing the recommendedactions. It also relies on a timely imple-mentation of the recommended actionsby individual ANS providers.

SASI working sessions. One-week work-ing sessions are organized at Euro-control’s Brussels headquarters for eachSMS element to be implemented. Safetymanagers have the opportunity to devel-op their own draft procedures, identifyawareness requirements and associatedkey messages, identify training require-

ments and develop an action plan.The working sessions are labour inten-

sive, and highly interactive, so that expe-riences and ideas can be shared. Twenty-one ANS providers participated in theworking sessions to the end of 2006.Activities for 2007 are already planned,with one phase of the project set to becompleted in June 2007. In addition,beginning in May 2007 a specific SASI ini-tiative is planned for five more ANSproviders over the 2007-09 period.

Field implementation and support. Onceback within their own organizations, safe-ty managers are expected to apply theiraction plan (after its approval by theirorganizations). Further support may berequired from Eurocontrol during fieldimplementation, the last and most delicatephase of the SASI Project, as safety man-agers may be involved in numerous othertasks and may also lack adequateresources.

By the end of January 2006, ATM safetyframeworks within Europe had on averageachieved 70 percent of full implementation.The objective is to raise safety systems inall States in Europe to at least 70 percentimplementation by the end of 2008.

Incident reporting. An integral part ofany SMS is a comprehensive occurrencereporting system, since hazard identifica-tion is a critical step in managing safety.Each hazard identified must be evaluatedand prioritized, a process that requires thecompilation and analysis of all availabledata using appropriate analytical tools.With this information about hazards, risksare identified, assessed and finally man-aged. A database may be required to facil-itate the storage and retrieval of informa-tion, and a safety “cycle” needs to be estab-lished to ensure that identified risks aremanaged properly.

States are required by ICAO Annex 13to establish a mandatory incident report-ing system to facilitate the collection ofinformation on actual or potential safetydeficiencies. They are also encouraged toestablish a voluntary incident reportingsystem and adjust their laws, regulationsand policies in such a way as to encour-age reporting.

24 ICAO JOURNAL

Before SES canbecome a reality,

robust safety management

systems must be put in place by allservice providers

38701.P24 12/7/06 9:38 PM Page 24

As highlighted by a 1998 Eurocontrolreport on ATM performance, “significantvariations exist in the scope, depth, consis-tency and availability of ATM safety data”across the ECAC area. The report under-scored the fact that achievement of consis-tent high levels of aviation safety and ATMsafety management required the effectiveuse of harmonized occurrence reportingand assessment schemes. Harmonizedschemes would lead to moresystematic visibility of safetyoccurrences and their caus-es, and would highlight theappropriate corrective actionsand areas where safety couldbe improved through chan-ges to the ATM system.Harmonized schemes wouldalso provide the data neededto operate an SMS. Thereport led to the publicationof ESARR 2, a regulation con-cerning the reporting andassessment of safety occur-rences in ATM, and an ATMsafety database. Moreover,the EU has issued a directiveon occurrence reporting incivil aviation, and set up a database forinformation collected through the require-ments set out in the directive.

Over the past few years EuropeanStates and ANS providers have made con-siderable progress towards implementingincident reporting schemes. However, theprocess is still not comprehensive, and thequality of the data still varies significantlyfrom country to country. Despite the clearbenefits of sharing information, someStates and ANS providers remain con-cerned that their safety record might becompared unfavourably with others.

A “just culture.” In addition, ATM pro-fessionals have expressed concern aboutpublic perception and especially the atti-tude of the judicial system. There is grow-ing concern about the occasional inter-vention of the legal system, a trend thatengenders fear of sanctions amongreporters. Furthermore, certain mediahave dealt unsympathetically with appar-ent breaches of safety within certain air-

ATM SAFETY

lines and service providers. All of thesefactors have had the cumulative effect ofreducing the level of reporting and there-fore information sharing.

Such issues have been addressed byEurocontrol by setting up a task force in2005. It concluded that while changes tocurrent legislation were not required toprotect safety data, there did exist consid-erable variations in the approach of judi-

cial systems. In some States, good prac-tices were supported by appropriate leg-islation, but sometimes good practiceswere still embedded within an ambiguouslegislative framework, and sometimesneither the good practices nor the neces-sary legislative framework were in place.

The Eurocontrol task force also con-cluded that in a significant number ofcases the credibility of safety regulation,including the oversight of safety reportingand assessment processes by States, isthreatened by a lack of human and finan-cial resources. A number of its recommen-dations concentrated on getting States toadapt their national legislative frameworksto foster a “just culture,” improve staffinglevels, raise awareness of the reportingrequirements, and disseminate best prac-tices. The group encouraged Euro-control’s governing bodies to take a leadin improving the situation.

The recommendations of the Euro-control task force have, among other

things, been adopted for the EuropeanSafety Programme for ATM, and a safetydata analysis function for ATM occur-rences is now being established in con-junction with the European CoordinationCentre for Aviation Incident ReportingSystems (ECCAIRS), the Europe-widedatabase for all aviation occurrences.However, the European ATM communitystill needs a risk warning system support-

ed by a common safety infor-mation repository.

The question of legal impe-diments is being addressedby opening a dialogue withthe judiciary and by holdingad hoc workshops. Euro-control has also issued guid-ance material on establishinga just culture to complementESARR 2.

SummarySerious accidents in recent

years have caused EuropeanATM authorities to reviewthe status of ATM safetyframeworks across the 42States of ECAC, and to put in

place a programme to advance implemen-tation of such frameworks, where neces-sary. By early 2006, half of the serviceproviders across Europe had establishedsafety management systems whose levelof maturity exceeds Eurocontrol’s imple-mentation target.

As an outgrowth of efforts to improveATM safety in Europe and encourageStates and service providers to ensurerobust safety management systems havebeen put in place, Eurocontrol and ICAOare cooperating more closely on ATMsafety matters. The ICAO regional officein Paris and Eurocontrol are workingtogether to help ICAO member States of

NUMBER 6, 2006 25

The European Organization for the Safety of AirNavigation (Eurocontrol) develops, coordinates andplans for implementation of pan-European ATM strate-gies and their associated action plans in a collectiveeffort with all stakeholders. The primary objective of the organization, which currently numbers 37 member States, is the development of a seamless ATMsystem across Europe. For more information, visitwww.eurocontrol.int.


Eurocontrol’s efforts to accelerate implementation of ATM safetymanagement systems across Europe are motivated in part by thesafety challenge posed by the continent’s steady growth in air traffic

38701.P25 12/11/06 6:55 PM Page 25

NTERNATIONAL civil aviation’s out-standing safety record is largely attrib-utable to the dedication to safety

shown by aviation organizations and theirpersonnel. Equally important is a continu-ous learning process based on the devel-opment and free exchange of safety infor-mation, as well as industry’s ability to turn

operating errors into preventive actions.Endeavours aimed at improving avia-

tion safety must build upon empiricaldata. Fortunately, there are severalsources of such data available to the avia-tion community. In combination, thesesources of information provide the basisfor a solid understanding of the strengthsand weaknesses of aviation operations.

Information gathered from accident and

DATA PROTECTION

Guidance material addresses concernsabout protection of safety information

Legal guidelines developed recently by ICAO focus on enactment of national laws and regulationsthat safeguard data collected for safety purposes while also allowing for justice to take its course

SILVÉRIO ESPÍNOLA • MARCUS COSTA

DANIEL MAURINO

ICAO SECRETARIAT

I

incident investigations has long formedthe backbone of activities aimed atimprovements in equipment design, main-tenance procedures, flight crew training,air traffic control systems, airport designand functions, weather support services,and other safety-critical aspects of the airtransport system. In recent years, techno-logical advances have led to an accelerateddevelopment of safety data collection, pro-cessing and exchange systems. Safetydata collection and processing systems(SDCPS) form the pillars of a safety man-

agement system (SMS), and generateinformation that is used to implement cor-rective safety actions and proactive, long-term strategies.

Accidents and serious incidents arerare occurrences, usually reflecting theinterplay of circumstantial factors. It isoften difficult, when using informationfrom the investigative process exclusive-ly, to uncover unsafe operating practices

in time to deal with them appropriately.Moreover, since accidents and incidentsrepresent failures of the aviation system,human performance data obtainedthrough investigations inevitably reflectunsuccessful system and human per-formance, or what might be called unmit-igated operational errors.

On the other hand, a typical aviationoperation – not unlike any human activity –involves frequent, minor and, most impor-tantly, inconsequential errors such asselecting wrong frequencies, diallingwrong altitudes or acknowledging incor-rect read-backs. Some of these types oferrors reflect natural limits in human per-formance, while others are fostered bysystemic shortcomings, but most are acombination of both. Nevertheless, thefact remains that these frequent and minorerrors have the same damaging potentialas rare and major errors underscored byaccident and incident investigation.

Fortunately, the damaging potential ofminor errors is mitigated by the success-ful coping strategies employed by operat-ing personnel and the protective role ofspecific system defences that act to con-tain errors. Emerging SDCPS systemscapture successful coping strategies andeffective system defences. Simply put,they highlight what works well in theoperating sphere.

Countermeasures to operational errorsare best developed by combining the les-sons gleaned from occurrence investiga-tions with information about successfulstrategies and defences obtained fromsafety data collection and processing sys-tems. The latter systems rely on one ofthree methods for collecting data: self-reporting, electronic capture or directobservation. With few exceptions, such

26 ICAO JOURNAL

Safety data collection and processing systems highlight successes in mitigatingoperational errors and can therefore lead to more insightful conclusions about safety

Jim

Jorg

enso

n

38701.P26 12/7/06 9:38 PM Page 26

data programmes are voluntary in natureand, without exception, confidential andnon-punitive. Since they never cease func-tioning, emerging safety data collectionand processing systems generate a greatvolume of information to support safetyefforts, including long-term strategies.

All safety data collection and reportingsystems can highlight system and humansuccess in mitigating operational errors.Such systems lead to more complete con-clusions about safety, thus enhancingdevelopment of countermeasures tohuman error.

One example of an industry initiative tocollect safety data through voluntaryreporting is the Aviation Safety ActionProgramme (ASAP). Flight data analysisprogrammes such as the Flight OperationsQuality Assurance (FOQA) Programmeare based on electronic capture of safetydata. Examples of the third category ofSDCPS, involving direct observation ofpersonnel at work by specially trainedexperts, are the Line Operations SafetyAudit (LOSA) and the Normal OperationsSafety Survey (NOSS). (For more onLOSA, see Issue 4/2002, a special editiondedicated to this topic. For details aboutNOSS, see Issue 3/2004, pp 14-16.)

International situation. Safety data col-lection and processing systems have madepossible a deeper understanding of opera-tional errors. Without ques-tion, in general operationalerrors in aviation are inadver-tent and involve well-trainedand well-intentioned peoplewho may err while conductingoperations or maintaining well-designed equipment. For thoserare situations involving sabo-tage or reckless misconduct,enforcement systems ensurethat those responsible are heldaccountable.

This two-prong approach,balancing enhanced under-standing of inadvertent oper-ational errors with appropri-ate enforcement of rules incases of misconduct, hasserved civil aviation well.

DATA PROTECTION

While promoting safety, it also deniesimmunity to violators.

In recent years, however, informationfrom these systems has been used for dis-ciplinary and enforcement purposes andhas also been admitted as evidence in judi-cial proceedings where criminal chargeshave been brought against individualsinvolved in aviation occurrences. Thistrend is a concern, since the inappropriateuse of safety data may hinder the develop-ment and free exchange of informationthat is essential to efforts to improve avia-tion safety.

The civil aviation community hasrepeatedly attempted to ensure the pro-tection of safety data, with mixed success.Such efforts must strike a very delicatebalance of interests between the need toprotect safety information and theresponsibility to administer justice. A cau-tious approach is necessary to avoid mak-ing proposals that prove incompatiblewith national laws and policies.

Within ICAO, a number of provisionsaddress the protection of certain sourcesof safety information, among them anAssembly resolution urging States toensure that national laws, regulations andpolicies comply with ICAO Annex 13. Inaddition, the ICAO Assembly has calledfor voluntary and non-punitive reportingsystems to be implemented, and has

directed ICAO to participate in efforts toimprove safety information reporting andsharing of information.

ICAO Annex 13, Aircraft Accident andIncident Investigation, establishes (para5.12) that information gathered by a safe-ty investigation — including statementsfrom persons, communications betweenpersons involved in an aircraft operation,medical and private information, cockpitvoice recordings and transcripts, andopinions expressed in the analysis ofinformation — shall not be made avail-able for purposes other than accident orincident investigation unless the appro-priate authority for the administration ofjustice determines that their disclosureoutweighs the adverse domestic andinternational impact such action mayhave on that or any future investigations.

Annex 13 also establishes (para 8.3)that voluntary incident reporting systemsshall be non-punitive, and sources ofinformation shall be protected. ICAOAnnex 6, Operation of Aircraft (Part I,para 3.2.4) stipulates that flight dataanalysis programmes shall be non-puni-tive and shall contain safeguards to pro-tect sources of data.

ICAO provisions protecting certainaccident and incident records are explicitregarding their admissibility in judicialproceedings. While this is the case for

NUMBER 6, 2006 27

Legal guidance developed by ICAO is designed to prevent the inappropriate use of informationcollected solely for the purpose of improving aviation safety

Jim

Jorg

enso

n

38701.P27 12/7/06 9:39 PM Page 27

information obtained from cockpit voicerecorders and transcripts, similar protec-tion is not evident with respect to infor-mation obtained from emerging SDCPSsystems. In the absence of explicit word-ing such as that contained in Annex 13,information from safety data collectionsystems is protected by agreementsestablished by operators and serviceproviders. However, the legal protectionsuch agreements afford toSDCPS information withinthe different judicial systemsaround the world is ratherdifficult to ascertain.

Few States have promulgat-ed national legislation protect-ing information obtained fromself-reporting safety and elec-tronic safety data collectionsystems, and in some coun-tries legal reform may berequired to accommodate such legislation.Moreover, protection of information fromdirect observation safety data collectionsystems is not currently addressed by leg-islation in any State.

Since current ICAO provisions, as wellas international and national legislation,do not sufficiently address the protectionof information obtained from SDCPS sys-tems other than certain accident and inci-dent records, in many States national leg-islation may give inadequate protection tosuch information. This has created theneed for legal guidance that covers theprotection of all relevant safety data col-lection and processing systems, and thatis the product of a cautious internationalconsensus.

Legal guidance. ICAO has formulatedlegal guidelines that address concernsabout the protection of safety data. Thismaterial was drawn up in response to arequest by the ICAO Assembly, whichadopted a resolution in 2004 directing theorganization “to develop appropriate legalguidance that will assist States to enactnational laws and regulations to protectinformation gathered from all relevantsafety data collection and processing sys-tems, while allowing for the properadministration of justice in the State.”

DATA PROTECTION

As a first step in preparing these guide-lines, States were called on to provideexamples of their relevant laws and regula-tions relating to the protection of informa-tion obtained from SDCPS. Subsequently,ICAO conducted an analysis of the submis-sions received, seeking common threadsand conceptual points. The legal guidancethat resulted takes the form of a series ofprinciples that has been distilled from such

laws and regulations.As the guidance material

primarily relates to two chap-ters of ICAO Annex 13, themost effective means of dis-seminating the informationwas through an attachmentto Annex 13. Consequently,notes were added to Chap-ters 5 and 8 of Annex 13, witha further note added toAnnex 6 (para 3.2.4 of Part I),

referring to the legal guidance containedin new Attachment E to Annex 13.

The objective of the guidance materialis to prevent the inappropriate use ofinformation collected solely for the pur-pose of improving aviation safety.

To provide States with the flexibility todraft laws and regulations in accordancewith their national policies and practices,the legal guidance is formulated in a waythat can be adapted to meet the particularneeds of the State. Following is a briefoutline of the guidance material in termsof its general principles, as well as itsprinciples of protection and the questionof public disclosure.

Providing protection to qualified safetyinformation under specified conditions ispart of a State’s safety responsibilities.The sole purpose of protecting such infor-mation from inappropriate use is toensure its continued availability so thatproper and timely preventive actions canbe taken to improve aviation safety. Theprotection of safety information is notintended to interfere with the properadministration of justice.

National laws and regulations protect-ing safety information should ensurethat a balance is struck between theneed for protection and the need for the

proper administration of justice. Na-tional laws and regulations protectingsafety information should prevent itsinappropriate use.

The ICAO guidance material sets out anumber of tenets related to the protectionof safety information. Safety informationshould, for instance, qualify for protectionfrom inappropriate use according to spec-ified conditions that should include, butnot necessarily be limited to, a commit-ment to collect the information for explic-it safety purposes and to avoid any disclo-sure that would inhibit the continuedavailability of such information.Protection should be specific for eachsystem by being based on the nature ofthe safety information it contains. In addi-tion, a procedure should be establishedto provide formal protection to qualifiedsafety information in accordance withspecified conditions.

Safety information should not be usedin a way that is different from the purpos-es for which it was collected. Further-more, its use in disciplinary, civil, admin-istrative and criminal proceedings shouldbe carried out only under suitable safe-guards provided by national law.

According to ICAO guidelines, excep-tions to the protection of safety informationshould only be granted by national lawsand regulations when there is evidence —or whenever an appropriate authority con-siders that circumstances reasonably indi-cate — that the occurrence was caused byan act legally defined as conduct withintent to cause damage, or conduct withknowledge that damage would probablyresult, behaviour that is equivalent to reck-less conduct, gross negligence or wilfulmisconduct.

This principle would also apply whenan appropriate authority determines thatthe release of the safety information isnecessary for the proper administration

28 ICAO JOURNAL

Silvério Espínola is the Principal Legal Officer in theLegal Bureau at ICAO headquarters, Montreal. MarcusCosta is the Chief of the Accident Investigation andPrevention (AIG) Section in the ICAO Air NavigationBureau; Capt. Daniel Maurino, of the Flight Safety(FLS) Section in the Air Navigation Bureau, is theCoordinator of the ICAO Flight Safety and HumanFactors Programme.


Protection of qualified safety

information under specified

conditions is a State’s

responsibility

38701.P28 12/11/06 6:55 PM Page 28

WHILE they may not be proactive innature, unlike the other tools associatedwith a safety management system, reportsof aircraft accidents and serious inci-dents continue to be a time-honouredmeans of promoting safety, in partbecause they present recommendationsfor change that could enhance safety, butalso because they alert managers andoperating personnel to critical issues.

Under ICAO Annex 13, States routine-ly forward copies of their reports of inves-tigations of fatal aviation accidents andserious incidents to ICAO, which arethen entered into the organization’s acci-dent and incident reporting (ADREP)system for trend analysis and risk assess-ment within ICAO, among other things.The final reports on accidents of specialinterest are included in the ICAOAircraft Accident Digest.

Among notable accident reportsreceived in recent months was that of theHelios Airways Boeing 737 crash nearAthens, Greece in August 2005, dissemi-nated by the Hellenic Air AccidentInvestigation and Aviation Safety Board(AAIASB) in October 2006. Also of notewas the report on a fatal Boeing 747freighter crash at Halifax, Canada inOctober 2004, released by theTransportation Safety Board of Canada(TSB) in June 2006.

Following are brief summaries of theconclusions contained in these reports.(Space constraints prevent reproductionof report findings and recommendations,however, website links have been indicat-ed for readers who are interested inreviewing the full report.) Also highlight-ed below is a safety alert arising from thecrash of a Comair Bombardier CRJ100in the United States in August 2006.

SAFETY INFORMATION

Information gleaned from recent accidentsprovides basis for safety improvements

Final reports issued by investigation authorities, plus safety alert arising from the August crash of a regional jet transport, serve the aviation community by underscoring various safety issues

Helios Airways Flight 522On 14 August 2005, a Boeing 737-300

operated by Helio Airways departedLarnaca, Cyprus at 0607 local time forPrague, Czech Republic, via Athens,Greece. The aircraft was cleared to climbto FL340 and to proceed direct to theRDS very high frequency omnidirection-al radio range (VOR). As the B737ascended through 16,000 feet, the captaincontacted the company OperationsCentre to report a take-off configurationwarning and an equipment cooling sys-tem problem (a warning horn had sound-ed and the avionics bay temperaturewarning light had illuminated). Thewarning horn to which the captain hadresponded in factconcerned the cabinaltitude and was acti-vated by a lack ofpressurization.

Several communi-cations between thecaptain and the Oper-ations Centre con-cerning the prob-lems confronting theflight crew took placeover a period ofeight minutes, end-ing as the aircraftclimbed through 28,900 feet. Thereafter,there was no response to radio calls tothe aircraft. The flight crew, who had notdonned oxygen masks, probably lost use-ful consciousness as a result of hypoxiasome time after their last radio communi-cation on the company frequency at 0620,approximately 13 minutes after take-off.(During the climb, passenger oxygenmasks deployed automatically at an air-craft altitude of 18,200 feet, but the pilots

did not become aware of this fact.) As pro-grammed, the aircraft levelled off at FL340and continued on the route entered intothe flight management computer.

At 0721, the aircraft flew over the KEAVOR, then over the Athens InternationalAirport, and subsequently entered theKEA VOR holding pattern at 0738. At0824, during the sixth holding pattern,the Boeing 737 was intercepted by two F-16s of the Hellenic Air Force. One of theF-16 pilots observed the aircraft at closerange, reporting at 0832 that the captain’sseat was vacant, the first officer’s seat wasoccupied by someone who was slumpedover the controls, the passenger oxygenmasks could be seen dangling, and three

motionless passen-gers could be seen intheir seats with oxy-gen masks donned.No external damageor fire was noted. Thecrew did not respondto radio calls from themilitary escorts.

At 0849, the F-16pilot reported that aperson (later deter-mined to be a flightattendant who held acommercial pilot’s

licence) not wearing an oxygen mask hadentered the cockpit and occupied the cap-tain’s seat. At 0850, the 737’s left engineflamed out due to fuel depletion, and theaircraft started descending. At 0854, twoMayday messages were recorded on thecockpit voice recorder (CVR).

At 0900, at an altitude of approximately7,100 feet, the right engine also flamedout. The aircraft continued to descendrapidly and impacted hilly terrain at 0903,

NUMBER 6, 2006 29

The digital pressure control panel of theB737-300. The AUTO and ALTN posi-tions provide automatic cabin pressurecontrol, while the MAN position allowsmanual control

38701.P29 12/7/06 9:39 PM Page 29

in the vicinity of Grammatiko, Greece,approximately 33 kilometres north-westof the Athens International Airport. The115 passengers and six crew members onboard were fatally injured, and the air-craft was destroyed.

The AAIASB determined that the acci-dent resulted from both direct and latentcauses. Among the direct causes, theinvestigation determined that the crew didnot recognize that the cabin pressurizationmode selector was on the manual positionduring performance of their pre-flight,

before-start and after-take-off checklists(the selector had been placed on MANduring unscheduled maintenance). Inaddition, the crew did not detect the rea-son for the activation of the cabin altitudewarning horn, apparently interpreting thisas a take-off configuration warninginstead; nor did they notice an indicationof passenger oxygen mask deployment orthe master caution light. With the flightcrew incapacitated by hypoxia, the aircraftwas flown by the flight management com-puter and autopilot until the fuel wasdepleted, resulting in engine flameout andimpact with the ground.

Among latent causes cited by theAAIASB were deficiencies in the opera-tor’s organization, quality managementand safety culture, as well as the regulato-ry authority’s inadequate execution ofsafety oversight. Also highlighted werethe inadequate application of crewresource management (CRM) principlesand the ineffectiveness of measurestaken by the aircraft manufacturer inresponse to previous pressurization inci-dents involving the same aircraft type.

The AAIASB cited a number of factorsthat could have contributed to the acci-

SAFETY INFORMATION

dent, among them the fact that the cabinpressurization mode selector was notplaced on the automatic position follow-ing aircraft maintenance. Also noted werethe lack of cabin crew procedures (at theinternational level) for addressing eventsinvolving the loss of pressurization andcontinuation of a climb despite thedeployment of the passenger oxygenmasks, and the ineffectiveness of interna-tional aviation authorities in enforcingimplementation of action plans that addressthe deficiencies documented in audits.

In the months fol-lowing the accident,the AAIASB made anumber of interimsafety recommenda-tions that were ad-dressed to the U.S.National Transporta-tion Safety Board(NTSB), the aircraftmanufacturer, the

Cyprus Air Accident and Incident Inves-tigation Board, Cyprus-based airlines, andthe Hellenic Civil Aviation Authority(HCCA). As a result of the investigation,the AAIASB noted, the U.S. FederalAviation Administration (FAA) issued anairworthiness directive requiring a revisionof B737 flight manuals to reflect improvedprocedures for pre-flight setup of the cabinpressurization system and crew responsesto cabin altitude warnings and take-off orlanding configuration warnings.

The report highlighted additional safe-ty deficiencies related to maintenanceprocedures, pilot training, normal andemergency procedures, airline organiza-tional matters, and safety oversight ofmaintenance and flight operations. Thefinal report of the AAIASB included anadditional 11 safety recommendationsaddressed to Cyprus, the EuropeanAviation Safety Agency (EASA) and JointAviation Authorities (JAA), and ICAO.

The 164-page report may be reviewedat the AAIASB website (www.rndt.eu/FINAL_REPORT_SB-DBY.pdf).

MK Airlines B747 freighterThe fatal crash of an MK Airlines

freighter at Halifax International Airporton 14 October 2004 underscores the needfor better systems to ensure correct take-off speed and thrust, according to aninvestigation by the TransportationSafety Board of Canada. The final report(No. A04H0004) is available at the TSB’swebsite (www.tsb.gc.ca./en/reports/air/2004/A04H0004/a04H0004.pdf).

The MK Airlines B747 was being oper-ated as a non-scheduled internationalcargo flight from Halifax, Canada toZaragoza, Spain. At about 0654Coordinated Universal Time, 0354 AtlanticDaylight Time, MK Airlines Flight 1602attempted to take off from Runway 24 atthe Halifax International Airport. The air-craft overshot the end of the runway for adistance of 825 feet, became airborne for325 feet, then struck an earthen berm.The aircraft’s tail section broke away fromthe fuselage, and the aircraft remained inthe air for another 1,200 feet before itstruck terrain and burst into flames. Theaircraft was destroyed by impact forcesand a severe post-crash fire. All sevencrew members suffered fatal injuries.

The report concluded that the speedand thrust settings selected by the crewmembers in preparation for their flight toSpain were incorrect for the weight of theBoeing 747-244SF.

The investigation found that the crewdid not receive adequate training on theBoeing Laptop Tool, a computer pro-gramme used to calculate the take-offvelocity and power necessary in light offactors such as fuel weight, payload andenvironmental conditions. TSB investiga-tors also found that crew fatigue and adark take-off environment may have com-pounded the likelihood of error. As a con-sequence, the board called on Canadianand international regulatory authoritiesto ensure that crews of large aircraft arealerted in time where there is not enoughpower to take off safely. The board rec-ommended that “The Department ofTransport, in conjunction with ICAO, theU.S. Federal Aviation Administration, theEuropean Aviation Safety Agency, andother regulatory organizations, establish

30 ICAO JOURNAL

Altitude(1 000 ft)

Rapid disconnect(moderate activity)

Rapid disconnect(sitting quietly)

22 5 minutes 10 minutes 25 2 minutes 3 minutes 28 1 minute 1 minute 30 seconds 30 45 seconds 1 minute 15 seconds 35 30 seconds 45 seconds 40 18 seconds 30 seconds 65 12 seconds 12 seconds

The length of time an individual can maintain useful con-sciousness when suddenly deprived of oxygen is primarilyrelated to altitude (Carlyle, 1963)


38701.P30 12/11/06 6:55 PM Page 30

NUMBER 6, 2006 31

In the wake of the planned terrorist plot to sabotage severalairliners over the North Atlantic, unveiled by U.K. authoritiesin mid-August 2006, ICAO has developed security guidelinesfor screening liquids, gels and aerosol products to be carriedin the passenger cabin, and the ICAO Council has recom-mended that member States implement these guidelines nolater than 1 March 2007.

As a result of the new security concerns, the Council hasalso decided to form a Secretariat study group to developlong-term, cost-effective and harmonious security measuresthat will not impact on the overall objective of safe and effi-cient civil aviation operations. The new group, to be com-posed of members of the Aviation Security (AVSEC),Facilitation and Dangerous Goods Panels as well as econom-ic and industry experts, is expected to present its recommen-dations before the end of June 2007.

The newly developed screening guidelines for carry-on liq-uids cover all gels, pastes, lotions, liquid and solid mixtures,and the contents of pressurized containers such as shavingfoam. Under the new guidelines, the affected containers arerestricted to a maximum capacity of 100 millilitres each evenif only partially filled. Such containers should be placed in atransparent, resealable one-litre plastic bag that is then pre-sented for visual inspection at the screening point, with a limitof one bag per passenger.

Exempted from the new screening process are medications,baby milk and foods, and items related to a special dietaryrequirement, although an appropriate and proportionatemeans of verifying the nature of such liquids also needs to beavailable. The guidelines recommend exemptions for liquidspurchased either at airport duty free shops or on board aircraft,provided these products are packed in a sealed plastic bagthat readily reveals tampering and that displays a satisfactoryproof of purchase on the day of the journey.

A revised list of prohibited items, intended to deal with thethreat posed by liquid, gel and aerosol products that may beused in improvised explosive devices, is also under develop-ment. The revised list is to be based partly on the work of theICAO International Explosives Technical Commission (IETC),which recently evaluated carry-on substances having char-acteristics that could make them attractive for use in a terror-ist attack. The list of prohibited items is considered a com-plex matter as it involves law enforcement, explosives tech-nologies, evaluation of trace detection equipment, training ofsecurity personnel, logistics and commercial considerations.

The ICAO Council has also adopted a recommendation byexplosives experts to encourage States to continue theirefforts to develop appropriate processes and technologiesfor dealing with the real threat from homemade explosives,while in the meantime applying some form of control orrestriction on liquids through screening points. It called forthe Ad Hoc Group of Specialists on the Detection ofExplosives (AH-DE) to convene a workshop in early 2007 to

share the results of ongoing work in this area and to developcommon approaches and best practices for the longer term.

Emphasizing the importance of cooperation with intelligenceagencies and regulators, ICAO has developed a point of contact(PoC) network for rapidly sharing significant security informationon an international basis. The PoC network, which uses asecure website for communications, so far involves registeredparticipants in some 70 States. Those States that are not yetpart of the network are being urged to join without delay.

Over the long term, ICAO intends to review and revise itssecurity standards and guidance for dealing proactively withany emerging threat. It will focus on how to further enhancethe integrity of airside security, including screening of work-ers and cargo, catering products and hold baggage, and thepossible relevance of other security measures such asbehavioural pattern recognition. ■■

ICAO UPDATE ICAO addresses security concern highlighted by failed terrorist plot

FIRST MEETING

The first meeting of the Commission of Experts of the Super-visory Authority of the International Registry was held at ICAOheadquarters from 6 to 8 November 2006 under the chair-manship of Laurent Noël (Switzerland). The commissionadvises ICAO Council on matters related to the registry, whichwas created by an international treaty — the Cape Town Con-vention and Aircraft Protocol — that came into effect in early2006. The registry is a central feature of the regime which willreduce the risks of lending for aircraft financiers, banks andother financing institutions involved in aircraft purchasing andleasing, thus reducing the cost of credit.

Disclosure authorizedA total of 82 ICAO Contracting States and two territories hadagreed by 23 November 2006 to the disclosure of either their fullsafety oversight audit report or an executive summary of theaudit report at ICAO’s website. The decision to release theresults of ICAO safety oversight audits to the public was madeby the world’s directors general of civil aviation at a safety con-ference at ICAO headquarters in late March 2006. ■■

38701.P31 12/7/06 9:39 PM Page 31

32 ICAO JOURNAL

FUNDING GRANT

ICAO received a grant of U.S. $405,000 from the Govern-ment of Canada during a brief presentation at ICAO head-quarters on 12 September 2006. The funding is in supportof the ICAO/Canada Security Awareness Training Pro-gramme. Debra Normoyle, Director General of Security andEmergency Preparedness at Transport Canada, is seenpresenting the grant on behalf of Foreign Affairs and Inter-national Trade Canada to Mohamed Elamiri, Director of theICAO Air Transport Bureau.

Central to its efforts to respond more effectively to the needsand expectations of member States, ICAO is focusing on theimplementation of safety management systems designed toachieve measurable results in aviation safety, ICAO CouncilPresident Roberto Kobeh González informed participants ofan international safety forum in early November.

The emphasis of ICAO’s first-ever business plan, theCouncil President explained, is performance-based pro-grammes and initiatives that “provide the greatest return oninvestment of limited human and financial resources, throughworking methods and management practices that lead toidentifiable results.” Safety management systems are onesuch initiative, a means of enhancing safety despite challeng-ing industry growth that strains safety oversight resources.

“Safety management systems are the most effective wayof responding to the need for effective supervision with a rel-atively small workforce,” stated Mr. Kobeh González. “Manymember States are implementing or exploring safety man-agement systems to complement the existing regulatorystructure. We encourage them to do so …”.

ICAO, the Council President added, offers concrete assis-tance in the form of standards and related guidance materialfor establishing safety management systems, including a setof aligned safety management provisions for aircraft opera-tions, air traffic services and aerodromes, as well as modellegislation to make it easier to implement SMS.

Other areas in which ICAO is concentrating its resourcesare the development of global performance-based securitymeasures amongst States; the pursuit of unified and coordi-nated measures to reduce civil aviation’s adverse impact onthe environment; and the implementation of harmonized air

traffic management systems and performance-based effi-ciency improvements.

The Council President’s 2 November address to the U.S.Federal Aviation Administration (FAA) International AviationSafety Forum elaborated on safety policy, including the shifttoward increased visibility of safety information, a develop-ment that “should encourage States to correct more quicklythe safety deficiencies that remain in their aviation systemsand make it easier for States and donors to provide morerapid and more effective assistance to those that requiremuch needed financial or human resources.”

Mr. Kobeh González remarked that so far some 80 Stateshave authorized ICAO to disseminate information on ICAOsafety oversight audits at its public website, and other Statesare expected to join them. In any event, the results from allICAO safety oversight audits will appear in summary form atICAO’s website beginning in March 2008, ushering in a newera of openness.

“This is an unprecedented development in terms ofincreasing transparency and sharing of information amongStates, as well as with the industry and the travelling public,”Mr. Kobeh González said.

In reflecting on the theme of the 2006 symposium, Safetyfrom Top to Bottom, the Council President asserted thatsafety demands “a firm commitment from senior manage-ment of airlines, airports, service providers, manufacturers,regulators and all other stakeholders, no matter how small,for aircraft operations to be as safe as is humanly possible.

“The commitment to safety must flow from the top like a water-fall and permeate every part of an organization,” he asserted.

The Council President’s full address to the 3rd Annual FAAInternational Aviation Safety Forum is available at the ICAOwebsite (www.icao.int). Also available at the website is thePresident’s address to the 27th Assembly of the LatinAmerican Civil Aviation Commission (LACAC) in Panama Cityon 6 November. ■■

SMS implementation leads to safety enhancement despite strong industry growth

Council elects VPs and committeechairmen for 2006-07The ICAO Council has elected three vice-presidents to servefor the 2006-07 period. The newly appointed vice-presidentsare: Igor Lysenko, Representative of the Russian Federation,as First Vice-President; Dr. Attila Sipos, Representative ofHungary, as Second Vice-President; and Julio Enrique OrtizCuenca, Representative of Colombia, as Third Vice-President.

The Council also elected the chairmen of the five Councilcommittees for a one-year period. Those appointed are: AirTransport Committee, Silvia Gehrer (Austria); Joint SupportCommittee, Bong Kim Pin (Singapore); Finance Committee,Dr. Nasim Zaidi (India); Unlawful Interference Committee,Donald Bliss (United States); and Technical CooperationCommittee, Daniel Oscar Valente (Argentina).

The ICAO Council, the governing body of the organization,comprises representatives of 36 States elected by the ICAOAssembly. ■■

38701.P32 12/7/06 9:39 PM Page 32

NUMBER 6, 2006 33

Symposium puts spotlighton ATC safetyICAO will hold a global symposium on threat and error man-agement (TEM) and the process for conducting a normaloperations safety survey (NOSS) in air traffic control inWashington, D.C. from 7 to 8 February 2007. Developed bythe ICAO Flight Safety and Human Factors Programme, thesymposium is intended to assist States and air traffic servic-es (ATS) providers in their efforts to monitor safety duringnormal ATS operations as part of a safety management sys-tem (SMS). Open to officials from civil aviation administra-tions, ATS providers, airlines, training institutions and profes-sional associations, the event is being hosted by the U.S.Federal Aviation Administration (FAA).

The symposium will highlight guidance material developed byICAO in recent years. With the assistance of a team of expertsknown as the Normal Operations Safety Survey Study Group(NOSSSG), the organization developed a circular on the subjectof TEM in air traffic control which promotes safety managementand provides training guidance. It has also developed a proto-col for conducting the normal operations safety survey, and hasarranged for several ATS providers to undertake NOSS trials.The symposium will feature case studies based on the experi-ence with implementing NOSS; these will be presented byAirservices Australia, Nav Canada, Airways New Zealand andEurocontrol. The event will conclude with a presentation andpanel discussion on the safety benefits of NOSS.

The event, to be conducted in English, is the second of itskind. The first symposium on TEM and NOSS in ATC was heldin Luxembourg in November 2005, with Eurocontrol as host.For details on NOSS, see “ICAO examining ways to monitorsafety during normal ATS operations,” Issue 3/2004, pp 14-16.

The venue for the Washington symposium, L’Enfant PlazaHotel, can accommodate a maximum of 150 participants.Registration is on a first-come, first-served basis, and closeson 10 January 2007. For more information, contact Capt. DanMaurino ([email protected], with a copy to [email protected]). ■■

Safety data system marks30th anniversaryThe ICAO accident/incident data reporting (ADREP) system,which contains some 34,000 occurrence reports on aircraft hav-ing a certificated maximum take-off mass of over 2,250 kilograms(5,000 lb), has now been in use as a safety tool for 30 years.

ADREP began in 1976 as a simple batch processing sys-tem. Managed by the Accident Investigation and PreventionSection (AIG) of the ICAO Air Navigation Bureau, ADREP waslast upgraded in 2004 by implementing a data system specif-ically developed for occurrence reporting. The same datasystem, developed by the Joint Research Centre (JRC) of theEuropean Union, has been installed in several EU memberStates as well as a number of countries outside the EU, andpermits the reporting of data to ICAO electronically.

ICAO encourages the establishment of safety data sharingnetworks. Information on data sharing and related tax-onomies is available at the organization’s website and canalso be found at the JRC website.

ADREP information is available for accident preventionpurposes and is provided on request to authorized officials inICAO member States. ICAO receives some 130 ADREPqueries from member States annually. The data is also usedin various ICAO safety-related initiatives. ■■

Experts to discuss performanceframework for air nav systemA global symposium on the performance of the world’s airnavigation system will take place at ICAO headquarters from26 to 30 March 2007. Government policy makers will join reg-ulators, air navigation services (ANS) providers, airport oper-ators and airspace users in Montreal to discuss the perform-ance of the air navigation system from the perspectives ofsafety, economics and management, operations, and tech-nological developments. Some 500 participants are expect-ed at the five-day event, which is seen as a follow-up to the11th Air Navigation Conference held in 2003, during which aperformance framework for an air navigation system basedon the global air traffic management (ATM) operational con-cept was outlined (see “11th Air Navigation Conferenceadopts global framework for airspace management evolu-tion,” Issue 8/2003, pg 24).

The symposium, which will heighten awareness of the needto create a performance framework for the purpose of enhanc-ing safety and efficiency in the air navigation system, is open

ICAO Council appointmentKarin Kammann-Klippstein has beenappointed Representative of Germanyon the Council of ICAO. Dr. Kammann-Klippstein’s appointment took effecton 1 July 2006.

Dr. Kammann-Klippstein is a graduateof the Universities of Hamburg andGeneva, where she specialized in inter-national law and law of the EuropeanCommunities. After serving as Coun-sellor for International Shipping Policy atthe German Federal Ministry of Trans-portation, she was appointed Transpor-

tation Counsellor at the Permanent Mission of Germany to theUnited Nations and other international organizations in Geneva.From 1992 to 1996, Dr. Kammann-Klippstein served as DeputyHead of the Division for International Transportation Policy at theFederal Ministry of Transportation in Bonn. She was then appoint-ed Transportation Counsellor at the German Embassy inWashington, D.C., a position she held until her appointment, in2002, as Deputy Head of the Division for Coordination of Aviationand Shipping Policy at the Federal Ministry for Transportation,Building and Urban Development in Berlin. ■■

K. Kammann-Klippstein(Germany)

to participation by the wider aviation industry as well as otherparties interested in air navigation and air transport perform-ance, among them financiers, consultants and members of theacademic community. Prominent moderators and speakers willlead the discussion on immediate and future issues related tothe performance of the air navigation system.

More information, including registration procedures, isavailable at the ICAO website (www.icao.int/perf2007). ■■

38701.P33 12/8/06 3:04 PM Page 33

34 ICAO JOURNAL

AMHS

ATN AIPAFTN

AIS

www.ubitech.com

inspirechange.

experience matters

15+ Global Deployments

50+ International Connections

2 Customer Certifications for AMHS

20 Years Experience

Global provider of ATS messaging technology

Global Symposium on Liberalization … An ICAO sympo-sium on air transport liberalization held in Dubai, United ArabEmirates on 18-19 September 2006 attracted over 250 partic-ipants from 65 States and 11 international organizations. Ledby prominent speakers, the event provided an opportunity toshare information, discuss issues and challenges, and exploreways to advance liberalization. The symposium was hosted bythe Dubai Department of Civil Aviation.

Traffic forecasts for transpacific and intra-Asia/Pacific … The ICAO Asia/Pacific Area Traffic ForecastingGroup recently developed a set of passenger and aircraftmovement forecasts for transpacific and intra-Asia/Pacificroutes, as well as passenger forecasts for major city-pairs ofintra-Asia/Pacific and transpacific (the latter to the year2010). The group also carried out analyses of flight informa-tion region (FIR) data for a sample week (1–7 July) for 2004-06 for the Fukuoka, Bangkok and Hong Kong FIRs, includingthe analysis of transpacific peak-hour aircraft movements.These forecasts and analyses are included in the report of thegroup’s October 2006 meeting, which will be available toContracting States on the ICAO-NET and on CD-ROMs toothers in December. In addition, it will be posted on a dedi-cated ICAO aviation statistics website (www.icaodata.com).

Aviation emissions trading … ICAO Secretariat organizeda series of briefings recently to update the ICAO Council and

Air Navigation Commission (ANC) on the work of theCommittee on Aviation Environmental Protection (CAEP) andsome of the key achievements anticipated for CAEP’s nextmeeting in February 2007 (CAEP/7). Of particular note werebriefings on aviation emissions trading to better acquaint theCouncil and ANC of key issues. These were presented by theSecretariat of the United Nations Framework Convention onClimate Change, the European Commission and CAEP’sEmissions Trading Task Group.

CNS/ATM business case analysis tool ... A computerapplication has been developed by the ICAO Air TransportBureau in support of the implementation of CNS/ATM sys-tems. The CNS/ATM database and financial analysis comput-er system (DFACS) model is an interactive, analytical tool thatenables air navigation services providers and airspace users tobuild, evaluate and compare the economics of alternativeoptions or scenarios for the implementation of CNS/ATM sys-tems. A CD-ROM containing the computer application, alongwith a user’s manual and an illustrative example, has beenmade available to ICAO regional offices. States may downloadthe application and the documents from the ICAO-NET web-site (Electronic publications/ ICAO documents).

Latest on trade-in-services matters … ICAO is closelyfollowing work of the Council for Trade in Services (CTS) ofthe World Trade Organization (WTO), which has commenceddiscussions on the second review of the Air Transport Annexof the General Agreement on Trade in Services (GATS), cov-ering developments in the civil aviation sector during theperiod 2000–05. The first review ending in 2000 did not resultin any expansion of the annex, which covers three air trans-port services (aircraft repair and maintenance, computerreservation systems, and selling and marketing). Aviationauthorities need to actively participate together with theirtrade counterparts in the discussions at CTS in order to exerta leadership role by ICAO in the process of economic liberal-ization within a safe and secure air transport environment.

Noise and emissions workshops … The third Workshop onAviation Operational Measures for Fuel and EmissionsReduction was jointly organized by ICAO and Transport Canadaon 20-21 September 2006 in Montreal to disseminate informa-tion on fuel and emissions reductions contained in ICAO’sCircular 303, Operational Opportunities to Minimize Fuel Useand Reduce Emissions, and to share practical experiences andsuccessful programmes that have contributed to emissionsreductions in all aspects of the aviation industry. In addition,ICAO organized and held the third Regional Aircraft NoiseCertification Workshop on 6-7 November in Bangkok, Thailand.

Course on user charges … A training course on interna-tional policies and practices for the establishment of airportuser charges was conducted in Zurich, Switzerland from 23-27 October 2006. The course was the second in a series thatICAO and the Airports Council International (ACI) are offeringto airports (see Issue 4/2006, pg 16).

The next ICAO/ACI workshop on airport user charges to beoffered in the English language will be convened in KualaLumpur, Malaysia on 12-16 February 2007. French and Spanishlanguage workshops will also be conducted in 2007. nn

AIR TRANSPORT BRIEFS

38701.P34 12/7/06 9:40 PM Page 34

NUMBER 6, 2006 35

Pandemic influenza guidelinesnow available at websiteGuidelines that States can apply to reduce the risk of pan-demic influenza being spread through air transport opera-tions have been posted at the ICAO website (www.icao.int).

Concurrently, a new provision has been adopted for ICAOAnnex 9, Facilitation, requiring that Contracting States estab-lish a national aviation plan for an outbreak of a communica-ble disease posing a public health risk. The changes, whichbecome applicable on 17 July 2007, revise the health infor-mation part of the aircraft general declaration form. They alsocall for the introduction of a passenger locator card that pub-lic health officials can use to trace passengers who may havebeen infected by a serious communicable disease.

In a related development, the ICAO plan for the air trans-port sector’s response to the outbreak of a communicabledisease has been incorporated into a United Nations actionplan that spells out the role of various UN agencies and part-ners in the event of a health emergency that requires a coor-dinated global response.

The guidelines which are now available from ICAO are animportant step in preparedness planning. Avian influenza cur-rently poses a substantial risk to the global populationbecause it is likely that at some unpredictable point in thefuture a strain of influenza will emerge that transmits easilybetween humans. If this were to occur, the World HealthOrganization (WHO) may call on the aviation community toimplement measures to limit the spread of disease.Moreover, aviation would undoubtedly be detrimentallyaffected by decreased traffic to areas where there is a per-ceived increased risk of disease. For both reasons it is there-fore necessary to plan for such an event.

The guidelines were developed over a period of months incooperation with WHO, the Centers for Disease Control andPrevention (CDC), Airports Council International (ACI),International Air Transport Association (IATA), and otherorganizations with appropriate expertise. The internationaleffort was coordinated by ICAO, which gained experience indeveloping related guidelines during the severe acute respi-ratory syndrome (SARS) outbreak in 2003.

Generic in nature, the ICAO guidelines are based on theWHO International Health Regulations published in 2005, andcan be applied to many communicable diseases, not onlyinfluenza. They will continue to be modified over time asmore information is gained on preparedness planning and onthe behaviour of relevant infectious agents.

In addition to guidelines that are directed towards States,more detailed guidance has been developed specifically foruse by airport operators and airlines. This information isavailable from ACI and IATA respectively.

ICAO has also been active in promoting a coordinatedresponse to any health crisis. The Asia/Pacific region is thefirst to be involved in an ICAO project that aims to harmonizepreparedness plans across the globe, known as theCooperative Arrangement for Preventing the Spread ofCommunicable Diseases through Air Travel (CAPSCA). Thepurpose of this project is to ensure that international airportshave a preparedness plan in place that is aligned with ICAOguidelines. Another important aim is the development of a

regional network of experts who can provide advice to theaviation sector on preparedness planning, and in the event ofan outbreak of a serious communicable disease.

If successful, the CAPSCA project will be extended toAfrica in 2007, and subsequently to other regions as well. ■■

ICAO and the Republic of Koreaannounce training programmeICAO and the Republic of Korea have signed a memorandum ofunderstanding on training programmes tailored for aviation per-sonnel from developing countries. Under the agreement signedin September 2006, the Korea Civil Aviation Training Centre(KCATC) will provide selected participants with courses on theglobal navigation satellite system (GNSS), nav aid maintenance,radar approach control and other technical subjects. To com-mence in 2007, the training programme will be established andadministered jointly by the Korean Civil Aviation Safety Authority(KCASA), the Korea International Cooperation Agency (KOICA)and the ICAO Technical Cooperation Bureau.

The initial programme is being offered on an annual basisfor a three-year period, at which point it may be extended.The training initiative will accommodate about 39 participantsper year initially, and is being funded by the Ministry ofConstruction and Transportation of the Republic of Korea(MOCT) and the KOICA.

The annual curriculum will reflect the changing needs ofdeveloping countries and is intended to promote the develop-ment and safety of international civil aviation. To be conduct-ed in English, the programme will be available to specificcountries identified by ICAO and the MOCT, with final selectionof the students to be determined by the Republic of Korea.

The Korea Civil Aviation Training Centre, also known as theKorea Civil Aviation Academy (www.catc.airport.co.kr/), wasestablished in 1984 with financial and technical assistance fromthe United Nations Development Programme (UNDP) and ICAO,and with the objective of meeting the developmental needs ofcivil aviation in the Republic of Korea. KCATC has played a majorrole in the enhancement of technical expertise in Korean civil avi-ation, and has offered an international fellowship programmesince 2001. During the 2001-06 period, the centre provided fel-lowship training to 173 participants from 49 countries.

An instructor with students at the Korea Civil Aviation TrainingCentre. Beginning in 2007 the centre will provide training for par-ticipants from developing countries under an MOU signed byICAO and the Republic of Korea. ■■

38701.P35 12/7/06 9:40 PM Page 35

36 ICAO JOURNAL

Like any other aspect of business, safety management sys-tems demand that a plan be drawn up. This plan attempts toensure that all safety issues are listed and assigned priority, andthat action is initiated with sufficient allocations of people, time,money, tools and the processes needed to do the job properly.

Organizing tasks usually entails the striking of a safety team,with a manager responsible for the achievement of the plan’sgoals. The team should be made up of personnel with the need-ed skills set. This may involve a significant degree of coordina-tion between organizational units.

Controls are put in place, and the environment monitored forchange. This involves benchmarking safety performance orcomparing this performance with a departure point, measuringthe results and making corrections if the desired results are notachieved. Finally, management system thinking demands con-tinuous improvement. It demands continuous learning andsearching for better ways of doing things and institutionalizingthose processes that prove their worth.

In summary, a safety management system consists of compo-nents and elements that provide for a comprehensive approachto safety, an effective organization to achieve safety, and the sys-tems needed to provide for safety oversight.

Safety philosophy and policies. A comprehensive corporateapproach to safety speaks to the need for aviation organizations toestablish a safety philosophy and appropriate policies. This calls fororganizations to establish their fundamental approach to managingsafety in terms of leadership and direction, planning, controlling,and measuring performance, as well as related functions that per-meate the entire organization.

An “effective organization to achieve safety” speaks to suchthings as roles, responsibilities, accountabilities, structure andmeans of achieving coordination among organizational units.“Systems to achieve safety” speaks to the establishment of thevarious means for accomplishing this. Such systems must beintroduced in order to achieve compliance with statutory orinternally promulgated rules; identify the hazards and risksassociated with different operations; assess and mitigate theknown risks; report safety deficiencies, accidents and inci-dents; contain accidents and prepare for likely emergencies;investigate accidents and incidents, and disseminate the les-sons learned and correct system deficiencies — all the whiledocumenting the processes, decisions and actions throughout.

Transport Canada believes that a safety management systemwill enable aviation organizations to better manage risk andcontribute to their bottom line. To quote James Reason, SMShelps aviation firms “navigate the safety space” between bank-ruptcy and catastrophe by providing the means to better bal-ance investments in protection and production.

Managers face myriad challenges in their attempt to makemoney. But at their most fundamental level, safety managementsystems can help a company reconcile the social demand forenhanced safety with the shareholder’s expectation for betterfinancial returns and, perhaps, keep the regulator happy at thesame time. ■■

ATM safetycontinued from page 25

the region that are not members of ECAC to review andstrengthen their ATM safety frameworks.

The introduction of the Single European Sky presents freshsafety challenges for European authorities, and with this in mindEurocontrol recently launched a new safety initiative known as theEuropean Safety Programme for ATM. The proactive programmelooks forward and identifies areas that need improvement to meetthe challenges presented by the ever-increasing level of traffic andSES implementation. In particular, the reporting of ATM occur-rences and the sharing of lessons learned need to be improved.

Over the past four years European ATM providers havestrengthened and improved their safety management systems.There is now a much greater awareness among ATM providersof what is required in respect of safety frameworks, and thereis greater cooperation between the various organizations andassociations active in Europe. The next few years will see tar-geted workshops on different aspects of SMS that will be heldacross Europe and Northern Africa.

An ATM safety management system provides a structuredbasis on which to develop, organize and manage all of the variouselements that are required to ensure that air traffic is managed inthe safest way. Considering that risk must be managed daily, withsteadily increasing traffic and the advent of new technology andnew procedures, it is incumbent on everyone involved to maintainthe highest level of safety possible. Safety cannot be left to chance,and together we must ensure that accident rates are reduced tocompensate for the expected future growth in air travel. ■■

SMS fundamentalscontinued from page 17

statutory and internally promulgated safety rules, and second-ly, they focus on prevention and/or reduction of harm arisingout of a firm’s decisions and operations.

Management strategies attempt to systematize managementfunctions and processes to enhance or optimize organizationalperformance. With respect to a business strategy, as with anymanagement system, a safety management system must pro-vide opportunities to create and capture shareholder value.This approach recognizes that a firm is in the business of mak-ing money for its owners.

In order to achieve the goals of ensuring compliance and pre-venting or reducing harm arising out of a company’s decisionsand actions, safety strategies incorporate a number of elements,specifically those concerned with compliance, risk manage-ment, prevention, containment and remedial action.

Management strategies refer to the system by which man-agers perform their functions, in particular their efforts to lead,plan, organize, control and achieve improvements. The goal ofthese management strategies is to enhance organizational per-formance in terms of effectiveness, efficiency and economy.

To be truly effective, efficient and economic, a safety man-agement system requires leadership. A company’s executivesmust possess the commitment to pursue safety as a core valueof their organization. They must be cognizant of the safety risksfaced by their firm and competent enough to put in place themeasures that can bring about effective and lasting results.

Safety informationcontinued from page 30

a requirement for transport category aircraft to be equippedwith a take-off performance monitoring system that would pro-

You have individual needs. We have the individuals.

www.shell.com/aviation

38701.P36 12/7/06 9:40 PM Page 36

You have individual needs. We have the individuals.

www.shell.com/aviation

38701.P37 12/7/06 9:40 PM Page 37

38 ICAO JOURNAL

vide flight crews with an accurate and timely indication of inad-equate take-off performance.”

Comair Flight 5191. The U.S. Federal Aviation Admin-istration (FAA) has issued a safety alert in the wake of the 27August 2006 crash of a Comair Bombardier CRJ100 atLexington, Kentucky Blue Grass Airport (KLEX). The safetyalert for operators (SAFO), No. 06013 dated 1 September 2006,is available at the FAA’s website (www.faa.gov/other_visit/aviation_industry/airline_operators/airline_safety/safo).

The recent accident, in which a commuter jet took off from thewrong runway, “brings into focus the importance of maintainingsituation awareness and adherence to CRM procedures,” theFAA stated. “It is important to note than many airports areinvolved in construction activities that result in changing envi-ronments. This heightens the importance of pilot vigilance.

“There are many other factors that can distract a pilot andcause the loss of situational awareness. Even subtle distractionscould demand a share of the pilot’s workload, such as dealingwith company procedures, passengers, running late and evenpersonal issues,” the SAFO stated.

“It is imperative that flight crews maintain the highest levelsof airmanship discipline and crew resource management. Thisis especially significant during the critical phases of flight, take-off and landing.”

The SAFO reminded flight crews of the following existingguidance:• As part of pre-flight planning, review airport layouts andknow airport signage.• Review NOTAMs for information on runway and taxiway clo-sures and construction areas.• During taxi operations, have a current airport diagram readi-ly available for reference and check the assigned taxi routeagainst the diagram, paying special attention to any unique orcomplex intersections.

SMS implementationcontinued from page 8

States in implementing the harmonized provisions will be deliv-ered in each of ICAO’s seven regional offices.

While a great deal is being done to implement SMS as a toolfor managing safety, it is important to bear in mind that thisimplementation does not obviate the need to comply with the

Business Plan commitmentcontinued from page 7

the greatest challenge is that of putting these programmes intopractice. While both the business plan and SMS implementationare evolved forms of past ideas, proper execution demands thatthey be seen as new concepts. While seemingly a subtle distinc-tion, this approach prepares one mentally to go beyond simpleadaptation of past practices and behaviour to formulate new strate-gies based on the best practices and operational experience.

Over the next decade, the ICAO business plan and safetymanagement concept will undergo a series of trials and itera-tions. The ICAO Assembly will streamline the organization’sstrategies, and the effects of this enhanced institutional effi-ciency will be obvious to all from the organization’s updatedbusiness plan and associated performance indicators. At thesame time, the governing boards of operators of countless avi-ation systems worldwide will periodically adjust their safetyindicators and targets to meet their acceptable levels of safety.

And while the SMS and ICAO business plan will ultimatelygrow outdated — like all other forms of management that havepreceded them — they can be expected in the meantime to pro-vide an effective response to the safety concerns that mayemerge over the coming decades. ■■

ICAO Council appointmentAmbassador Gil-sou Shin has beenappointed Representative of theRepublic of Korea on the Council ofICAO. His tenure commenced on 26September 2006.

Ambassador Shin is a graduate ofthe Seoul National University, wherehe majored in economics. He joinedhis country’s Ministry of Foreign Affairsin 1978, and served in a number ofpositions of increasing responsibilityboth at home, in different divisions of

the Ministry of Foreign Affairs and Trade (MOFAT), as well asabroad, in embassies of the Republic of Korea in Africa, Asiaand Europe. His most recent assignments have included thoseof Counsellor at the Permanent Mission of the Republic ofKorea to the United Nations Secretariat and InternationalOrganization in Geneva; the Deputy Director-General forCommerce and Trade Policy at the MOFAT; and the Minister ofthe Embassy of the Republic of Korea in the Philippines.

In addition to his recent appointment as Representative onthe ICAO Council, Ambassador Shin is currently serving asConsul General of the Republic of Korea in Montreal. ■■

G. Shin(Republic of Korea)

• Write down complex taxi instructions. When unsure of thetaxi route, request progressive taxi instructions from Air TrafficControl (ATC).• If the flight has more than one crew member, it is important thatboth fully understand taxi clearances and runway assignments.• During taxi operations, the pilots’ maximum attention shouldbe placed on maintaining situational awareness. The pilot taxiingshould have his attention focused outside the aircraft at all timeswhile the other pilot should monitor the taxi progress by refer-ence to the airport diagram and give guidance to the taxiing pilot.• Apply CRM procedures to identify and resolve conflicting per-ceptions of ATC instructions; confirm, by using the challenge-and-response technique, proper execution of ATC instructions;and confirm, using this same technique, that the aircraft is actu-ally positioned on the assigned runway by reference to theheading indicator.• Use all available resources to ensure the aircraft is positionedon the proper runway. One technique for aeroplanes that areequipped with a flight management system (FMS) is to verballyannounce that the proper runway and departure procedure areselected in the FMS and that the aircraft heading agrees withthe assigned runway for take-off.

The U.S. NTSB is continuing its investigation of the accident,which occurred when the aircraft attempted to take-off from aninoperative 3,500-foot runway instead of the 7,000-foot runwaythat it had been assigned by ATC. ■■

38701.P38 12/8/06 3:04 PM Page 38

NUMBER 6, 2006 39

specifications and regulations in force.Importance of training. Training that can assist States with

the global implementation of SMS is very important, and con-sequently ICAO recently developed such a course. During2006, the organization conducted three courses for differentregions, and four more courses will be delivered next year.

The goals of the ICAO SMS training course, which buildsupon the harmonized safety management provisions andDocument 9859, are to expand the knowledge of the safetymanagement concepts and related SARPs contained in ICAOAnnexes 6, 11 and 14, as well as guidance material. Anothergoal is to develop States’ capacity to certify and oversee theimplementation of key components of a basic SMS in compli-ance with ICAO SARPs and national regulations.

The target audience for the courses includes civil aviationadministration officials who are responsible for the implemen-tation of safety programmes and the oversight and/or imple-mentation of safety management systems in the areas of aircraftoperations, air traffic services and aerodromes.

The ICAO SMS training course, delivered in five days, com-prises 10 modules and six case studies to allow participants toapply their newly acquired knowledge in a practical setting.Topics covered include safety basics, fundamentals of safetymanagement, hazard identification and risk management,ICAO SMS regulation, and the development, implementationand operation of an SMS. The course includes daily progresstests and a final examination.

To provide sufficient SMS training opportunities in the yearsahead, ICAO plans to develop training for course instructors asthis will allow States to become self-sufficient both in SMS imple-mentation and in imparting SMS training. Moreover, as Statesdevelop these internal resources, they will be in a position toassist other States with their implementation of safety manage-ment systems, thus achieving the synergistic partnership neces-sary for the global execution of safety management systems.

SMS training is available from ICAO on request from individ-ual States or groups of States. The course, designed for a max-imum of 30 participants, includes study materials provided toStates in electronic format. At present, it is conducted either inEnglish or Spanish, but it is expected that availability will beexpanded to other languages.

Once the training has been completed and instructors havebeen endorsed, States may use the ICAO training course andits materials without restrictions. From time to time, the coursematerial may be updated by ICAO, in which case States will beprovided with new material in electronic form. States mayobtain further details on the SMS training programme atICAO’s website (www.icao.int/anb/safetymanagement).

ICAO’s initial effort in assisting States with implementingSMS will continue for another year, at which point further activi-ties may be undertaken. These could involve identifying a meansfor further pursuing safety management activities, includingrelated training, on a regional basis. It could also entail the devel-opment of guidance material and provision of assistance for theestablishment of safety data collection and analysis systems inStates. Future work might involve efforts to improve safety dataanalysis capabilities in States, and the linking of regional systemsfor the exchange of safety information and analysis. Also envi-sioned is the development of guidance material and provision ofassistance for the enactment of national legislation to protect all

relevant sources of safety information.Conclusion. Under the prevailing situation in international

civil aviation, it is becoming increasingly difficult to dissociatesafety from efficiency. Aviation organizations, no matter theircore business activity or geographical location, must not only besafe but efficient. Even organizations that are not directlyinvolved in a measurable production activity, such as civil aviationadministrations, are under pressure to discharge their mandatein the face of ever-diminishing resources. Hence, the value andimportance of SMS.

SMS presents the international aviation community with a prin-cipled, data-driven approach to determining priorities and allocat-ing the resources required to address safety concerns that holdthe greatest risk potential, and towards activities likely to pro-duce the biggest return on resources invested. SMS also pro-vides the means to address safety systemically and proactivelythrough hazard analysis and risk assessment and mitigation. Inthis manner, SMS presents the international aviation communitywith clear means to achieve more, safety-wise, with less.

ICAO has worked determinedly toward harmonizing SMSconcepts, guidance material and SARPs, in addition to develop-ing a comprehensive training course, and is now preparing todeliver this course as far and wide as possible.

The full potential of SMS will be realized when the concept isadopted on a global basis, by all Contracting States and, throughStates, by as many aviation organizations as possible. In orderfor this worldwide implementation to take place, States need tobe fully aware and informed about the SMS concept and themeans and tools for its implementation. ■■

SMS standardscontinued from page 12

Another initiative is to better integrate the existing suite of advi-sory circulars into a comprehensive safety and quality manage-ment system concept for the aviation industry. Part of this effortwill include the development of more sophisticated operationalrisk analysis techniques including the effects of operationalchanges on system safety. Particular targets for these efforts willinclude existing advisory circulars and other documentation for aninternal evaluation programme, continuing analysis and surveil-lance systems and the Voluntary Disclosure ReportingProgramme (VDRP). Along these same lines, future study willalso explore safety management in other fields of aviation, as wellas industry-developed management programmes in common use.

The FAA further plans to infuse the concepts of SMS into theagency’s oversight systems. The four pillars will be applied to theprocesses of producing regulations, standards and policies suchthat these will be viewed as system risk controls. Future rulemak-ing will be based more on risk analysis so that the FAA can be surethat necessary controls are in place, and that obsolete regulationsthat no longer are needed to control risk can be eliminated.

In a similar manner, safety assurance of the overall aviationsystem will be based on analysis of data coming from FAA fieldelements as well as directly from aviation service providers.Information sharing will receive much greater emphasis thanbefore as a fundamental part of the FAA risk management andsafety assurance strategy. In this manner, the total govern-ment/industry safety management strategy can be made moreeffective and efficient. ■■

38701.P39 12/7/06 9:40 PM Page 39

40 ICAO JOURNAL

Single European Skycontinued from page 23

them establish a certification regime compliant with SingleEuropean Sky principles and place them in a position to veri-fy and show compliance with the common certificationrequirements.

As part of the move towards SES, ESARRs are now being pro-gressively transposed into European Communities law. Theyare appearing as EC regulations, which have direct applicabili-ty in EU member States, and as EC directives, which need to betransposed at the national level.

Ensuring that safety management systems are embeddedthroughout the Single European Sky is a fundamental prerequi-site to the safe transition to new procedures. ESARR require-ments for safety management systems have therefore beenincluded as essential criteria to be met by ANS providers beforethey can be certified. nn

Representative of AustraliaSimon Clegg has served as the Rep-resentative of Australia on the Councilof ICAO since mid-2003. Prior toassuming his current post, Mr. Cleggheld a number of positions in hiscountry’s Department of Transportand Regional Services.

Mr. Clegg played a leading role inmost of the major reforms toAustralian aviation in the pastdecade, including the privatization ofmajor airports and the establishment

of two specialized agencies, Airservices Australia and theCivil Aviation Safety Authority of Australia. Mr. Clegg wasleader of the government task force set up to deal with theeffects of the terrorist attacks of 11 September 2001 on theaviation insurance market. During 2001-02, he served asChairman of the ICAO Special Group on War Risk Insurance.

Mr. Clegg’s most recent position in Australia was that ofDirector, Aviation and Maritime Legal, a role in which headvised widely on a range of legal issues associated withAustralia’s international and domestic aviation policy. In thiscapacity, he worked closely with aviation safety investigationteams and spearheaded development of comprehensive newnational legislative regimes for both aviation and maritimesecurity. In addition, Mr. Clegg chaired several governmentworking groups, among them the GNSS Legal IssuesWorking Group and the Joint Australia-New Zealand WorkingGroup. The latter group developed the legislation for mutualrecognition of aviation certificates, a necessary step in imple-menting arrangements for a single aviation market for the twocountries.

Mr. Clegg holds degrees in economics, commerce and lawfrom the University of Adelaide, and is a barrister of the HighCourt of Australia. He has been a visiting lecturer at theAustralian National University, where he conducted a post-graduate course in international air law for several years.Before joining the Australian Government, he worked for thechartered accounting firm, Ernst & Young. nn

S. Clegg(Australia)

Protection of safety datacontinued from page 28

of justice, and that its release outweighs the adverse domesticand international impact such release may have on the futureavailability of safety information.

In addressing the subject of public disclosure, the ICAOguidelines propose — subject to the principles of protection andexception outlined above — that the onus to justify the releaseof information should be on those seeking disclosure. Formalcriteria for disclosure should be established and should requirethat several conditions be met. Information may be released pro-vided its disclosure is necessary to correct conditions that com-promise safety or to change policies and regulations, so long asthe disclosure does not also inhibit the availability of informa-tion in the future. Such disclosures should be made in a de-iden-tified, summarized or aggregate form. Moreover, disclosure ofrelevant personal information included in the safety informationneeds to comply with applicable privacy laws.

The legal guidelines also discuss the responsibility of thecustodian of safety information, proposing that each SDCPSshould have a designated guardian. This protector is responsi-ble for applying all possible safeguards to the informationunless consent for disclosure has been granted by the origina-tor, or the custodian is satisfied that its release is justified forexceptional reasons.

Lastly, the guidelines address the protection of recordedinformation, which ICAO recommends be treated as privilegedprotected information (i.e. information deserving enhancedprotection) since ambient workplace recordings required bylegislation, such as cockpit voice recorders (CVRs), may beperceived as an invasion of privacy. What’s more, ICAO propos-es that national laws and regulations provide specific measuresof protection to such recordings, upholding their confidentiali-ty and spelling out rules for public access. Specific measures ofprotection for workplace recordings could include orders deny-ing public disclosure. nn

Airport safetycontinued from page 21

on current resources.• Keep it simple. If the safety management system is to be“saleable” to all staff, it is important that it remain simple andunderstandable. Gaining trust in the system is another impor-tant facet. Both staff and management must embrace owner-ship of the system.• Use and enhance existing practices. Each organization isbound to have current practices that may be incorporated intothe safety management system. For example, a procedure forinvestigation of incidents already exists in many organizations.Adapting existing practices as much as possible is advanta-geous because this can support a trouble-free implementation.• Share the responsibility. The safety manager is the individualresponsible for developing and implementing a safety manage-ment system. The safety manager should organizationally servein a support role to the aerodrome manager. It is important toemphasize, however, that this individual is not alone in beingresponsible for safety at the aerodrome. Rather, safety must bethe responsibility of the entire airport management. nn

IN THESPOTLIGHT ...

38701.P40 12/8/06 3:04 PM Page 40

IN THESPOTLIGHT ...

14-BIS MODELBrazil presented ICAO with a miniature replica of the aircraft piloted by aviation pioneer Alberto Santos-Dumont on the 100th anniversary ofhis first flight in October 1906. The replica serves as a reminder to theinternational community of how one man’s gift to the world still inspiresus today, Brig. Sérgio Luiz de Oliveira Freitas, of the Brazilian Embassyin Washington, D.C., stated during the presentation on 25 October.Shown on the occasion are (l-r) Brig. Freitas; ICAO Council PresidentRoberto Kobeh González; ICAO Secretary General Taïeb Chérif; and PedroBittencourt de Almeida, the Representative of Brazil on the Council of ICAO.

HUNGARIAN SCULPTUREHungary recently presented ICAO with a bronze statue entitled “Generations” that was created by Hungarian sculptor Robert Csikszentmihalyi. The gift commemorates ICAO’s 60th anniversary. Shown following the presentation at ICAO headquarters in June 2006 are (l-r): Dr. Attilio Sipos, Representative of Hungary on the Council of ICAO; Roberto Kobeh González, then ICAO Council President-elect; Dr. Assad Kotaite, then ICAO Council President; Dr. Laszlo Kiss, Director General of Civil Aviation, Hungary; and ICAO Secretary General Dr. Taïeb Chérif.

DEPOSIT BY COLOMBIAColombia deposited its instrument of ratification of the Convention onthe International Recognition of Rights in Aircraft, signed at Geneva inJune 1948, during a brief ceremony at ICAO headquarters on 8 September2006. Shown on the occasion are (seated, l-r): Gloria Cecilia RodriguezVaron, Ministry of Foreign Affairs, Colombia; Denys Wibaux, Director of ICAO Legal Bureau; Julio Enrique Ortiz Cuenca, Representative ofColombia on the Council of ICAO; and Maria Cecilia Salazar Cruz, Civil Aviation Administration, Colombia. Standing (l-r): Luis Miguel GarciaLancheros, Delegation of Colombia to ICAO; Cesar Augusto BejaranoRamon, Delegation of Colombia to ICAO; and Walter Amaro, of the ICAO Technical Cooperation Bureau.

FOCUS ON WAFSThe third meeting of the World Area Forecast System Operations Group(WAFSOPSG) took place at the ICAO European and North Atlantic RegionalOffice in Paris in late September 2006. In addition to operational issues,the group addressed development of the WAFS and endorsed introductionof trial grid-point forecasts for icing, turbulence and convective clouds thatare to be evaluated before their anticipated operational implementationin 2010. Given the slower-than-expected operational implementation ofthe BUFR-coded significant weather forecasts by States, the group agreedthat this information would continue to be made available in PNG chartform, as a back-up, until 2010. The third meeting of WAFSOPSG wasattended by 28 experts from 14 States and four international organizations, representing all ICAO regions.

38701.P41 12/7/06 9:40 PM Page 41

38701.P42 12/7/06 9:42 PM Page 42

www.ceia.net/emdUNI EN ISO 9001 CERTIFIED

CEIA EMD application

CEIA EMDS

ENHANCED METAL DETECTORSSTATE-OF-THE-ART

Fully compliant with the New Security Standards for Conventional and non-Conventional Weapons

Unsurpassed Passenger Throughput

Exceptional Immunity to Environmental Interference

•

•

•

38701.P43 12/7/06 9:42 PM Page 43

38701.P44 12/11/06 6:55 PM Page 44

Date post:	06-Jan-2020
Category:	Documents
Upload:	others
View:	2 times
Download:	0 times

PROTECTING DATA COLLECTED FOR SAFETY PURPOSES ICAO · volume 61 number 6, 2006 icao journal...

Documents