National Academies Press: OpenBook

Safety Management Systems for Airports, Volume 2: Guidebook (2009)

Chapter: Chapter 5 - Safety Risk Management

« Previous: Chapter 4 - SMS Implementation
Page 62
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 62
Page 63
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 63
Page 64
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 64
Page 65
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 65
Page 66
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 66
Page 67
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 67
Page 68
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 68
Page 69
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 69
Page 70
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 70
Page 71
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 71
Page 72
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 72
Page 73
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 73
Page 74
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 74
Page 75
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 75
Page 76
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 76
Page 77
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 77
Page 78
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 78
Page 79
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 79
Page 80
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 80
Page 81
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 81
Page 82
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 82
Page 83
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 83
Page 84
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 84
Page 85
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 85
Page 86
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 86
Page 87
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 87
Page 88
Suggested Citation:"Chapter 5 - Safety Risk Management." National Academies of Sciences, Engineering, and Medicine. 2009. Safety Management Systems for Airports, Volume 2: Guidebook. Washington, DC: The National Academies Press. doi: 10.17226/14316.
×
Page 88

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

62 SRM is the core process behind SMS. It is through SRM that an airport will be able to deter- mine and classify risks to develop appropriate risk mitigation strategies. According to FAA AC 150/5200-37, “SRM is a systematic, explicit, and comprehensive approach for managing safety risk at all levels throughout the airport.”(1) The SRM process ensures the following: • Hazards and other safety issues are identified and documented. The associated risks are mit- igated, monitored, and controlled • Risk is determined, assessed, and classified. Unacceptable risk is mitigated • Corrective actions are taken after accidents and incidents • The effectiveness of the risk mitigation strategies is monitored and assessed • There is continuous progress toward improving safety Realistically, some risk must be accepted. How much is accepted or not accepted by the air- port organization is still a prerogative of the Accountable Executive. This chapter provides some recommendations on risk tolerability that may be used by airports. When an Accountable Exec- utive decides to accept a risk, the decision should be coordinated with the affected personnel and stakeholders, and then documented so that, in the future, everyone will know and understand the elements of the decision and why it was made. The SRM process and its five steps are explained in this chapter. In addition, this chapter also describes how to use the risk matrix, presents a list of common airport hazards with associated risks, and describes a complete example of the SRM process for several airport hazards. 5.1 The SRM Process SRM is a process for controlling risk in an organization. There are different levels of risks. Some are unacceptable for airport activities. With SRM you will be able to identify those risks that require specific actions to reduce them to acceptable levels. Moreover, you will be able to classify and prioritize the risks so that you can make the best use of your limited resources. The SRM process is depicted in Figure 6. It comprises five steps: 1. Describe the system 2. Identify hazards 3. Determine risk 4. Assess and analyze the risk 5. Treat and monitor risk C H A P T E R 5 Safety Risk Management

Safety Risk Management 63 Collect data Analyze data Is data revealing potential hazards? Identify hazards Assess risks Are there risks that need mitigation measures? Treat the Risk (mitigation actions) Are there hazards that pose a risk? Has risk been lowered to an acceptable level? NO Modify mitigation plan NO Model Selection Data Entry Visualization Manipulation Analysis NO NO Avoid Transfer Control YES YES YES Have hazards created by mitigating measures been identified and assessed? NO YES Reactive Processes Proactive Processes Mandatory reports Incident reports Accident reports Trend analysis Hazard reports Surveys/Audits Self-Inspections Direct observations Trend analysis YES COMMUNICATE AND IMPLEMENT MITIGATION ACTIONS Is there any action to be taken? Document: Event/Situation; Hazard; or Risk Acceptance and Rationale YES NO M O N I T O R I N G P E R F O R M A N C E Equipment Environment Physical Characteristics Human Factors Procedures External Factors Organizational Factors Determine Level of Severity Determine Level of Probability Compare with Acceptable Threshold Classify and Prioritize Describe the System 1 2 4 Determine Risk3 5 Figure 6. SRM life cycle.

64 Safety Management Systems for Airports These steps should be applied in sequence as each is a building block for the next one. It is important to complete each step before proceeding to the next. Until the hazard identification step is complete, it is not possible to properly prioritize risk control efforts. Each of these steps is described in detail in this chapter. An example of the application of the SRM process is presented in Section 5.7. 5.2 Describe the System The first step in performing SRM is to describe the system under consideration. The system description should include the functions, general physical characteristics and resources, and operations of the system. When considering the environment of the airport system, consider all of the safety-related functions already outlined in the ACM. The existing safety functions should steer the focus of the risk management analysis and will assist in determining potential risk control strategies. Normally, for airport hazards, a detailed physical description is not necessary. It may be easier to consider the system as an activity, such as a ramp operation, or in terms of the phys- ical area involved (e.g., Taxiway D or airside). The main objectives of identifying the system are (1) to characterize, limit, and document the scope of the problem or change and (2) to identify stakeholders. In general, a model is used to remind you what should be described to characterize the system. While there are many models available, the model called “5M” is simple and takes into account the interrelationships and integration of the equipment, people, environment, and procedures of the system. The 5M model has five components: • Mission: It is the airport activity or the reason that all the other elements are brought together. Example: operation for transporting baggage from parked aircraft to baggage claim area. • Man:This is the human element of a system. If a system requires humans for operation, main- tenance, or installation, this element must be considered in the system description. For exam- ple, an airport construction activity is conducted by contract workers and monitored by airport staff. This group of people and the people they interact with during the construction activity constitute the human element of this system. • Machine:This is the equipment element of a system. Example: the operation to transport bag- gage on the ramp may require a baggage tug and baggage carts. • Media: It is the environment in which a system will be operated, maintained, and installed. This environment includes operational and ambient conditions. Operational environment means the conditions in which the mission or function is planned and executed. Operational conditions are those involving things such as volume of traffic, communication congestion, and workload. Ambient conditions are those involving temperature, humidity, light, precip- itation, visibility, and so forth. An example is winter operation conditions. • Management:This element includes the organization, procedures, policy, rules, and regulations involved in operating, maintaining, installing, and decommissioning a system. Example: a con- struction activity will involve engineers, contractors, and inspection personnel and can involve several procedures and construction specifications: escorting construction equipment on the airside, signaling the construction area, specific procedures to mitigate FOD, and so forth. Figure 7 shows a graphical representation of the interactions among these elements. An example of a system is depicted in Figure 8. Construction is taking place on the airfield. In this case, the system is daytime construction work (replacement of drainage pipes) taking place close to the intersection between Taxiway D and the Runway 5 arrival end.

5.3 Identify Hazards FAA AC 150/5200-37 defines a hazard as “any existing or potential condition that can lead to injury, illness, or death to people; damage to or loss of a system, equipment, or property; or damage to the environment. A hazard is a condition that is a prerequisite to an accident or incident.”(1) Understanding the hazards and inherent risks associated with everyday activities allows the airport to minimize unsafe acts and respond proactively, by improving the processes, conditions, and other systemic issues that lead to unsafe acts. These include training, budgeting, procedures, planning, promotion, and other organizational factors that are known to play a role in many systems-based accidents. Media (or Environment): e.g., Airport, Airside, Terminal, Taxiway C, Garage D Mission (functions and objective) Machine (e.g., equipment, hardware and software, tool) Management (e.g., SOP, organizational structure, rules and regulations) Human Element (e.g., Personnel involved (operations, maintenance, engineering)) Figure 7. The “5M” model. 05 Twy D Figure 8. SRM example. Safety Risk Management 65

66 Safety Management Systems for Airports In this way, safety management becomes a core business function and is not just an adjunct management task. It is a vital step in the transition from a reactive safety culture—one in which the organization reacts to an event—to a proactive safety culture, in which the organization actively seeks to address systemic safety issues before they result in an active failure. Although hazards are an ever present fact of airport operations, a hazard by itself may not have the potential to cause damage under many situations. It only results in risk when specific situa- tions arise that could affect the continuity of airport operations. For example, rain is not neces- sarily a hazard; however, if the runway surface holds the water, there is potential for aquaplaning. Some airport hazards may be obvious, such as speeding at the ramp. Others may be more subtle, such as using inexperienced staff to tow aircraft. There is a common tendency to confuse hazards with their consequences. Example: “runway incursion” is an outcome or consequence, not a hazard. In contrast, “unclear pavement markings” is a hazard that may lead to runway incursions. Hazard identification techniques may be reactive or proactive in nature. Reactive Proactive Trend Analysis (Accidents) Trend Analysis (Incidents) Accident Investigations Self-Inspections Occurrence Reporting Change Analysis Hazard Reporting Brainstorming Sessions Checklists Hazard Analysis Tools SMS Assessment Interviews The initial step in SRM is to identify the hazards that the airport faces in its operational envi- ronment. A description of the system or operation must be developed as part of this step. The key and simple question to ask is what can go wrong? In an SMS, all identified hazards are documented and analyzed to determine what action is required to eliminate or reduce the safety risk associated with each specific hazard. Judgment is necessary to determine the adequate level of detail to describe the hazard. Hazard identification is the act of identifying any condition with the potential to cause injury to personnel, damage to equipment or structures, loss of material, or reduction of the ability to perform a prescribed function.

Using the example illustrated in Figure 8, a couple of hazards can be identified: Hazard Category 1—Construction Affecting Operations • Workers and vehicles crossing runway/taxiway • Construction debris • Construction equipment interference with NAVAIDS Hazard Category 2—Operations Affecting Construction • Jet blast from aircraft accelerating to takeoff • Aircraft excursions and undershoots Once you have completed your first hazard identification exercise (spanning the whole area under your SMS scope), the process cycle should be continuous and include mechanisms to allow for periodic and ad hoc hazard identification exercises. Hazards are continuously identi- fied and reported during daily self-inspections, observations, and hazard reports received from the available reporting system. For other situations, the airport should also define triggers to initiate the process, identify who will be involved, and the proper way to record the findings and actions taken. It should also pro- vide training to the participants. For example, a major change (see Table 17) may trigger the haz- ard identification process for that specific change. Factors for Consideration Hazard identification should consider every potential source of system failure, including equipment, the airport operating environment, and operational and maintenance procedures. Organizational and human factors to consider include the following: • All persons having access to the workplace (e.g., airport workers, passengers, contractors, delivery personnel, as well as airport employees) • The hazards and risks arising from their activities, the required skills and training to perform a procedure, and their varying behavior, medical conditions, and physical limitations • The hazards arising from the use of equipment or services supplied to the airport and its tenants • The hazards arising from operational practices and procedures • The work environment (visibility, lightning, temperature and precipitation conditions, strong winds) • Communications, including means, terminology, and language • Regulatory factors, including the applicability and enforceability of regulations; certification of equipment, personnel, and procedures; and the adequacy of oversight • Defenses, including detection and warning systems, and the extent to which the equipment is resilient against errors and failures • Organizational factors, such as airport policies for recruitment, training, remuneration, and allocation of resources Safety Risk Management 67 While identification of every conceivable hazard would be impractical, airports are expected to exercise due diligence in identifying significant and reasonably foreseeable hazards related to their operations. It is important that hazard identification be conducted at all levels throughout the organiza- tion, because there is often a relationship between the hazards and activities conducted in one department and another.

68 Safety Management Systems for Airports Hazard Identification Techniques There are several means that the airport can use to identify hazards. In general, airside haz- ards are identified by the airport operations staff, in many cases, as part of Part 139 regulatory requirements for self-inspection. With SMS, the airport can use additional means. The most common ones used by airports are the following: • Hazard reporting—this is an effective multiplier of the “eyes” of the airport to identify hazards because it is accessible to any person working (or not) at the airport • Visual inspection—on the airside it is mostly performed under Part 139 self-inspections by airport staff; on the landside and terminal areas, maintenance and public safety staff can be trained to identify hazards • Checklists (group review)—review of experience and available data from accidents, incidents, or similar systems to draw up hazard checklists that can be used to identify potentially haz- ardous areas that require further detailed evaluation Checklists can be used as a reminder of what types of potential hazards to consider and to record the initial hazard identification; however, care should be taken to avoid over reliance on the use of checklists. Checklists should be specific to the work area, process, or equipment being evaluated. Evaluating hazards associated with human factors should consider latent conditions. These are usually not obvious. The process should specifically address questions such as: How might staff misinterpret this procedure? How might a person misuse this function/system (intentionally or unintentionally)? • Brainstorming may be unstructured thinking (e.g., when major changes occur) or may be based on a review of an existing checklist. The group should consist of people with a wide vari- ety of backgrounds with relevant experience and competence • Review of accident investigation reports from your own airport or from other airports. Example: it would be difficult to identify all hazards leading to aircraft overruns if accidents from only one airport were evaluated • Change analysis (construction, new equipment or facility, organizational changes, new reg- ulation, etc.) • Information from industry associations and advisory bodies • SMS publications and websites • Professional advice • Consultation and interviews with employees/stakeholders • SMS and internal safety assessments • Statistical analysis of records and performance indicators (trend analysis) • Hazard identification tools: (see Annex E) — Functional hazard analysis — Change analysis — Job hazard analysis • Information from other management systems (Air Traffic Control (ATC)(27), airlines(28), envi- ronmental, wildlife, risk management, etc.) • Safety surveys • When an unexplained increase in safety-related events or infractions is identified

An airport operator might have identified the storage of unsecured containers as a hazard on the cargo ramp. Risk associated with this hazard is a gust of wind or aircraft jet blast setting an empty container in motion and striking a passing aircraft or person. Recording Hazards All identified hazards should be assigned a hazard number and be recorded in a hazard log. The log should contain a description of each hazard, its consequences, the assessed risk in terms of likelihood and severity, and any required mitigation measures. It should be updated as new hazards are identified and proposals for mitigation are introduced. Table 7 provides suggested information to include in a hazard log. Common Airport Hazards Table 8 presents several hazard categories present at airports. Each category is further broken down into specific components of the category. The third column provides some general conse- quences associated with the specific hazard category and its components. The list is not intended to be exhaustive, but to provide some helpful information that can be used to identify additional categories, components, and potential consequences. 5.4 Determine Risk One of the best methods to identify risk associated to a hazard is a brainstorming session. Per- sonnel involved in day-to-day operations are generally very familiar with “what can go wrong” situations. Another method is through lessons learned that are usually shared through industry publications and conferences or workshops. Date Hazard No. Hazard Location Potential Consequences Risk Rating Prior to Control Measures Expected Risk Rating After Control Measures Responsibility for Action Review Date Closed Out Date Table 7. Hazard log table. Safety Risk Management 69 Improvised processes for hazard identification are unacceptable safety management practices. For example, simply telling airport staff to identify hazards will not work unless proper training is provided on how to identify and report hazards. Some of these processes can be used in combination. For example, a change analysis due to construction may use a “construction safety checklist” to evaluate potential hazards dur- ing construction.

70 Safety Management Systems for Airports A - Hazard Category B - Main Components C - Potential Consequences Jet blast Operating aircraft jet engines • Blowing over vehicles, equipment, objects, particularly in the ramp area • Displacing people, particularly in the ramp area FOD FOD management, maintenance and construction activities, airside activities, pavement deterioration, aircraft operations and maintenance • Jet blast of FOD striking people, aircraft, equipment, or infrastructure • FOD being ingested into the engines of operating aircraft • FOD damaging the aircraft during operations (e.g., accident with Concord aircraft) Runway usage ATC, aircraft, vehicles • Runway incursions • Insufficient runway distance available for landing or taking off • Wrong runway usage • Aircraft undershoots and runway excursions • Lack of or misleading Notices to Airmen (NOTAMs) Taxiway routings Traffic control, weather conditions, communication, markings • Routing errors with aircraft and vehicle collisions • Runway incursions • Low visibility • Incorrect phraseology • Human errors • Deficient marking and signing Airside ground traffic Traffic control, visibility and adverse weather conditions, communications, equipment maintenance • Vehicles and aircraft running over people • Collisions in the non-movement areas • Runway incursions and collision with aircraft • Speeding of ground vehicles • Poor equipment maintenance and malfunctions • Human errors • Incorrect phraseology Winter services procedures (de-icing, anti-icing and snow Procedures, equipment, training, materials, poor operation conditions, timing, monitoring of surface conditions, • Lack or incorrect de-icing procedures may disable aircraft ability to fly • Improper snow removal or anti-icing may lead to improper removal) reporting of surface conditions braking capability on the runway with risk of overruns and veer-offs • Asymmetric drag during operations may cause veer-offs • Poor braking performance causing collisions in movement and non-movement areas • Lack of sufficient materials • Equipment coordination disruption • Delay to employ safety measures • Low runway friction • Pilot unawareness of surface conditions Rescue and fire fighting Deficient ARFF facilities and equipment, lack of appropriate access routes, poor planning and training, lack of appropriate materials and protective equipment, poor maintenance, poor emergency awareness • Improper training can delay rescue and firefighting • Lack of appropriate access routes may delay operations • Inoperative equipment can restrict ARFF capabilities • Insufficient equipment and materials can restrict capability • Poor equipment maintenance may jeopardize effectiveness • Improper protective equipment may restrict rescue and firefighting operations • Level of protection lower than that required will restrict capability during major accidents • Lack of water rescue capability at airports close to great stretches of water or swampy areas will restrict rescue capabilities • Inappropriate facilities that provide for rest, exercise, drill, training, etc. will pose restriction to staff working at the fire station • Delay to initiate operations will restrict occupant survivability • Poor communications procedures and equipment readiness will restrict ARFF capability Table 8. Common airport hazards.

Table 8. (Continued). A - Hazard Category B - Main Components C - Potential Consequences Crisis and contingency management (medical, disabled aircraft removal, etc.) Planning and training, coordination, communications, equipment, procedures, command • Delay to respond to emergencies and decrease in survivability • Delay to isolate the accident area • Delay to remove accident obstacles • Delay to inform other pilots and operators • Lack of coordination • Incorrect phraseology • Lack of appropriate equipment and procedures • Poor alerting services • Dated contact information • Loss of operational control • Unavailable resources • Command structure decay and delay Special events (air shows, etc.) Coordination, security, procedures for non-standard operations, spectator proximity to aircraft and operations, spectator unawareness of risks, communication, FOD, marking and barricading of restricted areas, new ignition sources • Damage to aircraft • Loss of aircraft control during maneuvers • Runway incursions • FOD and jet blast consequences • Collisions • Damage to equipment • Fire • Vandalism • Poor event performance • Loss of public relations opportunity • Other vehicle, aircraft, staff, and spectator accidents Adverse environmental conditions (night, low visibility, adverse wind conditions, precipitation) Training and experience for adverse weather conditions, preparation and communication, visibility and lighting conditions, runway surface conditions, approach conditions • Visual aid and electronic device malfunction or destruction • Aircraft and ground vehicle collisions • Increased aerial and surface condition hazards • Aircraft and vehicles running over airport workers and passengers • Aircraft overruns, veer-offs, and undershoots • Reduced emergency response capability Airport development, construction, and maintenance activities Impact of construction on operations, impact of operations on construction, coordination (air traffic, apron management, security, etc.), access routing, communication (e.g., NOTAMs), FOD and dust control, construction signage, temporary airfield signage, interference with operations and NAVAIDS, off-peak construction, construction worker training and awareness, safety and emergency plans, construction quality, construction equipment maintenance, construction OSH compliance, location of existing installations • Breakdown of construction equipment • Jet blast affecting construction area • FOD • Runway incursions • Malfunction of NAVAIDS • Damage to aircraft • Pilots, ATC, airport workers, and contractor unaware of construction and changed operation conditions • Accidental interference with existing installations • Equipment, stockpile, and construction location within airfield safety areas • Material stockpiles or construction equipment obstructing the view of ATC • Permitted times for construction not strictly followed • Displacement of construction equipment and materials by prop wash, jet blast, or wind • Edge and threshold lights for closed portions of a runway not properly disconnected or covered to prevent pilots use of the areas Wildlife hazards (birds and other wildlife) Fencing, wildlife detection systems and procedures, deterrent devices, wildlife management plan, training and equipment for wildlife control, minimization of attractants (through disposal of food and airport trash, garbage receptacles, and airport zoning) • Bird and wildlife strikes to aircraft and vehicles • Loss of aircraft and vehicle control • Improper use of wildlife deterrent devices • Damage to perimeter fences • Poor field monitoring and reporting • Poor wildlife control Security issues Access control • Runway incursions • Vandalism • Terrorism Safety Risk Management 71 (continued on next page)

72 Safety Management Systems for Airports Table 8. (Continued). A - Hazard Category B - Main Components C - Potential Consequences Visual and non-visual Adequacy and reliability, interference, • Inaccurate approach and landing aids for approach and landing runway approach area updates • Unavailability of NAVAIDS • Collision with obstacles • Aircraft overruns and undershoots Inspection and survey activities (internal and external) Frequency, personnel training, equipment • Failure to identify and report existing hazards • Runway incursions • Failure in communication procedures • Use of incorrect phraseology • Equipment malfunction Protection of NAVAIDS and related sites Fencing, vigilance, maintenance, zoning, signage • Inoperative or damaged equipment • Interference to NAVAIDS from new developments in the area • Aircraft collisions • Failure to ensure a secure and safe area • Airport closure Obstacles Signage, monitoring, awareness of pilots, and ATC • Aircraft collision with obstacles • Vehicle and equipment collisions • Presence of unreported obstacles • Change in obstacle condition • Inaccurate location and elevation of obstacle Fuel handling Operating procedures, spillage control procedures, proximity of ignition sources, supervision and training, equipment compatibility, fuel storage • Spillage • Misuse • Fire • Contamination • Damage to asphalt pavements • Environmental impacts • Improper handling and spillage control • Procedural violations • Vapor inhalation and ingestion • Downtime of resources Hazardous materials handling Handling procedures, spillage control procedures, supervision and training, storage • Spillage • Environmental impacts • Damage to equipment • Improper handling and spillage control • Procedural violations • Human injuries • Downtime periods • Airport closure Passenger handling Handling and control procedures, supervision, monitoring, operation of passenger bridges, operation of buses, evacuation procedures • Vehicles striking passengers • Slips and trips • Unawareness of airport dangers • Inadvertent or deliberate damage to aircraft and equipment • Improper use of safe routes • Running aircraft engines • Speeding of passenger buses • Passenger deviating from their designated routes Communications Communication procedures, equipment maintenance, training • Miscommunication • Incorrect use of communication devices • Incorrect phraseology • Impact on operations and emergency services • Equipment failure • Loss of coordination and control • Operator error • Loss of airport operations capabilities Airport reporting (Airport Publication Information [AIP], NOTAMs, etc.) Responsibility, up-to-date information • Improper notification and update procedures • Delay in operations • Change in conditions • Failure to publish NOTAM • Runway incursions • Collisions

Table 8. (Continued). A - Hazard Category B - Main Components C - Potential Consequences Apron management Airport rules and regulations, SOPs, access control, gate assignment, ramp congestion, turnaround times, airport infrastructure, technology • Aircraft assigned to incorrect gate • Collision between aircraft and vehicles • Inadequate lighting, glare, or confusing lights • Non-enforcement of rules, regulations, and SOPs available, and maintenance • Lack of centralized and uniform management • Poor, misleading or non-standard markings • Poor supervision of ramp activities • Deficient coordination with ATC, tenants, and service providers • Low capacity of infrastructure • Malfunction of ground control equipment • Aircraft stands are not serviceable, clean, or free of obstructions • Passenger bridge not retracted or correctly parked • Non-availability of emergency equipment • Lack of functional check of the passenger bridge before utilization • Improper use of apron real estate and reduced capability • Delay of operations Ground operations (marshalling, catering, towing, baggage handling, apron bridges, etc.) Airport rules and regulations, equipment parking, SOPs, supervision, pilot blind area, personal protection equipment (PPE), training, self-maneuvering operations • Propeller blades striking people or equipment • Jet blast displacing materials and equipment, and striking people • People and objects being sucked by jet engine intakes • Unsafe aircraft towing • Pilot cannot perceive presence of equipment and/or people • Vehicles striking aircraft and/or people • Falls and falling objects • Inappropriate aircraft chocking • Activities start before aircraft engine shuts down • Hot aircraft brakes • Untrained aircraft Marshaller • Use of non-standard marshalling signals • Improper passenger bridge operation • Lack of emergency stop procedures • Improper parking location by vehicles and aircraft Training and licensing Competency training and evaluation, access requirements for movement, non-movement areas • Poor training • Non-qualified workers performing activities at the ramp • Violations of rules and regulations • Failure to perform duties • Incorrect execution of procedures Infrastructure, pavements (FOD, runway friction, roughness, pavement condition) Safety areas Markings Signs Lighting Electrical systems Engineered Materials Arresting Systems (EMAS) Pavement management, marking, and lighting, aircraft arresting systems • Deteriorated pavement • FOD • Inappropriate Pavement Condition Number (PCN) • Poor runway surface friction condition, contaminated surface (rubber build-up, ponding, ice, snow, dirt), ungrooved pavement • Uneven or non-smooth pavement may damage aircraft equipment • Bumps, potholes, rutting • Excessive difference in elevation between adjacent areas • Malfunction of lighting system • Missing, unclear, or deteriorated markings • Lack of maintenance of aircraft arresting systems Occupational health and safety Equipment, procedures • Improper procedures • Lack of PPE Helicopter operations Segregation, location, and type of operations • Helicopter blades striking people, vehicles, and equipment • Rotor wash displacing objects Equipment maintenance and conditions Airport ground equipment, visual aids, NAVAIDS, surface movement guidance and control • Disruption of operations • Runway incursions • Runway excursions and undershoots • Collisions • Aircraft and vehicles striking people Safety Risk Management 73 (continued on next page)

74 Safety Management Systems for Airports Table 8. (Continued). A - Hazard Category B - Main Components C - Potential Consequences Shift work Effects on health, coordination, timing • Fatigue • Lack of concentration • Human errors • Poor duty performance Change in conditions New equipment, new aircraft, new employee, new regulation, new SOP, new or withdrawal of services, new tenant • Deficient risk assessment for new conditions • Deficient infrastructure to effect change • Untrained workers on new procedures • Employees unfamiliar with new workplace • Lack of coordination between services Landside hazards Landside traffic, parking, pedestrian crossings • Vehicle collisions • Vehicles striking pedestrians • Accidents in parking areas Passenger terminal hazards Maintenance activities, electric carts (at larger terminals), airport equipment, people movers, escalators, elevators, spillages • Slips, trips, and falls • Carts striking pedestrians • Hands, feet, clothing, or shoes that become entrapped in the escalator or people mover • Injuries caused by sudden stops, misleveling, and mechanical malfunctions of elevators Using Figure 8, you can determine some risks associated with the construction activity. Focus on one of the hazards described in the previous example: jet blast from aircraft acceler- ating for takeoff. When taking off, many pilots start to accelerate the aircraft while it is still in the taxiway, just before aligning with the runway. In such a case, the jet blast can be aimed at the construction area, as shown in Figure 9. The blast can displace equipment and debris, and people may get hurt. 5.5 Assess and Analyze Risk Risk assessment is the process that associates “hazards” with “risks.” The process involves both estimating and classifying risks. The simplest way to estimate the risk associated with a specific hazard is to ask the following two questions: 1. What possible harm could the hazard present (the consequences)? 2. How likely is it that harm could occur (the likelihood)? 05 Twy D Figure 9. Jet blast in construction area.

A risk assessment needs to address both answers to obtain a clear picture of what controls to take. For instance, the consequence may be minor but the likelihood may be high. Therefore, properly controlling the likelihood should be a higher priority. After you estimate the consequences and the likelihood, you can use this information to clas- sify your risk. Risk classification is necessary to identify how serious risks are and to define the order in which they should be treated, particularly if you don’t have all the resources needed to take every mitigation action in the short term. Estimating Risks To estimate the two risk components you may use the following guidelines: Consequences. Determine the severity of the hazard in terms of its potential impact on the people, equipment, or activity. Cause and effect diagrams, scenarios and “What-If” analysis (see Annex E) are some of the best tools for assessing the risk severity. Severity assessment should be based on the worst possible outcome that can reasonably be expected. Severity categories are defined to provide a qualitative measure of the worst credible mishap resulting from personnel error, environmental conditions; design inadequacies; procedural deficiencies; or system, sub- system, or component failure or malfunction. To estimate the consequences, you should always consider the “worst credible scenario” to avoid underestimating the risk and thereby applying inaccurate controls. For instance, the worst credible consequence for an air carrier aircraft undershooting a runway would be multiple fatalities and significant property damage. Likelihood. Determine the probability that the hazard will cause an accident or incident of the severity assessed previously. Probability may be determined quantitatively, when a method or historical information is available. Assigning a quantitative mishap probability to a new activ- ity or system may not be possible early in the planning process. A qualitative probability may be derived from research, analysis, and evaluation of historical safety data from similar activities and systems. Supporting rationale for assigning a probability should be documented for future reference. Some possible means to estimate the likelihood of an accident are the following: • Using historical data on similar accidents and incidents, if the information is available • When historical data for the airport are not available, check if information is obtainable for airports with similar characteristics • When no information is available on accident/incident rates associated with the hazard, check what frequency of accidents/incidents is caused by equipment, operations, or procedures with similar characteristics at other airports. An airport with restricted runway safety areas (RSAs) is a good example of how to estimate the likelihood of occurrence of undesirable events. An airport with restrictions in terms of RSA may not have faced any aircraft overruns, but this does not mean that an overrun could not occur. In this case, the team assessing the risk may examine data from NTSB and FAA and con- firm there is a considerable amount of useful data to draw some conclusions regarding the prob- ability of an overrun. In some circumstances, this approach will also help to estimate a credible severity level for the specific risk. An effective way to estimate risk, particularly when no historical data is available, is to gather a group that has expertise in the relevant areas to independently rate the risk. A follow-up dis- cussion, eventually using the average level of the group to rate the risk, is a practical and solid way to perform this task. The group may be formed by members of an airport safety committee or, when feasible, experts can be brought in from other organizations. Safety Risk Management 75

76 Safety Management Systems for Airports Classifying Risks The second aspect of risk assessment is the ranking of risks into a priority order. The most common tool used for risk classification is the risk matrix. The risk matrix is a simple but power- ful risk assessment tool for most airport hazards. Those performing the risk assessment should use the risk score in conjunction with good judgment, understanding, and awareness of the risk. The most important risk is the one with the greatest potential impact on airport activities, although even the least important risk may deserve some attention and possible risk control action. You should keep in mind that this priority listing is created as a guide to the relative pri- ority of the risks involved and is not intended to be an absolute order to be followed. There are low priority risks that are extremely simple to control and appropriate actions should be taken. For example, a burned out light bulb on the runway can and should be replaced quickly and easily, even though the risk associated with it is low. A realistic and effective risk assessment should involve an expert or group of experts. Typi- cally, the best experts are those who are most familiar with the hazard; in most cases, this is the line worker. For some hazards, however, the risks cannot be known simply through the process of familiarity. Such is the case with hazardous substances and confined spaces. For these hazards, other expertise is required. In most cases, such expertise can be gained from regulations, stan- dards, manufacturer instructions, competent training organizations and safety consultants, material safety data sheets, and so on. The initial risk assessment should consider the existing risk controls. Each time a risk control is added, the person performing the assessment should re-assess the risk until it has been reduced to a level as low as reasonably practicable (otherwise known as ALARP). For the example depicted in Figure 9, the severity is rated as high because construction work- ers can be killed if heavy equipment is displaced and strikes them or if they are thrown by the jet blast. The probability in this case is also high, particularly in a busy airport, when the taxiway is used many times every day. About the Risk Matrix The risk matrix is a simple table divided into columns and rows. The rows are used to repre- sent values of probability or likelihood, and the columns are used to represent values of conse- quence. Where the columns and rows intersect is the assessed value of risk. The risk matrix forms the basis for judging both the tolerability of a risk and the management level at which the decision on tolerability will be made. The matrix may also be used to priori- tize resources to resolve risks resulting from hazards or to standardize hazard notification or response actions. Severity, probability, and risk assessment should be documented to serve as a record of the analysis for future use. Existing databases, the risk matrix, or a panel of personnel experienced with the mission and hazards can be used to help complete the risk assessment. A risk matrix usually has three to five columns and three to five rows. Each column represents a different level of consequence, and each row represents a different level of likelihood. Each cell is a combination of consequence and severity and represents the risk level. Usually the cells have colors or criteria for risk acceptance. The risk matrix depicted in FAA AC 150/5200-37 has five consequence levels, five likelihood levels, and three overall risk levels represented by colors: red for high risk, yellow for medium risk, and green for low risk, defined as follows (see Figure 10): • High—the risk is unacceptable and the activity should be discontinued until the risk is mitigated. • Medium—the risk is acceptable; action may be implemented or the activity can continue with control and tracking measures. • Low—the risk is acceptable without restrictions.

Risk Matrix Low Risk No Safety Effect Minor LOW MEDIUM HIGH HIGH HIGH HIGH HIGH HIGH HIGH HIGH HIGH HIGH MEDIUM MEDIUM MEDIUM MEDIUM LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW Major Hazardous CatastrophicRISK MATRIX Frequent Probable Remote Extremely Remote Extremely Improbable SEVERITY L I K E L I H O O D A B 5 4 3 2 1 C D E High Risk Medium Risk Figure 10. Risk matrix.(1) Safety Risk Management 77 Note that in this guidebook, the colors have been replaced with shading. The darkest shading represents high risk, the medium shading represents medium risk, and the lightest shading rep- resents low risk. You can select a risk matrix that best fits your airport’s needs. Some guidelines on building your own risk matrix are provided in the next section. Building Your Risk Matrix Risk matrices are easy to use; however, they must be designed properly to avoid a false sense of safety. Your risk matrix should have the following characteristics to be effective: • Fit your airport’s needs (size and complexity) • Be simple and easy to use and understand • Not require extensive knowledge of quantitative risk analysis • Have consistent likelihood ranges that cover the full spectrum of potential scenarios • Have detailed descriptions of the consequences of concern for each consequence range • Have clearly defined acceptable and non-acceptable risk levels There are two key decisions to be made when designing your risk matrix: 1. Defining how many columns (levels of severity) and rows (levels of likelihood) you need. For smaller airports, it may be preferable to use a simple risk matrix with three levels of conse- quence and three levels of likelihood. These airports have fewer hazards and limited staff to perform risk assessments. Larger airports may wish to have an expanded risk matrix that will avoid classifying too many hazards in the same category. “At U.S. airports, many of the airport operators’ actions are governed by standards issued by the FAA. The FAA would not expect an airport operator to conduct an independent risk analysis of an action or condition directed by a mandatory FAA standard or specification. Any discretionary action or decision by the airport operator in the application of the standards should still be analyzed.”(1)

78 Safety Management Systems for Airports 2. Defining risk tolerability criteria. Your airport should avoid developing a risk matrix that implies a level of risk tolerability that is too generous and does not translate into what your airport actually desires. For most risk matrices there are three or four different levels of risk tolerability; however, some organizations use up to six different tolerability levels to facilitate the definition of control actions when using software management tools. Note that it is rec- ommended to seek legal counsel when defining your risk tolerability criteria as it may impact a law that may be applicable to your airport. Another key aspect of risk matrix design is having the capability to evaluate the effectiveness of risk mitigation measures. The risk matrix should always allow the risk ranking for a scenario to move to a risk tolerable level after implementation of mitigating measures. Otherwise, it may be difficult to determine the effectiveness of mitigation measures. Some organizations also include rankings or priorities for each cell. In general, the higher the number in the cell, the higher is the priority to mitigate the risk. The next section describes some criteria that may be used for risk classification. In this case, the risk matrix depicted in FAA AC 150/5200-37(1) was used. Simpler matrices and criteria can be used based on the information presented. Risk Classification Having a risk matrix is usually not sufficient for risk classification. The risk matrix works better if you assign specific quantitative and qualitative criteria to risks. Stating that a credi- ble consequence is minor, for example, is very subjective. Another person assessing the same risk may find the consequence is major. It will be easier for both to agree if you define crite- ria for minor and major consequences. For example, you may describe a minor consequence as a “physical discomfort to people” and major consequence as “physical distress, possibly including injuries.” A sample risk matrix is depicted below. Risks are ranked according to the severity and the likelihood. Hazards with high risk receive higher priority for treatment and mitigation. Risk Matrix Low Risk No Safety Effect Minor Major Hazardous Catastrophic RISK MATRIX Frequent Probable Remote Extremely Remote Extremely Improbable SEVERITY L I K E L I H O O D A B 5 4 3 2 1 C D E High Risk Medium Risk

Each airport may establish its own risk criteria for both consequence and likelihood. An exam- ple of such criteria is described in Tables 9 and 10 for the risk matrix depicted in Figure 10. The criteria suggested are based on the FAA Air Traffic Organization Safety Management System Manual applicable to ATC and navigation services in the National Airspace System (NAS). The impacts on the airport’s reputation and financial loss were added to those criteria. So far, there are no regulatory safety level requirements or criteria for airports; each airport must establish its own. Records of the risk assessment process and results must be kept, including the name of the person(s) performing the risk assessment. The results of the risk assessment should be used to help identify appropriate control measures for the elimination or reduction of the risk to an acceptable level. Risk Severity Classification Criteria No Safety Effect A Minor B Major C Hazardous D Catastrophic E Effect on aircraft operations No effect on safety Slight reduction in safety margin or functional capabilities Significant reduction in safety margin or functional capability Large reduction in safety margin or functional capabilities Hull loss Effect on people Inconven- ience Physical discomfort Physical distress possibly including injuries Serious or fatal injury to small number of people Multiple fatalities Effect on airport reputation Slight to moderate impact Loss of community reputation Loss of state reputation Loss of national reputation Loss of international reputation Financial loss Slight damage is less than $10,000 Noticeable damage between $10,000 and $100,000 Large damage between $100,000 and $1,000,000 Major damage between $1,000,000 and $10,000,000 Severe damage exceeds $10,000,000 Risk Likelihood Classification Criteria Extremely Improbable 1 Extremely Remote 2 Remote 3 Probable 4 Frequent 5 Quantitative (# of ops for 1 event) More than 1,000,000,000 Between 10,000,000 and 1,000,000,000 Between 100,000 and 10,000,000 Between 1,000 and 100,000 Less than 1000 Qualitative Less than once in 100 years Once every 10-100 years Once every 1-10 years Once every month More than once every week Table 9. Risk severity classification. Table 10. Risk likelihood classification. Safety Risk Management 79

80 Safety Management Systems for Airports 5.6 Treat and Monitor Risk This process should include a follow-up risk assessment to ensure that no new hazards are introduced by the selected mitigation control. Looking for Alternatives Risk treatment alternatives should address the risk probability, the risk severity, or both. The following examples were classified according to one of the categories, either reducing likelihood or reducing consequences; however, in most cases the effect is on both the likelihood and the severity simultaneously. • Reducing Likelihood — Implement the airport SMS — Raise awareness and/or control (e.g., safety campaigns, NOTAMs, briefings, enforce air- port rules) — Provide training (e.g., on-the-job training, recurrent training on SOPs, improve skills) — Establishing procedures (e.g., avoid operations under certain conditions, develop or mod- ify SOPs, intensify frequency of sweeping areas subject to FOD) — Avoid the risk by ceasing the activity (e.g., close taxiway for operations during mainte- nance activities) — Increase supervision (e.g., escorting non-airport workers, monitor ramp activities, inten- sify inspections) — Improve infrastructure and equipment (e.g., install a surface movement guidance and control system (SMGCS), improve signage, use magnetic bars and FOD containers) • Reducing Severity — Improve emergency response (e.g., reduce emergency response time, improve coordina- tion and capability) — Improve infrastructure (e.g., extend runway safety areas, remove obstacles, cover drainage ditches) — Establish SOPs (e.g., define procedures for strong wind conditions) — Create special programs (e.g., wildlife programs to avoid presence of large birds, establish rules for reduced speed at the ramp) Going back to the example depicted in Figure 9 for the jet blast hazard, airport operations eval- uated two alternatives for treating the risk: 1. Close the taxiway to aircraft operations 2. Issue a NOTAM and request ATC to caution aircraft pilots to use idle power when entering the runway Option 1 was selected because there was no guarantee the pilots would remember the ATC and NOTAM requests. It is important to note that this option may require a formal process to obtain FAA authorization and close the taxiway. When possible, select and appoint a group of staff (task group or work group) who are knowl- edgeable on the airport sector or activity that you are targeting (i.e., where the hazard associated to the risk in question is located, be it maintenance, operations, etc.), to identify possible risk mitigation strategies. This is an ad hoc group assigned to evaluate a specific hazard associated with the activities with which this group is familiar. For example, if the hazard is related to emer- gency operations, the ARFF staff is probably the best group to identify mitigation controls because that is the activity with which they are most familiar.

When developing risk mitigating strategies, be careful with solutions that are based on human performance; this is the least reliable sort of “solution.” The identification of appropriate risk mitigation measures requires a good understanding of why the hazard is likely to manifest and the factors contributing to the probability and/or the severity of its consequences. Achieving the desired level of risk reduction may require the implementation of more than one mitigation measure. The risk mitigation approach selected may include avoidance, transfer, assumption, or control. Risk Avoidance. prevent the occurrence by selecting a different approach or by not participating in the operation, procedure, or system development. For example, when reha- bilitating a runway, the airport can avoid many construction risks by closing the runway; however, if the airport has only one runway, the best option may be to go with off-peak con- struction and close the runway during certain periods of the day. An avoidance strategy is one that involves all the stakeholders associated with the proposed change. Ceasing opera- tions is always an avoidance alternative when timely mitigation actions are not available for unacceptable risks. Risk Transfer. shift the ownership of risk to another party. One transfers risk primarily to assign ownership to the organization or operation most capable of managing it. The receiving party must accept the risk, which should be documented (e.g., via a Letter of Agreement). Exam- ples of risk transfer in airport activities may include • Issuing NOTAMs to warn pilots on hazardous conditions (e.g., low runway skid resistance). In this case the airport leaves the pilot to judge if the operation is safe. • Transferring safety management of ramp areas to airlines exclusively using those areas of the airport. While transfer of risk is theoretically an acceptable means of dealing with risk, it cannot be the only method of mitigation used to treat high risk associated with a hazard. The stakeholder must still mitigate the safety risk to medium or low before it can be accepted. Moreover, when identi- fied hazards (and their corresponding risks) are outside the scope of the SMS (e.g., OSHA, phys- ical, and information security), you should transfer the management and mitigation of these risks to the appropriate airport organizational unit. Safety Risk Management 81 Risk Mitigation Strategies The ultimate purpose of hazard identification, risk determination, and analysis is to prepare for risk mitigation. Risk mitigation measures may work through reducing the probability of occurrence, the severity of the consequences, or both. This section discusses the importance of risk mitigation planning and describes approaches to mitigating safety risks. Some risks, once identified, can be eliminated or reduced readily, particularly those found during the daily self-inspections. However, other risks are much more difficult to mitigate, particularly high-impact, low-probability risks. Therefore, risk mitigation and control actions may require long-term efforts by the airport.

82 Safety Management Systems for Airports Risk Assumption. accepting the likelihood or probability and the consequences associated with a risk’s occurrence. When a risk is classified under an acceptable level, you are assuming that it is low enough that no mitigation action is required in the short term. Risk Control. options and alternative actions that lower or eliminate the risk. Examples include implementing additional policies or procedures, improving the airport infrastructure, developing redundant systems and/or components, and improving training. A control is any- thing that reduces the risk associated with a hazard. Controls can be complex or simple. It is important that they are effective and verified before the change is approved for operation. It is essential that each risk mitigation control is monitored for unintended consequences when put into place. When planning how hazards are to be controlled and risks reduced, the following hierarchy should be considered: • Elimination—can the hazard be eliminated completely? (e.g., removing an existing obstacle) • Substitution—can the activity or operation be substituted for a lower risk alternative? (e.g., using air bridges or buses to transfer passengers, rather than have passengers walk on the apron) • Engineering Controls—is there a technical solution? (e.g., runway incursion prevention sys- tem [RIPS]) • Procedural Controls—can procedures be developed? (e.g., SOPs, training, limiting exposure to hazardous operation conditions) Controls closer to the top of the hierarchy are preferable because they are less dependent on human behavior. Elimination of hazards is the first choice in controlling risks, but when this is not practical, isolation and engineering controls should be considered. Administrative controls and PPE may provide interim solutions in a planned program to eliminate or reduce a particu- lar risk, or they may be useful in addition to other control methods. In many circumstances, con- trol solutions will incorporate a combination of controls. 5.7 Example of SRM The example of SRM described in this chapter includes the analysis process for a list of five typical airport hazards. The SRM involves five steps: describe the activity or system, identify haz- ards, determine the risk, assess and analyze the risk, and prioritize and treat the risk. Step 1—Describe the System or Activity Defining and bounding the system or subsystem will help you focus on a specific activity that will assist with having a better assessment of hazards involved with that activity. For example, let’s assume the airport will have a new aircraft operating next year. The aircraft is larger than the ones currently operating at the airport. The activity (or system) in this case is “the operation of a new aircraft.” In a proactive risk management setting, system (or activity) identification is performed before the hazard identification step. However, in many cases, the identification of a hazard might take place even before the system is identified and lead to an activity (or system) that is the source. As an example, in a daily inspection of the airport airside, the airport on-duty operations officer found some FOD on the runway. The existence of FOD on the runway is a hazard. The system in this case is the whole airside, and the activity causing the hazard may be the construction work

Safety Risk Management 83 Hazard # System Subsystem Activity Description of Hazard How Hazard Was Identified 1 Airside Movement Area Runway operations Runway rubber build- up Pilot reports and runway friction measurements 2 Airside Construction Site Construction - drainage pipe replacement near runway threshold FOD Pre- construction conference 3 Airside Non- Movement Area Ground traffic in ramp area Speeding in ramp area Increase in speeding violations from trend analysis 4 Airside Movement Area Topographic survey for runway rehabilitation People crossing movement areas Manager’s meeting 5 Airside Gate Areas Aircraft services in gate areas People approaching aircraft before anti-collision light is turned off Daily inspections at the ramp Table 11. Hazard identification in the airport system. taking place in the vicinity of the runway. Table 11 contains additional examples of hazards and their associated activities. Step 2—Identify the Hazards for the Activity Once the system, subsystems, or activities are defined, the hazards should be identified. Each activity might incur one or more hazards. For the example of a new large aircraft, some brain- storming questions leading to the identification of hazards may include • Is the current ARFF capacity compatible with the new aircraft? • Are current taxiway and ramp markings appropriate to the new aircraft? • Does the pavement structure of areas used by the new aircraft have sufficient capacity to handle the new loads? • Are runway and taxiway width and safety areas compatible with the standards for the new aircraft? • Is there enough room at the ramp and gate area to accommodate the new aircraft? • Is the AEP compatible with the operation of the new aircraft? • Is current training for airport workers compatible with the new operation? Answers to these questions will indicate potential hazards linked to such a change in operation. As a general example for the SRM process, five hazards were assumed in an airside system, as presented in Table 11. The subsystems related to each hazard are also described to facilitate the understanding of the SRM process.

84 Safety Management Systems for Airports Hazard # Description of Hazard Risk Scenarios 1 Runway rubber build-up (a) Aircraft losing directional control and/or braking capability and departing the runway during operation (overruns and veer-offs) (a) Debris being ingested by aircraft enginesFOD2 (b) Jet or propeller blast displacing debris, equipment, and people 3 Speeding in ramp area (a) Vehicles striking aircraft, other vehicles and equipment, or people 4 People crossing movement areas (a) Runway incursions (b) Jet or propeller blasts displacing equipment or people 5 People approaching aircraft before anti-collision light is turned off (a) People affected by engine blast, propeller blades, or engine suction (b) People being struck by moving aircraft Table 12. Risk determination for identified hazards. Step 3—Determine the Risk Once you know the hazard, ask yourself what could go wrong. To determine the risk, you should look at all the possibilities, even those that seem to have little chance of occurrence. Table 12 presents the associated risk scenarios for the hazards identified in the previous step. As shown, the presence of FOD may cause damage to aircraft engines if it is sucked in or may cause damage to equipment and people if it is displaced by jet or propeller blast. Step 4—Assess and Analyze the Risk Risk is assessed by evaluating the likelihood (probability) of the occurrence of each risk sce- nario and the severity of the consequences of those scenarios. For each risk scenario, there may be several levels of consequences. If so, you should take the worst credible consequence as the reference for your assessment. As shown in the risk matrix in Figure 11, the likelihood varies from extremely improbable to frequent and the severity varies from no safety effect to catastrophic. The shading of the cells in the matrix represents the risk level (i.e., darkest shading is High Risk, medium shading is Medium Risk, lightest shading is Low Risk). For runway rubber build-up (hazard #1), the worst credible consequence is that the pilot may not be able to control the aircraft during landing. The aircraft will depart the runway at high A hazard is not a danger by itself. It is always associated with certain conditions that have the potential to result in an accident: • A 15-knot wind can be a hazard if it is blowing across the runway; however, if it is aligned with the runway, it can actually reduce the runway length needed for landing • Rubber built up on the runway is only a hazard when it reduces skid resistance if the surface is wet

speed, running beyond the safety areas and eventually striking an existing structure. In this sit- uation, there is a chance of hull loss and multiple fatalities. The severity in this case can be clas- sified in the risk matrix as Catastrophic (E). Then you should evaluate the likelihood. Statistics from past overrun and veer-off accidents indicate a chance of 1 catastrophic overrun or veer-off accident in 15 million operations, given the specific airport and hazard conditions (wet runway). Therefore you can classify this risk as Extremely Remote (2). This hazard, according to the risk of an aircraft departing the runway during a landing oper- ation, is then classified as 2E, which falls in the zone of High Risk (darkest shading). This is labeled as hazard “1a” in Figure 11. The same process can be applied to other hazards and risk scenarios. The results are both marked on the matrix and presented in Table 13. Hazard # Description of Hazard Risk Description Likelihood Level Severity Level Risk Classification 1 Runway rubber build-up (a) Aircraft departing runway 2 E High (a) FOD ingestion 3 E High 2 FOD from construction (b) Jet blast effects 5 C High 3 Speeding in ramp area (a) Accidents at the ramp 3 D High (a) Runway incursions 2 E High 4 Survey workers crossing movement areas (b) Jet blast effects 2 C Low (a) Aircraft engine effects 3 C Medium 5 People approaching aircraft before anti-collision light is turned off (b) Aircraft striking people 2 C Low Table 13. Risk level classification. Safety Risk Management 85 Low Risk No Safety Effect Minor Major Hazardous Catastrophic RISK MATRIX Frequent Probable Remote Extremely Remote Extremely Improbable SEVERITY L I K E L I H O O D A B 5 4 3 2 1 C D E High Risk Medium Risk 1a 2a 2b 3a 4a4b 5a 5b Figure 11. Risks classification using the risk matrix.

Step 5—Prioritize and Treat Risk At this point, all the risks associated with identified hazards have been assessed and classified. The next step is to treat the risks; however, for our example, let’s say the airport has limited resources and simply cannot eliminate every existing risk. Therefore, we need to find out how to make the best use of limited resources by prioritizing the risks. It is important to note that all risks classified under an unacceptable level should be brought to acceptable levels using mitiga- tion actions. From Table 13, we identified five risk scenarios classified as High, one as Medium, and two as Low. High-risk scenarios are treated first. But among the high-risk scenarios, which should be addressed first? If you compare a 3E risk with a 2E risk, you should treat 3E risk first because, with a similar consequence, the probability is higher for 3E. When comparing 2E and 3D, the latter has a higher probability while the former has higher consequences. In this case, they may be classified in the same priority. Taking this approach, the risk scenarios are prioritized as shown in Table 14. Following the prioritization, it is necessary to decide the actions to treat the risks. Table 15 provides some alternatives for the examples described. It should be noted that some actions will mitigate more than one risk, and some actions may mitigate the risk temporarily, as in hazard #1. Removing rubber build-up is a temporary solu- tion because rubber will continue to build up at the runway surface and removal will be neces- sary from time to time. It is easy to understand the need for continuous risk monitoring, even for treated risks, to ensure their level remains acceptable. A high risk will require immediate attention from the airport operator. Given the urgency of a solution and the limited resources available, the associated action for a high risk may be suffi- cient only to mitigate it to a medium level. For example, for more permanent results, it may take months before the airport is able to develop a safety campaign with focus on vehicle speed at the ramp. A more urgent and possible measure is to intensify enforcement of airport rules while the campaign is being developed. Each hazard identified should be documented and recorded in a hazard log, as described in Table 16. The hazard log should contain a description of each hazard, its consequences, the assessed risk in terms of likelihood and severity, and any required mitigation measures. It should be updated as new hazards are identified and proposals for mitigation are introduced. The log depicted in Table 16 was completed using the examples described in this section. 86 Safety Management Systems for Airports Hazard # Description of Hazard Risk Description Risk Classification Priority 1 Runway rubber build-up (a) Aircraft departing runway 2E - High 2 2 FOD from construction (a) FOD ingestion (b) Jet blast effects 3E - High 5C - High 1 1 3 Speeding in ramp area (a) Accidents at the ramp 3D - High 2 2E - High 4 Survey workers crossing movement areas (a) Runway incursions (b) Jet blast effects 2C - Low 3 5 3C - Medium 5 People approaching aircraft before anti- collision light is turned off (a) Aircraft engine effects (b) Aircraft striking people 2C - Low 4 5 Table 14. Risk scenarios prioritization.

Hazard # Description of Hazard Risk Priority Action to Mitigate Risk Further Actions (when required) 1 Runway rubber build- up (a) Aircraft departing runway 2 Remove rubber build-up Repave and groove (a) FOD ingestion 1 Clean up and define procedure to eliminate source Provide training on new procedure to contractor workers 2 FOD from construction (b) Jet blast effects 1 Clean up and define procedure to eliminate source Provide training on new procedure to contractor workers 3 Speeding in ramp area (a) Accidents at the ramp 2 Enforce and implement safety promotion campaign to address issue Monitor trends in number of violations and implement system of accumulated points to suspend and revoke airport driver’s permit (a) Runway incursions 3 Provide training to contractor employees Monitor activities and, if necessary, have an airport escort with the survey crew 4 Survey workers crossing movement areas (b) Jet blast effects 5 Only allow survey job on areas closed to operations None (a) Aircraft engine effects 4 Enforce SOP for aircraft arrival and departure Monitor violations and establish recurrent training program for frequent violators 5 People approaching aircraft before anti- collision light is turned off (b) Aircraft striking people 5 Enforce SOP for aircraft arrival and departure Monitor violations and establish recurrent training program for frequent violators Table 15. Risk treatment actions. Safety Risk Management 87

88 Safety Management Systems for Airports D at e H az ar d No . H az ar d Lo ca tio n R es po ns ib le D ep t/P er so n Po te nt ia l Co ns eq ue nc es R is k Ra tin g Pr io r t o M iti ga tio n A ct io n to M iti ga te R is k Ex pe ct ed R is k R at in g Af te r M iti ga tio n R ev ie w D at e Cl os ed O ut D at e Jul 3 2008 1 Runway Rubber Build-Up (low surface friction) Runway 08/26 Dept of Engineering (John S.) Aircraft excursion (overrun, veer-off) 2E- H Remove rubber build-up M Apr 1 2008 Jun 12 2008 FOD ingestion 3E- H Clean up and define procedure to eliminate source L Jun 29 2008 Aug 1 2008 Jan 4 2008 2 FOD from construction Intersection of Taxiway A and C Dept of Engineering (John S.) Jet blast effects 5C- H Clean up and define procedure to eliminate source L Jun 27 2008 Aug 3 2008 Sep 4 2008 3 Speeding in ramp area Terminal A Dept of Public Safety (Scott L.) Accidents at the ramp 3D- H Enforce and implement safety promotion campaign to address issue M Jul 6 2008 Runway incursions 2E- H Provide training to contractor employees M Jul 7 2008 Aug 31 2008 May 15 2008 4 Survey workers crossing movement areas Terminal C Dept of Operation (John C.) Jet blast effects 2C- L Only allow survey job on areas closed to operations L Aircraft engine effects 3C- M Enforce Standard Operating Procedure for aircraft arrival and departure L Aug 11 2008 Jun 21 2008 5 People approaching aircraft before anti-collision light is turned off Terminal A Terminal Manager (Lynda F.) Aircraft striking people 2C- L Enforce Standard Operating Procedure for aircraft arrival and departure L Note: H, M, and L are high, medium, and low, respectively. The airport’s hazards now have been identified and risks determined, assessed, and treated. The SMS records have been organized, placing all information in the hazard log table. However, remember that we need to keep monitoring those hazards and the mitigation measures to ensure they were implemented and that they are effective to mitigate these risks over time. Table 16. Example hazard log table.

Next: Chapter 6 - SMS Operation »
Safety Management Systems for Airports, Volume 2: Guidebook Get This Book
×
MyNAP members save 10% online.
Login or Register to save!
Download Free PDF

TRB's Airport Cooperative Research Program (ACRP) Report 1: Safety Management Systems for Airports, Volume 2: Guidebook explores what constitutes an airport safety management system (SMS). The report examines SMS components and their interactions, and offers guidance in the planning, implementation, and operation of an airport SMS. It also provides detailed information on how to carry out each of the necessary SMS processes.

This guidebook supplements ACRP Report 1: Volume 1, which provides an overview of SMS and explains how a systems approach to safety management can benefit both the safety and business aspects of airports.

http://onlinepubs.trb.org/onlinepubs/acrp/acrp_rpt_001a.pdf

  1. ×

    Welcome to OpenBook!

    You're looking at OpenBook, NAP.edu's online reading room since 1999. Based on feedback from you, our users, we've made some improvements that make it easier than ever to read thousands of publications on our website.

    Do you want to take a quick tour of the OpenBook's features?

    No Thanks Take a Tour »
  2. ×

    Show this book's table of contents, where you can jump to any chapter by name.

    « Back Next »
  3. ×

    ...or use these buttons to go back to the previous chapter or skip to the next one.

    « Back Next »
  4. ×

    Jump up to the previous page or down to the next one. Also, you can type in a page number and press Enter to go directly to that page in the book.

    « Back Next »
  5. ×

    To search the entire text of this book, type in your search term here and press Enter.

    « Back Next »
  6. ×

    Share a link to this book page on your preferred social network or via email.

    « Back Next »
  7. ×

    View our suggested citation for this chapter.

    « Back Next »
  8. ×

    Ready to take your reading offline? Click here to buy this book in print or download it as a free PDF, if available.

    « Back Next »
Stay Connected!