Cover Image

Not for Sale



View/Hide Left Panel
Click for next page ( 75


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 74
74 Safety Management Systems for Airports Table 8. (Continued). A - Hazard Category B - Main Components C - Potential Consequences Shift work Effects on health, coordination, timing Fatigue Lack of concentration Human errors Poor duty performance Change in conditions New equipment, new aircraft, new Deficient risk assessment for new conditions employee, new regulation, new SOP, Deficient infrastructure to effect change new or withdrawal of services, Untrained workers on new procedures new tenant Employees unfamiliar with new workplace Lack of coordination between services Landside hazards Landside traffic, parking, pedestrian Vehicle collisions crossings Vehicles striking pedestrians Accidents in parking areas Passenger terminal Maintenance activities, electric carts Slips, trips, and falls hazards (at larger terminals), airport equipment, Carts striking pedestrians people movers, escalators, elevators, Hands, feet, clothing, or shoes that become entrapped in the spillages escalator or people mover Injuries caused by sudden stops, misleveling, and mechanical malfunctions of elevators Using Figure 8, you can determine some risks associated with the construction activity. Focus on one of the hazards described in the previous example: jet blast from aircraft acceler- ating for takeoff. When taking off, many pilots start to accelerate the aircraft while it is still in the taxiway, just before aligning with the runway. In such a case, the jet blast can be aimed at the construction area, as shown in Figure 9. The blast can displace equipment and debris, and people may get hurt. 5.5 Assess and Analyze Risk Risk assessment is the process that associates "hazards" with "risks." The process involves both estimating and classifying risks. The simplest way to estimate the risk associated with a specific hazard is to ask the following two questions: 1. What possible harm could the hazard present (the consequences)? 2. How likely is it that harm could occur (the likelihood)? Twy D 05 Figure 9. Jet blast in construction area.

OCR for page 74
Safety Risk Management 75 A risk assessment needs to address both answers to obtain a clear picture of what controls to take. For instance, the consequence may be minor but the likelihood may be high. Therefore, properly controlling the likelihood should be a higher priority. After you estimate the consequences and the likelihood, you can use this information to clas- sify your risk. Risk classification is necessary to identify how serious risks are and to define the order in which they should be treated, particularly if you don't have all the resources needed to take every mitigation action in the short term. Estimating Risks To estimate the two risk components you may use the following guidelines: Consequences. Determine the severity of the hazard in terms of its potential impact on the people, equipment, or activity. Cause and effect diagrams, scenarios and "What-If" analysis (see Annex E) are some of the best tools for assessing the risk severity. Severity assessment should be based on the worst possible outcome that can reasonably be expected. Severity categories are defined to provide a qualitative measure of the worst credible mishap resulting from personnel error, environmental conditions; design inadequacies; procedural deficiencies; or system, sub- system, or component failure or malfunction. To estimate the consequences, you should always consider the "worst credible scenario" to avoid underestimating the risk and thereby applying inaccurate controls. For instance, the worst credible consequence for an air carrier aircraft undershooting a runway would be multiple fatalities and significant property damage. Likelihood. Determine the probability that the hazard will cause an accident or incident of the severity assessed previously. Probability may be determined quantitatively, when a method or historical information is available. Assigning a quantitative mishap probability to a new activ- ity or system may not be possible early in the planning process. A qualitative probability may be derived from research, analysis, and evaluation of historical safety data from similar activities and systems. Supporting rationale for assigning a probability should be documented for future reference. Some possible means to estimate the likelihood of an accident are the following: Using historical data on similar accidents and incidents, if the information is available When historical data for the airport are not available, check if information is obtainable for airports with similar characteristics When no information is available on accident/incident rates associated with the hazard, check what frequency of accidents/incidents is caused by equipment, operations, or procedures with similar characteristics at other airports. An airport with restricted runway safety areas (RSAs) is a good example of how to estimate the likelihood of occurrence of undesirable events. An airport with restrictions in terms of RSA may not have faced any aircraft overruns, but this does not mean that an overrun could not occur. In this case, the team assessing the risk may examine data from NTSB and FAA and con- firm there is a considerable amount of useful data to draw some conclusions regarding the prob- ability of an overrun. In some circumstances, this approach will also help to estimate a credible severity level for the specific risk. An effective way to estimate risk, particularly when no historical data is available, is to gather a group that has expertise in the relevant areas to independently rate the risk. A follow-up dis- cussion, eventually using the average level of the group to rate the risk, is a practical and solid way to perform this task. The group may be formed by members of an airport safety committee or, when feasible, experts can be brought in from other organizations.

OCR for page 74
76 Safety Management Systems for Airports Classifying Risks The second aspect of risk assessment is the ranking of risks into a priority order. The most common tool used for risk classification is the risk matrix. The risk matrix is a simple but power- ful risk assessment tool for most airport hazards. Those performing the risk assessment should use the risk score in conjunction with good judgment, understanding, and awareness of the risk. The most important risk is the one with the greatest potential impact on airport activities, although even the least important risk may deserve some attention and possible risk control action. You should keep in mind that this priority listing is created as a guide to the relative pri- ority of the risks involved and is not intended to be an absolute order to be followed. There are low priority risks that are extremely simple to control and appropriate actions should be taken. For example, a burned out light bulb on the runway can and should be replaced quickly and easily, even though the risk associated with it is low. A realistic and effective risk assessment should involve an expert or group of experts. Typi- cally, the best experts are those who are most familiar with the hazard; in most cases, this is the line worker. For some hazards, however, the risks cannot be known simply through the process of familiarity. Such is the case with hazardous substances and confined spaces. For these hazards, other expertise is required. In most cases, such expertise can be gained from regulations, stan- dards, manufacturer instructions, competent training organizations and safety consultants, material safety data sheets, and so on. The initial risk assessment should consider the existing risk controls. Each time a risk control is added, the person performing the assessment should re-assess the risk until it has been reduced to a level as low as reasonably practicable (otherwise known as ALARP). For the example depicted in Figure 9, the severity is rated as high because construction work- ers can be killed if heavy equipment is displaced and strikes them or if they are thrown by the jet blast. The probability in this case is also high, particularly in a busy airport, when the taxiway is used many times every day. About the Risk Matrix The risk matrix is a simple table divided into columns and rows. The rows are used to repre- sent values of probability or likelihood, and the columns are used to represent values of conse- quence. Where the columns and rows intersect is the assessed value of risk. The risk matrix forms the basis for judging both the tolerability of a risk and the management level at which the decision on tolerability will be made. The matrix may also be used to priori- tize resources to resolve risks resulting from hazards or to standardize hazard notification or response actions. Severity, probability, and risk assessment should be documented to serve as a record of the analysis for future use. Existing databases, the risk matrix, or a panel of personnel experienced with the mission and hazards can be used to help complete the risk assessment. A risk matrix usually has three to five columns and three to five rows. Each column represents a different level of consequence, and each row represents a different level of likelihood. Each cell is a combination of consequence and severity and represents the risk level. Usually the cells have colors or criteria for risk acceptance. The risk matrix depicted in FAA AC 150/5200-37 has five consequence levels, five likelihood levels, and three overall risk levels represented by colors: red for high risk, yellow for medium risk, and green for low risk, defined as follows (see Figure 10): High--the risk is unacceptable and the activity should be discontinued until the risk is mitigated. Medium--the risk is acceptable; action may be implemented or the activity can continue with control and tracking measures. Low--the risk is acceptable without restrictions.

OCR for page 74
Safety Risk Management 77 Risk Matrix SEVERITY High Risk RISK No Safety Minor Major Hazardous Catastrophic Effect Medium Risk MATRIX A B C D E Low Risk Frequent LOW MEDIUM HIGH HIGH HIGH 5 L I Probable LOW MEDIUM HIGH HIGH HIGH K 4 E L Remote LOW LOW MEDIUM HIGH HIGH I 3 H Extremely O Remote LOW LOW LOW MEDIUM HIGH O 2 D Extremely HIGH Improbable LOW LOW LOW LOW 1 MEDIUM Figure 10. Risk matrix.(1) Note that in this guidebook, the colors have been replaced with shading. The darkest shading represents high risk, the medium shading represents medium risk, and the lightest shading rep- resents low risk. "At U.S. airports, many of the airport operators' actions are governed by standards issued by the FAA. The FAA would not expect an airport operator to conduct an independent risk analysis of an action or condition directed by a mandatory FAA standard or specification. Any discretionary action or decision by the airport operator in the application of the standards should still be analyzed."(1) You can select a risk matrix that best fits your airport's needs. Some guidelines on building your own risk matrix are provided in the next section. Building Your Risk Matrix Risk matrices are easy to use; however, they must be designed properly to avoid a false sense of safety. Your risk matrix should have the following characteristics to be effective: Fit your airport's needs (size and complexity) Be simple and easy to use and understand Not require extensive knowledge of quantitative risk analysis Have consistent likelihood ranges that cover the full spectrum of potential scenarios Have detailed descriptions of the consequences of concern for each consequence range Have clearly defined acceptable and non-acceptable risk levels There are two key decisions to be made when designing your risk matrix: 1. Defining how many columns (levels of severity) and rows (levels of likelihood) you need. For smaller airports, it may be preferable to use a simple risk matrix with three levels of conse- quence and three levels of likelihood. These airports have fewer hazards and limited staff to perform risk assessments. Larger airports may wish to have an expanded risk matrix that will avoid classifying too many hazards in the same category.

OCR for page 74
78 Safety Management Systems for Airports 2. Defining risk tolerability criteria. Your airport should avoid developing a risk matrix that implies a level of risk tolerability that is too generous and does not translate into what your airport actually desires. For most risk matrices there are three or four different levels of risk tolerability; however, some organizations use up to six different tolerability levels to facilitate the definition of control actions when using software management tools. Note that it is rec- ommended to seek legal counsel when defining your risk tolerability criteria as it may impact a law that may be applicable to your airport. Another key aspect of risk matrix design is having the capability to evaluate the effectiveness of risk mitigation measures. The risk matrix should always allow the risk ranking for a scenario to move to a risk tolerable level after implementation of mitigating measures. Otherwise, it may be difficult to determine the effectiveness of mitigation measures. Some organizations also include rankings or priorities for each cell. In general, the higher the number in the cell, the higher is the priority to mitigate the risk. The next section describes some criteria that may be used for risk classification. In this case, the risk matrix depicted in FAA AC 150/5200-37(1) was used. Simpler matrices and criteria can be used based on the information presented. A sample risk matrix is depicted below. Risks are ranked according to the severity and the likelihood. Hazards with high risk receive higher priority for treatment and mitigation. Risk Matrix SEVERITY High Risk RISK No Safety Minor Major Hazardous Catastrophic Effect Medium Risk MATRIX A B C D E Low Risk Frequent 5 L I Probable K 4 E L Remote I 3 H Extremely O Remote O 2 D Extremely Improbable 1 Risk Classification Having a risk matrix is usually not sufficient for risk classification. The risk matrix works better if you assign specific quantitative and qualitative criteria to risks. Stating that a credi- ble consequence is minor, for example, is very subjective. Another person assessing the same risk may find the consequence is major. It will be easier for both to agree if you define crite- ria for minor and major consequences. For example, you may describe a minor consequence as a "physical discomfort to people" and major consequence as "physical distress, possibly including injuries."

OCR for page 74
Safety Risk Management 79 Table 9. Risk severity classification. Risk Severity Classification Criteria No Minor Major Hazardous Catastrophic Safety Effect B C D E A Effect on No effect Slight Significant Large Hull loss aircraft on safety reduction in reduction in reduction in operations safety safety margin safety margin or or functional margin or functional capability functional capabilities capabilities Effect on Inconven- Physical Physical Serious or Multiple people ience discomfort distress fatal injury fatalities possibly to small including number of injuries people Effect on Slight to Loss of Loss of state Loss of Loss of airport moderate community reputation national international reputation impact reputation reputation reputation Financial loss Slight Noticeable Large Major Severe damage damage damage damage damage is less between between between exceeds than $10,000 and $100,000 and $1,000,000 $10,000,000 $10,000 $100,000 $1,000,000 and $10,000,000 Each airport may establish its own risk criteria for both consequence and likelihood. An exam- ple of such criteria is described in Tables 9 and 10 for the risk matrix depicted in Figure 10. The criteria suggested are based on the FAA Air Traffic Organization Safety Management System Manual applicable to ATC and navigation services in the National Airspace System (NAS). The impacts on the airport's reputation and financial loss were added to those criteria. So far, there are no regulatory safety level requirements or criteria for airports; each airport must establish its own. Records of the risk assessment process and results must be kept, including the name of the person(s) performing the risk assessment. The results of the risk assessment should be used to help identify appropriate control measures for the elimination or reduction of the risk to an acceptable level. Table 10. Risk likelihood classification. Risk Likelihood Classification Criteria Extremely Extremely Remote Probable Frequent Improbable Remote 1 2 3 4 5 Quantitative More than Between Between Between Less than (# of ops for 1,000,000,000 10,000,000 100,000 1,000 and 1000 1 event) and and 100,000 1,000,000,000 10,000,000 Qualitative Less than Once every Once Once More than once in 100 10-100 years every 1-10 every once every years years month week