Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 74
74 Safety Management Systems for Airports
Table 8. (Continued).
A - Hazard Category B - Main Components C - Potential Consequences
Shift work Effects on health, coordination, timing · Fatigue
· Lack of concentration
· Human errors
· Poor duty performance
Change in conditions New equipment, new aircraft, new · Deficient risk assessment for new conditions
employee, new regulation, new SOP, · Deficient infrastructure to effect change
new or withdrawal of services, · Untrained workers on new procedures
new tenant · Employees unfamiliar with new workplace
· Lack of coordination between services
Landside hazards Landside traffic, parking, pedestrian · Vehicle collisions
crossings · Vehicles striking pedestrians
· Accidents in parking areas
Passenger terminal Maintenance activities, electric carts · Slips, trips, and falls
hazards (at larger terminals), airport equipment, · Carts striking pedestrians
people movers, escalators, elevators, · Hands, feet, clothing, or shoes that become entrapped in the
spillages escalator or people mover
· Injuries caused by sudden stops, misleveling, and
mechanical malfunctions of elevators
Using Figure 8, you can determine some risks associated with the construction activity.
Focus on one of the hazards described in the previous example: jet blast from aircraft acceler-
ating for takeoff. When taking off, many pilots start to accelerate the aircraft while it is still in
the taxiway, just before aligning with the runway. In such a case, the jet blast can be aimed at
the construction area, as shown in Figure 9. The blast can displace equipment and debris, and
people may get hurt.
5.5 Assess and Analyze Risk
Risk assessment is the process that associates "hazards" with "risks." The process involves both
estimating and classifying risks. The simplest way to estimate the risk associated with a specific
hazard is to ask the following two questions:
1. What possible harm could the hazard present (the consequences)?
2. How likely is it that harm could occur (the likelihood)?
Twy D
05
Figure 9. Jet blast in construction area.
OCR for page 75
Safety Risk Management 75
A risk assessment needs to address both answers to obtain a clear picture of what controls to
take. For instance, the consequence may be minor but the likelihood may be high. Therefore,
properly controlling the likelihood should be a higher priority.
After you estimate the consequences and the likelihood, you can use this information to clas-
sify your risk. Risk classification is necessary to identify how serious risks are and to define the
order in which they should be treated, particularly if you don't have all the resources needed to
take every mitigation action in the short term.
Estimating Risks
To estimate the two risk components you may use the following guidelines:
Consequences. Determine the severity of the hazard in terms of its potential impact on the
people, equipment, or activity. Cause and effect diagrams, scenarios and "What-If" analysis (see
Annex E) are some of the best tools for assessing the risk severity. Severity assessment should be
based on the worst possible outcome that can reasonably be expected. Severity categories are
defined to provide a qualitative measure of the worst credible mishap resulting from personnel
error, environmental conditions; design inadequacies; procedural deficiencies; or system, sub-
system, or component failure or malfunction. To estimate the consequences, you should always
consider the "worst credible scenario" to avoid underestimating the risk and thereby applying
inaccurate controls. For instance, the worst credible consequence for an air carrier aircraft
undershooting a runway would be multiple fatalities and significant property damage.
Likelihood. Determine the probability that the hazard will cause an accident or incident of
the severity assessed previously. Probability may be determined quantitatively, when a method
or historical information is available. Assigning a quantitative mishap probability to a new activ-
ity or system may not be possible early in the planning process. A qualitative probability may be
derived from research, analysis, and evaluation of historical safety data from similar activities
and systems. Supporting rationale for assigning a probability should be documented for future
reference.
Some possible means to estimate the likelihood of an accident are the following:
· Using historical data on similar accidents and incidents, if the information is available
· When historical data for the airport are not available, check if information is obtainable for
airports with similar characteristics
· When no information is available on accident/incident rates associated with the hazard, check
what frequency of accidents/incidents is caused by equipment, operations, or procedures with
similar characteristics at other airports.
An airport with restricted runway safety areas (RSAs) is a good example of how to estimate
the likelihood of occurrence of undesirable events. An airport with restrictions in terms of RSA
may not have faced any aircraft overruns, but this does not mean that an overrun could not
occur. In this case, the team assessing the risk may examine data from NTSB and FAA and con-
firm there is a considerable amount of useful data to draw some conclusions regarding the prob-
ability of an overrun. In some circumstances, this approach will also help to estimate a credible
severity level for the specific risk.
An effective way to estimate risk, particularly when no historical data is available, is to gather
a group that has expertise in the relevant areas to independently rate the risk. A follow-up dis-
cussion, eventually using the average level of the group to rate the risk, is a practical and solid
way to perform this task. The group may be formed by members of an airport safety committee
or, when feasible, experts can be brought in from other organizations.
OCR for page 76
76 Safety Management Systems for Airports
Classifying Risks
The second aspect of risk assessment is the ranking of risks into a priority order. The most
common tool used for risk classification is the risk matrix. The risk matrix is a simple but power-
ful risk assessment tool for most airport hazards. Those performing the risk assessment should
use the risk score in conjunction with good judgment, understanding, and awareness of the risk.
The most important risk is the one with the greatest potential impact on airport activities,
although even the least important risk may deserve some attention and possible risk control
action. You should keep in mind that this priority listing is created as a guide to the relative pri-
ority of the risks involved and is not intended to be an absolute order to be followed. There are
low priority risks that are extremely simple to control and appropriate actions should be taken.
For example, a burned out light bulb on the runway can and should be replaced quickly and
easily, even though the risk associated with it is low.
A realistic and effective risk assessment should involve an expert or group of experts. Typi-
cally, the best experts are those who are most familiar with the hazard; in most cases, this is the
line worker. For some hazards, however, the risks cannot be known simply through the process
of familiarity. Such is the case with hazardous substances and confined spaces. For these hazards,
other expertise is required. In most cases, such expertise can be gained from regulations, stan-
dards, manufacturer instructions, competent training organizations and safety consultants,
material safety data sheets, and so on.
The initial risk assessment should consider the existing risk controls. Each time a risk control
is added, the person performing the assessment should re-assess the risk until it has been reduced
to a level as low as reasonably practicable (otherwise known as ALARP).
For the example depicted in Figure 9, the severity is rated as high because construction work-
ers can be killed if heavy equipment is displaced and strikes them or if they are thrown by the jet
blast. The probability in this case is also high, particularly in a busy airport, when the taxiway is
used many times every day.
About the Risk Matrix
The risk matrix is a simple table divided into columns and rows. The rows are used to repre-
sent values of probability or likelihood, and the columns are used to represent values of conse-
quence. Where the columns and rows intersect is the assessed value of risk.
The risk matrix forms the basis for judging both the tolerability of a risk and the management
level at which the decision on tolerability will be made. The matrix may also be used to priori-
tize resources to resolve risks resulting from hazards or to standardize hazard notification or
response actions. Severity, probability, and risk assessment should be documented to serve as a
record of the analysis for future use. Existing databases, the risk matrix, or a panel of personnel
experienced with the mission and hazards can be used to help complete the risk assessment.
A risk matrix usually has three to five columns and three to five rows. Each column represents
a different level of consequence, and each row represents a different level of likelihood. Each cell
is a combination of consequence and severity and represents the risk level. Usually the cells have
colors or criteria for risk acceptance. The risk matrix depicted in FAA AC 150/5200-37 has five
consequence levels, five likelihood levels, and three overall risk levels represented by colors: red
for high risk, yellow for medium risk, and green for low risk, defined as follows (see Figure 10):
· High--the risk is unacceptable and the activity should be discontinued until the risk is mitigated.
· Medium--the risk is acceptable; action may be implemented or the activity can continue with
control and tracking measures.
· Low--the risk is acceptable without restrictions.
OCR for page 77
Safety Risk Management 77
Risk Matrix
SEVERITY High Risk
RISK No Safety
Minor Major Hazardous Catastrophic
Effect Medium Risk
MATRIX
A B C D E Low Risk
Frequent
LOW MEDIUM HIGH HIGH HIGH
5
L
I Probable
LOW MEDIUM HIGH HIGH HIGH
K 4
E
L Remote
LOW LOW MEDIUM HIGH HIGH
I 3
H Extremely
O Remote
LOW LOW LOW MEDIUM HIGH
O 2
D Extremely HIGH
Improbable
LOW LOW LOW LOW
1
MEDIUM
Figure 10. Risk matrix.(1)
Note that in this guidebook, the colors have been replaced with shading. The darkest shading
represents high risk, the medium shading represents medium risk, and the lightest shading rep-
resents low risk.
"At U.S. airports, many of the airport operators' actions are governed by standards
issued by the FAA. The FAA would not expect an airport operator to conduct an
independent risk analysis of an action or condition directed by a mandatory FAA
standard or specification. Any discretionary action or decision by the airport
operator in the application of the standards should still be analyzed."(1)
You can select a risk matrix that best fits your airport's needs. Some guidelines on building
your own risk matrix are provided in the next section.
Building Your Risk Matrix
Risk matrices are easy to use; however, they must be designed properly to avoid a false sense
of safety. Your risk matrix should have the following characteristics to be effective:
· Fit your airport's needs (size and complexity)
· Be simple and easy to use and understand
· Not require extensive knowledge of quantitative risk analysis
· Have consistent likelihood ranges that cover the full spectrum of potential scenarios
· Have detailed descriptions of the consequences of concern for each consequence range
· Have clearly defined acceptable and non-acceptable risk levels
There are two key decisions to be made when designing your risk matrix:
1. Defining how many columns (levels of severity) and rows (levels of likelihood) you need. For
smaller airports, it may be preferable to use a simple risk matrix with three levels of conse-
quence and three levels of likelihood. These airports have fewer hazards and limited staff to
perform risk assessments. Larger airports may wish to have an expanded risk matrix that will
avoid classifying too many hazards in the same category.
OCR for page 78
78 Safety Management Systems for Airports
2. Defining risk tolerability criteria. Your airport should avoid developing a risk matrix that
implies a level of risk tolerability that is too generous and does not translate into what your
airport actually desires. For most risk matrices there are three or four different levels of risk
tolerability; however, some organizations use up to six different tolerability levels to facilitate
the definition of control actions when using software management tools. Note that it is rec-
ommended to seek legal counsel when defining your risk tolerability criteria as it may impact
a law that may be applicable to your airport.
Another key aspect of risk matrix design is having the capability to evaluate the effectiveness
of risk mitigation measures. The risk matrix should always allow the risk ranking for a scenario
to move to a risk tolerable level after implementation of mitigating measures. Otherwise, it may
be difficult to determine the effectiveness of mitigation measures.
Some organizations also include rankings or priorities for each cell. In general, the higher the
number in the cell, the higher is the priority to mitigate the risk.
The next section describes some criteria that may be used for risk classification. In this case,
the risk matrix depicted in FAA AC 150/5200-37(1) was used. Simpler matrices and criteria can
be used based on the information presented.
A sample risk matrix is depicted below. Risks are ranked according to the severity
and the likelihood. Hazards with high risk receive higher priority for treatment
and mitigation.
Risk Matrix
SEVERITY High Risk
RISK No Safety
Minor Major Hazardous Catastrophic
Effect Medium Risk
MATRIX
A B C D E Low Risk
Frequent
5
L
I Probable
K 4
E
L Remote
I 3
H Extremely
O Remote
O 2
D Extremely
Improbable
1
Risk Classification
Having a risk matrix is usually not sufficient for risk classification. The risk matrix works
better if you assign specific quantitative and qualitative criteria to risks. Stating that a credi-
ble consequence is minor, for example, is very subjective. Another person assessing the same
risk may find the consequence is major. It will be easier for both to agree if you define crite-
ria for minor and major consequences. For example, you may describe a minor consequence
as a "physical discomfort to people" and major consequence as "physical distress, possibly
including injuries."
OCR for page 79
Safety Risk Management 79
Table 9. Risk severity classification.
Risk Severity Classification
Criteria No Minor Major Hazardous Catastrophic
Safety
Effect B C D E
A
Effect on No effect Slight Significant Large Hull loss
aircraft on safety reduction in reduction in reduction in
operations safety safety margin safety
margin or or functional margin or
functional capability functional
capabilities capabilities
Effect on Inconven- Physical Physical Serious or Multiple
people ience discomfort distress fatal injury fatalities
possibly to small
including number of
injuries people
Effect on Slight to Loss of Loss of state Loss of Loss of
airport moderate community reputation national international
reputation impact reputation reputation reputation
Financial loss Slight Noticeable Large Major Severe
damage damage damage damage damage
is less between between between exceeds
than $10,000 and $100,000 and $1,000,000 $10,000,000
$10,000 $100,000 $1,000,000 and
$10,000,000
Each airport may establish its own risk criteria for both consequence and likelihood. An exam-
ple of such criteria is described in Tables 9 and 10 for the risk matrix depicted in Figure 10. The
criteria suggested are based on the FAA Air Traffic Organization Safety Management System
Manual applicable to ATC and navigation services in the National Airspace System (NAS). The
impacts on the airport's reputation and financial loss were added to those criteria. So far, there
are no regulatory safety level requirements or criteria for airports; each airport must establish
its own.
Records of the risk assessment process and results must be kept, including the name of the
person(s) performing the risk assessment. The results of the risk assessment should be used
to help identify appropriate control measures for the elimination or reduction of the risk to
an acceptable level.
Table 10. Risk likelihood classification.
Risk Likelihood Classification
Criteria Extremely Extremely Remote Probable Frequent
Improbable Remote
1 2 3 4 5
Quantitative More than Between Between Between Less than
(# of ops for 1,000,000,000 10,000,000 100,000 1,000 and 1000
1 event) and and 100,000
1,000,000,000 10,000,000
Qualitative Less than Once every Once Once More than
once in 100 10-100 years every 1-10 every once every
years years month week
