A Guidebook for Safety Risk Management for Airports (2015)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Safety Risk Assessment (SRA) P A R T V This part presents a detailed discussion about the SRM application likely to be the most visible to airport management, staff, and stakeholders. The SRA is the practical application of the 5-step pro- cess in a formal, in-depth manner. This part introduces the concept of SRA triggers—precursors that lead to an airport’s formal use of the SRM process and triggers that may not require the formal use of a panel. The chapters describe the SRA process, keys to its effective and efficient conduct, and recommendations and lessons learned for effective facilitation of the SRA.

81 SRM processes are used to address many different types of safety issues, from simple haz- ards, like FOD originated from uncovered trash cans, to very complex airport construction and improvement projects that affect airfield operations. These examples illustrate conditions that require changes to how the airport does business. Change generates risk. An SRA is a way to thoroughly address the risks. The SRA is a safety assessment performed by a panel of stakeholders and subject matter experts (SMEs) to analyze a safety issue, run the SRM process to establish risk mitigation actions, and document the process. The SRA is a formal application of the SRM process to study an airport condition, either planned or discovered. The SRA will likely be the most visible application of SRM to airport personnel and tenants. The SRA is triggered by conditions or events at the air- port; follows the SRM 5-step process in a formal, proactive manner; is facilitated by a person well versed in the SRM process; and provides airport management with actionable knowledge to enhance effective, risk-informed decisions. In general, an SRA should be conducted if a change to the airport system is planned or deemed necessary. A planned system change might come in the form of an airport construction project, such as the renovation of a concourse. A system change that is deemed necessary could be dis- covered from the analysis of safety reports that highlight an undesirable trend, such as increased levels of FOD. Some safety issues may be unique to specific airport conditions, but may affect multiple airport stakeholders. Although certain corrective actions may seem apparent and easy to correct, the airport personnel who identify the condition may not fully understand all of the effects of the condition or the range of effects the corrections may have. Similarly, when a change to the configuration of the airport is planned, the integrated nature of airport operations and the number of stakeholders affected demand a thorough examination of the change. For scenarios such as these, an SRA gives airport decisionmakers the information necessary to make fully risk- informed decisions regarding the allocation of resources. C H A P T E R 1 6 Introduction to SRA At small airports, the panel of stakeholders and SMEs might only need to be two to three people. It is the subject matter that is most important. The facilitator may be a member of the airport staff who understands the SRA process thoroughly. The effective execution of the process is what is most important.

82 A Guidebook for Safety Risk Management for Airports 16.1 Benefits of an SRA Among the most important benefits of convening a panel and performing an SRA are as follows: • The SRA takes the airport through a full and systematic process to identify hazards and reduce risk levels. • The SRA coordinates the actions of multiple airport functions (e.g., operations, maintenance, engineering, and ARFF) and stakeholders and provides a greater understanding of how each function may interact to improve overall safety. • The SRA documents hazards, risks, mitigation actions, and responsibilities for those actions. • The SRA provides a framework and schedule to manage mitigation actions and accomplish safety goals. • The SRA increases awareness of risks affecting the various airport functions and stakeholders. • The SRA supports airport safety policy, helps the airport achieve its safety goals and acceptable levels of safety, and promotes regulatory compliance. 16.2 Responsibility to Conduct an SRA In certain situations, the FAA may require an SRA. With the introduction of SMS in the avia- tion industry, every line of business within the FAA may initiate an SRA. The FAA ARP may request an airport conduct an SRA and, depending on the scope of the assessment, may ask par- ties outside the airport to participate. ARP uses a process called Safety Assessment Screening (SAS) to “document the evidence to support whether the proposed action is acceptable from a safety risk perspective.” The SAS and an SRA follow nearly identical processes. The SAS is internal to the FAA, and airports will only provide information requested. The FAA ARP project manager will complete the SAS-1 form (SAS report) as appropriate based on the findings from the SAS. The procedures for the SAS apply to projects, Modification of Standards, and development/modification of AC standards. Therefore, airport projects submitted to the FAA for approvals will undergo an SAS and, according to FAA Internal Order 5200.11, may require SRM actions and deter- mination as to the requirement for an airport SRA. If so, the FAA may recommend that the airport sponsor convene an SRA panel for the safety assessment and the airport will pay for the associated costs. The costs of the SRA normally will include preparing the SRA briefing documents for distri- bution to the SRA panel members, arranging for a facilitator, scheduling a suitable meeting place for the panel, sponsoring SME participation, and other costs related to organizing and hosting the meeting, and documenting the results. In addition to FAA-required safety assessments for projects and Modification of Standards, the airport may organize its own SRAs as part of its internal SMS processes. Any safety issue or concern is a candidate for an SRA. Typically, only those issues associated with higher risk and need for a multidisciplinary team to conduct an analysis are selected for a formal SRA. Refer to Appendix A (SRM and the FAA) for more information on FAA-required SRAs. An SRA may involve one or more airport functions and departments. An SRA supporting an airfield construction project will involve several functions of the airport (e.g., operations, engineering, and ARFF), as well as airport stakeholders (e.g., airlines, ground handlers, and fixed-base operators [FBOs]). In some cases, an SRA may also involve staff of only one air- port department. For example, the head of an airfield maintenance department has received

Introduction to SRA 83 complaints from the FAA ATCT personnel that maintenance staff is not using proper ingress/ egress procedures to access the airfield movement areas. The Director of Maintenance deter- mines an SRA may help determine risks and identify actions for the maintenance department to take to improve the use of correct procedures. In this case, only staff from the maintenance department may be involved in the SRA because the issue was specific to the department. 16.3 When Is an SRA Needed? There are many factors to consider when deciding to conduct or not conduct an SRA. Airports need to determine their own set of requirements for initiating an SRA. 16.3.1 Basic Principles An SRA should be conducted any time the airport determines that a full safety analysis of an airport condition or event is warranted. Three rules of thumb can help in the determination: • A change in the airport system is pending. • The allocation of significant airport resources is required. • An undesirable trend in airport safety metrics is revealed. In each of these instances, airport management will face decisions regarding operations and assets that will alter the way the airport does business. With change comes potential risk. The SRA is the most complete method to ensure risk is managed as effectively as possible. The rules of thumb are not all inclusive. Any issue that affects aviation safety can be the subject of an SRA. The following questions can be asked when considering the need for a panel: • Will the FAA require an SRA for a planned change/project? • Do we have an important safety issue that we have not been able to resolve? • Do we have undesirable trends in our safety performance indicators and we cannot explain why? • Was an incident reported at another airport with causes similar to conditions at our airport? • Are incidents or reported hazards on the rise? • Does a type of incident occur frequently at the airport? • Is a safety issue affecting the airport’s reputation? • Is there an important safety issue on the landside of the airport? • Have we received frequent complaints from our stakeholders about a certain safety issue at the airport? • Is an important decision pending that has safety implications? If the answer is “yes” to one of these questions, there is a good chance that an SRA will benefit the airport. Another determining factor regarding when to conduct the SRA is time. Is there sufficient time to prepare, conduct, and document the SRA? If a panel of SMEs is needed, an effective and complete SRA requires time. The amount of time necessary may be a function of the complex- ity of the issue at hand, the size of the airport and number of stakeholders, or the availability of data needed to properly analyze and assess the risks. For some airports participating in the SMS Pilot Studies, an SRA scheduled over 2 days, with one 4-hour block held each day was effective. This length of time allows the panel members to continue their daily duties and to gather more information for the SRA if required. Other airports learned that one 8-hour day worked well, or even two 8-hour days were best if the subject matter was complex and the discussions among the panel members warranted the added time.

84 A Guidebook for Safety Risk Management for Airports In general, the SRA should primarily be considered as a proactive planning evolution. It is best used in advance of a planned system change or as a result of safety trend analysis. The airport will generally use its internal resources to support the SRA. On occasion, it may be necessary, and beneficial, to call upon external resources from stakeholders and con- sultants. Although the availability of resources may pose a near-term obstacle when deciding to execute an SRA, it is important to remember that SRM is a key component of an effective SMS and that absorbing near-term costs may achieve greater long-term safety and capacity benefits. 16.3.2 SRA Triggers An SRA Trigger is a condition, a system change, or piece of information that prompts man- agement to convene a panel to conduct the 5-Step SRM process or an event that automatically requires convening a panel. In most cases, SRA triggers are associated with safety issues that require a multidisciplinary team to perform the SRM process thoroughly. Many of the same triggers that lead to the convening of a panel can initiate application of the 5-Step SRM process in the field to manage daily operational risks. The FAA uses an internal procedure to identify the need to organize an SRA Panel and complete a safety assessment systematically. The Safety Assessment Screening (SAS) process is described in FAA Order 5200.11 and ARP SMS Desk Reference guide. Some of the triggers defined by the FAA (e.g., development and update of ARP standards) will only require internal FAA actions. Other FAA triggers may require actions by airport operators to participate in and organize a safety assessment and convene an airport SRA panel. The list below presents the most common FAA triggers for airport SRAs: • Airport Planning • Airport Construction Safety and Phasing Plan (CSPP) Development • 49 CFR Part 150 Noise Compatibility Planning Projects • Modification of FAA Airport Design Standards • Airspace Determinations for Non-Construction Changes Additional Non-Construction Changes include • Runway or taxiway designation changes • Pavement marking and signage changes • Runway categories changes • Planned approach/departure procedure changes • Airport modifications or updates that substantially change an action already approved by the FAA Some triggers can be considered universal; all airports can use these as SRA initiation points or as catalysts for evaluating the need for an SRA. Additionally, each airport should determine its own SRA triggers that fit the needs of the airport, its available resources, and the philosophy of airport management. Table 16-1 lists common SRA triggers.

Introduction to SRA 85 SRA Trigger Description Example Construction Airfield improvement Runway 15 extension Airfield rehabilitation Resurfacing Taxiway C Airfield maintenance (beyond day to day work) Rubber removal; chip seal on Runway 10 Construction of tower Construction of new ATC tower Terminal expansion Additional gates and gate areas Landside roadway reconfiguration Additional lanes into the terminal area Parking area modifications or rehab Parking garage rehab or updating facilities Changes in access roads onto airport property Adding or subtracting lanes and access points Standard Operating Procedures Changes New SOP SOP for towing aircraft; SOP for mowing grass in safety areas Modification to existing SOP Changes to SOP on snow removal due to new equipment Airport Organization Significant changes to airport organizational structure or key personnel Rearranging the Department of Operations; creating an SMS Division Safety Reports (Hazardous Condition Reports) Safety issues reported by pilots or airport employees (including tenants) Reports of pavement failure, blind spots, or hazardous conditions on the ramp Safety issues resulting from daily inspections FOD generated by poor pavement conditions at the intersection of taxiways Accidents and incidents Surface or ramp accident; birdstrikes Special Event Major sport events Super Bowl; Olympic Games; Major College Football Game New Equipment or Software New aircraft brought in by a carrier Starting operation of A380 or B787 aircraft New passenger boarding bridge Installation of new bridges that have different capabilities New ramp equipment that requires special consideration Introduction of towbar less tractor Changes to information management systems Changes to reporting procedures during self inspections Proposed New Infrastructure/Facilities and Regulatory Standards FAA research and development work (e.g. the FAA Tech Center) Perimeter taxiway; new NextGen equipment Safety Assurance Trends identified from safety performance indicators (e.g. birdstrikes, FOD, etc.) Increase of birdstrikes with damage to aircraft Safety audits Unsatisfactory SMS internal or external audit results Table 16-1. Common airport SRA triggers.

86 A Guidebook for Safety Risk Management for Airports 16.4 Categories of SRA Triggers This section explains and provides examples of the most common triggers used by airports to define the need to conduct an SRA. 16.4.1 Hazard Reports Hazard reports at airports are used to describe safety issues (e.g., presence of wildlife, damaged NAVAID, and FOD) identified during routine procedures. The diverse sources may include • Daily inspections by airport staff • PIREPs • Observations from airfield workers (e.g., Maintenance, ARFF, and FBO) • Observations from ATCT personnel At larger airports, hazards are generally reported using systems designed to capture and save the information, such as airport intranet systems or telephone communications systems. At the time of the development of this guidebook, the FAA ARP, through the Notice of Proposed Rule Making regarding SMS, anticipates limiting the application of SMS to the Air Operations Area (AOA), inclusive of the movement areas. Airports can and are encouraged to include triggers for those conditions that fall outside the AOA as well. This promotes an airport-wide approach to safety management with consistent processes, regardless of location and regulation. At small airports, communication between airport personnel is normally very effective, and frequently safety issues are communicated and discussed verbally. A method to document such discussions will enhance SRM at small airports. Table 16-2 presents examples of frequently reported airport hazards. In most situations, the parties listed in the table are those reporting the issues; in special circumstances, other stake- holders may report the issue. Some of these issues are SRA candidates, particularly if reported frequently at the airport, frequently at a specific location, or in the movement area of the airfield. For these hazard categories, only the most serious or frequently reported issues generally lead to a formal SRA. In fact, convening a panel would only slow the decision-making and reaction processes necessary for normal daily operations. Airports are encouraged to consider panels in those cases of frequently recurring issues; an example might be FOD reported every day, in the same location, at about the same time of day. Examples like this are clear indications of systemic problems that a panel might be better equipped to solve completely. The SRA process would identify root causes, determine risk levels, and mitigate the situations more thoroughly rather than just treating the symptom—routinely picking up the FOD every day.

Introduction to SRA 87 16.4.2 Accident and Incident Reports Accident and incident reports constitute an important category of triggers. In most cases, these reports lead to an accident or incident investigation. The purpose of an investigation is to determine causal and contributing factors to the event so such factors can be prevented or mitigated. Airport staff can augment and complement investigations by performing an SRA and identifying risk mitigation actions and staff responsibilities to reduce the chances of a similar incident or accident. The most common types of accidents and incidents in this category are • Surface incidents/accidents • Wingtip collisions and incidents • Runway incursions and excursions • FOD (damage) • Wildlife strikes According to the FAA Order 7050.1A, a surface event is an “. . . occurrence at an airport involving a pedestrian, vehicle, or aircraft on the movement area that involves an incorrect pres- ence, unauthorized movement or occurrence that affects or could affect the safety of flight of an aircraft.” The same reference defines a surface incident as an “unauthorized or unapproved movement within the designated movement area (excluding runway incursions) or an occur- rence in that same area associated with the operation of an aircraft that affects or could affect the safety of flight.” Most frequently, surface events and wingtip collisions happen in the ramp Hazard Who Reports FOD (debris) Airport operations personnel performing daily inspections PIREPs Airportmaintenance personnel during routine work ARFF personnel Airlines’ ground personnel Low runway friction PIREPs Airportmaintenance staff performing runway friction measurements Airport Operations personnel Daily safety inspections Vehicles and equipment speeding in ramp areas Ground handlers Airline ground personnel Airport public safety personnel Presence of wildlife Airport operations personnel performing daily inspections PIREPs ATCT Airportmaintenance personnel during routine work ARFF personnel Inoperable NAVAID Airport operations personnel performing daily inspections PIREPs ATCT Damaged signs and lights Airport operations personnel performing daily inspections PIREPs ATCT Faded or removed pavement markings Airport operations personnel performing daily inspections PIREPs Table 16-2. Typical safety issues reported.

88 A Guidebook for Safety Risk Management for Airports areas. Having many workers and much equipment in a confined area, often under substantial time pressure, creates an environment in which injuries and aircraft damage may occur. Runway incursion and excursion accidents and serious incidents are investigated by the NTSB and the FAA. Determination of causal and contributing factors will help the airport evaluate the need for mitigation actions, such as new equipment installations to prevent runway incur- sions, modifications of airfield layout to avoid confusion and hotspots, or improvements to runway friction, safety areas, and emergency response. An SRA using the investigation reports as a resource will assist in the evaluation. FOD and damage caused by wildlife strikes frequently occur at all types of airports. Although these events rarely lead to fatal accidents, direct and indirect associated costs are high. Airport SRM will benefit by tracking these events to evaluate trends in frequency, location, and severity. The SRA may identify further actions in addition to those outlined in the investigation report to mitigate risk at specific areas or for certain species involved in wildlife strikes. 16.4.3 Trend Analysis With the implementation of SMS comes the introduction of safety performance indicators. These could be new measures of safety developed to support the SMS and its SRA component. Data for these indicators are collected and trends are followed to determine the need for new actions if an undesirable trend is identified. Examples of indicators in this category are the fre- quency of wildlife strikes at the airport, the number of FOD incidents in movement areas, or the number of specific incidents on the ramp (e.g., frequency of vehicle/equipment speeding reports). To illustrate trending, recorded wildlife strikes are used as an example. An airport created a KPI to measure trends of birdstrikes. Data was collected from the FAA Wildlife Database during the past 10 years and the trends were graphed (see Figure 16-1). A wildlife strike with adverse effect (AE) is one that causes some type of effect on a flight (e.g., damage, delay, or go around). As shown in Figure 16-1, a general increasing trend to the number of AE strikes is seen, despite some periods when the number of strikes decreased relative to the previous year (e.g., 2009 as compared to 2008). The trend is undesirable and the airport intends to further evaluate the species that may be causing the trend using an SRA. 0 2 4 6 8 10 12 14 16 18 20 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 # of A E St rik es Year Airport Example - Wildlife Strikes with Adverse Effect 2004 to 2013 Figure 16-1. Trends in wildlife strikes.

Introduction to SRA 89 Sometimes the simple analysis and trending of data may help identify the focus of actions to mitigate risks. However, to understand which actions will be more effective will require a discussion with SMEs or personnel from specific airport functions. In this case, an SRA may be the best option to understand the problem, the associated risks, and the means to reduce the likelihood of occurring. 16.4.4 Major System Changes Major system changes at the airport are sources of risks. Some typical examples of such changes include • Airfield improvements: runway rehabilitation and extension, construction of new taxiway, renovation of terminals • Operation of a new large aircraft: B747-800, A380 • Changes to airport management: reorganization of Dept. of Operations, new Director at a small airport • Introduction of new snow control equipment • Special events: Super Bowl, college football game, air show • Introduction of new systems: new NAVAID, new IT system for work orders • Development of new operational or administration procedures • Financial priority adjustments • Rapid airport growth: aircraft operations increases, passenger increases 16.4.5 New SOPs In most cases, the introduction of a new SOP will not represent a major system change. How- ever, SOPs that focus on procedures used in the airfield can substantially affect safety. Conduct- ing an SRA may enhance the safety effect of the changes and enable stakeholders to examine fully how the change affects their operations. The effective approach is to develop a draft SOP that highlights the proposed changes and distribute this draft to the parties involved for review. A follow-up SRA will help identify safety issues associated with the new procedures as well as necessary modifications to the SOP to reduce the likelihood of incidents and accidents. An aircraft towing incident illustrates the use of an SRA to examine SOPs. For example, a small airport had a few incidents with aircraft under tow to the hangars. In a few cases, the wingtip of the aircraft struck the doors or the internal structures of the hangar. An SRA with the airport director and staff responsible for towing aircraft helped to revise the existing SOP and reduce the likelihood of the incident occurring. During the brainstorming session, the group identified each step of the towing process (e.g., place work order, assign tow crew, select tow equipment, hook up, tow, maneuver aircraft in/out hangar, and park and secure aircraft). Risks were assessed for each step of the proposed procedure, and the procedure was reviewed again to address the higher risks.

90 A Guidebook for Safety Risk Management for Airports In this example, each towing incident caused major problems and legal actions for the small airport. The airport management was seeking alternatives to reduce the negative perception of stakeholders and ensure the view that hiring airport services for towing aircraft was safe. The results of an SRA would support both of these goals. 16.4.6 Concerns Presented in Meetings Safety concerns are commonly raised during internal and external airport meetings with stakeholders. These meetings offer excellent opportunities for important discussions about safety issues. Time is a critical constraint in multi-stakeholder meetings. How safety issues are presented can determine the value of the safety decisions that come out of such meetings. Air- port safety leaders can submit specific issues for inclusion in the agenda with recommendations for immediate action or convening of an SRA. The presentation of the results from completed SRAs can also be included in the agenda of an upcoming meeting and can direct the group toward decisions about the actions proposed. As an example, one tenant airline pointed out to the airport Safety Manager that traffic speed- ing on the commercial ramp was a concern voiced by several airline employees. The Safety Man- ager contacted the airport manager’s office and asked that the issue be added to the agenda of the next Airport Advisory Board meeting. In the meeting, the group recognized this as a significant safety issue that should be addressed and the airport manager directed the convening of an SRA. Following the completion of the SRA, the Safety Manager again requested that a presentation on the results be added to the agenda of the next Advisory Board meeting. When the recom- mendations for action were presented, including the estimated costs of each recommendation, the board decided to act on two of the four SRA recommendations and monitor the progress of those actions. 16.4.7 Formal Reporting Process for Hazardous Conditions Formal airport reporting systems take many forms. Many reporting systems are regulatory requirements to meet compliance standards. For example, Part 139 commercial airports are required to conduct a “daily safety” inspection of the aircraft movement area. Some airports use an internal voluntary reporting system or a voluntary reporting system for employees and passengers, either by online reporting, a voicemail hotline, or written forms submitted to the airport. Airport hazard reports can come in the form of pavement management friction reports, wildlife strike reports, and vehicle accidents reports. Because safety is a job requirement for all employees of the companies working on the airside, airport hazard reports can also come through tenant companies. These companies should have internal formal reporting systems for airport hazards by their employees, with a responsible company representative reporting to the airport. Any and all concerns reported through a formal reporting process must be evaluated and, if required, an SRA should be conducted. 16.5 Support Material Support material for SRAs is presented in the guidebook appendices as follows: • Appendix A: SRM and the FAA describes interactions and interfaces between FAA internal SRM processes and those required by Part 139 airports • Appendix B: SRM Handbook provides practical information that can be customized and used as a quick reference guide during an SRA

Introduction to SRA 91 • Appendix C: SRM Process Tools presents practical processes and associated tools for use during the SRM process • Appendix D: SRM Templates presents additional templates, risk matrixes, SRA report struc- tures and examples • Appendix E: Preliminary Hazard Lists provides lists of common hazards for various categories of airport safety issues • Appendix F: Typical Accident and Incident Rates presents historical accident and incident rates for airport safety issues that can be used as baselines during the SRA process • Appendix G: Typical KPIs and Associated Data provides examples of typical Key Performance Indicators that may be used/created by the airport for monitoring trends after SRA control actions have been implemented • Appendix H: Basic Probability and Statistics for SRM presents basic approaches to calculating probability and statistics which are intended to support the risk assessment portion of SRM

92 The SRA process can be divided into three different parts: preparation, conduct, and docu- mentation. Each part includes two or more subtasks, as illustrated in Figure 17-1. The process can be used for a range of safety issues with varying degrees of complexity. Some of the sub- tasks described in this chapter can be eliminated if the SRA Panel is experienced with SRM processes. 17.1 Before—SRA Preparation and Planning 17.1.1 Review Documents One way to ensure the SRA is conducted as efficiently as possible is to ensure that appropriate documentation is collected in advance while developing the SRA Plan. If the SRA is planned to cover a construction project, then all documentation that explains and describes the proposed project needs to be reviewed and understood by the appropriate airport staff. Most likely this will be the SMS manager and the primary project owner or sponsor. The documents should include all available information about the project’s effect and proposed schedule. Documents covering the SRM process and SRA procedures are very helpful to ensure the SRA is planned and executed properly, particularly if the panel members are new to the SRM process. The same is true for non-construction-related SRAs as well. As an example, documents describing elevators and escalators in a terminal building would be appropriate to review for an SRA that will cover passenger conveyance issues in a terminal. 17.1.2 Develop SRA Plan SRA pre-planning, as with most group exercises, is critical to ensuring the effort is efficient and effective. As presented later in the templates section of this guidebook, use of SRA checklists is recommended and examples are provided. By having already reviewed the documents, the SMS manager and SRA owner or sponsor should be able to determine basic logistics of the SRA and assign responsibilities. This is helpful to make the SRA as participant friendly as possible, which will help to support process buy-in. 17.1.3 Identify Panel Members The number of panel members may vary—from a couple of people for smaller airports to over 40 as observed in SRAs conducted during the FAA SMS Implementation Pilot Study— depending on the complexity and reach of the SRA topic. Key personnel with expertise in the areas affected by the subject or trigger of the SRA will be required attendees, along with select decisionmakers from the airport staff. C H A P T E R 1 7 Conducting an SRA

Conducting an SRA 93 SRAs are relatively new and represent a change to business practices for airports. Those that participate will need prior notification and guidance. In many cases, it may be beneficial to limit the size of the panel, particularly when the group is formed with the most experienced personnel involved with the specific SRA theme. Smaller groups of no more than ten people are easier to manage. The SRA needs to include the ultimate owner of the subsystem being assessed, the project manager (if the assessment will cover a con- struction project), the SMS manager, and important stakeholders of the potential impacts of the assessment. Examples of required panel members include • Airport operations • SMS manager/coordinator • Risk management • FAA (as appropriate from ARP, ATC, Tech Ops) • Airlines • SMEs • Facilitator (while not a voting panel member, a facilitator ensures the process is followed) Panels may also include staff from: • Airfield maintenance • Planning • Development and engineering • Public safety (Police and Fire) • Environmental management • Ground handlers • FBOs • Fueling services • Transportation • Review Documents • Develop SRA Plan • Identify Panel Members • Identify Facilitator • Contact Stakeholders • Prepare Material • Develop Preliminary Hazard List • Schedule SRA SRA Preparation • Introductions • SRM Basics • SRA Template and Example • SRA Facilitation • Identification of System SRA Conduct • Consolidate Info Recorded • Prepare Report • Submit Report for Approval SRA Documentation Figure 17-1. SRA parts.

94 A Guidebook for Safety Risk Management for Airports 17.1.4 Identify Facilitator Identifying an experienced facilitator is important to a successful SRA. The person should be selected immediately after a decision is made to conduct the SRA. Ideally, the facilitator is also a SME with the safety issue that triggered the SRA and has no conflict of interest with the parties involved. For these reasons, an airport sponsor may choose to use an outside consultant or use airport staff from another airport if such an arrangement is possible. According to FAA Order 5200.11 (08/2010), facilitators should complete the SRA Panel Facil- itation course before leading ARP SRA panels. This is only the case for those panels required by FAA ARP. However, it is recommended that facilitators engaged by the airport have a similar qualification, thus, providing a certain level of consistency to the industry. It is also important to understand the need for and identify necessary support staff—individuals who can take notes, organize documents, and run presentations, freeing the SMEs to focus on the SRA. Refer to Chapter 18 for more information on how to facilitate an SRA. The facilitator should not be responsible for taking the overall notes that will make up the information contained in the SRA report. The facilitator should only be responsible to take bullet- form notes to record information requested from or provided by panel members. The facilitator bullet-form notes should remain visible to the panel. This provides a level of reassurance to the panel members that their input was heard and noted. Ideally, a designated note taker will assist the facilitator and help with documentation required for the final report. 17.1.5 Contact Stakeholders In most situations, when the need for an SRA is determined, a group of stakeholders are invited to participate in the brainstorming sessions. It is important to contact key stakeholders and SMEs as early as possible to ensure their availability and avoid conflict of schedules. The presence of certain key panel members may be critical to achieve effective results and a successful SRA. Organizing the list of panel members with their respective contacts will save time during the coordination and scheduling of the SRA session. When contacting stakeholders, make sure they are aware of the SRA topic and have a timeframe to check their availability. When confirmed, they should receive documentation to understand the issue or system to be assessed and prepare for the discussions. Appendix B has a template to help identify the preliminary information to be passed to panel participants. 17.1.6 Prepare Materials 17.1.6.1 Review Documents Panel members and particularly the SRA facilitator should review the documents and data associated with the safety issue. Examples of valuable SRA documentation include the Airport Certification Manual (ACM), operating procedures, safety performance trends, project plans, Construction Safety and Phasing Plan (CSPP), and the Airport Master Plan.

Conducting an SRA 95 17.1.6.2 Develop Preliminary Hazard List (PHL) A Preliminary Hazard List can save valuable time during the panel’s brainstorming sessions. Appendix E presents some hazard lists associated with common airport safety issues. Although these lists address many of the hazards, they are not comprehensive and many of the listed hazards may not be relevant to the specific problem. The airport should develop its own PHL before the SRA starts. The lists help the group involved with the SRA select some hazards for the specific situation. 17.1.6.3 Organize a Template for SRA Flow A template that follows the SRM 5-step process will help the conduct and flow of the SRA. A common SRA template is a simple table, often generated using an electronic spreadsheet, which lists the SRM steps and several sub-steps that will guide the SRA. Annotating an estimated time allotted to each step can assist in SRA schedule adherence. The type of template used will depend on the type of SRA. Information used to help select the type of SRA is provided in the ensuing chapter. The template will help the facilitator and the panel navigate through the brainstorming session. Appendix D has typical templates used for different types of SRAs along with information on how to use each template. 17.1.6.4 Prepare SRA Briefing A valuable tool used to kick-off the SRA is an introductory briefing to present the problem and introduce SRM concepts to those less familiar with the process. The duration of the briefing depends on the complexity of the issue and the knowledge of the panel. The briefing could last 30 minutes for a focused and narrowly scoped SRA topic or 2 hours or more for a complex project with a large panel. The briefing content should include the following: • SRA objective • SRM basics with examples • Description of the SRA process with example • Description of the system that will be assessed during the SRA • Preliminary plans and initial data associated with the SRA 17.1.7 Schedule the SRA Scheduling an SRA involving a large panel can be challenging. It is rare that all key participants and SMEs will be available during the same days; therefore, flexibility must be built into the schedule. For smaller panels, with six or fewer participants, it may be easier to accommodate the requirements of the participants and a couple of days can be reserved for the SRA. For larger airports when a facilitator is brought in from outside the airport, a hard start and end time and dates are likely, thus requiring more detailed advanced planning. A basic SRA schedule example is provided in Table 17-1. This type of schedule was used by some of the airports participating in the SMS Pilot Studies, on various SRA topics, and by different sizes of airports (non-hub, medium-hub, and large-hub airports). Note: in the example Table 17-1, only 8 hours are planned for the actual conduct of the SRA itself. The amount of time needed should be driven by the topic and the complexity of the airport. It is difficult to estimate the duration of an SRA. Risk assessments associated with airfield construction may require 8 or 12 hours over 2 or 3 days. It is necessary to limit the time of each session because brainstorming sessions may be very demanding. After a few hours, the exercise becomes less effective. Examples from the FAA SMS Pilot Studies include two half-day sessions

96 A Guidebook for Safety Risk Management for Airports (allowing staff to have time for their daily responsibilities and provide more information for the SRA process if necessary), a single session lasting a full day, and a single half-day session. There is not enough information in the airport industry yet to recommend a time standard. Airport operators need to determine what works best at their airports and how best to ensure the process is followed and productive. A simple table where each column represents the date and rows represent the period of the day (i.e., morning or afternoon) is suitable. The cells should contain • The time period (e.g., from 8:00 AM-12:00 PM) • The location (e.g., Meeting Room A, Ops Bldg.) • The parties involved if the sessions involve smaller groups (e.g., Ops and Engineering only) It may be hard to schedule SRAs with large parties. An alternative is to break the panel into smaller groups of up to ten people. This approach allows for the accommodation of individual schedules and organizes more manageable groups to make the process simpler and focused, thus helping the facilitator and the groups to keep the SRA efficient. The disadvantage of an SRA with multiple groups is that some synergy and interaction between different parties with varied views may be lost. To mitigate this disadvantage, the final SRA meeting can be scheduled to have at least one member of each group present to overcome the loss of interaction. This strategy also avoids discussions focused to only one or two subgroups, while the other SRA panelists remain silent and may lose motivation. 17.2 Conducting an SRA Figure 17-2 presents the recommended steps to conduct an effective SRA and the flow of the SRA process. 17.2.1 Step 1: Opening Remarks, Introductions, Handouts, & Agenda The SRA opens with remarks by airport leaders or SRA sponsors describing the subject of the SRA and introducing the organizations involved. Each participant is asked to introduce himself/herself, including name, affiliation, and position. Next, the meeting agenda is presented, describing the steps and any schedule issues. Any handouts (e.g., risk matrix and categories of hazards) should be provided to participants. Every participant should be aware of the purpose of the meeting, expected outcomes, and the items to be covered during the SRA. The agenda will help participants get ready for the discussions. Having start times for each agenda item will help maintain the pace of the discussions and keep conversations focused. In addition, this will ensure that the number of agenda items to be covered remains realistic for the time allotted. Day 1 (2 hours) 1/6/14 Day 2 (4 hours) 1/7/14 Day 3 (4 hours) 1/8/14 12:00 PM to 2:00 PM 8:00 AM to 12:00 PM 8:00 AM to 12:00 PM Briefing with airport staff Confirm logistics and processes and procedures Steps 1 3 of the SRM process 1. Describe the System 2. Identify the Hazards 3. Analyze the Risks Steps 4 5 of the SRM process & SRA Documentation 4. Assess the Risks 5. Mitigate 6. Document the process and mitigations Table 17-1. Basic SRA schedule (example).

Conducting an SRA 97 17.2.2 Step 2: SRM Presentation/Training The introductory briefing is next. An SRM briefing/training is presented to familiarize the participants (particularly those who have not participated in SRA exercises) with the 5-step process and the tasks at hand, understand the SRM process, and introduce or review the airport- specific risk matrix. The presentation ensures all participants are on the same page, whether or not preliminary information was provided prior to the meeting. 17.2.3 Step 3: Rules of the Meeting The participants should be briefed on what role they will play, what is expected from them, and how they should act to help achieve a successful outcome. Before the meeting begins, address 1. Opening Remarks, Intros, Handouts, & Agenda 2. SRM Process Presentation / Training 6. SRM 5-Step Process •Describe the System •Identify the Hazards • Analyze the Risks • Assess the Risks •Mitigate the Risks 7. Review Actions & Assign Responsibilities 8. Review Results 3. Rules of the Meeting 9. Review Next Steps & Close 4. Bound the Discussion 5. Identify Categories of Hazards Figure 17-2. SRA facilitation process.

98 A Guidebook for Safety Risk Management for Airports things to avoid during the meetings (e.g., responding to text messages, answering phones, and sidebar conversations). Only one person should speak at a time during the SRA. 17.2.4 Step 4: Bound the Discussion Discussing the specific portion of the system involved in the assessment will help participants further understand the scope of the analysis. For example, a construction job on the airfield assess- ment may be bounded as the construction area (e.g., Taxiway M, from Taxiway C to Taxiway F), equipment, haul routes, workers, airport staff and other stakeholders, construction materials and debris, and the environment comprised by the movement and non-movement areas impacted. When proceeding through the process and discussing each individual hazard, a new subsystem may be identified as associated with the specific hazard and should be part of the bounded SRM process for that hazard. 17.2.5 Step 5: Identify Categories of Hazards Although a list of specific hazards should not be provided to participants, a list of categories may help with hazard identification. Hazard categories for a construction job could include hauling, excavation, and paving. 17.2.6 Step 6: SRM 5-Step Process One approach is to discuss each category of hazards and perform the SRM 5-step process for each hazard identified within the specific category. The subsystem for the category is described, and the first hazard is identified. Risk is determined and assessed for the hazard under existing conditions and controls for that hazard are identified. The risk should be classified and additional mitigation actions may be deemed necessary to address medium and high risk. The risk should be reassessed to determine the expected residual risk following implementation of new mitigation actions. The process is repeated for each hazard within the specific category. The whole 5-step process is repeated for each category of hazards. 17.2.7 Step 7: Review Actions and Assign Responsibilities One or more risk mitigation actions may result from an SRA. These actions will help further mitigate the risk level in addition to existing controls. A person or group at the airport should be responsible for implementing these risk mitigations; often, so as to avoid potential organizational conflicts, the implementation is assigned to one or more stakeholders without engaging a specific person. In most situations, the results of an SRA will be presented during a regular airport meeting for decisions related to recommended actions and assignment of parties responsible. Although this step could be performed during the SRA facilitation meeting, it may be more effective to perform after the 5-step process is complete. Grouping mitigation actions before assigning responsibilities for implementation creates more efficient assignment of responsibilities. The objective is to identify the party responsible, rather than the person. Each party will later follow specific management processes to appoint the person responsible for each action. 17.2.8 Step 8: Review Results Participants usually have different views of what happened during the SRA and what are the next steps. Five to ten minutes before the end of the meeting, participants should review the main

Conducting an SRA 99 risk mitigations resulting from discussions and convert those decisions into action. To improve the quality of the SRA, the group should be asked “What went well?” and “What can we improve on next time?” 17.2.9 Step 9: Review Next Steps & Close Meeting The final step in conducting the SRA is to describe the next steps and the schedule (including preparation of the SRA report, submittal of the report to the participants for approval, and collec- tion of information on mitigation actions approved by the parties at their specific decision levels). Following this, the SRA is closed. 17.3 After—SRA Documentation 17.3.1 Consolidate Information The SRA process will generate several documents. Regardless of how the information is collected, either via a computer using MS Excel or a Word document or by using large note paper, a lot of information will be captured and must be gathered so that it can be easily made into a report. 17.3.2 Prepare Report It is necessary to document both the SRA process and the results. The report ensures that the essential elements of the SRA were discussed. These elements include • Who was involved with the assessment, • The hazards and risk levels identified, and • Particularly the risk mitigation actions that should be implemented. The report will contain important details and may be used to guide discussions in other meetings, particularly for decision making on risk mitigation actions that should be implemented and the persons responsible for those actions. Small airports may only need a one-page template in order to document the SRA and the results effectively. Appendix D includes a template for small airports. SRA reports, in general, should contain the following sections: • Cover and Table of Contents • Quality Assurance and Version Tracking • List of Participants • Executive Summary • Background and Scope • Description of the System

100 A Guidebook for Safety Risk Management for Airports • Hazards, Risks, and Risk Values • Mitigation Actions and Responsibilities • Conclusions and Recommendations • Attachments The cover should provide the name of the airport, the type of report, the theme of the safety assessment, the report number, the report version, and the date. 17.3.2.1 Quality Assurance and Version Tracking Some SRA reports will be reviewed by several participants and decisionmakers. Track the modi- fications to ensure that relevant comments and suggestions are properly addressed. Appendix D’s example SRA reports include • Mission: The purpose of the system being described, such as the safe movement of aircraft on the ground, and during takeoff and landing operations, when describing the airfield. • Machine: A physical description of the site or area involved with existing structures (e.g., buildings and facilities, airfield areas, access routes, parking or staging areas, gates, utilities, equipment, and systems). • HuMan: A description of the functions involved, including airline operations, airport functions, and other stakeholders. • EnvironMent (Media): The environment composed of the types of operations and weather conditions to which these operations are subject. This may also include key behavioral influ- ences such as psychological, physical, and physiological stressors (e.g., night shifts or long working hours). • Management: A list of safety-significant activities, processes, procedures, rules, and regulations that govern the conduct of the mission described for the system. 17.3.2.2 Hazards, Risks, and Risk Values This section summarizes hazards, associated risks, and risk values. It is normally presented as a table with risk value cells with background color corresponding to the level of risk: green for low, yellow for medium, and red for high. For simpler SRAs, current risk, residual risk, and mitigation actions are presented in the same table. Table 17-2 illustrates the concept. The risk values assigned in Table 17-2 are examples only. The values should be determined by the definitions for severity and likelihood that were developed specifically for the airport and then assessed using the airport’s risk matrix. Examples of severity and likelihood definitions and risk matrixes are included in Appendix C. Some facilitators prefer to sort the risks from highest to lowest in this type of table. Examples are presented in the example SRA reports in Appendix D. Haz # Hazard Outcome Risk Value Severity Likelihood Risk Value 1 Haz 1 1 1 Sev. 1 1 Lik. 1 1 RV. 1 1 1 2 Sev. 1 2 Lik. 1 2 RV. 1 2 2 Haz 2 2 1 Sev. 2 1 Lik. 2 1 RV. 2 1 3 Haz 3 3 1 Sev. 3 1 Lik. 3 1 RV. 3 1 Table 17-2. Hazards, risks, and risk values.

Conducting an SRA 101 17.3.2.3 Mitigation Actions and Responsibilities This section can be a single table or multiple tables with each presenting a single hazard. Table 17-3 presents a description of each field. More examples are in the example SRA reports in Appendix D. 17.3.2.4 Conclusions and Recommendations This section summarizes the main hazards, risk categories, and mitigation actions in bullet form. Tables may be necessary for better organization as shown below. Haz # Hazard Identified Hazard Outcome Potential result associated with the Identified hazard Risk Value This section provides the severity, likelihood and value of the Identified risk. The field may be colored to reflect the color scheme set up in the risk matrix used for this exercise. Yellow in this case represents a Medium level of risk. RiskMitigation Actions This section identifies both: The policies, programs and other measures that the airport or the FAA already has in place that contribute to the management of the risk identified; and The actions that are to be put in place as a result of the specific hazard. Updated Risk Value This section provides the severity, likelihood and value of the Identified Risk revised in light of the mitigating actions. The field is colored to reflect the color scheme set up in the matrix used for this exercise. Green in this case represents a low level of risk, I.E. the airport was able to lower the risk value through mitigation(s). Recommended further Risk Mitigation Actions This section provides, when applicable, further actions that could be implemented by the airport to further mitigate the risk and reduce its value. Table 17-3. Summary of mitigation actions. Risk 2-1 (Medium Level of Risk): Performance of routine operations in the presence of new structures erected to support construction work causing lack of situ- ational awareness and potential accidents in ramp area affected by construction. Risk mitigation actions: • Markings and signage • Temporary routes • Temporary protective structures • Stakeholder construction meetings • Employee Awareness campaigns • Airport staff, airlines and third-party operators training programs • Daily safety briefings and employee awareness • Issuing of NOTAMs A table summarizing the parties responsible for implementing each risk mitigation action is also desirable in this section. 17.3.2.5 Attachments This section should include the risk matrix used to determine risk values, along with any materials supporting the SRA (e.g., plans, procedures, and data).

102 A Guidebook for Safety Risk Management for Airports 17.3.3 Submit Report Following the completion of the documentation, the airport should have a documented process that describes how the report is to be submitted and accepted by the appropriate management personnel. These personnel may include the SMS manager, the Accountable Executive, the project sponsor, or other personnel authorized to accept and ensure the risk mitigation plan is implemented and tracked to determine if it is successful. Further, the SRA report must be archived so that the process used and the results are available as future SRA reference material and as evidence that the airport followed its own SMS processes for audit and regulation purposes.

103 18.1 Preparing to Facilitate an SRA An experienced facilitator can help ensure the success of an SRA. Ideally, a facilitator who is also a SME in the safety issue that triggered the SRA and who has no conflict of interest with the parties involved should be selected. The facilitator must be familiar with airport operations to the extent the subject matter deals with those aspects. If the facilitator is not familiar with the particular topic of the SRA, time needs to be spent preparing so that the facilitator will have a basic knowledge of the system to be described during the process. C H A P T E R 1 8 Facilitating an SRA A good facilitator can make the difference between an SRA that enhances airport performance and an SRA that “checks a requirements box.” The facilitator should spend time with the airport staff in advance of the SRA. The time should be spent accomplishing preparatory tasks and getting answers to important questions such as • Learning about and understanding the reason for the SRA. What was the triggering event and how does it fit into the existing system? • What is the airport staff’s understanding of the issues associated with the SRA? What are the underlying conditions, personalities, or hidden agendas that may surface during the SRA? • Confirm the SRM processes, procedures, and templates to be used. Have these been agreed to with any outside agencies who are participating? (e.g., FAA and airlines) • Confirm the logistics associated with the SRA – Dates – Times – Location (exact) – Refreshments – Projectors – White boards and or white paper to capture notes in real time – Responsibilities for documents, drawings, plans, and data – Responsibilities for other logistics as needed • If the triggering event is a construction project, the airport staff should provide a detailed description of the project, including any preferences the staff may have with regard to project phasing and priorities to tenant and airport impacts.

104 A Guidebook for Safety Risk Management for Airports 18.1.1 Invitations to Participate Following the initial briefing with the airport staff, decisions need to be made concerning the invitations to participate in the SRA. The first decision is on the responsibilities to prepare and send the invitations. Usually, airport staff will send the invitations; however, the facilitator, especially if he or she is an outside consultant, may be assigned to prepare the invitation. In this case, some questions will need to be answered before the development of the invitation: • Will the invitation be sent via email or hard copy? • If via email, who is responsible to ensure that all the invitees’ email addresses are correct? • How elaborate does the invitation need to be? Will it require photos and/or will appropriate logos be necessary? • What are the dates for distribution? Will there be a reminder sent closer to the actual date of the SRA? Identifying the right people to invite will set the stage for the success of the SRA. Invitations should be offered to those having a stake in the issue and to those with expertise in the topic area. The invitation should explain the purpose of the SRA and outline the topics and issues to be discussed. Make it clear in the invitation what the needed expertise is and how the airport expects to benefit from the SRA. Prepare a list of items and information each individual invitee is expected to bring. This list should be included in the SRA invitation so that other members of the panel can see and understand who is responsible for what. After coordination discussions are complete, the invitation can be prepared. The invitation should include, at a minimum, the following information: • Title (Example: Invitation to a Safety Risk Assessment). • Dates. • Times. • Location (exact, including room numbers or names if necessary). • A description of the triggering event for the SRA. If it is a construction project, the project designer might need to provide this information. The description should be short and concise. • The exact reason why the invitees are receiving the invitation. (Example: You are receiving this invitation because of your SME and we are requesting your participation in this SRA to assist us with making important safety risk management decisions.) • The list of invitees and all the information they are expected to bring. • Logistics, such as refreshments. • Any other pertinent issues. • An RSVP link or phone number. An exact number of participants is needed for proper planning. 18.1.2 SRA Templates The templates for use during the SRA should be identified well in advance. The appendices of this guidebook offer examples. Appendix D is specific to templates. In general, the three most important templates for use during the conduct of the SRA are • Definitions for severity and likelihood • Risk matrix • Hazard table (which tracks the SRA process) Sometimes, airport staff may be able to fill in certain templates as the SRA is being conducted. However, this approach slows the process because members of the SRA panel begin to assist with writing the details in the tables and report, rather than responding to questions and providing information that supports decisions.

Facilitating an SRA 105 18.1.3 Risk Matrix The guidebook’s appendices contain several sample risk matrixes for use by an airport. Appendix D is specifically provided to give airport operators options to select risk matrixes that best fit their needs. The facilitator needs to be familiar with the risk matrix to be used and under- stand why that particular matrix was chosen by the airport staff. The airport should determine which matrix is to be used and it should be included in the SMS manual. Appendix D contains a 5 × 5 matrix used by various airports of varying size and complexity and recommended in current FAA SMS guidance. When presenting or reviewing the risk matrix, the facilitator should illustrate the two ways to reduce risk—decrease the severity of the outcome or reduce the likelihood of the undesirable outcome. 18.1.4 SRA Briefing to Participants One of the most important sessions during the SRA is the initial briefing to the panel par- ticipants. The initial briefing sets the tone for the level of professionalism expected and enables the airport and the facilitator to be seen as leaders who will ensure the success of the process. In most cases, the briefing should be presented by a member of the airport staff, particularly, a senior member of the staff who most likely is seen as the SRA sponsor or SMS manager. It may be beneficial for the facilitator to make the presentation, particularly if bias among the panel members may exist. For illustration, the assumption is made that the briefing consists of a PowerPoint presentation outlining the issue to be assessed. In general, the presentation should include the following: • Introduction slide • Roles and responsibilities • Logistics – Dates and times – Refreshments and breaks – Overall agenda. (Note: If the SRA will last over 2 days, indicate which parts of the 5-step process will be covered on which days) • Brief description or depiction of the 5-Step SRM process • Definitions for Hazard, Risk, and Mitigation (if necessary, based on the panel members’ knowledge) • Risk Matrix to be used • Definitions of Severity and Likelihood to be used • Detailed description of the issue to be covered (i.e., the triggering action, event, or proposed change to the system). If it is a construction project – Site plans – Phasing – Haul routes – Planned mitigations to be implemented during the project • Close out slide to allow any questions prior to starting the process To be effective, the presentation should be complete and concise. To some panel members it may be their first exposure to SRM, and creating a positive first impression of the SRA process is

106 A Guidebook for Safety Risk Management for Airports important. Alternately, panel members experienced with SRAs may have had a bad experience, such as a protracted timeline, arguments among panel members, or poor data, which may arouse negative feelings about the process. The briefing is an opportunity to demonstrate how this SRA will be improved. Keep the mood professional and focused on the tasks at hand. 18.1.5 Handouts to Participants The SRA will be more efficient if the SRA panel members have pertinent information at their fingertips during the SRA. Refer to Appendix B for the minimum recommended information that should be made available. Appendix B, a brief handbook that can be tailored to fit the needs of an individual airport, can be printed and bound into a small handout for reference. 18.1.6 SRA Checklist Appendix B also includes an SRA checklist that can be tailored to any airport. During the SRA, it is beneficial to have the checklist available to confirm roles, responsibilities, and actions. Someone on the administrative staff of the airport should be tasked with using the checklist to confirm that things are occurring as anticipated. 18.2 Facilitating the SRA An effective facilitator is essential for conducting a successful SRA. The facilitator ensures that the panel members make the most of their time and that the correct information is gathered to support timely and pertinent decisions. The facilitator must wear multiple hats to make this happen. Being the SRA’s leader is one; being the SRA’s number one listener is another; and being the SRA’s manager is yet another. The panel members need to feel heard and sense that their opinions matter. However, the facilitator must also ensure that the process is followed and the information and decisions made are appropriate and timely. This is a tough assignment for even the most experienced person. Having some focused facilitation training is very beneficial. The FAA ARP provides guidance on facilitator training in FAA Order 5200.11 and the FAA SMS Desk Reference Guide, Appendix F. The Order identifies courses consistent with the training and experience needed to assist with FAA ARP-required and -led SRAs. The FAA uses this guidance for ARP-led panels. Although 5200.11 is an internal document to ARP, it does and will affect Part 139 airport operators because of the requirements placed on airport operators to provide facilities and facilitation services. Regardless of the requirement, facilitation is more art than science, and participants in the SRA will benefit from an accomplished facilitator; this is true whether the facilitator is a third-party consultant, part of the airport’s staff, or provided by the FAA. 18.2.1 Keeping to a Timeline To ensure the process is followed and the SRA is accomplished in the time allotted, the facilita- tor also needs to serve as timekeeper. There are several ways to accomplish this; but, in general, reminding the panel members of what they have accomplished and what will be covered next is very effective. It reminds the panel members that more work is needed and that providing infor- mation and making decisions is why they were asked to participate. Specific techniques include • Establishing the timeline in advance, making it part of the overall briefing and putting it in the invitation if the SRA is planned over multiple days

Facilitating an SRA 107 • Referring to the timeline prior to taking breaks and coming out of breaks so that panel members see progress and can adjust accordingly • Starting on time after breaks and refreshment periods • Having a plan for how long each step in the process will take for discussion and decisions • Asking panel members what can be done to ensure the process and the timeline proceeds efficiently • Calling time-out and reminding the panel members that their time is valuable and you, as the facilitator, want to ensure it is not wasted. This may be necessary for those panels members who insist on straying off topic and discussing matters that do not directly pertain to the SRA • Striving to prevent participants from skipping ahead. Following the process is critical to ensure the best and most accurate results come from the SRA. Some SMEs who are participating on the panel may want to skip ahead in the process and jump to conclusions. The facilitator must recognize this and not allow it to happen The best technique to ensure the timeline is followed is to keep the panel members focused on the process. Gather the necessary information from them and ask for decisions. By leading the process, the facilitator can help ensure that the SRA follows the agreed timeline. Keeping the discussion moving during the earliest stages of the SRA can help keep to the timeline. Typically, panel members will become overly focused on individual issues early on and then rush toward the end realizing they are running out of time. 18.2.2 Focusing the Participants The SMEs sitting on the SRA panel often come from different organizations, but they are all related by aviation. Representatives from the airport staff, the FAA, the airlines, airport tenants, and ground service providers might all sit on the panel as SMEs. Often, the panel members already know one another and work with each other frequently—thus, panel members want to “visit” and discuss topics unrelated to the SRA subject. As mentioned in the introductory sections, SMS and SRM are in various stages of development in the United States. The diverse background of panel members may also mean they have different views of SRM and how the SRA process should be followed. These pre-conceived thoughts may slow or hinder the process. The facilitator must be aware of this possibility before the SRA begins. To focus the panel members and keep them concentrating on the tasks at hand, the following techniques can be used: • Describe the process, the risk matrix to be used, and the definitions for the severity and likeli- hood up front; get agreement from the panel on what is to be used • Layout the overall timeline and advise the panel that the facilitator’s job is to ensure participants stay focused on the process and adhere to the timeline • Establish the ground rules. Reserve the right as the facilitator to refocus the panel members to ensure the SRA is accomplished • Remind the panel members that the process will be followed. To make progress, they need to work the process as prescribed • Call on them individually and remind them that they were asked to participate for their expertise and knowledge

108 A Guidebook for Safety Risk Management for Airports • Allow some discussion, but be mindful of the schedule and call the panel members back if need be. Some discussion is important because it gives the panel members an opportunity to debate and perhaps discover issues that otherwise would not be mentioned • Take breaks. When a break is finished, make it clear when the panel reconvenes as to where they left off and what is coming next As mentioned earlier, facilitation is more art than science. Each SRA panel will have a different dynamic and the members will have different relationships with one another and perhaps bias about the topic being assessed. To the extent possible, the facilitator should be aware of these conditions in advance and understand how these conditions may affect the SRA process. 18.2.3 Techniques for Hazard Identification In general, the facilitator keeps the panel members focused and actively participating in the process. The facilitator may find it beneficial to summarize the techniques used to make the process more effective. If the panel members offer suggestions that are not classified as hazards, but rather the outcome of a hazard, the facilitator may choose to not correct the panel member specifically. Rather, a successful technique is to allow the process to continue and when no other hazardous conditions are offered, go back through the list and discuss each one to ensure con- sensus among the panel; a correction can be made then. In such a case, the process continues and the panel member who offered the non-hazardous condition will not feel their input was rejected, thus keeping them engaged in the process. 18.2.4 What to Do When a Preliminary List of Hazards Is Not Available Some things can be done in the absence of a PHL: • Allow time for hazard identification in the process. The SRA panel members will develop the list of hazards from scratch. Therefore, enough time should be allocated in the schedule. • Plan to use the techniques described in Chapter 9, Step 2, to develop the list. The panel mem- bers should be asked to go back through the list to confirm the items are, in fact, hazardous conditions, and then add or subtract as appropriate. • Use the general lists of hazards provided in Appendix E of this guidebook as a starting point for the discussions. The examples provided in Appendix E may not be exact matches for each individual airport, but the examples can put the hazardous conditions in context and spark discussion among the panel members. The facilitator must ensure that hazard identification is as inclusive as possible. Encouraging the panel members to consider all appropriate conditions and under all appropriate circumstances is necessary. This critical step in the SRA process should not be cut short; extra time should be allowed and the panel should be encouraged to continue exploring all possible conditions. 18.2.5 Playing “Devil’s Advocate” Often panel members may begin to agree with one another as a matter of gradually developing process routine, rather than as a result of honest deliberation. This may stifle thoughtfulness and leave out important information. The facilitator must identify this behavior and address it. One way to do so is to play “devil’s advocate.” This means the facilitator challenges the consensus and asks “What-If” or “what about.” The facilitator must understand the system and the issue being assessed well enough to be able to ask such questions and have the panel members recognize what is being asked.

Facilitating an SRA 109 SRA panel members will sometimes want to assess risk based on the worst outcome of the hazardous condition and not necessarily on the worst credible outcome. People tend to believe that all hazardous conditions could lead to a catastrophic event. Although the worst can happen, it may not represent what is reasonable or credible. The facilitator needs to challenge this by specifically asking for data to support the panel’s assertion. Questions the facilitator should ask include, “Is that truly what you expect to happen?” or “When was the last time that occurred?” These are simple ways to challenge the panel without stifling discussion and interaction. 18.3 Recording/Documenting the Proceedings The facilitator is responsible for capturing what is said by the panel members, not verbatim, but by topic or in a bullet formatted list. The panel members expect to be heard, and the most effective way to demonstrate that the facilitator did hear them is to capture the topic or issues they provide. Such capture can be accomplished in several ways: • Use large whiteboards or poster paper and capture thoughts with a marker. This is a long standing technique used by facilitators of various industries and provides immediate feedback to the panel members that they were heard. This technique is taught in detail in the Certified Master Facilitator’s Course referenced in Section 17.1.4. With this technique, it is important to keep track of the pages used with a simple numbering system. Also putting headers at the top of each page will help in tracking progress. • Use an electronic table and project it on a screen for all the panel members to see as it is being filled in. This technique may require additional staff to type in the information while the facilitator manages the process. This technique may save on documentation on the backend of the SRA by providing the beginnings of the final report. One drawback to this technique is that panel members may become more interested in editing the projected table rather than staying on task and working the SRA process. • Allow each member of the panel to have a template at their place that they can fill in as the process moves along. This is a way to provide panel members with quick visual references and feel more involved. This should not replace the facilitator’s documentation. The facilitator needs to ensure consistency and provide the official results of the SRA. The facilitator must understand that personally capturing focused comments does not replace the need for a dedicated note taker to capture the detail of the discussion and the decisions made. It is very difficult for the facilitator to both take notes and effectively facilitate during the SRA. SRAs may benefit from having a recorder or note taker to free the facilitator to focus on keeping the process moving and productive. At the conclusion of the SRA, all notes should be gathered and pulled into a draft report as expeditiously as possible. This ensures the capture of the information while it is still “fresh” in everyone’s minds. Refer to Appendix D for sample final report templates.

110 19.1 SRA Planning At small airports, an SRA will likely involve few people, regardless of the complexity of the issue. Typically, panel members will come from the airport staff. The planning process can be less formal and a meeting can be scheduled using regular electronic messages or verbal communication. Scheduling should be easier due to the number of people participating. 19.2 Conducting the SRA The main challenge faced by a small airport is in finding a facilitator with experience and training to lead the SRA brainstorming. At airports with limited resources and for airports that do not fall under FAA SRM requirements, having someone on staff who understands the SRA process and can lead a group of people through the process is very valuable. Having at least one employee with formal facilitator training can ensure small airport SRAs are effective and efficient while relying on internal resources. For SRA panels with less than five people, the facilitator may only need to ensure the process is followed and document a discussion as it occurs. The size of the SRA panel will determine how involved the facilitator will need to be. Some airport panels may only involve two people and they may simply carry on a discussion about the safety issue being assessed. One person might act as facilitator by taking notes in a logical and thorough manner. The need for a facilitator should be driven by the number of people needed to conduct the SRA and the complexity of the issue being assessed. C H A P T E R 1 9 SRA for Small Airports Small airport operators should determine the need, roles, and responsibilities of a facilitator, based on the size of the SRA panel and the complexity of the issue being assessed. Internal staff may be acceptable and should be considered first in order to save costs. 19.3 Documenting the SRA Unless it is an FAA-led panel, there is no need for a formal report to document the SRA. Appendix D presents an SRA report example from a small hub airport. The report may be as simple as an SRA template that presents the hazards, risks, and risk mitigation actions, with any relevant notes or comments presented during the SRA meeting attached to the completed template.

111 The FAA may require some 14 CFR Part 139 certificated airports to develop and maintain an SMS that encompasses aircraft movement areas of the airfield. The SMS should include the four components: safety policy, safety risk management, safety assurance, and safety promotion. In addition to the “internal SMS” processes required by the FAA, there are some important interfaces between Part 139 airports and the FAA lines of business, particularly Airports—ARP and Air Traffic Organization—ATO, which are summarized in this guidebook. Figure A-1 illus- trates the interactions among ARP, ATO, and the airport. Some areas are common to two of the three elements; in some situations, all three SMS will interact. This section describes how these elements may work together regarding SMS. The information presented here may be changed and updated by the FAA, so the airport operator as the certificate holder should always obtain updated information and advisory material from the FAA website (www.faa.gov). A-1 Framework of SMS Amendment to Part 139 Proposed Rule The basic proposed requirements for SRM described in the Notice of Proposed Rulemaking for Part 139 SMS are as follows: • Establish a system for identifying safety hazards; • Establish a systematic process to analyze hazards and associated risks using the five SRM steps; • Ensure that mitigations are implemented where appropriate to maintain an acceptable level of safety; • Monitor safety objectives for regular assessment of safety level achieved; • Aim to make continuous improvement to the airport’s overall level of safety; and • Establish and maintain a process for formally documenting identified hazards, their associ- ated analyses, and management’s acceptance of the associated risks. A more detailed look at the minimum elements required in the regulation is presented to help certificate holders understand the potential effect of the SMS amendment. A P P E N D I X A SRM and the FAA

112 A Guidebook for Safety Risk Management for Airports System to Identify Hazards A system to identify hazards is a key element of the airport SMS. The airport may decide to use or create a hotline for hazard reporting or to use its IT systems and create a tool for online reporting of hazards. A few airports may use drop-boxes and hazard reporting forms in paper form. At larger airports, this alternative has limitations because there may be a delay in collect- ing and processing the information. At smaller airports, verbal communication is common. As an example, a small airport announced to its employees and stakeholders that hazards could be reported using the same hotline used by operations. The calls are normally documented in the operations log book and a checkmark was added to identify if the call reported an issue relevant to SMS. The information is then passed to the staff member responsible to coordinate the SMS, for actions when necessary. Process to Analyze Risks This process consists of the five steps for risk analysis described by the FAA and includes describing the system, identifying hazards, analyzing the risk, assessing the level of risk, and miti- gating risks (see Figure A-2). The process presented in the FAA regulatory and advisory material on SMS is usually documented in the airport’s SRM component of the SMS manual. The process is one of the most important elements of safety management. An example of a process to analyze risks is an SRA for an airfield construction project. Ensuring Mitigations Are Implemented Following the process to analyze risks and identify actions to mitigate risks, it is necessary to ensure that mitigation actions are in place and effective. This is done by assigning parties respon- sible for implementing each action, defining deadlines for completion, checking the status, and determining if actions are in place when milestones occur. For smaller airports, the electronic spreadsheet presented in Chapter 15 (Figure 15-1) can be used for this function. Monitoring of Safety Objectives Safety performance indicators are defined by the airport to monitor specific risks of concern to the airport. Reducing the level of risk associated with these performance indicators is part of Figure A-1. SMS interactions between FAA and Part 139 airports. Figure A-2. The 5-step process.

SRM and the FAA 113 the objectives defined by the airport and, in some cases, these objectives are documented in the SMS manual. For example, a large airport established a safety objective of reducing by 40% the monthly number of birdstrikes causing adverse effect to flights over a period of 2 years. Histori- cal information collected from the FAA Wildlife Strike Database served as the baseline for future improvements and actions were implemented to reduce the presence of species causing adverse effects. The trend was monitored over a 2-year period, with additional measures implemented to affect the presence of the most hazardous species and a reduction of 55% in the annual number of serious birdstrikes was achieved after 2 years. Continuous Improvement to Safety A more detailed look at the minimum proposed elements of SMS is presented that tar- get continuous improvement of safety levels in airport operations. In the SRM component, continuous improvement is achieved with the continuous identification of hazards, trend analysis of safety performance indicators, and execution of the SRM cycle using the five steps to identify actions that should be improved or implemented to reduce risks. As an exam- ple, an airport administrator received reports of miscommunication incidents between the tower and airfield maintenance staff. Based on the analysis of these incidents, the risks were assessed and additional training was provided to maintenance staff to mitigate the risk. How- ever, after the training was delivered, new incidents were reported and a new safety assessment was conducted. With the new assessment, the airport decided to replace the mobile radios used by maintenance staff. The SRM cycle does not end with the implementation of risk miti- gation actions. Often, it is necessary to monitor both the effective- ness of those actions and the risk level achieved to ensure risks are and remain acceptable. Whenever it is identified that risk was not controlled to acceptable levels, the SRM 5-step process should be restarted. Documenting Hazards, Risks, and Actions The airport should keep track of reported hazards, associated risks, and actions to take risks to acceptable levels. At larger airports, an IT solution may be beneficial to monitor and document the processes and actions. At smaller airports, a simple electronic spreadsheet may be sufficient. In addition, safety issues analyzed by a panel can be documented with reports describing the SRA study, conclusions, and actions. A-2 SRM Interface with the FAA The SRM processes carried out by the airport as part of its internal SMS aim to continuously and proactively improve the operations’ safety. The proposed SMS amendment in the Part 139 Rule would add another element of compliance for those airports affected by the revised Rule.

114 A Guidebook for Safety Risk Management for Airports Some safety assurance processes used by the FAA, like Part 139 certification inspections, have been in place for decades. With the implementation of the FAA ARP’s internal SMS, some triggering actions for safety assessments have been established and may require interactions with the airport operator, as presented in Table A-1. Not all safety assessments will require a panel, and the FAA will inform the airport about the need to convene a panel. Note: sometimes, the FAA ARP can provide facilitation services, but this is handled on an individual basis. A-3 Understanding the SRM Process Used by the FAA Airports’ Division (ARP) Understanding the process used by FAA ARP to conduct safety assessments may help airports support the FAA efforts and strengthen the interface between the FAA’s SMS and the airport’s SMS. The process is summarized in this section and details can be found in the FAA Office of Airports Safety Management System (SMS)—Desk Reference “National Policy”—Order 8040.4A (04/30/12) available on the FAA website. The FAA process in Figure A-3 is one where the FAA leads and the airport sponsor may be asked to procure facilitation services, provide additional data, and participate on the panel. The following are the steps in the process: 1. A project plan, change, or other approval is proposed by the airport or the FAA and a Safety Assessment Screening (SAS) is required. 2. Documents and relevant information are reviewed by the FAA office overseeing or adminis- tering the project. 3. The appropriate SAS form (Form 5200-8, 5200-9 or 5200-10) is initiated. 4. The airport sponsor and/or facilitator prepares a Proposal Summary and, when necessary, submits this summary to other FAA offices and stakeholders to verify the effect on aviation/ airport safety and operations. FAA SRM Trigger Airport Involvement Type of Involvement Development and Update of ARP Standards No Consultants and representatives of trade organizationsmay be invited to participate as panel members of safety assessments. Airport Planning Yes Exceptions include as built airport layout plans and long term planning beyond15 years. Airport Construction Safety and Phasing Plans (CSPP) Yes The airport is responsible for acquiring independent facilitation services for the safety assessment when a panel is required. 49 CFR Part 150 Noise Compatibility Planning Projects Yes Safety assessment required for proposed plans that can affect safety critical elements of the NAS. The airport is responsible for acquiring independent facilitation services for the safety assessment when a panel is required. Modification of FAA Airport Design Standards Yes The airport is responsible for acquiring independent facilitation services for thesafety assessment when a panel is required. Airspace Determinations for Non Construction Changes Yes The airport is responsible for acquiring independent facilitation services for the safety assessment when a panel is required. Operational Changes Impacting ATO’s SMS Yes FAA expects the certificate holder to participate in the FAA risk analysis insteadof performing an independent risk assessment under its SMS. Table A-1. FAA internal SMS triggers for airport operator involvement.

SRM and the FAA 115 Figure A-3. FAA safety assessment process. 5. Based on the reviews, it is determined if an SRM Panel is required. If a panel is not required, the project manager completes and signs the SAS form and the process stops. 6. If an SRM panel is necessary, the airport will be notified for coordination, to acquire a facilita- tor and arrange the panel, and prepare the schedule. Additional safety data and analyses are assembled by the FAA and the airport to support the SRM panel meeting. 7. The panel meeting is conducted using standard SRM processes and tools, and the discussions, conclusions, and actions are reported. 8. The SAS Form is prepared, completed, and finalized prior to being signed by meeting partici- pants, the airport sponsor, and the FAA; the process is then complete. FAA’s SRMTS is an internal IT system to document and manage hazards and risks. With this system, the FAA can keep track of hazards identified in its internal processes as well as those involving airport changes and improvements and monitor risks and the implementa- tion of actions associated with these risks. With this tool, the FAA can screen the SMS ele- ments by risk level, risk category, risk priority, airport, and specific categories of mitigation action. A-4 SRM Panel Documentation Whenever the FAA notifies the airport of the need to convene an SRM panel for a safety assess- ment, the airport will be responsible for coordinating the schedule with the panel participants and arranging a facilitator for the analysis. The final documentation is prepared by the FAA and the airport according to Table A-2.

116 A Guidebook for Safety Risk Management for Airports Document Responsibility Note SAS Form completed and signed by panel members, FAA official and airport sponsor FAA Airport sponsors sign the SAS form only if a panel is held and at the conclusion of the panel deliberations Project proposal summary Airport Sponsor Based on proposal documents Hazard identification and analysis tool worksheet and hazardmitigation plan completed by the panel Airport Sponsor In most situations the facilitator will beacquired/arranged by the airport Narrative of discussions and dissenting opinions Airport Sponsor In most situations the facilitator will be acquired/arranged by the airport Pictures, plans and other supporting documents and data FAA and Airport Including proposal documents Table A-2. Documentation responsibilities.

117 The following material is designed to be customized, removed, and copied in order to provide a 5- to 6-page handbook that is scalable for all airports. The information in these examples is for illustration only. Each airport should use information pertinent to that airport. Having a handbook for reference during an SRA, especially with a large panel of SMEs, has proven very helpful. Individual roles and responsibilities of those conducting and participating in the SRM process are also defined on Page 4 of this handbook. Note: this handbook is intended to assist airports conducting a SRA by and for their own needs. It is not intended to replace the FAA ARP process as defined in FAA Internal Order 5200.11 and explained further in the FAA ARP SMS desk reference guide. A P P E N D I X B SRM Handbook

118 A Guidebook for Safety Risk Management for Airports The Five Step Safety Risk Assessment Process 1. Describe the System The system is described to limit the scope of the risk assessment. The system is oen described using the 5MModel, which includes: Mission: the specific airport acvity (e.g. taxiway B reconstrucon) huMan: the personnel involved with the acvity (e.g. construcon workers, airport engineering and operaons staff, etc.) Machine: the equipment involved (e.g. trucks, pavers, compactors, etc.) Media or environMent: the environment including physical areas and ambient condions (e.g. taxiway B between taxiways J and N, haul routes, night work) Management: organizaon, procedures, regulaons, advisory material (e.g. FAA ACs, Construcon Safety Phasing Plan) 2. Idenfy Hazards There may be mulple hazards associated with the system that is being evaluated. For example, a construcon project may involve hazards such as FOD and the movement of haul trucks in airfield areas. 3. Analyze Risk Each hazard may have one or more outcomes (e.g. FOD may cause damage to aircra if ingested by the engine, or it may cause injuries to construcon workers due to jet blast). NOTE: It is important to idenfy exisng controls. The controls should be considered before assessing the level of risk prior to other migaon acons that are not in place. SOP, ACs, safety plans, and regular inspecons are examples of exisng controls (e.g., FOD control plan for a construcon project). 4. Assess Level of Risk The level of risk with the exisng controls is esmated and recorded. Use the risk matrix on Page 2 of this handbook. The user or the group will esmate the worst credible outcome and then the likelihood of occurring. The background color to indicate if the risk is low (green), medium (yellow) or high (red). The colors will provide quick idenficaon of higher risks. Within each box (25) there is a le’er which represents the overall level of risk, i.e. green, yellow, or red and a corresponding number which represents the level of risk based on the level of consequence, “1” being the lowest and “25” being the highest. The combinaon makes up the RAC which can be used to priorize migaons within a parcular color group. 5. Migaon Acons The high and medium risks should be controlled with migaon acons. Each risk may have one or more migaon/control acons to reduce the risk to an acceptable level. An airport that is experiencing high frequency of FOD may reduce the risk of accidents by taking addional measures such as increasing frequency of maintenance and removal of debris with sweeper trucks, and increasing the frequency of inspecons. PAGE 1

SRM Handbook 119 Customizable Checklist for SRM ITEM DOCUMENTATION OR TASK OWNER STATUS A Meeting and Logistics 1. SRA Topic 1a. Description of Proposed SRA 2. Onsite Contact 3. Facilitation Date(s) 4. Location 5. Start Time (Airport Team) 6. Start /End Time SME Panelists 7. Documentation 8. Visual Aids 9. Agenda 10. Other Logistics B Stakeholder Names and Contacts 1. Facilitator 2. Meeting Coordinator 3. Consultants 4. (airport) Ops/Safety 5. (airport) Admin. (properties) 6. (airport) Admin. (risk mgmt.) 7. (airport) ARFF/PD 8. (airport) Maintenance 9. (airport) Engineering and Planning 10. Major Airline 11. Major Airline & or Cargo 12. FBO 13. Catering Company 14. Others tenants (Part 135 operators, flight schools, etc.) 15. Other federal agencies: Border Protection, Customs, Federal Security Administration, FAA FSDO 16. FAA ATCT 17. FAA Certification 18. FAA Tech Ops (continued on next page)

120 A Guidebook for Safety Risk Management for Airports Document Title (examples) Specific Document Responsible Party Status 1. Gate Assignments 2. e.g. Airline Operations # 3. e.g. Gate Layout (aircraft restrictions) 4. e.g. Airline Scheduled Aircraft 5. e.g. Snow Removal Plan 6. Others D Final Documentation Section/Content Author/Owner Status 1. SRA Draft Report 2. SRA Review Team 3. SRA Final Report 4. SRA Signoff 5. SRA Submittal 6. Hazard Tracking 7. Hazard Status 8. Final Budget PAGE 2 C - Supporting Documentation/Information Sample Risk Matrix (5 X 5) Severity Likelihood No Safety Risk Minor Major Hazardous Catastrophic Frequently L5 M13 H20 H22 H25 Probable L4 M12 M15 H21 H24 Remote L3 L8 M14 M17 H23 Extremely Remote L2 L7 L10 M16 M19 Extremely Improbable L1 L6 L9 L11 M18 Low Medium High No Action Required Monitor, Determine if Risk can be Mitigated to a Low Risk Must beMitigated to aMedium Risk

SRM Handbook 121 Likelihood: Frequently Occurs once everymonth or XXXX commercial operations or XXXXXX passenger enplanements Probable Occurs once every year or XXXXX commercial operations or XXXXXXX passenger enplanements Remote Occurs once every 5 years or XXXXXXX commercial operations or XXXXXXXXX passenger enplanements Extremely Remote Occurs once every 10 years or XXXXXXX commercial operations or XXXXXXXXX passenger enplanements Extremely Improbable Occurs once every 20 years or over XXXXXXXX commercial operations or XXXXXXXXXX passenger enplanements PAGE 3 Definitions for Severity and Likelihood (Examples) Severity: People Assets Environmental Reputation Catastrophic Fatality+ Loss of an aircraft/or over $1,000,000 dollars in damage/or loss of critical system(s) for an extended period of time A spill or release that is not contained and results in long term damage to the environment and fines to the airport. An event or a series of events resulting in the community NOT using XXX for an extended period of time. Hazardous Severe Injury, requiring hospitalization Damage to an aircraft taking it out of service for an extended period of time/or damage in excess of $500,000/or disruption of critical services for extended period of time A reportable spill or release that requires mitigation. An event or a series of events resulting in the community lessening the use of XXX causing negative (annual) financial or operational impacts. Major Minor Injury requiring medical treatment Damage to an aircraft that is reparable/or damage to equipment or facility that is reparable within a short period of time. A reportable spill or release that is contained. An event or a series of events resulting in the community lessening the use of XXX for a short period of time. Minor Minor injury not requiring medical treatment Minor damage to an aircraft, equipment, or facility not requiring it to be taken out of service A spill or release that does not require a report. An event or a series of events resulting in the community questioning the reliability of XXX. No Safety Risk No injury No Damage No Impact No Impact

122 A Guidebook for Safety Risk Management for Airports Roles and Responsibilities Table (typical examples) Role Organization Position Held Responsibilities SRA Sponsor Airport Accountable Executive, Safety Manager, Department Head Approve and or require the SRA to be conducted Ensure it is conducted in accord with the airport’s protocols Participate as needed Review and approve results SRA Facilitator Airport or consultant (FAA led SRA may be provided by the FAA) Consultant, Safety Manager, other designee in the organization Lead the panel in accord with the documented airport’s process Ensure the five step SRM process is followed correctly Ensure the panel members participate as needed Ensure the documentation is thorough and accurate (this may be completed by the scribe; however the facilitator needs to ensure it’s accomplished and correct) SMEs AKA: Panel members Airport (operations, maintenance, engineering, police, fire department, properties, other as appropriate) Airlines (chief pilot, ground crews, properties, station management) FAA (tech ops, ARP certification, environmental management, project management, ATCT personnel) Other stakeholder(s) As appropriate for the subject matter necessary to ensure the SRA has the needed information to appropriately cover the topic Participate as requested Provide any requested information Bring any requested materials, drawings, maps, or other Review results (if requested) Ensure your information is accurately presented Note taker or scribe Airport’s responsibility to ensure someone is assigned the duty. Must work hand in hand with the facilitator Airport personnel and or consultant Take all appropriate notes and documentation in order to develop and provide the final SRA report which represents the SRA, decisions made, and actions taken. PAGE 4

123 C-1 Introduction This appendix presents templates to support risk assessments. The templates guide the user through the necessary steps to conduct an SRA and identify the most important factors and parameters in the process. C-2 How to Use the Templates The templates may be used to guide the risk assessment. In most cases, a template is presented as a table or worksheet and each column represents a parameter of the risk assessment. For each type of analysis, a specific worksheet is presented, each field is briefly explained, and examples are provided. In most cases, the columns should be filled in sequence, starting from column one. C-3 Categories Many techniques may be used to identify hazards and conduct risk assessments. The tem- plates present techniques for use by airport staff performing analyses of many common airport issues. Techniques include • Basic Risk Assessment • Safety Risk Assessment (SRA) • Comparative Safety Assessment (CSA) • Bowtie • What-if Analysis C-4 Basic Risk Assessment This technique includes the FAA-recommended SRM steps. Most of the techniques presented use this process; however, the process and the parameters evaluated may change. A basic risk assessment has the following steps: 1. Describe the system 2. Identify the hazards in the system 3. Analyze risk associated with the hazard 4. Assess the level of risk 5. Mitigate the risks A P P E N D I X C SRM Process Tools

124 A Guidebook for Safety Risk Management for Airports An SMS Administrator could use this technique daily to make risk assessments of sim- ple safety issues reported or identified during self-inspections. A formal report may not be required. Having software to record the parameters presented in the template may be very helpful to track implementation of actions and perform trend analysis. Table C-1 illustrates this process. The following are the parameters in the template: Column 1—Describe the System Describing the system limits the scope of the risk assessment. The system is often described using the 5M Model, as follows: • Mission: the specific airport activity (e.g., taxiway B reconstruction) • Man: the personnel involved with the activity (e.g., construction workers and airport engi- neering and operations staff) • Machine: the equipment involved (e.g., trucks, pavers, and compactors) • Media: the environment, including physical areas and ambient conditions (e.g., taxiway B between taxiways J and N and haul routes) • Management: organization, procedures, regulations, and advisory material (e.g., FAA ACs) Column 2—Identify Hazards Multiple hazards may be associated with the system being evaluated. For example, a construc- tion project may involve hazards such as FOD and movement of haul trucks in airfield areas. Letters may be used to identify each hazard. Column 3—Analyze the Outcome Each hazard listed in Column 2 may be associated with one or more outcomes (e.g., FOD may cause damage to aircraft if ingested by the engine or it may cause injuries to construction work- ers due to jet blast). Using the hazard letter and a number will help maintain the organization of the template (e.g., Risk B2 is the second risk associated with hazard B). Column 3a—Identify Existing Controls This column should be used to identify existing controls. It is important to consider these controls before assessing the level of risk prior to other mitigation actions that are not in place. Table C-1. Basic risk assessment template. (1) Describe the System (2) Identify Hazards (3) Analyze Outcome (3a) Identify Existing Control (4) Assess Level of Risk (5) Mitigation Actions (5a) Reassess Level of Risk with Mitigation Actions in Place 5M: Mission, Man, Machine, Media, Management Hazard A Risk A1 CA11, CA12, … A1 prior MA11, MA12, A1 after Risk A2 CA21, CA22, … A2 prior MA21, … A2 after Risk A3 CA31, CA32, … A3 prior MA31, MA32, A3 after Hazard B Risk B1 CB11, CB12, … B1 prior MB11, MB12, B1 after Risk B2 CB21, CB22, … B2 prior MB21, … B2 after Hazard C Risk C1 CC11, CC12, … C1 prior MC11, … C1 after Risk C2 CC21, CC22, … C2 prior MC21, MC22, … C2 after Risk C3 CA31, CC32, … C3 prior MC31, MC32, … C3 after

SRM Process Tools 125 SOP, ACs, safety plans, and regular inspections are examples of existing controls (e.g., FOD control plan for a construction project). Column 4—Assess Level of Risk In this column, the level of risk with the existing controls is estimated and recorded. In most cases, a risk matrix will be used to estimate the risk. First, the user or the group will estimate the worst credible consequence and then the likelihood of this occurring. In most cases, a code consisting of a number (corresponding to the severity) and a letter (corresponding to the like- lihood) will be assigned to identify the level of risk. It is always helpful to use a background color to identify if the risk is low (green), medium (yellow) or high (red). The colors will provide quick identification of higher risks. For example, if using the risk matrix used by the FAA, a risk level 2C represents a risk of hazardous consequences (2) and remote likelihood (C). A 2C risk level is assumed to be a medium risk (yellow). If colors are not used, the risk may be characterized as 2C-medium. Column 5—Mitigation Actions The high and medium risks should be controlled with mitigation actions. Each risk may have one or more mitigation/control actions to reduce the risk to an acceptable level. An airport experiencing high frequency of FOD on the runway may reduce the risk of accidents by tak- ing additional measures (e.g., increasing frequency of maintenance and removal of debris with sweeper trucks, planning runway rehabilitation, and increasing the frequency of inspections). Column 5a—Reassess Level of Risk with Mitigation Actions in Place This column is similar to Column 5; however, the new control actions are considered in order to estimate the new level of risk when all mitigation actions are in place. C-5 Safety Risk Assessment Table C-2 is a template for use in an SRA. The columns in this table were described in the previous section. In addition to the basic risk assessment table, it is important to define the par- ties responsible for each mitigation action developed during the analysis. Table C-3 provides an example for an airfield construction project. The columns represent the following parameters: Column 1—Haz # A number to identify the hazard Column 2—Hazard Description A short description of the hazard Table C-2. Risk assessment table. (1) Describe the System (2) Identify Hazards (3) Analyze Outcome (3a) Identify Existing Control (4) Assess Level of Risk (5) Mitigation Actions (5a) Reassess Level of Risk with Mitigation Actions in Place

126 A Guidebook for Safety Risk Management for Airports Column 3—Outcome A short description of the outcome involved with the hazard. There may be one or more out- comes associated with each hazard. Column 4—Risk Mitigation Actions Description of risk mitigation actions. There may be one or more recommended risk mitiga- tion actions that the airport could implement. Columns 5–9 Columns 5–9 indicate any involvement of a specific stakeholder to implement the specific mitigation action. In the first line of the example table, the planning and design, as well as the contractor staff are responsible for ensuring sweepers will be available at the construc- tion site. Haz # (1) Hazard Description (2) Outcome (3) RiskMitigating Actions (4) Planning & Design (5) Contract- or (6) Ops (7) ATCT (8) Other (9) 1 FOD from construction vehicles on taxiways Damage to aircraft Sweepers at construction site Establish monitoring procedures by Ops Establish notification procedures between contractor/operations/ATCT Use trained contractor escort to identify FOD and report to Ops Use trained flagmen equipped with brooms and shovels Install rumble strips at hauling route before pavement 2 Unanticipated damage to utilities due to construction activities Loss of systems leading to accidents Locate utilities prior to construction activities Test unidentified utility cables Identify non redundant systems for extra precautions Place system cables in conduits Mark location of utilities 4 Construction vehicles crossing active taxiways Collisions between aircraft and construction vehicles AOA driver trained escorts at both ends of the convoy Use trained flagmen Safety briefings Evaluate blast envelope of larger aircraft Secure equipment at gates Airlines Safety briefings Airlines Coordination: ramp tower/airlines/ATC Airlines Implement protective equipment for construction workers Adjust routing to avoid construction zones if possible Airlines Temporary signage at prone construction sites 5 Jet blast Injuries to construction workers and gate operators, and damage to equipment Table C-3. SRA mitigation table.

SRM Process Tools 127 C-6 Comparative Safety Assessment (CSA) A CSA is a comparison of the relative risk among multiple alternatives for resolving a safety issue or airport planning consideration. It is common to use a CSA to conduct tower siting stud- ies. A Preliminary Hazard List (PHL) is normally used to identify the hazards; hazard analysis worksheets are used to document the severity of consequence and likelihood of occurrence to assess the risks associated with each alternative being evaluated. For example, an airport may decide to build a new control tower with four viable sites identified. Each site is evaluated against each of the system safety hazards identified in the PHL. The hazards are compared using a risk matrix for relative hazard ranking. The CSA only considers hazards that may affect aviation safety and does not address other issues (e.g., cost or environmental issues). The basic worksheet for a CSA is presented in Table C-4 with examples included. • Column 1—Hazard: Hazards are numbered according to the alternative being evaluated and a hazard # is assigned. Hazard 2-3 is the third hazard identified for alternative 2. • Column 2—Hazard Description: Describe each hazard. There is only one description for each hazard identified (e.g., difficulty in clearly identifying planes approaching runway 15). • Column 3—Causes: Describe one or more causes for each hazard identified (e.g., it may be difficult to identify approaching aircraft due to long distance to runway end, and/or under low-visibility conditions). • Column 4—System State: Describe the conditions when causes described in Column 3 are predominant (e.g., identification of aircraft will be difficult under low light conditions or for smaller approaching aircraft). Table C-4. Sample CSA worksheet (example). Hazard (1) Hazard Description (2) Causes (3) System State (4) Existing Control or Requirement (5) Possible Outcome (6) Severity Rationale (7) Likelihood Rationale (8) Initial/Current Risk (9) Recommended Safety Requirements (10) Predicted Residual Risk (11) 1 1 Poor visibility on the aircraft ramp 1 1 Lack of highmasted lighting #1 Faded lead in lines at gates #2 At night #1 Consistently exacerbated at night #2 Airlines use wing walkers and lighted wands #1 Airlines use wing walkers and lighted wands #2 Local NOTAM issued to airlines who operate at that airport; posted in all airline operations offices #3 Aircraft accident with another aircraft #1 Aircraft incident with ground equipment #2 Hazardous, because of multiple aircraft being damaged and driving up $$$ #1 Major, because of damage to only one aircraft #2 Extremely remote, because it happened once in the past 10 years #1 Remote, because it happened within the past five years #2 #1: M16 – Medium #2: M14 – Medium #1: Install highmasted lights #2: Paint new lead in lines and aircraft safety envelopes #1: Hazardous and Extremely Improbable (changed likelihood to every 20 years) = L11 – Low #2: Major and Extremely Remote (changed likelihood to occurring every 10 years) = L1 – Low 1 2 Desc. 1 2 … … … … … … … … … 2 1 Desc. 2 1 … … … … … … … … … 2 2 Desc. 2 2 … … … … … … … … … 2 3 Desc. 2 3 … … … … … … … … … 3 1 Desc. 3 1 … … … … … … … … … 4 1 Desc. 4 1 … … … … … … … … …

128 A Guidebook for Safety Risk Management for Airports • Column 5—Existing Control or Requirement: Use this column to identify any measures in place that will help mitigate the risks associated with the hazard (e.g., FAA Orders, binoculars). • Column 6—Possible Outcome: The hazard may lead to an unsafe condition, which is described in this column. The hazard may not necessarily be described in terms of consequences. There may be one or more possible effects for each hazard (e.g., loss of separation and holding air- craft interference with NAS equipment). • Column 7—Severity Rationale: This column is used to justify the estimate of the worst credible consequence. Often, a SME or group of experienced stakeholders may perform the estimate. • Column 8—Likelihood Rationale: Similar to Column 7, this column is used to justify the ratio- nale used to obtain the estimate. A SME may have the experience to make the estimate, or it may be estimated using available data for the airport. • Column 9—Initial/Current Risk: In this column, the level of risk with the existing controls in place is characterized. Usually, a risk matrix will be used to estimate the risk. The user or the group will estimate the worst credible consequence and then the likelihood of it occur- ring. Often, a code composed of a number (corresponding to the consequence) and a letter (corresponding to the likelihood) will be assigned to identify the level of risk. It is always helpful to use a background color to identify if the risk is low (green), medium (yellow), or high (red). The colors will provide quick identification of higher risks. For example, if using the risk matrix used by the FAA, a risk level 2C represents a risk of hazardous con- sequences (2) and remote likelihood (C). A 2C risk level is assumed to be a medium risk (yellow). If colors are not used, the risk may be effectively characterized as 2C-medium to ensure understanding. • Column 10—Recommended Safety Requirements: In this column, the list of control actions to address the hazard should be included. Examples of controls to mitigate the risks for a tower siting study might include pilot position reports and signage to avoid runway/taxiway incursions. • Column 11—Predicted Residual Risk: The residual risk is the risk level estimated if the controls are implemented to reduce the current risk. The new control actions are considered in order to estimate the residual level of risk when all mitigation actions are in place. In addition to the CSA worksheet, a summary table can be used to help compare the alterna- tives being evaluated. Each line represents one of the alternatives evaluated and numbering fol- lows the order used in the CSA worksheet. Three columns present the number of hazards with high, medium, and low risk for each alternative. The last column contains key justification for selection or elimination of the alternative, as shown in Table C-5. Table C-5. Example of CSA initial risk ranking results. Alternative # High Medium Low Comments 1 0 0 1 Recommended alternative 2 0 2 1 Eliminated because one of the medium riskscould not be furthermitigated 3 2 0 1 Eliminated due to two high risks with high costtomitigate 4 1 1 0 Eliminated because alternative will not complywith FAA standard

SRM Process Tools 129 C-7 Bowtie The bowtie method of risk assessment is often used when quantitative data is available and is an excellent tool for communication to management. The focus is a single undesirable event (e.g., a runway/taxiway incursion at a specific hotspot or an aircraft overrun). The name origi- nated from the basic shape of the analysis diagram, illustrated in Figure C-1. The left side of the event (accident) is characterized as the fault tree and the right side as the event tree. The knot of the bowtie is the undesirable event. The fault tree contains proactive controls that act as safety barriers to prevent, control, or mitigate the chance that a hazard leads to an accident. The event tree has proactive controls to mitigate the severity of consequences if an accident/incident takes place, despite the proactive controls. The diagram helps illustrate the relationships among hazards, controls, and consequences and supports a systematic approach for the risk assessment. The following are the steps to conduct a bowtie risk assessment: 1. Identify the Undesirable Event The objective of the assessment is to reduce the risk of the undesirable event by reducing the likelihood and mitigating the consequences when the event occurs. This is the focus of the bowtie analysis (e.g., aircraft overrun accident). 2. Assess the Hazards Identify the threats that may lead to the undesirable event (e.g., low friction, long touch- down, or small RSA). 3. Assess the Consequences There may be different types or levels of consequences. An aircraft overrun may result in an incident only or it may end up with multiple fatalities and catastrophic consequences (e.g., damage to aircraft or hull loss with multiple fatalities). 4. Identify Proactive Controls Proactive controls are used to eliminate or reduce the probability that the event takes place (e.g., runway grooving, monitoring runway friction, or installing EMAS). Each hazard may have one or more controls, and each control may address one or more hazards. 5. Identify Reactive Controls This is the type of control used if the undesirable event takes place. Instead of reducing the likelihood, reactive controls may only mitigate the consequences of the event (e.g., establish Figure C-1. Bowtie model. Haz #1 Haz #2 Haz #3 Haz #4 Haz #5 Haz #6 Accident PC #1 PC #2 PC #4 PC #3 Undesired Event Proactive Controls Hazards Reactive Controls Consequences Cons #1 Cons #2 Cons #3 RC #1 RC #2 RC #3

130 A Guidebook for Safety Risk Management for Airports an emergency plan, reduce emergency response time, improve ARFF training, and establish a recovery plan for operations). Each reactive control may address one or more consequences and each consequence may be mitigated with one or more reactive controls. Figure C-2 illustrates the application of the bowtie method for an airport safety issue. The undesirable event is an aircraft overrun. C-8 What-If Analysis What-If Hazard Analysis is a structured brainstorming method to identify what things can go wrong and assess the consequences and likelihood should the risk occur. The answers to these questions help classify the risks and determine a course of actions to control and mitigate the risks. The template used for What-If analysis is shown in Table C-6. The example shows an analysis for aircraft refueling and the list should be considered only partial. As with the SRM 5-step process, defining the system in which the hazardous condition exists is essential. In Table C-6, a quick way to define the system is consistent with the 5-M Model. The 5-M Model in this case would be captured as: (1) Mission: Fueling Aircraft (2) huMan: Aircraft crews and fueling personnel (3) Machine: Fuel trucks and or system, the fuel itself, the aircraft (4) Management: The fueling SOP (5) Media: The aircraft ramp area/gate area The What-If analysis then asks: what if certain components of the system failed? Table C-6 presents examples for just part of the system failing as listed above. Use this for all the 5-M Model components listed above for a complete picture of the What-If analysis. Figure C-2. Bowtie model with examples.

SRM Process Tools 131 System Failure What if? (1) Answer (2) Likelihood (3) Severity (4) Control Actions (5) Fueling equip. Mechanical failure adrift nozzle during fueling Fuel may spray out between mating faces Improbable Minor Use of locking mechanism Inspection and maintenance Fueling adapter on aircraft designed to prevent back flow Human error Faulty gauge system or human error leads to overfill of aircraft tanks Fuel spills from surge tank vent on the aircraft wing onto the ramp Remote Major (large quantity of fuel spill) Auto shutoff fueling valves Overfill protection with fuel sensors in surge tank Aircraft equipment failure Aircraft brakes are not applied nor chocks are used and aircraft moves Hose may get ruptured Improbable Major Operator should detect aircraft movement Release dead man’s control to stop fuel transfer Chock aircraft Table C-6. Template for What-If hazard analysis.

132 A P P E N D I X D D-1 Introduction The SRM templates support the SRM processes and procedures being developed by airports. Each section presents templates by category and briefly explains their origin. The templates were developed using MS Excel and Word templates to help airports in effective, efficient application of SRM. These templates are scalable and include examples used during the SMS Pilot Studies. There are explanations and an approach to developing individual airport-specific SRM tem- plates along with these examples. The intent is not to require the use of any one template, but to provide airport operators with options and an approach so that local philosophy and require- ments can be incorporated into the SRM process. D-2 SRA Checklist Identifying the need for, planning, preparing, executing, monitoring and tracking, and docu- menting a safety risk assessment (SRA) can be arduous. Depending on the complexity of the safety issue, system change, or system itself, the amount of effort that must go into the SRA is proportional. To make this process more manageable for airport stakeholders and operators, a simple checklist has been developed by several airports that have participated and some airports that did not participate in the SMS Pilot Studies. These checklists can help ensure the tasks, information, and panel member duties are accounted for, so that the SRA can be an effective, efficient process. Following are two versions of such checklists. Table D-1 contains four sections with four columns; the last two columns are used to identify who manages or is in charge of the task and its status. Section A is used to summarize the general information about the SRA. Section B contains the SRA panel participants with their affiliation and contact information. Section C lists the documents relevant to the specific SRA. Finally, Section D is used to control the documents generated in the SRA. Note: This checklist was used by multiple pilot study airports. It is flexible and not dependent on the size of the airport. Table D-2 presents a checklist developed by the research team to support SRAs conducted for any size of airport and contains the minimum amount of information that may be necessary for SRA planning. It includes examples of the information. SRM Templates

ITEM DOCUMENTATION OR TASK OWNER STATUS A –Meeting and Logistics 1. SRA Topic 1a. Description of Proposed SRA 2. Onsite Contact 3. Facilitation Date(s) 4. Location 5. Start Time (Airport Team) 6. Start /End Time SME Panelists 7. Documentation 8. Visual Aids 9. Agenda 10. Other Logistics B – Stakeholder Names and Contacts 1. Facilitator 2. Meeting Coordinator 3. Consultants 4. Airport Ops/Safety 5. Airport Admin. 6. Airport Admin. 7. Airport ARFF/PD 8. Major Local Airline 9. Major Local Airline (Cargo) 10. Any Other Airline Stakeholders 11. FBO 12. Catering Company Table D-1. SRA checklist from multiple pilot study airports. (continued on next page)

ITEM DOCUMENTATION OR TASK OWNER STATUS 13. Others? 14. FAA ATCT 15. FAA Certification C – Supporting Documentation/Information Document Title Specific Document Responsible Party Status 1. Gate Assignments 2. e.g. Airline Operations # 3. e.g. Gate Layout (aircraft restrictions) 4. e.g. Airline Scheduled Aircraft 5. e.g. Snow Removal Plan 6. Other D – Final Documentation Section/Content Author/Owner Status 1. SRA Draft Report 2. SRA Review Team 3. SRA Final Report 4. SRA Signoff 5. SRA Submittal 6. Hazard Tracking 7. Hazard Status 8. Final Budget Table D-1. (Continued).

Topic: New Taxiway Turnoff A 12 (example) Item: Item to be Provided Person Responsible Status Logistics o Date o Time(s) o Place o Other o January 6, 2014 o 8:00 AM to 12:00 PM EDT o Wilber Wright Conference Room o Coffee provided Mrs. Administration Confirmed Facilitator John Doe, Airport WYZ Mr. Administration Confirmed DocumentMgr. Mr. Administration Mrs. Administration Confirmed Data / Information o Construction Drawings o ALP o Aerial Mr. Engineering TBD PanelMembers 1. Mr. FBO Mr. Operations Invited 2. Mrs. US Airline Mr. Operations Invited 3. Mr. FAA Mr. Operations Invited 4. Mrs. GSP Mr. Operations Invited Additional Resources o Incursion # from XYZ o Safety data from previous projects Mr. Engineering Mr. Operations Confirmed Confirmed Photos (as required) See above, Aerial Mr. Operations Confirmed Table D-2. SRA checklist developed by the research team.

136 A Guidebook for Safety Risk Management for Airports D-3 Risk Matrix One of the critical steps in SRM is classifying the risks. Classifying the risks provides the opportunity to prioritize resources necessary to mitigate the risks effectively. To address risks falling under multiple categories, airports need a consistent and locally generated reference to help prioritize resources for risk mitigation. Risk is normally classified using a matrix—a simple table where the columns represent the levels of severity and the rows represent the levels of probability. The FAA, across multiple lines of business, has determined that a five-by-five risk matrix is appropriate to character- ize safety risk in their varied regulatory roles in aviation (i.e., five categories of severity and five categories of probability). The tool serves FAA needs and is the risk matrix presented in the ACs for airports (see Figure D-1). The different colors help the user identify the risk level: high risk (red), medium risk (yellow), or low risk (green). Additional risk matrix examples are provided to allow users options when selecting the tool that best fits their operational and safety needs. Another version of the FAA risk matrix is presented in AC 150/5200-37 (Figure D-2). It is similar to the matrix adopted by all FAA lines of business; however, two red cells were adjusted for yellow cells. It is expected that this matrix will be replaced with that shown in Figure D-1. Figure D-3 illustrates a simple 4 × 4 risk matrix with only two risk classifications: accept- able and unacceptable risk. This type of matrix may be suitable for smaller airports where the numbers of identified risks are limited and do not require additional levels of classification for prioritizing risk management actions. Figure D-1. FAA ARP risk matrix as of July 22, 2013 (update to document: Internal Order 5200.11 V2). * Unacceptable with Single Point and/or Common Cause Failures High Risk Medium Risk Low Risk Severity Likelihood Minimal 5 Minor 4 Major 3 Hazardous 2 Catastrophic 1 Frequent A Low Risk Medi um Risk Medi um Risk High Risk High Risk Probable B Low Risk Medi um Risk Medi um Risk High Risk High Risk Remote C Low Risk Low Risk Medi um Risk High Risk High Risk Extremely Remote D Low Risk Low Risk Low Risk Medi um Risk High Risk Extremely Improbable E Low Risk Low Risk Low Risk Low Risk * HalfHi gh/Half

SRM Templates 137 Figure D-2. Risk matrix from AC 150/5200-37. *Unacceptable with Single Point and/or Common Cause Failures * Figure D-3. Example of risk matrix presented in draft AC 150/5200-37A. Predictive Risk Matrix Frequent – Likely to Occur Repeatedly Occasional – Likely to Occur Sometime Remote – Unlikely, but Possible Improbable – Very Unlikely to Occur Catastrophic – Multiple Deaths, Critical Damage, Aircraft Destruction Serious – Serious Injury or Death, Major Damage to Facility or Aircraft Minor –Minor Injury, Minor Damage to Facility or Aircraft Negligible – Superficial Injury, Cosmetic Damage or Inconvenience Only Acceptable Risk Unacceptable Risk

138 A Guidebook for Safety Risk Management for Airports Figure D-4 presents another type of risk matrix similar to that in use by the FAA and developed by consultants during the FAA Pilot Study. The cells are characterized by a letter representing the risk acceptability (low, medium, and high) and a number that helps classify the risk within the acceptability level: the higher the number, the higher the level of risk and the priority for mitigation actions. The combination of the letter and number represents the Risk Assessment Code (RAC). In Figure D-4, each category of risk (e.g., Low, Medium, and High) is assigned a Risk Assess- ment Code (RAC) to enhance risk identification and prioritization. The risk level numbers increase within risk category from left to right, corresponding to increasing severity. Example: A risk assessed to be a M14 will carry a higher priority than a risk assessed to be a M12. Both are assessed to be Medium level of risk; however, the risk with the higher classification of severity will take priority for mitigation actions. D-4 Severity and Probability Tables Severity and probability tables reflect an individual airport’s level of risk tolerance and are associated with the specific risk matrix adopted by the airport. The definitions for sever- ity and probability give the risk assessment meaning and allow airports to quantify the risk associated with each risk of a particular hazard. Because risk is defined by the combination of severity and probability, those definitions must reflect the airport’s risk acceptance. The fol- lowing tables represent a broad variety of definitions for severity and probability. Some of the tables assign a “value” to the definitions. These values are used when risks are assessed using a risk assessment matrix and help to prioritize risks within a particular category (i.e., Low, Medium, or High). Figure D-4. Risk matrix used by multiple SMS pilot study airports. Severity Likelihood No Safety Risk Minor Major Hazardous Catastrophic Frequently L5 M13 H20 H22 H25 Probable L4 M12 M15 H21 H24 Remote L3 L8 M14 M17 H23 Extremely Remote L2 L7 L10 M16 M19 Extremely Improbable L1 L6 L9 L11 M18 Low Medium High No Action Required Monitor, Determine if Risk can be Mitigated to a Low Risk Must beMitigated to aMedium Risk

Table D-3. Definitions for severity from the FAA ARP Internal Order 5200.11. Minimal 5 Minor 4 Major 3 Hazardous 2 Catastrophic 1 A T C S e r v i c e s Conditions resulting in a minimal reduction in ATC services, or A loss of separation resulting in a Category D Runway Incursion (RI), or An Operational Deviation (OD), or A Proximity Event (PE) Conditions resulting in a slight reduction in ATC services, or A loss of separation resulting in a Category C RI, or Operational Error (OE) Conditions resulting in a partial loss of ATC services, or A loss of separation resulting in Category B RI or OE Conditions resulting in total loss of ATC services (ATC Zero), or A loss of separation resulting in a Category A RI or OE Conditions resulting in a collision between aircraft, obstacles or terrain F l i g h t C r e w Flight crew receives TCAS Traffic Advisory informing of nearby traffic or, Pilot Deviation (PD) where loss of airborne separation falls within the same parameters of a Category D OE or PE, or Minimal risk on operation of aircraft Potential for PD due to TCAS Preventive Resolution Advisory (PRA) advising crew not to deviate from present vertical profile, or PD where loss of airborne separation falls within the same parameters of a Category C OE, or A reduction of functional capability of aircraft but does not impact overall safety (e.g. normal procedures per AFM) PD due to response to TCAS Corrective Resolution Advisory (CRA) issued advising crew to take vertical action to avoid developing conflict with traffic, or PD where loss of airborne separation falls within the same parameters of a Category B OE, or Reduction in safety margin or functional capability of the aircraft requiring crew to follow abnormal procedures per AFM Near mid air collision (NMAC) results due to proximity of less than 500 feet from another aircraft or a report filed by pilot or flight crew member that a collision hazard existed between two or more aircraft; or Reduction of safety margin and functional capability of the aircraft requiring crew to follow emergency procedures as per AFM. Conditions resulting in a mid air collision (MAC) or impact with obstacle or terrain resulting in hull loss, multiple fatalities, or fatal injury F l y i n g P u b l i c Minimal injury or discomfort to passenger(s) Physical discomfort to passenger(s) (e.g. extreme braking action; clear air turbulence causing unexpected movement of aircraft causing injuries to one or two passengers out of their seats) Minor injury to greater than zero to less or equal to 10% of passengers Physical distress on passengers (e.g. abrupt evasive action; severe turbulence causing unexpected aircraft movements), or Minor injury to greater than 10% of passengers Serious injury to passenger(s) Fatalities or fatal injury topassenger(s) A i r p o r t No damage to aircraft but minimal injury or discomfort of little risk to passenger(s) or workers Minimal damage to aircraft, or Minor injury to passengers, or Minimal unplanned airport operations limitations (i.e. taxiway closure), or Minor incident involving the use of airport emergency procedures Major damage to aircraft and/or minor injury to passenger(s)/worker(s), or Major unplanned disruption to airport operations, or Serious incident, or Deduction on the airport’s ability to deal with adverse conditions Severe damage to aircraft and/or serious injury to passenger(s)/worker(s); or Complete unplanned airport closure, or Major unplanned operations limitations (i.e. runway closure), or Major airport damage to equipment and facilities Complete loss of aircraft and/or facilities or fatal injury in passenger(s)/worker(s); or Complete unplanned airport closure and destruction of critical facilities; or Airport facilities and equipment destroyed Severity Definitions

140 A Guidebook for Safety Risk Management for Airports Table D-4. Definitions for severity (ACRP Report 1, Vol 2). Criteria Risk Severity Classification No Safety Risk A Minor B Major C Hazardous D Catastrophic E Risk on aircraft operations No risk on safety Slight reduction in safety margin or functional capabilities capabilities Significant reduction in safety margin or functional Large reduction in safety margin or functional capabilities Hull loss Risk on people Inconvenience Physical discomfort Physical distress possibly including injuries Serious or fatal injury to small number of people Multiple fatalities Risk on airport reputation Slight to moderate impact Loss of community reputation Loss of state reputation Loss of national reputation Loss of international reputation Financial loss Slight damage is less than $10,000 Noticeable damage between $10,000 and $100,000 Large damage between $100,000 and $1,000,000 Major damage between $1,000,000 and $10,000,000 Severe damage exceeds $10,000,000 Table D-5. Definitions for severity from a medium-hub (SMS Pilot Study) airport. People Assets Environmental Reputation Catastrophic Fatality+ Loss of an aircraft/or over $1,000,000 dollars in damage/or loss of critical system(s) for an extended period of time A spill or release that is not contained and results in long term damage to the environment and fines to the airport. An event or a series of events resulting in the community NOT using XXX for an extended period of time. Hazardous Severe Injury, requiring hospitalization Damage to an aircraft taking it out of service for an extended period of time/or damage in excess of $500,000/or disruption of critical services for extended period of time A reportable spill or release that requires mitigation. An event or a series of events resulting in the community lessening the use of XXX causing negative (annual) financial or operational impacts. Major Minor Injury requiring medical treatment Damage to an aircraft that is reparable/or damage to equipment or facility that is reparable within a short period of time. A reportable spill or release that is contained. An event or a series of events resulting in the community lessening the use of XXX for a short period of time. Minor Minor injury not requiring medical treatment Minor damage to an aircraft, equipment, or facility not requiring it to be taken out of service. A spill or release that does not require a report. An event or a series of events resulting in the community questioning the reliability of XXX. No Safety Risk No injury No Damage No Impact No Impact

SRM Templates 141 Table D-6. Severity definitions from a large-hub (SMS Pilot Study) airport. 1 – People 2 – Continuity of Operations 3 – Environmental 4 – Reputation 5 – Assets Minimal 5 No to slight injury No impact No impact No impact Less than $50k Minor 4 Injury with medic response Minor disruption to normal operations Recovery time = immediate Non Reportable – Containable minimal volume of hazardous material Minimal media inquiries $50K to <$1 Million Major 3 Injury with transport to medical facility Major disruption to normal operations Recovery time =24 to 48 hours Reportable – Non containable minimal volume of hazardous material Local media coverage $1 Million to$100 Million Hazardous Severe 2 Multiple injuries or fatalities Severe disruption to normal operations Recovery time = more than 48 hours Reportable – Containable moderate volume of hazardous product/material Local and national media coverage for more than 48 hours $100 Million to $1 Billion Catastrophic 1 Mass Casualty Incident Widespread regional disruption Recovery time = indefinite Reportable – Non containable significant volume of hazardous product/material Widespread international media coverage and reduction of air travel indefinitely Over $1 Billion

Probability Definitions Table D-7. Qualitative criteria for risk likelihood from the FAA ARP Internal Order 5200.11. NAS System & ATC Operational NAS Systems ATC Operational Flight Procedures Airports Individual Item/System ATC Service/NAS Level System Per Facility NAS Wide Airport Specific F r e q u e n t A Probability of occurrence per operation/operational hour 1x10 3 Expected to occur about once every 3 months for an item Continuously experienced in the system Expected to occur more than once per week Expected to occur more than every 1-2 days Probability of occurrence per operation/operational hour 1x10 5 Expected to occur more than once per week or every 2500 departures, whichever occurs sooner P r o b a b l e B Probability of occurrence per operation/operational hour 1x10 5 Expected to occur about once per year for an item Expected to occur frequently in the system Expected to occur about once every month Expected to occur about several times per month Expected to occur about once every month or 250,000 departures, whichever occurs sooner R e m o t e C Probability of occurrence per operation/operational hour 1x10 5 but 1x10 7 Expected to occur several times during an item’s lifecycle Expected to occur numerous times in a system’s lifecycle Expected to occur about once every year Expected to occur about once every 3 years Probability of occurrence per operation/operational hour 1x10 5, but 1x10 7 Expected to occur about once every year or 2.5 million departures, whichever occurs sooner E x t r e m e l y R e m o t e D Probability of occurrence per operation/operational hour 1x10 7 but 1x10 9 Unlikely to occur, but possible in an item’s lifecycle Expected to occur several times in a system’s lifecycle Expected to occur once every 10 100 years Expected to occur about once every 3 years Probability of occurrence per operation/operational hour 1x10 7 but 1x10 9 Expected to occur once every 10 100 years or 25 million departures, whichever occurs sooner E x t r e m e l y I m p r o b a b l e E Probability of occurrence per operation/operational hour < 1x10 9 So unlikely that it can be assumed that it will not occur in an item’s lifecycle Unlikely to occur, but it is possible in system lifecycle Expected to occur less than every 100 years Expected to occur less than every 30 years Probability of occurrence per operation/operational hour < 1x10 9 Expected to occur < every 100 years

SRM Templates 143 Table D-8. Quantitative criteria for likelihood (ACRP Report 1, Vol 2). Risk Likelihood Classification Extremely Improbable 1 Extremely Remote 2 Remote 3 Probable 4 Frequent 5 More than one event in 1,000,000,000 operations Between 10,000,000 and 1,000,000,000 operations per event Between 100,000 and 10,000,000 operations per event Between 1,000 and 100,000 operations per event Less than 1000 operations per event Less than once in 100 years Once every 10 100 years Once every 1 10 years Once every month More than once every week Table D-9. Quantitative criteria from a medium-hub (SMS Pilot Study) airport. Likelihood: Frequently Occurs once everymonth or 5,600 commercial operations or 336,000 enplanements Probable Occurs once every year or 68,000 commercial operations or 4,000,000 enplanements Remote Occurs once every 5 years or 340,000 commercial operations or 20,000,000 enplanements Extremely Remote Occurs once every 10 years or 680,000 commercial operations or 40,000,000 enplanements Extremely Improbable Occurs once every 20 years or over 1,360,000 commercial operations or 80,000,000 enplanements Table D-10. Quantitative criteria from a non-hub (SMS Pilot Study) airport. Likelihood: Frequently Occurs once everymonth or 3,000 aircraft operations or 25,000 enplanements Probable Occurs once every year or 34,000 aircraft operations or 300,000 enplanements Remote Occurs once every 5 years or 170,000 aircraft operations or 1,500,000 enplanements Extremely Remote Occurs once every 10 years or 340,000 aircraft operations or 3,000,000 enplanements Extremely Improbable Occurs once every 20 years or over 700,000 aircraft operations or 6,000,000 enplanements Severity: People Assets Environmental Reputation Catastrophic Fatality+ Loss of an aircraft/or over $1,000,000 dollars in damage/or loss of critical system(s) for an extended period of time. A spill or release that is not contained and results in long term damage to the environment and fines to the airport. An event or a series of events resulting in the community NOT using XXX for an extended period of time. Hazardous Severe Injury, requiring hospitalization Damage to an aircraft taking it out of service for an extended period of time/or damage in excess of $500,000/or disruption of critical services for extended period of time. A reportable spill or release that causes short term damage to the environment and requires mitigation. An event or a series of events resulting in the community lessening the use of XXX causing negative (annual) financial or operational impacts. Major Minor Injury requiring medical treatment Damage to an aircraft that is reparable/or damage to equipment or facility that is reparable within a short period of time. A reportable spill or release that is contained. An event or a series of events resulting in the community lessening the use of XXX for a short period of time. Minor Minor injury not requiring medical treatment Minor damage to an aircraft, equipment, or facility not requiring it to be taken out of service A spill or release that does not require a report. An event or a series of events resulting in the community questioning the reliability of XXX. No Safety Risk No injury No Damage No Impact No Impact Note: This airport combined severity and likelihood into one table for ease of reference.

144 A Guidebook for Safety Risk Management for Airports D-5 Detailed 5-Step SRM Process Table D-11 provides easy-to-follow, step-by-step guidance for process application during an SRA. Airport operators may choose to provide this template to SRA panel members for use during the SRA process. The SRA is typically led by a designated facilitator. The facilitator’s role is to guide the SRA panel members through the process, document results, and provoke interaction, thought, expertise, and information exchange. Parameters in the template are as follows: • Column 1—Describe the System: The system is described to limit the scope of the risk assess- ment. The system is often described using the 5M Model: – Mission: the specific airport activity (e.g., taxiway B reconstruction) – Man: the personnel involved with the activity (e.g., construction workers and airport engineering and operations staff) – Machine: the equipment involved (e.g., trucks, pavers, and compactors) – Media or environMent: the environment including physical areas and ambient conditions (e.g., taxiway B between taxiways J and N and haul routes) – Management: organization, procedures, regulations, advisory material (e.g., FAA ACs) • Column 2—Identify Hazards: Multiple hazards may be associated with the evaluated system. For example, a construction project may involve hazards such as FOD and movement of haul trucks in airfield areas. Letters may be used to identify each hazard. • Column 3—Analyze Outcomes: Each hazard listed in Column 2 may be associated with one or more outcome(s) (e.g., FOD may cause damage to aircraft if ingested by the engine, or it may cause injuries to construction workers due to jet blast). Using the hazard letter and a number will help maintain the organization of the template (e.g., Effect B2 is the second outcome associated with hazard B). Table D-11. Safety risk assessment process. (1) Describe the System (2) Identify Hazards (3) Analyze Outcomes (3a) Identify Existing Control (4) Assess Level of Risk (5) Mitigation Actions (5a) Reassess Level of Risk with Mitigation Actions in Place 5M: Mission, Man, Machine, Media/environMent, Management Hazard A Effect A1 CA11,CA12, A1 prior MA11, MA12, … A1 after Effect A2 CA21,CA22, A2 prior MA21, … A2 after Effect A3 CA31,CA32, A3 prior MA31, MA32, A3 after Hazard B Effect B1 CB11,CB12, B1 prior MB11, MB12, B1 after Effect B2 CB21,CB22, B2 prior MB21, … B2 after Hazard C Effect C1 CC11,CC12, C1 prior MC11, … C1 after Effect C2 CC21,CC22, C2 prior MC21, MC22, C2 after Effect C3 CA31,CC32, C3 prior MC31, MC32, C3 after

SRM Templates 145 • Column 3a—Identify Existing Controls: This column is used to identify existing controls. It is important to consider these controls before assessing the level of risk and developing other mitigation actions. SOP, ACs, safety plans, and regular inspections are examples of existing controls (e.g., FOD control plan for a construction project). • Column 4—Assess Level of Risk: In this column, the level of risk with the existing controls is estimated and recorded. In most cases, a risk matrix will be used to estimate the risk. Initially, the user will estimate the worst credible outcome or risk and then the likelihood of that out- come occurring. Usually, an alphanumeric code (a letter for likelihood and a number for severity) will be assigned to identify the level of risk. It is helpful to use a background color to identify if the risk is low (green), medium (yellow), or high (red). The colors allow for quick identification of higher risks. For example, if using the FAA risk matrix, a RAC 2C represents a risk of hazardous severity (2) and remote probability (C). A 2C risk level is assumed to be a High risk (Red). If colors are not used, the risk may be described as 2C-High to ensure the correct characterization. • Column 5—Mitigation Actions: Any risk classified as a high level of risk must be mitigated and cannot be accepted. Any medium risk level may be accepted, but should be controlled with mitigation actions to the degree possible, given the airport resources. Each risk may have one or more mitigation/control actions to reduce the risk to an acceptable level. An airport experiencing high frequency of FOD on the runway may reduce the risk of accidents by taking additional measures (e.g., increasing frequency of repairs and removal of the debris with sweeper trucks or planning runway rehabilitation and increasing the frequency of inspections). • Column 5a—Reassess Level of Risk with Mitigation Actions in Place: This column is similar to Column 5; however, the new control actions are considered to estimate the new level of risk when all mitigation actions are in place. An example using this template is presented in the guidebook. D-6 Hazard Tables Sound documentation of processes and procedures is vital to both the success of the SRA and the proper implementation of follow-on actions. To track the SRA process effectively, a Hazard Table was used during several SRA at Pilot Study airports. The tables capture the results from the SRA. The SRA report documents why changes and/or decisions were made (i.e., why the remaining risk may have decreased in priority from the risk assessment). The hazard tables should capture the following information: • Hazards • Outcome (NOTE: during the pilot studies, several airports used the term Risk) • Severity • Likelihood • Risk assessment (high, medium, or low) for each risk • Mitigations • Residual risk (high, medium, or low) The hazardous condition within the context of the overall system is listed first. Then the outcome of that hazardous condition is listed (note: many airports that participated in the SMS Pilot Studies and those that have developed SMS on their own used the terms “risk” or “conse- quence” instead of outcome.) An outcome is a possible occurrence resulting from the hazardous condition. Risk is the combination of severity and likelihood. Tables D-12 through D-14 present examples of Hazard tables.

146 A Guidebook for Safety Risk Management for Airports Hazard Outcome Risk Assessment Mitigation RemainingRisk 1. Pedestrians on the airfield Impact to pedestrians Severity – Minor personal injury Likelihood – Probable Medium Risk 1. The FBO provides designated walking paths. 2. The FBO escorts all pedestrians to and from GA. 3. The FBO and the XXXX maintain visual contact with all pedestrians while they are on the airfield. 4. The FBO train all staff from other airports. 5. The FBO maintains a list of between 5 and 10 employees from other airports. Only those employees are allowed to work on major event days. MEDIUM 2. 3. Table D-13. (Example) Hazard table from a non-hub airport. # Hazard Outcome Risk Assessment Mitigation(s) Remaining RiskSeverity Likelihood Result (Risk Level) 1 Men and equipment working in Taxiway N safety area 1. Aircraft and vehicle accident 2. Aircraft and pedestrian accident 1. Hazardous 2. Hazardous 1. Remote 2. Extremely Remote 1. M17 2. M16 1. Marked and lighted equipment 2. Reflective vests on all personnel in area 3. FAA ATC ground radios in vehicles and actively monitored 4. Airport Ops personnel bi hourly inspections and activelymonitoring radio traffic. 1. M16 2. M16 2 XXXX 1. 2. 1. 2. 1. 2. 1. 2. 1. 2. 1. 2. Table D-12. (Example) Hazard table from large & medium-hub airports. In Table D-12, the hazards are numbered. There can, and most likely will, be multiple effects associated with each hazardous condition. In this table each risk is tracked through the risk assessment process, mitigations are considered which may address multiple risks, and a risk reas- sessment is conducted and documented to determine the residual level of risk post mitigation. The RAC is highlighted to indicate the level of risk (in this case yellow, representing medium). In most cases, mitigations decrease the likelihood of the risk, not the severity. Severity can be reduced (e.g., wearing a helmet while riding a motorcycle). In Table D-13, the smaller airport elected to provide the same level of information as provided in Table D-12 by using fewer cells and combining the information often presented in multiple

Hazard (1) Hazard Description (2) Causes (3) System State (4) Existing Control or Requirement (5) Possible Effect (6) Severity Rationale (7) Likelihood Rationale (8) Initial/Current Risk (9) Recommended Safety Requirements (10) Predicted Residual Risk (11) 1 1 Desc. 1 1 Cause #1 Cause #2 SS 1 SS 2 EC #1 EC #2 EC #3 Eff. #1 Eff. #2 SRat. #1 SRat. #2 LRat. #1 LRat. #2 LRat. #3 4D Low RSR #1 RSR #2 RSR #3 4D – Low 1 2 Desc. 1 2 … … … … … … … … … 2 1 Desc. 2 1 … … … … … … … … … 2 2 Desc. 2 2 … … … … … … … … … 2 3 Desc. 2 3 … … … … … … … … … 3 1 Desc. 3 1 … … … … … … … … … 4 1 Desc. 4 1 … … … … … … … … … Table D-14. Hazard table from a comparative risk assessment (FAA ATO).

148 A Guidebook for Safety Risk Management for Airports cells. This airport also elected to use color coding to provide a visual cue for the reader (yellow representing a medium RAC). In Table D-14, the CRA is used by the FAA ATO in tower siting studies and SRM panels for proposed changes to the NAS. Table D-14 provides a more granular level of information than Tables D-12 and D-13. This approach can mitigate causes and system state factors, thus chang- ing the hazard condition rather than only mitigating the risks. An example of this: A hazardous condition exists on a commercial aircraft ramp at night because it is dark. By simply lighting the ramp with highmasted ramp lights, in accord with ACs, the hazardous condition has changed; the hazard probability of the possible effect of a vehicle—aircraft accident occurring has been lessened. D-7 Mitigation Tables The mitigation table serves as a means to document the mitigations for each individual hazardous condition and its associated risks. The mitigation descriptions should explain what will be done by whom and any deadlines associated with the actions. The template should include a column to record the end date (if appropriate) for any mitigation. Tables D-15 through D-18 provide examples of mitigation tables used by pilot study airports. Table D-15 is designed specifically for construction projects. Sample language is provided in the respective columns. Because Table D-15 was developed for a construction project, the users assumed the mitigation(s) will continue over the life of the project, so no end-dates are assigned. Table D-16 was used by multiple pilot study airports choosing to include a separate table in their SRM Final Reports. This sample table includes some example language that was typical for a specific airport. The Person Responsible column includes departments and organiza- tions, rather than individuals, unless the mitigation involves contract matters. With only one column provided for a proposed completion date, milestone dates were included there as well. Table D-17 comes from an overall comprehensive worksheet used to document hazards, risk assessments, and mitigation plans. Each hazardous condition is documented on an individual worksheet. The mitigation(s) are included as an individual section on the worksheet. Table D-18 was used by multiple pilot study airports choosing to include a separate table in their SRM Final Reports. This allowed the airports to use the table as a separate document, to make assignments, work orders, and planning work load for staff. D-8 Sample Final SRA Report Structure Thoroughly documenting the SRM and SRA processes is critical to the success of an airport SMS. SRM documentation provides historical data that can be used during future SRAs, holds individuals accountable for required tasks, demonstrates SMS compliance when audits are conducted, and demonstrates to airport staff and stakeholders that the SMS, SRM, and SRA processes are part of the business at the airport. The airport must have an acceptable and consistent means to document the process. The report format should represent the business practices of the airport and ensure that the nec- essary information is captured concisely. The following sections present three examples of SRM reports for reference: D-9 Medium-Hub Airport, D-10 Small-Hub Airport, and D-11 Large-Hub Airport.

Table D-15. SRM example mitigation table (construction). Haz # (1) Hazard Description (2) Effect (3) RiskMitigating Actions (4) Planning & Design (5) Contractor (6) Ops (7) ATCT (8) Other (9) 1 FOD from construction vehicles on taxiways Damage to aircraft Sweepers at construction site Establish monitoring procedures by Ops Establish notification procedures between contractor/operations/ATCT Use trained contractor escort to identify FOD and report to Ops Use trained flagmen equipped with brooms and shovels Install rumble strips at hauling route before pavement

Table D-16. SRM example mitigation table (pilot study airport). # Mitigation Person Responsible Proposed Completion Date 1. Training: controllers, airfield personnel (GSE and Ops, flight crews (chief pilots) for… XXX (airport) operations work with ATCT… Plan complete by XXX, XXXX Begin familiarization by XXX, XXXX 2. Improve communications: determine… XXX operations will address updating publications XXX operations will create diagram and advertise at FBOs XXX ATCT will assist with departure card content and provide to XXX operations All to be completed and in place by XXX, XXXX 3. Facility: install Runway guard lights… XXX planning and engineering departments will investigate… Runway guard light investigation should be concluded with a report of results by XXX, XXXX 4. System changes – Ground based radar… The XXX ATCT management will investigate the status of ground based radar for XXX. XXX operations and XXX ATCT management will form a working group to investigate if there’s any benefit to pursuing video cameras and camera analytics… Form the working group by XXX, XXXX. Provide an interim report of findings by XXX, XXXX Make a recommendation for… XXX, XXXX 5. Add a brochure to foreign air carriers… Individuals named (due to contract issues) will investigate the necessary contents of a brochure and discuss this issue with XXX property department for inclusion in LOA. Provide an interim report by XXX, XXXX

SRM Templates 151 Table D-17. SRM example mitigation table (pilot study airport). Action Plan Steps Milestone Date Responsible Person Completion Date 1. 2. 3. 4. Table D-18. SRM example mitigation table (pilot study airport). Hazard # Mitigation Person Responsible Proposed Completion Date 1 (mitigations are numbered to correspond with the hazard, risk, and mitigation table) Specific individuals are named. Includes any milestone dates. 2 3 4 D-9 Example of SRA Report from a Medium-Hub Airport Safety Risk Assessment # Topic: Represent the Issue or System Date: Presented by: Authored by: PHOTOS of Area Assessed

152 A Guidebook for Safety Risk Management for Airports Table of Contents NOTE: insert a table of contents here for the report as necessary. Introduction The introduction should include the reason (trigger) for the SRA, a brief description of what is to be assessed, and who is taking the lead or sponsoring the SRA. The introduction should also summarize the process that will be used. Because each airport may have a slightly different way of working the SRA process, here is one example: The SRA facilitation and subsequent documentation is based on the 5-Step Safety Risk Assessment process plus a 6th step for monitoring. The six steps are 1. Define the System, 2. Identify the Hazards, 3. Analyze the Risk (Effect), 4. Assess the Risk (through use of a risk matrix), 5. Treat/mitigate the Risk, 6. Mitigation and Monitoring Plan, mitigating the risk also includes a monitoring plan that assigns tasks, timelines, and responsibility for implementation and management. Background The background should include what led to the SRA. The background section should describe the actions, reference regulations, and outline how the airport is authorized to conduct the SRA (i.e., if the airport developed and implemented an SMS program and the SRM component of that program requires an SRA to be conducted). The timeline for the SMS development and implementation should be referenced. Any additional information pertinent to the SRA (e.g., any interaction between FAA ATCT and the airport staff that jointly identified this need) should be noted. Logistics The logistics should include the date, time, location, and panel members and should briefly mention responsibilities (e.g., facilitation, documentation, and results acceptance).Table D-X provides an example. SRA Panelists Parcipants Role Represenng 1 2 3 4 5 6 Table X. SRA #X participants.

SRM Templates 153 Define the System This section should follow a known approach in order to ensure the system is accurately cap- tured. This guidebook promotes the use of the “5M” model. An example of how to document it is provided: Overall System In order to focus the discussion, the panel agreed to bound the system and discussion specifi- cally to the issue that was identified . . . The system . . . The panel employed the 5-M Model as a guide to define the system. The 5-M Model is: 1. Mission 2. Management 3. Machine 4. huMan 5. environMent Following are examples of the 5-M Model: Mission 1.1.1 The airfield is intended to provide for the safe movement of aircraft on the ground and during takeoff and landing. a. One or two sentence brief statement. Management 1.1.2 FAA ATCT SOPs a. Describe what processes and procedures one of the stakeholders has that need to be accounted for. Such as FAA ATCT procedures. 1.1.3 The Airport’s Air Operations Area (AOA) Rules and Regulations a. Describe what processes and procedures one of the stakeholders has that need to be accounted for. Such as the Airport’s procedures. Machine 1.1.4 Aircraft a. Describe what machines need to be accounted for. Use the number of them if it is appropriate. b. Aircraft operations (example) c. Type of aircraft (example) 1.1.5 Airport Maintenance and Operations Vehicles a. Vehicles (example) 1.1.6 FAA Vehicles a. Vehicles: airport snow removal, fuelers, FAA tech ops (examples). 1.1.7 Runways and Taxiways a. Runway XXX huMan 1.1.8 Airport Operations and Maintenance Personnel a. Operations Managers b. Break it down if needed

154 A Guidebook for Safety Risk Management for Airports 1.1.9 Pilots a. Airlines (example) 1.1.10 FAA a. ATCT personnel (example) b. Tech ops personnel (example) EnvironMent 1.1.11 Weather a. Note if the condition being assessed is contingent upon the weather 1.1.12 Time of Day 1.1.13 Time of Year 1.1.14 Other a. Terminal area (example) b. Parking garage (example) c. Public roads (example) Identify the Hazards The hazard identification process is essential to the overall SRA. This section should describe the method used to identify the hazards and whether hazards are a result of a proposed change or already exist in the system. This section should also explain any limitations or boundaries the panel members chose to use. An example follows: The Panel considered the information documented from the system description and focused on the area of 1. Aircraft movement on the commercial ramp on the south side of Concourse A. Refer to where the hazards are being captured (documented): Table XX provides the hazards, risks, risks assessment, mitigations, and risk analysis results. Risk Analysis and Assessment This section should briefly describe what tool(s) were used to identify and quantify the risk associated with the hazardous condition and should reference where and how they are docu- mented. An example follows: The Panel used Table X to guide and track the discussion through the risk assessment portion of the SRA. The Consulting Team used a projector for Table X, thus allowing the Panel members to track the process and discuss the language used in the documentation as the SRA progressed. The risk matrix and definitions for Severity and Probability are attached in Appendix X.

# Hazard Outcome (previously Risk) Risk Assessment Mitigation(s) Residual Risk Severity Likelihood Result (if any) 1 1. Weather, visibility, human accuracy, etc. (including erroneous information) 1. AC accident (AC to AC, AC to V) 2. Incursion 3. Deviation (Pilot or V) 4. Delay in operations 1A – Asset – Catastrophic 1B – People – Catastrophic 1C – Reputation – Major 2A – Reputation – Minor 3A – Reputation – Minor 4A – Reputation – Minor 1A – Extremely Improbable 1B – Extremely Improbable 1C – Extremely Improbable 2A Remote 3A – Extremely Remote 4A – Frequent 1A = M 1B = M 1C = M 2A = L 3A = L 4A = M 1 – Training controllers, airfield personnel (GSE vs. Operations), flight crews (chief pilots) for accuracy of location reporting could include discussion with station manager’s level of awareness training. Situational awareness to be emphasized. Training focus on staff that are based at XXX. D – Improved communications, add information to Airport Facility Directory; no ground radar available, add to Jeppesen chart notes, airport 5010 form, in publications (in general) for safety notes. Advertise at FBOs. Issue airport diagram for all pilots. Automatic terminal information system (ATIS). Include the communication in special event cards, i.e. knee board cards/departure cards add information on the specific area’s challenges. D – Facility – install in pavement runway guard lights. This mitigation requires further investigation. Future planning consideration for expansion of the Northeast side of airfield. 4 – System changes – Ground based radar, video cameras, camera analytics. 5 – Existing mitigations – standalone FLM/CIC, heightened awareness, team work emphasis, currently developing scenarios for tower simulator, controller training without visual aids (back turned). Emphasis in On the Job Training (OJT). Training program addresses the lack of visual aids and physical limitations without electronic system support. Included in the Indoctrination checklist. 1ª = M 1B = M 1C = M 2ª = L 3ª = L 4ª = L Table X. Hazards, outcome (previously risks), risk assessment, mitigations, and residual risk table (example from a SMS pilot study airport).

156 A Guidebook for Safety Risk Management for Airports Mitigation Plan The mitigation action plan identifies the item to be investigated and/or deployed; the responsi- ble party for implementing the investigation, documentation, reporting; and the completion date. Table X. Mitigation plan (example from a SMS pilot study airport). # Mitigation Person Responsible Proposed Completion Date 1. 1 – Training: controllers, airfield personnel (GSE and Ops, flight crews (chief pilots) for accuracy of location reporting could include discussion with station managers’ level of awareness training. Situational awareness training focus on staff who are based at XXX XXX operations work with ATCT management to provide a briefing for those personnel. Plan complete by April 1, 2012 Begin familiarization by May 1, 2012 2. 3. 4. 5. SRA Accepting Authority This section documents who is accepting the results of the SRA. By accepting, they are accept- ing the levels of risk identified and the mitigation plan. Responsible Person Accepting Residual Risk SRA Document Preparer Signature: Signature: Title: Title: Date: Date: Signature: Title: Date:

SRM Templates 157 Example Appendix A—Airport Diagram

158 A Guidebook for Safety Risk Management for Airports Example Appendix B—Photos (Document the condition)

SRM Templates 159 XXX Definitions for severity and likelihood. Likelihood: Frequently Occurs once every month or 5,600 commercial operaons or 336,000 enplanements Probable Occurs once every year or 68,000 commercial operaons or 4,000,000 enplanements Remote Occurs once every 5 years or 340,000 commercial operaons or 20,000,000 enplanements Extremely Remote Occurs once every 10 years or 680,000 commercial operaons or 40,000,000 enplanements Extremely Improbable Occurs once every 20 years or over 1,360,000 commercial operaons or 80,000,000 enplanements Severity: People Assets Environmental Reputaon Catastrophic Fatality+ Loss of an aircra/or over $1,000,000 dollars in damage/or loss of crical system(s) for an extended period of me A spill or release that is not contained and results in long term damage to the environment and fines to the airport. An event or a series of events resulng in the community NOT using XXX for an extended period of me. Hazardous Severe Injury, requiring hospitalizaon Damage to an aircra taking it out of service for an extended period of me/or damage in excess of $500,000/or disrupon of crical services for extended period of me A reportable spill or release that requires migaon. An event or a series of events resulng in the community lessening the use of XXX causing negave (annual) financial or operaonal impacts. Major Minor Injury requiring medical treatment Damage to an aircra that is reparable/or damage to equipment or facility that is reparable within a short period of me. A reportable spill or release that is contained. An event or a series of events resulng in the community lessening the use of XXX for a short period of me. Minor Minor injury not requiring medical treatment Minor damage to an aircra, equipment, or facility not requiring it to be taken out of service A spill or release that does not require a report. An event or a series of events resulng in the community quesoning the reliability of XXX. No Safety Risk No injury No Damage No Impact No Impact Example Appendix C—Draft Definitions of Severity and Likelihood, and Risk Matrix

160 A Guidebook for Safety Risk Management for Airports Figure X. Risk matrix. Severity No Safety Risk Minor Major Hazardous Catastrophic Likelihood Frequently L5 M13 H20 H22 H25 Probable L4 M12 M15 H21 H24 Remote L3 L8 M14 M17 H23 Extremely Remote L2 L7 L10 M16 M19 Extremely Improbable L1 L6 L9 L11 M18 Low Medium High No Action Required Monitor, Determine if Risk can beMitigated to a Low Risk Must beMitigated to a Medium Risk Example Risk Matrix D-10 Example of SRA Report for Small Hub Airport 1. Background The XXX airport staff tows aircraft to and from a hangar and relocates aircraft following arrival to ramp parking positions. Some aircraft are towed on the aircraft movement area which raised addi- tional concerns in the review of the processes and procedures. In addition, the YYY Flight School operates and maintains over 50 aircraft ranging from single engine trainers to twin engine aircraft. The Flight School operates several hangars and tows aircraft across ramps and on a nearby taxiway or in close presence to the taxiway. At times the tow routes cross the air carrier operations ramp or in close proximity to it. Minor incidents/accidents have occurred in the past usually resulting in minor damage to the aircraft in tow. A few incidents have resulted in the XXX airport insurance premiums being increased. Causal factors vary from weather related events, training, equipment issues, situational awareness and standard procedures. This SRA report summarizes the safety risk management process conducted at XXX and presents the process, findings and recommendations. 2. SRA Panel The SRA process was conducted in two steps. A preliminary safety assessment meeting with representatives from XXX airport management, Operations and FBO operations was step one. Step two was the formal conduct of the SRA and convening of a panel. Before the SRA process

SRM Templates 161 was carried out, towing procedures and each step of aircraft towing and phases were discussed to identify activities. This preliminary step assisted in facilitating the identification of hazards asso- ciated with each step and activity. Following the initial meeting, the SRA panel proceeded with additional analysis and prepared a draft report for review by the participants of the panel. List of Participants: Name and affiliation of seven participants 3. References • FAA AC 150/5200-37, Introduction to Safety Management Systems for Airport Operators • FAA Order 5200.11, FAA Airports (ARP) Safety Management System • XXX Safety Management System Manual (2008) • ACRP Report 1—Safety Management Systems for Airports—Volume 2: Guidebook 4. Safety Risk Management (SRM) Process SRM Process The risk assessment process conducted for this SRA was that presented in FAA AC 150/5200-37 and incorporated to XXX SMS Manual. The process consists of five steps, as follows: Step 1—Describe the system The first step in performing SRM is to describe the system under consideration. The system description includes the functions, general physical characteristics and resources, and opera- tions of the system. Step 2—Identify hazards Hazard identification is the act of identifying any condition with the potential of causing injury to personnel, damage to equipment or structures, loss of material, or reduction of the ability to perform a prescribed function. Step 3—Determine the possible effect This step is to identify the possible effect associated with each hazard listed in the previous phase. One hazard may have one or more risks associated with it. Step 4—Assess and analyze the risk Risk assessment is the process which associates “hazards” with “risks.” The process involves both estimating and classifying risks. The simplest way to estimate the risk associated with a specific hazard is to ask the following two questions: • What possible harm could the hazard present (the risks)? • How likely is it that harm could occur (the likelihood)? After estimating the risks and the likelihood, this information is used to classify risk according to XXX Risk Matrix, which follows that presented by the FAA in Order 5200.11. Risk classifica- tion is necessary to identify how serious is the risk and to define the priorities to treat these risks. Step 5—Treat and monitor risk Risk treatment alternatives should address the risk probability, the risk severity, or both. More detailed information on these steps is described in ensuing sections of this report. 5. Description of the System The system includes the phases, steps, location and activities involved with towing aircraft, the XXX airport FBO staff and Flight School for activities, related XXX Aircraft Tow Procedures

162 A Guidebook for Safety Risk Management for Airports (see Attachments A and B). These include escorting, coordination, training and SOPs activities performed by XXX staff and the Flight School staff. Towing operations usually take place in the ramp area and inside the hangars of XXX airport. 6. Activities, Major Hazards and Risks Assessment The table below presents a summary of major hazards, associated effect and risk levels assessed. In addition, the table contains the basic control actions to mitigate the risk levels assessed prior to the control measures. The current risk levels were arrived at after assessing the risks for their associated severity and probability. The treated risk levels were arrived at after mitigation actions were taken into consideration. Medium and low-risk levels are presented in the table; no high-level risks were identified by XXX staff: Activity Hazards Effect (previously Risk) Current Risk Level Treated Risk Control Actions Work order verbal or written containing aircraft data, location and planned tow route Errors in work order Damage to aircraft, injury to persons, damage to facilities and equipment Low Low Recheck tow order data before initiating tow actions Assign tow crew Inexperienced operator Fatigue Training Awareness Damage to aircraft and injury to persons, damage to facilities, and equipment Medium Low Provide training Promote awareness Assign tow crew Insufficient crew staff Sense of urgency/pressure Damage to aircraft, facilities and equipment, and injury to persons Medium Low Mandate at least 2 crew staff to each aircraft tow by SOPs Select tow equipment Equipment maintenance Obstructed visibility Improper tow bar Damage to aircraft Injury to persons Low Low Mark towing safety rules on tug Add to SOP’s, clean windshield of tug Mark tow bars with list of aircraft that can be towed Select tow equipment Obstructed visibility Injury to persons Medium Low Improve awareness Place safety/operating checklist in tugs Position tug and hook up Careless driving Approach aircraft too fast Damage to aircraft, injury to persons, damage to facilities Medium Low Promote awareness Review SOP Tow aircraft Driving careless Damage to aircraft and facilities, injury to persons Medium Low Review SOP and training Turn limits exceeded Damage to aircraft and facilities, injury to persons Low Low Review SOPs, clearances on ramp, no wing overlaps

SRM Templates 163 7. Summary of Risk Mitigation Actions This section includes a list of safety issues for this particular safety risk assessment that should be addressed by the XXX staff and Flight School. The list of mitigation actions under the respon- sibility of the XXX staff shall be addressed in the XXX Aircraft Tow Procedures and the Flight School Safety Manual. XXX List of Risk Control Actions • Review SOP for towing aircraft – Mandate at least two persons to towing of large aircraft, recommend two persons always for all towing – Evaluate fatigue conditions of crew due to weather events/other – Address specific daily safety issues (hazardous situations, construction, etc.) – Confirmation of aircraft tow work order information – Develop incident reports to include causal factors – Review procedures, training, recurrent training – Tow route inspection prior to tow operations to check for obstacles and improve situational awareness – Explore development of standard tow routes for approach to and behind aircraft parking/ tie-down spots, other factors – Reading/completing a checklist for towing safety rules posted in tug prior to each tow operation • Plan to provide basic safety training to workers addressing: – Awareness promotion – Equipment inspections – Obstructed visibility – Escorting (for vehicle drivers) – Communication and coordination with tow crews – Driving and working in the AOA – Obstruction clearance • Review SOP to include hangar ingress/egress of aircraft – Signage, markings and lighting – Wing-walker procedures – Communication and coordination procedures – Reflective materials use as required Maneuver aircraft in/out of hangar Hangar doors not fully open Damage to aircraft and facilities, injury to persons Medium Low Already addressed by XXX, use reflective materials on hangar doors and include recheck in SOP Multiple command orders Damage to aircraft and facilities, injury to persons Low Low Training and recurrent training Lack of conspicuity of obstacles Damage to aircraft and facilities, injury to persons Medium Low Training and recurrent training. SOPs Promote awareness Park and secure Lack of visible Damage to aircraft and Medium Low Implement centerline aircraft centerline marking facilities, injury to persons markings outside hangar Activity Hazards Effect (previously Risk) Current Risk Level Treated Risk Control Actions

164 A Guidebook for Safety Risk Management for Airports XXX FBO List of Risk Control Actions • Comprehensive review of aircraft tow safety procedures prepared by XXX • Coordination with ATC, Contractors, airlines, Tenants and XXX FBO services escorting, ingress and egress procedures, airfield closures, marking and lighting, emergency routes • Ensure coordination with ATC to identify aircraft towing/relocation in close proximity to taxiway boundaries for each tow operation • Ensure availability of effective communication measures • Ensure XXX SOPs are followed • Ensure tow crew is briefed and has clear instructions on tow route and steps • Identify areas of jet blast potential tow route • Ensure vehicles are properly marked/lighted inside the AOA 8. Attachments • XXX Towing Procedures • XXX FBO Towing Procedures • Pictures of Accidents D-11 Example of SRA Report for Large Airport TABLE OF CONTENTS 1. Introduction 1.1 Background 1.2 Scope 2. Methodology 2.1 General 2.2 Workshop Participants 2.3 Bound the Discussion 2.4 Identify the Hazards 2.5 Determine the Risk 2.6 Assess and Analyze the Risk 2.7 Treat the Risk 3. Description of the System 3.1 Systems Characteristics 3.2 Safety-Significant Activities 3.3 Dependencies 4. Results 4.1 Hazards, Risks and Risk Values 4.2 Mitigating Actions 5. Conclusions 5.1 Main Hazards 5.2 Risk Categories 5.3 Mitigation Actions 5.4 Risk Value 6. Recommendations 6.1 Further Mitigating Actions 6.2 Monitoring

SRM Templates 165 LIST OF FIGURES Figure 1: Brainstorming Tool Figure 2: Risk Matrix Figure 3: XXX AOA and Deicing Pads Figure 4: Risk Reduction LIST OF TABLES Table 1: SRA Panel Participants Table 2: Likelihood Classification Criteria Table 3: Severity Classification Criteria Table 4: Safety-Significant Activities Table 5: Safety-Significant Activities—Anchor Elements Table 6: Hazards, Risks and Risk Values Introduction Background The Federal Aviation Administration (FAA) is conducting a Part 139 Safety Management System (SMS) Implementation Study. This study serves as a continuation of the Airport SMS Pilot Studies. The intent of the current implementation study is to examine how airports can implement the SMS pillars of safety risk management (SRM) and Safety Assurance throughout their airfield environment including the aircraft movement and non-movement areas. The study will also evaluate the validity of SMS documentation developed during the first pilot studies. Scope This report outlines the conduct of a safety risk assessment (SRA) that is part of the FAA Pilot Study on SMS. The focus areas for this SRA are Winter Weather Operations and this risk assess- ment was conducted to address only hazards in the aircraft movement and non-movement areas of the airport as applicable. Methodology General The approach followed for the execution of the risk assessment is in line with the phases of SRM described in the FAA Advisory Circular: AC 150/5200-37—Introduction to Safety Manage- ment Systems for Airport Operators, namely: 1. Describe the System 2. Identify the Hazards 3. Determine the Risk 4. Assess and Analyze the Risk 5. Treat the Risk (i.e. mitigate, monitor and track) The execution of these phases was achieved by conducting some facilitated workshops held at XXX. Participants in these workshops are provided in the following section.

166 A Guidebook for Safety Risk Management for Airports Name Position Organization Name1 Facilitator Org1 Name 2 SME Org1 Name 3 Facilitation Assistant Org2 Name 4 XXX Operations Name 5 XXX Operations Name 6 XXX Engineering Name 9 FAA FAA airports Name 10 FAA XXX ATC Name 7 Airline 1 Operations Name 8 Airline 2 Safety … … … Table x. Panel participants. Workshop Participants The individuals indicated in the table represented XXX Airport and other airport stake- holders and provided SMEs support with respect to the risk assessment focus areas and SRA facilitation. During the workshops, members of the facilitation team guided the XXX stakeholders through the SRM process described below and documented the SRA. Bound the Discussion This phase began with a documentation review by the facilitation team. This was done such that the facilitation team became familiar with XXX operations as they relate to the risk assess- ment focus area. Once on site, the facilitation team asked XXX stakeholders to describe the system associated with the risk assessment focus area in terms of their: • Physical Characteristics – e.g.: the physical layout and/or contents of the system (e.g. dimensions, proximity to roads, taxiways or runways, structures, etc.) • Functional Characteristics – e.g.: what is the system used for and who are the users • Environment – e.g.: under which conditions are the activities within the system taking place (weather, operational environment, behavioral stressors) These system characteristics allowed the facilitation team and XXX stakeholders to have a common mental picture of the systems associated with the risk assessment focus area. Based on this information, XXX stakeholders were then able to define the specific activities that take place within the system. These activities are the safety-significant activities.

SRM Templates 167 Identify the Hazards Once XXX stakeholders had described the system, they were asked “what could go wrong?” while performing each of the functions within the different safety-significant activity. Through the conduct of this exercise, XXX stakeholders considered both the system physical and func- tional characteristics as well as the environment under which they are performed. This part of the exercise was guided through the use of anchor elements. The anchor elements used were: • People • Equipment • Materials • Environment • Procedures For each of these elements the attributes specific to the system in question were used as a guide (e.g. type of equipment used, personnel in the area, etc.). Based on these “what could go wrong?” scenarios, the facilitation team and XXX stake holders were able to identify the conditions or situations that could create adverse safety risks to the airport (i.e. hazard). A brainstorming tool developed by the facilitation team was used to facilitate the identifica- tion of hazards. This tool is provided below. Figure X. Brainstorming tool.

168 A Guidebook for Safety Risk Management for Airports Table X. Probability classification criteria. FAA National Policy, Order 5200.11 Qualitative Frequent A Expected to occur more than once per week or every 2,500 departures, whichever occurs sooner Expected to occur frequently for an item Probable B Expected to occur about once every month or 250,000 departures, whichever occurs sooner Expected to occur several times in the life of an item Remote C Expected to occur about once every year or 2.5 million departures, whichever occurs sooner Expected to occur sometime in the life cycle of an item Extremely Remote D Expected to occur about once every 10 100 years or 25 million departures, whichever occurs sooner Unlikely but possible to occur in an item’s life cycle Extremely Improbable E Expected to occur less than every 100 years So unlikely, it can be assumed that it will notoccur in an item’s life cycle Determine the Effect (previously Risk) For each of the hazards identified for each “what could go wrong?” scenario, XXX stakeholders were encouraged to identify the worst reasonable or credible outcome(s) that can occur within the operational lifetime of the system (i.e. effect) for each hazard. Hazards and risks were documented by the facilitation team to be assessed for severity and probability to determine risk values. Assess and Analyze the Risk For each risk determined in the previous phase, XXX stakeholders defined the severity of the stated risk, and then determined the likelihood or probability that each occurrence will take place. The assigned values were based on the classification criteria given below, which are based on the FAA National Policy, Order 5200.11—FAA Airports (ARP) Safety Management System. It should be noted that the facilitation team also included qualitative classification criteria for likelihood to assist XXX stakeholders during this phase.

SRM Templates 169 Following the assignment of likelihood and severity values, each risk was assigned a value based on the risk matrix given in FAA National Policy, Order 5200.11—FAA Airports (ARP) Safety Management System. *Unacceptable with Single Point and/or Common Cause Failures Figure X. Risk matrix. Treat the Risk Upon completion of the assignment of risk values, XXX stakeholders were able to assign miti- gation actions based on the following criteria: • High Risk (Red) – Unacceptable, mitigating actions required Table X. Severity classification criteria. Minimal 5 Minor 4 Major 3 Hazardous 2 Catastrophic 1 No damage to aircraft but minimal injury or discomfort of little risk to passenger(s) /workers Minimal damage to aircraft; or Minimal injury to passengers; or Minimal unplanned airport operations limitations (i.e. taxiway closure); or Minor incident involving the use of airport emergency procedures Major damage to aircraft and/or injury to passenger(s)/ worker(s); or Major unplanned disruption to airport operations; or Serious incident; or Deduction on the airport’s ability to deal with adverse conditions Severe damage to aircraft and/or serious injury to passenger(s)/ worker(s); or Complete unplanned airport closure; or Major unplanned operations limitations (i.e. runway closure); or Major airport damage to equipment and facilities Complete loss of aircraft and/or facilities or fatal injury to passenger(s) /worker(s); or Complete unplanned airport closure and destruction of critical facilities; or Airport facilities and equipment destroyed

170 A Guidebook for Safety Risk Management for Airports • Medium Risk (Yellow) – Medium Risk can be classified in the following three (3) ways: � Unacceptable due to the absence of risk control, mitigating actions required; � Unacceptable in the presence of existing risk control, mitigating actions required; or � Acceptable in the presence of existing risk controls. • Low Risk (Green) – Acceptable Therefore, following these criteria, XXX stakeholders suggested mitigating actions for all high-risk values as well as any medium risk values that were deemed to warrant them. Following the assignment of mitigating actions, XXX stakeholders derived new values of severity and likelihood for the risk with these mitigating actions in place following the process described in previous sections. These revised risk values were then evaluated for the assignment of mitigating actions following the process described above. If a revised risk value was deemed by XXX stakeholders as requiring further mitigation, actions would be assigned with the risk value being revised once more. XXX stakeholders would repeat this process as long as the risk value was determined to be unacceptable. In certain cases, XXX stakeholders suggested further actions for risks that were deemed accept- able. These suggestions were documented by the facilitation team and included in the final report for completeness. However, these suggestions were not subject to a further derivation of risk value and should be considered actions to be taken as part of continuous improvement efforts. Description of the System Systems Characteristics The system involved with the analysis of winter weather operations at XXX involves several areas, facilities, equipment and activities that take place within the XXX AOA. Physical Description Both XXX aircraft movement and non-movement areas are affected by winter weather opera- tions. It may involve any runway(s), taxiway(s) and ramp(s) where aircraft can be de-iced and where airfield areas require to be cleaned or treated for winter surface contaminants (e.g. snow, ice, slush). The following are the main categories associated with winter weather operations at XXX: • Airfield operational areas • Snow removal and deicing equipment staging areas • Storage of surface treatment material Figure X. XXX AOA and deicing pads.

SRM Templates 171 Functional Description There are several activities that are associated with winter weather operations at XXX, includ- ing the following categories: • Aircraft inspection and deicing operations • Snow and ice removal • Treatment of airfield areas contaminated with ice/snow • Airfield condition assessment • . . . These functions are managed and performed by specific groups of XXX staff and stakeholders, including the following: • Snow and Ice Control Committee (XXX staff, tenants, and FAA ATC collaboration) convened at the beginning of winter weather season in October then whenever a winter weather emer- gency is declared for XXX Airport with continuing communications as needed • XXX Operations Department – Airfield Operations – SMS Coordinator – AOC • Asset Management • . . . Environment Operational During winter weather operations several organizations and XXX staff will be performing duties in the AOA specifically related to winter weather operations and will be transiting with various vehicles and equipment. During special inspections and aircraft deicing operations there will be personnel on foot performing activities in certain areas where aircraft and vehicles may also be present. Weather Low temperatures and frozen precipitation are likely conditions during operations with winter weather conditions. The airport area is susceptible to snow and icing conditions, typically from November through March. Wind The prevailing winds at XXX are from the south and they average 5 to 10 mph. However, quadrant changes and gusts of 50 mph and above are not uncommon. Snow Accumulation with an annual average of 43 inches. Ice From October to April it can be expected that temperatures fall below 32°F and ice is encountered. Behavioral Influences The following key stressors, which could negatively influence human performance, are pos- sible within the environment of the working area: Psychological Stressors Restricted operations under hazardous conditions for aircraft, vehicles and people create an environment prone to many psychological stressors.

172 A Guidebook for Safety Risk Management for Airports Physical Stressors Very low temperatures, frozen contaminants, deicing fluids and poor visibility will also influ- ence the working environment. Physiological Stressors Early shifts, night shifts, weekend shifts, changing working hours, long working hours, very intensive work conditions. Safety-Significant Activities Once a description of the system to be assessed was achieved, the hazard identification process was started. As described in the methodology section earlier, the hazards are identi- fied from safety-significant activities, which are derived by the SMEs from the system char- acteristics above. In this analysis, the SMEs were participants of the workshops held at XXX airport. The following list is the summary of the key safety-significant activities identified by the SMEs: Table X. Safety-significant activities. SAFETY SIGNIFICANT ACTIVITIES – XXX SRAWinter Weather Ops Mobilization of essential personnel Aircraft deicing Airfield anti icing, deicing or sanding operations Aircraft towing Aircraft taxi Aircraft marshalling Passenger boarding bridge operation Passenger handling … Snow and ice removal and control Management of ASDE X situational displays Staff training Driving on the AOA Operation of equipment on the AOA Snow removal Emergency response Aircraft incident response … Dependencies During the brainstorming sessions, participants were reminded of the following anchor elements: Table X. Safety-significant activities— anchor elements. SAFETY SIGNIFICANT ACTIVITIES ANCHOR ELEMENTS PERSONNEL EQUIPMENT MATERIALS ENVIRONMENT PROCEDURES Based on these anchor elements, participants were able to generate some system dependen- cies to consider during the hazard identification process. A sample of some of the dependencies identified can be found in the sections below.

SRM Templates 173 Personnel Presence of • XXX staff that is unfamiliar with the Aircraft Movement Area (AMA) and FAA ATC coordination • Airline personnel operating deicing equipment that has limited experience working in the AOA • . . . Types of personnel in the area: • Airline staff • XXX Asset Management staff (snow/ice removal) • XXX ARFF staff • XXX Airfield Operations staff • Others Equipment Aircraft • Propeller/Turbine • Low profile turbine • Others Vehicles/Equipment • Aircraft deicing equipment • Snow/ice removal and control equipment • Airfield operations vehicles • Others Operational • Push/tow tractors • Baggage tractors • Others Service vehicles • Fuel trucks • Catering trucks • Maintenance vehicles • Others Service Equipment • Baggage carts • Cargo dollies • ULDs • Others Other • Radios • Telecommunications equipment • Others

174 A Guidebook for Safety Risk Management for Airports Procedures • Procedures associated with the safety-significant activities Materials • Snow and ice • Water • Type I deicing fluid • Type II deicing fluid • Type IV deicing fluid • Sand • Others Environment • Open Area • Snow • Ice • Wind Results Hazards, Risks and Risk Values The following is a summary of the Hazards, Effect (previously Risks), Risk Severities (S) and Probabilities (P) and Risk Values (V) identified during the workshops. Risk Values are given as High (H) in red; Medium (M) in yellow; and Low (L) in green. These risk levels are associated with the risk matrix presented in XXX SMS Manual. The list is sorted in descending order from the highest to the lowest risk value. # Hazard Outcome (previously Risk) P S R 1. Inaccurate runway assessment measurements Takeoff and landing overruns under hazardous conditions leading to runway excursions and aircraft damage/passenger injury D 1 H 2. Runway snow removal covering only central portion of runway width Lateral deviations during landing and takeoff and snow windrows causing asymmetric drag on landing gears and potential lateral runway excursions C 2 H 3. … … … … H 4. Air crew unfamiliarity with deicing pad layout/operations Aircraft to aircraft or deicing equipment collision E 1 M 5. Miscommunication during emergency call due to equipment failure Delay in response to an emergency resulting in personnel or passenger fatality E 1 M 6. … … … … M 7. Non standardized training program Shortcomings on the delivery of existing training leading to equipment failure and damage or personnel injury E 2 L 8. Improper training for winter operation equipment Equipment damage/personnel injury D 3 L 9. ... … … … L Table X. Hazards, outcome and risk values.

SRM Templates 175 Mitigating Actions Once the risk values were determined, a second evaluation took place in light of the mitigating actions associated with the winter weather operations at XXX and other actions XXX will put in place to control the identified risks. The following table provides a summary of the information derived for each hazard, associ- ated risk and mitigating actions used to reduce the risk value. The information is presented in the following format: # Hazard Identified Hazard Effect Possible Effect associated with the Identified Hazard Risk Value This section provides the severity, probability and value of the Identified Risk. The field is colored to reflect the color scheme set up in the matrix used for this exercise. Mitigating actions This section identifies the Policies, Programs and other measures that XXX already has in place that contribute to the control of the Risk identified. Residual Risk Value This section provides the severity, probability and value of the Identified Risk revised in light of the mitigating actions. The field is colored to reflect the color scheme set up in the matrix used for this exercise. Recommended further mitigating actions This section provides, when applicable, further actions that could be implemented by XXX to further control the risk and reduced its value. Considerations In some instances, despite the existence of mitigating actions, the risk value presented remains unchanged. This is because the granularity of the matrix suggested by the FAA does not allow for capturing differences within each bracket. For example, if the probability of an identified risk is that it may be expected to occur every 10 years, as per the matrix a probability “D” would be assigned. If mitigating actions implemented are deemed to reduce this probability to occur every 90 years, as per the matrix a value of “D” would remain, even though the probability has been reduced ninefold. 1 Hazard Inaccurate runway assessment measurements Effect Takeoff and landing overruns under hazardous conditions leading to runway excursions and aircraft damage/passenger injury Risk Value 1 D HIGH Mitigating actions XXX training program PIREPS Snow & Ice Committee meetings Airlines internal training program Restrict ops after 3 consecutive PIREPs of poor runway friction conditions Revised Risk Value 1 E MEDIUM Recommended further mitigating actions 2 Hazard Runway snow removal covering only central portion of runway width Effect Lateral deviations during landing and takeoff and snow windrows causing asymmetric drag on landing gears and potential lateral runway excursions Risk Value 1 D HIGH Mitigating actions PIREPS Special inspections Airlines internal training program Snow & Ice Committee meetings Revised Risk Value 1 E MEDIUM Recommended further mitigating actions Increase snow removal capability to reduce probability of partial snow removal

176 A Guidebook for Safety Risk Management for Airports Conclusions Main Hazards The key hazards identified in this analysis as a result of winter weather conditions at XXX can be summarized as follows: 1. Potential runway excursions as result of the following hazards: a. Low runway surface friction due to snow/ice accumulated due to partial snow/ice removal or severe weather conditions surpassing XXX capability to remove winter contaminants b. Inaccurate reporting of runway surface conditions c. Inaccurate assessment of runway conditions d. Partial removal of winter contaminants leaving snow banks, drifts or windrows leading to differential drag of landing gear during aircraft operations 2. Loss of situational awareness due to working conditions a. Pressure to maintain operational capacity b. Exposure to low temperatures, winter precipitation, high noise and possible low visibility and/or night conditions c. Need to coordinate with operators of snow/ice control equipment d. Fast paced and changing work environment e. Non-routine working conditions f. Obscured markings and lights making it harder to get oriented in the airfield g. Increased communication traffic h. High density of personnel, equipment and aircraft in operational areas (e.g. de-ice pads) 4 Hazard Air crew unfamiliarity with deicing pad layout/operations Effect Aircraft to aircraft collision Risk Value 1 E MEDIUM Mitigating actions XXX Winter Weather OperationsManual Airlines internal training programs XXX Non Movement Area FamiliarizationManual Revised Risk Value 1 E MEDIUM Recommended further mitigating actions 5 Hazard Miscommunication during emergency call due to equipment failure Effect Delay in response to an emergency resulting in personnel or passenger fatality Risk Value 1 E MEDIUM Mitigating actions Assetmanagement maintenance program Assetmanagement QA program Use of backup communication equipment (mobile phones) Revised Risk Value 2 E LOW Recommended further mitigating actions Establish need to usemobile phone for backup 7 Hazard Non standardized training program Effect Shortcomings on the delivery of existing training leading to equipment failure and damage or personnel injury Risk Value 3 D LOW Mitigating actions XXX departmental OJT Snow & Ice Committee meetings Revised Risk Value 3 D LOW Recommended further mitigating actions Develop standardized training program for winter weather operation conditions 8 Hazard Improper training for winter operation equipment Effect Equipment damage/personnel injury Risk Value 3 D LOW Mitigating actions XXX departmental OJT XXX Winter Weather OperationsManual Revised Risk Value 3 D LOW Recommended further mitigating actions Develop standardized training program (Curriculum, refreshers, etc.)

SRM Templates 177 3. Limited airport capacity leading to: a. Traffic delays and pressure to maintain operational areas open b. Pressure to maintain aircraft deicing capacity 4. Non-routine operational conditions a. Few winter weather events per year restrict staff from gaining more experience b. Limited airport capability to handle very severe and unique winter weather conditions c. Limited capability to provide standardized winter weather conditions training to personnel d. Pilots unfamiliar with deicing pad layout/operations Effect Categories The major effects categories associated with winter weather operations at XXX can be sum- marized as follows: 1. Runway excursion accidents (overruns and veer-offs) due to poor runway surface friction conditions or asymmetric braking and drag 2. Runway incursion accidents due to loss of situational awareness 3. Aircraft/vehicle/equipment/personnel collisions due to loss of situational awareness under winter weather conditions and limited experience of staff working under such conditions 4. . . . Mitigation Actions A series of mitigating actions have been identified to control risks associated with winter weather operations at XXX. The key actions as they refer to the summary risks described above are: Risk #1: Runway overruns and veer offs due to poor runway fricon condions resulng from winter weather contaminants and leading to major accidents Migaon Acons XXX Winter Weather Operaons Manual Snow & Ice Commiee meengs XXX Movement Area Familiarizaon Manual XXX Policy Radio Standards AO.006.00 XXX Policy Runway Crossing by Authorized Ground Vehicles … Risk #2: Runway incursion accidents due to loss of situaonal awareness Migaon Acons XXX Winter Weather Operaons Manual Snow & Ice Commiee meengs XXX Movement Area Familiarizaon Manual XXX Surface Movement Guidance and Control System Plan … Risk #3: Aircra/vehicle/equipment/personnel collisions due to loss of situaonal awareness under winter weather condions and limited experience of staff working under such condions Migaon Acons XXX Winter Weather Operaons Manual Snow & Ice Commiee meengs XXX Movement Area Familiarizaon Manual XXX Surface Movement Guidance and Control System Plan XXX Policy Authorized Ground Vehicle Access to AMA safety area … Risk #4: … …

178 A Guidebook for Safety Risk Management for Airports Risk Value As result of applying the identified mitigating actions, and their effect on the risk values, the following conclusions can be drawn: 1. There are no “unacceptable” (HIGH) risks 2. The overall risks associated with XXX winter weather operations can be effectively mitigated using procedural measures developed by XXX and the airlines 3. Additional measures targeting specific risks can further reduce the probability and/or severity of airside accidents during winter weather conditions. These measures are recommended in the ensuing section of this report 4. Figure X summarizes the potential risk levels with and without mitigation actions adopted. Significant improvements to safety associated with winter weather conditions at XXX can be achieved with the actions presented in this SRA. Figure X. Risk reduction. Low 47 Medium 21 High, 21 Low 59 Medium 30 High, 0 0.0% 20.0% 40.0% 60.0% 80.0% 100.0% Original With Mitigation Actions Recommendations Further Mitigating Actions Many risk mitigating actions and procedures listed in previous sections were already imple- mented by XXX. This section describes additional measures to further reduce risk levels when winter weather conditions arise. 1. Upgrade snow removal equipment to increase XXX capacity 2. Retrofit radios to accommodate headsets plugs 3. Develop standardized training program for winter weather operations and provide refresher training during the fall 4. . . . Monitoring It is recommended that XXX ensures that the actions are implemented and monitored for effectiveness over an appropriate period. If monitoring reveals that any action is not effective, new actions should be developed and implemented to maintain the identified risk at an accept- able level.

179 A P P E N D I X E Preliminary Hazard Lists (PHLs) Hazard Outcome CommonMitigations or Source Material for Mitigations Airfield Operations Haul routes crossing operational areas Collision with aircraft, vehicles, equipment and ground personnel Use “flagmen”; Escorts; Traffic control signals; Training; FAA AC for construction safety; Part 139; Construction Safety Phasing Plan (CSPP); SOP Temporary haul routes crossing rapid exit taxiways Collision between vehicles and aircraft Use “flagmen”; Escorts; Traffic control signals; Training; FAA AC for construction safety; Part 139; CSPP; SOW FOD Debris causing damage to aircraft Wheel wash stations for construction vehicles; training; use of sweepers and FOD crews; CSPP; FAA AC; Part 139 Jet blast Flying Debris into aircraft, vehicle, or workers Use “flagmen”; Escorts; Traffic control signals; Training; FAA AC for construction safety; Part 139; Construction Safety Plan (CSPP); SOP Deficient communication Runway/taxiway incursion Training; supervision; Part 139; FAA AC; CSPP; SOP Deficient coordination between maintenance shifts/workers Collision with aircraft, vehicles, equipment and ground personnel; runway/taxiway incursion, FOD, obstacles Training; supervision; SOP; Part 139; CSPP Construction Safety and Phasing Plan (CSPP) Changes to airfield operations Runway/taxiway incursion, collision, delay responding to emergencies Training; written distribution of changes and confirmation of receipt; Part 139; FAA AC; SOP; CSPP Construction worker job related processes, procedures, and tools Occupational accident Training; Part 139; FAA AC; SOP; CSPP; OSHA Regulations; supervisory monitor Airfield Construction

180 A Guidebook for Safety Risk Management for Airports Hazard Outcome Common Mitigations or Source Material for Mitigations Interaction between construction, operations, maintenance, ARFF activities Runway/taxiway incursion, collision, delay responding to emergencies SOP; training; daily shift construction safety meetings; Part 139;FAA AC; CSPP Unfamiliarity of construction workers with airfield activities Damage to NAVAIDS, runway/taxiway incursions, damage to aircraft Training; construction manager presence with workers; supervision by airport operations personnel; marked and lighted areas; Part 139; CSPP; FAA AC; SOP Unfamiliarity of construction drivers with characteristics of airfield traffic Runway/taxiway incursion, collision Training; escorts; marked and lighted areas; Part 139; CSPP; FAA AC; SOP ARFF unaware of changes to access routes Delay in emergency response SOP; Part 139; CSPP; FAA AC; Operational briefings Construction equipment breakdown Collision, interference with Part 77 surfaces Training; SOP; internal review process; CSPP; FAA AC; Part 139 Coordination and Communication Deficient coordination of construction activities with other airport activities (air traffic, ramp management, security, emergency, etc.) Runway/taxiway incursion, aircraft collision, obstacles, vehicle accident SOP; training; daily shift construction safety meetings; notification process; Part 139; CSPP; FAA AC Pilots unaware of airfield configuration changes, limitations and construction areas Runway/taxiway incursion, aircraft collision, obstacles, vehicle accident, aircraft, equipment, people, injuries SOP; NOTAMs; ATIS recordings; notification to chief pilots’ offices, FBOs; timely publication change submittals to FAA and Jeppesen chartings; Part 139; FAA AC; Air Traffic Orders Airport staff and construction workers unaware of hazardous situations Runway/taxiway incursion, aircraft collision, obstacles, vehicle accident, injuries SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP Radio failure Runway/taxiway incursion, aircraft collision, obstacles, vehicle accident, injuries SOP; training on Air Traffic Control light gun signals; use of cell phones; escorts; CSPP; FAA AC; Part 139 Emergency Response Failure to update ARFF of construction areas and temporary access routes and closures Delay in emergency response SOP; Part 139; CSPP; FAA AC; daily shift briefings ARFF unaware of deactivated water lines Delay in emergency response SOP; daily shift briefings; FAA AC; CSPP; Part 139 ARFF unaware of emergencies associated with construction activities Delay in emergency response SOP; daily shift briefings; FAA AC; CSPP; Part 139 Construction traffic crossing airfield areas Runway/taxiway incursion; Collision; Delay responding to emergencies Escorts; training; SOP; FAA AC; Part 139; CSPP Tall equipment Interference with NAVAIDS or Part 77 surfaces Training; SOP; internal review process; Part 139; FAA AC; CSPP

Preliminary Hazard Lists (PHLs) 181 Hazard Outcome CommonMitigations or Source Material for Mitigations Security Unauthorized access to airfield areas Runway/taxiway incursion, surface incidents Continuous inspections of areas as possible; guards at gates/open areas; use of radar or FLIR security and CCTV systems; CSPP; FAA AC; Airport Security Plan; TSA Part 1542 Construction traffic outside defined work area ingress/egress routes Runway/taxiway incursion, surface incidents Use of escorts; marked and lighted routes; guards at ingress/ egress points; SOP; CSPP; FAA AC; Part 139 Failure of conspicuous identification of construction workers and equipment Runway/taxiway incursion, surface incidents Use of escorts; temporary ID badges and temporary vehicle signage; Part 139; TSA Part 1542; Airport Security Plan; onsite supervisor; CSPP; FAA AC; SOP Fences and Gates Temporary opening in airfield fences or gates due to construction activities Unauthorized access to AOA, runway/taxiway incursion, surface incident, wildlife strikes Continuous inspections of areas as possible; guards at open gates/areas; TSA Part 1542; Part 139; CSPP; FAA AC; SOP Construction equipment outside designatedwork areas Runway/taxiway incursion, surface incident Training; SOP; designated marked and lighted work areas; CSPP; FAA AC; Part 139; escorts/construction managers on site Haul Routes Improper identification of temporary access routes Runway/taxiway incursion, surface incident Escorts; training; SOP; CSPP; FAA AC; Part 139 Barricades and fences blocking driver’s vision of oncoming traffic Runway/taxiway incursion, surface incident Safety inspections by airport and construction management (CM); SOP; training; escorts; Part 139; FAA AC; CSPP Low visibility conditions Runway/taxiway incursion, surface incident SOP; PART 139; Surface Movement Guidance Control System Plan(SMGCS); FAA AC; training; use of escorts; FAA AC; CSPP; Air Traffic Orders FOD generated by construction traffic FOD damage to aircraft, construction equipment, airport equipment SOP; CSPP; FAA AC; Part 139; FOD patrols; sweepers; wheel wash stations Haul routes crossing operational areas Runway/taxiway incursion, surface incident Escorts; training; SOP; FAA AC; Part 139; CSPP; FAA AC; Air Traffic Orders; routes marked and lighted Deficientmaintenance of haul routes FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols; sweepers; wheel wash stations Vehicles interfering with Part 77 surfaces Runway/taxiway incursion, surface incident Training; SOP; internal review process; CSPP; FAA AC; Part 139 Construction workers unaware of ARFF right of way Emergency response delays SOP; daily shift briefings; FAA AC; CSPP; Part 139

182 A Guidebook for Safety Risk Management for Airports Hazard Outcome CommonMitigations or Source Material for Mitigations Driving Vehicle and equipment operators who are unfamiliar with regulations pertaining to vehicle operations on the airfield Runway/taxiway incursion, collisions Training; SOP; Part 139; CSPP; escorts; speed limit signs; vehicle speed regulators; supervision monitoring FAA AC Escorting of construction equipment operators Runway/taxiway incursion, surface incident Training; SOP; Part 139; CSPP; speed limit signs; vehicle speed regulators; FAA AC Driving under low visibility conditions Runway/taxiway incursion, surface incident Training; SOP; Part 139; CSPP; FAA AC; Surface Movement Guidance Control System Plan (SMGCS); escorts Construction drivers unfamiliar with airfield activities Runway/taxiway incursion, surface incident SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP; escorts; marked and lighted work areas Operating equipment and or vehicles off of designated construction routes Runway/taxiway incursion, surface incident, FOD SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP; escorts; marked and lighted work areas and routes Backing dump trucks and other equipment Occupational accident Backup walkers/flaggers; FAA AC; CSPP; Part 139 Deficient construction equipment maintenance Runway/taxiway incursion, FOD SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP; escorts; equipment shift inspections Escorting Failure to have “positive control” of escorting procedures Runway/taxiway incursion, surface incident SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP; use of more than one escort; handout of escort route map on airfield and briefing of vehicles being escorted Low visibility conditions Runway/taxiway incursion, surface incident SOP; PART 139; SMGCS; FAA AC; training; use of escorts; CSPP; Air Traffic Orders Deficient communication or training of escorting procedures Runway/taxiway incursion, surface incident SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP; use of more than one escort; handout of escort route map on airfield and briefing to vehicle operators being escorted Earthmoving, Excavation, and Paving Excavation close to utilities and cables Power and system outages, collisions, runway/taxiway incursions and excursions FAA AC; CSPP; Part 139; excavation plan/ SOP and onsite supervision; daily shift briefings; hand digging until utilities/cables located Generation of debris to operational areas FOD damage SOP; FAA AC; CSPP; Part 139; training; FOD patrols; sweepers; wheel wash stations

Preliminary Hazard Lists (PHLs) 183 Hazard Outcome CommonMitigations or Source Material for Mitigations Deficient identification of construction areas Surface accident, aircraft collision SOP; FAA AC; CSPP; Part 139 Failure to issue timely and accurate NOTAMs Runway/taxiway incursion, surface incident SOP’s; FAA AC; CSPP; Part 139; AIM Low visibility conditions Runway/taxiway incursion, surface incident SOP; PART 139; SMGCS; FAA AC; training; use of escorts; CSPP; Air Traffic Orders Stockpiling spoils/soil in/near taxilane/taxiway/runway safety/obstacle free areas/zones Aircraft collision SOP; PART 139; FAA AC; training; use of escorts; CSPP; Air Traffic Orders; Part 77; FAA AC Staging equipment in/near taxiway or runway safety areas Collisions between equipment and aircraft SOP; PART 139; FAA AC; training; use of escorts; CSPP; Air Traffic Orders; Part 77; FAA AC Out of service obstruction lights Collisions between equipment and aircraft Part 139; FAA AC; CSPP; safety inspections Deficient equipment maintenance Runway/taxiway incursion, collision, surface incident, FOD SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP; escorts; equipment shift inspections; a planned/ preventive maintenance program by the contractor Dust generated by construction activities Runway/taxiway incursion, surface incident, FOD SOP; CSPP; Part 139; contractor dust control plan Equipment left unattended at night Collisions FAA AC; Part 139; Part 77; Air Traffic Orders; CSPP; daily shift construction safety briefings Deficient construction quality FOD damage SOP; training; daily shift construction safety meetings; Part 139; FAA AC; CSPP; Quality control plan Disruption of weather reporting services Collision, runway excursion, major system failure, flooding SOP; training; Part 139; CSPP; FAA AC Miscommunications Runway/taxiway incursion, surface incident Training; supervision; Part 139; FAA AC; CSPP; Air Traffic Orders; SOP Training Construction workers cannot understand English Runway/taxiway incursion, surface incident Training; Part 139; FAA AC; CSPP; escorts; onsite supervision Construction workers in movement areawithout an understanding of airport rules and regulations for operations in the movement area Runway/taxiway incursion, surface incident SOP; PART 139; SMGCS; FAA AC; training; use of escorts; CSPP; Air Traffic Orders

184 A Guidebook for Safety Risk Management for Airports Hazard Outcome CommonMitigations or Source Material for Mitigations Construction workers in movement areas Runway/taxiway incursion, surface incident SOP; PART 139; SMGCS; FAA AC;training; use of escorts; CSPP; Air Traffic Orders Deficient communication between contractor and airport operations Runway/taxiway incursion, surface incident SOP; FAA AC; CSPP; Part 139; training Deficient driver and escort training Runway/taxiway incursion, surface incident SOP; written and OJT testing; FAAAC; Part 139; CSPP Lighting, Marking, Signage Deficient marking, signaling and lighting of construction areas Collision, surface incident, runway/taxiway incursion Part 139; CSPP; FAA AC; SOP; training Out of service obstruction lights Collision Part 139; CSPP; FAA AC; SOP; training Incorrect use/installation of temporarymarking and lighting Collision, surface incident, runway/taxiway incursion Part 139; CSPP; FAA AC; SOP; training Power outage Runway/taxiway incursion, surface incident, collision Part 139; CSPP; FAA AC; SOP; training Off Peak Construction Failure to build temporary ramps when resurfacing runways Blown tires, broken landing gear Part 139; CSPP; FAA AC; SOP; training Deficient procedures to open closed areas to operations Runway/taxiway incursion, collision Part 139; CSPP; FAA AC; SOP; training; supervision and monitoring Temporary ramps not complying with FAA recommendations Blown tires, broken landing gear Part 139; CSPP; FAA AC; SOP; training Aircraft operations in opposite direction of paving operations Blown tires, broken landing gear Part 139; CSPP; FAA AC; SOP; training; Air Traffic Orders Stockpiling Height and location of stockpiles close to safety areas Collision Part 129; Part 77; CSPP; FAA AC; SOP; training Generation of FOD FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols; sweepers; wheel wash stations Work in Safety Areas, Object Free Areas (OFA), Object Free Zone (OFZ) Height of equipment Collision Part 139; Part 77; CSPP; Air Traffic Orders; FAA AC; SOP; training Equipment breakdown Collision Part 139; CSPP; FAA AC

Preliminary Hazard Lists (PHLs) 185 Hazard Outcome CommonMitigations or Source Material for Mitigations Deficient coordinationwith ATO Runway/taxiway incursion, surface incident Part 139; CSPP; SOP; FAA AC; Air Traffic Orders; training FOD FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols; sweepers; wheel wash stations Loosemaintenance tools and parts FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols; escorts following vehicles NAVAIDS Construction workers unaware of NAVAIDS restrictions Aircraft accident, NAVAID damage SOP; CSPP; Part 139; Part 77; Air Traffic Orders; training; onsite supervision; FAA AC Proximity of construction vehicles to NAVAIDS Aircraft accident, NAVAID damage SOP; CSPP; Part 139; Part 77; Air Traffic Orders; training; onsite supervision; FAA AC Changes to airside aircraft traffic patterns due to construction Runway/taxiway incursion, surface incident, collision SOP, NOTAMs; Part 139; Air Traffic Orders; FAA AC; CSPP Trash from Construction Trash as wildlife attractants Wildlife strikes SOP, NOTAMs; Part 139; FAA AC; CSPP; FOD/ trash patrols Generation of FOD FOD damage SOP; CSPP; Part 139; FAA AC; FOD patrols Wildlife Movement Installation of temporary gates Wildlife strikes Guards; Part 139; Wildlife Hazard Management Plan (WHMP); CSPP; FAA AC; TSA Part 1542; SOP Temporary removal of fences Wildlife strikes Guards; Part 139; WHMP; CSPP; FAAAC; TSA Part 1542; SOP Drainage Construction debris obstructing drainage systems FOD damage Part 139; CSPP; FAA AC; SOP Excavation close to utilities and other systems Circuit light outages on AOA FAA AC; CSPP; Part 139; excavation plan and onsite supervision; daily shift briefings; hand digging until utility/cables located; SOP Flooding or ponding in movement areas FOD damage, closed areas resulting in delay in operations CSPP; Part 139; FAA AC; SOP; sweepers on call

186 A Guidebook for Safety Risk Management for Airports Hazard Outcome Common Mitigations or Source Material for Mitigations Birds Landfill close to the airport Birdstrikes Local ordinances; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP Wastewater treatment facilities near the airport Birdstrikes Local ordinances; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP Wetlands, grasslands, wooded areas at or near the airport Wildlife strikes Local ordinances; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP; FAA AC Dredge spoil containment areas near the airport Birdstrikes Local ordinances; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP; FAA AC Development of favorable habitat conditions for certain species Wildlife strikes Local ordinances; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP; FAA AC Agricultural activities on and off airport Wildlife strikes Local ordinances; leases; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP; FAA AC; training; crop control and clean up after harvest Urban areas at or near the airport Wildlife strikes Local ordinances; leases; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP; FAA AC Construction and demolition (C&D) debris facilities at or near the airport Wildlife strikes Local ordinances; leases; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP; FAA AC Uncovered garbage cans and dumpsters Wildlife strikes Local ordinances / Airport Rules & Regulations; leases; Wildlife Hazard Management Plan (WHMP); local Letter of Agreement; FAA AC; Part 139; SOP; FAA AC; training Construction workers leaving food in open areas Wildlife strikes CSPP; FAA AC; Part 139; FOD patrols; training; daily shift briefings; SOP High grass Wildlife strikes SOP’s; Part 139; Wildlife Hazard Management Plan (WHMP); FAA AC; SOP Low grass Wildlife strikes SOP; Part 139; Wildlife Hazard Management Plan (WHMP); FAA AC Grass type attracts certain species of wildlife Wildlife strikes SOP; Part 139; Wildlife Hazard Management Plan (WHMP); airport design standards; FAA AC Type of vegetation attracts certain species of wildlife Wildlife strikes SOP; Part 139; Wildlife Hazard Management Plan (WHMP); airport design standards; FAA AC Earthworm presence in airfield areas Birdstrikes SOP; Part 139; Wildlife Hazard Management Plan (WHMP); FAA AC Nesting on or near the airport, areas that allow for ease of roosting Wildlife strikes SOP; Part 139; local ordinances; Federal laws and regulations; FAA AC animals Delay removing dead animals Wildlife strikes, disease Local Letter of Agreement with USDA/ SPCA animal control; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP Wildlife Hazards

Preliminary Hazard Lists (PHLs) 187 Hazard Outcome CommonMitigations or Source Material for Mitigations Migratory season for certain species Birdstrikes SOP; Part 139; local ordinances; Federal laws and regulations; FAA AC; training; Wildlife Hazard Management Plan (WHMP); NOTAMs; ATIS Feeding of wildlife Wildlife strikes SOP; Part 139; local ordinances; FAA AC; training; Wildlife Hazard Management Plan (WHMP) Flocks of birds frequently seen in airfield areas Birdstrikes SOP; Part 139; local ordinances; FAA AC; training; Wildlife Hazard Management Plan (WHMP); NOTAMs; ATIS Large species (raptor birds, deer, wild boars, etc.) frequently seen in airfield areas Wildlife strikes SOP; Part 139; local ordinances; FAA AC; training; Wildlife Hazard Management Plan (WHMP) Approaching season of high frequency for certain bird species Birdstrikes SOP; Part 139; local ordinances; FAA AC; training; Wildlife Hazard Management Plan (WHMP); NOTAMs Presence of rodents (food) attracting birds of prey Birdstrikes SOP; Part 139; local ordinances; FAA AC; training; Wildlife Hazard Management Plan (WHMP); grass height; vegetation control Golf courses near the airport Birdstrikes Local Letter of Agreement; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP Livestock production operations near the airport Birdstrikes Local Letter of Agreement; local ordinance; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP; NOTAMs Open aquaculture operations Wildlife strikes Local Letter of Agreement; local ordinance; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP; NOTAMs High frequency ofmost hazardous birds to aircraft: vultures, geese, cormorants/pelicans, cranes, eagles, ducks, osprey, turkey/pheasants, herons, hawks, gulls, rock pigeons and owls Birdstrikes SOP’s; Part 139; FAA AC; Wildlife Hazard Management Plan (WHMP); training; depredation; SOP; NOTAMs OtherWildlife Low fences Wildlife strikes Airport design standards; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP Type of fence does not restrain wildlife from entering airfield Wildlife strikes Airport design standards; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP Topography and vegetation allow wildlife to enter airfield areas Wildlife strikes Airport design standards; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP Culverts without grids Wildlife strikes Airport design standards; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP Presence ofmost hazardous mammals to aircraft: deer, coyote Wildlife strikes Airport design standards; training; Wildlife Hazard Management Plan (WHMP); Part 139; FAA AC; SOP; catch and relocate release program; depredation

188 A Guidebook for Safety Risk Management for Airports Hazard Outcome Common Mitigations or Source Material for Mitigations Pavements and Safety Areas Surface cracking with generation of lose fragments, chips FOD damage SOP; FAA AC; Pavement Management Program (PMS); Part 139; training; sweepers; FOD patrols Raveling of pavement surface with generation of lose aggregates FOD damage SOP; FAA AC; Pavement Management Program (PMS); Part 139; training; sweepers; FOD patrols Loose dirt blown by aircraft engines FOD damage, injuries SOP; FAA AC; Part 139; training; sweepers; FOD patrols; special inspections Loose material from freshly mowed areas FOD damage SOP; FAA AC; Part 139; training; sweepers; FOD patrols; escorts; special inspections Proximity of helipads to unpaved areas FOD damage SOP; FAA AC; Part 139; training; sweepers; FOD patrols FOD generated by construction activities FOD damage SOP; FAA AC; CSSP; Part 139; training; sweepers; FOD patrols Weathering during freeze thaw cycles FOD damage SOP; FAA AC; Pavement Management Program (PMS); Part 139; training; sweepers; FOD patrols Loose rubber joint materials FOD damage SOP; FAA AC; Pavement Management Program (PMS); Part 139; training; sweepers; FOD patrols Maintenance Tools and parts left after maintenance operations FOD damage SOP; FAA AC; FOD patrols; training; special inspections Open garbage cans or dumpsters FOD, wildlife strikes SOP; FAA AC; FOD patrols; training; Wildlife Hazard Management Plan (WHMP) Personnel Trash in open areas FOD, wildlife strikes SOP; FAA AC; FOD patrols; training; Wildlife Hazard Management Plan (WHMP); Part 139 Trays, bags and trash from catering services FOD, wildlife strikes SOP; FAA AC; FOD patrols; training; Wildlife Hazard Management Plan (WHMP); Part 139 Loose flight line items (wheel chalks, badges, pens, tags, etc.) FOD damage SOP; FAA AC; FOD patrols; training; Part 139 Other Loose branches and vegetation FOD damage SOP; FAA AC; FOD patrols; training; Part 139 Rain water and drainage streaming mud, pebbles and other debris FOD damage SOP; FAA AC; FOD patrols; training; Part 139 Pieces of aircraft tires or parts FOD damage SOP; FAA AC; FOD patrols; training; Part 139; NOTAM’s Winter contaminants (snow, ice) FOD, runway excursion, surface accident SOP; FAA AC; FOD patrols; training; Part 139; Environmental regulations; Snow Plan for aircraft deicing; NOTAMs Foreign Object Debris

Preliminary Hazard Lists (PHLs) 189 Hazard Outcome CommonMitigations or Source Material for Mitigations Hotspots Complex airfield configuration and intersections Runway/taxiway incursion Hotspots map; Letter of Agreement with Air Traffic; MOS special lighting; signage, markings; Runway Safety Action Team (RSAT) team recommendations; Air Traffic Orders; NOTAMs; training; SOP; FAAAC; ATIS; Part 139 Nearness of taxiway intersections to runway thresholds Runway/taxiway incursion Hotspots map; Letter of Agreement with Air Traffic; MOS special lighting; signage, markings; Runway Safety Action Team (RSAT) team recommendations; Air Traffic Orders; NOTAMs; training; SOP; FAAAC Part 139 Joint use of runway as taxiway Runway/taxiway incursion, surface accident Hotspots map; Letter of Agreement with Air Traffic; special lighting; signage, markings; Runway Safety Action Team (RSAT) team; Air Traffic Orders; NOTAMs; FAA and Jeppesen charting; training Environment Deficient weather conditions Runway/taxiway incursion, surface accident SOP; FAA AC; Air Traffic Orders; training; escorts; Part 139; halting all AOA construction; Letter of Agreement Low visibility Runway/taxiway incursion, surface accident Surface Movement Guidance Control Plan (SMGCS); SOP; FAA AC; Air Traffic Orders; training; escorts; Part 139; halting all AOA construction; Letter of Agreement Nighttime conditions Runway/taxiway incursion, SOP; FAA AC; Part 139; Letter of Agreement; surface accident training Other Construction and temporary markings, signs and lighting Runway/taxiway incursion, surface accident, collision CSSP; Part 139; ATIS; NOTAM’s; training; Air Traffic Orders; Letter of Agreement; FAA AC; SOP Deficient airfield driver training Runway/taxiway incursion, surface accident, collision Part 139 recurrent driver training; Airport/City policies on punishment; FAA AC; SOP Deficient taxi route planning Runway/taxiway incursion Part 139; Air Traffic Orders; Letter of Agreement; ATIS; NOTAMs; “standard taxi routes” chart publishing; signage, lighting, marking; FAA AC; SOP Temporary closures, construction, and changes in status of NAVAIDS Runway/taxiway incursion, surface accident, collision Part 139; Air Traffic Orders; Letter of Agreement; ATIS; NOTAMs; “standard taxi routes” chart publishing; signage, lighting, marking; CSPP; training; maps provided to airport departments, construction crews and airlines, FBOs and pilots; FAA AC; SOP Airfield Configuration

190 A Guidebook for Safety Risk Management for Airports Hazard Outcome CommonMitigations or Source Material for Mitigations Airfield Operations Snow removal ops in airfield areas Runway/taxiway incursion, runway excursion, surface accident Part 139; Air Traffic Orders; Letter of Agreement; ATIS; NOTAMs; training; FAA AC; SOP; escorts; Snow Plan Adverseweather elements and extended shifts Runway/taxiway incursion, surface accident Part 139; Air Traffic Orders; Letter of Agreement; ATIS; NOTAMs; training; FAA AC; SOP; escorts Slippery pavement conditions Runway excursion, surface accident Part 139; Air Traffic Orders; Letter of Agreement; ATIS; NOTAM’s; training; FAA AC; SOP; escorts; treat or close areas Radio failure Runway/taxiway incursion, surface accident SOP; training on Air Traffic Control light gun signals; use of cell phones; escorts; FAA AC; Part 139 Deficient coordination between maintenance shifts and/or airport operations and/or FAA ATC Runway/taxiway incursion, runway excursion, surface accident Training; supervision; record of shift briefings; SOP; Part 139 Shortage of personnel due to inability to report to work Runway/taxiway incursion, runway excursion, surface accident SOP; training; Snow Plan; IROPS Plan; cross training of personnel Deficient coordination during snow removal ops Runway/taxiway incursion, runway excursion, surface accident SOP; FAA AC; training; Snow Plan; shift safety briefings; supervision on site Snow / Ice Plan Deficient planning tomitigate impact to airport operations Runway excursions, runway/taxiway incursions SOP; Snow Plan; IROPS Plan; training; FAA AC Deficient coordination between tenants, airlines and airport departments Runway/taxiway incursion, runway excursion, surface accident SOP; Snow Plan; IROPS Plan; training; FAA AC; scheduled conference call briefings Deficient Irregular Operations Plan (IROPS) Runway/taxiway incursion, runway excursion, surface accident FAA AC; Snow Plan; SOP; training Airfield condition reports that are not accurate Runway excursion, surface accident FAA AC; Snow Plan; Air Traffic SOP and Orders; ATIS; NOTAMs; notification to airlines/FBOs Missing contact info for key operational and emergency recall personnel Delay emergency response Activate emergency recall through Airport Emergency Plan list; SOP; news media announcements Deficient training of airport maintenanceworkers on airfield winter operations Runway excursion, surface accident SOP; Snow Plan; IROPS Plan; escorts Deficient training of contractor personnel to support snow operations Runway excursion, surface accident SOP; Snow Plan; conduct emergency training; onsite supervision Deficient coordination to notify ARFF/EMS/Police when access routes have changed Delay emergency response SOP; notification recording; FAA AC; temporary signage Deficient coordination to prioritize clearing of runways and taxiways Runway excursion, surface accident Snow Committee and Air Traffic notification; SOP; FAA AC Winter Operations

Preliminary Hazard Lists (PHLs) 191 Hazard Outcome CommonMitigations or Source Material for Mitigations Coordination and Communication Deficient coordination to notify ARFF/EMS/Police when access routes have changed Delay emergency response SOP; notification recording; signage; FAA AC Deficient coordination to prioritize clearing of runways and taxiways Runway excursion, surface accident Snow Committee and Air Traffic notification; SOP; FAA AC NOTAMs not submitted in a timely and coordinated manner Runway excursion, surface accident Snow Committee and Air Traffic notification; SOP; FAA AC; ATIS Deficient communication to pilots on airfield condition reports, closed areas and limitations to operations Runway excursion, surface accident, collision Snow Committee and Air Traffic notification; SOP; FAA AC; ATIS; NOTAMs; scheduled conference call briefings Failure to monitor deice fluid capture tank levels Impact on environment Monitoring system with alarms for pre critical, critical areas; physical monitoring of tank/system levels; water/deice fluid water shed volumes reporting; Storm Water Pollution Prevention Plan (SWPPP) Insufficient coordination of AOA/AMA inspections with airline representatives (Chief Pilots) Runway excursion, surface accident Snow Committee; SOP; training; scheduled conference call briefings Emergency Response Changes to status of access roads/AOA routes Delay of emergency response, surface accident Scheduled conference call briefings; SOP AOA Security Unauthorized access to airfield areas Runway/taxiway incursion, surface accident, wildlife strike Security radar, FLIR systems; airfield CCTV; SOP; FAA AC; TSA Part 1542 Open fence or gates due to weather damage Runway/taxiway incursion, surface accident, wildlife strike SOP; post guards; use temporary fence/ gates to secure Fencing and Gates Open AOA gate Runway/taxiway incursion, surface accident, wildlife strike SOP; training; post guards Open construction gate or fence area Runway/taxiway incursion, surface accident, wildlife strike SOP; training; post guards Absence of security guards due to weather Runway/taxiway incursion, surface accident, wildlife strike Secure/close open area to no access Environmental Issues Stockpiling location of contaminated snow/ice Environmental impact Identify predetermined stock pile locations and mark; training; SOP; FAA AC Improper deicing fluid runoff Environmental impact Monitoring and reporting of deice operations; shutdown deice operations until corrected; training; sweep/contain deice fluid runoff and collect

192 A Guidebook for Safety Risk Management for Airports Hazard Outcome Common Mitigations or Source Material for Mitigations Deicer fluids and other contaminants outside of containment system Environmental impact Sand contaminated areas, boom fluids and collect later; monitor and assess if contaminants will have regulatory impact; SOP Radio failure in deice vehicles Runway/taxiway incursion, surface accident SOP; training; Part 139; cell phone use; backup radios/onsite supervision with radio Breakdown of deice vehicles Collision, surface accident SOP; close area; mark/light area of vehicle Driving and Escorting Operating equipment outside of accepted regulations Collision, surface accident Training; SOP; Part 139; escorts; speed limit signs; vehicle speed regulators; supervisory monitoring; FAA AC Improper escort training for drivers Runway/taxiway incursion, surface accident Part 139; FAA AC; SOP; use of other qualified personnel Impaired road signage on ramps due to snow/ice/low visibility Runway/taxiway incursion, surface accident, collision Part 139; FAA AC; SOP; monitor and correct issue Towing of Aircraft Slippery surfaces Surface accident, collision Part 139; FAA AC; SOP; training; pre check tow route and sand/treat Training Deficient training of personnel involved with deicing Environmental impact, collision, surface accident SOP; FAA AC; Part 139; use of other qualified personnel Snow clearing crews and equipment in movement areas Surface accident, collision Escorts; close runway and taxiways to be cleared; NOTAMs; conference call briefing; ATIS; training; SOP; FAA AC Deficient communication between snow clearing crews and airport/airfield operations crews Surface accident, collision Training; SOP; FAA AC; onsite supervision and monitoring Deficient SMGCS training Surface accident, collision Training; SMGCS Plan review; SOP; FAA AC; use escorts Lighting, Marking, Signage Deficient conspicuity of markings, lights and signs Surface accident, collision Part 139; FAA AC; SOP Out of service obstruction lights Surface accident, collision Part 139; FAA AC; SOP Equipment and Stockpiling Large equipment parked on/near safety areas Collision Part 139; FAA AC; SOP; Part 77; training Large stockpiles of snow on/near safety areas Collision Part 139; FAA AC; SOP; Part 77; training; Snow Plan Snow accumulated in proximity of NAVAIDS Aircraft accident, loss of operational capabilities Part 139; FAA AC; SOP; Part 77; training Ruts or wash outs and ponding of water Runway excursions Part 139; FAA AC; SOP Low visibility Environmental impact Monitoring and reporting of deice operations; shutdown deice operations until weather improves; training Deficient trained contract personnel Environmental impact, occupational accident, collision, surface accident Monitoring and reporting of deice operations; shutdown deice operations until deice operations properly conducted; onsite supervision; training; SOP

Preliminary Hazard Lists (PHLs) 193 Hazard Outcome CommonMitigations or Source Material for Mitigations NAVAIDS Snow clearing crews unaware of NAVAIDS location Aircraft accident, loss of operational capabilities Part 139; FAA AC; SOP; Snow Plan; training; onsite supervision Snow clearing vehicles near NAVAIDS Aircraft accident, loss of operational capabilities Part 139; FAA AC; SOP; Snow Plan; training; onsite supervision Changes to traffic routes causing aircraft to interfere with NAVAIDS Aircraft accident, loss of operational capabilities Part 139; Air Traffic Orders; Letter of Agreement; SOP; Snow Plan; training FOD Ice/snow debris from aircraft and vehicle routes FOD damage Part 139; FAA AC; SOP; Snow Plan; training FOD sweepers inoperative FOD damage Part 139; FAA AC; SOP; training Drainage Ponding and slippery surfaces due tomelting/freezing snow/ice Runway/taxiway excursions, collision Part 139; FAA AC; SOP; Snow Plan; training Hazard Outcome CommonMitigations or Source Material for Mitigations Airfield Operations Strong winds, flooding, or hail impacting aircraft, airline equipment stored on ramps Aircraft damage, equipment damage Part 139; Severe Weather Plan; SOP; FAA AC; Emergency Plan; training Deficient lightning and flood notifications to outside workers, tenants, airlines Damage to equipment, aircraft, worker injuries or death Part 139; Severe Weather Plan; SOP; FAA AC; Emergency Plan Changes to operation conditions Aircraft or vehicle accidents Part 139; Severe Weather Plan; SOP; FAA AC; Emergency Plan; conference call briefings Coordination and Communication Deficient coordination between airport activities (e.g., air traffic, ramp management, security, emergency) Delay of emergency response, surface accident, runway/taxiway incursion Part 139; Severe Weather Plan; SOP; FAA AC; Airport Emergency Plan; IROPS Plan; FAA AC; training; shift or special conference calls Airport staff and construction workers unaware of hazardous situations Delay of emergency response, surface accident Part 139; Severe Weather Plan; SOP; Weather radios; CSPP; FAA AC; Emergency Plan; training; shift or special conference calls Severe Weather

194 A Guidebook for Safety Risk Management for Airports Hazard Outcome CommonMitigations or Source Material for Mitigations Emergency Response Changes to emergency routes Surface accident Part 139; Severe Weather Plan; SOP; FAA AC; Emergency Plan; training; shift or special conference calls Impact of weather on water lines Reduction of ARFF capacity Part 139; Severe Weather Plan; SOP; FAA AC; Emergency Plan; training; conference call Security Damaged gates and broken fences Runway/taxiway incursion, surface accident, wildlife strikes Part 139; Severe Weather Plan; SOP; FAA AC; Security Plan; TAS Part 1542; provide guards at open areas Hazard Outcome CommonMitigations or Source Material for Mitigations Airfield Driving Extended shifts, distractions, weather conditions, etc., impacting situational awareness Runway/taxiway incursion, surface accident Part 139; FAA AC; SOP; proper rest periods; onsite supervision; cross–train personnel; training Vehicle improperlymarked, lighted, equipped and not inspected prior to operation Runway/taxiway incursion, surface accident Part 139; FAA AC; SOP; shift safety briefings; training; supervisory monitoring Jet blast/prop wash on vehicles Damage to vehicle, injury to personnel Part 139; FAA AC; SOP; shift safety briefings; training Changes to procedures affecting airfield service routes Runway/taxiway incursion, surface accident Part 139; FAA AC; SOP; shift safety briefings; training; shift conference calls Deficient equipment/vehicle maintenance Surface accident, FOD Part 139; FAA AC; SOP; shift safety briefings; training; vehicle inspections Shared service/emergency/haul routes and crossings Surface accident Part 139; FAA AC; SOP; shift safety briefings; training; escorts Vehicle operators unaware of regulations regarding vehicle operations on the airfield Runway/taxiway incursion, collision Training; SOP; Part 139; escorts; speed limit signs; vehicle speed regulators; physical monitoring; FAA AC Nighttime driving conditions Runway/taxiway incursion, surface accident Training; Part 139; FAA AC; SOP; shift safety briefings Coordination and Communication Deficient coordinationwith other airport activities (e.g., air traffic, ramp management, security, emergency) Runway/taxiway incursion, surface accident, damage to aircraft Training; Part 139; FAA AC; SOP; shift safety briefings; shift conference calls; IROPS Plan Airside Driving

Preliminary Hazard Lists (PHLs) 195 Hazard Outcome CommonMitigations or Source Material for Mitigations Changes to operations conditions and service routes Runway/taxiway incursion, surface accident Training; Part 139; FAA AC; SOP; shift safety briefings; shift conference calls Use of improper aviation phraseology Runway/taxiway incursion, surface accident Training; Part 139; FAA AC; SOP; shift safety briefings; supervision monitoring Loss of communicationwith ATC Runway/taxiway incursion, surface accident Training; Part 139; FAA AC; SOP; training in use of alternative communicationmethods Emergency Response Shared service/emergency routes and crossings Surface accident Training; Part 139; FAA AC; SOP; shift safety briefings; shift conference calls Security Unauthorized vehicle access to airfield areas Runway/taxiway incursion, surface accident Training; Part 139; FAA AC; SOP; shift safety briefings; shift conference calls; Airport Security Plan; TSA Part 1542 Weather Adverseweather conditions (heavy rain, snow,moderate ice) Runway/taxiway incursion, excursion or surface accident Training; Part 139; FAA AC; SOP; shift safety briefings; shift conference calls; GPS (with alarm capability for infringement of safety area, etc. surfaces) tracking vehicles operating on airfield Low visibility conditions Runway/taxiway incursion or surface accident Training; Part 139; FAA AC; SOP; shift safety briefings; shift conference calls; GPS (with alarm capability for infringement of safety area, etc. surfaces) tracking vehicles operating on airfield; SMGCS Plan Escorting Speeding during escorting operations Collision Training; SOP; Part 139; speed limit signs; vehicle speed regulators; physical monitoring; FAA AC; CSPP Deficient escort training Runway/taxiway incursion or surface accident Recurrent training; SOP; Part 139; supervision; FAA AC; driving simulators; OJT Unfamiliaritywith airfield plan and service routes Runway/taxiway incursion or surface accident Training; SOP; Part 139; speed limit signs; vehicle speed regulators; FAA AC; airfield maps with escort route provided to vehicles being escorted; use of 2 or more escorts Deficient communication with Ops and ATC Runway/taxiway incursion or surface accident Training; SOP; Part 139; FAA AC; Letter of Agreement; conference call

196 A Guidebook for Safety Risk Management for Airports Hazard Outcome CommonMitigations or Source Material for Mitigations Interference with NAVAIDS Aircraft accident, loss of operational capabilities, delay in operations Training; SOP; Part 139; FAA AC; escort briefing prior to start of escort; map of escort route provided to vehicle operators being escorted Vehicle breakdown in aircraft operations or safety areas Collision, loss of operational capabilities, delay in operations SOP; FAA AC; training; notify supervision for action and close area to aircraft and emergency operations Changes to traffic routes causing interference with NAVAIDS Runway/taxiway incursion or surface accident Training; SOP; Part 139; FAA AC; escort briefing prior to start of escort; map of escort route provided to vehicle operators being escorted FOD Transition from unpaved areas to operational areas, carrying FOD FOD damage Training; SOP; Part 139; FAA AC; escort briefing prior to start of escort; map of escort route provided to vehicle operators being escorted; inspection of escorted vehicles prior to entering AOA operational areas; sweeper on call Safety Areas/Obstacle Free Zones/NAVAIDS

197 A P P E N D I X F Typical Accident and Incident Rates Risk Category Subcategory Rate Source Data Period Runway/Taxi way Incursion Towered airports 2.5 runway/taxiway incursions per day in the U.S. GAO, 2008 Partial data from 2008 Towered airports 1 incursion per 167,000 operations GAO, 2008 1998 to 2007 Towered airports 1 collision per 37,500,000 operations FAA, 2004 2000 to 2003 Towered airports 1 fatality per 65,500,000 operations FAA, 2004 2001 to 2003 Runway Excursion Overrun landing 1 overrun in 1,050,000 landings ACRP Report 50, 2010 Overrun takeoff 1 overrun in 4,120,000 takeoffs ACRP Report 50, 2010 1982 2009 Undershoot 1 undershoot in 4,160,000 landings ACRP Report 50, 2010 1982 2009 Veer off landing 1 veer off in 840,000 landings ACRP Report 51, 2010 1982 2009 Veer off takeoff 1 veer off in 3,860,000 takeoffs ACRP Report 51, 2010 1982 2009 Fuel Spills Hydrant airport high pressure 1 spill per 6,700 operations WS ATKINS, 2000 1994 1998 Hydrant airport low pressure 1 spill per 1,100 operations WS ATKINS, 2000 1994 1999 Refueler airport low pressure 1 spill per 1,460 operations WS ATKINS, 2000 1994 1999 Ignition probability 1 ignition per 10,000 spills WS ATKINS, 2000 1994 1999 Risk of passenger fatality hydrant airport 1 fatality per 8,130,000,000 movements WS ATKINS, 2000 1994 1999 Risk of passenger fatality refueler airport 1 passenger fatality per 379,000,000,000 movements WS ATKINS, 2000 1994 1999 Ground Handling Incidents with aircraft damage 1 incident per 5,000 movements NLR, 2008 NA Damage rate in North America 1 damage per 10,000 movements ACRP Report 62 2006 2007 Damage rate in Europe 1 damage per 3,000 movements ACRP Report 62 2006 2007

198 A Guidebook for Safety Risk Management for Airports Risk Category Subcategory Rate Source Data Period Birdstrikes GA aircraft 1 birdstrike to GA aircraft in 132,000 movements FAA, 2012 1993 to 2011 Foreign Object Damage Annual cost to aerospace industry USD 4 billion Boeing, 1998 Annual direct cost to global aviation industry USD 1.26 billion ACRP Synthesis 26, 2011 Annual direct cost to US aviation industry USD 474 million ACRP Synthesis 26, 2011 Annual total cost to global aviation industry USD 13.9 billion ACRP Synthesis 26, 2012 Annual total cost to aviation industry USD 5.2 billion ACRP Synthesis 26, 2013 Total no. of engine FOD events 1 event per 3,200 aircraft movements McCreary, 2008 Tech test/inspection 1 test/inspection per 6,700 movements McCreary, 2008 Blade pairs replaced 1 blade pair replaced per 5,900 movements McCreary, 2008 Tire FOD events 1 tire FOD event per 1,030 movements McCreary, 2008 Tires replaced due to FOD 1 tire replaced per 2,940 movements McCreary, 2008 Aircraft fuselage damage 1 aircraft fuselage damage per 3,850 movements McCreary, 2008 Birdstrikes Birdstrikes with damage to commercial aircraft 1 birdstrike with damage to commercial aircraft per 75,200 movements FAA, 2012 1990 to 2011 Birdstrikes with damage to GA aircraft 1 birdstrike with damage to GA aircraft per 417,000 movements FAA, 2012 1991 to 2011 Birdstrikes commercial aircraft 1 birdstrike to commercial aircraft per 7,300 movements FAA, 2012 1992 to 2011

199 G-1 Introduction KPIs are quantifiable measures that a company or industry uses to gauge or compare per- formance in terms of meeting strategic and operational goals. KPIs vary among companies and industries, depending on priorities and performance criteria. KPIs are also referred to as “key success indicators (KSIs).” When measuring safety performance, some organizations use safety performance indicators (SPIs). Regardless of the term used, an airport must be able to assess safety performance. The indicators need to be measurable and in line with an organization’s goals and objectives. Indicators can change and should be updated as progress is made. In this appendix, the term KPI is used. For airports, KPIs represent known data sources and existing data collected through the nor- mal course of business. If an airport is Part 139 certificated, the airport operator is obligated to collect, document, and retain certain safety data points, including Part 139 daily inspections, ARFF inspections, driver training, and incursions. For airports that are not Part 139 certificated, operators must consider the data points they already have in place and those missing that might provide a more complete safety performance picture. Two lists of KPIs or potential KPIs that all airports should consider including in their SMS and subsequently use to support their SRM process follow. Part 139 KPIs 1. Part 139 self-inspection results a. Completed as described in the ACM b. Number of discrepancies documented c. Time to correct noted discrepancies d. Trends 2. ARFF inspections a. Number of discrepancies by location and tenant b. Time to correct noted discrepancies c. Trends 3. ARFF run reports (non-medical related) a. Trends 4. ARFF medical run reports a. Trends 5. Airfield driver training a. The number of individuals trained (used to put data in context) 6. AOA access training (badging) a. The number of individuals trained (used to put data in context) A P P E N D I X G Typical KPIs and Associated Data

200 A Guidebook for Safety Risk Management for Airports 7. FOD program results a. Completed inspections and documentation (as appropriate) b. Results of FOD inspections c. Trends d. Level of tenant and airline participation in the program Non-Part 139 KPIs 8. Baggage area program results (as appropriate) a. Completed inspections and documentation (as appropriate) b. Results of baggage area inspections c. Trends d. Level of tenant and or airline participation in the program 9. Ramp inspection program results a. Completed inspections and documentation as described in Appendix C b. Results from inspections c. Trends d. Level of tenant and airline participation in the program 10. Terminal and Landside inspections (if appropriate) a. Results from inspections b. Trends c. Level of tenant and airline participation in the program 11. Airport operator employee incident and accidents a. OSHA Reportable (if applicable) b. OSHA non-reportable (if applicable) c. Trends 12. Property damage reports a. Trends 13. Hazard reports a. Public reports b. Internal Authority reports c. Tenant and airline reports d. Time to investigate e. Time to corrective action(s) completion 14. Incident and accident reports (non-aircraft related) a. Public reports b. Internal airport operator reports c. Tenant and airline reports d. Time to investigate e. Time to corrective action(s) completion 15. Safety Training a. Number of tenants and or airlines employees trained in SMS orientation b. Airport operator staff and employees trained in SMS orientation, SRM process, and Assurance c. Test results d. Trends

201 Introduction SMS and SRM are terms that have been recently introduced to the airport industry—they highlight the need to understand some basic principles of probability because risk has two com- ponents: severity and likelihood. While the meaning of severity is straightforward, understand- ing the term likelihood requires some basic understanding of probability. This appendix will help airport workers understand basic principles and notations used to describe the chance of an accident or incident occurring. Reviewing these principles will help airport workers understand and participate in discussions about risk and in panels assembled for safety assessments. Catastrophic accidents in aviation are rare and estimating the probability of occurrence is best estimated using historical data. However, many types of incidents are frequent, particularly at larger airports, because of the associated volume of operations and activities. Birdstrikes and FOD incidents may occur daily at some airports. The initial sections of this appendix describe basic concepts that airport staff can use in deal- ing with SMS at the airport. The last section presents mathematical operations with probabilities to help staff understand more advanced concepts. Likelihood vs. Probability The words probability and likelihood are often used as synonyms, but in statistical use, there is a clear technical distinction. To illustrate the statistical difference between these terms we can use a die. If we roll a die 6 times, what is the probability that we will get a “4” in every roll? If we roll the die 6 times and we get a “4” in every roll, what is the likelihood that the die is fair? Statistically, it would be incorrect to switch likelihood and probability in the two sentences. Probability has to do with the chances of an observation, and likelihood refers to the chances of the parameters being correct, given an observation. However, for this guidance, no distinction will be made between likelihood and probability and the terms will be used interchangeably. Probabilities fall on a scale between 0, or 0%, (impossible) and 1, or 100%, (certain). There is no such thing as a negative probability (i.e., less than impossible) or a probability greater than 1 (i.e., more certain than certain). Some types of accidents are very rare and the probability may be very small (e.g., 0.00000001%), however, probability is never negative. A P P E N D I X H Basic Probability and Statistics for SRM

202 A Guidebook for Safety Risk Management for Airports Determining Probability Values Three methods typically are used to determine probability values. 1. Subjective Probability This value reflects the best available knowledge (which may be an educated guess). This is a common method used by SRA panels. For example, to estimate the probability that an airfield worker will be injured by jet blast, it is not possible to use baseline values because each situation is unique and will depend on variables (e.g., is it in an area that aircraft will power up engines or is FOD present in the area between the aircraft and the construction area). For this scenario, an educated guess is the best alternative. 2. Empirical Probability This value is determined by experimentation or historical data. An example of this is the probability of a runway veer-off. Based on the total number of runway veer-offs that occurred between 1982 and 2009 in the United States, and the number of aircraft operations during the same period, it was found that the probability of an aircraft veering-off during the takeoff is 1 in 3,861,000 departures (ACRP Report 51, 2009). 3. A Priori Probability This value can be determined prior to any experimentation or data collection. For example, the probability of obtaining a tail in tossing a coin once is 50%. The coin is not actually tossed to determine this probability. It is simply observed that there are two faces to the coin, one of which is tails and that heads and tails are equally likely. This type of probability is seldom used in the aviation industry. Understanding Probability Language This section presents basic concepts associated with risk analysis and the language used by the FAA to characterize the likelihood of an accident or incident. When taking the risk matrix defined by the FAA for its internal SMS and to illustrate SMS guidance and advisory material for Part 139 airports, likelihood definitions are presented in two forms: expected period for one event to occur and expected number of departures to occur, as shown in Table H-1. For example, “Remote” likelihood characterizes an event “expected to occur about once every year or 2.5 million departures.” The first part of this definition describes the chance that an event may occur within a certain period—in this case, 1 year. The second part pres- ents the odds that the event will occur in 2.5 million departures (or approximately 5 million operations). Likelihood Classification 1 Event in Every Frequent Week or less 2,500 departures or less Probable 1 Week – 1 Year 250,000 departures Remote 1 – 10 Years 2.5 million departures Extremely Remote 10 – 100 Years 25 million departures Extremely Improbable 100 Years or more N/A Table H-1. FAA likelihood definitions.

Basic Probability and Statistics for SRM 203 The interpretation is simple; however, it is sometimes misleading. That an event is expected to occur in 1 year does not mean that the event will take at least 1 year to occur. The event may occur today or it may be many years before it happens. The period is an average period if the time to obtain the data was long enough to measure the frequency of occurrence and the conditions remained the same. When reviewing the number of accidents on the ramp over a period of 15 years, an airport found that 18 accidents had occurred in that period, as shown in Table H-2. If we divide the number of events by the total observation period (18 events divided by 15 years), the result is approximately 1.1 events per year, which is about one event per year. In this case, the probability of that event is ranked as “Remote.” However no event occurred in the first 3 years, three events occurred in the 5th year, and so on. Given two options to classify likelihood, which one should we use? Should we use the criteria based on the number of operations or that based on the period? When the risk is associated with aircraft operations, the likelihood definition to be applied will depend on the volume of opera- tions at the airport. If the volume of operations is small, the likelihood definition based on time should be used. At larger airports, a criterion based on the number of departures is the correct one to apply. As a rule of thumb, airports with less than 200 departures per day should use likeli- hood definitions based on the expected period for an event to occur. Another important aspect is that risk management at an airport may be associated with other operational areas of the airport. For example, many airports have extended the SMS scope to terminal operations and landside. In addition, some airside risks, like collision between vehicles/ equipment at the ramp are not directly associated with the total number of operations at the air- port. For such cases, likelihood definition based on the period or criteria defined by the airport may be the best alternative. Year # of Ramp Accidents Year # of Ramp Accidents 1 0 9 0 2 0 10 2 3 0 11 1 4 1 12 2 5 3 13 2 6 1 14 0 7 2 15 1 8 1 16 2 Table H-2. Number of ramp accidents at example airport. As a rule of thumb, those airports having less than 200 departures per day may use only the criteria based on the expected period for an accident or incident, rather than the rate based on the number of operations.

204 A Guidebook for Safety Risk Management for Airports Notations for Likelihood or Probability Different notations can be used to represent the likelihood or probability of an accident or incident as follows. Although smaller airports with less than 400 movements per day should use the FAA likelihood criteria based on the period, the probability may still be calculated using a baseline risk based on the number of operations. For example, based on historical data, the probability of birdstrikes with damage to GA aircraft is 1 in 417,000 movements. If the airport has 4,000 annual operations of GA aircraft, it may take over 100 years for an incident with air- craft damage due to birdstrike. In this situation, the likelihood is assumed to be extremely improbable. Notation Example Description Note 1 in 100 (incidents/operation) One event (incident) per 100 operations (takeoffs and landings) 1 incident per 100 operations is approximately 1 incident in 50 departures 0.01 incidents per operation One percent chance of occurring an accident/incident per operation 0.01 chance incidents per operation is similar to saying 0.02 incidents per departure 1% incidents per operation One percent chance of occurring an accident/incident per operation 1% incidents per operation is similar to saying 2% incidents per departure 1 x 10-2 incidents per operation One incident per 100 operations (takeoffs and landings) This is scientific notation and 1 x 10-2 is similar to 1/100, or 0.01, or 1% 5 x 10 -3 incidents per operation Five incidents per 1,000 operations This is scientific notation and 5 x 10-3 is similar to 5/1000, or 0.005, or 0.5% Events per operation. Notation Example Description Note 1 incident in 10 years or 1 in 10 years One incident is expected to occur in 10 years assuming conditions remain constant It is wrong to assume that no event is expected in the next 10 years. The event may take place tomorrow or it may take many more years beyond 10 years to occur Events per period. Types of Events Mutually Exclusive Events: These are events that cannot occur at the same time. It is unlikely that a runway overrun will occur following a runway undershoot and these two events can be assumed as mutually exclusive. In another example, aircraft damage and injury to passengers may result from an aircraft accident; in this case, the events are not mutually exclusive.

Basic Probability and Statistics for SRM 205 Complementary Events: These are events that have two possible outcomes. The probability of event A plus the probability of A′ equals one. P(A) + P(A′) = 1. Any event A and its complemen- tary event A′ are mutually exclusive. Heads or tails in one toss of a coin are complementary events. Independent Events: These are two or more events for which the outcome of one does not affect the other (i.e., the events are not dependent on what occurred previously). Each toss of a fair coin is an independent event. Conditional Events: These events are dependent on what occurred previously. If a plane catches fire on the ground during a taxiway operation, there is a chance of fatalities due to the fire. The number of fatalities depends on the severity of the fire and the effectiveness of the emergency response. Probability Calculations Sometimes it is necessary to calculate the total probability that two events will occur simul- taneously or in succession. For example, if we know that the probability of an aircraft over- running a runway is 1 in 1 million operations and that approximately 20% of those incidents result in accidents, we can calculate the probability that an overrun accident occurs. In this case, the probability is calculated by the product of the two probabilities. The first step is to identify different types of events for which the probability will be calculated, as follows: • Mutually Exclusive Events: These are events that cannot occur at the same time. It is extremely improbable that a runway overrun will occur following a runway undershoot and these two events can be assumed as mutually exclusive. In another example, aircraft damage and injury to passengers may result from an aircraft accident; in this case, the events are not considered mutually exclusive because damage to aircraft may cause injury to passengers. • Complementary Events: These are events that have only a few possible outcomes. For example, an event may have outcome A or B. The probability of event A plus the probability of B equals one. P(A) + P(B) = 1. Any event A and its complementary event B are mutually exclusive. Heads or tails in one toss of a coin are complementary events. • Independent Events: These are two or more events for which the outcome of one does not affect the other. They are events that are not dependent on what occurred previously. Each toss of a fair coin is an independent event. • Conditional Events: These are events that are dependent on what occurred previously. If a plane catches fire on the ground during a taxiway operation, there is a chance of fatalities due to the fire. The number of fatalities depends on the severity of the fire and the effectiveness of the emergency response. Sometimes an airport wants to estimate the total probability of an accident occurring at the ramp. It involves accidents involving people, aircraft, vehicles, and equipment that have occurred on the ramp within a certain period. Total Probability Sometimes it is necessary to calculate the total probability that an event may occur and it is possible to add the probabilities if the events are mutually exclusive. An airport may define a safety performance indicator as the probability of an accident at the ramp. The probability is estimated by adding the probabilities for each type of accident on the ramp. P (A) is the probability that accident A type occurs P (B) is the probability that accident B type occurs

206 A Guidebook for Safety Risk Management for Airports P (C) is the probability that accident C type occurs P (A or B or C) = P (A) + P (B) + P (C) For example, historical data available at an airport were used to calculate the probability of birdstrikes. The chance of a birdstrike during a landing operation is approximately 1.3 bird- strikes per week and the probability that a birdstrike takes place during a departure is 1.1 per month. The airport wants to find the probability of a birdstrike during any movement (arrival or departure). In this case, the events are mutually exclusive; either a landing or takeoff operation and the total probability can be calculated by adding the probabilities. However the probabilities are presented in different units: incidents per week, and incidents per month. The first step is to make the units uniform. We can say that 1 month has approxi- mately 4 weeks and 1.3 birdstrikes per week represents 5.2 birdstrikes per month. We can now add the probabilities and obtain 6.3 birdstrikes per month as the chance of a birdstrike during any operation. Probability of Simultaneous Events As shown in the example presented for aircraft overruns, sometimes it is necessary to estimate that two events take place during the same incident. The probability of events A and B occurring simultaneously is the probability of event A multiplied by the probability of event B, if the events can be assumed independent. In mathematical notation: P (A & B) = P (A) × P (B) Using the example for runway overrun: P (A) = 1/1,000,000 = 0.000001 overruns per operation (probability of a runway overrun) P (B) = 20% = 0.2 (percentage of overruns that result in accidents) P (A & B) = P (A) × P (B) = 0.000001 × 0.2 = 0.0000002 overrun accidents per operation (probability of an overrun accident) Although the consequences of an overrun are associated with the speed that the plane departs the runway, we are using two independent probabilities for the calculation: the rate (or prob- ability) of overruns and the percentage of accidents during overruns.

Abbreviations and acronyms used without definitions in TRB publications: A4A Airlines for America AAAE American Association of Airport Executives AASHO American Association of State Highway Officials AASHTO American Association of State Highway and Transportation Officials ACI–NA Airports Council International–North America ACRP Airport Cooperative Research Program ADA Americans with Disabilities Act APTA American Public Transportation Association ASCE American Society of Civil Engineers ASME American Society of Mechanical Engineers ASTM American Society for Testing and Materials ATA American Trucking Associations CTAA Community Transportation Association of America CTBSSP Commercial Truck and Bus Safety Synthesis Program DHS Department of Homeland Security DOE Department of Energy EPA Environmental Protection Agency FAA Federal Aviation Administration FHWA Federal Highway Administration FMCSA Federal Motor Carrier Safety Administration FRA Federal Railroad Administration FTA Federal Transit Administration HMCRP Hazardous Materials Cooperative Research Program IEEE Institute of Electrical and Electronics Engineers ISTEA Intermodal Surface Transportation Efficiency Act of 1991 ITE Institute of Transportation Engineers MAP-21 Moving Ahead for Progress in the 21st Century Act (2012) NASA National Aeronautics and Space Administration NASAO National Association of State Aviation Officials NCFRP National Cooperative Freight Research Program NCHRP National Cooperative Highway Research Program NHTSA National Highway Traffic Safety Administration NTSB National Transportation Safety Board PHMSA Pipeline and Hazardous Materials Safety Administration RITA Research and Innovative Technology Administration SAE Society of Automotive Engineers SAFETEA-LU Safe, Accountable, Flexible, Efficient Transportation Equity Act: A Legacy for Users (2005) TCRP Transit Cooperative Research Program TEA-21 Transportation Equity Act for the 21st Century (1998) TRB Transportation Research Board TSA Transportation Security Administration U.S.DOT United States Department of Transportation

TRA N SPO RTATIO N RESEA RCH BO A RD 500 Fifth Street, N W W ashington, D C 20001 A D D RESS SERV ICE REQ U ESTED ISBN 978-0-309-30865-6 9 780309 308656 9 0 0 0 0 N O N -PR O FIT O R G . U .S. PO STA G E PA ID C O LU M B IA , M D PER M IT N O . 88 A G uidebook for Safety Risk M anagem ent for A irports A CRP Report 131 TRB