Welcome to the Air Traffic Organization (ATO) Safety Management System (SMS)
and Safety Risk Management (SRM) Safety Stakeholders briefing.
All stakeholders have a responsibility to support and strengthen the existing safety culture.
Without a robust safety culture, the SMS is unsustainable.
This briefing is divided into two parts.
Part one will provide a high-level overview of the structure and requirements of the ATO SMS.
Additionally, it will introduce how the ATO coordinates with stakeholders
to execute the SRM component of the SMS.
Part two provides further detail on the SRM process
and insight into why the ATO SMS matters.
It will illustrate how safety stakeholders can support the ATO safety
culture by building trust and rapport among industry and Agency peers.
The purpose of this briefing is to inform safety stakeholders about the benefits
of the ATO SMS and the goals of the ATO SRM process.
At the end of part one stakeholders will be able to
identify strategies that support a robust safety culture,
define the SMS, including its goals, requirements, and components,
and review the goals and objectives of SRM.
At the end of part two stakeholders will be able to
recognize when the ATO SRM process is required
and how safety decisions affect operations,
and participate effectively in SRM panels
with an understanding of how the ATO identifies and addresses safety risk
within the National Airspace System (NAS).
Review the references for this briefing.
Review the references used in the creation of the
Deepwater Horizon video contained in this briefing.
The ATO SMS is a formalized approach to system safety.
The FAA’s mission is “to provide the safest,
most efficient aerospace system in the world.”
Encouraging employees to recognize unsafe conditions and situations
in an effort to proactively manage risk
is an indicator of a transparent and strong safety culture.
If employees are encouraged to participate
in identifying and treating safety challenges,
they are better prepared to prevent hazardous situations
that can lead to catastrophic accidents.
(music playing)
On April 20, 2010, 50 miles off the coast of Louisiana in the Gulf of Mexico,
(explosion) an explosion ripped through the BP Deepwater Horizon oil drilling rig.
The blast killed eleven people and injured many more.
Over the following years, several committees investigated the causes of the disaster,
including a President-appointed Commission
and the United States Coast Guard.
Both reports describe the sequence of events that occurred
on the Deepwater Horizon oil rig that day.
The hydrocarbon pressures in the well increased, causing backflow onto the rig.
Then, the blowout preventer failed which stopped the well from properly sealing.
Without that seal, oil and gas flowed nonstop from the well to the rig.
(explosion) The escaping methane gas ignited, and the rig exploded.
The oil spilled from the well for 87 days before BP successfully capped the well.
In total, the well released approximately five million barrels of oil into the Gulf.
The spill threatened the livelihoods of thousands of people and inflicted damage
to precious habitats and wildlife that took years to repair.
Why did this happen? In the Presidential Commission’s final report,
Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling,
the Commission concluded that the Deepwater Horizon disaster could have been prevented
and revealed “such systemic failures in risk management
that they place in doubt the safety culture of the entire industry.”
The Coast Guard reported similar findings, stating in Deepwater Horizon, Volume 1,
that the accident occurred because of “serious safety management
system failures and a poor safety culture.”
The Coast Guard report indicates that the Deepwater Horizon
and Transocean, the owner of the well,
had an extremely compromised safety culture.
The investigation showed numerous safety deficiencies, including
code violations,
a poor maintenance record,
and a history of safety incidents.
Transocean “failed to ensure that the management team
and crew had sufficient training and knowledge to take
full responsibility of the vessel,”
and they “failed to require that the systems
in place and the personnel emphasize maximum emergency preparedness.”
The devastating oil spill on the Deepwater Horizon
did not have to end eleven lives
and cause significant harm to the Gulf ecosystem.
Both reports recommended that in order to protect human safety
and provide environmental protection in the future,
the oil and gas industry must create a new approach
to risk assessment and safety management
and support a more robust safety culture.
As the Deepwater Horizon tragedy has shown us,
supporting and maintaining a robust
safety culture is absolutely imperative.
That means continuously thinking about safety in our day-to-day activities
and realizing the potential impact of our safety-related decisions.
Safety culture is the way safety is perceived and valued within an organization.
It directly correlates to the safety performance of the NAS
and can be the deciding factor on whether safe air navigation services
are delivered to the flying public.
The ATO’s safety culture must adhere to the following standards:
Reporting and Just Culture
Provides an avenue for employees to identify safety concerns
Ensures that employees feel comfortable and safe from punitive action when
reporting hazards, incidents, and concerns
Supports voluntary safety reporting programs
that allow front line employees
to confidentially report incidents or safety concerns within the NAS
Learning and Informed Culture
Utilizes lessons learned from past events to mold future decisions,
Optimizes safety intelligence to identify trends,
and analyzes safety intelligence and advises decision makers
to ensure data-driven decisions are made
Finally, a Flexible Culture
Adapts to new entrants in the NAS and changing demands
and adjusts to gathered safety intelligence
Ultimately, safety must be made a priority
in an effort to avoid catastrophic consequences,
such as the Deepwater Horizon disaster.
It’s every stakeholder’s responsibility to continue to support and strive
to strengthen the existing safety culture throughout the ATO.
Stakeholders may consider these additional strategies.
Encourage engagement across Agency and safety stakeholders;
examples of this may include training,
sharing lessons learned, and best practices.
Ensure participants have a willingness to solve difficult safety challenges.
Promote transparency, and prioritize safety above programmatic,
financial, or efficiency concerns.
Without a robust safety culture,
the ATO SMS is unsustainable.
The ATO SMS is an integrated collection of policies,
programs, processes,
and procedures used to identify and address
safety hazards in the NAS.
The ultimate goal of the ATO SMS is to maintain an acceptable level of risk
within the ATO’s provisioning of the following services:
air traffic management, communication,
navigation, and surveillance.
The ATO leads the FAA in the implementation and continued maturity of the SMS.
The ATO SMS provides a formalized, repeatable, and systematic process to
identify and manage safety risk,
reduce isolated analysis and decision-making,
and ensure that all stakeholders are accountable for safety.
FAA Order JO 1000.37 states:
“…The ATO develops, implements, and maintains processes,
tools, and guiding principles within the framework
of a SMS to ensure that performance-based NAS safety goals are achieved.
The ATO ensures that the management of safety
is a primary and defined responsibility
of all managers and employees.”
The SMS was established to ensure that NAS equipment, operations,
procedures, and changes meet or exceed acceptable safety levels.
The SMS relies on four key elements for success.
First, it requires communication about,
and management of, potential and actual risks in the system.
Second, to be effective,
the SMS must be data-driven with decisions based on informed expertise.
Third, continuous monitoring is required
to ensure that mitigations function as intended
to address safety risks associated with a particular NAS change or existing safety issue.
Finally, the SMS reduces isolated decision-making
by using a common framework to identify risks and address hazards.
The ATO SMS is made up of four components:
Safety Policy, Safety Promotion,
Safety Risk Management, and Safety Assurance.
The key to successful implementation of the ATO SMS
is a robust Safety Culture wherein all stakeholders
in the system communicate effectively and work to support
all four of these components.
Safety Culture is defined as the way safety is
perceived and valued in an organization.
Safety Policy is the foundation for every step that is taken
to ensure the safety of the NAS operational environment. It serves to
formalize processes and procedures that are already in place.
Safety Policy is socialized through Safety Promotion.
This is the communication of information to ensure the safety of the NAS.
Safety Promotion fosters a positive safety culture
in which ATO employees understand why safety is important and how they affect it.
Safety Assurance is the performance-oriented component of the SMS.
Safety assurance entails collecting and assessing data to assess
performance of safety measures and to identify safety trends.
Safety Risk Management (SRM)
is the process that is used to identify and address safety
risk with regard to air traffic management,
and communication, navigation, and surveillance services.
It is a common misconception that SMS and SRM are synonymous;
however, SRM is only one component within the ATO’s SMS.
SRM complements Safety Assurance.
There is a closed-loop system between SRM and Safety Assurance.
Identifying safety hazards associated with a NAS change
and addressing those hazards via SRM make it possible to
proactively detect sequences of events where system deficiencies
could lead to an incident or accident before it actually occurs.
Safety Assurance includes monitoring operational data, analyzing the system,
and reporting safety issues to analyze the chain of events
that led to an accident or incident.
SRM and Safety Assurance would not be effective
in managing NAS safety if they worked in isolation.
SRM is the process that is used to identify and address safety risk
with regard to air traffic management, and communication,
navigation, and surveillance services.
Remember, SRM is only one component of the ATO SMS.
SMS and SRM are not interchangeable terms.
There are other Safety Management Systems throughout the FAA
that look at safety from different purviews;
for example, Project Management, Airport Construction, etc.
If there is a cross-organizational safety issue in the FAA,
FAA Order 8040.4, Safety Risk Management Policy,
offers guidance on how to proceed.
The ATO SMS is a roadmap to ensuring system safety in the NAS.
The ultimate goal of the ATO SMS
is to maintain an acceptable level of risk within the ATO’s
provisioning of air traffic management,
communication, navigation, and surveillance services.
SRM informs decision makers about potential hazards,
risks, and means to reduce risk
associated with a particular NAS change
or existing safety issue,
and facilitates communication and coordination
across FAA organizations
for enhanced safety risk decision-making.
This briefing detailed the importance of building and supporting
a robust ATO safety culture,
as well as strategies to support and maintain its effectiveness.
It provided an overview of the structure and requirements of the ATO SMS,
and how the ATO coordinates with stakeholders to execute
the SRM component of the SMS.
Part two will provide further details on the SRM process and insight
into why the SMS matters to all safety stakeholders.
It will illustrate how safety stakeholders can support
the ATO safety culture by participating in the
SRM process and building trust and rapport
among industry and Agency peers.
The ATO strives for continuous improvement of our SMS
through communication and coordination with all our safety stakeholders.
For questions regarding SMS policy application or recommendations
for changes to SMS policy,
please contact 9-AJI-SMS@faa.gov.