Safety Management System

Table of Contents

  1. Revision Record, Coordination and Control
    1. REVISION RECORD
    2. COORDINATION
    3. CONTROL
  2. Four Components of Safety Management
    1. GENERAL
    2. SAFETY POLICY
    3. SAFETY RISK MANAGEMENT (SRM)
    4. SAFETY ASSURANCE (SA)
    5. SAFETY PROMOTION
  3. Safety Policy and Objectives
    1. GENERAL REQUIREMENTS
    2. SAFETY PLANNING
    3. COMPLIANCE WITH LEGAL AND OTHER REQUIREMENTS
    4. PROCEDURES AND CONTROLS
    5. SAFETY POLICY
    6. SAFETY POLICY REVIEW
    7. MANAGEMENT RESPONSIBILITY AND KEY SAFETY PERSONNEL
    8. EMERGENCY PREPAREDNESS AND RESPONSE
    9. SMS DOCUMENTATION AND RECORDS
  4. Safety Risk Management
    1. GENERAL
    2. SRM PROCESSES
    3. SRM TRIGGERS
    4. SYSTEM DESCRIPTION AND TASK ANALYSIS AND HAZARD IDENTIFICATION
    5. IDENTIFY HAZARDS
    6. RISK ANALYSIS, ASSESSMENT AND CONTROL
    7. CONTROL/MITIGATE SAFETY RISK
  5. Safety Assurance
    1. GENERAL REQUIREMENTS
    2. SAFETY PERFORMANCE MONITORING AND MEASUREMENT
    3. INVESTIGATION
    4. REPORTING AND FEEDBACK SYSTEM
    5. ANALYSIS OF DATA
  6. Safety Promotion
    1. KEY SAFETY PERSONAL
    2. COMPETENCIES AND TRAINING
    3. COMMUNICATION AND AWARENESS
  7. Appendix A
    1. FIGURE 1 - RISK MATRIX
    2. FIGURE 2 - SRM DOCUMENTATION

1. Revision Record, Coordination and Control

  1. Revision Record
    1. A summary of each revision to the Purdue University Safety Manual is provided in the table that follows this paragraph. The date listed in the header of this manual will be updated with each manual revision.
  2. Coordination
    1. Revisions to this manual will be incorporated in accordance with continued development of the SMS and continuous improvement. Proposed changes that affect SMS procedures or output will be provided to the Safety Committee for input and review in advance of revision publications.
    2. In order to prevent deviation from the guidelines outlined in 14 CFR Part 5, the School’s Program leads will coordinate changes to the programs SMS with the Program Manager, Aviation Safety prior to all revisions. Programs shall document applicable Safety Manual revisions within one manual revision cycle from the published date of this manual.
  3. Control

    1. This manual is only current in its electronic format. Once printed, it is to be used for reference only, as indicated on the printed version.

      Log of Revisions

      When necessary, the Program Manager of Aviation Safety may issue revisions. These revisions shall be placed in the safety manual and maintained until a new version of this manual is approved. When a change is posted it shall be recorded, dated, and signed on the Log of Revisions below:

      Revision NumberDate InsertedAuthor
      Original Issue08/20/18Stephanie Brown
         

      Explanation of Changes

      When a Revision is logged on the previous page, a further explanation of the changes can be found in this section. Being the first iteration of this SMS there are no changes to log as this is the first iteration of the document.

2. Four Components of Safety Management

  1. General
    1. The SMS consists of four basic components, which are essential for a safety-oriented management system. This manual describes how the corporate processes are structured to ensure compliance with SMS requirements. School program SMS documentation includes safety management processes specific to their program, in accordance with this document and the four pillars
  2. Safety Policy
    1. All management systems must define policies, procedures, and organizational structures to accomplish their goals. These elements are outlined and documented within this manual and the program manual’s systems to provide the framework for the SMS functional elements.
  3. Safety Risk Management (SRM)
    1. This pillar is comprised of hazard identification and safety risk management procedures to control risk to the acceptable levels.
  4. Safety Assurance (SA)
    1. Once mitigation or controls are developed and implemented as an output of SRM processes, the organization must ensure they are continuously practiced and effective in changing environment. The safety assurance function reinforces the use of quality management concepts, continuous improvement, and other measurement and control processes.
  5. Safety Promotion
    1. School of Aviation and Transportation Technology (SATT) must promote safety as a core value with practices that support a sound safety culture. This component raises the level of safety awareness within the organization and fosters confidence that safety actions are taken in response to reported concerns in order to reduce safety risk and ensure the overall health of the school.

3. Safety Policy and Objectives

  1. General Requirements
    1. Safety at Purdue University is an attitude and culture that must permeate the entire organization. It is the responsibility of each and every individual including; the administration, faculty, professional and support staff, and students.
    2. Processes and procedures are documented within this manual section. SMS processes and procedures are documented, monitored, measured and analyzed as defined within this manual.
      • Flight Operations
      • Aviation Engineering Technology (AET)
      • Unmanned Aerial Systems (UAS)
      • Management
    3. Each school program in SATT has the responsibility to include the components of SMS in the scope and life cycle of their operations, including their respective training.
    4. All SMS outputs are recorded, monitored, measured and analyzed in accordance with this manual and 14 CFR Part 5. These document control processes and the record retention policy ensure traceability and historical record of safety action according to the SMS operating procedures.
    5. SATT promotes a positive safety culture as detailed in Section 6 of this manual.
  2. Safety Planning
    1. As directed by the Head of School for SATT, the Program Manager of Aviation Safety will coordinate the implementation and maintenance of SMS for the School.
    2. Each program will establish an organizational structure that supports this manual, and complies with 14 CFR 5. The structure and procedure for each program are documented in their operating manuals.
    3. All school, program goals, and metrics will be utilized to track the performance objectives of the Safety Policy and SMS. These objectives are monitored to ensure a safe environment to operate in. The metrics and goals that are used to monitor objectives are tracked within the review meetings, as indicated in Section 6 and are reviewed and revised by the Program Manager, Aviation Safety and the Safety Committee to ensure relevance and continuous improvement.
  3. Compliance with Legal and Other Requirements
    1. The Program Manager, Aviation Safety ensures that all components of the SMS comply with, establish and maintain all safety-related legal and regulatory requirements. These include, but are not limited to:
      • Federal Aviation Regulations and Advisory Circulars
      • ICAO Regulations (Annex 13 & 19)
      • NTSB Regulations (14 CFR 49 Part 830-831)
      • Purdue University Policies and Procedures
  4. Procedures and Controls
    1. The School maintains procedures to accomplish the objectives of the Safety Policy. This document addresses details on the planning and implementation process to support the safety management policies and objectives. This document will serve as the SMS policy and guidance for the School. Program level procedures shall describe how these requirements are met, in compliance with this document and 14 CFR Part 5.
  5. Safety Policy
    1. The School’s Safety Policy outlines the scope of the Safety Management System. The policy is established and signed by the accountable executive, Head, School of Aviation and Transportation Technology. The most current version of the Safety Policy is located in this document.
    2. Safety Objectives
      1. Safety overrides any other consideration at the School, and has established safety objectives to ensure continuous monitoring and improvement of our safety performance.
      2. The primary safety objective is to identify and monitor safety risks and to mitigate those risks to a level that is as low as reasonably practical. This is achieved, in part, by setting measurable enterprise goals and objectives which are monitored via the management review processes.
      3. Examples of enterprise Safety metrics (objectives) include:
        • Risk Level 3 – Measures the rate of unacceptable risk to the School as defined by the SMS Risk Matrix scale of 1 through 5. Risk level 3+ event rate goals are set annually.
        • Aircraft Ground Damage (AGD) – Goal rates for the AGD events are set annually. AGD rates are monitored against established targets via the management review processes.
        • Injuries – Goal rates for injuries are also set annually and monitored via the management review process.
    3. Commitment to Fulfill Safety Objectives
      1. The School’s Safety Policy documents the accountable executive’s commitment to fulfil the safety objectives and to provide human and financial resources necessary to implement and maintain the SMS.
    4. Student/Employee Responsibilities
      1. The Safety Policy requires and encourages employees to report safety hazards or incidents and supports the non-punitive reporting system in all areas where operations are conducted. With the exception of illegal activities or intentional disregard for regulations, policies, or procedures, no student/employee will ever be disciplined for reporting a safety hazards or events.
      2. All students and employees are empowered and expected to stop an operation anytime something appears to be unsafe, and will not face retribution for doing so.
    5. Emergency Response
      1. The School will employ an emergency response plan that provides for the safe transition from normal to emergency operations and back to normal in accordance with the requirements 14 CFR part 5.27 and section 3.8
      2. The emergency response plan is documented in the Purdue University School of Aviation and Transportation Technology Emergency Response Guide.
  6. Safety Policy Review
    1. The Program Manager, Aviation Safety will ensure the Accountable Executive reviews the Safety Policy at least annually to ensure continuous improvement and applicability.
  7. Management Responsibility and Key Safety Personnel
    1. This section will define, document, and communicate the safety roles, responsibilities, and authorities throughout the School of Aviation and Transportation Technology. An organizational chart is provided at the end of this section.
    2. The Department Head is the accountable executive at the School of Aviation and Transportation Technology who has the ultimate responsibility and final authority for the certificated flight school’s safe operations within the SMS. Including the items listed below.
      • Ensure that the SMS is properly implemented and performing in all areas of the School.
      • Ensure human and financial resources essential to implement and maintain the safe operations within the SMS.
      • Regularly review the safety performance of the School and direct actions necessary to address substandard safety performance.
      • Establish, regularly review and rives the safety policy included the importance of student/employee reporting programs.
    3. The Program Manager, Aviation Safety will be responsible for the following:
      • Ensure that the SMS is properly implemented and performing in all areas of the School.
      • Regularly review the safety performance of the School and direct actions necessary to address substandard safety performance.
      • Ensure the process needed for the SMS are established, documented, implemented and maintained.
      • Ensure the promotion and awareness of safety through the School.
      • Report to the Accountable Executive on the performance of the SMS and the need for improvement.
      • Support operating programs in the implementation of SMS.
      • Ensure hazard identification and risk analysis are performed.
      • Ensure effectiveness of safety risk controls.
    4. All Safety Committee members have the authority to carry out the duties listed below, delegated to them by the Head of the School / Program Manager of Aviation Safety:
      • Identify hazards in their operation
      • Promote safety in their programs
      • Assess safety risks
      • Ensure effectives of safety risk controls
      • Advise the Program Manager, Aviation Safety on the performance of the SMS and needs for improvement.
    5. ​All members of the full time staff, Captains, and Instructors in each School program have been given the authority by the Head of the School / Program Manager of Aviation Safety to implement, document maintain and continuously improve their SMS processes with the support of and in coordination with Safety Programs. This in includes following duties.1
      • Support the Program’s Safety Committee member with development, implementation, maintenance and improvement of the SMS in relations to their responsibilities within the organization. Ensure SMS procedures are followed in adherence with this and program guidance.
      • Inform the Program Manager of Aviation Safety on the performance of the SMS and the need for improvement.
      • Identify hazards in the operation.
      • Promote safety in their program.
      • Assess safety risks
      • Ensure the effectiveness of safety risk controls.​
         
  8. Emergency Preparedness and Response
    1. The emergency response procedures for the delegations of emergency authority, assignment of responsibilities, and coordination with external affected organizations are documented in the Purdue University School of Aviation and Transportation Technology Emergency Response Guide.
  9. SMS Documentation and Records
    1. This manual provides Safety Management System policy and procedures and set expectations for a comprehensive safety plan. The Program Manager, Aviation Safety is responsible for the quality of the document and records process as it relates to this manual. Each program is responsible for performing the document and records process within their manual systems, and in accordance with this manual.
    2. School of Aviation and Transportation Technology has documented the following procedures.
      • The Safety Policy – Documented on page one in Figure 1 of this manual. Safety policies are documented throughout this manual and in program policy and procedure manuals.
      • Safety objectives – are documented in in the Safety Policy section of this manual titled Safety Objectives.
      • SMS expectations are documented through this manual within program procedure documentation.
      • Safety and SMS procedures, processes, accountabilities, responsibilities and authorities as details in this manual and program manual systems, which include interactions and interfaces between safety-related procedures and policies. Safety risk controls and safety process and procedures that are in place to ensure safety are documented in this manual and program procedures and manual systems.
      • SMS outputs are documented in accordance with this sections and are described within each section in detail.
    3. Document management will be accomplished in accordance with the procedures described in this manual and in accordance with 14 CFR Part 5. This document will be legible, dated, readily identifiable, and maintained in an orderly manner. The original of each revision will be retained in the following network location: Z:\Safety Management System (SMS)\Safety Programs\SMS Manual. Copies will be shared with Programs via the Safety Committee meetings. The date will be added to the title for easy retrieval. Revisions will be saved for a minimum of five years.

4. Safety Risk Management

  1. General
    1. This process is used to understand critical characteristics of systems and their sub-systems including activities, resources, and operational environments and to use this knowledge to identify hazards, analyze and assess risk, and design risk controls. Reviews such as operational meetings, review boards provide a venue to channel identified risks along with change management producers. The SRM form will be used to document and track safety risks identified during changes or modification to the operational processes within the school. The SRM process can be used in 3 ways: reactive, proactive and predictive.
      • The reactive use of SRM is in response to a hazard or ineffective risk control found through the Safety Assurance (SA) process, often an investigation, or that has led to a negative outcome or consequence within the operation (Ex: aircraft damage or injury).
      • The proactive use of SRM includes SA inputs to identify changes in the operation that could lead to new hazards and to identify controls that are no longer effective for correction prior to a negative outcome, and to analyze proposed changes to identify potential hazards for correction prior to implementation.
  2. SRM Processes

    1. A. System Description and Task Analysis (used for proposed changes)

      B. Hazard Identification

      C. Safety Risk Analysis (C and D are referred to as “SRA”)

      D. Safety Risk Assessment

      E. Safety Risk Control or Mitigation

  3. SRM Triggers

    1. The SRM Process is initiated by the following “triggers”.

      A. New or revised process or procedures

      B. New or revised operation or environment

      C. New or revised system, organization or resources

      D. New or revised product or service

      E. New hazards (identified in the SA functions)

      F. Ineffective risk controls (identified in the SA function)

    2. The changes listed below often do not constitute an SRM “trigger”. If they are not changing the system. SRM triggers will be considered for the following changes to determine if they affect the work being performed by members of the school, their environment and resources. If there is no impact, SRM will not be performed for the changes that are isolated to the list below.

      A. Editorial changes to correct typographical errors with no safety impact (ex. Spelling or grammatical)

      B. Changes to add, delete, update or correct electronic links

      C. Changes to standardize title of personnel, forms, etc.

      D. Editorial/format changes that do not affect the intent of the document

      E. Changes to data or text that do not impact the process or actions performed

  4. System Description and Task Analysis and Hazard Identification
    1. System Description/Task Analysis and Hazard Identification will be performed for the triggering events listed in section 4.3. Perform these steps to ensure an understanding of the current scope of the system being changed, the impact of the change on the function, resources and environment, and the hazards that could be introduces as a result.

    2. The System Description and Task Analysis will be detailed enough to

      A. Identify hazards

      B. Develop operational procedures

      C. Develop and implement risk controls

    3. The System Description and Task Analysis answers the following three questions.

      A. What is the current system/sub-system, tasks (process/procedures, environment, resources needed) and their interface with each other?

      B. What is being changed or introduced?

      C. What is the impact? (leads to hazard identification)

  5. Identify Hazards

    1. Hazard identification is the output of the System Description and Task Analysis and Task Analysis (for proposed changes) or the output of the System Assessment within the Safety Assurance (SA) process (where a new hazards or ineffective risk controls is identified).

      Definition of a hazard is a condition that might cause (is a prerequisite to) an incident or accident.

  6. Risk Analysis, Assessment and Control
    1. The purpose of these steps is to estimate the severity and likelihood of an outcome (incident or accident) associated with each identified hazard, acceptability of the risk level and the need for risk control.
    2. Analyze and Assess Safety Risk
      1. The analysis will consider the credible outcome associated with the hazard to determine “how likely?” it is to occur and “how bad?” it would be. The assessment will quantify the outcome in terms of severity and likelihood and determine acceptability.
      2. Individuals who are authorized to perform safety risk analysis, assessment and acceptance decisions are defined in the training requirements section.
    3. Safety Risk Analysis determines the severity and likelihood of the potential outcome) incident or accident) associated with each hazard. This step considers the condition that is being created, introduced or is present from the System Description/Task Analysis or from the System Assessment, and what could reasonably result. Considerations include existing risk controls and their effectiveness, triggering mechanisms that could affect the hazardous condition and result in a negative outcome, as well as a credible outcome that could result. The severity and likelihood associated with the credible outcome are evaluated.
      1. The outcome should be credible. If multiple outcomes are possible, the worst credible outcome (not worst case scenario) should be used. For example, while there is a rare potential for a bird strikes to result in critical or catastrophic incidents, that is worse – case scenario, not a credible outcome. The worst credible outcome is often aircraft damage. Considerations to determine this would include types and number of birds at the location. It is important to identify they credible outcome that could reasonably occur to ensure that we are adequately protected against it. Do not assume a worst case scenario since that would mean that all controls have failed. In most cases, this would not result in a credible outcome. It is equally important to not assume that what has always happened will continue to happen, especially if a change is being introduced.
      2. Consider rate of exposure to the hazard. Analysis can be qualitative and/or quantitative, based on a combination of experience, judgment, and data from within the school and the industry (when needed). It is important to not only look at the past, but also to look at what we anticipate in the future based on operational performance. Consider whether we have avoided outcomes because we are good (strong procedures/controls) or lucky.
    4. Safety Risk Assessment uses the SMS Risk Matrix to select severity and likelihood that describe the outcome of the hazard and to determine whether the risk is acceptable
      1. Risk assessment is a core component of SMS and is used to assist management in making decisions that impact safety. The purpose of conducting a formal safety risk assessment is to prioritize items competing for limited resources and to identify hazards requiring special handling.
  7. Control/Mitigate Safety Risk
    1. Once hazards and their risks are fully understood, risk controls/mitigation plans are developed for each risk that is unacceptable (levels 3 and higher). Mitigation strategies shall be developed no later than 30 days after designated as risk level 3 or higher. For lower risks, the goal is to reduce risk to “As Low as Reasonably Practical” (ALARP). Areas for consideration for mitigation plan are risk controls and procedural changes.
    2. Revised Risk (Predicted Residual Risk and Substitute Risk)
      1. Prior to implementation of new Risk Controls or the mitigation plan, the revised risk will be assessed to determine if the risk will be reduced to an acceptable level if added to the current environment. The risk control and mitigation plan will be ready to use in its intended environment when evaluating what the revised risk will be following implementation. The revised risk considers the impact of the mitigation plan/controls to address the initial risk (predicted residual risk) and whether any new risks substitute risks) will be introduced unintentionally. The components that determine the revised risk, are the current operation, predicted revised risk and substitute risk.
    3. Implementation and Monitoring Plan
      1. The change is placed into the operation when the predicted revised risk level is acceptable, considering the mitigation plan with controls in the intended environment. The SA processes are used to monitor the risk controls to ensure they continue to be implemented as designed and continue to be effective.
    4. Promotion and Lessons Learned
      1. Safety Promotion and Improvement, consider any safety promotion opportunities and way to share lessons that have been identified as a result of the SRM. The lessons learned can provide valuable insight across the School that will help explain the ‘why’ to affected students, faculty, staff.
    5. Approval
      1. Present the following to the individual with the authority to accept the initial risk level within the School prior to implementation. This may be accomplished by directing the individual to the record within the SRM documentation.

5. Safety Assurance

  1. General Requirements

    1. The School monitor, measure and evaluate performance in order to:

      A. Identify new hazards

      B. Measure the effectiveness of and conformity with described risk controls (including those developed during the SRM process descried in section 4) to ensure they conform to the described requirements and maintain risk at or below acceptable levels.

      C. Ensure compliance with regulatory requirements.

    2. Information Acquisition

      The Safety Assurance processes collect and analyze data from multiple sources. These include, but are not limited to, the sources identified in this section. The ability to gather and analyze pertinent safety and operational data enables the School to continuously monitor the safety heath within the School and effectiveness of the SMS. Information will be collected in order to demonstrate the effectiveness of the following:

      A. Operational processes and their effectiveness

      B. Safety risk controls – effectiveness and conformance with

      C. SMS processes and output

  2. Safety Performance Monitoring and Measurement

    1. Continuous Monitoring

      A. The School will ensure conformity with and measure the effectiveness of safety risk controls and operational processes, and will assess SMS performance in order to identify hazards.

      B. The School will periodically monitor their operating environment to detect changes which could potentially introduce hazards.

      C. The School will continuously monitor the data identified in section 5.

      D. Results of data analysis and continuous monitoring are reviewed in the monthly Safety Committee meeting.

  3. Investigation
    1. The School collects data on incidents, accident and potential non-compliance and investigates in order to identify and correct new hazards and ineffective risk controls.
  4. Reporting and Feedback System
    1. The School will maintain a confidential safety reporting and feedback system using paper and electronic reporting system. The system allows students, faculty and staff members to report hazards, issues, concerns, occurrences, incidents, and propose solutions and safety improvements. All members are required to report observed safety hazards and incidents, and may use these systems without fear of reprisal, per the Safety Policy. Data from these sources is maintained and tracked within the safety data platform. Aggregate data collected is used in the analyses described in section 9.8.
  5. Analysis of Data
    1. Analysis involves the examination of data acquired from the sources listed in section 5.5.2 to make decisions about safety performance of the operation and of the SMS. It is important to use the data available to look across these various sources for trends to learn from the information available.

    2. The data summarized below, will be used to assess the performance and effectiveness of operational procedures, safety risk controls and the SMS to identify root cause of non-conformance and to identify new or potential hazards. This information will be sued to identify opportunities for improvement. Each program will use the inputs from the list below that are applicable to their operation.

      A. Safety Reports

      B. Investigations

      C. Input from subject matter experts

      D. Training analysis

      E. Data regarding operations, products, services

      F. Industry sources

      G. Performance of the SMS procedures and its outputs

    3. Analyses can be categorized as the following:

      A. Standard metrics

      B. Summary reports

      C. Trend analysis

      D. Event sequence analysis

      E. Facilitation of risk assessments

6. Safety Promotion

  1. Key Safety Personal

    1. Management is dedicated to promoting the growth of a positive safety culture. The school promotes and communicates safety information to the members by the following methods.

      A. Publication of the safety and non-punitive hazard reporting policies references in section 9 of this manual.

      B. The Safety Policy, which is communicated and distributed throughout the organization.

      C. Publications, communications, and safety information distributed to members containing safety related data, which include incidents, goals and completion ratios.

      D. Demonstration of the commitment to the SMS through distribution and publication of safety and SMS awareness products.

      E. An effective safety reporting and feedback system.

      F. A safety data platform that provides an accessible, efficient means to retrieve safety information.

      G. Resources to implement and maintain the SMS.

      H. Communicating safety responsibilities for personnel.

  2. Competencies and Training
    1. All – member SMS Awareness training
      1. All members of SATT will take SMS awareness training on a yearly basis. This course is administered via computer-based-training.
    2. Advanced SMS Training
      1. The training curriculum is required for all members of the Safety Committee.
      2. This training will give trainees the ability to facilitate SRMs and be a decision maker for SA related items.
  3. Communication and Awareness
    1. General
      1. Communications on the SMS and its output are critical to raising knowledge and awareness levels regarding safety across the School for continuous learning. This communication helps share hazards that have been identified for future prevention and explains the ‘why’ behind many policy and procedure changes that occur. Communication regarding the SMS and its output shows commitment on the part of the School to take action in response to reported concerns or analysis performed using aggregate reports and provides evidence of SMS procedures and objectives. It shows the School’s efforts to fix deficiencies that are identified because members report them, and builds confidence with members of the school for continued reporting.
      2. Safety promotion and communication will be retained for a minimum of 24 calendar months. Information will be archived on the network folders.

    2. Internal Communication: Outputs of the SMS are communicated to the students, faculty and staff members through, but not limited to, the following methods:

      A. Newsletter (Aviation Safety Spotlight)

      B. Safety metric status promotion

      C. Emails

    3. External Communication – Oversight: Outputs of the SMS are provided to the School’s oversight in accordance with established agreements and disclosure programs.

      A. FAA: Outputs are shared in accordance with this manual.