The BASI-INDICATE Safety Program

(1)

BUREAU OF AIR SAFETY INVESTIGATION

The BASI-INDICATE Safety Program

Implementation Guide

(2)

The BASI-INDICATE Safety Program: Implementation Guide Version 1.0

Date of issue: January 1998

Caveat:

BASI believes that safety information is of great value. If the safety information in this manual is passed to others for use, the copyright restrictions do not apply to material printed in The BASI-INDICATE Safety Program: Implementation Guide. Readers are encouraged to copy or reprint the information contained in this manual for further distribution, but should acknowledge BASI as the source.

This manual was designed and prepared for the Bureau of Air Safety Investigation by:

Wordware Pty Ltd 192 Burwood Road Hawthorn Vic 3122

(3)

Table of Contents The BASI-INDICATE Safety Program Implementation Guide

Approved by Director of Bureau of Air Safety Investigation Cover and TOC: 4 pages

ig211000tp.doc Version 1.0: January 1998 Page i

Preface

This BASI-INDICATE Safety Program: Implementation Guide describes the requirements for the formal and proactive management of safety within an aviation company. The program was developed to provide simple, cost effective and reliable means of capturing, maintaining, monitoring and reporting information about safety hazards.

The BASI-INDICATE Safety Program is owned and managed by an aviation company. It provides the company with a:

l structured framework for critically evaluating and continually improving the integrity of aviation safety measures

l formal communication channel to regularly identify and report

weaknesses in aviation regulations, policies and standards to BASI. Any safety issues that are reported to the Bureau are at the discretion of the company and the failure or success of the program is determined by the company.

This manual provides implementation guidelines to companies and personnel in the aviation industry on how to implement a proactive safety management program. Although the program is directed at the aviation industry, the principles set out for safety management also apply other industries.

The BASI-INDICATE Safety Program was trialed by a major Australian regional airline to evaluate whether the program would have a positive influence on safety performance. The successful results of the trial are presented in the 1998 BASI report: An evaluation of the BASI-INDICATE safety program.

(6)

1 Why the BASI-

INDICATE Safety

Program Was

Developed

(7)

The BASI-INDICATE Safety Program 1. Why the BASI-INDICATE Safety Program Was Developed Implementation Guide 1.1 Background to the Development of the BASI-INDICATE Safety Program

Chapter 1: 3 pages Approved by Director of Bureau of Air Safety Investigation Page 1-2 Version 1.0: January 1998 ig21100001.doc

1.1 Background to the Development of the BASI-INDICATE Safety Program

1.1.1 On October 2 1994, VH-SVQ, an Aero Commander 690B aircraft operated by Seaview Air, crashed into the Pacific Ocean, fatally injuring the nine persons on board. As a result of the accident, a public commission of inquiry into the relationship between Seaview Air and the then Civil Aviation Authority (CAA) was established. The inquiry became known as the Staunton Commission.

1.1.2 The Staunton Commission was not the only inquiry into Australian aviation safety at that time. In December 1995, a report of the inquiry into the safety of the general aviation and regional airline sectors by the House of

Representatives Standing Committee on Transport, Communications and Infrastructure was released. The report is titled Plane Safe, but is commonly known as the Morris Report.

1.1.3 A common conclusion of these inquiries was that management must take full responsibility for safety, and that both the aviation industry and aviation safety authorities must be more proactive in identifying safety deficiencies, so that the potential for accidents is reduced.

1.1.4 Despite the recommendations of reports of both inquiries, there are currently few formal proactive safety management programs designed to prevent accidents within the Australian aviation industry. In part, this is due to a number of misconceptions that proactive Safety Programs are only applicable to high-capacity operators, costly to implement and require system safety expertise for effective management.

1.1.5 The Bureau of Air Safety Investigation (BASI) has developed a proactive Safety Program to address these misconceptions and provide a safety tool for aviation companies that is cost effective, simple and flexible, called the BASI-INDICATE Safety Program. For further details on the background to and theory behind the program, refer to the 1996 BASI report Proactively monitoring airline safety performance: INDICATE (Identifying Needed Defences in the Civil Aviation Transport Environment).

1.1.6 During the development of the BASI-INDICATE Safety Program, discussions with low-capacity passenger-carrying operators revealed that many companies perceive proactive safety management programs as useful, but they lack the necessary knowledge, skills and resources to develop such programs. Therefore, BASI has produced this practical implementation and software guide to enable organisations to implement the BASI-INDICATE Safety Program and tailor it to their operational needs.

(8)

1. Why the BASI-INDICATE Safety Program Was Developed The BASI-INDICATE Safety Program 1.2 How to Obtain the BASI-INDICATE Software Program Implementation Guide

Approved by Director of Bureau of Air Safety Investigation Chapter 1: 3 pages

ig21100001.doc Version 1.0: January 1998 Page 1-3

1.2 How to Obtain the BASI-INDICATE Software Program

1.2.1 The BASI-INDICATE Software Program was developed to complement the BASI-INDICATE Safety Program. BASI makes the software program available to all aviation companies free of charge. However, users must agree to the terms and conditions governing operation of the program.

Details on how to obtain the BASI-INDICATE Software Program, the terms and conditions governing its use, installation requirements and operating instructions are outlined in The BASI-INDICATE Safety Program: Software Guide.

(9)

2 Basic Principles of

the BASI-INDICATE

Safety Program

(10)

The BASI-INDICATE Safety Program 2. Basic Principles of the BASI-INDICATE Safety Program Implementation Guide 2.1 The Premise Underlying the BASI-Indicate Safety Program

2.1 The Premise Underlying the BASI-Indicate Safety Program

2.4.4 The basic premise underlying the BASI-INDICATE Safety Program is that staff will generally report safety hazards within their work area if they are given sufficient opportunity.

2.1.1 A hazard is any event or situation that has the potential to cause damage or injury.

2.1.2 However, some staff are reluctant to report safety hazards for fear of blame or retribution, particularly if the problem reflects negatively on management.

In addition, some smaller aviation companies do not have formal operational safety officers that staff can access directly and/or confidentially report safety hazards. In other cases, safety hazards may be reported but get lost in company bureaucracy and little feedback is ever given to the originator. As a result, potential safety problems remain unchecked.

2.1.3 The implementation of the BASI-INDICATE Safety Program will minimise these types of communication problems by providing a simple, but

structured, process to ensure that consistent and high-quality safety feedback is disseminated to all staff.

2.1.4 To achieve this, it is necessary to understand how accidents occur and the crucial role that safety defences play in preventing accidents and incidents.

Safety Defence Failures

2.1.6 Safety defences are barriers or safeguards put in place to protect a system from both human and technical failure. According to Maurino, Reason, Johnson and Lee (see also Appendix D for details), defences serve a number of essential functions, including:

Essential function Example of defence

Awareness and understanding Crew Resource Management is a defence that is designed to highlight the value of crew

communication

Detection and warning A Traffic Collision Avoidance System (TCAS) provides flight crew with a timely warning regarding an impending collision

Protection Aircraft seats are designed to withstand g forces Recovery and containment Fire suppression systems are required for many

aircraft engines and cargo areas

Escape and rescue In the event of an aircraft crash, an emergency locater transmitter aids in the rescue of survivors

(11)

2. Basic Principles of the BASI-INDICATE Safety Program The BASI-INDICATE Safety Program 2.1 The Premise Underlying the BASI-Indicate Safety Program Implementation Guide

2.1.7 The breakdown of one or more defences can be determined in the aftermath of an accident as shown in the following examples of incidents in Finland and the United States of America.

2.1.8 The examples show how important it is for a company to regularly identify what defences are currently in place to contain potential safety hazards.

However, rather than waiting for accidents to reveal defence failures, the BASI-INDICATE program provides a method to proactively evaluate potential defence failures on a regular basis.

Example 1

2.1.9 The incident:

l At 0500 on the morning of 6 June 1995, a licensed aircraft maintenance engineer (LAME) towed an ATR 72 aircraft from the hangar and prepared it for engine runs. After discussion with the maintenance supervisor, it was decided that the LAME would conduct the engine runs on his own.

l The LAME carried out the post-maintenance engine run and other required tests. After having found the aircraft serviceable, he used the radio to obtain a clearance to taxi to a position on the terminal apron.

Releasing the parking brake, he increased thrust to get the aircraft moving, but quickly realised that the nosewheel steering was not working. He tried to apply the normal brakes by depressing the brake pedals but found that these did not work either. While the aircraft continued moving towards the hangar, the LAME sat motionless in the seat for about eight seconds. He then rapidly reduced power on both engines and selected reverse thrust. These actions were undertaken too late to stop the aircraft before the nose and right wingtip hit the hangar door, causing considerable damage to the aircraft.

2.1.10 The investigation:

l The investigation of the incident found that the aircraft was fully serviceable before colliding with the hangar. The normal brakes and nosewheel steering did not operate because the electric pumps supplying hydraulic pressure to these systems had not been switched on. Despite this, sufficient pressure was available in the parking brake accumulator (and shown on the gauge on the cockpit hydraulic panel) to stop the aircraft by use of the parking brake handle.

2.1.11 The following defence failures were evident in the report.

l The LAME’s engine run training was inadequate. The training had been conducted on an ad hoc basis by several instructors over nine months without the guidance of a syllabus. Not enough training was allocated to handling emergencies such as using the park brake to stop the aircraft in the event of brake failure. Also, no refresher training of LAMEs in engine runs and taxiing was conducted.

(12)

The BASI-INDICATE Safety Program 2. Basic Principles of the BASI-INDICATE Safety Program Implementation Guide 2.1 The Premise Underlying the BASI-Indicate Safety Program

l A checklist was not used during the engine start. This allowed the LAME to start taxiing the aircraft with the hydraulic pumps switched off. Despite a written company maintenance policy that required a checklist to be used for all engine runs and taxiing, only some

maintenance personnel used the checklist for all engine runs, some used it for extensive engine runs but not short duration runs, some only used the pilot’s engine start checklist and others did not use a checklist at all.

l The aircraft was taxied with only one person in the cockpit. This was contrary to company policy. Had another person been in the cockpit, the failure to switch on the hydraulic pumps may have been detected and the accident avoided.

l The company quality system failed to identify the poor state of the instructions relating to engine run training and taxiing of ATR 72 aircraft. It also did not detect that maintenance personnel were disregarding the instructions on use of checklists and ignoring the practice of requiring more than one staff member for taxiing tasks.

l The LAME was inexperienced in performing engine runs and taxiing, possibly because of inadequate training or lack of recent engine run practice. This may have affected his ability to solve the problem of lack of brakes and nosewheel steering when taxiing. Despite his lack of confidence, the LAME did not request assistance from his supervisor with the engine run on the day of the accident.

Example 2

2.1.12 The accident:

l Late at night on 7 January 1994, a Jetstream J 41 aircraft operated by a United States commuter airline was flying a scheduled service from Dulles International Airport, Washington D.C to Columbus, Ohio. It crashed during the approach to Columbus, killing five of the eight crew and passengers on board.

l The crew commenced the Instrument Landing System (ILS) approach to runway 28 Left in conditions of low visibility and icing. The pilot in command elected to fly a high-speed approach with the autopilot keeping the aircraft on the ILS glideslope and localiser. The Before Landing checklist was not completed until late in the approach, distracting the crew from their primary duties of monitoring the approach. The aircraft's airspeed, which was never stabilised during the approach, was not monitored by the crew and decreased until the stall warning system sounded. The crew failed to react appropriately to the stall warning and the aircraft crashed.

(13)

2. Basic Principles of the BASI-INDICATE Safety Program The BASI-INDICATE Safety Program 2.1 The Premise Underlying the BASI-Indicate Safety Program Implementation Guide

2.1.13 The following defence failures were evident in the report.

l The Federal Aviation Administration (FAA) had no adequate stabilised approach criteria.

l The airline and FAA had no adequate requirement for proper cockpit crew coordination.

l Pilot training simulators were not available within the airline.

l A newly upgraded captain on a new aircraft was paired with a co-pilot who had almost no experience in airline operations.

2.1.14 Applicability of this example to Australian operators:

Even though this accident occurred overseas, many of the lessons from it are equally applicable in Australia. The combination of poor planning, a poorly flown approach, inadequately trained pilots, the absence of effective crew resource management and bad weather is just as deadly in Australia as in any other country.

Identifying Inadequate Defences

2.1.15 Figure 2.1 presents a slightly modified version of Reason’s (1990) widely cited model of accident causation. The model highlights the important role that defences play in preventing accidents and acknowledges that the individual components of Reason’s model—organisation, workplace and person/team—are difficult to identify before an accident because latent failures are usually unforeseeable, workplace factors are dynamic, and errors or violations are unpredictable. The model implies that the integrity of safety defences can be more accurately determined. This is because defences are tangible, and thus measurable, components in a system. It is much easier to evaluate the probable failure of a safety defence than to identify the potential existence of a latent failure.

2.1.16 However, identifying inadequate defences does not mean that latent failures or individual errors can be ignored. Focusing on inadequate defences simply puts the responsibility of safety back on the structure of the organisation.

For example, if an inadequate defence is a lack of staff knowledge about the use of fire extinguishers, this automatically highlights a need to evaluate the company policy relating to ongoing emergency training. Regularly

evaluating defences provides a tangible means by which latent

organisational failures can be identified. The BASI-INDICATE Safety Program has been designed to evaluate safety defences regularly so that the risk of an accident is minimised.

(14)

The BASI-INDICATE Safety Program 2. Basic Principles of the BASI-INDICATE Safety Program

Implementation Guide 2.1 The Premise Underlying the BASI-Indicate Safety Program

Chapter 2: 6 pages Approved by Director of Bureau of Air Safety Investigation

Page 2-6 Version 1.0: January 1998 ig21100002.doc

Management decisions and organisational processes

Error and violation producing conditions

Errors and violations

Organisation Workplace Person/Team

Engineered safety devices

Policies, standards, controls

Procedures, instructions, supervision

Training, briefing, drills

Personal protective equipment

ACCIDENT

Proactively identifiable Defences

Difficult to identify pre - accident

Figure 2.1. Proactive defence evaluation model

(15)

3 Introduction to the

BASI-INDICATE Safety

Program

(16)

The BASI-INDICATE Safety Program 3. Introduction to the BASI-INDICATE Safety Program

Implementation Guide 3.1 Program Overview

3.1 Program Overview

3.1.1 A great deal of material has been published about safety management. Some of the more useful references are outlined in chapter 6 under Further Reading. These books identify the essential elements that make up a safety management program, but few provide a simple methodology to implement these essential elements and evaluate whether they are working.

3.1.2 This chapter provides a structured process for establishing and maintaining the BASI-INDICATE Safety Program, which contains all the recognised essential elements of a typical safety program, but can be tailored to meet the diverse operational needs of individual aviation companies. The principles underlying the program apply to all companies, regardless of their size, function or resources available within the company. Further details on how the BASI-INDICATE Safety Program can be tailored to suit a company's size is provided in chapter 4.

The Three Critical Elements

3.1.3 The BASI-INDICATE Safety Program is based on three elements which are critical for the success of any safety program within an organisation:

1. Safety must be recognised as a priority within the company.

2. Senior management must be committed to improving safety standards.

3. Appropriate resources must be allocated for safety management.

If any one of these elements is not present, a safety program is unlikely to be successful. The authority to commit resources, spend money and bring about safety change must be present.

The Six Core Safety Activities

3.1.4 Once the three critical elements are in place, the BASI-INDICATE Safety Program involves implementing and maintaining six core safety activities:

1. Appointing an Operational Safety Manager.

2. Proactively identifying aviation safety hazards by conducting a series of staff focus group discussions.

3. Establishing a confidential safety reporting system.

4. Establishing regular safety meetings with management.

5. Maintaining a safety information database.

6. Ensuring that vital safety information is regularly communicated to all staff.

3.1.5 Using the checklist in Annex 3A will help you implement these core safety activities in your organisation.

(17)

3. Introduction to the BASI-INDICATE Safety Program The BASI-INDICATE Safety Program

3.1 Program Overview Implementation Guide

Desired Outcomes

3.1.6 These core safety activities are not new, but are common to most safety programs. Essentially, they are structured processes designed to achieve the following desirable outcomes:

l the continual identification and correction of safety hazards within the company

l staff who are actively involved in company safety management

l the provision of current information on the safety health of the organisation

l staff that are motivated to be more safety conscious

l more open communication between different departments, and between management and staff, with access provided to safety information for those who need it.

(18)

Implementation Guide 3.2 Program Detail

3.2 Program Detail

1. Appointing an Operational Safety Manager

3.2.1 The Operational Safety Manager in an aviation company plays a critical role in safety management. Staff must regard him/her as being credible and trustworthy, and he/she must have a good working relationship with management.

3.2.2 Ideally the Operational Safety Manager position should be full time, to ensure that sufficient attention is paid to safety. However, many smaller companies do not have the resources to justify this. In such organisations, the Operational Safety Manager’s role can be fulfilled on a part-time basis—for example, by a current line pilot. Depending on the size of the company, the Operational Safety Manager may require the assistance of several safety officers.

3.2.3 The most important criterion in selecting the Operational Safety Manager and safety officers is that they must be enthusiastic, keen to improve safety and have sufficient experience and maturity to discuss sensitive safety issues with senior management. Appointing someone who wants the job for the right reasons will ensure the success of the program. All incumbents should have a reputation for trust and professionalism in the carrying out of their duties.

3.2.4 The Operational Safety Manager’s role is multi-faceted, and may involve the following tasks:

l coordinating regular safety meetings with management

l ensuring staff that are new to the company are made aware of the BASI- INDICATE Safety Program

l coordinating safety training for new personnel and refresher training for existing staff

l encouraging staff to use the confidential safety reporting system

l being available to all staff as a confidential contact for safety-related issues

l providing timely advice and assistance on safety matters to management and staff at all levels

l ensuring that vital safety information is communicated to all staff

l participating in accident and incident investigations

l regularly evaluating and improving the company’s safety program.

3.2.5 The Operational Safety Manager should be given the authority to report directly to the chief executive officer of the company.

3.2.6 The Operational Safety Manager should not occupy any other management role, and should be aware of the confidential nature of his/her position.

(19)

3.2 Program Detail Implementation Guide

2. Proactively Identifying Aviation Safety Hazards

3.2.7 Aviation safety hazards can be proactively identified by conducting focus group discussions with as many company staff and management as possible.

Focus Group Discussions

3.2.8 Focus group discussions enable staff to become more actively involved in establishing and maintaining a safety management program within the company.

3.2.9 The purpose of the group discussions is to provide participants with a structured method to identify the company hazards that have the greatest potential to compromise aviation safety.

3.2.10 This means that basic workplace occupational health and safety issues are not normally covered in the group discussions, but need to be covered elsewhere in accordance with normal legislative requirements.

Guidelines for Focus Groups

3.2.11 Each focus group discussion should generally take about two hours.

Although this is time-consuming and may be a possible drain on company resources, there are overriding advantages in conducting these group discussions. They:

l provide the company with a current assessment of its safety performance

l encourage staff to report safety problems

l show that management is encouraging and valuing staff participation in safety management

l reaffirm that the company is committed to safety

l make staff more aware of the safety implications of their job.

3.2.12 It is not necessary to conduct the focus group discussions on a regular basis.

However, it is recommended that the discussions occur at least annually and/or when the organisation is undergoing a major change—for example, when the company acquires a more complex aircraft or is expanding its operations.

(20)

Guidelines

3.2.13 There are no hard and fast rules for conducting effective focus groups, but the general guidelines provided below apply.

l The number and position of staff who should take part in focus group discussions will depend on the size of the company, but generally the focus groups should include captains, first officers, other technical flight crew, flight attendants, licensed and unlicensed aircraft maintenance engineers, ground crew, customer service personnel and flight operations staff. In addition, attendance at these focus groups need not be limited to full-time or part-time employees, but can include casual or contract staff.

l Ideally, each focus group should comprise participants who perform similar functions—for example, participants who are all pilots or all engineers. This avoids having to identify hazards associated with more than one job. However, this may not be practical in smaller companies, in which case a mixed group is appropriate.

l Company management should be included in the group discussions because they have a broader perspective on safety issues. Having management participate also sends a message to staff that the company is strongly committed to the safety management program.

l Whether an organisation should conduct separate management focus groups and staff focus groups depends on the current state of

management-staff relations—for example, some staff may feel inhibited about identifying aviation hazards if management are present.

l The focus groups should be facilitated by the Operational Safety Manager with the assistance of a scribe.

l The goal of focus group discussions is for management and staff to learn something new from the participants. Therefore, it is best to let

participants speak for themselves, with limited involvement by the facilitator.

l The facilitator’s role is not to lead the participants in a particular direction, but to let the group set the content of the discussions. All participants should have equal opportunity to put their view forward.

However, the airing of personal grievances should be strongly discouraged.

l The optimal size of a focus group is generally six to eight people. More than eight participants means a greater workload for the facilitator and fewer than six may not be an optimal use of the Operational Safety Managers’ time.

(21)

Five Steps to Identifying Aviation Safety Hazards

3.2.14 The basic process for identifying aviation safety hazards involves following five simple steps.

1 Identifying potential safety hazards (particularly those that may threaten the safety of fare-paying passengers)

ò

2 Ranking the severity of hazards

ò

3 Identifying current defences

ò

4 Evaluating the effectiveness of each defence

ò

5 Identifying additional defences

Figure 3.1. Proactive hazard identification process

Step 1 Identifying potential aviation safety hazards

3.2.15 Ask the question: What are the hazards within an operational area?

3.2.16 To answer this question:

l The group should be given a few minutes during which each participant lists any hazards in the company he/she can identify.

l The facilitator then asks each participant to suggest a hazard until all hazards identified by the individual participants have been listed.

3.2.17 At this early stage, the group should avoid discussing the hazards identified.

It is much better to brainstorm ideas rather than over-analysing items and inhibiting the free flow of information.

3.2.18 The outcome of this step should be a list of hazards that reflect the group’s perception of potential safety hazards within the company. It is expected that some of the items on the list will be closely related. Therefore, before moving to Step 2, these items should be collapsed into a smaller, more manageable group list.

3.2.19 A sample list of potential safety hazards that reflects many of the safety issues faced by aviation companies can be found in Appendix A.

(22)

Step 2 Ranking the severity of hazards

3.2.20 Ask the question: How risky are these hazards?

l The facilitator should ask each participant to evaluate each hazard in terms of whether he/she regards it to be severe, minor or negligible.

l Each person should assign a number from 1 to 3 for each hazard to indicate its severity, with 3 indicating the most severe.

To help participants rate a hazard, they should be asked to think about the potential outcome of the hazard. If the outcome is the loss of an aircraft and/or passenger fatalities, the hazard can be ranked as severe and given a rating of 3. Minor and negligible hazards can be given a rating of 2 and 1 respectively.

3.2.22 This provides a simple, but objective, method to achieve group consensus on hazard severity and ensures validity across different groups.

Step 3 Identifying current defences

3.2.23 Ask the question: What defences are in place within the company to contain these hazards?

l The participants are now required to identify current defences within the company designed to minimise the potential of each hazard contributing to an accident.

For example, if an engine failure during takeoff is a recognised hazard for flight crew, possible defences may include regular aircraft

maintenance, good training and checking, pre-takeoff crew briefings and a flight simulator to practise engine-failure scenarios.

Step 4 Evaluating the effectiveness of each defence

3.2.25 Ask the question: How effective are the defences?

l The group is now required to evaluate the effectiveness of each identified defence.

For example, if a fire extinguisher has been identified as a defence against an aircraft engine fire:

¡ are fire extinguishers easily accessible for staff?

¡ do staff know how to use them?

¡ are the fire extinguishers serviced on a regular basis?

If the answer to any one of these questions is no, then fire extinguishers are not an effective defence against an aircraft engine fire.

(23)

Step 5 Identifying additional defences

3.2.27 Ask the question: What modifications are needed to existing defences or are new ones required?

l Ask the participants to suggest whether additional controls or

procedures are needed, or if further modifications to current defences are required.

For example, several aspects related to fire extinguishers may be considered to be inadequate. Staff refresher training on the use of fire extinguishers could be required or new equipment may need to be purchased.

3.2.29 The outcome of this process is a list of inadequate defences that require safety action.

3.2.30 A sample of the output of a focus group can be found in Appendix C.

The Types of Hazards Identified by this Process

3.2.30 Typically, two types of hazards are identified through this process:

l Safety hazards that reflect deficiencies (real or potential) within various operational areas of the company—for example, flight crew,

maintenance and ground crew. These hazards are the responsibility of the company to address internally.

l Systemic safety problems that may compromise the safety of the broader aviation industry. These problems can be raised as safety deficiencies for BASI (or the appropriate authority) to investigate.

3. Implementing a Confidential Safety Reporting System

3.2.31 The focus group process discussed in the previous section identifies hazards that represent current aviation safety deficiencies. However, companies operate within a dynamic environment, so safety hazards change over time.

Therefore, staff must be given the opportunity to identify additional hazards.

(24)

3.2.32 The preferred method is for staff to consult their department manager or supervisor. Minor problems can usually be resolved immediately. However, a more serious problem may be better dealt with by raising the issue with a nominated safety officer or the Operational Safety Manager, who then includes the problem as a discussion item at the next safety meeting. The Operational Safety Manager enters the item in the safety information database.

3.2.33 Alternatively, a Confidential Safety Reporting System is an excellent means of providing this opportunity to staff, particularly for reporters who prefer that their identity not be disclosed and/or where the matter requires sensitive handling.

l Such a reporting system can be used by staff to report any concerns they may have about safety within their work location, including witnessing or experiencing unsafe work practices, or identifying deficient safety equipment and/or facilities.

l Hazard reporting systems are also integral to the process of preventing serious occurrences. For example, a pilot or a LAME may sometimes recognise a safety hazard that is known only to them. If these

experiences are never communicated, the opportunity to prevent an incident or accident is lost.

3.2.34 A sample confidential safety report form is provided in Appendix B.

Guidelines

3.2.35 Some basic guidelines for establishing and maintaining a Confidential Safety Reporting System are provided below.

l For such a reporting system to work, it is important that management create an atmosphere where staff feel comfortable about reporting safety issues.

l The reporting form should be sent to the Operational Safety Manager.

l The reporting system should be confidential, but not anonymous. If it is anonymous, the Operational Safety Manager cannot fully clarify the nature of the problem and investigate the matter further. Anonymous systems also tend to encourage the reporting of personal grievances by staff, which are not necessarily relevant to improving company safety.

By being able to contact the originator of the report the Operational Safety Manager is in a much better position to confirm that the problem exists, evaluate how serious it is and determine what action is required.

l The Operational Safety Manager must acknowledge the receipt of all reports. One method of ensuring acknowledgment is to have a tear-off strip at the bottom of the report form on which the reporter can record his/her contact details.

(25)

Once the reported hazard has been investigated, the information can be de-identified and entered on the safety information database of the BASI-INDICATE Software Program (see also section 5. Maintaining a Safety Information Database on page 3-13). The original form can then be destroyed, but the tear-off strip can be sent back to the originator, with any appropriate feedback.

Returning the tear-off strip also provides the author with confirmation that his/her report is being addressed.

l The reporting process should be promoted by advertising how to use it, where forms are located and how confidentiality is guaranteed. The results of the program should also feature regularly in newsletters or company bulletins.

Reporting Hazards to BASI

3.2.36 The hazard reporting system described above should not be used to report safety incidents or accidents. Under the Air Navigation Act 1920, aviation incidents or accidents must be reported to BASI using the Aviation Safety Incident Reporting (ASIR) form or the Confidential Aviation Incident Reporting (CAIR) System. Part 2A of the Act contains the detailed

legislative requirements for the reporting and investigation of accidents and incidents.

3.2.37 In most cases, the BASI-INDICATE confidential reporting system will be used by staff to report internal company safety hazards. However, in cases where the reported hazard has potential safety implications for the broader aviation industry, BASI should be informed. The report sent to BASI should contain as much detailed information as possible, and include the contact details for the company's Operational Safety Manager. To ensure

confidentiality, the reports should not identify any individual other than the company’s Operational Safety Manager.

3.2.38 The BASI-INDICATE Safety Program provides a means for the company to report industry hazards to BASI. (See also section 5. Maintaining a Safety Information Database on page 3-13.) Once a hazard has been reported to BASI, BASI creates a Safety Advisory Deficiency Notice (SADN) and assigns a number and safety analyst to the reported hazard in order to investigate the matter further and to issue safety recommendations, where appropriate.

& AN Act 1920 Pt 2A

(26)

4. Conducting Regular Safety Meetings

3.2.39 The purpose of the safety meetings is to manage, monitor and address the hazards identified through the BASI-INDICATE Safety Program. All managers of operational areas should attend so that communication about important safety information is encouraged.

3.2.40 The outcome of the meetings is to achieve positive action on safety issues.

The resolution of safety issues usually requires the support and cooperation of several line management areas.

Guidelines

3.2.41 Well-organised safety meetings can be an integral part of a safety program.

However, safety meetings have the potential to be unproductive.

3.2.42 Use the following guidelines to help ensure that the meeting is productive.

l Because management are the decision-makers in an organisation, they are in the best position to take action on safety issues. Therefore, it is important that they attend the safety meetings. If they cannot attend, they should send a representative.

l If possible, the Operational Safety Manager should not chair these meetings, but should act as a recorder. The chairperson should be someone with sufficient authority and organisational skills to ensure that positive safety benefits can be achieved—for example, the company’s Chief Pilot.

l A meeting should not involve more than six to eight people. Any more than eight people means that the meeting can become difficult to manage.

l Attendance at the meeting does not need to be restricted solely to management. It may be helpful to open the meeting up to any interested staff who would like to attend, but restrict their involvement to one of observation.

l Ideally, schedule monthly meetings. However, do not meet for the sake of it: cancel the next meeting if there is little to achieve. Do not cancel a meeting because one manager cannot participate.

l Schedule the meetings at a regular time—for example, the first Monday of every month at 10 am.

l Set a time limit for the meeting. This forces the group to keep on track, allows managers to attend with minimal disruption to their schedule and avoids the discussion of irrelevant issues. A meeting should not last any more than 90 minutes. Longer meetings may affect the group’s ability to concentrate.

l If the agenda is not covered within that time frame, carry it forward to the next meeting or re-evaluate how time-effective the group is.

(27)

l Distribute minutes from the meeting to give to the attendees, and make extra copies available on bulletin boards or in staff communal areas, to keep everybody informed.

Agenda of Safety Meetings

3.2.43 A typical agenda for a meeting includes:

l assessing the status of safety action items from the last meeting

l reviewing and prioritising outstanding safety hazards within the system

l reviewing all hazard reports and approving corrective actions

l discussing the best strategy for feeding information back to staff on action(s) already taken on previous safety issues

l reviewing the effectiveness of the safety program and discussing strategies for future improvements.

5. Maintaining a Safety Information Database

3.2.44 A safety program needs to collect a lot of information that must be recorded, analysed and distributed to senior management and staff in different

departments within a company, and which may need to be disseminated to other organisations and regulatory authorities.

3.2.45 If safety management information is not stored and managed within a structured framework, valuable information can be lost. The safety

information database of the BASI-INDICATE Software Program has been developed to provide a simple method of managing and communicating important safety information, not only within a company, but also to the appropriate aviation authorities/organisations.

Technical Specifications for the Safety Information Database

3.2.46 The safety information database of the BASI-INDICATE Software Program has been created in Microsoft Access and is easily installed on any IBM- compatible personal computer. The only requirement for operating the safety information database is Windows 3.1 or Windows 95. The program has been designed as a stand alone, self-install package and Microsoft Access is not needed to run the program. The program is installed via four 3.5-inch floppy disks. Because it contains a mini-version of Access, the program uses approximately 6 megabytes of memory.

Who in an Organisation Should Be Responsible for the Operation of the Safety Information Database

3.2.47 It is recommended that the safety information database of the BASI- INDICATE software program be operated by the company's Operational Safety Manager and the format of the program mirrors the process that is conducted in the focus group discussions.

(28)

What the Safety Information Database Provides to an Organisation 3.2.48 The safety information database of the BASI-INDICATE Software Program

provides a structured framework for the Operational Safety Manager and safety officers to:

l monitor and amend a comprehensive list of hazards for each operational area

l issue recommendations that specify where further defences are required

l print out and send recommendations to company senior management and/or to BASI and other agencies

l monitor any action being taken on current recommendations

l print out any actions taken on safety issues, so that the information can be sent to staff

l present graphical representations of safety information.

6. Communicating Critical Safety Information to All Staff

3.2.49 The BASI-INDICATE Software Program provides a useful means of distributing safety information to staff, management, other organisations and regulatory authorities.

3.2.50 Within an organisation, dissemination of safety information can also be improved by using the media listed below in Relevant Media for Distributing Safety Information to distribute important information about hazards

identified by the BASI-INDICATE Safety Program.

3.2.51 Generally speaking, the more information that is communicated the better.

However, this does not mean that trivia should be distributed.

Relevant Media for Distributing Safety Information

3.2.52 Establishing a number of media that can communicate highly relevant safety information within the company helps ensure that staff receive a clear message that the company is serious about safety.

l Company safety newsletters

Newletters can be very effective, but to ensure that people read them, make sure the information is interesting and highly relevant. It may be worth considering appointing an editor that has a flair for presentation or desktop publishing.

l Establishing a safety notice board

A good notice board only advertises critical information, otherwise staff may ignore it. Only items that are related to safety should be posted.

(29)

l Safety briefings

To ensure a good turnout, reserve these sessions for information that is critical.

l Distributing safety minutes to staff

Distributing minutes through the internal company mailing system is an effective process of communicating safety information to all staff.

However, there is the risk of staff not reading them. This risk can be reduced by having the minute signed by someone in a recognised position of authority or addressing the recipient by name as a way of personalising the information.

l Safety reading files

Files are an effective means to communicate current action being taken on safety issues. The file can be located in a staff communal area for anyone to read in a quiet time.

(30)

Approved by Director of Bureau of Air Safety Investigation Annex 3A: 3 pages

ig21100003a.doc Version 1.0: January 1998 Page 3A-1

Annex 3A. Checklist for

Implementing the BASI-INDICATE

Safety Program

(31)

Annex 3A. Checklist for Implementing the BASI-INDICATE The BASI-INDICATE Software Program Implementation Guide

Annex 3A: 3 pages Approved by Director of Bureau of Air Safety Investigation Page 3A-2 Version 1.0: January 1998 ig21100003a.doc

3A.1 Checklist for Implementing the BASI-INDICATE Safety Program

1. Appointing an Operational Safety Manager

q

What criteria will be used to appoint the Operational Safety Manager?

q

How much authority will the Operational Safety Manager have?

q

Who will the Operational Safety Manager report to?

q

Will the Operational Safety Manager’s position be part-time or full-time?

q

Will extra remuneration be offered with the position?

q

Will the Operational Safety Manager require assistance?

q

In addition to the Operational Safety Manager, are safety officers required for different departments or locations?

2. Proactively identifying aviation safety hazards

q

How many focus groups are needed?

q

When is the best time to run the groups?

q

Will management groups be run separately to staff groups?

q

Who will act as the scribe?

q

Who will facilitate the groups?

q

How will staff be encouraged to attend?

3. Establishing a Confidential Safety Reporting System

q

How will the reporting system remain confidential?

q

How will staff find out about the reporting system?

q

Who will the reporting forms go to?

q

How will staff use the reporting forms?

q

What records will be kept?

q

Who will act on the reports?

q

How will feedback be given to the originator?

q

How will the results of the reporting system be publicised?

q

Will anonymous reports be accepted?

(32)

The BASI-INDICATE Software Program Annex 3A. Checklist for Implementing the BASI-INDICATE Implementation Guide

Approved by Director of Bureau of Air Safety Investigation Annex 3A: 3 pages

ig21100003a.doc Version 1.0: January 1998 Page 3A-3

q

How will reports that are personal attacks or grievances be managed?

4. Establishing regular safety meetings with management

q

Who will chair the meetings?

q

Who will participate in the meetings?

q

Are the meetings freely open to staff to attend?

q

How often will meetings occur?

q

What records will be kept?

q

Where will the results of the meetings be sent?

q

What authority do the meetings have?

5. Maintaining a safety information database

q

Is a computer or paper version required?

q

What access will the user have to the computer?

q

Is there a backup user trained in operating the software?

q

Will the information in the computer be secure?

q

If a computer system is used, is there a backup?

6. Ensuring that vital safety information is regularly communicated to all staff

q

What are the best media available within the company to distribute information?

q

How will critical safety information be distributed?

q

How will routine safety information be distributed?

q

How will you determine whether staff are reading the information?

(33)

4 Tailoring the BASI-

INDICATE Safety

Program

(34)

The BASI-INDICATE Safety Program 4. Tailoring the BASI-INDICATE Safety Program Implementation Guide 4.1 Tailoring the BASI-INDICATE Safety Program to the Company

4.1 Tailoring the BASI-INDICATE Safety Program to the Company

4.1.1 The BASI-INDICATE Safety Program is designed to be flexible and to be tailored to the particular requirements of each aviation company.

4.1.2 Individual operators are responsible for determining how they are going to implement the six core safety activities of the BASI-INDICATE Safety Program, based on:

l the size of the company—staff numbers and how many aircraft the company operates

l the location of the company—whether there is a central company location or a number of geographically dispersed operational hubs

l the safety resources available within the company.

4.1.3 Companies that want to go beyond the six core elements of BASI- INDICATE to incorporate other complementary activities in their safety management program should refer to Richard Wood, Aviation Safety Programs: A management handbook. Refer to section 6.2 Further Reading.

(35)

4. Tailoring the BASI-INDICATE Safety Program The BASI-INDICATE Safety Program 4.2 Suggested LEVELS of Application of the BASI-INDICATE Safety Program Implementation Guide

4.2 Suggested LEVELS of Application of the BASI- INDICATE Safety Program

4.2.1 The suggested levels of application of the BASI-INDICATE Safety Program are:

l Level 1—fewer than 20 staff:

¡ focus groups

¡ safety recording system

¡ safety officer

¡ safety information distribution

l Level 2—more than 20 staff:

¡ the six core activities (described in paragraph 3.1.4)

l Level 3—large company:

¡ the BASI-INDICATE Safety Program can be used as a safety tool within the overall safety management strategy.

(36)

5 The Strengths of the

BASI-INDICATE Safety

Program

(37)

The BASI-INDICATE Safety Program 5. The Strengths of the BASI-INDICATE Safety Program

Implementation Guide 5.1 Strengths

5.1 Strengths

5.1.1 The strengths of the BASI-INDICATE Safety Program are that:

l It has been comprehensively evaluated and tested.

l It has been developed in cooperation with the industry.

l It is currently operational within a number of Australian aviation companies.

l It is simple and cost effective to implement and maintain.

l It encourages staff to become more actively involved in safety.

(38)

5. The Strengths of the BASI-INDICATE Safety Program The BASI-INDICATE Safety Program

5.2 Ownership of the Program Implementation Guide

5.2 Ownership of the Program

5.2.1 The BASI-INDICATE Safety Program is owned and managed by a company. Safety hazards are reported to BASI at the discretion of the company. The failure or success of the program in helping a company identify, report, record, act and monitor safety hazards depends entirely on the commitment of the company’s management and staff.

(39)

The BASI-INDICATE Safety Program 5. The Strengths of the BASI-INDICATE Safety Program Implementation Guide 5.3 Minimising the Costs of Aviation Accidents and Incidents

5.3 Minimising the Costs of Aviation Accidents and Incidents

5.3.1 The BASI-INDICATE Safety Program is designed to minimise the risk of accidents occurring. Therefore, if a company does not have a safety management program, it runs a higher risk of experiencing the costs associated with an accident.

5.3.2 The direct costs of an accident relate to the physical damage and include:

l death or injuries to persons involved

l aircraft and equipment damage

l property damage

l replacement costs.

5.3.3 One study calculated that Australian aviation accidents generated losses to society of approximately $45 million, or an average of $138,000 per accident (Bureau of Transport and Communication Economics, 1988).

5.3.4 Studies by the Boeing Company estimated that the indirect costs of an accident are at least four times as much as the direct costs. Indirect costs include:

l the loss of business and damage to reputation

l costs associated with legal action and damages claims

l increased insurance premiums

l cost of aircraft recovery and clean-up

l loss of productivity of personnel

l loss of public confidence.

5.3.5 These costs suggest that maintaining a proactive and effective safety program makes economic sense.

5.3.6 The BASI-INDICATE Safety Program provides aviation companies with a relatively simple method of improving aviation safety at little cost. It also enables them to bring safety issues to the attention of BASI, where appropriate.

(40)

6 Further Information

(41)

The BASI-INDICATE Safety Program 6. Further Information Implementation Guide 6.1 Further Information about the BASI-INDICATE Safety Program

6.1 Further Information about the BASI-INDICATE Safety Program

6.1.1 To find out more information about the development and theory underlying the program and how the program works on a daily operational basis within an aviation company, contact:

The BASI-INDICATE Project Manager Bureau of Air Safety Investigation GPO Box 967

Civic Square, ACT 2608 FREECALL: 1800 020 616 Fax: (02) 6247 1290

(42)

6. Further Information The BASI-INDICATE Safety Program

6.2 Further Reading Implementation Guide

6.2 Further Reading

6.2.1 The BASI-INDICATE Safety Program is just the starting point for

improving the standard of safety management within a company. There are a number of resources for those companies interested in finding out further information. Some practical texts are provided below.

l Boeing, Safety Program Model, Boeing Commercial Airplane Group:

Seattle (1996)

l Ferry, T.S., Safety Management Planning Manual, The Merritt Company Santa Monica, California (1989)

l International Civil Aviation Organisation, Accident Prevention Manual (Doc 9422-AN/923), Montreal, Canada (1984)

l Peterson, D., Safety Management, Goshen, New York: Aloray Inc.

(1988)

l Wood, R.H., Aviation Safety Programs: A Management Handbook, Jeppeson Sanderson, Englewood, Colarado (1991)