2.2 Safety Management Principles & State Safety Programmes
Key Takeaways
- Aviation safety evolved through three distinct eras: the Technical Era (1900s–1960s), the Human Factors Era (1970s–1990s), and the contemporary Organisational Safety / Systemic Era (late 1990s–present).
- Under ICAO Annex 19, each State establishes a State Safety Programme (SSP) to oversee safety at the national level, while aviation service providers implement an organisational Safety Management System (SMS).
- An ICAO/EASA compliant Safety Management System is structured upon four mandatory pillars: Safety Policy and Objectives, Safety Risk Management, Safety Assurance, and Safety Promotion.
- The Accountable Manager carries single, non-delegable corporate authority and ultimate financial responsibility for allocating the resources necessary to implement and sustain the SMS.
- Safety Risk Management assesses risk by combining likelihood (Frequent to Extremely Improbable) and severity (Catastrophic to Negligible), aiming to mitigate risks into the ALARP (As Low As Reasonably Practicable) region.
2.2 Safety Management Principles & State Safety Programmes
Core Concept: A Safety Management System (SMS) is an organized, proactive approach to managing safety, encompassing necessary organizational structures, accountabilities, policies, and procedures. SMS transitions aviation from reactive incident response to predictive risk control.
Modern commercial aviation is the safest mode of mass transportation in human history. This level of safety was not achieved through good fortune, but through the continuous evolution of safety thinking—transitioning from basic mechanical failure analysis to the scientific management of organizational and systemic hazards. In European aviation legislation, this approach is anchored in ICAO Annex 19 and woven directly into the fabric of EASA Part-145, Part-CAMO, and the Basic Regulation (EU) 2018/1139.
The Evolution of Aviation Safety Paradigms
Understanding contemporary safety legislation requires examining the three major historical eras of aviation safety:
+-----------------------------------------------------------------------------+
| HISTORICAL ERAS OF AVIATION SAFETY |
+-----------------------------------------------------------------------------+
| 1. Technical Era (1900s - late 1960s) |
| • Primary Focus: Mechanical reliability, metallurgy, structural physics. |
| • Paradigm: If machinery is engineered to fail-safe standards, flights |
| will be safe. Addressed by redundant systems and structural testing. |
+-----------------------------------------------------------------------------+
| 2. Human Factors Era (early 1970s - mid-1990s) |
| • Primary Focus: The human-machine interface, CRM, MRM, ergonomics. |
| • Paradigm: As mechanical reliability soared, human error caused ~75% |
| of crashes. Addressed by HF training, fatigue management, checklists. |
+-----------------------------------------------------------------------------+
| 3. Organisational / Systemic Era (late 1990s - Present) |
| • Primary Focus: Organizational culture, management pressures, SMS. |
| • Paradigm: Frontline errors are symptoms of deeper latent conditions |
| in the organization. Addressed by ICAO Annex 19, SSP, and SMS. |
+-----------------------------------------------------------------------------+
1. The Technical Era (1900s – late 1960s)
In the initial decades of flight, aviation hazards were overwhelmingly mechanical. Early aircraft suffered from engine seizures, wing spar failures, aerodynamic flutter, and metal fatigue (epitomized by the de Havilland Comet square-window pressure cabin failures in the 1950s). Safety efforts focused on engineering solutions: metallurgic improvements, fail-safe redundancy, enhanced maintenance inspection cycles, and dual independent hydraulic circuits.
2. The Human Factors Era (early 1970s – mid-1990s)
By the 1970s, technological reliability had matured dramatically, yet aircraft continued to crash. Landmark accidents (such as the 1977 Tenerife airport disaster and the 1972 Eastern Air Lines Flight 401 crash) revealed that highly trained individuals made fatal errors due to poor communication, fixation, sensory illusions, fatigue, and cockpit gradient. In maintenance, disasters like the 1990 British Airways Flight 5390 blowout (where wrong-diameter bolts were fitted to a windscreen) catalyzed Maintenance Resource Management (MRM) and the inclusion of Human Factors (EASA Part-66 Module 9) into maintenance licensing.
3. The Organisational / Systemic Era (late 1990s – Present)
Rooted in Professor James Reason's Swiss Cheese model, the organizational safety era recognizes that individual humans do not operate in a vacuum. A technician who forgets a split pin or misreads a torque wrench is usually responding to systemic latent conditions: commercial pressure to meet departure slots, poor lighting, understaffed night shifts, obsolete tooling, or contradictory maintenance manual revisions. Safety management today treats safety as a core corporate process that must be managed with the same financial, operational, and managerial rigor as profitability.
The State Safety Programme (SSP) and ICAO Annex 19
In 2013, the International Civil Aviation Organization (ICAO) adopted Annex 19 (Safety Management), dedicated entirely to safety management responsibilities.
Annex 19 establishes a dual-tier framework across global aviation:
- The State Safety Programme (SSP): An integrated set of regulations and activities established by a State to manage civil aviation safety at the sovereign level. In Europe, each EU Member State establishes an SSP that aligns with the European Plan for Aviation Safety (EPAS) promulgated by EASA.
- The Safety Management System (SMS): An organized approach to managing safety implemented by individual service providers (maintenance organisations, airlines, design offices, airports, and air traffic service providers).
+-----------------------------------------------------------------------------+
| SAFETY GOVERNANCE HIERARCHY |
+-----------------------------------------------------------------------------+
| ICAO ANNEX 19 |
| (Global Standards and SARPs) |
| | |
| v |
| EASA EPAS & MEMBER STATE SSPs |
| (European & National Safety Programmes) |
| | |
| v |
| APPROVED ORGANISATIONS (SMS) |
| (Part-145, Part-CAMO, Part-21, Part-ORO) |
+-----------------------------------------------------------------------------+
The State oversight authority evaluates whether an organisation's SMS meets regulatory standards. In turn, the organisation's SMS feeds operational hazard data back into the State's safety monitoring systems.
The Four Pillars of a Safety Management System (SMS)
Both ICAO Annex 19 and EASA management system regulations (such as Part-145 Subpart A and Part-CAMO Subpart A) structure an SMS around four fundamental pillars:
+-----------------------------------------------------------------------------+
| THE FOUR PILLARS OF AN EASA SMS |
+-------------------------------------+---------------------------------------+
| 1. Safety Policy and Objectives | 2. Safety Risk Management (SRM) |
| • Accountable Manager commitment | • Proactive hazard identification |
| • Clear safety accountabilities | • Risk assessment (Severity/Likelihood)|
| • Safety Manager & Review Board | • Risk mitigation and ALARP control |
| • Emergency Response Plan (ERP) | |
+-------------------------------------+---------------------------------------+
| 3. Safety Assurance (SA) | 4. Safety Promotion |
| • Safety Performance Indicators | • Competency & SMS training |
| • Management of Change (MOC) | • Two-way safety communication |
| • Continuous audit & improvement | • Just Culture dissemination |
+-------------------------------------+---------------------------------------+
Pillar 1: Safety Policy and Objectives
Safety Policy represents the formal foundation of the SMS, signed by the Accountable Manager. Key components include:
- Accountable Manager (AM): A single executive who possesses ultimate corporate authority, hiring/firing power, and non-delegable financial responsibility for ensuring that all maintenance operations are properly financed and conducted to EASA standards.
- Safety Accountabilities: Clear definition of lines of safety accountability throughout the organization, from executive directors down to individual certifying technicians.
- Key Safety Personnel: The appointment of a Safety Manager (responsible for facilitating risk assessments and administering the SMS) and a Compliance Monitoring Manager (responsible for independent quality assurance audits). The organisation must establish a Safety Review Board (SRB) chaired by the Accountable Manager and Safety Action Groups (SAG) on the hangar floor.
- Emergency Response Planning (ERP): A structured contingency plan ensuring orderly transition from normal to emergency operations during critical events (e.g., hangar fire, chemical spill, catastrophic component failure).
Pillar 2: Safety Risk Management (SRM)
SRM is the core operational engine of the SMS. It consists of two sequential phases:
- Hazard Identification: Identifying conditions or objects with the potential to cause injury, damage, or reduced airworthiness. Hazards are identified through:
- Reactive methods: Internal occurrence reports, MORs, flight logs, accident reports;
- Proactive methods: Safety audits, hangar safety surveys, line station inspections;
- Predictive methods: Maintenance data trending, reliability monitoring, statistical component failure analysis.
- Safety Risk Assessment and Mitigation: Evaluating the severity and probability of the potential consequence of a hazard, followed by implementing engineering or procedural controls to mitigate risk to an acceptable level.
Pillar 3: Safety Assurance (SA)
Safety Assurance monitors whether the risk controls implemented under Pillar 2 are functioning effectively and whether the organisation is meeting its safety goals:
- Safety Performance Monitoring: Tracking Safety Performance Indicators (SPIs) (e.g., number of forgotten tools per 1,000 flight hours, repeat defect rates) against established Safety Performance Targets (SPTs).
- Management of Change (MOC): A formal risk assessment process executed prior to introducing major operational changes—such as acquiring a new aircraft fleet type, introducing composite repair technology, altering shift patterns, or relocating maintenance facilities.
- Continuous Improvement: Management reviews, internal compliance audits, and feedback loops that refine procedures and address emerging systemic weaknesses.
Pillar 4: Safety Promotion
A robust SMS cannot succeed without an informed and committed workforce:
- Training and Education: Comprehensive initial and recurrent SMS and Human Factors training tailored to specific job roles (certifying staff, mechanics, planners, storekeepers, executive management).
- Safety Communication: Disseminating safety bulletins, lessons learned from incidents, hazard trends, and reinforcing a transparent Just Culture where technicians understand how their reports resulted in safety improvements.
Safety Risk Assessment Matrix and the ALARP Principle
To standardize risk evaluation, organisations utilize a Safety Risk Assessment Matrix combining the Likelihood (Probability) of an event occurring with its worst credible Severity.
Severity Classifications (ICAO / EASA)
| Level | Meaning | Operational Consequence |
|---|---|---|
| Catastrophic (A) | Total Destruction | Aircraft destruction, multiple fatalities, total loss of primary flight control. |
| Hazardous (B) | Severe Reduction | Large reduction in safety margins, severe injury, major structural damage, loss of redundant critical systems. |
| Major (C) | Significant Reduction | Reduction in safety margins, passenger/crew discomfort or injury, significant system failure requiring emergency procedures. |
| Minor (D) | Minor Impairment | Operating limitations, minor defect requiring troubleshooting, slight operational delay. |
| Negligible (E) | Inconvenience | Little operational consequence, minor cosmetic blemishes, standard log entry. |
Probability / Likelihood Classifications
| Level | Category | Description / Frequency |
|---|---|---|
| Frequent (5) | Common | Likely to occur many times; occurs regularly in day-to-day operations. |
| Occasional (4) | Periodic | Likely to occur sometimes; has occurred several times in the fleet. |
| Remote (3) | Unlikely | Unlikely, but possible; has occurred rarely in the aviation industry. |
| Improbable (2) | Highly Unlikely | Very unlikely to occur; not known to have occurred in the fleet. |
| Extremely Improbable (1) | Almost Inconceivable | Virtually impossible; probability $< 10^{-9}$ per flight hour for critical systems. |
The Risk Index and the ALARP Principle
Multiplying Probability by Severity yields a two-character Risk Index (e.g., 5A, 3B, 1E), which falls into one of three risk tolerability regions:
+-----------------------------------------------------------------------------+
| RISK TOLERABILITY FRAMEWORK |
+-----------------------------------------------------------------------------+
| 1. INTOLERABLE REGION (High Risk: 5A, 5B, 4A, 3A, 5C) |
| • Unacceptable under any operational circumstances. |
| • Maintenance/operations must halt immediately until risk is mitigated. |
+-----------------------------------------------------------------------------+
| 2. TOLERABLE / ALARP REGION (Medium Risk: 4C, 3B, 2A, 5D, 4D, 3C) |
| • Tolerable only if risk has been reduced to: |
| "As Low As Reasonably Practicable" (ALARP). |
| • Additional mitigation required unless the cost/effort is proven to be |
| grossly disproportionate to the safety benefit gained. |
+-----------------------------------------------------------------------------+
| 3. ACCEPTABLE REGION (Low Risk: 2D, 1D, 2E, 1E, 3E, 1C) |
| • Acceptable without immediate top-level management intervention. |
| • Managed through routine standard operating procedures and monitoring. |
+-----------------------------------------------------------------------------+
The ALARP Test: To demonstrate that a risk is ALARP, management must show that the resources, capital, and operational disruption needed to reduce the risk further would be grossly disproportionate to the fractional safety gain achieved. It does not mean accepting a hazardous condition simply because mitigation is expensive.
SMS Implementation in Maintenance: Management of Change (MOC)
In an approved Part-145 maintenance organisation, the Management of Change (MOC) procedure under Safety Assurance (145.A.200) is one of the most heavily audited processes. Whenever an organisation introduces:
- New aircraft types on its capability list (e.g., adding Boeing 787 composite airframes to an all-metal Boeing 737 shop);
- Re-organization of shift handovers (e.g., switching from 8-hour to 12-hour shifts);
- Structural hangar modifications or relocation of calibration workshops;
- New paperless electronic maintenance logging and digital sign-off software;
A formal MOC risk assessment must be performed before implementation. The MOC identifies potential failure modes, determines training requirements, adjusts tooling calibration controls, and ensures that safety margins are never degraded during operational transitions.
Practical Maintenance Case Study: Introduction of High-Voltage Systems
Scenario
A line maintenance station servicing conventional narrowbody aircraft is contracted to maintain new hybrid-electric commercial aircraft featuring 800V DC propulsion buses.
Application of the Four SMS Pillars
- Safety Policy: The Accountable Manager approves capital expenditure for specialized high-voltage insulation gear, insulated tools (certified to 1,000V), and arc-flash protective equipment.
- Safety Risk Management: The hazard of lethal electric shock during line transit troubleshooting is identified. Initial risk assessment: Severity = Catastrophic (A), Likelihood = Remote (3) -> 3A (Intolerable). Mitigations implemented: mandatory lock-out/tag-out (LOTO) procedures, de-energization verification by two qualified technicians, and specialized high-voltage training.
- Safety Assurance: The Safety Manager monitors compliance through weekly line audits and tracks high-voltage tooling calibration intervals. Revised risk: Severity = Major (C), Likelihood = Extremely Improbable (1) -> 1C (Acceptable).
- Safety Promotion: High-voltage hazard warning placards and safety briefings are integrated into daily shift-start tool-box talks.
EASA Part-66 Examination Tips & Regulatory Summary
- Accountable Manager Responsibility: In exam questions regarding corporate and financial liability for safety, the answer is always the Accountable Manager—never the Chief Inspector or Safety Manager.
- The Four Pillars: Memorize the four pillars in sequence: Policy, Risk Management, Assurance, Promotion. If an option mentions "Safety Punishment" or "Quality Auditing" as a primary pillar, it is incorrect.
- ALARP Concept: ALARP means mitigating risk to the point where further reduction would require costs or resources grossly disproportionate to the safety benefit gained. It does not mean reducing risk to absolute zero (which is impossible in physical systems).
- Management of Change: Remember that MOC falls under Pillar 3: Safety Assurance, not Safety Policy.
In the historical evolution of aviation safety thinking, what distinguishes the contemporary 'Organisational Safety' (systemic) era from the earlier Technical and Human Factors eras?
Under ICAO Annex 19 and EASA management system regulations, which specific management position bears ultimate corporate authority, financial responsibility, and non-delegable accountability for the Safety Management System?
Which of the four core pillars of an ICAO Annex 19 / EASA Safety Management System comprises safety performance monitoring, the management of change, and continuous improvement?
In safety risk management, what is the operational objective when reducing a safety risk to the 'ALARP' (As Low As Reasonably Practicable) level?