1. Head of International Safety NATS
Safety Management
- The Payback
Moscow – 15th September 2005
Presented by
Jane Gothard
Head of International Safety NATS

2. History of NATS Safety Management System (SMS)
1989 CAA Safety Management Review
Objective: To identify changes in organisational structure and safety
management which are required to assure ATC safety in the present
and future environment.
Considered safety management in its widest context;
Separation of safety regulation from NATS operations to be
made obvious;
Need for explicit commitment to safety;
Recommendations based on best practice in other safety
critical industries.
As the CAA was both service provider and the industry regulator it was important that the separation of safety regulation from NATS operations should be both real and obvious to outsiders. For this reason particular attention was paid to the principles of safety regulation and the respective roles of regulated and regulator organisations.
Although obvious concern for safety existed at all levels of the CAA there was a need to make this commitment to safety more explicit and to adopt a proactive stance. Terms such as ‘objectives’, ‘strategy’ and ‘mission statement’ and the statements themselves needed to reflect clearly the priority given to safety.
Recommendations made were based on the proposition that safety management and regulation of air traffic services in the UK should be consistent with best practice in other safety critical industries

3. A Catalogue of Disaster
Zagreb Mid-Air Collision 1976
Tenerife air disaster 1977
Challenger Space Shuttle disaster 1986
Herald of Free Enterprise ferry disaster Zeebrugge1987
Clapham Junction Rail Disaster 1988
Piper Alfa Oil Platform disaster 1988
Safety management is not new. However, formal approaches to safety management are relatively recent (circa 1980s). Previously, many organisations adopted a reactive approach to safety, driven by response to incidents. It was not uncommon for that approach to be inadequate and in some cases the shortcomings of the approach led to disaster.
The series of incidents during the late 1970s and the 1980s, for example Bhopal, Piper Alpha and Zebrugge, motivated a number of organisations - including NATS - to formalise their approach to safety management and to place more emphasis on a proactive approach based on the lessons learned from disasters.

4. Lessons from Accident Investigations
An organisation’s commitment to safety must be explicit
- set a clear safety policy;
Senior Management are responsible for way safety is managed
- Responsibilities for safety need to be explicit;
A top-down safety strategy should be established;
Free flow of information and openness is essential to ensure that
safety issues are acknowledged and communicated to the relevant
parts of the organisation;
Engineering systems need to be maintained in accordance with their
design principles;
A central focus on safety is useful;
There is a need to audit procedures;
So what are these lessons:
These lessons apply to all safety critical industries (nuclear, chemical, aviation, railways). There is nothing new in these lessons. They are re-emphasised every time disasters occur.
A sound safety policy is fundamental to an organisation’s approach to safety. Typically, this defines the overall safety objectives, performance standards and how they will be achieved.
If the lessons are to be learnt, senior management need to give commitment to safety. The best way to ensure this is to make someone at the top of the organisation accountable for safety.
Organisational structure and associated accountabilities need to address all safety functions and issues and facilitate the flow of information in all directions, up down and across the organisation.
A policy alone cannot prevent disaster - it needs to be implemented in a quality way i.e. by establishing procedures based on recognised good/best practice which address the principles of good safety management shown in the slide.
This is still not enough. Safety is complex and diverse. There is a need to continually verify that all the procedures and systems are working as intended. Formal audits are essentially for verifying that the policy is working, for making improvements and for providing senior management with such assurance.
The best way of implementing these lessons is by developing and maintaining a formal SMS.

5. 1989 CAA Safety Management Review
The 1989 CAA Safety Management Review identified the need for:
a single document to provide a comprehensive description of NATS
approach to safety management;
a system-wide policy of safety management which:
defines responsibilities and accountabilities;
provides a formal basis for translating NATS Objectives relating
to safety into detailed engineering and operational requirements.
A dictionary of common definitions such as safety, reliability
and integrity as they are understood in the NATS context.

6. SMS - The Drivers What do you need? To understand current performance;
To identify weaknesses / deficiencies;
To comply with regulatory requirements;
To stay in business.

7. SMS - The Drivers What do you want? Improved safety performance;
A means of achieving continuous improvement in safety performance;
Improved safety performance;
Minimal additional cost / cost control.

8. SMS Development Know where you are starting from - define a baseline
Set the Scope
- a realistic manageable level
Set clear objectives
- accept that you will not achieve everything right away.
Obtain Senior Management buy-in
- in both the philosophical and financial sense!
Build in ‘Line’ ownership
Engage expert support and identify internal resource
Take the regulator along with you
It is important to prepare your organisation for the introduction of a safety management system development programme. The bullet points on this slide reflect key learning from the experience of introducing a safety management system in NATS.

9. SMS Development - System Design
Set Policy;
Identify accountabilities;
Define processes and procedures;
Develop and implement a communication plan;
Test achievement regularly - identify successes;
Expand and improve.
Safety policy is a short statement of an organisations overall safety objectives, standards and practices. To fulfil the policy a number of fundamental safety management principles need to be met. These principles define the fundamental requirements of sound safety management such as the need for the appropriate levels of supervision, training, incident investigation etc.
Safety procedures need to be defined which satisfy the requirements of the safety principles; these make up the bulk of the SMS.
Implementation of the SMS leads to a safety programme to maintain and improve the level of safety and to provide assurance that this is being achieved. The SMS has to be implemented locally. Local procedures will be needed to supplement those defined in the SMS.
The safety policy and the principles it seeks to promote provide the foundation for the safety efforts of an organisation. Success depends on getting organised to pursue the policy and to implement systems and procedures to fulfil it; to communicate the policy and principles to everyone and seek their views. Organisational structures will need to consider the safety responsibilities of headquarters staff and local staff and the lines of communication

10. NATS Safety Policy
Safety has first priority within the core values that underline all
NATS activities, and it is NATS safety objective to maintain and,
where practicable, improve safety levels in all our activities.
To achieve this, it is NATS policy that an explicit, pro-active
approach to safety management is maintained to minimise NATS
contribution to the risk of an aircraft accident as far as is reasonably
practicable.

11. General Safety Management Principles
Organisational Change
System Safety Analysis
System Acceptance Procedures
Quantitative Safety Levels
Documentation
Organisational Change. (Major organisational changes are a regular feature of any business, and air traffic services are no exception. The primary purpose of this Principle is to ensure that essential safety functions are not lost in reorganisations).
System Safety Analysis: All new systems and changes to operational systems shall be assessed for their safety significance and system functions classified according to their safety criticality. Safety analysis shall be formally conducted and documented to ensure that due consideration is given to all elements of a system (equipment, procedures and people). Safety analysis will form the basis of safety cases.
System Acceptance Procedures: Clear lines of accountability shall be established for the formal acceptance of new systems into operational service or major changes to operational systems.
Quantitative Safety Levels: Quantitative safety levels shall be derived and maintained for all systems where practicable.

12. General Safety Management Principles
Incident Investigation
Lesson Dissemination
Safety Improvement
Training
Supervision
Monitoring Performance
Auditing Arrangements
Internal Incident Investigation. If lessons are to be learned from safety incidents and remedial action taken promptly, occurrences need to be investigated immediately after the event. It is not sufficient to await the results of an external investigation before taking action.
Lesson Dissemination. It is essential that lessons be learned from the experience of others to reduce the chances of a recurrence. This process should extend both internally and externally.
Safety Improvement. This requires an effective means of communicating safety issues and the development of an internal safety culture that encourages safety improvements. Once a recommendation has been accepted, it needs to be actioned. To ignore an identified risk could be judged culpable.
Training. A long-standing principle of providing a safe Air Traffic Service.
Supervision. This requires Managers to have the correct level of supervision in place to enable early detection of deviations from intended practices that degrade safety.
Monitoring Performance. ATS system performance can deteriorate, particularly as systems are approaching the end of their useful lives - traffic levels can change, resulting in unacceptably high increases in workload. Such changes need to be detected and managed.
Auditing Arrangements. This should be a routine activity that is part of the business. It covers Safety Inspections, Safety Surveys and the occasional Safety Review initiated by the CE.

13. NATS Safety Management System
What is required
POLICY
How is it achieved
PRINCIPLES
Who is responsible
ACCOUNTABILITIES
Action
PROCEDURES

14. The Role of the Corporate Centre
To maintain an effective SMS;
To provide assurance that the SMS is being implemented effectively;
To provide specialist advice and assistance where required;
To provide specialist safety management training at all levels;
To act as a proactive focal point for all safety management issues.
We saw previously that one lesson learned from the accidents of the 70’s & 80’s was the usefulness of having a central focus on safety. NATS has a central focus for safety and this slide gives you an indication of the role that the central focus performs:
NATS Safety Division
Director Safety and his staff (12 full time) are independent from NATS operation.
Director Safety reports to the Chief Executive directly and is responsible for the development
and maintenance of an effective safety management system for the whole of NATS.
The Role of the Safety Department is:
to develop policy, principles and procedures on safety management and to provide guidance on implementation.
to provide a central focus on air traffic management safety matters for organisations outside NATS, in particular for the CAA Safety Regulation Group (SRG) and the Ministry of Defence;
to monitor NATS safety performance trends to provide advice on whether the NATS is taking sufficient and timely action to address adverse safety trends and improve performance.
* It is important to note that the Safety Department is a facilitator, not an implementer – the staff
can be regarded as trustworthy consultants whose role is to assist in getting things right. .

15. The Reality of Achievement
A Safety Management System will enable you to:
Identify the risks;
Determine the priorities - explicit risk management;
Develop and execute a realistic plan;
Improve safety performance and demonstrate that you have improved;
Create a learning organisation.

16. An Example - Relative Risk of Events
I would now like to show you how NATS uses information from its SMS:
This diagram shows one way that we can analyse our data - here we
are looking at the causal factors in a set of incident data – the colour
bars show the different levels of risk associated with each event.
In this chart we are looking at the numbers of incidents combined with a
a weighting of the different levels of risk:
The first column shows that a ‘not see’ error is the higher risk causal factor.
The second column shows the second highest risk causal factor to be failed to follow cleared SID – this is a causal factor associated with Level Busts and I would now like to use level busts to give you another example of how the SMS is used in practice………
Data for illustration purposes only

17. An Example - Level Busts
We can see in this chart the number of Level Bust incidents for a given reporting period.
If we look at the top line – the magenta colour – we can see a high volume of activity – if we look at the last figure here we can see 320.
However, if we look at the blue line we can see those incidents where there was some level of risk attached - 28.
So what does this mean? – The blue line indicated those incidents where the SMF would have activated – the monitoring equipment would have detected a loss of separation – in such circumstances a mandatory report would have been required.
The magenta line indicates the actual reports filed by our controllers – I think this tells a very good story – the difference between the two lines indicated the level of ‘voluntary ‘ or ‘open’ reports that we receive – here there is no system to capture this data – it is the safety culture in the ops room – the confidence in the SMS and the trust of the managers that use the SMS that produces this gap.
12 month Rolling Total
Data for illustration purposes only

18. Level Busts – By Cause Data for illustration purposes only
This diagram shows one way of breaking down the level bust figures to determine the causal factors that lay behind the incidents so that we can target our action plans accordingly.
Data for illustration purposes only

19. Level Busts – An Action Plan
4 Important elements have been addressed:
Raising awareness
- Pilots & Controllers
Engaging industry
- Airlines & Chart Manufacturers
Changing procedures
- Phraseology
Taking advantage of new technology
- Developing controller tools
Here is an example of an action plan that we have constructed to address the level bust issue

20. The Reality of Achievement
An SMS makes good business sense:
Maintain approval to operate - continue in business;
Compete on equal terms with other ATSPs - Best practice;
Reduce Insurance Premiums;
Reduce burden of cost of remedial work and investigations;

21. The Reality of Achievement
You will achieve a state of continual unease but,
You will know what to worry about;
You will be able to worry constructively;
Big worries will become little worries;
Your customers / stakeholders/ Regulators will worry you less;
You will get more sleep!

22. The Reality of Achievementis
You can always do more !