Principles and Elements of SMS A Review Patrick

Principles and Elements of SMS A Review Patrick Hudson ICAO/Leiden University April 2006 ICAO Seminar Baku

Structure • • • Why SMS? The principles Shell’s experience Implementation experience Conclusion April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

Why Safety Management Systems? • Safety is a right for customers and staff • Poor safety performance is a sensitive indicator of poor operations • “If you can’t manage safety, how can you show you can manage anything else? ” • Safety management systems are about getting systematic about the problems April 2006 ICAO Seminar Baku

Safety Management System A framework for Safety Management Security Policy Road Safety Plan Audit Plans Alcohol & Drugs Policy Safety Policy Continuous Improvement Mgt. policy Safety Drills Process Safety (HSE Cases) Task Structure No Structure April 2006 ICAO Seminar Baku

A Pacific Southwest Airlines Boeing 727 as it goes down over San Diego, California after a mid-air collision with a Cessna in 1978. One-hundredthirty-seven people along with 7 on the ground were killed. April 2006 ICAO Seminar Baku

Early Safety Management • Early safety management was an unstructured mixture of ‘good things’ • Progress was based upon response to accidents • Measures were outcome based (crashes etc) • There were no process definitions (how to do it) • Regulations prescribed exactly what to do (what to do) • This works very well to start with, but expectations have been raised over the years, now everyone expects that every flight is safe April 2006 ICAO Seminar Baku

Types of Certification • • • There are three distinct ways of guaranteeing safety Type I - Classical ICAO/FAA/JAA certification Type II - Safety Cases and SMS Type III - Safety Culture and Good Practice These different approaches are complementary, especially II and III • Types I and II are Imagination Limited – Can people imagine what might go wrong – Type III involves doing The Right Thing anyway April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

Why have a Safety Management System? • A number of major disasters in the Petrochemical industry – Flixborough – Seveso – Bhopal • Nuclear disasters – Three Mile Island – Chernobyl April 2006 ICAO Seminar Baku

Flixborough 1 June 1974 • Modification Control • Use suitably trained, educated and responsible people April 2006 ICAO Seminar Baku • Know what you don’t know

Seveso July 1976 • Understanding safe state to leave reactions • Multiple layers of protection • Automated Reaction stop systems for exothermic systems April 2006 ICAO Seminar Baku

Longford 25 September 1998 • Training needs to impart and refresh knowledge. • Must identify other hazards and provide relevant training. • Corporate knowledge must be captured and kept alive April 2006 ICAO Seminar Baku

Piper Alpha • 1988 the Piper Alpha platform was destroyed • The platform had just been audited by the regulator • Lord Cullen’s report set up a new regime – Goal Setting – ISO 9000 type management systems – Safety Case to provide assurance - a documented proof that the SMS is both in operation and effective April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

Piper Alpha • Cost $1, 500, 000 • 167 killed • Occidental UK went out of business in two years April 2006 ICAO Seminar Baku

The Cullen Report • Cullen investigated the Piper Alpha disaster • Report was published 1990 • Requirement made for every offshore facility to have an SMS in place by November 1992 • Proof by submission of a safety case • If there was no acceptable safety case the operation would be shut down immediately April 2006 ICAO Seminar Baku

Shell International’s Approach • Shell is the largest operator in the North Sea - SMS was made mandatory • Shell decided to get in first rather than wait • A considered approach was designed • The requirement for SMS was to be made world-wide for all Shell Group companies April 2006 ICAO Seminar Baku

Shell’s Approach - don’t do everything • Decision to operate in terms of hazards and a limited set of events to avoid • Developed the Bow-tie model (next slides) • Identification of safety critical activities to provide assurance • Getting in first meant that they wouldn’t have to operate a system foreign to their culture April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku

The Swiss cheese model of accident causation (Reason) Some holes due to active failures Hazards Other holes due to latent conditions Losses Successive layers of defences, barriers, & safeguards

SAFETY MANAGEMENT Based on the Reason Model World Hazard/ Risk Barriers or Controls Work & Organisation Undesirable outcome April 2006 ICAO Seminar Baku

Safety Management Cycle April 2006 ICAO Seminar Baku

Hazard-based approach • Construct a generic hazard register • Assess which are relevant for a particular operation • Use a Business Process Model to identify safety critical processes that allow management of the hazards • Construct Bow Ties for control and recovery April 2006 ICAO Seminar Baku

HEMP • • • HEMP - Hazard and Effects Management Process Identify - What are the hazards? Assess - how big are those hazards? Control - how do we control the hazards? Recover - what if it still goes wrong? April 2006 ICAO Seminar Baku

Bow-tie Concept Events and Circumstances BARRIERS H A Z A R D April 2006 Harm to people and damage to assets or environment Undesirable event with potential for harm or damage Engineering activities Maintenance activities ICAO Seminar Baku Operations activities C O N SE Q U E N C ES

Bow-tie Concept Events and Circumstances for a specific threat BARRIERS H A Z A R D April 2006 Harm to people and damage to assets or environment Undesirable event with potential for harm or damage Engineering activities Maintenance activities ICAO Seminar Baku Operations activities C O N SE Q U E N C ES

RISK ASSESSMENT MATRIX Potential Consequence of the Incident Rating 0 People No injury Env'ment Assets Zero Effect Zero damage Slight damage < US$ 10 K 1 Slight injury Slight Effect 2 Minor injury Minor Effect 3 Serious injury 4 Single fatality 5 Multiple fatality April 2006 Reputation Increasing Probability A Unknown but possible in the aviation industry B Known in aviation industry C Happened in this company D E Happened > 3 x in the > 3 x in this Company location No Impact Slight Impact Minor damage < US$ 50 K Local Impact Localised Effect Local damage < US$ 250 K Industry Impact Major Effect Major damage < US$ 1 M National Impact Extensive damage > US$ 1 M International Impact h ug S o hr E-M T ge HS s a l an ma ure M or ed N oc pr Massive Effect k ris te ra o rp ion o t nc uc ure i d re eas m le o nt I ICAO Seminar Baku e l ab r

Hazard Management and Control • Bow Ties describe the hazards and the relevant controls • Controls are provided by elements in the business processes • Top events are a restricted set of unwanted events, not the final outcomes April 2006 ICAO Seminar Baku

Bow Ties as Standard • The Bow Tie is now the standard for the FAA in the USA • There a number of computer packages for making and maintaining bow ties • The information needed can be shared • Local differences are easily accommodated April 2006 ICAO Seminar Baku

Shell’s HSE MANAGEMENT putting it together HSE MS EP 95 -0300 Minimum Expectations HAZOP/ HAZID EIA/SIA/HRA etc. EP 95000 Series Technical advice Risk Assessment Matrix THESIS Design standards April 2006 ICAO Seminar Baku Group Guidance

HSE MS “in place” Job Hazard Analysis Permit to Work System Contract/ Contractor Management Hazardous Situation Unsafe Act reporting Workplans HSE Self Appraisal Observation techniques Violation Survey Site Visits Trends/ benchmarking HSE Standards & Procedures Incident Investigation (Tripod Beta) Competency Programmes Audits Reviews April 2006 Incident Reporting ICAO Seminar Baku

Advantages of an SMS • The SMS provides a structure for measuring in system audits • Bow ties provide a structure for operational audits – Are the barriers there? – Are the barriers intact and in operation – Is there sufficient defence- are there single point trajectories where everything relies on a single defence? • The analysis of barriers and operations also provides a basis for incident investigation that is consistent with the Reason model April 2006 ICAO Seminar Baku

What does it take? • Regulators can force implementation, but it is much easier if you want to do it anyway • Top management has to be convinced that implementing an SMS is in their interest • Shell had to implement in the North Sea, but decided to make SMS obligatory world-wide in view of the benefits to Shell group • BP and Exxon. Mobil have taken exactly the same approach with GHSSER and OIMS • You have to do it yourself – Hiring consultants can only be as support April 2006 ICAO Seminar Baku – An off-the-shelf SMS will soon fail

April 2006 ICAO Seminar Baku

Conclusion • Safety management systems turn safety into a systematic process • Development can be done with sharing of information and experience - you don’t compete on safety • SMS models can be used to unify management, audit and incident investigation • SMS does not guarantee everything - to get ahead you need to develop a safety culture as well - tomorrow April 2006 ICAO Seminar Baku

April 2006 ICAO Seminar Baku