Principles and Elements of SMS

A Review
Patrick Hudson
Leiden University

September 2005 ICAO Seminar Moscow

 Structure
• Why SMS?
• The principles
• Shell’s experience
• The elements
• Implementation experience
• Conclusion

September 2005 ICAO Seminar Moscow

 Why Safety Management
Systems?
• Safety is a right for customers and staff
• Poor safety performance is a sensitive
indicator of poor operations
• “If you can’t manage safety, how can you
show you can manage anything else?”
• Safety management systems are about
getting systematic about the problems

September 2005 ICAO Seminar Moscow

A Pacific
Southwest Airlines
Boeing 727 as it
goes down over
San Diego,
California after a
mid-air collision
with a Cessna in
1978. One-
hundred-thirty-
seven people along
with 7 on the
ground were killed.

September 2005 ICAO Seminar Moscow

 Early Safety Management
• Early safety management was an unstructured
mixture of ‘good things’
• Progress was based upon response to
accidents
• Measures were outcome based
• There were no process definitions
• Regulations prescribed exactly what to do
• This works very well to start with

September 2005 ICAO Seminar Moscow

 Types of Certification
• There are three distinct ways of guaranteeing safety
• Type I - Classical ICAO/FAA certification
• Type II - Safety Cases and SMS
• Type III - Good Practice assessment
• These different approaches are complementary,
especially II and III
• Types I and II are Imagination Limited
– Can people imagine what might go wrong
– Type III involves doing The Right Thing anyway

September 2005 ICAO Seminar Moscow

 The Evolution of Safety Culture

GENERATIVE
safety is how we do business
Increasing round here

Informedness PROACTIVE
we work on the problems that
we still find

CALCULATIVE
we have systems in place to
manage all hazards

REACTIVE
Safety is important, we do a lot
every time we have an accident Increasing
PATHOLOGICAL
Trust &
who cares as long as we’re not
caught
Accountability
September 2005 ICAO Seminar Moscow
Characteristics of a Safety Culture
• Informed - Managers know what is really going on and
workforce is willing to report their own errors and near
misses
• Wary - ready for the unexpected
• Just - a ‘no blame’ culture, with a clear line between
the acceptable and unacceptable
• Flexible - operates according to need
• Learning - willing to adapt and implement necessary
reforms

September 2005 ICAO Seminar Moscow

 Piper Alpha
• 1987 the Piper Alpha platform was destroyed
• The platform had just been audited by the
regulator
• Lord Cullen’s report set up a new regime
– Goal Setting
– ISO 9000 type management systems
– Safety Case to provide assurance

September 2005 ICAO Seminar Moscow

September 2005 ICAO Seminar Moscow
September 2005 ICAO Seminar Moscow
September 2005 ICAO Seminar Moscow
 Shell International’s Approach
• Shell is the largest operator in the North Sea
- SMS was obligatory
• Shell decided to get in first rather than wait
• A considered approach was designed
• The requirement for SMS was to be made
world-wide for Shell Group companies

September 2005 ICAO Seminar Moscow

 Shell’s Approach
• Decision to operate in terms of hazards and
a limited set of events to avoid
• Developed the Bow-tie model
• Identification of safety critical activities to
provide assurance
• Getting in first meant that they wouldn’t
have to operate a system foreign to their
culture
September 2005 ICAO Seminar Moscow
September 2005 ICAO Seminar Moscow
 Safety Management Cycle
Leadership and Commitment

Policy and Strategic Objectives

PLAN
Organisation, Responsibilities
Resources, Standards & Documentation

Hazards and Effects

Management FEEDBACK
DO
Planning and Procedures Corrective Action

Implementation Monitoring

Audit Corrective Action

and Improvement
CHECK

Management Review Corrective Action

And Improvement
September 2005 ICAO Seminar Moscow
 Hazard-based approach
• Construct a generic hazard register
• Assess which are relevant for a particular
operation
• Use a Business Process Model to identify
safety critical processes that allow
management of the hazards
• Construct Bow Ties for control and recovery

September 2005 ICAO Seminar Moscow

September 2005 ICAO Seminar Moscow
 The Swiss cheese model of
accident causation
Some holes due
to active failures Hazards

Other holes due to

latent conditions
Losses
Successive layers of defences, barriers, & safeguards
September 2005 ICAO Seminar Moscow
 HSE MANAGEMENT
Based on the Reason Model
World
Barriers
Hazard/ or Controls
Risk
Work &
Organisation

Undesirable
outcome

September 2005 ICAO Seminar Moscow

 HEMP
• HEMP - Hazard and Effects Management Process
• Identify - What are the hazards?
• Assess - how big are those hazards?
• Control - how do we control the hazards?
• Recover - what if it still goes wrong?

September 2005 ICAO Seminar Moscow

 RISK ASSESSMENT MATRIX
Potential Consequence of the Incident Increasing Probability

A B C D E
Rating People Env'ment Assets Reputation Unknown but Known Happened Happened Happened
possible in in aviation in this > 3 x in the > 3 x in this
the aviation industry company Company location
industry

0 No
injury
Zero
Effect
Zero
damage No Impact

Slight u gh
1
Slight
injury
Slight
Effect damage <
Slight
h ro -MS
Impact T E
US$ 10K e HS
g
a l s
Minor Minor an ma ure k
Minor Local M or e d r is
2 injury Effect
damage <
Impact N oc e
US$ 50K
pr rat
r po on
co cti re
Local
Serious Industry
3 injury
Localised
Effect
damage <
Impact n
i du u
US$ 250K re eas
Major
m le
Single Major National b
4 Effect
damage <
era
ol
fatality Impact
US$ 1M t
In
Multiple Massive Extensive International
5 fatality Effect damage > Impact
US$ 1M
September 2005 ICAO Seminar Moscow
 Bow-tie Concept
Events and Harm to people and
Circumstances damage to assets
or environment
BARRIERS

C
O
H N
S
A E
Z Q
U
A E
R N
C
D Undesirable event with E
potential for harm or damage S
Engineering activities
Maintenance activities
September 2005 ICAO Seminar activities
Operations Moscow
 Business Process Modelling
• BPM breaks down the overall processes into the
basic sub-elements
• These can be defined right down to the level of
procedures
• BPM is less difficult than it seems
• What we do, and how we do it
• BPM allows us to identify safety critical activities
- assurance is based on demonstrating these are
managed effectively

September 2005 ICAO Seminar Moscow

 HAZARD
THREAT
CONTROL
PROACTIVE
ESCALATION
CONTROL
THE H E M P

Hazardous
BOW-

Event
Identify
Assess
TIE Control
Recovery
RECOVERY
ESCALATION
REACTIVE
CONTROL
CONSEQUENCE
September 2005 MITIGATION MEASURES
ICAO Seminar Moscow
Hazard Management and Control
• Bow Ties describe the hazards and the
relevant controls
• Controls are provided by elements in the
business processes
• Top events are a restricted set of unwanted
events, not the final outcomes

September 2005 ICAO Seminar Moscow

 Bow-tie Concept
Events and
for a specific hazardHarm to people and
Circumstances damage to assets
or environment
BARRIERS

C
O
H N
S
A E
Z Q
U
A E
R N
C
D Undesirable event with E
potential for harm or damage S
Engineering activities
Maintenance activities
September 2005 ICAO Seminar activities
Operations Moscow
 Shell’s HSE MANAGEMENT
putting it together
HSE MS
Minimum
EP 95-0300 Expectations
HAZOP/ HAZID
EIA/SIA/HRA
etc.

EP 95000
Series
Technical advice

Risk Assessment THESIS

Matrix Risk Assessment Matrix
CONSEQUENCE INCREASING LIKELIHOOD
A B C D E
Environment
Severity

Reputation

Never Heard of Incident Happens Happens

People

Assets

heard of in …. has several several

in ….. industry occurred times per times per
industry in our year in year in a
Company our location
Company
0 No health No damage No effect No impact

Group
effect/injury

Design
1 Slight health Slight Slight effect Slight impact
effect/injury damage
2 Minor health Minor Minor effect Limited Manage for continuous
effect/injury damage impact improvement
3 Major health Localised Localised Consider- Incorporate risk
effect/injury damage effect able impact
reduction

Guidance
4 PTD or 1 to 3 Major Major effect National measures &
fatalities damage impact

standards
demonstrate Intolerable
5 Multiple Extensive Massive International ALARP
fatalities damage effect impact

September 2005 ICAO Seminar Moscow

 Lessons Learned
• Don’t try and do everything at once
– Generalisation comes later
– Integration only once you have experience
• Most of the information and processes transfer
• This means that information and experience can be
shared
• Goal setting regimes allow contractors to have their
own, distinct systems
• New operations are easy to do this way, retro-fitting is
harder
September 2005 ICAO Seminar Moscow
 Advantages of an SMS
• The SMS provides a structure for measuring in
system audits
• Bow ties provide a structure for operational audits
– Are the barriers there?
– Are the barriers intact and in operation
– Is there sufficient defence- are there single point
trajectories where everything relies on a single defence?
• The analysis of barriers and operations also
provides a basis for incident investigation that is
consistent with the Reason model

September 2005 ICAO Seminar Moscow

 What does it take?
• Regulators can force implementation, but it is
much easier if you want to do it anyway
• Top management has to be convinced that
implementing an SMS is in their interest
• Shell had to implement in the North Sea, but
decided to make SMS obligatory world-wide in
view of the benefits to Shell group
• You have to do it yourself
– Hiring consultants can only be as support
– An off-the-shelf SMS will soon fail
September 2005 ICAO Seminar Moscow
 Conclusion
• Safety management systems turn safety into a
systematic process
• Development can be done with sharing of information
and experience - you don’t compete on safety
• SMS models can be used to unify management, audit
and incident investigation
• SMS does not guarantee everything - to get ahead you
need to develop a safety culture as well - tomorrow

September 2005 ICAO Seminar Moscow