Safety Management. Manual... Version 0.1

Safety Management Manual... Version 0.1

Revision Table Version Date of effect Changes 0 2

Index Revision Table... 2 Index... 3 List of abbreviations... 5 Example: Safety policy statement... 7 Safety Goals... 8 Organisation... 9 Organisational flow chart... 9 Function Descriptions... 9 Chairman of the Board/Owner... 9 Safety Manager... 9 Instructor... 10 Members... 10 Safety Management Meetings... 10 Incident management and investigation... 11 Incidents to be reported:... 11 Risk Management... 12 Method 1... 13 Method 2... 13 Method 3... 15 Safety Assurance... 16 Mitigation Measures... 16 Annual Review... 16 Achieving the goals... 16 Safety Training... 16 Chairman of the board, board of directors and owner... 17 Safety Manager and other safety personnel... 17 Instructors and flying personnel... 17 Members, students, etc... 18 Safety Promotion... 18 Goal... 18 Resources... 18 Appendices... 19 3

Appendix Safety Policy Manual... 23 General... 23 Appendix Chapter 1 Safety Policy Statement... 23 Safety Policy Statement... 24 Appendix Chapter 2 Safety Goals... 25 Appendix Chapter 3 Organisation... 25 The Safety Manager... 25 Appendix Chapter 4 Incident Management and Investigation... 26 Appendix Chapter 5 Risk Management... 26 The use of the effect table... 26 Appendix Chapter 6 Safety Assurance... 27 Appendix Chapter 7 Safety Training... 27 Appendix Chapter 8 Safety Promotion... 27 Appendix Findings Register... 29 Appendix Hazard Register... 30 Incident Register...32 Incident Register...32 4

List of abbreviations FR HRF HR IR IRF SM SMM SMS Findings Register Hazard Registration Form Hazard Register Incident Register Incident Registration Form Safety Manager Safety Management Manual Safety Management System 5

List of definitions Hazard Mitigation measures Risk management Safety policy statement Safety management system A condition or an object which can cause injury, damage to material and objects, the destruction of material and objects or the reduction of the usability of material and objects. Measures taken to limit the risk of the consequences of an identified hazard. The identification of hazards, the quantification of risks and the establishing of mitigation measures the goal of which is to bring the risk back down to the lowest possible, acceptable level. Document setting out the organisation's safety policy. This statement is known to everyone who belongs to this organisation and has been signed by the chairman/owner/ceo. A systematic, proactive approach to managing safety, including the necessary organisational structures, responsibilities, procedures and policy 6

Example: Safety policy statement...strives to ensure that our aviation activities operate as safely as possible. This means flying with airworthy aircraft (helicopters, micro light aeroplanes, balloons, etc.), operated by competent airmen after good flight preparation. Furthermore, we will comply with all regulations applicable to us and to limit the risks inherent in flying as much as possible. Our goal is therefore: No accidents, and that is why we encourage increasing knowledge of safe aviation among our customers, members and staff, an environment in which safety has top priority and is second nature. We are deploying all necessary resources to achieve this. This includes the introduction and application of a safety management system. This entails that we are systematically and continually improving ourselves in the area of safety. Toward this end we have appointed a Safety Manager who will implement and maintain the Safety Management System. An important part of a safety management system is having the right culture within our organisation. We create a culture whereby learning from incidents is key and the honest acknowledgement of mistakes is seen as a chance to learn and as an opportunity to increase the safety or our aviation activities. When researching incidents it is therefore the identification of the cause of the incident which is the focal point and not the individual. This allows us to do something about that cause and prevent the same incident from happening again. The issue of guilt is therefore not relevant, unless there has been negligent and reckless behaviour. We will take action against the wilful contravention of (Dutch) legislation and regulations and against our own rules. We will not tolerate this unacceptable behaviour. In order to learn from incidents it is necessary that you report your incidents to us. We would also like to ask you to report identified hazards to us. This is in our joint interest. We therefore request your explicit cooperation! We guarantee the anonymity of the person making the report. We publish the results of the investigations of incidents and identified hazards, plus the measures which we take in connection with this (on the notice board, in our club magazine, on our website, etc. ) for your perusal. Naturally we also publish the measures taken in connection with identified hazards. A safe environment is created by all of us together! Thank you for your cooperation, The Board of Directors, Signature Mr P. Pilot, Chairman 7

Safety Goals As already mentioned in the safety policy statement, our goals are: - No accidents, - Increasing the knowledge on safe operations on the part of our customers, members and personnel and - Encouraging an environment whereby safety has top priority and is second nature. In order to achieve this we are introducing a Safety Management System whereby we systematically work to achieve the above goals and improve safety. As these goals have a high abstraction level, we have defined practical indicators and set objectives. These objectives must be achieved within the specified time limit. Indicators SMS introduction SMS introduction SMS introduction Objective Safety personnel designated and tasks divided before month 2 Safety policy statement adjusted and distributed before month 2 Incident management and study implemented before month 4 SMS introduction SMS manual adjusted before month 6 SMS introduction First safety management meeting held before month 6 SMS introduction Everyone trained in SMS application before month 12 SMS introduction SMS introduction Incident management Incident management Risk management Incidents Hazards First Safety Assurance audit executed and dealt with before month 12 First risk management session executed and dealt with before month 12 All incidents investigated within 1 month after receipt All results of incident investigation published within 3 months after receipt All approved mitigation measures have been introduced within the stipulated term A 10 % reduction in incidents in the three most commonly used incident categories before month 24 A considerable reduction of the risk level of the top 3 risks before month 24 8

Organisation Following is a description of the organisation and the functions of the people who have a role in the SMS Organisational flow chart Example: Chairman Board of Directors Safety Manager Instructors Function Descriptions Chairman of the Board/Owner Is also the chairman of the three-monthly SMS meeting Responsible for the safety of the operation Responsible for making airworthy aircraft available Responsible for making sufficient manpower and other resources available to bring about an effective SMS Responsible for limiting the risks inherent in flying Responsible for steering the Safety Manager Responsible for promoting the correct safety culture within the organisation Safety Manager Is also the Secretary of the three-monthly SMS meeting Responsible for realising the SMS Responsible for steering the SMS and the various components Responsible for carrying out or instructing the carrying out of an incident investigation Responsible for the drawing up of mitigation measures in connection with incident findings or risk identification Responsible for maintaining the SMS documentation 9

Responsible for the agenda and the minutes of the SMS meeting Responsible for bringing noted risks to the attention of the chairman of the board/owner Responsible for giving safety advice to the board/owner Responsible for promoting the correct safety culture within the organisation Responsible for the communication with the organisation with regard to safety matters Instructor Is also a member of the three-monthly SMS meeting Responsible for promoting the correct safety culture within the organisation and airmanship of the members Responsible for the introduction of the SMS to (new) members, customers whereby the emphasis lies on drawing attention to the obligation toward the organisation to report incidents Members We expect of our members that they take note of the safety notices on the notice board (club magazine) and that they report unsafe incidents by means of the IRF and report hazards by means of the HRF. See also 'incident reporting and investigation' and risk management method 3 further on in this chapter. We furthermore expect that they comply with the legislation and regulations which apply at that time and with the additional rules as laid down. Safety Management Meetings It is compulsory for the members of the meeting to attend SMS meetings. If a member cannot attend, he/she must give the Secretary notice in due time. The meeting will take place at least every three months. The Secretary will send the agenda of the meeting to participants together with the minutes of the preceding meeting in due time. The minutes of the meeting contain: An attendance list The topics which were discussed Old action points which could be closed Action points which will be taken along to the next meeting and the latest state of affairs New action points and the owner of the action to be taken The agenda and the minutes will be kept for 5 years. The agenda is comprised of at least: Those present are asked whether they agree with the minutes of the last meeting 10

The hazards which have been identified and any mitigation measures which have been proposed Discussion of the incidents which have taken place and the status of the investigation The findings in connection with the investigation A proposal of the mitigation measures in connection with the findings which are intended to prevent a repetition of the incident or reduce the seriousness of the outcome of an incident Noted negative trends and possible mitigation measures Findings in connection with Safety Assurance sessions and possible mitigation measures Who participates and what is his function: The chairman or owner of the club or school Chairman of the meeting The SM - Secretary Representatives of operational staff/members Incident management and investigation Members and customers are encouraged to report incidents. The relevant form can be found in the appendix. The list of incidents to be reported can be found there. Should there be incidents which are not on this list but which threaten/may affect the safety of the activities, we ask that you report them nevertheless. Incidents to be reported: Bird/wildlife strike Loss of control of the aircraft AIRPROX Airspace violation In-flight technical malfunctions In-flight incapacitation of pilot Incidents connected with I am safe" situations Problems during the flight execution which affect flight safety Emergency landings and precautionary landings Runway/taxiway incursions and excursions Fire or smoke on board of the aircraft 11

Faulty/incorrect loading (outside of envelope) Distress calls (both PAN and Mayday calls) Damage to aircraft and/or damage to others due to contact with aircraft Lost Injuries (self/third parties) Incorrect documentation, procedures etc. Problems with oil or fuel Problems relating to the condition of the airfield Incidents not mentioned here but which nevertheless have an impact on safety All fields to be filled in on the incident registration form (IRF) which apply, are compulsory. However, the filling in of the name of the reporting party is not compulsory. It is possible to report incidents anonymously. Should other details (aircraft registration, route, etc.) on the IRF lead to identification of the reporting party, these details may be left out. Customers and members must be aware that filling in all details can considerably help the investigation and improve the investigation outcome as the SM can ask the reporting party for further details. The members or customers can put completed forms in the sealed post box intended for this purpose. The SM will empty this post box on a regular basis. It is also possible to send the electronically completed form by e-mail to the SM. The IRFs will then be entered in the register and the form will be placed in a binder and stored for 5 years. The investigation will be started after this. The investigation is geared to the causes of the incident and the underlying hazards. The role of the organisation, the procedures, environmental factors and the individual will be included. The issue here is not determining guilt, but identifying the underlying hazards. On the basis of the investigation the SM will determine the findings. These are objective and ensue from the investigation. The investigation report will be drawn up by the SM. On the basis of the report the SM will establish the mitigation measures. There can be one or more mitigation measures for every finding and every identified hazard. The SM will present the mitigation measures to the SMS meeting for approval or will immediately introduce them when they are urgently necessary, with the consent of the chairman or owner. When the mitigation measures have been approved they can be introduced. The chapter 'Safety Assurance ' sets out how the effectiveness of the mitigation measures is reviewed. This will be done immediately after the introduction and thereafter with every Safety Audit. Risk Management The organisation has several methods for identifying risks. 12

Method 1 This method has been previously discussed under Incident Management and Investigation. If an individual is involved in an incident, he/she must complete an IRF. During the investigation the SM will primarily concentrate on the question what the underlying hazard of this incident was. In order to limit the risk of this hazard from resulting in an incident again, the mitigation measures in connection with this incident will concentrate on reducing the risk that this will happen again and/or on reducing the effect of the hazard. Method 2 The second method entails that a number of operational experts identify the hazards on the basis of their experience. Toward this end, on the initiative of the SM, every year before the start of the annual flying season the organisation will hold a meeting with a number (approx. 4) of the most experienced members and/or instructors (experts). During this meeting the top 3 hazards will be identified during a brainstorming session. This will take place as follows: 1. The experts will each write down their individual top 3 possible hazards 2. They will, again each individually, set out the most serious, and most likely consequences of these hazards, in detail 3. All hazards with consequences will be gathered and corresponding hazards will be combined 4. The experts will then decide together whether the consequences which have been written down are indeed the most serious, likely consequences and they will then study all possible consequences 5. It will then be reviewed for each consequence how big the chance of this event is and how big the effect is. This is again done by each of the experts separately. Questions which can be used to determine the effect: How many deaths could there be, taking account of personnel, passengers, bystanders, etc.? What will the financial impact be? Could there be damage to the environment? Will there be a big political impact or negative media attention? 6. The following tables will be used in this respect: Occurrence Meaning Value Frequent Several times per season certainty 5 Occasional A couple of times per season/ likely 4 Remote One time per season or per two seasons/ possible 3 Improbable Not known to have happened earlier, one time in five 2 years/ slight Extremely Almost inconceivable that it will ever occur / unlikely 1 Improbable Severity of Meaning Value Occurrence Catastrophic Material destroyed, fatality/fatalities A Hazardous Safety margins have been seriously affected, serious B injuries, substantial damage to material Major Safety margins have been affected, serious incidents, C 13

injuries, damage to material Minor Emergency procedures are used, aircraft limits have been D exceeded, incident, causes minor inconveniences in the programme Negligible Few consequences E 7. The values of the consequences under 'Occurrence' and 'Severity of Occurrence' are multiplied and the outcome (the risk) will be reviewed as to whether they correspond. Through a discussion between the experts it will be reviewed whether agreement can be reached on the various risk numbers. If this agreement is reached the following table will be used: Risk Risk severity probability Catastrophic A Hazardous B Major C Minor D Negligible E Frequent 5A 5B 5C 5D 5 E Occasional 4A 4B 4C 4D 4 E Remote 3A 3B 3C 3D 3 E Improbable 2A 2B 2C 2D 2 E Extremely Improbable 1A 1B 1C 1D 1 E 8. The outcome of the above table will be used as input for the following table and it will be reviewed whether measures are necessary to limit the risk: Outcome of the Criteria multiplication 5A, 5B, 5C, 4A, 4B, 3A Intolerable risk under the current circumstances, mitigation measures are necessary to lower the risk 2A, 2B, 2C, 3B, 3C, 3D, Tolerable risk, the board 4C, 4D, 4E, 5D, 5E can demand that (extra) mitigation measures may still be necessary. Risk will be monitored for risk growth 1A, 1B, 1C, 1D, 1E, 2D, 2E, 3E Acceptable risk. Risk will be monitored for risk growth 9. All hazards with their consequences and risks are then entered in the hazard risk, see appendix. The hazards with the highest risk total are at the top. 10. Mitigation measures will now be conceived for the top three hazards with the highest totals. 14

Method 3 During the daily operation it is possible that club members note hazardous situations. These hazardous situations need not have caused an incident yet. These hazardous situations will be reported to the SM by means of the hazard registration form (HRF). The hazards are evaluated by the Safety Manager. He will establish whether the reported hazards have been properly worded and will adjust this if necessary, he will then go through steps 2 through 9 for this reported hazard. When this is ready, it will be discussed in the Safety Management Meeting. It will be reviewed here whether all members agree with the risk level and the mitigation measures. It will also be discussed what the sequence of introduction will be for the mitigation measures and the time line for the introduction 15

Safety Assurance Mitigation Measures Safety Assurance will answer the question whether the implemented mitigation measures work. These are the measures which are taken in connection with an incident or in connection with a hazard identification session. The question which must be answered in this respect is whether these measures have reduced the previously established risk level. This question will first be asked, and answered, shortly after introduction of the measure. Thereafter this question will be asked on an annually recurring basis by the SM. During these safety assurance sessions it will be reviewed whether the mitigation measure works. This can be done in various ways and fully depends on the nature of the mitigation measure. For example, the SM can hold interviews, study (learning) material, review the operation, etc. With major changes the measures will be reviewed again by the SM to review whether the changes have an influence on the measures (and concomitantly on the risk level of the previously identified hazards) and what influence this is. Annual Review All previously introduced measures will be reviewed in this respect. The questions which will be answered, are: - Do the measures work the way they are supposed to? - Do they still have the intended effect on the hazard? - Is the risk that these measures limit still at the same level? - Have the measures ended up introducing new hazards? If these questions cannot be answered with Yes, a finding will be entered. The SM will offer this finding to the board/the owner, who will resolve it within a prediscussed and fixed time period by means of establishing mitigation measures which will also be recorded in the findings register. The SM monitors the stipulated timeline for closing the finding (This is including the introduction of the mitigation measures). Achieving the goals The second way in which Safety Assurance is applied lies in the continual monitoring of the achieving of the goals which the organisation has set for itself. The SM monitors whether the goals which have been set are achieved. Should this not be the case, or should this threaten to occur, the SM will intervene via the board or owner and a finding will be entered in the findings register by the SM. After that mitigation measures will be introduced, in conjunction with the person responsible for achieving the goal, to ensure that the goal is in fact achieved. These mitigation measures are then noted in the findings register along with the finding. Safety Training 16

Before people become active within the organisation they must first follow safety training. What safety training they follow depends on their function within the organisation. In addition, a record will be kept of who has received training and what training each person has received. Everyone has responsibilities within the SMS but the type of training differs per group. The various groups can be distinguished as follows: - Chairman of the board, board of directors and owner - Safety Manager and other safety personnel - Instructors and flying personnel - Members, students, etc. Chairman of the board, board of directors and owner They will receive a briefing on the following topics: The SMS framework The various components of the organisation's SMS The organisation's Safety Policy Manual Their share and responsibilities within the SMS, the Safety Management Meeting and the safety culture of the organisation The SM gives this briefing at the beginning of the annual flying season. Safety Manager and other safety personnel They receive training in the following topics: The SMS framework The various components of an SMS The Safety Policy Manual The role of the Safety Manager Risk Management Hazard identification Incident investigation Safety culture (An external course will be followed to gather the necessary knowledge.) Instructors and flying personnel They receive training in the following topics: The SMS framework 17

The various components of the organisation's SMS The Safety Policy Manual of the organisation Risk management Hazard identification Safety culture The SM will give this training course at the beginning of the annual flying season. Members, students, etc. They will receive a briefing on The SMS framework The various components of the organisation's SMS The organisation's Safety Policy Manual Hazard identification Safety culture Incidents and hazards to be reported and the forms to be used This briefing will be given at the beginning of the annual flying season by the instructors or other flying (professional) personnel for existing members. New members are given this briefing when they become a member and before they fly. Safety Promotion Goal The goal of safety promotion is: - to ensure that everyone is aware of the SMS Safety training is only one aspect of this. All changes in the structure of the SMS and important decisions which are made in the safety management meetings will be communicated to members, students and instructors. - to ensure that everyone is aware of information which is of influence on safety - to ensure that everyone knows why certain measures have been taken If people know that measures are taken due to their reporting, they are more likely to report incidents. - to ensure that everyone knows why certain safety procedures have been introduced or have been changed. When people know the reason for certain safety procedures they will be more likely to comply with these measures. - the transfer of interesting safety information This ensures that people are aware of safety information which they might not have found on their own. This results in an increase in safety awareness within the organisation. Resources The organisation uses the safety page of the website/the safety notice board in the common room for publishing safety information. The organisation distinguishes two types of safety information: critical safety information which must be known before the next flight or as soon as possible and information whereby the time factor is less critical. Members and customers are expected to check the notice board or website before every flight/flying day! 18

Critical safety information which must be known before the next flight or as soon as possible will be printed on red paper and will be hung up on the safety notice board for one month. After this month the information will be placed in the red binder. It is compulsory for anyone who has been away for longer than three weeks to go through this binder before the flight in order to become familiar with new critical safety information. Critical safety information which is no longer relevant will be removed from the binder by the SM. In the front of the binder is a list with all topics of the critical safety information so that it is clear whether the binder is complete. Information whereby the time factor is less critical can also be found on the safety notice board. Examples of safety information whereby the time factor is less critical are: - Results of incident investigation, mitigation measures, lessons learned - Results of hazard reports, mitigation measures - Results of hazard identification sessions - Changes in (Safety) procedures (not time-critical) - Safety policy statement - Safety goals - Interesting articles from newspapers and magazines - Interesting safety developments at other airfields Appendices - Incident registration form - Hazard registration form 19

20

21

Appendices 22

Appendix Safety Policy Manual General Although a Safety Management System (SMS) is not required for small, non-commercial aviation, the Dutch Transport and Water Management Inspectorate (IVW) believes the introduction of an SMS to in fact be a valuable step for this diverse group toward improving safety. Toward this end the IVW has created the SMS Light. The implementation of SMS Light is on an entirely voluntary basis. The Safety Policy Manual is an important pillar of the SMS Light. This describes all components of the SMS Light as well as the processes which form part of the SMS Light and the function descriptions of the relevant persons. This gives all members, customers and personnel access to this information. It is the intention that where (..) appears in the manual, the organisation's own name will be entered. Where it says school/club the term which does not apply must be crossed out. In addition, the manual is written on the basis of ICAO document 9859 Safety Management Manual and addresses all components of an SMS. Furthermore, the Safety Policy Manual takes account of EASA CRD 2008-22C, the Requirements for small organizations. The SMS Light deviates from the EASA CRD in the following areas: - The manual does not contain an Emergency Response Plan. There is already a Emergency Checklist for light aviation. The related AIC-Bs are attached and serve as a further guideline for the development of an individual emergency response plan or checklist. The link: http://www.civ.zweefportaal.nl/docs/checklist_calamiteiten_civ_vs_1_aug06.pdf - EASA CRD 22C does not provide a Safety Manager description for small organisations. Nevertheless, in line with ICAO, a choice has been made to designate someone who is specifically engaged in the facilitation of the SMS Light. - EASA CRD 22C does not describe a safety management meeting for small organisations. IVW, in line with ICAO, has opted to describe this process to promote the systematic consultation on safety matters. - EASA CRD 22C does not describe any Management of change for small organisations. This has therefore not been incorporated in this system.. - EASA CRD 22C classifies the quality control system (Compliance Monitoring) under the Safety Management System. The SMS Light has only been developed for managing safety and not quality. Many organisations already have a properly working quality control system. However, Safety Assurance is described in accordance with ICAO and forms part of the SMS. Safety Assurance does not form part of CRD 22C for small organisations. - Hazards ensuing from the outsourcing of work to third parties, e.g. maintenance, will not be discussed separately but are a factor which have to be included when going through the risk management for the entire organisation. Appendix Chapter 1 Safety Policy Statement The Safety Policy Statement The board of directors or the owner will set out the safety policy. The safety policy statement presents this policy to the customers, the members and the personnel. The complete safety policy will be described in the Safety Policy Manual. The enclosed document provides a blueprint for the safety policy statement. 23

In any event, items can be added to this document which specifically relate to your club or company. For example, the operation of the winch could be added to the document at a gliding club and at a ballooning club, the safety of bystanders when the balloon goes up. However, these additions may not affect the statements of the blueprint. The safety policy statement will be communicated to everyone in the organisation (members, customers, guests and personnel). This is possible by, e.g., displaying the document in a common area. The statement has also been included in the Safety Management Manual. In addition the safety policy statement must be reviewed every two years so that the information remains valid and up-to-date. Example: Safety Policy Statement...strives to ensure that our aviation activities operate as safely as possible. This means flying with airworthy aircraft (helicopters, micro light aeroplanes, balloons, etc), operated by competent airmen after good flight preparation. Furthermore, we will comply with all regulations applicable to us and limit the risks inherent in flying as much as possible. Our goal is therefore: No accidents, and that is why we encourage increasing knowledge about safe flight execution among our customers, members and employees, an environment whereby safety is top priority and second nature. We are deploying all necessary resources to achieve this. This includes the introduction and application of a safety management system. This entails that we are systematically and continually improving ourselves in the area of safety. Toward this end we have appointed a Safety Manager who implements and maintains the Safety Management System. An important part of a safety management system is having the right culture within our organisation. We create a culture whereby learning from incidents is key and the honest acknowledgement of mistakes is seen as a chance to learn and as an opportunity to increase the safety or our aviation activities. When researching incidents it is therefore the identification of the cause of the incident which is the focal point and not the individual. This allows us to do something about that cause and prevent the same incident from happening again. The issue of guilt is therefore not relevant, unless there has been negligent and reckless behaviour We will take action against the wilful contravention of (Dutch) legislation and regulations and against our own rules. We will not tolerate this unacceptable behaviour. In order to learn from incidents it is necessary that you report your incidents to us. We would also like to ask you to report identified hazards to us. This is in our joint interest. We therefore request your explicit cooperation! We guarantee the anonymity of the person making the report. We publish the results of the studies into incidents and identified hazards, plus the measures which we take in connection with this (on the notice board, in our club magazine, on our website, etc. ) for your perusal. Naturally we also publish the measures taken in connection with identified hazards. A safe environment is created by all of us together! 24

Thank you for your cooperation, The Board of Directors, Signature Mr P. Pilot, Chairman Appendix Chapter 2 Safety Goals The safety indicators and goals which are mentioned here are possible indicators and goals and can be adjusted to the organisation. This can mean, e.g., other time limits but it is also possible to divide the specified indicators into various lower level indicators or indicators in another area. When defining indicators always bear in mind that indicators have to be SMART, i.e. Specific, Measurable, Acceptable, Reasonable, Timely. In addition, the goals will have to have the approval of the individual responsible for achieving the goals. He or she must stand behind the indicator and the time span. The goals and indicators will change as the SMS Light develops further and will consequently be continually adjusted to the latest state of affairs. This ensures that we make continual improvements in the area of safety. Furthermore, the indicators will always be comprised of, on the one part, indicators which relate to the working of the SMS Light and on the other of indicators which relate to topics/trends which we manage by means of the SMS Light. In order to ensure that the goals which have been set are in fact achieved, it is necessary to designate a person who is responsible for achieving the goal. This is not the Safety Manager but can be someone of the board of directors or the owner. This person will always make an interim report on the state of affairs in the Safety Management Meeting. This will ensure that the tactics can be adjusted in the interim should this be necessary to achieve the goal. The SM will monitor the process and monitor that the goals are achieved. See Appendix Chapter 6 Safety Assurance Appendix Chapter 3 Organisation The presented organisational flow chart is an example. It is the intention that it is adjusted to the individual organisation. If different types of boxes and lines are used in the organisational flow chart, the meaning thereof must be explained. It is also possible in this chapter to refer to another place where the function descriptions and the organisation are laid down, as long as the safety tasks are adequately described. The function descriptions in the manual contain the minimum tasks to be performed. Naturally there is the option to add other safety tasks. The safety management meetings which are discussed here set out the minimum contents of these meetings. These meetings are primarily intended to facilitate the decision making on safety matters. In small clubs/schools this can of course be realised in a less formal manner. It is advised in this respect to keep notes on the decision making, as this can serve as a reference in the future. The Safety Manager The Safety Manager is the person in the organisation who facilitates and is responsible for the Safety Management System. In order to be able to do this effectively it is not only important that this person can put in enough time on this function, but a number of personal characteristics are also important. The SM must preferably: 25

have sufficient authority within the organisation be approachable have sufficient knowledge about the operations of the organisation have affinity with Safety Management Systems These characteristics are necessary to ensure that the SMS is properly rooted in the organisation. In many organisations this will require a culture shift. This is only possible if the SM has the support of the board of directors and the members. Furthermore, the SM will have to have sufficient knowledge to execute the tasks related to the SMS. For details see the chapter Safety Training in the SMM. Appendix Chapter 4 Incident Management and Investigation No further comments. Appendix Chapter 5 Risk Management Aviation has many hazards. Risk management provides a structured method for reducing potential hazards to an acceptable, documented risk level. It is the intention that this risk level is reduced to the lowest possible level, naturally account will be taken in this respect of the costs of implementing a mitigation measure and the effect that this has on the risk level. However, before we can manage the risk level, caused by a specific hazard, to an acceptable level, we will first have to know the potential hazards. When identifying hazards a number of difficulties may be encountered: 1. The level of the identified hazard is too low and a hazard at a higher level is consequently overlooked. 2. The level of the identified hazard is too high and consequently the mitigation measures are very difficult to implement. This can be overwhelming and consequently nothing is done with the measures. 3. The hazard is defined as the lack of a measure. Re 1 and 2: In connection with a brainstorming session, for example, the following hazard is named: A hole in front of the hangar door. A mitigation measure could be to repair this hole. Suppose Club x ensures that this happens. The next time there is another hole or another small defect, it is reported, and soon the register will be comprised of hundreds of hazards with as the result that one is always putting out little fires and the work pressure for the SM becomes very high. If one had gone one level higher and had classified the hazard as follows: The poor condition of the (own) site, then one would have specified other (better) mitigation measures which probably would have addressed other holes and perhaps bumps or poor drainage of the site, resulting in better management of the field. This is thus the better option. An example of an abstraction level which is too high is if the hazard had been the condition of airfields. The abstraction level here is so high that it is not known which measures should be defined and when this has been done, the task of applying the measures can be overwhelming. Re 3 An example: The hazard is the lack of a barrier to the airfield. This is thus incorrect. The correct definition of the hazard is: The hazard that unauthorised persons can simply walk onto the airfield. A barrier can be a mitigation measure. The use of the effect table A single component of the definition set out in the effect table provides an adequate indication for the effect level. 26

E.g. if the consequence of a known hazard entails the complete loss of the aircraft without any fatalities or injuries, it is still a very big (A) effect. Appendix Chapter 6 Safety Assurance Safety Assurance answers the question whether the activities which are developed within the SMS Light do in fact increase the safety of the operation. We distinguish two methods in this respect. With the first method we check whether the mitigation measures we introduced are working. With the second method we check whether the safety goals we have set for ourselves are achieved. When we can answer both positively we can say that our SMS Light is working. Appendix Chapter 7 Safety Training Safety training is necessary to ensure that everyone knows his or her responsibilities within the SMS. This is furthermore an important method for promoting the right safety culture. Appendix Chapter 8 Safety Promotion Safety promotion is an important method for sharing knowledge which has been gathered inside and outside of the organisation. This also promotes the right safety culture. Members/students will report incidents and/or hazards earlier if they know that in connection with their report action will be taken by the organisation. There are several methods for promoting safety in an effective manner. A distinction must be drawn between time-critical safety information which must be known before the next flight or as soon as possible and information whereby the time factor is less critical. This difference must be immediately clear to the relevant parties of the club/school, either through a difference in the communication channel, or through a clear difference in lay-out. The methods which can be used are: - Safety promotion board or website for general safety information whereby the time factor is less critical such as results of investigations, the transfer of interesting information, etc. - Safety promotion board or e-mail for critical information When use is made of a safety promotion board or place in a briefing room or a room where everyone comes before each flight, it is compulsory that before a flying day the information on this board is checked. Re safety board: All other information relating to the safety will be displayed on the safety board, possibly with a different lay-out each time (e.g. paper colour) when a different type of information is concerned. This lay-out will be described in this manual. A safety magazine could also be created for this information, instead of making use of a safety promotion board. Instead of a safety promotion board use can also be made of e-mail. Aside from the method for distributing the critical safety information which is used, use must always be made of the above-described binder. 27

If the club makes use of a website it can also be used for time-critical safety information. The publication management is important in this respect; information which is not (or no longer) relevant must be removed as soon as possible, or must be provided with a validity date. The website can therefore be viewed in the club building or use can be made of a binder. 28

Appendix Findings Register The Findings Register (FR) will be kept up to date by the SM and has been developed to facilitate the management of findings and the ensuing mitigation measures. The FR will be kept for 5 years. This document contains the explanation on how the various columns are filled in. Explanation on filling in the columns: Column A: Sequential number: The sequential number is the internal number given to the finding. The method of compiling this number is free-form. The finding is kept for 5 years. Column B: Date of incident: Fill in the date of the incident, in accordance with the format dd-mm-yyyy. Column C: Finding: In this column describe the finding as completely as possible in 1 or 2 sentences. The finding will set out what mitigation measure is not (or no longer) working or which goal is not being achieved. Only facts are mentioned here, not opinions. Try to be as complete as possible. Column D: Mitigation measure: Use a separate rule for each mitigation measure. Try to be as thorough as possible. Column E: Owner: This is the person who is going to introduce the mitigation measures and who is responsible for the topic to which the finding applies. This is therefore not the SM. Column F: Earlier risk: The risk number in the hazard register that still assumes that the mitigation measure has been applied successfully. This number will be taken over from the hazard register. Column G: Risk now?: What is the risk number now that it has turned out that the measure has not been applied or has not had the desired effect? Column H: Finding status: There are three options: Open, In progress and Closed. The status Open is used when no action has yet been taken to address the finding. In progress is used when work is being carried out on addressing the finding. Closed is used when the finding has been addressed and mitigation measures have been introduced. Column I: Completion date: The latest date on which the mitigation measure must be introduced and working. This date will be determined in advance. This usually involves a period of between 1 to 3 months. Column J: Realised completion date: The date on which the mitigation measure has been introduced and it has been established that it works. Column K: Risk after closing the finding?: This number can be the same number as in column F but due to changing circumstances can also turn out lower or higher. 29

Appendix Hazard Register The Hazard Register (HR) will be kept up to date by the SM and has been developed to facilitate the management of hazards and the ensuing mitigation measures. The HR will be kept for 5 years. This document will explain how to fill in the various columns. Explanation on the columns to be filled in: Column A: Sequential number: The sequential number is the internal number which is allocated to the hazard. The method for compiling this number is free-form. The hazard will be kept for 5 years. Column B: Date of hazard: Enter the date of the identification of the hazard in accordance with the format dd-mm-yyyy. Column C: Hazard: In this column describe the hazard as completely as possible in 1 sentence. Only facts are mentioned here, not opinions. Try to be as thorough as possible. Column D: Consequences: Describe the most serious, likely consequences, using a separate line for each one. Try to be as thorough as possible. Column E: Occurrence: Enter an occurrence number between 1 and 5 in accordance with the SMM occurrence table. Column F: Severity of Occurrence: Enter a severity number between 1 and 5 in accordance with the occurrence table in the SMM. Column G: Risk: This is column E times column F. The outcome is a number. Column H: Outcome of the multiplication: This is the outcome of the multiplication according to the table in the SMM. The choice is made between: Intolerable risk, tolerable risk, acceptable risk on the basis of the outcome in column G. Column I: Mitigation measures: The mitigation measures which are proposed to limit the risk. Use a new line for each measure. Column J: Each mitigation measure requires the approval of the safety management meeting. This column is used to keep track of which measures have been approved and which have not (yet) been approved. It is possible that measures which have not been approved for introduction at this time will be approved at a later time. Column K: Category of mitigation measures: A choice can be made in this respect between the categories within which the mitigation measure falls. This can be Technology, Training or Procedures, regulations. Technology not only includes the aircraft but also, e.g., improving the condition of the runway. Column L: Owner: This is the owner of the hazard, the person within whose operational area the hazard falls. This is also the person who is going to introduce the measures. The SM will later check whether this has been done properly. It is therefore not the intention that the SM introduce these measures himself. 30

Column M: Completion date: Date as of when the mitigation measure must have been introduced by the owner. The SM will monitor this date. Column N: Realised completion date: This is the date on which the mitigation measure has in fact been introduced and the owner has reported this to the SM. Column O: Closed: This is the date of the closing of the process. The process will only be closed if the SM has checked that the mitigation measure really does work. If this is not the case the process will not be closed. 31

Incident Register Incident Register The Incident Register (IR) will be kept up to date by the SM and is intended to register all incident reports and to make an analysis possible. Toward this end a system of classification codes has been applied. A distinction is made between cause (3 columns) and consequence (2 columns). - Per incident several lines with classification codes can be entered. Bear this in mind when a new incident is registered and there are empty lines. - It can also occur that several reports are made in connection with one incident because, e.g., several aircraft of your organisation are involved. The second or following report will have the same sequential number as the first report with addition of one letter: 10-2010, 10-2010A, 10-2010B, etc. - Maintain the text of the report! This means that if something is not in the report, it must not be classified. Example: When the report reports that there was a serious injury during an emergency landing, this is INJ (injured) and SI (serious injury). It is perhaps logical that an ambulance will have been called out to transport the person but if the Safety Manager does not know this for certain he/she may not assume this and enter it regardless! Furthermore the incident register can annually be sent to the Royal Netherlands Aeronautical Association (RNAA). This organisation will then draw up an analysis report which makes use of the received incident registers. The intention of the classification system is that all incidents can be classified with the codes which have been made available. It is very important for the uniformity between the various clubs and schools that no personal classification codes are added. This would destroy the possibility of a joint analysis. Should an extra code turn out to be necessary, contact IVW and in consultation an extra code will be added. A new version of the incident register will then be made available on the website www.ivw.nl. Explanation on filling in the columns: Column A: Sequential number: The sequential number is the internal number which is allocated to the report. The compiling of this number is free-form. The number will then be taken over on the original report and the original report will be kept for 5 years. Column B: Date of incident: Enter the date of the incident in accordance with the format dd-mm-yyyy. Column C: Type of aircraft: Enter the type of aircraft in which the party reporting the incident was flying at the time of the incident. A choice can be made from the following list: Aeroplane SE/ME TMG MLA Unanchored balloon Helicopter Gyroplane Hang glider Glider 32

Paraglider Parasailer Airship Column D: Title of incident: The format of the title is free-form. The title briefly sets out what has happened. It is furthermore recommended to describe similar incidents in the same manner. This promotes clarity which will benefit subsequent analysis. Column E: Time of the flight: A choice will be made from the following list: Parked Taxi Take off Climb Cruise Descent Approach Landing Column F: Incident location: An airport or a geographical location indicator is used (e.g. 10 km west of Deventer). If it is not known where the incident occurred, do not fill in this column. Column G: Departure location: this is the departure airport, using the ICAO taxonomy if available (e.g. EHGG) Column H: Precautionary landing/emergency landing: this column will only be filled in if there is a de facto emergency landing or precautionary landing. This can be an airport or a geographical location indicator Column I: Arrival location: this is the airport of arrival, using the ICAO taxonomy if available (e.g. EHGG) Column J, K, L: Classification of the cause of the incident: the cause of the incident is filled in here. Several causes can be selected per incident. See the following list: 33

AIRPROX Technical malfunction (TEC) - Engine (ENG) - Propeller/Rotor (PR) - Undercarriage (UC) - Electrics (EL) - Ailerons / Tail rotor (AIL/TR) - Radio (RA) - Emergency parachute (EP) - Wing (WI) - Screen (SC) - Equipment (EQUIP) - Frame (FR) - Burner (BR) - Balloon/envelope (BA) - Instrumentation (IN) Airmanship (AMS) Extreme weather (EXT) - Flight preparation (FPrep) ----------------------------- - Flight execution (FExe) - Lightening strike (LS) - Hail (HA) - Wind gusts (WI) - Icing conditions (IC) Winch use (WIN) - Premature stop (PS) - Cable rupture (CabRup) - Cable off-course (CabOC) - Engine malfunction (ENGMal) Condition of airfield (CON) Use of towline (TOW) Launch assistance (LAsst) - Birds/wildlife (BIRD/WILD) - Condition of taxiway (ConTx) - Condition of runway (ConRw) - Towline off-course (TOWOC) - Tower too low (Low) - Wing runner (WIRU) - Signaller (SIG) - On-duty instructor (ODI) - Load (lo) - Weather (we) - Fuel calculation (fc) - Navigation (na) - NOTAMS (no) - Pre-flight check (ch) ------------------------- - Navigation (na) - Procedures (pr) - Speed (spd) 34

The classification Pre-flight check (ch) is used in the broadest sense of the word, it includes the walk-around and all checks and checklists before the start. Column M, N: Classification of the consequence of the incident. See the following list: Injured on board (INJ) - Serious Injury (SI) - Minor Injury (MI) - Fatality (FA) Injured on the ground (INJGrnd) - Serious Injury (SI) - Minor Injury (MI) - Fatality (FA) Damage to aircraft (DAC) - ENG (ENG) - Propeller/Rotor (PR) - Undercarriage (UC) - Electrics (EL) - Ailerons /Tail rotor (AIL/TR) - Radio (RA) - Emergency parachute (EP) - Wing (WI) - Screen (SC) - Equipment (EQUIP) - Frame (FR) - Burner (BR) - Balloon/envelope (BA) - Instrumentation (IN) - Aircraft total loss (TL) Damage on the ground (DAMGrnd) Emergency services deployed? (EMSER) - Other aircraft (OthAir) - Building (BUI) - Vehicles (VEH) - Nature (NA) - Other (Oth) - Fire Department (FD) - Police (PO) - Ambulance (AM) Emergency landing (EL) Precautionary landing (PL) Lost (LST) Airspace Violation (AV) Loss of control (LOC) - Crashed (Cr) - Ground looping (GL) - Overshoot (OV) - Undershoot (UN) - Hard landing (HL) - Stall (ST) - Other (Oth) Emergency parachute deployed (EPD) Bird/wildlife strike (BIRD/WILD) - Bird (BIRD) - Other wildlife (WILD) The definition of serious injury is the ICAO definition: Serious injury is injury which 35

- necessitates a hospital admission of more than 48 hours, within 7 days after the occurrence of the injury or - results in a bone fracture (except for simple bone fractures, like finger, nose, toe) - lacerations have occurred which cause serious haemorrhage or damage to nerves, muscles or tendons - internal organs have been damaged - second- or third-degree burns have been suffered or the victim has suffered burns covering more than 5 percent of the body - it has been verified that there has been exposure to contaminated substances or harmful radiation Column O: Has the incident been investigated?: There are three options: Yes No In progress Column P: Have mitigation measures been defined and introduced: The answer is either Yes or No. Column Q: Incident closed? The answer is either Yes or No. Furthermore there is a relationship between Column O, P and Q. The following table sets out all possible combinations between O, P and Q with an explanation: Column O Column Column Explanation P Q Yes Yes Yes incident has been investigated, mitigation measures have been defined and introduced, the incident has been closed Yes Yes incident has been investigated, no mitigation measures, incident has been closed Yes No No incident has been investigated, mitigation measures have been defined but not yet introduced, incident has not yet been closed Yes No No incident has been investigated, mitigation measures have not yet been defined (nor introduced yet), incident has not yet been closed Yes No Yes incident has been investigated, mitigation measures have not been defined, was not found necessary (the incident has been recorded for analysis), incident has been closed No Yes a choice has been made not to investigate the incident but the incident has been closed (incident has been recorded for analysis) In progress No No investigation is ongoing, mitigation measures have not (yet) been defined and introduced, incident has not been closed All new incidents therefore start with the status: In progress, No, No, when they have just been introduced and will then change in status. 36

37

CONFIDENTIAL (WHEN FILLED IN) Incident Registration Form All underlined fields must always be filled in Date: TITLE OF INCIDENT Version number Aircraft information Sequential no. IRF (By SM) Incident location/coordinates Type of aircraft Registration Owner/Operator Date and time of the incident (UTC) DD MM yyyy / / UTC: :_ Flight number Departure location Arrival location Alternate airport Logbook no. (only for technical incident) Transponder code Passengers /crew / Flight rules VFR / IFR Airspace classification A /B/ C/ D/ E/ F/ G Height / Flight level Speed (kts) Takeoff weight Runway in use CHECK MORE THAN ONE IF NEEDED PARKED TAXI TAKE-OFF CLIMB EN ROUTE DESCENT APPROACH LANDING FLIGHT PHASE Weather and Conditions IMC / VMC WIND CLOUD PRECIPITATION TYPE AND QUANTITY VISIBILI TY ICING TURBULENCE OAT ( C) RUNWAY CONDITION DIREC TION SPEED (kts) TYPE HEIGHT (ft) QNH (hpa) BIRD STRIKE NO. SEEN: NO. HIT: TYPE OF BIRD Description of incident (Report cause, consequence and factors which were of influence) -------------------------------------------------------------------------------------- DETAILS OF THE REPORTING PARTY (NOT COMPULSORY!) NAME AND SIGNATURE: TELEPHONE NUMBER / E-MAIL: DATE REPORTED: IN THE EVENT OF DOUBT, ALWAYS REPORT! 38

SAFETY FIRST! CONFIDENTIAL (WHEN FILLED IN) Hazard Registration Form All underlined fields must always be filled in Date: SEQUENTIAL NUMBER IRF (BY SM): Version number Date of identified Time Location hazard dd/mm/yyyy Local time: UTC: Brief description of the identified hazard ------------------------------------------- TO YOUR KNOWLEDGE HAS THIS HAZARD PREVIOUSLY CAUSED AN INCIDENT? NO YES, EXPLANATION: ------------------------------------------- IN THE EVENT OF DOUBT, ALWAYS REPORT! SAFETY FIRST! 39

Possible consequences when nothing is done about this ------------------------------------------- Your proposal for measures which could be taken ------------------------------------------- DETAILS OF THE REPORTING PARTY (NOT COMPULSORY!) NAME AND SIGNATURE: TELEPHONE NUMBER / E-MAIL: DATE OF REPORT: IN THE EVENT OF DOUBT, ALWAYS REPORT! SAFETY FIRST! 40