Draft CAR Section 1 Series C Part I - Establishment of Safety Management System

GOVERNMENT OF INDIA OFFICE OF THE DIRECTOR GENERAL OF CIVIL AVIATION TECHNICAL CENTRE, OPPOSITE SAFDARJUNG AIRPORT, NEW DELHI – 11 0 003 CIVIL AVIATION REQUIREMENTS SECTION 1 – GENERAL SERIES 'C' PART I Issue II, 17th March 2017 EFFECTIVE: FORTHWITH F.No. 15011/19/2017-AS Subject: Establishment of a Safety Management System (SMS) 1. INTRODUCTION 1.1 The ICAO safety management SARPs provide the high-level requirements, which the States are required to implement to fulfil their safety management responsibilities related to, or in direct support of, the safe operation of aircraft. ICAO in its Annexes requires ‘States to, as part of their safety programme, have the service providers/ organizations engaged in commercial operations, maintenance of aircraft, aerodrome operations, air traffic services providers, design and manufacture organizations and training organizations to implement a Safety Management System (SMS) which is acceptable to the State’. 1.2 In compliance with the standards of ICAO Annexes, various CARs specify the requirements for the establishment of SMS by an organisation. This CAR specifies the minimum acceptable requirements for the establishment of SMS in an organization. 1.3 This CAR lays down the aviation safety-related processes, procedures and activities for the establishment of SMS by an organization and is issued in accordance with rule 29D and rule 133A of the Aircraft Rules, 1937. 2. APPLICABILITY 2.1 The provisions of this CAR are applicable to an applicant for, or a holder of, one of the following approvals/permits/licence: 1i) Scheduled or Non-Scheduled Operator’s Permit issued under rule 134 or 134A. ii) Conducting operations of large or turbojet aeroplanes for general aviation. iii) Engaged in the operation of an aerodrome licensed under rule 78. iv) Engaged in the type design of aircraft. v) Engaged in manufacture of aircraft. vi) Maintenance organization approved under rule 133B. vii) Training organization approved under rule 41B. viii) An air traffic service provider. 3. DEFINITIONS 3.1 Acceptable level of safety performance (ALoSP): The minimum level of safety performance of civil aviation in a State, as defined in its State safety programme, or of a service provider, as defined in its safety management system, expressed in terms of safety performance targets and safety performance indicators. 3.2 Accountable executive: A single, identifiable person having responsibility for the effective and efficient performance of the State’s SSP or of the service provider’s SMS. 3.3 Change management: A formal process to manage changes within an organization in a systematic manner, so that changes which may impact identified hazards and risk mitigation strategies are accounted for, before the implementation of such changes. 3.4 Defences: Specific mitigating actions, preventive controls or recovery measures put in place to prevent the realization of a hazard or its escalation into an undesirable consequence. 3.5 Errors: An action or inaction by an operational person that leads to deviations from organizational or the operational person’s intentions or expectations. 3.6 High consequence indicators: Safety performance indicators pertaining to the monitoring and measurement of high consequence occurrences, such as accidents or serious incidents. High-consequence indicators are sometimes referred to as reactive indicators. 3.7 Inappropriate use: use of safety information for purposes different from the purposes for which it was collected, namely, use of the information for disciplinary, civil, administrative and criminal proceedings against operational personnel, and/or disclosure of the information to the public. (ICAO Annex 13/19) 3.8 Just Culture: It is a culture in which personnel are not punished for actions, omissions or decisions taken by them which are commensurate with their 2experience and training, but where gross negligence, wilful violations and destructive acts are not tolerated. 3.9 Lower consequence indicators: Safety performance indicators pertaining to the monitoring and measurement of lower-consequence occurrences, events or activities such as incidents, non-conformance findings or deviations. Lower- consequence indicators are sometimes referred to as proactive/predictive indicators. 3.10 Risk mitigation: The process of incorporating defences or preventive controls to lower the severity and/or likelihood of a hazard’s projected consequence. 3.11 Safety information: Information contained in Safety Data Collection and Processing System (SDCPS) established for the sole purpose of improving aviation safety, and qualified for protection under specified conditions. 3.12 Safety management system: A systematic approach to managing safety, including the necessary organizational structures, accountabilities, policies and procedures. 3.13 Safety performance: A State’s or service provider´s safety achievement as defined by its safety performance targets and safety performance indicators. 3.14 Safety performance indicator: A data-based safety parameter used for monitoring and assessing safety performance. 3.15 Safety risk: The predicted probability and severity of the consequences or outcomes of a hazard. 3.16 State safety programme: An integrated set of regulations and activities aimed at improving safety. 4. GENERAL 4.1 The applicant of, or holder of an approval/certificate/licence, as specified in Para 2 of this CAR shall develop, establish, maintain and adhere to a safety management system. 4.2 SMS framework shall incorporate four components and twelve key elements, as follows: 4.2.1 Safety policy and objectives i) Management commitment ii) Safety accountability and responsibilities iii) Appointment of key safety personnel iv) Coordination of emergency response planning 3v) SMS documentation 4.2.2 Safety risk management i) Hazard identification ii) Safety risk assessment and mitigation 4.2.3 Safety assurance i) Safety performance monitoring and measurement ii) Management of change iii) Continuous improvement of the SMS 4.2.4 Safety promotion i) Training and education ii) Safety communication 4.4 The safety management system shall be accepted by DGCA. 4.5 Detailed requirements for the acceptance of a safety management system are laid down in the subsequent paras of this CAR. 5. SAFETY POLICY AND OBJECTIVES 5.1 Management Commitment 5.1.1 The service provider shall define its safety policy in accordance with international and national requirements. The safety policy shall: a) reflect organisational commitment regarding safety, including the promotion of a positive safety culture; b) include a clear statement about the provision of the necessary resources for implementation of the safety policy; c) include safety reporting procedures; d) clearly indicate which types of behaviours are unacceptable related to the service provider’s aviation activities and include the circumstances under which disciplinary action would not apply; e) be signed by the accountable executive of the organisation; f) be communicated, with visible endorsement, throughout the organisation; and g) be periodically reviewed to ensure it remains relevant and appropriate to the service provider. 5.1.2 The safety policy shall include commitment to: a) achieve the highest safety standards; b) comply with all applicable regulatory requirements; c) comply with international standards; d) adopt proven best practices appropriate to the activity; 4e) provide all the necessary resources; f) ensure safety is a primary responsibility of all managers; g) follow the disciplinary policy; and h) ensure that the safety policy is understood, implemented and maintained at all levels. 5.1.3 In order to mitigate the organization’s risks, the management shall ensure the following: a) document organisational priorities; b) prescribe and document procedures for performing activities/processes; c) provide training to the staff to develop the necessary knowledge, skills and attitude; d) provide safety directives and controls to ensure their compliance; e) procure suitable equipment and systems to support activities and ensure its continuing serviceability; and f) ensure that necessary resources are deployed to maximise the organisations’ safety performance. 5.1.4 Based on the safety policy, the service provider shall define safety objectives, which shall: a) form the basis for safety performance monitoring and measurement; b) reflect the service provider’s commitment to maintain or continuously improve the overall effectiveness of the SMS; c) be communicated throughout the organization; and d) be periodically reviewed to ensure that they remain relevant and appropriate to the service provider. 5.2 Safety Accountabilities and Responsibilities 5.2.1 The service provider shall: a) identify the accountable executive for implementation and maintenance of effective SMS, who has effective control over the resources; b) define safety accountability throughout the organisation including the senior management; c) identify the responsibilities of all members of management with respect to the safety performance of the organisation; d) document and communicate safety accountability, responsibilities and authorities throughout the organisation; and e) define the levels of management with authority to make decisions regarding safety risk tolerability. 6. Appointment of Key Safety Personnel 56.1 The service provider shall appoint a safety manager, who is responsible for the implementation and maintenance of the SMS on behalf of the accountable executive. The safety manager’s functions include, but are not necessarily limited to: a) performing/facilitating hazard identification and safety risk analysis; b) monitoring corrective actions and evaluating their results; c) providing periodic reports on the organization’s safety performance; d) maintaining records and safety documentation; e) planning and facilitating staff safety training; f) providing independent advice on safety matters; g) monitoring safety concerns in the aviation industry and their perceived impact on the organisation’s operations; and h) coordinating and communicating (on behalf of the accountable executive) with DGCA and other organisations on issues relating to safety. 6.2 For selection of a safety manager, the organisation shall follow the criteria as laid down in applicable ICAO Standards and Recommended Practices (SARPS). 6.3 After induction, the safety manager shall be imparted knowledge of the organization’s operations, procedures and activities as well as the applicable ICAO Standards and Recommended Practices (SARPS). 6.4 The organisation shall have Safety Review Committee (SRC)/Safety Action Group (SAG) headed by the accountable executive with senior functional heads as members. 7. Coordination of Emergency Response Planning 7.1 The service provider shall establish and maintain Emergency Response Plan (ERP) for aircraft accidents and incidents and other aviation related emergencies. It shall be ensured that the ERP is interfaced with the service provider. 7.2 The ERP shall suit the scope and complexity of the organisation. 8. Documentation 8.1 The service provider shall develop and maintain an SMS manual, that describes its safety policy and objectives; SMS requirements; SMS processes and procedures; and accountability, responsibilities and authorities for SMS processes and procedures. 8.2 The service provider shall develop the SMS Manual. The contents of SMS Manual shall be as given in Appendix A to this CAR. 69. SAFETY RISK MANAGEMENT 9.1 Hazard Identification 9.1.1 The service provider shall develop and maintain a process to identify hazards associated with its products. 9.1.2 Hazard identification shall be based on a combination of reactive, proactive and predictive methods of safety data collection. Note: Reactive methods of hazard identification include mandatory accident and incident reports and investigations. Proactive methods include voluntary reports, surveys and audits. Predictive methods include flight data analysis and other methods of direct observation of safety-related activities. 9.2 Safety Risk Assessment and Mitigation 9.2.1 The service provider shall develop and maintain a process that ensures analysis, assessment and control of the safety risks associated with identified hazards. 9.2.2 The methodology for assessing risk shall include the following: i) establishment of acceptable level of risk, according to the ‘as low as reasonably practical’ (ALARP) principle; ii) assessment of risk taking into account the severity of safety outcome and probability of occurrence; iii) assessment of the tolerability of the risk; iv) determination as to whether the risk can be tolerated, eliminated, or mitigated to a tolerable level; and v) assessment of residual risks and any new risks introduced as a result of mitigation measures. 9.2.3 The organizations shall adopt a methodology suited to the scope and complexity of their activities and adaptable to their individual resources and expertise. 10. SAFETY ASSURANCE 10.1 Safety Performance Monitoring and Measurement a) The service provider shall develop and maintain the means to verify the safety performance of the organisation and to validate the effectiveness of safety risk controls. b) The service provider’s safety performance shall be verified with reference to the safety performance indicators and safety performance targets of the SMS in support of the organisation’s safety objectives. 7c) The development of targets and indicators shall be based upon variety of data. Such data shall include, but not limited to, the data used for hazard identification complemented by safety studies, surveys, audits and investigations. 10.2 Management of Change a) The service provider shall develop and maintain processes to identify changes, which may affect the level of safety risk associated with its aviation products or services and to identify and manage the safety risks that may arise from those changes. b) The organization shall assess the risks associated with significant changes in terms of the criticality of the affected systems, equipment and activities to aviation safety. 11. SAFETY PROMOTION 11.1 The organisation shall ensure effective communication throughout all levels of the organisation, sharing information about safety objectives and current safety activities and issues. 11.2 The Communication shall be from the ‘bottom-up’, in an environment that allows management to receive open and constructive feedback from operational personnel and to demonstrate that they are taking action in response to such feedback. 12. SAFETY TRAINING 12.1 The service provider shall develop and maintain a safety training programme to ensure that the personnel are trained and competent to perform the SMS duties. 12.2 The scope of the safety training programme shall be appropriate to each individual’s involvement in the SMS. 12.3 The scope of the training program shall be appropriate to each personnel involvement in the SMS. Specific training shall be developed for managers and for the accountable executive. 13. SAFETY COMMUNICATION 13.1 The service provider shall develop and maintain formal means for safety communication that: a) ensures personnel are aware of the SMS to a degree commensurate with their positions; b) conveys safety-critical information; 8c) explains why particular safety actions are taken to improve safety; and d) explains why safety procedures are introduced or changed. 13.2 The organization shall ensure that all SMS elements are developed and implemented within a framework of just culture. 13.3 The organization shall ensure that policies and procedures to support just culture are established and documented. Such policies and procedures shall include the following, but not limited to: i) Mandatory and voluntary reporting systems; and ii) Staff management including disciplinary procedures. 13.4 The senior management shall familiarize themselves with the principles and practice of Just Culture and incorporate a structured strategy for its development as part of the SMS implementation. 14. INTERFACE MANAGEMENT 14.1 The service provider shall ensure that: a) there is a policy establishing safety accountability and authority flow between the service provider and the sub-contractor; b) the sub-contractor has a safety reporting system commensurate with its size and complexity that facilitates the early identification of hazards and systemic failures of concern to the service provider; c) the safety/quality indicators to monitor sub-contractor performance are developed, where appropriate; d) the service provider’s safety promotion process ensures sub-contractor employees are provided with the organization’s applicable safety communications; and e) any sub-contractor roles, responsibilities and functions relevant to the service provider’s emergency response plan are developed and tested. 15. HOLDER OF MORE THAN ONE CERTIFICATE 15.1 The holder of more than one licence, approval or certificate as referred to in Para 2 of this CAR, shall integrate the requirements of these Parts into a single SMS, subject to the acceptance of the DGCA. 16. GUIDANCE AND PLAN FOR IMPLEMENTATION OF SMS 16.1 Details on the phase-wise implementation of SMS are given in Appendix B to this CAR. 917. GUIDANCE FOR PROTECTION OF SAFETY INFORMATION 17.1 The sole purpose of safety information shall be for improving aviation safety. The safety information so collected by DGCA shall qualify for protection under specified conditions. 17.2 Detailed guidance on protection of safety information is given in Appendix C to this CAR. (B. S. Bhullar) Director General of Civil Aviation 10Appendix ‘A’ CONTENTS OF THE SMS MANUAL The contents of the SMS manual may include the following sections: 1.1 Document control; 1.2 SMS regulatory requirements; 1.3 Scope and integration of the safety management system; 1.4 Safety policy; 1.5 Safety objectives; 1.6 Role, Safety accountability and responsibility of Personnel Involved in SMS 1.7 Safety reporting and remedial actions; 1.8 Hazard identification and risk assessment; 1.9 Safety performance monitoring and measurement; 1.10 Safety-related investigations and remedial actions; 1.11 Safety training and communication; 1.12 Continuous improvement and SMS audit; 1.13 SMS records management; 1.14 Management of change; and 1.15 Emergency/contingency response plan. 11Appendix ‘B’ PHASE-WISE IMPLEMENTATION OF SMS Timelines for At the time of Application for At the time of Application for + 18 Months (Phase 3) + 18 Months (Phase 4) Implementation AOP (Phase 1) AOP (Phase 2) To demonstrate a) Identify SMS accountable a) Establish safety policy a) Establish voluntary a) Enhance existing disciplinary executive. and objectives. hazard reporting procedure/ policy with due b) Establish SMS b) Define safety procedure. consideration of unintentional errors implementation team. management b) Establish safety risk or mistakes from deliberate or gross c) Define scope of the SMS. responsibilities and management violations. d) Perform SMS gap accountabilities across procedures. b) Integrate hazards identified from analysis. relevant departments of c) Establish occurrence occurrence investigation reports with e) Develop SMS the organization. reporting and the voluntary hazard reporting implementation plan. c) Establish SMS/safety investigation system. f) Establish key coordination mechanism/ procedures. c) Integrate hazard identification and person/office responsible committee. d) Establish safety data risk management procedures with the for the administration and d) Establish departmental/ collection and sub-contractor’s or customer’s SMS maintenance of the SMS. divisional SAGs where processing system for where applicable. g) Establish SMS training applicable. high-consequence d) Enhance safety data collection and program for personnel, outcomes. e) Establish emergency processing system to include lower- with priority for the SMS e) Develop high- response plan. consequence events. implementation team. consequence SPIs and f) Initiate progressive e) Develop lower-consequence SPIs h) Initiate SMS/safety associated targets and development of SMS and associated targets/alert settings. communication channels. alert settings. document/manual and f) Establish SMS audit programs or f) Establish management other supporting integrate them into existing internal of change procedure documentation. and external audit programs. that includes safety risk g) Establish other operational SMS assessment. review/ survey programs where g) Establish internal quality appropriate. audit program. h) Establish external h) Ensure that SMS training program for quality audit program. all relevant personnel has been completed. i) Promote safety information sharing and exchange internally and externally. Note:  Actual implementation period is dependent on the scope of actions required for each element allocated and the size/complexity of the organization. The time period will be acceptable to the DGCA as part of SMS acceptance process.  Small and non-complex organizations should develop a simplified SMS that is workable with limited resources and expertise. While SMS should include all of the key SMS elements described in this CAR, documentation and procedures should be limited to the scope of the organization’s activities and readily used without excessive management effort. 12Appendix ‘C’ GUIDANCE ON PROTECTION OF SAFETY INFORMATION Description DGCA SDCPS shall refer to databases, schemes for exchange of information, and recorded information and include, but not limited to: a) Records/evidence pertaining to accident and incident investigations. b) Mandatory incident reporting system. c) Voluntary incident reporting system. d) Data/information captured from DGCA Oversight (regulatory audits/surveillance/ spot checks, etc.). e) Self-disclosure reporting systems, including automatic data capture systems Principles of Protection a) Safety information shall qualify for protection from inappropriate use according to specified conditions that will include, but not necessarily be limited to, collection of information for explicit safety purposes and disclosure of such information would inhibit its continued availability. b) Safety information shall not be used in a way different from the purposes for which it was collected. Principles of Exception Exceptions to the protection of safety information shall only be granted when: a) DGCA considers that circumstances reasonably indicate that the occurrence may have been caused by conduct with intent to cause damage or conduct with knowledge that damage would probably result, equivalent to reckless conduct, gross negligence or willful misconduct. b) Review by DGCA determines that the release of the safety information is necessary for the proper administration of justice, and that its release outweighs the adverse domestic and international impact and such a release may have on the future availability of safety information. Public Disclosure Subject to the principles of protection and exception outlined above, any person seeking disclosure of safety information shall justify its release. Formal criteria for disclosure of safety information shall be established to include, but not necessarily be limited to, the following: 13a) Disclosure of the safety information is necessary to correct conditions that compromise safety and/or to change policies and regulations. b) Disclosure of the safety information does not inhibit its future availability in order to improve safety. c) Disclosure of relevant personal information included in the safety information complies with applicable privacy laws. d) Disclosure of the safety information is made in a de-identified, summarized or aggregate form. Designated Entities Responsible for SDCPS a) Records/evidence pertaining to accident/incident investigations - Aircraft Accident Investigation Bureau (AAIB) & Air Safety Directorate (DGCA) b) Mandatory incident reporting systems- Air Safety Directorate (DGCA) c) Voluntary incident reporting systems,- Air Safety Directorate (DGCA) d) Data/information captured from DGCA Oversight- All Directorates of DGCA e) Self-disclosure reporting systems, including automatic data capture systems,- All Directorates of DGCA It shall be the responsibility of the custodian of safety information to apply all possible protection regarding the disclosure of the information, unless: a) There is a consent of the originator of the information for disclosure; or b) There is a reason that release of safety information is in accordance with the principles of exception. 14