Aviation safety and safety management systems

In short

Aviation safety is the state in which the risk of harm to persons or property is reduced to, and maintained at or below, an acceptable level through a continuing process of hazard identification and safety risk management. A Safety Management System (SMS) is the formal, organisation-wide, data-driven way of achieving that — replacing the older "comply with the rules and hope" approach with proactive and predictive management. It rests on ICAO Annex 19 (Safety Management) internationally and, in India, on DGCA Civil Aviation Requirements Section 1 Series C (and the national State Safety Programme) which oblige scheduled operators, airports, MROs, ATS providers, training organisations and design/manufacturing organisations to run an accepted SMS. The topic is examined in B.Sc Aviation aviation-safety and human-factors papers, in DGCA ground-subject preparation, and is a guaranteed interview area for airline safety departments, airport operations, AAI/ATC and ground-handling roles.

Explained

Safety concepts, definitions and the evolution of safety thinking

• Safety (ICAO): the state in which risks associated with aviation activities are reduced and controlled to an acceptable level. It is not "zero accidents" — absolute safety is unachievable and unaffordable.
• Hazard: a condition or object with the potential to cause injury, damage or loss (e.g. a 15-knot crosswind, a wet runway, an unserviceable radio altimeter). A hazard is a *state*, not an event.
• Consequence: the potential outcome of a hazard. Risk: the predicted probability and severity of that consequence — risk is measured, a hazard is identified.
• Incident / serious incident / accident: an occurrence affecting or which could affect safety; a serious incident is one where an accident nearly occurred; an accident involves fatal or serious injury, substantial damage to the aircraft, or the aircraft being missing or inaccessible (ICAO Annex 13 definitions, adopted in India by the Aircraft (Investigation of Accidents and Incidents) Rules, 2017).
• Four eras of safety thinking: technical (to the 1960s — machine failures); human factors (1970s-90s

— the human at the sharp end); organisational (1990s onward — systemic and latent conditions); and the current total-system / data-driven era (interfaces between organisations, big-data and predictive analytics).

• Reactive → proactive → predictive: reactive methods investigate what has already happened (accidents, incidents); proactive methods look for hazards before loss (audits, surveys, reporting); predictive methods mine routine operational data (flight data monitoring, normal operations safety surveys) for emerging trends.

Accident causation models

• Reason's Swiss cheese model: defences are layered slices with holes (latent conditions and active failures); an accident occurs when the holes momentarily line up. Explains that front-line errors are usually the *last* link, not the cause.
• Active failures vs latent conditions: active failures are errors and violations with immediate effect (misread altimeter setting); latent conditions are decisions taken earlier by management/design (poor rostering, ambiguous checklist, inadequate training budget) that lie dormant.
• SHELL model: Software (procedures, manuals, software), Hardware (aircraft, equipment), Environment (weather, noise, shift timing, regulatory climate) and Liveware (people) around a central Liveware. Accidents come from mismatches at the interfaces, not from the blocks themselves.
• Heinrich pyramid / 1-29-300: many minor occurrences underlie each major loss — the rationale for treating low-level reports as early warning. The fixed ratio itself is not taken literally in modern practice.
• Bowtie: a diagram with the hazard/top event at the knot, threats and preventive barriers on the left, consequences and recovery barriers on the right — widely used in airport and fuel-handling risk assessment.
• James Reason's three-bucket model and the error-chain (dirty dozen) are covered in human performance; here they matter only as feeders into the SMS hazard log.
• Safety-I vs Safety-II: Safety-I counts what goes wrong; Safety-II (resilience engineering) studies why things usually go right and builds adaptive capacity. Modern SMS blends both.

The SMS framework: four components, twelve elements

1. Safety policy and objectives — (a) management commitment and responsibility; (b) safety accountabilities (the Accountable Executive holds ultimate accountability and controls the budget); (c) appointment of key safety personnel (Safety Manager, Safety Review Board, Safety Action Group); (d) coordination of the emergency response plan (ERP); (e) SMS documentation (the SMS Manual).
2. Safety risk management (SRM) — (f) hazard identification; (g) risk assessment and mitigation.
3. Safety assurance (SA) — (h) safety performance monitoring and measurement; (i) management of change; (j) continuous improvement of the SMS.
4. Safety promotion — (k) training and education; (l) safety communication (bulletins, safety magazine, feedback on reports).
5. Interfaces: SRM and SA are the "engine" — SRM designs controls, SA checks whether they work in practice and feeds new hazards back into SRM.
6. Safety culture is the enabler, not a component: informed, reporting, just, flexible and learning (Reason's five attributes). A just culture draws a clear line between honest error (not punished) and wilful violation/gross negligence or sabotage (not tolerated).

Safety risk management step by step

1. Identify the hazard — sources: voluntary and mandatory reports, FDM/FOQA exceedances, audits, LOSA/NOSS observations, investigation findings, change proposals, industry data.
2. Describe the generic hazard and its components — e.g. generic hazard "monsoon operations", component "contaminated runway".
3. Identify the consequences — runway excursion, overrun, tyre burst.
4. Assess probability on a 5-point scale (frequent 5, occasional 4, remote 3, improbable 2, extremely improbable 1).
5. Assess severity on a 5-point scale (catastrophic A, hazardous B, major C, minor D, negligible E).
6. Plot on the 5×5 risk matrix → risk index (e.g. 4B). Tolerability regions: intolerable/red (stop or mitigate immediately), tolerable/amber (acceptable only with mitigation, management decision and monitoring), acceptable/green (no further action beyond monitoring).
7. Select mitigation, in the ICAO order of preference: avoid the activity → reduce exposure/frequency → segregate or contain the exposure. Engineering controls beat procedural controls, which beat reliance on human vigilance (hierarchy of controls).
8. Re-assess the residual risk, check the mitigation has not introduced new hazards, assign an owner and a date, record in the hazard register / risk register, and monitor through safety assurance.
9. ALARP: risk reduced "as low as reasonably practicable" — further reduction would cost grossly disproportionate effort for the benefit gained.

Safety assurance, performance measurement and data systems

• SPI (safety performance indicator): a measured parameter, e.g. unstable approaches per 1,000 approaches. SPT (safety performance target): the value aimed for, e.g. reduce to 1.5. Alert level: a trigger based on past data (commonly mean + 1σ, 2σ, 3σ of the previous period) above which investigation is mandatory.
• Lagging vs leading indicators: lagging = outcome-based (accidents, serious incidents, ground damage events); leading = activity/precursor-based (report rate, training completion, GPWS warnings, TCAS RAs).
• ALoSP (acceptable level of safety performance): the minimum level of safety performance of civil aviation in a State, defined in its State Safety Programme and expressed as a set of SPIs and SPTs; service providers in turn agree their own SPIs and SPTs with the State.
• Reporting systems: mandatory occurrence reporting (MOR) for defined occurrences, and voluntary/confidential hazard reporting (VOR) protected from disciplinary use. DGCA operates confidential voluntary reporting and MOR channels under CAR Section 5 Series C; protection of safety data and safety information sources follows ICAO Annex 19 Appendix 3 principles.
• FDM / FOQA: routine de-identified download of flight data to detect exceedances (high rate of descent below 1,000 ft, long flare, flap/speed exceedance, excessive bank at low altitude). Mandated for Indian operators above specified aircraft mass; data use is governed by an FDM agreement with the pilot body so it stays non-punitive.
• LOSA / NOSS: line operations safety audit (flight deck) and normal operations safety survey (ATS) — trained observers record threats, errors and their management on *normal* flights; data are de-identified and never used against individuals.
• Management of change: before any change (new aircraft type, new route or aerodrome, new apron layout, organisational restructuring, outsourcing), a documented safety assessment identifies new hazards and re-validates existing controls.
• Audits: internal audit (first party), supplier/contractor audit (second party), regulator or IOSA (third party). IOSA (IATA Operational Safety Audit) and ISAGO (ground operations) are commercially essential for Indian carriers and ground handlers.

State-level framework and Indian regulatory structure

• ICAO Annex 19 (Safety Management) sets the State Safety Programme (SSP) and SMS requirements; Annex 13 governs accident and incident investigation; the ICAO Safety Management Manual (Doc 9859) is the standard reference.
• SSP — four components: State safety policy, objectives and resources; State safety risk management; State safety assurance; State safety promotion. India publishes a National Aviation Safety Plan and an SSP document.
• ICAO oversight: USOAP CMA (Universal Safety Oversight Audit Programme, Continuous Monitoring Approach) scores a State's Effective Implementation (EI) across eight critical elements — legislation, regulations, organisation, personnel licensing/training, technical guidance, licensing/certification, surveillance obligations, resolution of safety concerns. A systemic failure can produce a Significant Safety Concern (SSC).
• India's structure: the Bharatiya Vayuyan Adhiniyam, 2024 (which replaced the Aircraft Act, 1934 — check the current gazette for commencement of individual provisions) with the Aircraft Rules, 1937 as amended; the Directorate General of Civil Aviation (DGCA) as safety regulator issuing CARs; the Bureau of Civil Aviation Security (BCAS) for security; the Airports Authority of India (AAI) for ATS and many airports; the Airports Economic Regulatory Authority (AERA) for tariffs; and the Aircraft Accident Investigation Bureau (AAIB), which is independent of DGCA and investigates accidents and serious incidents under the Aircraft (Investigation of Accidents and Incidents) Rules, 2017.
• DGCA CAR structure worth knowing: Section 1 (General — includes SMS requirements, Series C), Section 2 (Airworthiness), Section 3 (Air Transport — includes passenger-facing requirements such as denied boarding and cancellation), Section 5 (Air Safety — includes occurrence reporting and investigation), Section 7 (Flight Crew Standards, Training and Licensing — includes flight duty time limitations, Series J), Section 8 (Aircraft Operations), Section 9 (Air Space and Air Traffic Management — series content varies — confirm the current series before quoting a number, as CAR numbering is revised frequently).
• Aerodrome side: aerodromes are licensed by DGCA under CAR Section 4 and must run an SMS, a Safety Management System Manual, an Aerodrome Manual, a Runway Safety Team, wildlife hazard management, apron safety and an aerodrome emergency plan with a full-scale exercise every two years and a partial/table-top exercise in the intervening years.
• Programmes and systems in Indian practice: eGCA (DGCA's digital licensing and approvals platform), SAFETY initiative / eSMS and spot-check regimes, the National Aviation Safety Plan, ramp inspections (SAFA-equivalent), and DGCA's annual audit/surveillance plan covering regulatory audits, spot checks and night surveillance.
• ICAO high-risk occurrence categories (global accident taxonomy, used in Indian safety plans): LOC-I (loss of control in flight), CFIT (controlled flight into terrain), RE (runway excursion), RI (runway incursion), MAC (mid-air collision/loss of separation), and ground safety/ramp damage. LOC-I dominates fatalities; runway excursion dominates accident counts.

Emergency response and the investigation process

• ERP defines delegation of authority, who assumes command, notification lists, crisis management centre, family assistance, media handling, and the transition from emergency to normal operations; it must be tested and integrated with the aerodrome emergency plan.
• Annex 13 investigation: sole objective is prevention of accidents and incidents — not apportioning blame or liability. Notification → investigator-in-charge appointed → site and wreckage survey → recorder recovery (CVR/FDR) → factual data gathering → analysis → findings, causes/contributing factors, safety recommendations → final report; preliminary report within 30 days, final report ideally within 12 months with an interim statement annually thereafter.
• State roles: State of Occurrence, State of Registry, State of the Operator, State of Design, State of Manufacture — each has participation rights (accredited representatives and advisers).
• Protection of records: CVR transcripts, witness statements and investigators' opinions are protected from use in disciplinary, civil or criminal proceedings except where a competent authority determines disclosure outweighs the adverse impact.

Key points

• Safety (ICAO) - risk of harm reduced to and kept at an acceptable level; not zero risk.
• Hazard vs risk - a hazard is a condition with potential for harm; risk is the predicted probability × severity of its consequence.
• SMS - a systematic approach to managing safety, comprising structures, accountabilities, policies and procedures; mandated by ICAO Annex 19.
• Four components, twelve elements - policy & objectives, safety risk management, safety assurance, safety promotion.
• Accountable Executive - single person with ultimate accountability and control over financial and human resources for the SMS.
• Swiss cheese model - latent organisational conditions plus active failures align through defensive layers to cause an accident.
• SHELL model - Software, Hardware, Environment, Liveware; accidents arise from interface mismatches.
• Reactive, proactive, predictive - investigate past events, hunt hazards before loss, mine routine data for trends.
• 5×5 risk matrix - probability 5-1 × severity A-E gives a risk index such as 3C; regions intolerable, tolerable, acceptable.
• Mitigation hierarchy - avoid, reduce, segregate; engineering controls above administrative controls above reliance on human vigilance.
• ALARP - risk reduced as low as reasonably practicable, balancing cost against benefit.
• SPI, SPT, alert level, ALoSP - the measurement chain of safety assurance.
• Just culture - honest errors reported without punishment; wilful violations and gross negligence remain accountable.
• FDM/FOQA and LOSA/NOSS - de-identified operational data as the predictive backbone of SMS.
• Management of change - any significant change triggers a documented safety assessment before implementation.
• SSP and USOAP EI - State-level mirror of SMS; ICAO audits a State's effective implementation across eight critical elements.
• Annex 13 - investigation exists solely for prevention, not blame; in India, AAIB investigates independently of DGCA.
• High-risk categories - LOC-I, CFIT, runway excursion, runway incursion, mid-air collision, ground damage.

Formulas and examples

Example 1 — risk index and tolerability. A domestic operator's hazard log records "ground handling tow-bar failure during pushback". Over the last 12 months there were 4 tow-bar failures in 40,000 pushbacks. The worst credible consequence is nose-gear damage with the aircraft out of service — major, no injuries.

• Occurrence rate = 4 / 40,000 = 1 in 10,000 pushbacks → on the operator's scale "remote" = probability 3.
• Severity: substantial aircraft damage, no injury → major = C.
• Risk index = 3C → in the tolerable (amber) region on the ICAO matrix: acceptable only with mitigation, sign-off by the Safety Review Board and continued monitoring.
• Mitigation: replace towbar pushback with towbarless tractors on the busiest stands (avoid the hazard), plus a pre-use torque inspection (reduce).
• Re-assessment after one year: 1 failure in 45,000 pushbacks = 1 in 45,000 → "improbable" = probability 2 → residual index 2C → acceptable with monitoring.

Example 2 — accident rate comparison. Airline P: 2 accidents in 1,250,000 departures. Airline Q: 1 accident in 400,000 departures.

• P = (2 / 1,250,000) × 1,000,000 = 1.6 accidents per million departures.
• Q = (1 / 400,000) × 1,000,000 = 2.5 accidents per million departures.
• Although Q had fewer accidents in absolute terms, its normalised rate is about 1.56 times P's. Always normalise by exposure (departures, sectors or flight hours) before comparing.

Example 3 — SPI, target and alert level. Unstable approaches recorded monthly over the last year: mean = 12 per month, standard deviation σ = 3. Monthly approaches ≈ 4,000.

• Baseline rate = (12 / 4,000) × 1,000 = 3.0 unstable approaches per 1,000 approaches.
• SPT for next year: a 25% reduction → 3.0 × 0.75 = 2.25 per 1,000, i.e. 9 events per month at the same traffic.
• Alert levels: mean + 1σ = 15, mean + 2σ = 18, mean + 3σ = 21 events per month.
• If a month records 19 events, two consecutive alert levels are breached → mandatory review by the Safety Action Group, root-cause analysis of approach briefing and ATC late descent clearances, with a corrective action plan.

Example 4 — cost-benefit of a mitigation (ALARP test). A regional airport suffers bird strikes costing an average of ₹18 lakh per event in engine inspection and delay, with 6 strikes a year. A proposed mitigation (bird-detection radar, grass-height management and two additional wildlife patrol staff) costs ₹1.2 crore capital and ₹30 lakh a year to run, and is expected to cut strikes by 60%.

• Present annual loss = 6 × ₹18,00,000 = ₹1.08 crore per year.
• Expected saving = 60% × ₹1.08 crore = ₹64.8 lakh per year.
• Net annual benefit = ₹64,80,000 − ₹30,00,000 = ₹34,80,000 per year.
• Simple payback on capital = ₹1,20,00,000 / ₹34,80,000 ≈ 3.45 years.
• Within a 10-year horizon the measure is clearly reasonably practicable, so under ALARP it should be implemented; the safety benefit of avoiding a potential catastrophic multiple-bird-strike event strengthens the case beyond the monetary figure.

Example 5 — safety assurance after a change. An operator adds a night schedule to a hill aerodrome with no precision approach. Management-of-change assessment: new hazards = CFIT risk on a circling approach at night, crew fatigue on a back-of-clock duty, no diversion field within 45 minutes.

• Initial risk: probability "occasional" 4, severity "catastrophic" A → 4A, intolerable.
• Controls: aerodrome-specific simulator qualification for captains, RNP approach with an approved minima set, terrain-awareness database update, a hard fuel policy with a named alternate, maximum two consecutive night duties.
• Residual risk: probability "extremely improbable" 1, severity A → 1A, tolerable with monitoring; SPIs = GPWS/EGPWS warnings per 100 approaches and unstable-approach rate on that route, reviewed monthly for the first six months.

Where it is used

• Scheduled airlines (Air India, IndiGo, Akasa, SpiceJet): safety departments running SMS, FDM/FOQA analysis, occurrence investigation, emergency response and IOSA renewal; entry roles are Safety Officer, FDM Analyst and Safety Data Analyst.
• Airports (AAI, Adani Airports, GMR, Mumbai and Delhi International Airports): aerodrome SMS, Runway Safety Teams, apron and airside safety audits, wildlife hazard management, aerodrome emergency exercises and works-in-progress safety assessments — the core of airport-operations job descriptions.
• Air traffic services: AAI ATC safety management, NOSS surveys, loss-of-separation and runway-incursion investigation, airspace change safety assessments.
• Ground handling and MRO: ISAGO-compliant SMS for ground damage prevention (the single largest cost driver in ramp operations), CAR 145 / CAMO safety and quality systems, human-factors error reporting in maintenance.
• Regulator and investigator roles: DGCA Flight Operations Inspector, Airworthiness Officer, Air Safety Officer; AAIB investigators; BCAS on the security side.
• Training organisations (DGCA-approved FTOs and B.Sc Aviation partner academies): FTO SMS, student incident reporting, aircraft utilisation and maintenance oversight — a frequent area of DGCA audit findings.

Interview questions

• Q: What is the difference between a hazard and a risk? A: A hazard is a condition or object with the potential to cause harm; risk is the assessed combination of the probability and severity of the harm that the hazard could produce.
• Q: Name the four components of an SMS. A: Safety policy and objectives, safety risk management, safety assurance, and safety promotion — subdivided into twelve elements in ICAO Annex 19 and Doc 9859.
• Q: Who is ultimately accountable for safety in an airline? A: The Accountable Executive — typically the CEO or Managing Director — because the role controls the financial and human resources needed for the SMS; accountability cannot be delegated, though tasks can.
• Q: What does "just culture" mean, and where is its limit? A: Staff can report errors and unsafe conditions without fear of punishment so that the organisation can learn; the limit is wilful violation, gross negligence, intoxication or destructive acts, which remain subject to disciplinary action.
• Q: Explain reactive, proactive and predictive safety methods with one example each. A: Reactive — investigating a runway excursion; proactive — a safety audit or hazard report on a slippery apron; predictive — FDM trend analysis showing rising high-energy approaches before any event occurs.
• Q: An unmitigated risk comes out as 5A on the matrix. What must you do? A: 5A is intolerable — the operation must be stopped or the risk reduced immediately by effective mitigation, re-assessed to a tolerable index, and only then resumed with monitoring.
• Q: What is the sole objective of an Annex 13 investigation? A: The prevention of future accidents and incidents; it is expressly not to apportion blame or liability, which is why its records are protected.
• Q: Who investigates aircraft accidents in India, and why must it be independent of DGCA? A: The AAIB, under the Aircraft (Investigation of Accidents and Incidents) Rules, 2017; independence prevents conflict of interest, since the regulator's own oversight may itself be a contributing factor.
• Q: Difference between SSP and SMS? A: SSP is the State's integrated set of regulations and activities to manage safety nationally (DGCA/MoCA in India); SMS is the service provider's own system, accepted and overseen by the State under the SSP.
• Q: What are SPIs and SPTs, and how is an alert level set? A: SPIs are measured safety parameters, SPTs are the targets set for them; alert levels are usually derived statistically from the previous period's data, commonly mean plus one, two and three standard deviations.
• Q: Why is FDM data de-identified? A: To keep the programme non-punitive so crews do not resist it; the agreement with the pilot body restricts use to safety analysis, not discipline, except in cases of deliberate unsafe acts.
• Q: A new apron taxiway is being commissioned at your airport. What does SMS require before it opens? A: A documented management-of-change safety assessment identifying new hazards (e.g. jet blast, restricted wingtip clearance, obscured markings), mitigations and residual risk, approval by the Safety Review Board, NOTAM action, and post-implementation monitoring.
• Q: Which occurrence categories cause the most fatalities and the most accidents? A: LOC-I accounts for the largest share of fatalities, while runway excursions account for the largest number of accidents — hence the global focus on upset prevention and recovery training and on runway safety teams.

Common mistakes

• Defining safety as "zero accidents" or "absence of risk" instead of risk controlled to an acceptable level.
• Using "hazard", "risk", "consequence" and "incident" interchangeably — examiners mark these as distinct terms.
• Confusing SMS with SSP, or SMS with a quality management system; QMS checks conformity to specification, SMS manages risk to safety outcomes.
• Mixing up probability and severity axes on the matrix, or quoting an index like "C3" when the convention is probability-then-severity (3C).
• Comparing raw accident counts between operators or airports without normalising by departures or flight hours.
• Treating just culture as a no-blame culture — forgetting that deliberate violations remain accountable.
• Listing only the four components in an exam answer when the question asks for the twelve elements, or omitting management of change and emergency response planning.
• Quoting a DGCA CAR section/series number from memory — the numbering and revisions change, so name the requirement and cite the current CAR only if certain.

Related topics

Human performance and limitations · Crew resource management · Air law and ICAO Annexes · Aerodrome operations and airside safety · Aviation meteorology and weather hazards · Aircraft maintenance human factors and airworthiness regulation