THE NATIONAL ACADEMIES PRESS

This PDF is available at http://nap.edu/22138 SHARE

   

A Guidebook for Safety Risk Management for Airports (2015)

DETAILS

212 pages | 8.5 x 11 | PAPERBACK

ISBN 978-0-309-30865-6 | DOI 10.17226/22138

CONTRIBUTORS

GET THIS BOOK Kenneth Neubauer, Dave Fleet, and Manuel Ayres, Jr.; Airport Cooperative
Research Program; Transportation Research Board; National Academies of
Sciences, Engineering, and Medicine
FIND RELATED TITLES

SUGGESTED CITATION

National Academies of Sciences, Engineering, and Medicine 2015. A Guidebook for

Safety Risk Management for Airports. Washington, DC: The National Academies
Press. https://doi.org/10.17226/22138.


Visit the National Academies Press at NAP.edu and login or register to get:

– Access to free PDF downloads of thousands of scientific reports

– 10% off the price of print titles
– Email or social media notifications of new titles related to your interests
– Special offers and discounts


Distribution, posting, or copying of this PDF is strictly prohibited without written permission of the National Academies Press.
(Request Permission) Unless otherwise indicated, all materials in this PDF are copyrighted by the National Academy of Sciences.

Copyright © National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

AIRPORT COOPERATIVE RESEARCH PROGRAM

ACRP REPORT 131

A Guidebook for Safety
Risk Management
for Airports

Kenneth Neubauer
Futron Aviation Corporation
Norfolk, VA

Dave Fleet
Futron Aviation Corporation
Norfolk, VA

Manuel Ayres, Jr.

Airport Safety Management Consultants LLC
Ann Arbor, MI

Subscriber Categories
Aviation  •  Safety and Human Factors

Research sponsored by the Federal Aviation Administration

TRANSPORTATION RESEARCH BOARD

WASHINGTON, D.C.
2015
www.TRB.org

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

AIRPORT COOPERATIVE RESEARCH PROGRAM ACRP REPORT 131

Airports are vital national resources. They serve a key role in trans­ Project 04-16
portation of people and goods and in regional, national, and inter­ ISSN 1935-9802
national commerce. They are where the nation’s aviation system ISBN 978-0-309-30865-6
­connects with other modes of transportation and where federal respon­ Library of Congress Control Number 2015938387
sibility for managing and regulating air traffic operations intersects
with the role of state and local governments that own and operate most © 2015 National Academy of Sciences. All rights reserved.
airports. Research is necessary to solve common operating problems,
to adapt appropriate new technologies from other industries, and to
introduce innovations into the airport industry. The Airport Coopera­ COPYRIGHT INFORMATION
tive Research Program (ACRP) serves as one of the principal means by
Authors herein are responsible for the authenticity of their materials and for obtaining
which the airport industry can develop innovative near-term solutions
written permissions from publishers or persons who own the copyright to any previously
to meet demands placed on it. published or copyrighted material used herein.
The need for ACRP was identified in TRB Special Report 272: Airport
Research Needs: Cooperative Solutions in 2003, based on a study spon­ Cooperative Research Programs (CRP) grants permission to reproduce material in this
publication for classroom and not-for-profit purposes. Permission is given with the
sored by the Federal Aviation Administration (FAA). The ACRP carries understanding that none of the material will be used to imply TRB or FAA endorsement
out applied research on problems that are shared by airport operating of a particular product, method, or practice. It is expected that those reproducing the
agencies and are not being adequately addressed by existing federal material in this document for educational and not-for-profit uses will give appropriate
research programs. It is modeled after the successful National Coopera­ acknowledgment of the source of any reprinted or reproduced material. For other uses of
tive Highway Research Program and Transit Cooperative Research Pro­ the material, request permission from CRP.
gram. The ACRP undertakes research and other technical activities in a
variety of airport subject areas, including design, construction, mainte­
nance, operations, safety, security, policy, planning, human resources, NOTICE
and administration. The ACRP provides a forum where airport opera­
tors can cooperatively address common operational problems. The project that is the subject of this report was a part of the Airport Cooperative Research
Program, conducted by the Transportation Research Board with the approval of the
The ACRP was authorized in December 2003 as part of the Vision Governing Board of the National Research Council.
100-Century of Aviation Reauthorization Act. The primary participants in
the ACRP are (1) an independent governing board, the ACRP Oversight The members of the technical panel selected to monitor this project and to review this
report were chosen for their special competencies and with regard for appropriate balance.
Committee (AOC), appointed by the Secretary of the U.S. Department of The report was reviewed by the technical panel and accepted for publication according to
Transportation with representation from airport operating agencies, other procedures established and overseen by the Transportation Research Board and approved
stakeholders, and relevant industry organizations such as the Airports by the Governing Board of the National Research Council.
Council International-North America (ACI-NA), the American Associa­
The opinions and conclusions expressed or implied in this report are those of the
tion of Airport Executives (AAAE), the National Association of State researchers who performed the research and are not necessarily those of the Transportation
Aviation Officials (NASAO), Airlines for America (A4A), and the Airport Research Board, the National Research Council, or the program sponsors.
Consultants Council (ACC) as vital links to the airport community; (2)
The Transportation Research Board of the National Academies, the National Research
the TRB as program manager and secretariat for the governing board; Council, and the sponsors of the Airport Cooperative Research Program do not endorse
and (3) the FAA as program sponsor. In October 2005, the FAA executed products or manufacturers. Trade or manufacturers’ names appear herein solely because
a contract with the National Academies formally initiating the program. they are considered essential to the object of the report.
The ACRP benefits from the cooperation and participation of airport
professionals, air carriers, shippers, state and local government officials,
equipment and service suppliers, other airport users, and research orga­
nizations. Each of these participants has different interests and respon­
sibilities, and each is an integral part of this cooperative research effort.
Research problem statements for the ACRP are solicited periodically
but may be submitted to the TRB by anyone at any time. It is the
responsibility of the AOC to formulate the research program by iden­
tifying the highest priority projects and defining funding levels and
expected products.
Once selected, each ACRP project is assigned to an expert panel,
appointed by the TRB. Panels include experienced practitioners and
research specialists; heavy emphasis is placed on including airport pro­
fessionals, the intended users of the research products. The panels pre­
pare project statements (requests for proposals), select contractors, and
provide technical guidance and counsel throughout the life of the
Published reports of the
­project. The process for developing research problem statements and
selecting research agencies has been used by TRB in managing cooper­ AIRPORT COOPERATIVE RESEARCH PROGRAM
ative research programs since 1962. As in other TRB activities, ACRP
are available from:
project panels serve voluntarily without compensation.
Primary emphasis is placed on disseminating ACRP results to the Transportation Research Board
Business Office
intended end-users of the research: airport operating agencies, service 500 Fifth Street, NW
providers, and suppliers. The ACRP produces a series of research Washington, DC 20001
reports for use by airport operators, local agencies, the FAA, and other
interested parties, and industry associations may arrange for work­ and can be ordered through the Internet at
shops, training aids, field visits, and other activities to ensure that http://www.national-academies.org/trb/bookstore
results are implemented by airport-industry practitioners. Printed in the United States of America

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished scholars engaged in scientific
and engineering research, dedicated to the furtherance of science and technology and to their use for the general welfare. Upon the
authority of the charter granted to it by the Congress in 1863, the Academy has a mandate that requires it to advise the federal
government on scientific and technical matters. Dr. Ralph J. Cicerone is president of the National Academy of Sciences.

The National Academy of Engineering was established in 1964, under the charter of the National Academy of Sciences, as a parallel
organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the
National Academy of Sciences the responsibility for advising the federal government. The National Academy of Engineering also
sponsors engineering programs aimed at meeting national needs, encourages education and research, and recognizes the superior
achievements of engineers. Dr. C. D. Mote, Jr., is president of the National Academy of Engineering.

The Institute of Medicine was established in 1970 by the National Academy of Sciences to secure the services of eminent members
of appropriate professions in the examination of policy matters pertaining to the health of the public. The Institute acts under the
responsibility given to the National Academy of Sciences by its congressional charter to be an adviser to the federal government
and, upon its own initiative, to identify issues of medical care, research, and education. Dr. Victor J. Dzau is president of the
Institute of Medicine.

The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of
science and technology with the Academy’s purposes of furthering knowledge and advising the federal government. Functioning in
accordance with general policies determined by the Academy, the Council has become the principal operating agency of both the
National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and
the scientific and engineering communities. The Council is administered jointly by both Academies and the Institute of Medicine.
Dr. Ralph J. Cicerone and Dr. C. D. Mote, Jr., are chair and vice chair, respectively, of the National Research Council.

The Transportation Research Board is one of six major divisions of the National Research Council. The mission of the Transporta-
tion Research Board is to provide leadership in transportation innovation and progress through research and information exchange,
conducted within a setting that is objective, interdisciplinary, and multimodal. The Board’s varied activities annually engage about
7,000 engineers, scientists, and other transportation researchers and practitioners from the public and private sectors and academia,
all of whom contribute their expertise in the public interest. The program is supported by state transportation departments, federal
agencies including the component administrations of the U.S. Department of Transportation, and other organizations and individu-
als interested in the development of transportation. www.TRB.org

www.national-academies.org

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

COOPERATIVE RESEARCH PROGRAMS

CRP STAFF FOR ACRP REPORT 131

Christopher W. Jenks, Director, Cooperative Research Programs
Michael R. Salamone, ACRP Manager
Marci A. Greenberger, Senior Program Officer
Joseph J. Snell, Program Associate
Eileen P. Delaney, Director of Publications
Hilary Freer, Senior Editor

ACRP PROJECT 04-16 PANEL

Field of Safety
Connie M. Proctor, Salt Lake City International Airport, West Jordan, UT (Chair)
Kent V. Hollinger, MITRE Corporation, McLean, VA
Bruce MacLachlan, Lewiston Airport, ID
Dawn Mehler, DHL Express (USA), Inc, Plantation, FL
Jose R. Ruiz, Southern Illinois University–Carbondale, Murphysboro, IL
Thomas M. “Tom” Williams, Meridian Regional Airport, Meridian, MS
Matthew J. Griffin, Airports Consultants Council Liaison
Bernardo Kleiner, TRB Liaison

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

FOREWORD

By Marci A. Greenberger
Staff Officer
Transportation Research Board

ACRP Report 131: A Guidebook for Safety Risk Management for Airports provides guidance
on conducting the safety risk management (SRM) process, one of the four components of
a Safety Management System (SMS). The guidebook is organized to allow readers who are
new to SMS and its components to understand where the SRM process falls within an over­
all SMS; those familiar with the SMS concepts and ready to specifically learn more about
the SRM process can go directly to the relevant material.
The guidebook provides information on conducting safety risk assessments (SRA) and
tailors this information so that it can be scaled for smaller airports with fewer resources.
Tools and templates are provided as appendices and typical accident and incident rates are
provided to help airport operators understand some potential airport risks.

Although a final regulation has not been issued by the FAA to airport operators on estab­
lishing an SMS, the industry has been preparing for this eventuality. There have been airport
pilot studies and those lessons learned have been published. It is also believed that many
airports currently conduct safety risk assessments; however, the formality expected to be
required will be new to airports. Futron Aviation, as part of ACRP Project 04-16, devel­
oped this guidebook to assist airports of all sizes in navigating the safety risk management
process. Airport directors, safety managers, and operations, maintenance, and public safety
employees will benefit from understanding the SRM process and its application to the daily
operation of the airport and unique events, including construction.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CONTENTS

P A R T I   Using the Guidebook

3 Chapter 1  Glossary
3 1.1 Acronyms
4 1.2 Definitions
8 1.3  Key Terms and Standardization
11 Chapter 2  Introduction
11 2.1 Background
12 2.2  Guidebook Audience
13 Chapter 3  Using the Guidebook
13 3.1  Guidebook Organization
14 3.2  Key Concepts
16 Chapter 4  Small Airports

P A R T I I   Safety Risk Management Concepts

19 Chapter 5  The Big Picture—SRM and SMS
22 Chapter 6  Risk and Risk Management
22 6.1 Hazards
23 6.2 Risk
25 6.3  Risk Management
27 6.4  Risk Classification
27 6.5  SRM and SMS Component Interaction
30 Chapter 7  SRM Phases
30 7.1  Planning Phase
31 7.2  Preparation Phase
32 7.3  Execution Phase
34 Chapter 8  SRM at Small Airports

P A R T I I I  The Srm Process and Application

37 Chapter 9  SRM 5-Step Process
37 9.1  Step 1—Describe the System
39 9.2  Step 2—Identify Hazards
41 9.3  Step 3—Analyze the Risks
43 9.4  Step 4—Assess the Risks
47 9.5  Step 5—Mitigate the Risks

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

50 Chapter 10  Applying the SRM Process

52 Chapter 11  SRM Applied to Small Airports
52 11.1  Conducting Effective SRM with Limited Resources
52 11.2  Overcoming Challenges
53 11.3  Making It Simple
53 11.4  Using Simple Tools for Risks and Controls

P A R T I V   SRM in Daily Operations

57 Chapter 12  SRM in Daily Operations
57 12.1  SRM as a Component of Operational Effectiveness
58 12.2  SRM in Operational Settings
61 Chapter 13  Time-Critical SRM—ABCD Model
64 Chapter 14  Implementing Mitigation Actions
64 14.1  Working with Likelihoods and Outcomes for Risk Mitigation
68 14.2  General Considerations
70 14.3  Making Decisions About Risk Mitigations
71 14.4  Ensuring Risk Mitigations Are in Place
72 14.5  Monitoring Mitigation Actions and Risk
73 14.6  Mitigation Actions
74 Chapter 15  Daily SRM for Small Airports

P A R T V   Safety Risk Assessment (SRA)

81 Chapter 16  Introduction to SRA
82 16.1  Benefits of an SRA
82 16.2  Responsibility to Conduct an SRA
83 16.3  When Is an SRA Needed?
86 16.4  Categories of SRA Triggers
90 16.5  Support Material
92 Chapter 17  Conducting an SRA
92 17.1  Before—SRA Preparation and Planning
96 17.2  Conducting an SRA
99 17.3  After—SRA Documentation
103 Chapter 18  Facilitating an SRA
103 18.1 Preparing to Facilitate an SRA
106 18.2 Facilitating the SRA
109 18.3 Recording/Documenting the Proceedings
110 Chapter 19  SRA for Small Airports
110 19.1 SRA Planning
110 19.2 Conducting the SRA
110 19.3 Documenting the SRA

111 Appendix A  SRM and the FAA

117 Appendix B  SRM Handbook

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

123 Appendix C  SRM Process Tools

132 Appendix D  SRM Templates
179 Appendix E  Preliminary Hazard Lists (PHLs)
197 Appendix F  Typical Accident and Incident Rates
199 Appendix G  Typical KPIs and Associated Data
201 Appendix H  Basic Probability and Statistics for SRM

Note: Photographs, figures, and tables in this report may have been converted from color to grayscale for printing.
The electronic version of the report (posted on the web at www.trb.org) retains the color versions.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Pa rt I

Using the Guidebook

This guidebook has five parts. Part I will help readers become familiar with Safety Management
System (SMS) and safety risk management (SRM) terms and definitions. Part I identifies key
terms and how they relate to one another and explains how to use the guidebook. Readers will
also learn how the guidebook can benefit all airports, regardless of size or complexity.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 1

Glossary

One reason for this guidebook is to promote consistency in the use of safety and risk manage-
ment terms. To do this, the authors compared FAA and International Civil Aviation Organization
(ICAO) references to non-aviation industry references to identify inconsistent nomenclature.
When the authors found multiple terms with common meanings and uses, they identified the
most commonly accepted terms.
Terms used by the FAA Office of Airports (ARP) and ICAO are preferred; where terms from
other industries or organizations are used, sources are noted. The glossary will help airport staff
use the terms more uniformly, thus reducing confusion and setting up consistency across the
industry. Although some of the terms defined are not used in this guidebook, they are included
because they are commonly used in industry or by regulators.

1.1 Acronyms
AAS FAA Office of Airport Safety and FOIA Freedom of Information Act
Standards
ICAO International Civil Aviation
ACM Airport Certification Manual Organization
ACRP Airport Cooperative Research KPI Key Performance Indicator
Program
PIREP Pilot Report
ARFF Aircraft Rescue and Fire Fighting
SA Safety Assurance
ARP FAA Office of Airports
SAS Safety Assessment Screening
ATCT Air Traffic Control Tower
SME Subject Matter Expert
ATO FAA Air Traffic Organization
SMS Safety Management System
AVS FAA Office of Aviation Safety
SOP Standard Operating Procedure
FAA Federal Aviation Administration
SRA Safety Risk Assessment
FBO Fixed-Base Operator
SRM Safety Risk Management
FOD Foreign Object Damage or
SRMD Safety Risk Management
Foreign Object Debris
Document

3  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

4   A Guidebook for Safety Risk Management for Airports

1.2 Definitions
Accountable Executive—a single identifiable person responsible for the effective and effi-
cient performance of the airport’s SMS. (ICAO Doc 9859, 3rd edition Safety Management
Manual—SMM)
Aircraft Accident—an occurrence, associated with the operation of an aircraft, that occurs
between the time any person boards the aircraft with the intention of flight and until all such
persons have disembarked; and in which any person suffers death or serious injury, or the air-
craft receives substantial damage. (NTSB, Part 830)
Aircraft Incident—an occurrence, other than an accident, that is associated with the opera-
tion of an aircraft and that affects or could affect the safety of operations. (NTSB, Part 830)
Airport Project—an airport construction project that affects the physical characteristics of
the airport, airport layout plan approvals, or review of construction safety phasing plans. (FAA
Order 5200.11)
As Low As Reasonably Practicable (ALARP)—describes a safety risk reduced to a level that
is as low as reasonably practicable; that is, any further risk reduction is either impracticable or
grossly outweighed by the cost. (ICAO Safety Management Manual) Note: in the latest version
of ICAO Safety Management Manual (3rd Edition, 2013) ALARP was removed. It is provided here
for reference only.
Common Cause Failure—a failure that occurs when a single fault results in the correspond-
ing failure of multiple system components or functions. (FAA Order 5200.11)
Comparative Safety Assessment (CSA)—a safety analysis that provides a list of hazards asso-
ciated with a project proposal, along with a risk assessment of each alternative-hazard combina-
tion. A CSA is used to compare alternatives from a risk perspective. (FAA SRM Guidance for
System Acquisitions, 2007)
Construction Safety and Phasing Plan (CSPP)—a document that outlines procedures, coordi-
nation, and control of safety issues during construction activity on an airport. (FAA AC 150/5370-2)
Control—see Risk Control.
FAA Office of Airports (ARP)—provides leadership in planning and developing a safe and effi-
cient national airport system. The office is responsible for all programs related to airport safety and
inspections and standards for airport design, construction, and operation (including international
harmonization of airport standards). The office also is responsible for national airport planning
and environmental and social requirements and establishes policies related to airport rates and
charges, compliance with grant assurances, and airport privatization. (http://www.faa.gov/about/
office_org/headquarters_offices/arp/)
FAA Air Traffic Organization (ATO)—the operational arm of the FAA. It is responsible
for providing safe and efficient air navigation services to 30.2 million square miles of airspace.
(http://www.faa.gov/about/office_org/headquarters_offices/ato/)
FAA Office of Aviation Safety (AVS)—responsible for the certification, production approval,
and continued airworthiness of aircraft; and certification of pilots, mechanics, and others in
safety-related positions. (http://www.faa.gov/about/office_org/headquarters_offices/avs/)
Hazard—A condition that could foreseeably cause or contribute to an accident. (FAA Order
8040.4A) Note: Section 1.3 discusses this in further detail.
Hazard Assessment—a systematic, comprehensive evaluation of a change, operation, system,
or safety issue. (DRAFT FAA AC 150/5200-37A)

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Glossary  5  

Incident—an occurrence, other than an accident, associated with the operation of an aircraft,
that affects or could affect the safety of operations. (49 CFR 830.2)
Injury Severity (ICAO Annex 13)
• Minor—any injury that is neither fatal nor serious.
• Serious—an injury that (1) requires hospitalization for more than 48 hours, commencing
within 7 days from the date the injury was received; (2) results in a fracture of any bone
(except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, mus-
cle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree
burns, or any burns affecting more than 5 percent of the body surface.
• Fatal—fatal injuries include all deaths determined to be a direct result of injuries sustained in
the accident, and within 30 days of the date of the accident.
International Civil Aviation Organization (ICAO)—a specialized agency of the United
Nations, the ICAO promotes the safe and orderly development of international civil aviation
throughout the world. (http://www.icao.int/about-icao/Pages/default.aspx)
Key Performance Indicator (KPI)—a set of quantifiable measures that a company or indus-
try uses to gauge or compare performance in terms of meeting strategic and operational goals.
Within the context of SRM, the KPI will be safety related. (Various sources)
Likelihood—the estimated probability or frequency, in quantitative or qualitative terms, of a
hazard’s effect. (FAA Order 5200.11)
Material Change—any change, relating to a construction project, that is a result of the envi-
ronmental or design process and/or alternative selection that changes the physical layout. Such
changes could introduce safety risks. (FAA Order 5200.11)
National Airspace System (NAS)—the common network of U.S. airspace; air naviga-
tion facilities; equipment and services; airports or landing areas; aeronautical charts and
information services; rules, regulations, and procedures; technical information; and labor
and material. The NAS includes system components shared with the military. (FAA Pilot/
Controller Glossary, 2014)
Operational Risk Management (ORM)—a decision-making tool used by personnel at all
levels to increase effectiveness by identifying, assessing, and managing risks. By reducing the
potential for loss, the probability of a successful mission increases. (Chief of Naval Operations
Instruction 3500.39C)
Outcome—a specific system state and sequence of events supported by data and expert
opinion that clearly describes the outcome. The term implies that it is reasonable to expect the
assumed combination of conditions may occur within the operational lifetime of the system.
(FAA Order 5200.11) Note: Other terms used in risk management as substitutes for outcome include
consequence, effect, and result. Outcome is used throughout the guidebook.
Preliminary Hazard Assessment (PHA)—an overview of the hazards associated with an
operation or project proposal consisting of an initial risk assessment and development of safety-
related requirements. (FAA ARP Desk Reference)
Preliminary Hazard List (PHL)—a list of anything that the analyst can think of that can go
wrong, based on the concept, its operation, and implementation. (FAA System Safety Hand-
book, 2000) Note the FAA System Safety Handbook, 2000, is no longer in use by the FAA and is
only used as a resource because it cross references some FAA ATO documents.
Qualitative Risk—level of risk based on subjective measures, rather than quantitative metrics.
(Various sources)

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

6   A Guidebook for Safety Risk Management for Airports

Quantitative Risk—level of risk based on objective data and metrics. (Various sources)
Risk—see Safety Risk.
Risk Analysis—the process during which a hazard is characterized for its likelihood and the
severity of its effect or harm. Risk analysis can be either quantitative or qualitative; however,
the inability to quantify or the lack of historical data on a particular hazard does not preclude
the need for analysis. (DRAFT FAA AC 150/5200-37A)
Risk Assessment—the process by which the results of risk analysis are used to make deci-
sions. The process combines the effects of risk elements discovered in risk analysis and com-
pares them against acceptability criteria. A risk assessment can include consolidating risks into
risk sets that can be jointly mitigated, combined, and then used in making decisions. (FAA
Order 5200.11)
Risk Assessment Code (RAC)—the ranking of risks based on the combination of likelihood
and consequence (severity) values. A widely used SRM term throughout DoD and governmental
agencies. (DoD MIL-STD-882E)
Risk Control—reduction of risk severity and/or likelihood, via the application of engineer-
ing and/or administrative hazard controls. Risk control can also be anything that mitigates or
ameliorates the risk. (FAA System Safety Handbook) Note: In this guidebook, risk mitigation is
used instead of risk control.
Risk Matrix—table depicting the various levels of severity and likelihood as they relate to the
levels of risk (e.g., low, medium, or high). (FAA Desk Reference)
Risk Mitigation—any action taken to reduce the risk of a hazard’s effect. (DRAFT FAA AC
150/5200-37A) Note: Further definition is provided in Section 1.3.
Root Cause Analysis—analysis of deficiencies to determine their underlying root cause.
(FAA AC 120-79A)
Safety—the state in which the risk of harm to persons or property damage is acceptable. (FAA
Order 8000.369A); The state in which the possibility of harm to persons or of property damage
is reduced to, and maintained at or below, an acceptable level through a continuing process
of hazard identification and safety risk management. (ICAO Doc 9859, Safety Management
Manual—SMM)
Safety Assessment—completion of the applicable SAS, the SRM 5-step process of identifying
and analyzing hazards and documentation of the SRA panel’s findings, as applicable. (FAA ARP
Desk Reference)
Safety Assessment Screening (SAS)—an FAA form (5200-8, 5200-9 or 5200-10) used to
document the ARP Safety Assessment process. Specifically, the SAS form is used to document
the appropriate level of assessment, the five steps of SRM, and the final signatures and approvals.
(FAA ARP Desk Reference)
Safety Assurance—the process and procedures of management functions that evaluate the
continued effectiveness of implemented risk mitigation strategies, support the identification of
new hazards, and function to systematically provide confidence that an organization meets or
exceeds its safety objectives through continuous improvement. (FAA AC 150/5200-37)
Safety Evaluation—procedures to monitor performance with respect to safety objectives,
SMS requirements, and/or safety initiatives. (FAA AC 150/5200-37)
SMS Manual—an airport-developed document that describes the SMS components and how
they will be established and will function. An SMS manual may resemble the Airport Certification

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Glossary  7  

Manual (ACM). Whereas an ACM describes how an airport operates, an SMS Manual describes
how the SMS functions. (FAA AC 150/5200-37)
Safety Management System (SMS)—a formal, top-down, organization-wide approach to
managing safety risk and ensuring the effectiveness of safety risk controls. An SMS includes
systematic procedures, practices, and policies for managing safety risk. (FAA Order VS
8000.369A)
Safety Objective—a measurable goal or desirable outcome related to safety. (FAA AC
150/5200-37)
Safety Performance Indicator (SPI)—a data-based safety parameter used for monitoring and
assessing safety performance. (ICAO Doc 9859, Safety Management Manual—SMM)
Safety Policy—defines the fundamental approach to managing safety that is to be adopted
within an organization. Safety policy further defines the organization’s commitment to safety
and overall safety vision. (AC 150-5200-37)
Safety Promotion—the combination of safety culture, safety training, and communication
activities that support the implementation and operation of the SMS in an organization. (AC
150-5200-37)
Safety Risk—the composite of predicted severity and likelihood of the potential effect of a
hazard. (FAA Order 8040.4A)
• Initial—the predicted severity and likelihood of a hazard’s effects or outcomes when it is
first identified and assessed; includes the effects of pre-existing risk controls in the current
environment.
• Current—the predicted severity and likelihood at the current time.
• Residual—the remaining predicted severity and likelihood that exists after all selected risk
control techniques have been implemented.
Safety Risk Assessment—assessment of a system or component, often by a panel of system
subject matter experts (SMEs) and stakeholders, to compare an achieved risk level with the
tolerable risk level. (Various sources)
Note: during the FAA SMS Pilot Studies multiple airports adopted the term SRA to describe the
5-step process, defined within SRM: (1) define the system, (2) identify the hazards, (3) assess the risks,
(4) analyze the risks, and (5) mitigate the risks. In this guidebook, safety risk assessment is used exclu-
sively when describing the 5-step process and the conduct of that process with a panel of SMEs.
Safety Risk Control—anything that mitigates the safety risk of a hazard. Safety risk controls
necessary to mitigate an unacceptable risk should be mandatory, measurable, and monitored for
effectiveness. (FAA AC 150/5200-37)
Safety Risk Management—a standard set of processes to identify and document hazards,
analyze and assess potential risks, and develop appropriate mitigation strategies. (FAA ARP SMS
Desk Reference)
Safety Risk Management Document (SRMD)—an ATO-specified description of the safety
analysis for a given proposed change. An SRMD documents the evidence to support whether
or not the proposed change to the system is acceptable from a safety risk perspective. SRMDs
are maintained by the organization responsible for the change for the lifecycle of the system or
change. (FAA Order 5200.11)
Safety Risk Management Panel—a group formed to formalize a proactive approach to system
safety and a methodology that ensures hazards are identified and unacceptable risk is mitigated

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

8   A Guidebook for Safety Risk Management for Airports

before the change is made. An SRM Panel provides a framework to ensure that, once a change is
made, the change will be tracked throughout its lifecycle. (FAA Order 5200.11)
Note: this term is synonymous with Safety Risk Assessment (SRA) Panel. This guidebook uses SRA
Panel as the common term.
Severity—the measure of how severe the results of a hazardous condition’s outcome are
predicted to be. Severity is one component of risk. The safety risk of a hazard is assessed on the
combination of the severity of and the likelihood (probability) of the potential outcome(s) of
the hazard. (FAA Order 8040.4A)
Single Point Failure—a failure of an item that would result in the failure of the system and
is not mitigated by redundancy or an alternative operational procedure. (FAA Order 5200.11)
Small Airport—a non-primary airport with less than 20 employees working full time.
(defined by the author for this guidebook)
System—an integrated set of constituent pieces combined in an operational or support envi-
ronment to meet a defined objective. Elements include people, hardware, software, firmware,
information, procedures, facilities, services, and other support facets. (FAA Order 8040.4)
Note: See the 5M Model.
System State—an expression of the various conditions, characterized by quantities or quali-
ties, in which a system can exist. (FAA ATO SMS Manual)
Triggers for SRM—the requirements, precursors, or organizational plans that lead
to initiation of the SRM process. Note: Triggers are explained in more detail in Part V,
Chapter 16.
Validation—the process of proving the functions, procedures, controls, and safety standards
are correct and the right system is being built (that is, the requirements are unambiguous, cor-
rect, complete, and verifiable.) (FAA Order 5200.11)
5M Model—A model often used to help define an operational system, composed of five
elements: Mission, huMan, Machine, Management, and environMent (also called Media).
(Various sources)

1.3  Key Terms and Standardization

Some safety and risk management terms are commonly used when addressing the subject. A
few key terms are defined further to ensure consistent understanding in the airport industry and
to minimize misuse or interchanging of terms.

Safety
A well understood definition of the term safety is necessary given that the SRM process deals
predominately with safety risks. Three definitions of safety follow:
• Safety—freedom from harm or danger: the state of being safe; the state of not being danger-
ous or harmful. (Merriam-Webster)
• Safety—freedom from unacceptable risk. (FAA)
• Safety—the state in which the risk of harm to persons or property damage is reduced to, and
maintained at or below, an acceptable level throughout a continuing process of hazard iden-
tification and risk management. (ICAO)

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Glossary  9  

From an airport perspective, any of the definitions can suffice. The FAA’s definition is the
simplest, while ICAO’s definition is the most complete. All definitions address that which can
do harm within the organization. Airports should develop or adopt a definition for safety that
is compatible with their safety policies and objectives. For this guidebook, the FAA definition is
the accepted definition.

Hazard
Airport personnel must have a clear, consistent understanding of the term hazard. Many air-
ports in the early stages of SRM implementation use hazard synonymously with the term risk;
however, these are different although related terms. A hazard must exist for the airport to be at
risk. A hazard is defined as any existing or potential condition that can lead to injury, illness, or
death to people; damage to or loss of a system, equipment, or property; or damage to the envi-
ronment. A hazard is a condition that is a prerequisite of an accident or incident. A hazard might
or might not result in a situation of high risk. (Various sources)
Airport personnel need to learn the difference between a hazard and the risks posed by a haz-
ard. The SRM process functions effectively only when the organization actively identifies con-
ditions or potential conditions that can result in undesirable or harmful outcomes; the airport
identifies hazards, then assesses and mitigates the risks.

Risk
Hazards present risk. Risk is the composite of predicted severity and likelihood of the poten-
tial outcome of a hazard.
Risks may be categorized as follows:
• Initial—the severity and likelihood of a hazard’s risk when it is first identified and assessed,
including the effects of pre-existing risk controls in the current system.
• Current—the predicted severity and likelihood of a hazard’s risk at the current time.
• Residual—the risk that remain after all risk mitigations have been implemented or exhausted
and all risk mitigations have been verified.

Outcome
An outcome is the potential undesirable result of a hazard or the ill effects potentially
resulting from exposure to a hazard. In this guidebook, outcome is used rather than conse-
quence or effect.

Safety Risk Assessment (SRA)

According to the FAA and as defined in the ARP Desk Reference Guide, an SRA is one element
of SRM and involves the SRM 5-step process by identifying hazards and analyzing, assessing,
and mitigating risks and documenting findings. An SRA may be developed and conducted by a
single person or a panel of SMEs and stakeholders with a facilitator.
The SRA and SRM processes differ as follows. SRM is the component of SMS that deals
directly with safety hazards, their potential outcomes, and the risks associated with them. SRM
defines the management tools and responsibilities and the triggers that cause an SRM action to
happen. SRA is the act of conducting the 5-step process and addressing the hazardous conditions
of a system or planned event.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

10   A Guidebook for Safety Risk Management for Airports

Risk Mitigation
Mitigating airport risks is the result of a proactive SRM process. The FAA ARP defines risk
mitigation as follows:
Risk Mitigation—an airport operator-developed option or an alternative strategy to modify or reduce
the risk of an identified hazard. Mitigations can be used to reduce the hazard’s effects on the system. Risk
mitigation is also referred to as a risk control. Most risk management strategies address medium and
high-risk hazards. Low-risk hazards may be accepted after considering risk.

Risk management activities should identify feasible options to manage risk according to the
following categories:
• Avoidance—selecting a different approach or not participating in, or allowing, the operation
or procedure.
• Acceptance—accepting the likelihood, probability, and consequences associated with the
risk.
• Control—developing options and alternatives that minimize or eliminate the risk.
• Transfer—shifting the risk to another area.

In this guidebook, mitigation and mitigate are used instead of control.

Baseline Safety
An airport uses an SMS to improve safety performance. In order to measure change, airport
management must establish a safety performance baseline. Safety performance cannot be mea-
sured daily like the number of departures or gallons of fuel pumped into aircraft. Safety perfor-
mance is assessed over extended periods.
The baseline level of safety performance is established before SMS implementation. Airport
management should review and analyze past safety performance measures and identify a period
when performance was judged acceptable. This could be for a 3-month period, a 6-month
period, or as long as a year. The longer the selected period, the more patient the organization
must be in assessing the success of SMS initiatives.
Key decisionmakers should receive regular updates on safety performance compared with
baseline safety. These updates help decisionmakers make informed decisions on the use of
resources. Current safety data enhances discussions on whether safety resources are being used
effectively and where resources should be otherwise allocated.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 2

Introduction

The U.S. aviation system is one of the safest in the world. This is the result of decades of
examining and reviewing incidents and accidents and making improvements based on the find-
ings. After-action efforts—in response to aircraft incidents and accidents, ground movement
incursions (by vehicles, equipment, or pedestrians), and incidents that have hampered the safe
operation of aircraft—have resulted in regulations and guidance to reduce the likelihood of
incidents, accidents, and incursions occurring. For airports, 14 CFR Part 139 is, in many ways, a
proactive and systematic approach to managing risks. The FAA developed the regulations based
on the lessons learned by airports over time. The result is processes, procedures, and physical
requirements to reduce the likelihood of incidents, accidents, and incursions occurring.
Airport operators deal with risk every day and in everything they do. The risk is sometimes
within their control, and sometimes it is not. Regulations and guidance developed and enforced
by the FAA are a way to manage the risk inherent in the National Airspace System (NAS).
Although this approach has been successful for more than 50 years, as air traffic increases, safety
performance needs to improve. With traffic growth, the number of accidents tends to increase if
the level of safety remains constant. To preserve public confidence, the aviation industry, using
new technologies and approaches like SMS, needs to further reduce the chances of accidents. The
implementation of NEXTGEN technologies and processes over the coming decade will bring
changes to the NAS and require airports to adapt accordingly. SMS is a way to adapt current
safety programs and methods to meet the requirements of these changes. Safety Risk Manage-
ment, the key operational component of an SMS, is a creative method that looks into the future,
rather than solely reacting to past events as the catalyst for improving safety.
As the industry becomes more complex and aircraft become more sophisticated, demands
on airports will increase. If public confidence in the safety of the air transportation system is
to be maintained, everyone involved must play a role. Simply following regulations will not be
enough. Regulations too often are developed in reaction to past events. Managing risk needs
to be proactive and consider the specific characteristics of each airport. This guidebook gives
airport operators the means and methods to perform SRM and considers the wide spectrum of
airport characteristics. Airport owners and operators will benefit from regular use of this guide-
book, regardless of airport size or complexity.

2.1 Background
The FAA is developing regulations to require 14 CFR Part 139 certificated airports to develop
and implement SMS. This is a result of the International Civil Aviation Organization (ICAO)
requirement for all member states (the United States being one) to develop and implement SMS
for the regulator and the international airports of member states.

11  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

12   A Guidebook for Safety Risk Management for Airports

The airport industry knows that SMS will become a regulatory requirement. SMS will require
more knowledge and training for airport staff and stakeholders. SMS references that provide
objective and practical guidance specifically addressing airport needs are needed. The need for
SRM guidance became clear during the FAA pilot studies on SMS. Given this situation combined
with a desire to address pending regulation, the industry identified the need for this guidebook.
In developing this guidebook, the authors used many lessons learned from the FAA-sponsored
SMS Pilot Studies. Key information about SRM learned during the pilot studies helped to identify
tools and support data that were missing and that should be developed to help airports run their
SRM processes. The guidebook also reflects experiences from other countries and other industries
that have adopted SMS. The guidebook presents concepts that are important to proper implemen-
tation and application of SRM, but many of these concepts (such as SRM and SRA triggers) can be
difficult to understand or apply correctly. Questions about when the SRM process can and should
be applied, and what considerations go into the decision to convene a panel and conduct an SRA
arise often during early SMS implementation efforts. The guidebook provides explanations and
examples for important concepts like these.
The guidebook also consolidates information on the resources available, uses research and
experience to fill the gaps, and provides guidance and examples to help the industry move
forward with SMS to improve the managing of safety.

2.2  Guidebook Audience

This guidebook was developed for airport staff responsible for SMS. The person or team
responsible for an airport’s safety should have in-depth knowledge of SMS and SRM; however,
everyone working at an airport is responsible for safety. This guidebook can help anyone—airport
staff, consultant or stakeholder—better understand SRM concepts, their practical application in
dealing with airport issues that affect safety, and how SRM can enhance job performance.
The guidebook provides airports with tools to develop, set up, and perform SRM. Airports are
the link between aircraft operators, the FAA, and the traveling public. With the right resources to
manage safety risks, airports can improve the overall safety of the aviation industry and specifi-
cally improve safety for their airport users. SRM used by one airport positively affects not only
the airport staff, but everyone involved with, working on, or traveling from that airport and can
even reach outside the immediate airport environment and improve the safety for the surround-
ing community and its activities.
Regardless of past or pending regulations, SRM is a proven way to manage safety—determining
hazards and their associated risks and mitigating them, before accidents occur, thus improving the
overall safety performance of the National Airspace System (NAS).
SRM processes are not restricted to managing safety risk. The techniques can be used in every
line of business. Other airport lines of business, such as environmental management, use similar
approaches to manage the risk of their activities. Risk management, through use of the meth-
ods and tools in this guidebook, can be applied to all aspects of the airport, including property
development, concessions, and Fixed-Base Operator (FBO) operations. Using a common risk
management approach is helpful from a standardization perspective. A common approach will
reduce confusion among organizational divisions and increase understanding and acceptance
of risk management throughout the airport community.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 3

Using the Guidebook

The guidebook provides tools, examples, and guidance to help airports manage safety risks
using the SRM process. Airport operators can use the guidebook to develop scalable SRM
processes and procedures.
The guidebook provides sections and chapters that can standalone. An airport manager need
not need absorb all contents to start using SRM. For example, Appendix B, which provides the
basics for a handbook to conduct a safety risk assessment (SRA), is effective as a standalone tool.
If theory and background behind process and tools are needed, users can easily find and extract
such material for education and training when necessary.
All readers, regardless of their knowledge of SMS and SRM, should become familiar with the
overall content and structure and then review applicable chapters more thoroughly.
This guidebook is a resource—for ideas, examples, lessons learned, methods, techniques,
templates, and tools for use at their airport—airports should not consider it as required or
prescriptive doctrine. This guidebook reflects input from various industries and can provide the
foundation for how the airport management conducts its daily business, rather than SRM being
just part of safety business.

3.1  Guidebook Organization

The guidebook has five major parts. Each part has several chapters, as shown in Figure 3-1.
Each part builds on the previous part and provides the user with information and tools necessary
to develop and set up SRM. The appendices have additional material, such as tools, templates,
and information on baseline risks, to help airports carry out SRM processes.
• Part I discusses the guidebook’s structure (see Figure 3-1). Part I presents key terms and
explains how key ideas, hints, and concepts are highlighted.
• Part II presents basic SRM concepts. Part II helps the reader understand SRM, where it
fits within the airport SMS, and its relationships with other SMS components. Part II also
addresses how SRM improves airport systems and projects.
• Part III explains how to apply SRM. Part III also describes (1) how to use the five steps of the
SRM process to address hazards and identify actions to mitigate risks and (2) the continual
interaction between SRM and Safety Assurance (SA).
• Part IV presents SRM processes in the operational sense. Part IV describes how routine haz-
ards are dealt with every day and how they are documented for further analysis. When non-
routine hazards are present, such as those associated with airfield construction or special
events, Part IV helps the user recognize SRM triggers and when to gather a team to conduct
an SRA. Part IV also describes the decision and implementation processes for risk mitigations.

13  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

14   A Guidebook for Safety Risk Management for Airports

Figure 3-1.   Guidebook outline.

• Part V focuses on procedures for evaluating more complex hazards using SRA techniques
and templates. Part V addresses SRA planning, facilitation, and reporting, including specific
facilitation techniques and support material available in the appendices, such as preliminary
lists of hazards and baseline risks.

3.2  Key Concepts

The guidebook is organized so that important concepts are easily located. The Contents and
Figure 3-1 tell where to find parts, chapters, and key concepts. The appendices include vari-
ous tools, templates, and samples. For example, there is a sample SRM handbook that can be
removed, reproduced, and used to guide the formal application of SRM.
To direct the user to key SRM aspects and identify where and when they apply, the guidebook
uses text boxes with icons as indicators. They are as follows:

This icon and text box point out Key Aspects of the guidebook.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Using the Guidebook   15  

This icon and text box point to important concepts and how they
Apply to Small Airports.

This icon and text box point out Potential Bottlenecks and practi-
cal alternatives to overcome such bottlenecks.

This icon and text box point to Examples and Practical Recom-
mendations.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 4

Small Airports

For this guidebook, a small airport is non-primary and has fewer than 20 employees working
full time. Most small airports have limited resources and staff to manage an SMS and to run SRM
processes. Despite these limits, small airports can benefit from using SRM concepts and applying
the templates and tools presented in this guidebook.
At the end of each part, a section is devoted to helping small airports set up SRM using avail-
able resources. The Small Airport icon points out guidance for small airports throughout the
guidebook.

Regardless of pending regulatory requirements, small airports

can use the SMS and SRM concepts described in this guidebook to
manage safety issues at the airport actively and effectively.

16

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

PA RT I I

Safety Risk
Management Concepts
Part II presents key concepts about SRM and identifies where it fits within an airport SMS.
Those leading the SMS and SRM efforts at an airport must fully understand these elements and
educate airport personnel on the aspects relevant to their safety roles and responsibilities.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 5

The Big Picture—SRM and SMS

An SMS enables an airport to (1) anticipate and manage safety risks before system failures
occur and (2) find out how to improve safety after accidents and incidents have happened. Air-
ports have been pursuing these goals since long before SMS was introduced to the industry. With
SMS, airports can move from sporadic and isolated safety initiatives to a systematic process in
which the entire airport works in a coordinated, more effective manner.
The success of an airport’s SMS hinges on identifying potential hazards and deciding the
likelihood of accidents occurring and then using this information to make decisions in time to
lessen unacceptable risk. SRM also includes monitoring mitigations to find out their effective-
ness and to start future hazard mitigation plans. This is what SRM does and the reason that SRM
is considered the “heart” of an SMS.
Even with the importance of SRM, its effective use cannot improve safety performance by
itself. Effective SRM application works in coordination with the other three components of
SMS: Safety Policy, Safety Assurance, and Safety Promotion. The four SMS components work
in concert and continuously. None exists as a standalone element and each component provides
inputs to and supports the others.
SRM is the primary operational component of the airport SMS. SRM is used by every airport
function to manage risks at the airport every day. Effective SRM needs the active participation
of all personnel at the airport (that is, airport staff, airlines, tenants, business partners, and other
stakeholders). For SRM to work to benefit the airport, those involved in flight operations, emer-
gency response, ground handling, and facility maintenance must constantly watch for condi-
tions that could disrupt aircraft operations and the flow of people and cargo or cause damage to
the assets needed to promote air transportation.

To explain how the four components of a Safety Management

System (SMS) integrate, an example of an airport considering
how to manage an increasing birdstrike rate follows.

A study identified the top ten airports with the highest rates of birdstrikes in the country; the
sign was the number of birdstrikes causing adverse effect on flights. The example airport was

19  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

20   A Guidebook for Safety Risk Management for Airports

one of the top ten airports. Adverse effects of a birdstrike can range from damage to aircraft to
aborted takeoffs and delays.
Examples for each component of SMS in relation to the scenario for birdstrike rates follow:
• Safety Policy: The airport management decided to act to lessen the number of birdstrikes. The
goal was to reduce the birdstrike rate by 20% every year, for 3 years. A special meeting with
the SMS Accountable Executive, the Director of Operations, the wildlife management staff,
and the SMS Coordinator was scheduled for once a month.
• Safety Risk Management: With the goal set by the airport management, airport personnel
conducted an SRA to identify hazards and develop actions to lessen the number of birdstrikes
at the airport. The SRA was conducted with the help of a panel composed of airport staff
members, two SMEs on birdstrikes from outside the airport staff, and an SRA facilitator.
During the SRA, a statistical summary of birdstrike data showed the species with the highest
number of birdstrikes and the periods of the year with the highest frequencies and ranked
the species causing the highest number of birdstrikes with adverse effects. The SRA used the
SRM 5-step process recommended by the FAA. Some actions were identified and approved to
reduce the attraction of hazardous species and to harass or deter those species. It was thought
that performing these actions would lessen the rate of birdstrikes to achieve the goal set by
airport policymakers.
• Safety Assurance: The SMS Coordinator defined the number of birdstrikes with adverse
effects as a new safety performance indicator for the airport. Data on birdstrikes was col-
lected monthly to record the total number of birdstrikes, the number of birdstrikes with an
adverse effect, and the birdstrikes associated with the species with the highest risk identi-
fied during the SRA. Data were collected in coordination with all tenant airlines and the
general aviation community. During the monthly meetings, the SMS Coordinator, with the
wildlife management staff, presented trends to the Accountable Executive and the Director
of Operations.
• Safety Promotion: In the SRA, incorporating a risk-based approach to wildlife manage-
ment was identified as an airport gap. The SMS Coordinator developed and delivered a
special training program on SMS for wildlife staff. Operations inspectors and maintenance
staff were asked to report to wildlife management when certain species of birds were on the
airside and posters with birdstrike hazard themes were prepared to remind staff to report.
The airport bought and used new tools for harassing and deterring hazardous species. At
the beginning of project implementation, and throughout the effort, the airport manager
communicated with personnel and explained the actions taken and the reasons for the
actions, as well as periodic progress reports on the success of the actions in reaching the
airport’s goal.
Conclusions drawn from this example follow. The airport management policy decisions
set a goal to lessen birdstrikes, to support the effort by keeping track of results, and to
allocate resources for equipment needed to carry out risk mitigation actions, which set the
stage for the SRM process to be successful. Keeping track of birdstrike data and trends is an
important assurance element that shows the actions defined by the SRM process are working
to meet the goal. If trends show the rate of birdstrikes is not decreasing, or the decrease will
not meet the goal set by the airport’s management, these results might trigger another SRA
to identify more actions. The training developed for airport stakeholders and the messages
from the airport manager helped promote awareness, understanding, acceptance, and sup-
port for the safety improvement initiatives. The approach to reducing the risk of birdstrikes
was anchored by SRM activities and supported by actions that fall under the other SMS
components.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

The Big Picture—SRM and SMS   21  

S afety Risk Management (SRM) will not be effective without the

safety policy, safety assurance, and safety promotion components
supporting SRM outputs.

Risk mitigation actions arising from SRM processes may require new tools and equipment,
more training, and improved awareness. Without safety promotion and management commit-
ment to use resources to control hazards, neither the SRM outcome nor SMS performance will
be effective.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 6

Risk and Risk Management

This chapter presents basic concepts of risk and how it is managed. The terms hazard and risk
are explained in detail, how hazards and risk relate is outlined, how risk is classified is described,
and how SRM interacts with the other SMS components is further clarified.

6.1 Hazards
In addition to the definitions provided in Sections 1.2 and 1.3, ICAO and the FAA clearly
define a hazard. According to ICAO, a hazard is a “condition or object with the potential of caus-
ing injuries to personnel, damage to equipment or structures, or reduction of ability to perform
a prescribed function.” The FAA uses this definition—“a condition that could foreseeably cause
or contribute to an accident.”
Some hazards are obvious, like a worn out tire. When driving, a flat tire may cause loss of
directional control or braking capability, which may lead to an accident. Other hazards are more
intangible. A passenger bridge operated by personnel with inadequate training may cause dam-
age to an aircraft arriving at the gate.
Some hazards are common to all airports—jet blast or rotating propellers, and hazardous
materials like fuel, oil and hydraulic fluid. The existence of these materials and equipment by
themselves does not set up a hazard; but when humans are exposed to them, or operations are
conducted contrary to normal procedures, these materials and equipment can become hazards.

 he materials and equipment common to the airport industry are

T
not in themselves hazards. When they become part of a danger-
ous condition, like the rotating propeller example that follows,
they are considered hazards.

Rotating propellers are not hazardous when the aircraft is taxiing on a taxiway with no per-
sonnel or equipment nearby. However, when the aircraft is parked at a loading gate, with one
engine running (rotating propellers) and ground crews and equipment are servicing the aircraft,
then the rotating propeller presents a hazardous condition. Harm to a person or damage to
equipment could occur if contact is made with the spinning propeller.
Each individual airport will also have unique hazards based on their configuration and pro-
cedures. Airport personnel recognize and understand many of these unique conditions. These
well-known hazards may affect many systems or situations in different ways and, therefore, are

22

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Risk and Risk Management   23  

routinely identified during the SRM process. Developing a preliminary hazard list (PHL) is a
timesaving SRM technique. The PHL can be a catalyst for proper hazard identification. Appen-
dix E lists some common airport hazards.

Airports should be wary of relying too heavily on a PHL. It can

become a crutch and be considered as a definitive source that
includes all airport hazards. The SRM process can start with the
preliminary list, but then staff need to dig deeper into the system
under consideration and anticipate more hazards. New hazards
can then be reviewed and considered for addition to the list.

Ways to identify hazards at an airport follow:

• Checklists: checklists prepared for self-inspections may include the presence of FOD, pave-
ment deterioration, and faults in the lighting system and signs.
• Observation and experience: an operations inspector is continuously searching for anything
that may pose a safety risk to airport operations, even when not listed in the self-inspection
checklists. Examples of hazards in this category include vehicles speeding on the ramp and
equipment parked outside designated areas.
• Brainstorming: this is the most common method used during SRAs. A group of stakehold-
ers meet to identify hazards and analyze risks. During the brainstorming session, the group
develops a list of hazards associated with the issue being assessed. Brainstorming is a common
basis for Preliminary Hazard Analysis (PHA), Comparative Safety Assessment (CSA) and
Operational Safety Assessment (OSA).
• Accident/incident investigations: when studying the causes of accidents and incidents, the
hazards and contributing factors to the event are identified. For example, an airside driver
struck an aircraft causing minor damage during a ground handling operation. The accident
investigation revealed the brakes failed when approaching the aircraft, which resulted in a col-
lision. Improper vehicle maintenance and a violation of standard procedures were identified
as hazards leading to the incident.
• Job hazard analyses: this is a technique that uses job tasks to identify hazards. A job hazard
analysis explores how the worker, the specific task, the required tools, and the work environment
relate. For example, an airport maintenance worker using a chipping hammer to break concrete
pavement during repair work is subject to flying particles. The job hazard analysis identifies flying
concrete particles as a hazard that can cause injuries.
• Preliminary hazard lists (PHLs): based on the safety issue or activity, preliminary lists of
hazards can be prepared using a PHA (see the example in Appendix E).

6.2 Risk
Before understanding how risk can be managed, it is necessary to fully understand what risk
is and how it relates to hazards. Risk combines two components: likelihood (or probability) and
severity. Under the SMS approach, risk is the probability of an undesirable event occurring.
Although risk is sometimes represented as a mathematical equation (risk = likelihood × severity
of outcome), risk is not calculated using this formula to come up with a quantitative value. The
“risk formula” is a simple representation that the parameter (risk) has two components (likeli-
hood and severity).

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

24   A Guidebook for Safety Risk Management for Airports

The terms hazard and risk are often used synonymously. This is in-
correct. A hazard is a condition that can present risk to the airport.
The risk is the likelihood that the hazard will cause an undesir-
able outcome and the potential severity of that outcome. This is a
key point for all airport personnel to understand. An airport with
strong SRM processes in place has all airport personnel identifying
and reporting hazards.

The analysis of risk is one of the steps of the SRM 5-step process and is addressed in detail
in Chapter 9. For the discussion herein, the two components of risk can be illustrated by an
example of how risk is analyzed for issues facing an airport. Suppose an airport has experienced
two runway excursions in the past 6 months and wants to find out the risk of future excursions
occurring. Several hazardous conditions can result in a runway excursion—the outcome.

To explain the two components of risk, severity and likelihood,

runway excursions at an airport are used here as an example.

6.2.1  Severity of Outcomes

The outcome is the effect of a hazard and the undesirable result the airport wants to avoid or
control. Describing the outcome is always the first step in defining the risk. In this case, the out-
come can be defined as “an aircraft accident resulting from a runway excursion.” According to
NTSB, an aircraft accident is “an occurrence in which any person suffers death or serious injury,
or the aircraft receives substantial damage.” If the event results in no death or serious injury and
the aircraft receives no substantial damage, the event is considered an aircraft incident.
The difference between accident and incident is important because the outcome and its sever-
ity are related. The severity of an incident, by definition, is lower than that of an accident. It is
also important to know that within the “accident” and “incident” categories are many possible
outcomes. One possible outcome is a runway excursion incident with the aircraft staying in the

Airports should resist the temptation to predict that all hazards

will result in a fatality or major damage to assets, such as an
aircraft hull loss. Although a fatal accident may happen, these
are rare events and may not be considered likely outcomes.
For example, a wingtip collision may lead to catastrophic out-
come if fuel is spilled and ignited; however, historically no such
accidents have occurred in the United States with commercial
aircraft and, therefore, a more believable outcome for air-
craft wingtip collision is aircraft structural damage or a delay
in operations.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Risk and Risk Management   25  

paved areas off the runway—on the runway shoulders, for example. In this example, the severity
of the outcome is considered minor because no damage to the aircraft or injury to crew members
or passengers occurred. The range of outcomes associated with a hazard is normally classified
according to the severity of each possible outcome.

6.2.2 Likelihood
The likelihood component of risk is the estimated probability or frequency, in quantitative or
qualitative terms, of a hazard’s outcome. In other words, how often does or could the undesir-
able outcome happen? The airport safety data records can be the source of likelihood informa-
tion if such an event has occurred at the airport. If the airport has never experienced a potential
outcome of a hazard, other airports may have had such an event or agencies may have estimated
based on historical data. Occasionally, the likelihood will need to be estimated based on the
experience of airport personnel.
Continuing the runway excursion example, the likelihood of an aircraft leaving the runway
will vary depending on the hazard leading to the outcome. If one of the excursions occurred
because the runway was wet from a heavy rainstorm prior to landing and the airport is in Ari-
zona, the likelihood may be determined as highly unlikely for such an outcome to reoccur in the
next year or more. However, if the excursion happened because of ice on the runway and the
latest event occurred in December in Minnesota, the likelihood may be determined to be likely
to occur during the winter; thus the airport may need to consider actions related to the snow
removal plan. Chapter 9 presents more detailed discussions of likelihood.
Appendix F presents some likelihood values based on historical data from accidents and inci-
dents and associated with common airport risks. Appendix H presents basic concepts about
probability that should help airport staff in finding out outcome likelihood. Appendix H also
explains the basic notation used to characterize probability values.

6.3  Risk Management

This section discusses the overall concept of risk management; this discussion is separate and
in more general terms that cover the SRM 5-step process presented in following sections of this
guidebook.

The SRM component of SMS comprises five steps: (1) describing

the system, (2) identifying the hazards, (3) analyzing the risk,
(4) assessing the risk, and (5) mitigating the risk. The SRM process
is used for all identified issues affecting safety, regardless of air-
port complexity or size. A safety issue could be simple (some debris
found on the runway during a daily inspection that can be imme-
diately fixed) or complex (a construction project needing a more
detailed SRM analysis).

Not all risk can be removed; the goal in most cases is to lessen the risk (by either reducing the
likelihood of an undesirable outcome or reducing the severity of the outcome) to an acceptable
level. Managing risk is to take actions to control unacceptable risks and use available resources
to improve the overall safety of airport operations.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

26   A Guidebook for Safety Risk Management for Airports

Risk management is a decision-making process applied to control risks associated with a

single or multiple hazards. An airport always has multiple hazards to control and the risk
management process involves assessing and classifying each risk, defining control measures,
and allocating the resources needed to implement the controls. These actions are carried out
so risks can be compared and ranked to make the best use of limited resources to control
the risks.
Sometimes a single risk is identified during self-inspections or perhaps by means of a pilot
(weather) report (PIREP) and is immediately assessed as unacceptable (for example, FOD on
the runway). In such cases, the airport takes immediate actions to control the risk (for example,
remove FOD).
In other situations, a project is planned (for example, taxiway construction), new equipment
(for example, passenger bridge) will be installed, or a new SOP is developed. Some new hazards
can be expected for each project plan. Most of the hazards, at least the most critical ones, should
be identified and risk mitigation measures performed to control the risks to acceptable levels.
Figure 6-1 shows the concept of multiple hazards that may exist and should be managed across
multiple airport functions.
The large shapes represent airport functions, assets, and projects. To each of these compo-
nents a series of hazards (represented by the small triangles) can be associated and some of these
hazards may be common to two or more functions, assets, or projects. Personnel must realize
that an airport deals with multiple hazards and the resources available may not be enough to
remove every risk at the airport. Therefore, the best way to deal with airport risks is to use risk
management tools to identify and rank the control of higher level risks.
To identify and rank the risks for control, personnel can use specific techniques and processes.
This guidebook presents these techniques and processes. The basic tool used in risk management
is the 5-Step SRM process recommended by the FAA.

Figure 6-1.   Concept of airport hazards.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Risk and Risk Management   27  

6.4  Risk Classification

One key task in risk management is to classify the risks. Risk classification allows one to rate
the risks according to acceptability and use a consistent reference to compare risks—a reference
that is relevant no matter which airport function or project is being addressed. Using the same
“measure” for every risk allows for comparisons, prioritization, and effective management.
A risk matrix is a tool used to assess the risks associated with a particular hazardous condition.
A risk matrix provides a way to decide where a risk fits into an airport’s predetermined levels of
risk tolerance. The risk matrixes found in the FAA and ICAO guidance reflect five levels of sever-
ity and five levels of likelihood, also referred to as a 5x5 (five-by-five) matrix. Regardless of the
number of levels for either severity or likelihood, the definitions for each level need to represent
the local conditions and risk tolerance of the individual airport. A 5x5 risk matrix is the most
common matrix structure used in aviation.
Each airport should adopt a matrix that fits its needs and complexity. Appendix D provides
examples of risk matrixes.

6.5  SRM and SMS Component Interaction

In Chapter 5, the role of SRM within the airport SMS was presented. SRM is one of the opera-
tional components of an SMS. This section explains the relationships and interactions between
SRM and the three other SMS components.

6.5.1  SRM and SA

SRM and SA are considered the operational components of the SMS. They are directly linked
and work together; the output of one directly supports the other. The SA component encom-
passes the monitoring and measuring functions of the SMS. For the SRM process to fully sup-
port operations and safety performance improvement at an airport, the mitigations must be
monitored and measured to decide their effectiveness.
Figure 6-2, from FAA Order 8040.4A, shows how SRM and SA relate. There are two flows in
the diagram, one relates to the SRM process and the other is associated with SA. The informa-
tion created by SRM feeds the SA process, and the information produced by SA feeds the SRM
process. To clarify this idea, we return to the birdstrike hazard example presented earlier.

How SRM and SA relate is explained here by returning to the

birdstrike example presented earlier.

An airport found the number of birdstrikes per 10,000 aircraft movements causing damage
to aircraft was high compared to the rate found in other Part 139 airports. The airport then
decided to carry out the SRM process to discover the reasons for the higher rates and how to
mitigate future risk. During the SRM exercise, made easy by the SMS Coordinator and with the
participation of airport staff involved with wildlife management, data from the FAA Wildlife

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

28   A Guidebook for Safety Risk Management for Airports

Figure 6-2.   SRM and safety assurance processes

(FAA Order 8040.4A, 2012).

Strike Database showed that five bird species were responsible for 92% of birdstrikes causing
damage to aircraft and the risk was classified as high. With the exercise complete, the wildlife
team proposed new actions to target the presence of those five species in the airport area. The
actions were approved by the Director of Operations and were implemented over 6 months. All
these actions were part of the first SRM cycle for the safety issue.
A parallel SA process was created to monitor the number of birdstrikes associated with the
five bird species identified during the SRM. Data were collected monthly, and a performance
indicator was defined as the number of birdstrikes associated with the five species identified.
Data were analyzed for every month and the performance indicator was calculated and com-
pared to the baseline rate calculated during the SRM. Trends were noted and after 1 year, the
number of birdstrikes had decreased but not significantly. Because results were not considered
satisfactory, a new SRM exercise was scheduled to find alternative control actions that could
be more effective.
The risk assessment step generated the need to monitor birdstrike data and check for trends.
Monitoring or system assessment is part of the SA component of SMS. When the monitoring
and assessment of trends revealed unsatisfactory results during the SA cycle, the process led back

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Risk and Risk Management   29  

to SRM and the need for a new SRM cycle associated with the same hazard. Thus, the two SMS
components support each other and eventually lead to improved safety performance.
Some airports involved in early SMS development designed their SRM process with six steps
versus five; the sixth step being to monitor mitigation actions. Other high-risk organizations
using SRM include monitoring (or supervision) as part of the fifth process step. Regardless, the
mitigations selected to decrease the risk need to be monitored to assess effectiveness. The audit
and metrics monitoring functions of SA all work to support the continuous process of SRM.
Feeding back the monitoring data from SA allows airport personnel to reassess risk, find out
the residual risk that follows from mitigation, and, perhaps, identify new hazards with the SRM
process starting a new cycle.

6.5.2  SRM, SA, Safety Promotion, and Safety Policy

The relationships among the components of an SMS resemble a wheel, with SRM as the hub.
SRM supports safety policy, safety assurance, and safety promotion. A key SMS responsibility
for airport management is to set safety objectives and goals for the airport. These performance
targets are part of the airport safety policy. The ability to find out or measure the success of risk
mitigation actions stemming from the SRM process depends on the existence of data and mea-
sures that can be tracked and analyzed by SA processes. Thus, the airport safety policy sets up the
metrics by which the success of SRM is determined. If satisfactory metrics do not exist at the air-
port, then the SRM process actions may trigger a review of safety policy and modifying of airport
goals and objectives. The mitigation actions defined during the SRM process will undergo an
approval process by management. That approval and the resulting allocation of resources help
prove airport management’s support for the SMS and their safety policy, as well as their commit-
ment to improve airport safety. The commitments of resources for improvement, coupled with
feedback from airport management, are parts of safety promotion at the airport. Additionally,
when performing the SRM and SA processes, some risk mitigation actions adopted fall under
the umbrella of the safety promotion component. For example, when a new SOP is developed,
the SRM process is used to ensure the safe implementation of new procedures. Recommended
mitigation actions may include developing a training program for operators of new equipment
or displaying posters to improve safety awareness when new equipment is introduced. These
actions, while performed because of effective SRM, are also safety promotion initiatives that
double as risk mitigation actions so that the SMS wheel continues to revolve around the SRM Figure 6-3.  The SMS
hub (see Figure 6-3). wheel.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 7

SRM Phases

Earlier chapters explained the importance of risk management for airports. Every airport has
multiple hazards to control. Some hazards are specific to certain airport activities and functions,
while others are common to two or more activities. Many activities will involve different phases.
For example, a construction project always includes planning and design phases, a preparation
phase, and the construction or execution phase. Another example is a special event like the Super
Bowl, or a popular college game in a small town. Again, the airport must plan for the changes in
operations the event will bring, prepare the airport before the event, and then carry out the plan
to help the event go off smoothly.
A construction project and a special event present major changes to an airport’s operation
and SRM should be used to identify and address any new hazards that such changes introduce.
However, hazards associated with each phase can be different and the best approach is to
conduct the SRM process for each project or event phase.
Often, an SRM approach can be helpful to deal with unanticipated hazards to daily activities
as well. Imagine that a large fuel spillage from an aircraft has occurred on the ramp. Several
hazards surface in a situation like this. During the response to the event, there is little time to
use a formal planning/preparation/execution approach. However, this type of incident can be
expected to occur on occasion and emergency response crews plan and prepare ahead so that
the airport response crew is ready to execute appropriate mitigation plans.
The application of SRM during the three phases differs in the time allotted to process execution,
the effort and detail put into each of the process steps, and the experience of the people using
the process. The three basic phases of SRM thus mirror the project phases: the planning phase,
the preparation phase, and the execution phase.

7.1  Planning Phase

The planning phase of SRM is the most disciplined phase—there is enough time to examine
fully the system involved and the hazards associated with the system. In other high-risk organi-
zations (such as the oil and gas industry) this phase is referred to as the In-Depth Level of risk
management.
Safety risk assessment (SRA) techniques described in later chapters are commonly used during
the planning phase. In the planning phase, SMEs are consulted, and all appropriate stakeholders
in the system are involved. As with an SRA, this level is often carried out by gathering a panel so
those involved can brainstorm and discuss the issues face to face.

30

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Phases   31  


Planning and designing a new terminal is used here as an example.

As an example, an airport decides to build a new terminal. During the planning and design
phases, the location and the size of the terminal are defined, and any impacts to the airfield.
Many potentially, permanent hazard conditions can be avoided through an effective planning
phase SRM—line-of-sight limits on the ATCT personnel, airspace impacts, potential interference
with existing and/or proposed surveillance equipment are just a few.

In the planning phase, time is usually not a constraint. This phase typically addresses large
projects and complex evolutions that involve many parties, both inside and outside the airport
organization. Time is available to research and gather the data needed to assess the risks fully
and accurately.

Conducting an SRA is perhaps the best known technique applied to this SRM phase and it can
become a valuable component of any airport planning evolution. The best decisions are made
in a risk-informed manner. Applying the SRM process in all airport planning evolutions will
improve the overall effectiveness and thoroughness of the plan.

In the planning phase, the SRM process is often revisited on multiple occasions. As assign-
ments to research issues and gather information are completed, panels can be reconvened to
review the SRM process results and update the outputs of the process. This keeps the process
alive and relevant. The effectiveness of updating risk information can be increased during large
projects with extensive periods of execution through the regular meeting of stakeholders, or
risk reviews.

7.2  Preparation Phase

The preparation phase of SRM is performed immediately before a planned special or even
a routine event. In other high-risk organizations, this level is known as the deliberate phase of
risk management. The preparation phase can begin a few weeks before a special event, or a day
before a complex but reoccurring operation. In this phase, the SRM process is used to (1) ensure
that all hazards and risks identified in the planning phase are still relevant and (2) identify
and assess any new hazards and risks that may have surfaced or can be anticipated during
the execution.
The preparation phase occurs between planning and execution and is often applied immediately
before implementation of the proposed change. This time frame may not allow for the research
and data gathering performed in the planning phase, however, it still gives the responsible party
the opportunity to ensure that appropriate stakeholders are involved in preparation. It also
should provide time for pre-event briefings to address the risks faced and how such risks are
to be mitigated. Finally, it allows opportunity to address environmental conditions and human
performance issues that cannot be foreseen far in advance.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

32   A Guidebook for Safety Risk Management for Airports

Middle managers and team leaders are particularly involved in

the preparation phase. The results of the preparation level SRM
can keep senior leaders informed, but the true value is in keep-
ing the executing team’s thinking focused and aware of the risks
involved.

To show the difference between the planning and preparation phases, consider an airside
construction project. Before starting the project, a Construction Safety and Phasing Plan (CSPP)
is prepared and pre-construction meetings take place to define construction phasing and
how hazardous situations will be managed. Examples of safety issues considered during the
planning phase and the development of the CSPP include FOD control, definition of haul routes
and escorting procedures, potential impacts on operations, coordination, and interference with
NAVAIDs.
During the days just before the start of project work is the preparation phase—there is still
enough time to work through the 5-Step SRM process, and management should ensure the team
is disciplined and uses the process to improve the evolution. The SRM process is used to evaluate
the risks posed by the latest weather forecasts, recent changes in personnel, and the potential
performance levels of those who will carry out the project. Preparation phase SRM is still active

A common pitfall is to assume that all hazards have been effectively

assessed and mitigated before operational execution and simply
run through the steps as a formality—in other words, “check-the-
box.” A way to avoid the hasty, cursory use of the process at the
preparation phase is for the responsible party to ask his or her
team, “What has changed since we first planned this event?”
This question can reengage the team’s thinking and invigorate
risk-based decision making.

in nature and enables leaders to focus project planners, supervisors, and workers on the hazards
and levels of risk they will face.

7.3  Execution Phase

The execution phase of SRM involves the techniques used to manage safety risks during the
execution of an event or task. In other high-risk industries, this phase is known as time-critical
risk management. In the planning and preparation phases of SRM, management and leadership
are at the forefront of ensuring proper application of the SRM process. At the execution phase, all
participants should have a working knowledge of SRM and all involved must be aware and attuned
to unanticipated hazards presenting new, often unmitigated risks to the success of the operation.
Often, the outcomes of hazards are realized because of the actions of the most junior personnel
or those performing the task. During task execution there is little time to run through all SRM

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Phases   33  

process steps formally. In the execution phase, those involved may be able to take time to evaluate,
identify, and assess the new risk. At other times, they may have to act in the moment and need
to be able to recognize and act to control risk. In the latter case, having an easy way to remember
and act on processes can be of great value to the individuals involved.

In most cases, hazards produce losses and undesirable outcomes

during the execution phase of airport activities. Those performing
airport tasks must understand SRM and effective risk management
tools to manage the risks they face in execution.

In the example of fuel spillage, an SOP can help the emergency response crew remember the
sequence of actions to control the issue safely. There is little to no time to use a formal SRM
during execution to control fuel spillage.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 8

SRM at Small Airports

The SRM concepts presented in this part are equally applicable to small airports and to large,
complex airports. Many small airports may not have the resources to implement a formal SMS
with staff that has full-time responsibility to coordinate an SMS; however, despite the seeming
difficulty of having the right resources to perform an SMS, coordination and communication at a
small airport are more direct, with frequent face-to-face discussions during the day. The number of
hazards identified during daily inspections or PIREPs is low and hazards may be more manageable
as compared with larger airports because there are fewer layers in the decision-making process.
Hazards may be identified during routine tasks if the airport has a positive safety culture and
SMS and SRM concepts are known by both senior and front line staff at the airport. For small
airport operators, a wide understanding of the general concepts presented in this guidebook may
be more important than using formal SRM processes. In many situations, the manager of a small
airport will see an unsafe situation that is not so obvious and take intuitive actions to eliminate
the hazard. However, if the manager is familiar with SRM concepts, a brief, informal brainstorm-
ing session with his or her staff will help identify and control other hazards that were not on the
manager’s “intuitive” list. These types of SRM exercises will continually improve safety awareness
and help to instill a positive safety culture in the staff of the small airport.


The effective use of SRM processes is explained here using the
towing of aircraft as an example.

Consider a small airport that had a few incidents and minor accidents while towing aircraft
from the ramp to hangars. Besides the monthly briefings to improve safety awareness, the airport
manager met with the Supervisor of Operations and Safety and the individuals responsible for
the towing operations. The airport manager used the SRM approach and identified the ramp
and hangar areas, personnel and equipment involved with the coordination and processes asso-
ciated with the towing operation. The incidents were reviewed and a “5-Why” approach was
used to identify the hazards or root cause of the incidents. The towing operation was divided
into different tasks and hazards and things that could go wrong were identified for each task. In
a couple of hours, the group decided to develop an SOP for towing, use a wing-walker for each
towing operation, and prepare posters to remind the crew of the basic procedures. This example
explains how the SRM approach helped a small airport operator improve the safety of a routine
evolution and enhance the operational performance of the airport.

34

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

PA RT I I I

The SRM Process

and Application
Part III presents the 5-Step SRM process and how to apply it in daily operations. Understand-
ing the SRM process is the first step to understanding the many ways it can be applied. Part III
includes examples of when SRM is applied and a chapter specific to small airports.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 9

SRM 5-Step Process

Having a collective understanding by all airport personnel of SRM concepts and using
a common risk management process can increase the likelihood of successfully managing
safety and other organizational risks. Managing safety risk can take various forms, both for-
mal and informal. Using airport SRM methods based on a disciplined, systematic process
can promote understanding of foundational SRM techniques; this makes application easier
to accept and more successful. This chapter discusses an FAA-recommended 5-Step SRM
process used by many airports carrying out an SMS. The 5-Step SRM process follows this
sequence:
1. Describe the System
2. Identify Hazards
3. Analyze Risks
4. Assess Risks
5. Mitigate Risks

9.1  Step 1—Describe the System

To manage risk effectively and prevent undesirable outcomes, personnel must understand
the system under review. The system consists of parts, components, organizations, functions,
and personnel interacting to produce a desired outcome. The system may be the airport as
a whole, as is often the case with a major construction project. Alternatively, it may be a
smaller part or subsystem of the airport, such as the runway lighting system or the system
to move people through the terminal (for example, elevators, moving walkways, passenger
carts, and airport ambassadors) or a defined hazardous area on the airside (e.g., the aircraft
parking ramp).
Many industries use the 5M Model to describe a system. The model offers an effective way to
identify the parts of the system at risk. The model breaks the system down into five interacting
components:
• Mission
• Man (or the huMan component)
• Machine
• Management
• Media (or environMent)
By walking through the 5M Model when reviewing the system, SRM users can better ensure
that all aspects of the system are considered and that all stakeholders in the system are involved.
Figure 9-1 illustrates the 5M Model.

37  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

38   A Guidebook for Safety Risk Management for Airports

Figure 9-1.   Relationships of the 5M Model.

 ew practitioners of SRM must remember not to exclude key

N
people or organizations affected by the at-risk system in the SRM
process.

Examples of such organizations for the airport environment include

local organizations outside the airport property and all airlines and
flying organizations that work from the airport. Using the
5M Model lessens the potential for unintended omissions.

Using the 5M Model to describe the system means those looking at the system describe it in
terms of the mission to be performed, the media or environment in which it operates, the people
who work in the system, the machines involved, and the management that ensures proper opera-
tion and output. In addition, while examining the system, users must “bound” the system, that
is, they must also consider and exclude aspects that are not included in the system and parts that
may be influenced by but are not part of the system. Bounding the discussion is important in
focusing the SRM effort.


Here an airside construction project example is used to show how
to use the 5M Model.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM 5-Step Process   39  

To show how to use the 5M Model to describe the system, the guidebook presents an airside
construction project to rehabilitate a taxiway as an example. To carry out the construction project,
construction equipment, personnel, and materials will be on site. Also work must be carried out
so airport operations can continue safely and construction workers will be protected from harm
during the entire project. In this example, the 5M Model would describe the system as follows:
• Mission: The safe movement of aircraft on the ground from runway to ramp area and vice
versa. The project is described as follows: The work is to regain the functionality of the taxiway
being rehabilitated and any activity needed to perform the work is included in the mission.
Examples of activities are securing and marking construction area and haul routes; coordinat-
ing with ATC; coordinating with operations and engineering; transporting equipment, work-
ers and materials; escorting trucks and vehicles; milling old pavement and making repairs;
stockpiling material; controlling FOD; repaving and compacting; placing new markings;
cleaning up; and reopening the taxiway.
• Man: Any person involved with the construction project who may affect construction activi-
ties. Many of the people involved are not construction workers. For example, ATC personnel
who coordinate with airport operations staff and construction workers are part of this cat-
egory. Airport staff securing a special “construction gate” where trucks may enter the airside
are also in this category.
• Machine: Any equipment and tools involved with the construction activities defined in the
Mission. This includes trucks, pavers, compactors, milling machines, escorting and inspection
vehicles, communication equipment, barricades, aircraft, airfield lighting and other systems,
navigational aids, and communication equipment.
• Management: Any coordination and communication activities associated with the Mission.
Coordination and communication within the construction crew, between ATC and aircraft,
and operations, between operations and contractors, and so forth.
• Media (environMent): The media represents the physical area involved in the project, includ-
ing the weather and conditions that activities are subject to during construction. The physi-
cal area includes the taxiway being rehabilitated and adjacent areas, haul routes, plant and
stockpile areas, and equipment parking areas. Operational conditions may include potential
low visibility, strong wind, high temperatures, and snow—all conditions when construction
activities might be suspended.

9.2  Step 2—Identify Hazards

This step is critical to the SRM process and should take a significant amount of the time allot-
ted to applying the process. As defined earlier, a hazard is
Any existing or potential condition that can lead to injury, illness, or death to people; damage to or loss
of a system, equipment, or property; or damage to the environment. A hazard is a condition that is a
precondition to an accident or incident.

As stated above, a hazard must exist for an accident or an undesirable incident to take place.
A hazard is the origin of risk to the airport. Airport stakeholders must make every effort to iden-
tify the hazards associated with the system or evolutions they are considering. Identifying and
mitigating hazards may lessen and potentially remove the chances for loss.
When considering hazards, personnel may find it helpful to break down the discussions into
categories. Similar to using the 5M Model for describing the system, categorizing hazards can
help ensure all hazards are acknowledged. Examples of hazard categories include the following:
• People: Could the condition lead to injuries or fatalities?
• Assets: Could the condition result in losses of property, equipment, and/or operating funds
for which the airport could be liable?

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

40   A Guidebook for Safety Risk Management for Airports

• Environment: Could the condition lead to damage to the environment or local pollution?
• Reputation: Could the condition lead to damage to the image of the airport or cause a loss in
public confidence about travel to or from the airport?
• Mission: Could the condition hinder the airport’s ability to move people and cargo to and
from desired destinations?
These hazard categories will be revisited in Step 3 of the SRM process, given that this tech-
nique can also be used to analyze the severity of the hazardous condition.
Often an identified hazard is simply the result or outcome of a hazard. Personnel must not
take a first suggestion for a hazard to be analyzed and assessed as the last word. As an example,
one member of a group exercising the 5-step process might suggest that a vehicle colliding with
an aircraft in the non-movement area is a hazard because such a collision could result in injuries
to people and/or damage to airport and airline assets. While accepting this as a hazardous con-
dition may serve the airport’s purposes, an underlying cause, or true hazard, may be uncovered
by asking “why?”—Why did the collision occur? Was the vehicle operator distracted, and if so,
why? Was the ramp wet or icy, and if so, why? And so on.
A rule of thumb when identifying hazards is to ask “why” five times before settling on the haz-
ard. Although there may not be five “whys” to ask, the answer to the final question will uncover
the hazard that needs to be addressed.

It is common to confuse hazards with their outcome or

consequences.
Example: “runway incursion” is an outcome or consequence, not
a hazard. In contrast, “unclear pavement markings” is a hazard
that may lead to runway incursions. (ACRP Report 1, Vol. 2, 2009)

Another method to identify hazards is to use the proposed condition in a “risk statement.”
For example
Given that (state the condition or hazard), it is possible that (state the undesirable outcome or consequence).

If that statement makes sense when read aloud, then the hazard inserted in the statement is
likely valid and should be assessed. The risk statement technique is also useful in moving from
Step 2 of the SRM process, identify the hazards, to Step 3 where the potential outcomes of the
hazards are determined.
Continuing with the example of the Vehicle to Aircraft Collision on the ramp, the 5 Why’s
and the risk statement techniques can be explained. Those looking at the potential event could
ask “why might a collision occur?” The answer might be that a collision could be caused during
night operations because of low visibility. A follow-on “why” might be: “Why will visibility on
the ramp be degraded?” The answer might be there is inadequate lighting on certain segments of
the ramp area where a collision might occur. Another “why” might be “why is there insufficient
lighting?” The answer might be that funding is not available or the Airport Master Plan does not
call for extra lighting for certain areas, which may lead to deciding the hazard is “insufficient ramp
lighting.” (Figure 9-2 illustrates the preceding example.)
Using the risk statement technique with this example, such a statement might read as follows:
Given there is no funding for more lighting, it is possible a collision will occur that causes significant aircraft
damage.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM 5-Step Process   41  

• Why might a collision occur?

1 • A collision might occur due to low visibility

• Why will visibility be degraded?

2 • Because there is insufficient lighting on the ramp

• Why is there insufficient lighting?

3 • Because there is no high intensity ramp lighting on that portion of the ramp

Figure 9-2.   An illustration of the 5 whys.

In this example, the statement reads as if the lack of funding for improved lighting is the
hazard. Although this statement may support the airport’s assessment, the statement may not
fully highlight a condition that poses risk that can be mitigated. This determination could lead
to further dissection of the condition to better define the cause of the potential incident or haz-
ard. This further consideration might lead to insufficient lighting being the hazard. When that
condition is inserted in the risk statement, it would read as follows:
Given the insufficient lighting on select areas of the ramp, it is possible a vehicle could collide with an aircraft.

This statement makes sense when read aloud, confirms that “insufficient lighting on the ramp”
is a hazard to be addressed, and is a hazard that likely gives the airport multiple mitigation options.
Appendix E lists common airport hazards for various categories of activities. The lists can help
readers become familiar with common airport hazards.

9.3  Step 3—Analyze the Risks

In Step 3, users analyze the elements that decide the level of risk, and the SRM process con-
tinues toward actionable risk information for decision making. There are three parts to this step:
• Decide the potential outcome of the hazards
• Decide the potential severity of the outcome
• Decide the likelihood of the outcome

To reiterate, the terms hazard and risk often are used synony-
mously,
 but this is incorrect. A hazard is a condition that can pre­
sent risk to the airport. The risk is the likelihood that the hazard
will cause an undesirable outcome and the potential severity of
that outcome.


Likelihood can only be estimated after the outcome is defined.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

42   A Guidebook for Safety Risk Management for Airports

9.3.1  Anticipating Potential Outcomes

Finding the potential undesirable outcomes of an uncontrolled hazard is the first step in
analyzing the components of the risk. As suggested in using the risk statement method in SRM
Step 2, identifying a potential outcome can help settle the validity of the identified hazard. But
hazards can have some potential outcomes.
To continue with the “insufficient lighting” example, personnel concluded that the possibility
of a collision between a vehicle and an aircraft was a potential outcome. However, other possible
undesirable outcomes could result from this condition:
• Injury to personnel because of a trip or fall
• Damage to a vehicle from hitting an unseen obstacle
• An unnoticed fuel leak or spill

When deciding the outcomes of a hazard, the analysis should focus on making reasonable
assessments based on credible outcomes. Many areas on an airport are host to many dangers.
Working around aircraft and equipment is hazardous work. Although catastrophe is possible
with many hazards, safety statistics show and reason backs the fact that fatalities and/or destroyed
aircraft and equipment are rare. The goal is to discover credible outcomes—the outcomes most
likely to occur. Personnel can base decisions about credible outcomes on experiences at the
airport or historical events and statistics at other airports.
As discussed in Step 2, it can be valuable to consider potential outcomes according to the
aspect of the airport they may affect. Potential outcomes could be categorized as follows:
• People: Could the hazard lead to serious injuries or fatalities?
• Assets: Could the hazard result in losses of property, equipment, or operating funds for which
the airport could be liable?
• Environment: Could the hazard lead to negative effects on the environment or to increased
local pollution?
• Reputation: Could the outcome of the hazard degrade the image of the airport or reduce
public confidence about travel to and from the airport?
• Mission: Could the hazard degrade the airport’s ability to move people and cargo to and from
the desired destinations?

9.3.2  Determining the Severity

The next step in analyzing the risk is to assess the severity for each potential, credible outcome.
Personnel should base the severity classification on predetermined definitions set up during the
development of the airport SMS (or standalone SRM). The individual airport’s management
should develop these definitions so as to represent the airport’s risk tolerance level—this is criti-
cal for making SRM scalable to the size and complexity of the individual airport.
Two similar methods can be used to analyze the risk. Given that a single hazard could pro-
duce multiple outcomes, one way to analyze the risk is to consider all potential outcomes and
determine the severity of each. As an alternative, the analysis can be done on the worst credible
outcome. When the most severe outcome is determined, the risk associated with the single haz-
ard will reflect a single level of severity, followed by a single determination of likelihood.

9.3.3  Determining Likelihood

The likelihood of the hazard resulting in an undesirable outcome is the second of the two
risk components. Given that accidents are rare at most airports, the likelihood of one occurring

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM 5-Step Process   43  

For certain hazards, using the worst credible outcome and

determining risk mitigation actions will also address less severe
outcomes; however, often it is important to analyze a range of
outcomes. For example, when dealing with birdstrikes, control
actions to address large birds causing damage to aircraft may not
mitigate risks associated with smaller species.

could be once in a month, once in a year, or even once in the history of the industry. Personnel
can consult safety databases to research the number and frequency of occurrences for many
outcomes. The most commonly referenced accident database is kept and provided by the NTSB.
The NTSB is responsible for investigating all U.S.- registered aircraft accidents (among other
transportation accident investigation duties).
The definitions of likelihood to be used during the SRM process should be developed during
the development of the airport SMS (or standalone SRM). These definitions should reflect the
history of the airport or the history of airports of similar size and complexity. Appendix D has
examples of likelihood definitions used by early SMS adopters.

For small airports, researching safety databases for undesirable

events at other airports may be the most productive way to deter-
mine credible outcomes. Because limited numbers of operations
reduce exposure to hazardous conditions, an airport may never
have experienced a certain undesirable outcome. That fact may or
may not be an indication of a low level of risk.

Small airports may find the NTSB database helpful. The NTSB
keeps records for all aircraft accidents investigated in the United
States and its territories and for aircraft registered in the United
States. From January 2008 to April 2014, there were more than
7,800 GA aircraft accidents in the United States; presumably,
most of the aircraft involved were operating to and from GA
airports. (NTSB aircraft accident database)

9.4  Step 4—Assess the Risks

The fourth step is to assess the risk. In this step, the likelihood and severity for each hazard are
compared to the levels of acceptable risk determined during development of the SMS (or stand-
alone SRM). This is an initial assessment of the risk associated with each hazard. The assessment
may determine that the risk is too high or unacceptable for airport management to accept.
Tools are available to the industry to help estimate the likelihood of certain outcomes. These
include the Collision Risk Model (CRM) to evaluate the probability of an aircraft colliding with
an obstacle during instrument approaches, and the method presented in ACRP Report 50 to
estimate the risk of accidents during runway excursions. A risk matrix is a simple, effective, and
often used tool to analyze airport risks.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

44   A Guidebook for Safety Risk Management for Airports

9.4.1  Risk Matrix

The tool most commonly used to analyze risks is the risk matrix. A risk matrix is a simple
table whose columns represent the levels of severity and the rows represent the levels of
likelihood. The FAA, across multiple lines of business, has determined that a five-by-five
(5 × 5) risk matrix is suitable to characterize safety risk in their varied regulatory roles in avia-
tion, that is, five categories of severity and five categories of likelihood. The 5x5 risk matrix
is the tool currently presented in the FAA advisory circulars for airports. Figure 9-3 shows
the current FAA matrix. The different colors help the user identify the risk level: high risk
(red), medium risk (yellow), and low risk (green). Appendix D contains more risk matrix
examples to help guidebook users select or create a risk matrix that best fits their operational
and safety needs.
Each level of likelihood and severity is defined so as to help the user select the most suit-
able combination of severity and likelihood. These defined levels reflect the risk tolerance of
the airport. The definitions for risk levels adopted by the FAA in Order 5200.11 (Change 2,
2013) are presented below, followed by the definitions of severity and likelihood in Tables 9-1
and 9-2:
• High Risk—High risk is unacceptable within the FAA ARP SMS. If a hazard presents a high-
initial risk, the proposal cannot be carried out, unless hazards are further mitigated so that
risk is reduced to medium or low level and the ARP Safety Review Board recommends that
ARP-1 approve the mitigations. Tracking and management of high-risk hazards and controls
are required.
• Medium Risk—Medium risk is acceptable within the FAA ARP SMS. A medium risk is the
minimum acceptable safety objective. With medium risk, the proposal may be carried out, as
long as the risk is tracked and managed.

Figure 9-3.   FAA ARP Risk Matrix as of July 22, 2013 (Order 5200.11, Change 2).

Copyright National Academy of Sciences. All rights reserved.

 A Guidebook for Safety Risk Management for Airports
Table 9-1.   Definitions for severity from the FAA ARP Order 5200.11.

Minimal 5 Minor 4 Major 3 Hazardous 2 Catastrophic 1

Conditions resulting in a
minimal reduction in ATC
services, or Conditions resulting in a slight
ATC Services

Conditions resulting in a partial Conditions resulting in total

A loss of separation resulting in a reduction in ATC services, or Conditions resulting in a
loss of ATC services, or loss of ATC services (ATC Zero), or
Category D Runway Incursion (RI), A loss of separation resulting in collision between aircraft,
A loss of separation resulting in A loss of separation resulting
or a Category C RI, or Operational obstacles or terrain
Category B RI or OE in a Category A RI or OE
An Operational Deviation Error (OE)
(OD), or
Copyright National Academy of Sciences. All rights reserved.

A Proximity Event (PE)

PD due to response to TCAS

Potential for PD due to TCAS Near mid air collision (NMAC)
Corrective Resolution Advisory
Preventive Resolution Advisory results due to proximity of less
Flight crew receives TCAS Traffic (CRA) issued advising crew to take
(PRA) advising crew not to deviate than 500 feet from another
Advisory informing of nearby vertical action to avoid developing
from present vertical profile, or aircraft or a report filed by pilot
traffic or, conflict with traffic, or Conditions resulting in a mid-air
PD where loss of airborne or flight crew member that a
Flight Crew

Pilot Deviation (PD) where PD where loss of airborne collision (MAC) or impact with
separation falls within the same collision hazard existed between
loss of airborne separation falls separation falls within the same obstacle or terrain resulting in
parameters of a Category C two or more aircraft; or
within the same parameters of parameters of a Category B hull loss, multiple fatalities, or
OE, or Reduction of safety margin and
a Category D OE or PE, or OE, or fatal injury
A reduction of functional functional capability of the aircraft
Minimal risk on operation of Reduction in safety margin or
capability of aircraft but does not requiring crew to follow
aircraft functional capability of the
impact overall safety (e.g. normal emergency procedures as per
aircraft requiring crew to follow
procedures per AFM) AFM
abnormal procedures per AFM

Physical discomfort to
Physical distress on
passenger(s) (e.g. extreme
passengers (e.g. abrupt evasive
braking action; clear air
action; severe turbulence causing
Minimal injury or discomfort to turbulence causing unexpected Fatalities or fatal injury to
Flying Public

unexpected aircraft movements), Serious injury to passenger(s)

passenger(s) movement of aircraft causing passenger(s)
or
injuries to one or two passengers
Minor injury to greater than
out of their seats)
10% of passengers
Minor injury to greater than zero
to less than or equal to 10% of
passengers

Severe damage to aircraft and/or

Minimal damage to aircraft, or Major damage to aircraft and/or Complete loss of aircraft and/or
serious injury to
Minor injury to passengers, or minor injury to facilities or fatal injury in
passenger(s)/worker(s); or
No damage to aircraft but Minimal unplanned airport passenger(s)/worker(s), or passenger(s)/worker(s); or
Complete unplanned airport
minimal injury or discomfort of operations limitations (i.e. Major unplanned disruption to Complete unplanned airport
Airport

closure, or
little risk to passenger(s) or taxiway closure), or airport operations, or closure and destruction of critical
Major unplanned operations
workers Minor incident involving the Serious incident, or facilities; or
limitations (i.e.. runway closure),
use of airport emergency Deduction on the airport's ability Airport facilities and equipment
or
procedures to deal with adverse conditions destroyed
Major airport damage to
equipment and facilities
 A Guidebook for Safety Risk Management for Airports
Table 9-2.   Qualitative criteria for risk probability from the FAA ARP Internal Order 5200.11.

NAS System & ATC

NAS Systems ATC Operational Flight Procedures Airports
Operational
Copyright National Academy of Sciences. All rights reserved.

Individual Item/ ATC Service/NAS

Per Facility NAS Wide Airport Specific
System Level System

Expected to occur
Probability of occurrence Expected to more than once per
Frequent

per Continuously Expected to Expected to

occur about once week or every
experienced in occur more than occur more than
A

operation/operational every 3 months 2,500 departures,

the system once per week every 1 2 days
hour 1x10 3 for an item whichever occurs
Probability of occurrence sooner
per operation/operational
hour 1x10 5 Expected to occur
Probability of occurrence Expected to Expected to about once every
Probable

per Expected to Expected to

occur about once occur about month or
occur frequently occur about once
B

operation/operational per year for an several times per 250,000 departures,

in the system every month
hour 1x10 5 item month whichever occurs
sooner

Probability of occurrence Expected to occur

Expected to Probability of occurrence
per Expected to Expected to about once every
occur several Expected to
Remote

occur numerous occur about per operation/operational year or 2.5 million

operation/operational times during the occur about
hour 1x10 5, but
C

times in a once every 3 departures,

hour is 1x10 5 but lifecycle of an once every year
system's lifecycle years 1x10 7 whichever occurs
1x10 7 item
sooner

Probability of occurrence Expected to occur

per Expected to Expected to Expected to Probability of occurrence once every 10 100
Extremely

Unlikely to occur,
Remote

operation/operational occur several occur once occur about per operation/operational years or 25 million
but possible in an
D

hour 1x10 7 but item's life cycle

times in a every 10 100 once every 3 hour 1x10 7 but 1x departures,
system's lifecycle years years 10 9 whichever occurs
1x10 9 sooner

Probability of occurrence So unlikely that it

Improbable

Unlikely to occur,
Extremely

can be assumed Expected to Expected to Probability of occurrence

per but it is possible Expected to occur
that it will not occur < every occur < every 30 per operation/operational
E

operation/operational in system every 100 years

occur in an item's 100 years years hour < 1x 10 9
hour < 1x10 9 lifecycle
lifecycle
A Guidebook for Safety Risk Management for Airports

SRM 5-Step Process   47  

• Low Risk—Within the ARP SMS, low risk is the target. Low risk is acceptable without restric-
tion. Low-risk hazards do not need to be managed actively, but must be recorded in the SRM
documentation.
When personnel use a risk matrix, they need to set priorities. Which risks are the most critical?
Which risks can the airport mitigate? What risks deserve having airport resources assigned to
mitigate them? If a risk is assessed as unacceptable or high risk, it is understood and required that
the risk must be mitigated. But, most of the assessed risks probably will fall into the acceptable
regions of the matrix, either medium or low risk. For these risks, mitigation may be desirable but
not be required to continue operations. Also, because an airport may not have the resources to
mitigate all assessed risks, airport decisionmakers can benefit from risk prioritization.
For medium and low risks, using the matrix can lead to questions about which risk is more
important to treat. Which poses the highest risk, if there are two different medium-level risks? Is
it the hazard with the higher severity or the one more likely to result in an undesirable outcome?
Personnel can use a Risk Assessment Code or RAC to help with prioritization. The RAC is a code
developed by the airport to signify a level of importance within the risk matrix and even within
the individual levels of risk (high, medium, and low). There is no set RAC system and the airport
should use a code that is easily understood and reflects the priorities of the airport. Appendices B
and D present an example of a risk matrix with a built-in RAC. The RAC in the example relates
to the severity categorization (e.g., as the severity increases so does the RAC #).

Personnel can develop the RAC by simply numbering each box


within the matrix, in ascending order based on the level of sever-
ity. A 5X5 matrix has 25 boxes. The airport could start with RAC
number 1 in the lower left box of the matrix and finish with the
box in the upper right corner of the matrix assigned RAC 25. Several
airports that participated in the FAA SMS Implementation study
used this method.

9.5  Step 5—Mitigate the Risks

The fifth step is to mitigate the assessed risks. In this step, resources or operational approaches
are applied to treat or control the risk. The goal is to reduce the likelihood of the outcome occur-
ring, reduce the severity of the outcome, or both.
The FAA requires, within their internal SMS, that high-level risks be mitigated to a lower or
acceptable level of risk. Individual airports may determine that high-level risks are acceptable, if
certain requirements are met. High-level risks are not acceptable according to the FAA; there-
fore, during the SRM processes required by the FAA of an airport operator, high-level risks must
be mitigated to a lower level. Appendix A has more information on FAA-required SRM.
Strategies to handle the assessed risks can include the following:
• Accept: When the risk is sufficiently low and further mitigation is not feasible or practical, the
airport may opt to accept the risk.
• Avoid: The event or operation can be canceled or postponed until hazardous conditions
change or resources become available to control the risk.
• Reduce: Steps are taken to (1) reduce the likelihood of the undesirable outcome affecting
operations or (2) reduce the severity of the undesirable outcome.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

48   A Guidebook for Safety Risk Management for Airports

• Transfer: The airport can notify and reassign accountability and responsibility to another stake-
holder willing to accept the risk (buying insurance is an example of transferring financial risk).
• Monitor: The airport can monitor the activity, operation, or environment for changes to
hazardous conditions.


Accept A night inspection identified that two taxiway lights were
off. No actions were taken to stop operations because the
risk was considered low and maintenance could do the
repair the next day.

Avoid 
 Thunderstorms were approaching. The airport stopped
all ramp activity and cleared the ramp when the light-
ning detection/prediction system indicated severe
weather within 2 miles of the airport.


Reduce 
On construction projects, use of personal protective
equipment (PPE) is mandatory so as to reduce the sever-
ity of injuries. Also, the airport expanded safety areas
between construction zones and aircraft movement
areas and used barricades to identify construction areas
so as to reduce the likelihood of damage to aircraft.


Transfer 
The airport measured runway friction. Given the low
friction levels, the airport planned to remove rubber
within 15 days. Meanwhile, a NOTAM was issued to
warn pilots that poor runway friction was expected
under wet conditions. In this case, the airport trans-
ferred the responsibility for the risk of operating on the
runway to the pilot and the airline.


Monitor Pilots operating on the runway report runway condi-
tions during periods of rain, snow, or ice to the tower.
The tower passes the information to airport operations
and to other pilots. If hazardous conditions are identi-
fied, the approaching aircraft pilot may opt not to use
the runway or the airport may clear or close the runway.

Regardless of the strategy, mitigations should be practical and achievable. All possible miti-
gations should be identified. The mitigation that best addresses the hazard, does not introduce
added risk, and best fits the airport’s capabilities should be identified and implemented when-
ever possible.

 isk mitigation may challenge smaller airports having limited

R
financial and personnel resources, especially if engineering
changes are judged to be the most effective mitigation. Alter-
nate mitigation strategies, or a combination of strategies, may
be required to continue operations.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM 5-Step Process   49  

When the most effective strategies are not practical, alternate risk strategies need to be used to
continue operations. These strategies could include delaying certain types of operations, trans-
ferring the risk or mitigation responsibilities to other agencies with greater means to deal with
the risk, or compensating for the risk through redundant procedures or equipment.
A vital component of effective mitigation strategies is assigning responsibility for the mitiga-
tions. Someone must be designated to organize and monitor the effectiveness of the strategies.
The responsible person should be able to make real-time decisions and influence those with
resource allocation authority. The responsible person is a key link between safety risk man-
agement and safety assurance. (See Chapter 14 for further information on carrying out risk
mitigations.)

When assigning responsibility for risk mitigation actions, the

 
responsible person should be able to make real-time decisions
about how the actions are accomplished and have influence on
those with resource allocation authority.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 10

Applying the SRM Process

When airports use SRM processes, common questions arise. When should SRM be used?
Who performs it at the airport? How are hazards identified? Which mitigation actions should
be performed? Who makes the risk decisions on the airport? This chapter provides examples of
when and how SRM is applied.
The SRM process can be applied whenever a hazard or a hazardous situation is identified.
Table 10-1 presents some hazard identification techniques available for use by airports.

50

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Applying the SRM Process   51  

Table 10-1.   Hazard identification techniques used by airports.

Technique Example
Anyone working at the airport or using airport facilities should be able to
report hazards that they see. The process can be more effective when
Observation and
airport staff has received training on how to identify and report hazards,
reporting
and a system or tool is available for reporting, like a hotline or intranet
based reporting system.
Daily inspections are effective in identifying airside hazards. The procedure
Daily inspections can be more effective if inspectors have received training to identify types of
hazards, not covered by the routine list of Part 139 requirements.
The hazards contributing to accidents or incidents are often difficult to
identify. A thorough investigation can discover the causes and contributing
Accident and incident
factors, particularly those hazards that are not obvious (for example
investigations
deficient training), and investigation reports can communicate the
identified hazards to airport decision makers for SRM action.
Some common safety issues and hazardous situations can signal the need to
put the SRM process in action, or the need to convene a formal SRA. A list
SRM triggers of common SRM triggers is presented in Chapter 16. The FAA uses a
technique called a Safety Assessment Screening (SAS) to identify situations
when SRM is required.
There are some common tools used by multiple industries to identify
Hazard identification hazards. Examples include Functional Hazard Analysis (FHA); Change
tools Analysis; Job Hazard Analysis (JHA); Job Safety Analysis (JSA); Failure Modes
and Effects Analysis (FMEA), and “What If…” tools.
Brainstorming is a tool that systematically identifies hazards, often using
hazard identification tools previously described. The airport may use
this technique whenever multiple airport functions or stakeholders are
Functional brainstorming
impacted by the hazardous situation. It consists of gathering a group of
people to discuss the issue and identify hazards. A facilitator will make the
process more effective.
When available, preliminary lists of hazards can be helpful to streamline the
SRM process, and to identify main categories of hazards, including specific
Preliminary lists of hazards associated with unique situations at airports. Appendix E presents
hazards several example lists of hazards. A preliminary list of hazards is by definition
not comprehensive, nor does it address special cases. The lists should be
used carefully and as a prelude to in depth hazard identification.
Monitoring of safety performance indicators and statistics improves SRM by
Trend analysis identifying undesirable trends associated with certain hazards like
birdstrikes, runway incursions, and injuries to personnel.
Safety and SMS audits, like accident investigations, are effective tools to
identify hazards that are not obvious. Hidden hazards can include outdated
Audits
training, organizational issues, deficient operational processes and
procedures.
Interviews during gap analyses or audits, or even informal interviews during
inspections represent an excellent opportunity to identify hazards with line
Interviews
workers and supervisors – those airport personnel with the most in depth
knowledge of the airport systems.
Usually, these reports will lead to an accident or incident investigation. The
purpose of an investigation is to discover causal and contributing factors to
Review of prior accident the event so they can be prevented or mitigated. The airport staff can
and incident reports augment and complement investigations by performing a SRA and
identifying risk mitigation actions and staff responsibilities to reduce the
chances of a similar incident or accident.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 11

SRM Applied to Small Airports

Making SRM work to the advantage of small airports takes leadership, dedication, and ingenuity.
Small airport operators may have to combat the perception that applying SRM to their operations
is too difficult, too expensive, and unsustainable. The size of the airport staff and budget will fuel
negative SRM views. The reality is that smaller airports may have some distinct advantages when
it comes to SRM. This chapter discusses SRM application techniques, considerations, and paths
to successful management of risk for the small airport.

11.1  Conducting Effective SRM with Limited Resources

In many cases, one person at the airport may wear multiple hats and be responsible for many
aspects of operation. It is important to remember that subject matter expertise, which is knowledge
of a particular issue, may reside with a single individual. When implementing SRM at a small
airport, and the need to conduct an SRA with multiple areas of expertise required is identified,
one person may have numerous areas of expertise. Often, one person may have general knowledge
of the entire airport system. It then becomes a matter of ensuring that the person is prepared
and available to provide the needed information about the specific subject matter of the SRA.
The size of the airport staff at a small airport may allow a more streamlined process and
quicken the response time when key decisions are needed. Larger airports may incur lengthy
delays from having people involved who have a narrow span of control, getting bogged down
with decision making, and relying on someone else to provide information; smaller airports may
not face these challenges.
At smaller airports, one or two people may be able to discuss an issue, use the 5-step process,
and come to a conclusion without formally convening an SRA panel. One or two people may
be able to provide the information of ten people from a larger airport. A formal panel may not
be needed at smaller airports. The important thing is that the process is followed as best possible
and that all of the necessary information is provided to support informed decisions.

11.2  Overcoming Challenges

Having limited staff can allow for streamlining. Identifying ownership of the processes and
the risk information is vitally important when facing small airport SRM challenges. Mitigations,
after-action plans, monitoring, and tracking of results all need to be performed and documented
well. The person responsible for the process can also own the data. However, documentation of
the process and the location and sources of data must be well thought out and made available to
other appropriate staff to ensure continuity of the SRM in case the knowledgeable individual be
unavailable. If the responsible person is not available when risk information is needed, proper

52

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Applied to Small Airports   53  

documentation helps to ensure that key information is available. Ensuring that other appropriate
staff know where and how to access the information is equally important.
Personnel can track the process and results with simple office software. This guidebook
offers several examples of tools and processes that can be applied when implementing SRM. In
general, most tools and processes can be accomplished using word processing and spreadsheet
software. A complete SRM software package can help airports, but, airports should be able to
develop, implement, and administer SRM using their existing administrative tools (for example,
Microsoft Office). This will speed acceptance by the staff and stakeholders and reduce the amount
of necessary administrative changes.

11.3  Making It Simple

If one of the triggers for an SRA raises a safety concern (see Chapter 16), one person may choose
to conduct an SRA and contact the appropriate people who have the necessary subject matter
expertise. This panel can be large or small, but it needs to represent the stakeholders involved
with the issue. At a small airport, two or three people can work through the 5-Step SRM process
and complete an SRA in a relatively short time. The process can be simple, if it is understood by
the people who have the needed knowledge.
One trigger for applying SRM processes may be undesirable trends in safety-related data.
The sources of safety data (such as accident reports, hazardous condition reporting, or property
damage reports) can still be generated from their current sources. Data need to be formatted
for easy review in accordance with a schedule that is appropriate for that particular airport’s
management. In other words, having an electronic spreadsheet with accident/incident data
input and having it reviewed by the airport manager monthly prior to a board meeting or county
commissioners meeting is perfectly acceptable, if it fits the structure of that particular airport.
Tracking mitigations or hazardous conditions and their associated risks also does not need to
be cumbersome. Again, personnel can use simple office software tools and results can be input
and reviewed by appropriate personnel within the airport’s management structure. The most
important aspect about capturing data and/or tracking mitigations is reviewing and analyzing
the results. Data and information is worthless if nothing is done with it.

11.4  Using Simple Tools for Risks and Controls

Simple software applications can provide the necessary tools to track risks and their controls
or mitigations. Appendices C and D provide examples in the form of tables and spreadsheets.
Because of the limited frequency of accidents and incidents at smaller airports, data mining
software is normally not necessary but may be helpful if an airport can procure it and put it
in place. Electronic databases are effective and inexpensive tools for data mining. These tools
produce charts and graphs to depict trends. Again, the airport must ensure that the process is
followed and the data are captured and analyzed for a successful SRM program—this does not
depend on how sophisticated the tools are.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

PA RT I V

SRM in Daily Operations

The previous parts of the guidebook focus on SRM principles and processes and how the
5-step process works. The chapters in this part link existing airport activities to SRM concepts
and steps, explain how effective SRM uses mitigation strategies and risk controls the airport
already has in place, and address ways airport personnel can apply SRM thinking when faced
with unanticipated hazards in daily activities.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 12

SRM in Daily Operations

Chapter 7 discussed how SRM can be phased to mirror the phases of an airport event or proj-
ect. In the planning and preparation phases, looking into the future and formulating strategies
to manage risk are key aspects of these SRM phases. However, airports do not experience losses
during the planning and preparation phases; airports experience losses while executing the tasks
required to keep the airport working. Closing the SRM loop and ensuring it works as a continu-
ous process requires application of SRM principles during daily operations; those on the ramp,
in the baggage well, or performing maintenance must understand that SRM principles apply at
all times. SRM is integral to operational excellence.

12.1  SRM as a Component of Operational Effectiveness

All airport personnel should receive SRM training—not just those most likely to be partici-
pants in SRA panels. Staff performing the challenging daily tasks that present risks to the airport
must understand that their actions in an operational setting play the most important role in
managing risk. Their understanding of the hazards and why certain mitigations were put in place
helps ensure the success of airport operations and the preservation of valuable assets. These two
benefits lead to greater operational effectiveness and efficiency.

Because the success of the airport SMS hinges on the effective-

ness of SRM and because effective SRM demands participation
at some level of all airport personnel, training programs for all
airport employees should include applicable SRM concepts.

SRM training programs, an element of the SMS Safety Promotion component, should high-
light the links between SRM in the planning phase and SRM in the execution. Formal train-
ing for those regularly in the execution phase and performing airport business should produce
an understanding of the operational effects of improperly managed risk, which include the
following:
• Injuries: In addition to causing workplace stress, lost time by employees puts greater burdens
on replacements and loss of expertise on the job.
• Damage: Equipment taken off the line requires repair time, incurs the financial costs of
replacement parts, and may delay operations.

57  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

58   A Guidebook for Safety Risk Management for Airports

• Delays: Errors can cause delays that interrupt schedules and cost money for air carriers and
general aviation operators alike.
Introducing SRM in the execution phase of airport operations minimizes and often eliminates
these undesirable effects, thus improving airport efficiencies and operational effectiveness.

12.2  SRM in Operational Settings

The application of SRM in the execution phase is meant to help personnel who
• Work in a dynamic environment
• Monitor or inspect daily or routine operations
• Supervise planned execution and routine tasks where errors can occur
• Need to make decisions rapidly, often based on partial information
In these roles, employees and supervisors need to remember the importance of recognizing
anticipated hazards and having planned mitigations ready to control risk. Personnel also need
to maintain a mindset that new and unanticipated hazards may surface at any time.

12.2.1  Daily Inspections Provide Information to Support SRM

Inspections are part of each airport day. They are a requirement for airports certified under
14 CFR Part 139 and a best practice for doing business. Inspections are also a vital part of SRM
in the execution phase. Having “trained eyes” watching the airport and observing the activities
that go on daily is an important source of safety information and a key hazard identification
activity.

SRM is not a standalone airport process. Daily airport activities,

such as daily inspections required under 14 CFR Part 139, are part
of the SRM process.

Airports can enhance SRM efforts by ensuring that

• Airport operations supervisors are well versed in SRM concepts
• Airport inspections include hazard identification in addition to Part 139 compliance
• Inspection documentation is integrated into the airport safety information system or hazard
identification system
• Safety information is passed to the SMS Coordinator for trend recognition and to support the
safety assurance process

12.2.2  Preparing for Complex Changes

Planning and preparing for complex airport changes are enhanced by the application of SRM,
typically through the conduct of an SRA. SRM performed in the planning phases anticipates haz-
ards, analyzes and assesses risks, and plans for mitigation strategies to control risk to acceptable
levels. In the execution phase, mitigations are put into place and applied to the tasks identified
during planning.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM in Daily Operations   59  

Performing SRM in the preparation phase is the bridge between SRM in the planning phase
and the execution phase. Supervisors involved in complex changes should
• Be well versed about the anticipated hazards identified in the planning phase
• Understand the mitigations put into place to manage the anticipated risks
• Brief all participants involved with the change on the anticipated risks and the planned
mitigations
• Ensure that participants understand their responsibilities in watching for the emergence of
new hazards and addressing errors before they result in adverse outcomes

Many risk mitigation actions reflect FAA recommendations

contained in ACs. Staff need to ensure such recommendations
are in place and effective during the execution of the change
(e.g., airside construction).

12.2.3  Performing Routine Operational Tasks

Airports run on a routine. In particular, airports with scheduled air carrier service run on a
defined routine well known by all employees. Effective SRM in the execution phase requires the
vigilance of supervisors and line workers alike to watch for variance, guard against error, and be
aware of changing conditions.

Routine breeds complacency.

One way to keep the SRM mindset active in the execution phase is to ask a simple question
when going into an event or preparing to perform a task that is done multiple times per week,
per month, each year:
What is Different Today?
Answering this question reminds those about to perform routine tasks that they should take
care and heighten their senses. Answering this question raises awareness of changing conditions
and focuses those who continuously perform the same tasks on the potential for error.
“What is different today?” can lead to follow-up questions such as
• Will the weather cause problems with this task?
• Do I have the right tools with me?
• Did I get a good sleep last night and am I as alert as I need to be?
• Am I performing this task in an unfamiliar location?

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

60   A Guidebook for Safety Risk Management for Airports

Questions such as these can start the mental execution of the SRM process and will enhance
both situational awareness and operational performance.

12.2.4  Responsibilities of Supervisors

Supervisors are an extra set of eyes and the objective observers of operations on the airport.
Often, supervisors have the most experience. Supervisors assigning or monitoring routine oper-
ations must ask those performing tasks about changes they are facing and about things that are
different from other times they have performed similar actions. Supervisors can ask “What is
different today?” during shift changes, event briefings, and during their “walk-arounds” when
observing work happening on the airport.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 13

Time-Critical SRM—ABCD Model

Both supervisors and frontline workers need an easy-to-recall way to both trigger and exe-
cute a quick run-through of the SRM process. The 5-step process described in Chapter 9 can
be effective in a short-response situation if those facing risk decisions are well versed in the
process. Usually, this is not the case for frontline workers not exposed to the SRM process daily.
The Department of the Navy uses an easy-to-remember trigger for the SRM process in the
execution phase—this may be useful for those working at airports. The ABCD Model provides
frontline workers involved in high-risk tasks with an easy-to-recall trigger that engages the risk
management thought process. The ABCD Model, a variation on the 5-step process, is for fast
action.
“ABCD” stands for
Assess the situation
Balance resources
Communicate to others
Do and debrief the event
This model provides those in the execution phase with a consistent approach and easy-to-
remember tool for dealing with changing conditions and hazards previously unforeseen.
As an event begins or conditions change, the focus of the individuals involved tends to shift
to understanding the changes and how to deal with them. As participants become more focused,
their ability to take in additional information or give adequate attention to normal procedures
diminishes. This paves the way for errors. The use of a tool such as the ABCD Model can help
individuals take a step back, maintain situational awareness, and better manage risk during
dynamic conditions.
A detailed explanation of the ABCD Model is presented below [as adapted from the Navy’s
Instruction on Operational Risk Management (OPNAV Instruction 3500.39C)].
• Assess the Situation: In a real-time situation, individuals must consider the event in which
they are engaged and choose appropriate resources and controls to meet the hazards they
identify. In a time-critical situation, assessing the situation requires an accurate perception of
what is happening in a relatively short time and then quickly projecting its effect—in other
words, maintaining good situational awareness. Unlike in the planning or preparation phases
where there is time to assess hazards, an individual’s ability to comprehend the situation and
apply appropriate, available resources quickly and effectively can mean the difference between
success and failure.
• Balance Resources: After assessing the situation, personnel must consider all the resources
available for the task or activity. Are backup personnel available if additional people are

61  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

62   A Guidebook for Safety Risk Management for Airports

needed? Is there a way to call supervisors or emergency response assets? Are spare tools
nearby if something breaks? Thorough planning before an event will increase the avail-
ability of appropriate resources to mitigate hazards effectively. Understanding the task or
mission, proper training, using PPE, and knowing personal limitations are essential aspects
of balancing resources; they are also aspects that can be pre-planned.
• Communicate to Others: Good communication is essential to the success of SRM in the exe-
cution phase. The “C” in ABCD is a reminder to explicitly communicate during the event, and
it is tied to all steps of the 5-step process. Maintaining good situational awareness of changing
conditions and increased task loading is critical to communication. This is because perception
and communication skills deteriorate as people lose situational awareness. As stress increases
or events become more time constrained, communication tends to become limited or non-
existent. Individuals who understand this relationship are better able to adjust and mitigate
additional risk when they recognize a loss of awareness.
Although communicating intentions works best when multiple individuals are involved in
the event, situations may occur where individuals must weigh decisions on their own, where
“self-communication” is crucial. When working alone, individuals should ask themselves:
• Who needs to know about the situation?
• Who can help or assist?
• Who can provide backup?
• Can this be done differently?
These are just a few examples of questions individuals can ask to ensure positive and effec-
tive communication takes place.
• Do and Debrief: The “D” of the Model starts the risk mitigation actions—Do the task or
execute the evolution. To ensure success in the task or event, the individual must select and
use the appropriate resources while adjusting actions as required to manage the new risks. The
second aspect of the “D” is ensuring that the feedback loop or “Debrief” aspect of the model
is performed. It is beneficial for individuals or teams to follow through and complete the
ABCD mnemonic loop by identifying what worked and what did not work and then ensuring
documented lessons are disseminated. Debriefs will improve performance and mitigate risks
in future activities. During debriefs, questions should be asked of those completing the event
or task, such as
• Was our assessment accurate?
• Were we lucky?
• How well did we use the resources?
• Was the communication effective?
• What can we do to improve response to similar events in the future?
Asking these types of questions, and then documenting the new hazards and real-time
mitigation actions taken and discussed in an event debrief, helps ensure future activities are
improved and risks are reduced.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Time-Critical SRM—ABCD Model   63  

To illustrate the ABCD Model in action, the actions of a super­

visor of a snow removal team during a snow event are used. The
storm is worse than forecast. Team leaders and team members
using the model will

• Assess the progress of the snow event: the amount of snow

or ice falling; the temperatures; the winds; the length of time
the event is forecast to take place; the conditions anticipated
following the event.
• Balance resources during the event: the staff, equipment, and
chemicals available prior to the storm; the available backups
like contractors to augment the airport staff; FAA ATCT to
assist with pilot communications; working radios or mobile
phones; alternate runway options.
• Communicate to others about the changing conditions and
considered actions: contact airport management and ATCT
about the changing and unanticipated conditions; pass on
recommendations and actions being taken on the scene;
airport management will communicate with snow crews, con-
tractors, airlines (if operating at the field), and other stake-
holders as appropriate.
• Do or act on the recommendations using available resources:
Take actions based on the best information available. Lastly,
the airport will conduct a de-brief to discuss the changes
needed to handle the unanticipated intensity of the storm;
consider recommendations for changes to the airport snow
removal plan.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 14

Implementing Mitigation Actions

The last step in the SRM process is to mitigate and monitor the actions taken for the identified
hazards. This step includes tasks and actions that should be implemented to reduce the risk. In
most situations, these actions will be assigned when the level of risk is found to be unaccept-
able; however, actions may be established to address medium and low risk as well. Medium risk
should be mitigated whenever possible and feasible, and low risks can be further mitigated if
simple, low-cost actions are possible (e.g., improve situational awareness). Medium risk should
be mitigated further if it is believed that the outcome is a single point of failure, defined as a part
of a system that, if it fails, will stop the entire system from working.

To understand how mitigation actions can reduce the level of risk, it is necessary to understand
basic risk concepts, particularly severity of outcome and likelihood. This chapter presents differ-
ent categories of risk mitigation actions, how mitigation actions can affect different components
of risk, and how actions should be managed and monitored to complete the SRM process.

14.1 Working with Likelihoods and

Outcomes for Risk Mitigation
As described previously, risk has two components: severity of outcomes and likelihood of
occurrence. The severity of the outcome is the effect on the system from the hazard. The effect
is normally associated with the worst credible outcome.

Outcome
The potential outcome or effect if the hazard is not addressed is the first component of risk.
The key question to answer is “what can go wrong?” when certain conditions are assumed. For
example, the user can ask what can go wrong during an aircraft landing if the runway surface is
contaminated with ice and runway friction is reduced. The answer could be “a runway excursion.”

In reality, there is a range of outcomes—from a minor veer-off with no damage to the aircraft
to a catastrophic overrun with hull loss and multiple fatalities. So, which outcome should be
used when doing a risk assessment?

There is no rigid rule for this; a few credible outcomes should be used so that the focus of
mitigation actions is defined. There is an important difference between the worst outcome and
the worst credible outcome. The worst outcome is always major asset loss, major damage to the
environment, or death. When considering airports, catastrophic failure of the system is always
possible.

64

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Implementing Mitigation Actions   65  

To illustrate how varying outcomes for a single hazard are con­

sidered when assessing risk, contamination of runway landing
area is used as an example.

Working with the worst rather than the worst credible outcome can have major effects on
resources required to mitigate risks, and risk classification will lose its effectiveness because every
risk will fall in one column of the risk matrix. In many situations, it will be significantly more
expensive to implement actions for over-rated risks.
For the example, the worst credible outcome for a runway excursion is likely to be an accident
with multiple fatalities. The outcome is credible because accidents with this level of severity have
happened, and a collision between two aircraft or an aircraft at high speed and a vehicle during
a landing can lead to a catastrophic accident.
Another example is the risk of wingtip collision during taxiway operations when the separation
is lost. Chances are that an aircraft may deviate excessively from the taxiway centerline resulting
in collision of aircraft wingtips. There may be a tendency to classify the worst credible outcome
for this type of risk as catastrophic because of the possibility of fuel spillage and fire that could kill
everyone on board and destroy the aircraft. However, historical records indicate that no events of
this type involving fatalities have occurred in the United States during the past 30 years. A more
credible outcome is major damage to aircraft involved. This does not mean that the catastrophic
event will never happen, but it is unrealistic to expect that it will happen at any individual airport
in the next 100 years.
Therefore, when estimating the severity of a risk, it is important to recall if the event has occurred
in recent years at the airport or in the U.S. aviation industry. The NTSB accident databases are
excellent sources of information on whether or not an event has occurred at other airports.

The two components of risk: severity of outcome and likelihood,

are related because likelihood is always associated with the
specific level of consequences assumed for the risk.

Risk classification involves the assumption of credible outcomes. In most situations, the per-
son or group assessing the risk will have a risk matrix to make the classification and a single
classification for severity should be selected. Table 14-1 provides the FAA severity classification
impacts specific to airports.
When reviewing the examples presented, the credible outcome for a runway excursion can be
classified as Catastrophic (1); and the severity associated with wingtip collision during a taxiway
operation is Major (3), because major damage to aircraft is a plausible scenario.

Likelihood
The second component of risk is likelihood; it is the chance that the assumed outcome will
take place. Likelihood is normally presented in terms of the number of occurrences per number
of operations or number of occurrences per period. For example, the likelihood of a birdstrike

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

66   A Guidebook for Safety Risk Management for Airports

Table 14-1.   FAA Order 5200.11 (Change 1) – hazard severity classification.

Complete loss of aircraft and/or facilities or fatal injury in passenger(s)/ worker(s), or

Catastrophic
Complete unplanned airport closure and destruction of critical facilities, or
(1)
Airport facilities and equipment destroyed.

Severe damage to aircraft and/or serious injury to passenger(s)/ worker(s), or

Hazardous Complete unplanned airport closure, or
(2) Major unplanned operations limitations (i.e. runway closure), or
Major airport damage to equipment and facilities.

Major damage to aircraft and/or minor injury to passenger(s)/ worker(s), or

Major Major unplanned disruption to airport operations, or
(3) Serious incident, or
Deduction on the airport’s ability to deal with adverse conditions.

Minimal damage to aircraft, or

Minor Minor injury to passengers, or
(4) Minimal unplanned airport operations limitations (i.e. taxiway closure), or
Minor incident involving the use of airport emergency procedures.

Minimal No damage to aircraft but minimal injury or discomfort of little consequence to

(5) passenger(s) or workers

to commercial aircraft is one per 7,300 movements. If we use this rate for a large airport with
1,000 commercial aircraft movements per day, one birdstrike per week is expected for the air-
port; however, if this rate is applied to a smaller airport with only ten commercial flights per day,
a birdstrike is expected to occur approximately every 2 years.
Appendix F presents a table with benchmark risks based on historical rates for the U.S. avia-
tion industry. The information may be helpful when assessing the likelihood component of a
specific risk. Table 14-2, used by the FAA to classify risk likelihood in five different levels, is a
simplified version of the FAA Likelihood classifications presenting those specific to airports.
An important question arises from these examples: Should the rate or the occurrences per
number of movements be used or should the expected period for one occurrence be the reference?
The answer is simple. . . it depends! For the small airport with low traffic volumes, the expected
period is usually best, and for the large airport, the incident rate may be more appropriate. The
rule is simple: the likelihood should be classified according to both the accident/incident rate and
expected period, and then the lowest likelihood classification should be used. Likelihood criteria
are normally presented in both accident/incident rate and expected period for occurrence, as
shown in Table 14-2. Other forms of determining likelihood are the use of passenger enplane-
ment numbers for airports with commercial service. This is particularly helpful when dealing with
terminal issues. (See Appendix D, SRM Templates for the tables for likelihood.)

Table 14-2.   FAA Order 5200.11 (Change 1) – likelihood classifications for airports.

Expected to occur more than o nce per week or every 2500 departures,
Frequen
nt (A)
whichever occurs sooner
Expected to occur about once e very month or 250,000 departures,
Probablle (B)
whichever occurs sooner
Expected to occur about once e very year or 2.5 million departures,
Remotte (C)
whichever occurs sooner
Expected to occur once every 1 0 100 years or 25 million departures,
Extre
emely Remotte (D)
whichever occurs sooner
Extreme
ely Improbab
ble (E) Expected to occur less than eve ry 100 years

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Implementing Mitigation Actions   67  

Here is an example using the “birdstrike scenario” for different size airports. When using the
table to classify the risk of birdstrikes for the large airport, the accident rate of 1/7,300 move-
ments can be used, and the likelihood is “Frequent (A).” In the period form, the same likelihood
level is obtained, considering the frequency of one birdstrike per week.
The results for the small airport are different. When using the rate, the same classification
for the large airport is obtained: “Frequent (A).” Nevertheless, if one event every 2 years is
used, the likelihood classification is “Remote (C).” In this case, the lowest likelihood classifi-
cation is “Remote (C),” and this should be the likelihood classification for birdstrikes when
analyzing risk at the small airport.

At small airports, for most situations, the risk likelihood classifica­

tion is based on the expected time to occur between accidents or
incidents resulting from a specific hazard.

The understanding of risk components and risk classification will help the understanding of
how mitigation actions may affect the severity, the likelihood of the event, or both.

Risk classification is illustrated using faded runway markings as an

example.

For example, based on PIREPS, an airport has identified that runway hold position markings
are faded and difficult to see from the aircraft cockpit during rain or low-visibility conditions. A
possible outcome associated with this hazard is a runway incursion. A risk assessment performed
by the airport staff classified the credible outcomes as catastrophic and the likelihood as remote.
Two mitigation actions were planned: the first action was to repaint the markings and the second
to install stop bars at the runway intersections most used by aircraft.
The credible outcomes with mitigation actions remain catastrophic; however, the likelihood
was considerably reduced and is now classified as extremely improbable. Figure 14-1 illustrates
the risk change. In this case, the credible outcome was not changed by the mitigation actions,
and only the likelihood of a runway incursion was reduced to take the risk from unacceptable
(red) to medium (yellow). The risk assessed falls in the yellow or medium half of the lower
right box of the 5 × 5 matrix because other mitigations are in play for risk of a runway incur-
sion; in other words, the repainting of the runway markings is not a single point of failure in
the system.
At another airport, an airside vehicle struck a ramp worker, resulting in a severely injured
employee. The accident investigation identified the causes of the accident as poor driver train-
ing and speeding. A risk assessment by the SMS manager assessed the risk of new accidents and
assumed that the worst credible outcome could be classified as “Hazardous (2),” according to
the airport’s risk matrix, which is similar to that presented in FAA Order 5200.11. Reviewing
the history of similar accidents and incidents at the airport in the past 10 years, it was found that

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

68   A Guidebook for Safety Risk Management for Airports

Mitigation
Mitigation
2C
tion
3D M itiga

Figure 14-1.   Assessment with new mitigation actions.

two similar events had occurred and the likelihood was classified as “Remote (C).” Therefore the
existing risk was classified as 2C using the matrix, or high risk.
Based on the accident investigation, the airport decided to make changes to its airside driving
program and introduce an airside driver responsibility and speed enforcement program. The
actions are expected to reduce both the likelihood and severities if the vehicle speed is reduced
to minimum levels. The assessment with the new mitigation actions classified the credible out-
comes as “Major (3)” and the likelihood to “Extremely Remote (D),” taking the risk to the green
zone, as illustrated in Figure 14-1.

14.2  General Considerations

14.2.1  Mitigation Strategies
When selecting a strategy, personnel should review and assess proposed safety risk mitigation
options from the following perspectives:
• Effectiveness: the extent to which the options reduce or eliminate the safety risks. Effective-
ness can be determined in terms of reliability to reduce the risk significantly.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Implementing Mitigation Actions   69  

• Cost/benefit: the extent to which the perceived benefits of the mitigation outweigh the costs.
Cost estimation of mitigation actions is normally a separate process but is essential to support
decision making.
• Practicality: the extent to which mitigation can be implemented and the appropriateness of
available technology, financial, administrative, and operational resources. This is barring any
legislation or regulation, political issues, and so forth.

Many risk mitigations can be an improvement or an extension

of existing airport practices and controls. FAA ACs provide the
minimum level of mitigations and controls in many cases. How­
ever, airports must take into account ALL existing mitigations and
controls when determining the most appropriate ones to put into
place. Identification of existing mitigations and controls is part
of defining the system in Step 1 of the 5-Step SRM process. These
existing mitigations and controls should be carried over into the
decision-making process for mitigation strategies.

Because operational budgets can be affected by hazard mitigation programs if no funding

has been planned, personnel should consider establishing a line item for risk mitigation in the
estimation of project funding and when planning operational budgets.
When conducting risk assessments, it is common to identify risk mitigation alternatives based
on airport capabilities. Risk mitigation is one option available to treat risk. Other strategies that
may be used are summarized below.

14.2.2  Risk Acceptance

Although acceptance does not reduce the risk, it is still a strategy. This strategy is sometimes
used when the risk is classified as medium and additional control actions are not feasible from
a cost, physical, or environmental perspective. An example is the risk of runway incursions
presented in the previous section. Although mitigation actions were used to reduce the risk, the
risk was still classified as medium because limited resources meant it was not possible to further
reduce the severity of credible outcomes of a runway excursion.

14.2.3  Risk Avoidance

Risk avoidance is used when further mitigation actions are not feasible. For example, an air-
port is certificated for operation of Group III aircraft; however, the separation between one of
the taxiways and a hangar complies only with Group II aircraft. Under this scenario, the taxiway
is restricted to operations of Groups I and II aircraft. The risk associated with the small separation
for Group III aircraft is, in this case, avoided.

14.2.4  Risk Transference

Using this strategy, the airport passes the risk to another party more capable of managing
the risk. A typical example of risk transfer is having an insurance contract to avoid bankruptcy
when the financial situation becomes dire. Here is an example of operational risk transfer—an

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

70   A Guidebook for Safety Risk Management for Airports

airport measured runway friction after noticing excessive rubber accumulation on the runway
surface and found that it is lower than acceptable levels. The airport then decided to issue a
NOTAM announcing that poor braking conditions should be expected when the pavement
was wet. The information was acquired by the pilots and they chose whether to use or avoid
the runway when the pavement was wet. Issuances of NOTAMs by airports are examples of a
risk transfer strategy.

The FAA Safety Risk Management Guidance: The 5-Step Process

(dated September 14, 2012) states “One of the fundamental
principles of system safety is the Safety Order of Precedence
in eliminating, controlling, or mitigating a hazard. Safety
professionals use the techniques listed in the Safety Order of
Precedence, in priority order, for reducing risk.” The priority
order is

1.  Design the hazard out

2.  Provide physical guards or barriers
3.  Provide warning devices
4.  Train people
5.  Communicate the hazard

14.3  Making Decisions About Risk Mitigations

A frequently overlooked but critical aspect of risk mitigation is the decision-making process
to implement risk mitigation actions, particularly at larger airports where key decisionmakers
may not be able to participate in SRA panels.
When an SRA is conducted, the panel will recommend several actions to address the risks
identified and sometimes assign the parties responsible for implementing those actions. How-
ever, non-participation of key decisionmakers in the SRA panels, or the lack of cost estimates to
implement the actions, may postpone the decisions for some of the actions, particularly those
involving significant expenditures. At smaller airports, key decisionmakers typically participate
in SRA panels and decisions can be made in a timely manner.
In any case, following the documentation of risk mitigation action during an SRA, it is neces-
sary to make final decisions about implementing the recommended actions, assigning respon-
sibilities, establishing a schedule, and monitoring to ensure the implementation is completed.
If some actions are not approved, the SRA documentation should be updated and, if necessary,
the residual risk classification should be changed to reflect that one or more actions will not be
implemented or will be modified. Ideally, the approval process for risk control actions should
be described in the airport’s SMS manual.
Figure 14-2 illustrates the flow of safety management information and decision making for
a large-hub airport. The SMS manager can take some simple and immediate decisions on fre-
quently reported hazards. If the implementation of risk mitigation actions involves more sig-
nificant resources, decision making is taken to the upper levels of management. However, if
actions involve multiple stakeholders and significant resources, decisions about which mitiga-
tion actions will be implemented are made with the support of cost information during stake-
holder meetings.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Implementing Mitigation Actions   71  

Tower

Phone
Safety Reporting Airfield Web/
Network

Call Center
Data Recording
Database

Screen, Process,
Analyze & Monitor
Severity
Minimal Minor Major Hazardous Catastrophic

5 4 3 2 1
Probability

Frequent
A

Probable
B

Remote
C

Extremely
Remote
D
Extremely
Improbable
E

Collaborative Decision Making Safety Actions

• What
• When
• Who
Stakeholder Meetings

Figure 14-2.   Decision making of risk control actions at large-hub

airport (example).

At smaller airports, with a reduced management structure and

fewer employees, airport directors and deputies are normally
participants in safety assessments or SRA panels, and decisions
about control actions can be made immediately.

14.4  Ensuring Risk Mitigations Are in Place

During a risk assessment, each risk is normally evaluated more than once because planned
mitigation actions may change the assessed level of risk. The first assessment considers the cur-
rent or planned conditions with existing mitigation actions; follow-on assessments consider
additional recommended actions to further reduce the risk.
All commercial and general aviation airports have some type of FAA regulatory compliance
requirements. Such requirements are considered required or existing risk mitigations. Existing
airport mitigation examples include the following:

• Airport policies or procedures

• Airport infrastructure requirements
• Redundant systems

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

72   A Guidebook for Safety Risk Management for Airports

• Training programs
• FARs, FAA ACs, Letters of Agreement (LOAs), FAA Orders
• Pilot reports (PIREPS)
• FAA Runway Safety Action Team (RSAT)
• Airspace and Aeronautical Information Management (AIM)
• Commonly Used Safe Operational Practices for Taxi Safety (CAST)
• Automatic Terminal Information System (ATIS)
• Pre-construction meetings
• Standard Operating Procedures (SOPs)
• Mutual aid agreements
• Modification of Standards (MOS)
• Airport Certification Manual (ACM)
• TSA 1542 Airport Security
• Local ordinances
• Airport Codes of Rules and Regulations

When considering the present condition during risk analysis, the references listed are assumed
to be existing risk mitigation measures. Although this is true for many situations, that some
procedures are documented in ACs does not mean that those procedures are in place or will be
in place when the hazardous situation is present.

For instance, one of the common hazards of construction projects on the airfield is FOD.
Construction debris may be generated during demolition, excavation, and paving operations
and ingested or blasted by aircraft engines causing damage and/or injuries. FAA AC 150/5370-2,
Operational Safety on Airports during Construction, describes FOD management as one of the ele-
ments of a Construction Safety and Phasing Plan (CSPP). The airport must ensure that the CSPP
is developed for the specific construction project, that a plan for FOD management is included,
that the plan is in place during construction, and that the plan is working effectively to control
FOD generated by construction activities.

14.5  Monitoring Mitigation Actions and Risk

Under an SRM, numerous hazards are identified, and their risks assessed and documented,
sometimes on a daily basis for larger airports. One or more mitigation actions may be assigned
to each risk, and personnel must ensure that the actions are in place and are effective to achieve
acceptable risk levels.

At larger airports, an IT solution, such as a web-based hazard reporting system, preferably

integrated with existing airport information systems, may be very helpful to keep track of haz-
ards and risk mitigation actions. Some available systems include an electronic dashboard that
gives the SMS manager a brief picture of prioritized risks and the status of risk mitigation actions
that may require attention.

At smaller airports, a simple electronic spreadsheet can be very

helpful to track risks and associated control actions, with respon­
sibilities assigned and an implementation schedule developed.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Implementing Mitigation Actions   73  

Monitoring mitigation actions and risks involves three basic tasks:

• Ensuring that mitigation actions are in place and having the desired effective outcome
• Reassessing the risk based on observations or trends of performance indicators
• Checking for unintended outcomes or creation of new hazards

The first task involves ensuring that the responsible party has put the mitigation actions in
place, that implementation schedules are being followed, and that changes can be measured.
With the example of implementing a FOD Management Plan for airfield construction, during
the construction period, airport operations and engineering staff may want to check the areas
near the construction site frequently for the presence of FOD, even though Part 139 airports
should already include this task in daily inspections processes. If FOD is present, the FOD con-
trol plan may not be effective and should be evaluated for improvements. If the amount of FOD
is higher than expected based on observations during daily inspections, the planned mitigations
are not having the desired effect. A new risk assessment should be made and mitigation action
changes identified.
The success of risk mitigation actions can be determined by using established performance
indicators as a baseline. For example, an airport may decide to monitor the number of wildlife
strikes that adversely affect operations. An adverse outcome of this hazard may be aircraft dam-
age or a flight delay, a go around, or an aborted takeoff. By taking data from the FAA Wildlife
Database and counting the number of strikes during each month, it is possible to see the trend
over a period of a few years to check if the wildlife management program is working as expected
or if additional actions should be considered to further reduce the presence of certain species in
the airport area and its vicinity.

14.6  Mitigation Actions

A proven way to manage risk mitigation actions is to develop a hazard and risk log or table.
Numerous off-the-shelf software programs are available and can be used to document hazards,
associated risks, and actions for mitigation. However, smaller airports can use basic office soft-
ware, such as an Excel spreadsheet, for the same purpose. There are also software packages for
managing assets and work orders that can be customized for SMS and can incorporate the capa-
bility to log hazards, their associated risks, and the mitigation actions put in place.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 15

Daily SRM for Small Airports

As discussed throughout the guidebook, small airports have less staff and resources to facilitate
the easy addition of new approaches and tasks to routine operations. For small airports, SMS
in general, and SRM in particular can be seen as a burden, rather than a benefit. Much of this
perception comes from the fact that larger airports have dedicated staff to coordinate SMS activities
and are taking steps to implement specific software solutions for hazard reporting and docu-
mentation, as well as providing SMS training to staff.
Smaller airports have some unique advantages for using SMS and SRM precisely because of having
fewer staff members. In most cases, staff members work in the same area and communicate face to
face many times during the day. Small airports do not require special software to report hazards and
unsafe conditions because a simple phone call, electronic message, or daily discussions are effective to
initiate and make decisions to implement actions to mitigate risks. Simple electronic spreadsheets or
database software is sufficient and effective to document and track hazards, classify risks, and define
control actions—the only added requirement is the discipline to take these administrative actions.
The ABCD Model presented in Chapter 13, or the more thorough SRM 5-step process, should
be used daily. Before SMS, airport managers likely did not have clear, systematic approaches to
address safety issues, document them, and support risk decisions. SRM provides the processes for
this when used properly and regularly. The ABCD Model enables employees at small airports to
address risk faced in everyday activities, even when performing tasks alone. When more complex
safety issues arise, convening a small group, perhaps two or three employees and stakeholders
if necessary, to conduct an SRA is appropriate. The keys to success are knowledge and practice.
An example of SRA for a small airport was provided in Chapter 8. The focus was the towing of
aircraft to the hangar following the reporting of a few incidents associated with this type of opera-
tion. The SRA example involved only the airport manager, the supervisor of operations, and a towing
operator. The example showed how the SRM process is beneficial in determining simple risk con-
trol actions that can be implemented with a low level of effort and few resources (e.g., developing a
simple SOP for towing aircraft and developing posters to remind the operator on the SOP).
Figure 15-1, Example of Hazard and Risk Log Table, provides an example of a hazard and risk
table that can be used by small airports and some large ones alike. Tables 15-1 and 15-2 provide
example lists of ACs that airports use as guidance for risk controls and mitigations.

The Hazard and Risk Log Table in Figure 15-1 is relatively easy to
develop and use and can be a great tool for smaller airports to track
SRM actions.

74

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports
Figure 15-1.   Example of hazard and risk log.
Copyright National Academy of Sciences. All rights reserved.
 A Guidebook for Safety Risk Management for Airports
Table 15-1.   Risk management references available to airports.

Document Title Number Description

Air Traffic Control Order JO 7110.65 Provides Air Traffic Control Procedures and Requirements
Irregular Operations Plan –Tarmac Delay Plan Order 5200.10 Provides Guidelines and Requirements for Developing and Compliance
with a Tarmac Delay Plan (IROPS)
Copyright National Academy of Sciences. All rights reserved.

Foreign Object Debris Management AC 150/5210 24 Provides Guidance on Foreign Object Damage (FOD) and Guidelines for
Developing an Airport FOD Plan/Program
Airport Safety Self Inspection AC 150/5200 18 Provides Guidance on Self – Inspection Processes and Programs
Notices to Airmen (NOTAMS) AC 150/5200 28 Provides Guidance and Requirements for Issuing NOTAMS
Airport Winter Safety and Operations AC 150/5200 30 Provides Guidance and Guidelines on Winter Safety and Operations and
Developing a Snow Plan
Heliport Design AC 150/5210 20 Provides Guidance for Developing a Heliport
Ground Vehicle Operations on Airports AC 150/5300 13 Provides Guidance for Training, Control and Safety of Ground Vehicles
Airport Design AC 150/5300 13 Provides Airport Design Standards and Guidance
Surface Movement Guidance Control System AC 120 57 Provides Guidance for Developing and Implementing a SMGCS Plan
(SMGCS) /Program
Signs, Markings and Lighting, Standards for AC 150/5340 1 and 18 Provides Guidance for Signs, Markings, and Lighting and Standards for
Airport Sign Systems Airport Sign Systems
Hazardous Wildlife Attractants On or near AC 150/5200 32 Provides Guidance for Wildlife Attractant Development and Mitigation
Airports
Qualifications for Wildlife Biologist AC 150/5200 36 Provides Guidance and Experience for Selecting Wildlife Consultants and
Experience and Credentials/Certifications
Debris Hazards AC 150/5380 5 Provides Guidance for Developing a Debris Program and Controls
Design and Installation Details for Airport AC 150/5340 30 Provides Guidance and Data for Design and Installation of Airport Visual
Visual Aids Aids
Safety During Construction AC 150/5370 2 Provides Guidance for Developing a Construction Safety Phasing Plan
(CSPP) and Safety Processes
 A Guidebook for Safety Risk Management for Airports
Table 15-1.  (Continued).

Document Title Number Description

Guidebook for Airport Irregular Operations ACRP Report 65 Provides Guidance on Developing an Irregular Operations Plan
(IROPS)
Construction Safety Phasing Plan (CSPP) (See AC 150/5370 2 above) Provides Guidance on Developing a Construction Safety and Phasing Plan
(CSPP)
Copyright National Academy of Sciences. All rights reserved.

Pilot Reports (PIREPS) SEE Order JO 7110.65 and Order PIREPS provide real time pilot reports of restricted visibility, icing
JO 7110.10 conditions, turbulence, cloud base, layers, tops and other information of
Flight Conditions for Pilots and Air Traffic Controllers and FAA Flight
Services (FSS)
Aeronautical Information Manual (AIM) AIM Provides wide range of regulatory and non regulatory references with
capability of cross referencing CFRs and Advisory Circulars
Obstruction Lighting and Marking AC 150/7460 1 Provides Guidance for Lighting and Marking Obstructions on Airports and
Filing
Objects Affecting Navigable Airspace Part 77 Provides Requirements and Standards for proposed construction and to
determine obstructions
Operator Driver Training Parts 121, 135 Provides Guidance and Requirements for Airline Vehicle Operators
Airport Certification Manual (ACM) AC 150/5210 22 Provides Methods for Meeting Certification Requirements for the ACM
Runway Safety Program Order JO 7050.1 Provides Information and Guidance on FAA’s National Runway Safety
Program to reduce runway incursions
Airport Traffic Control Tower Siting Order Order JO 6480.4 Air Traffic Provides Guidance and Requirements for Proposed New, Relocated or
Control Siting Order Existing Tower Site, Height and Visibility Requirements
FAA Engineering Brief # 75 Engineering Brief # 75 Provides Guidance for Incorporating Runway Incursion Prevention into
Taxiway and Apron Design
Safety Management Systems for Airports ACRP Report 1; Volume 2 Provides comprehensive reference that will help users determine what
Guidebook constitutes an airport SMS. Offers guidance in planning, implementation, and
operation of an airport SMS. This guidebook supplements ACRP Report 1:
Volume 1 which provides an overview of SMS.
Letters of Agreement (LOAs) LOAs Provide wide distribution of information to users on specific operating
processes for e.g. LOA between Air Traffic Control and Airport Operations
when responding to an emergency
Standard Operating Procedures (SOPs) SOPs Provide wide distribution of information to users on frequently used
operating protocols. I.e. consistent and frequently used procedures
primarily used internally to an airport department for e.g. airport FBO
towing aircraft into / out of a hangar
A Guidebook for Safety Risk Management for Airports

78   A Guidebook for Safety Risk Management for Airports

Table 15-2.   Key FAA advisory circulars and CertAlerts applied to airport safety.

Advisory Circular Number

Standards for Airport Markings AC 150/5340 1
Reporting Wildlife Aircraft Strikes AC 150/5200 32
Performance Specifications for Airport Vehicle Runway Incursion Warning System AC 150/5210 25
Aircraft Fuel Storage, Handling, Training and Dispensing on Airports AC 150/5230 4
Airport Design AC 150/5300 13
Engineered Materials Arresting Systems (EMAS) for Aircraft Overruns AC 150/5220 22
Qualifications for Wildlife Biologists Conducting Wildlife Hazard Assessments and Training AC 150/5200 36
Curriculums for Airport Personnel Involved In Controlling Wildlife Hazards on Airports
Operational Safety On Airports During Construction AC 150/5370 2
Airport Avian Radar Systems AC 150/5220 25
Airport Foreign Object Debris (FOD) Management AC 150/5210 24
Standards for Airport Sign Systems AC 150/5340 18
Painting, Marking, and Lighting of Vehicles Used on an Airport AC 150/5210 5
Airport Emergency Plan AC 150/5200 31
Airport Winter Safety and Operations AC 150/5200 30
Systems for Interactive Training for Airport Personnel AC 150/5210 18
Notices to Airmen (NOTAMS) for Airport Operators AC 150/5200 28
Hazardous Wildlife Attractants On or Near Airports AC 150/5200 33
Airport Certification Manual AC 150/5210 22
Construction or Establishment of Landfills Near Public Airports AC 150/5200 34
Airport Self Inspection AC 150/5200 18
Ground Vehicle Operations on Airports AC 150/5210 20
CERT ALERTs Part 139 CERT ALERTs
Part 139

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

PA RT V

Safety Risk Assessment (SRA)

This part presents a detailed discussion about the SRM application likely to be the most visible to
airport management, staff, and stakeholders. The SRA is the practical application of the 5-step pro-
cess in a formal, in-depth manner. This part introduces the concept of SRA triggers—precursors
that lead to an airport’s formal use of the SRM process and triggers that may not require the formal
use of a panel. The chapters describe the SRA process, keys to its effective and efficient conduct, and
recommendations and lessons learned for effective facilitation of the SRA.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 16

Introduction to SRA

SRM processes are used to address many different types of safety issues, from simple haz-
ards, like FOD originated from uncovered trash cans, to very complex airport construction and
improvement projects that affect airfield operations. These examples illustrate conditions that
require changes to how the airport does business. Change generates risk. An SRA is a way to
thoroughly address the risks.
The SRA is a safety assessment performed by a panel of stakeholders and subject matter experts
(SMEs) to analyze a safety issue, run the SRM process to establish risk mitigation actions, and
document the process. The SRA is a formal application of the SRM process to study an airport
condition, either planned or discovered. The SRA will likely be the most visible application of
SRM to airport personnel and tenants. The SRA is triggered by conditions or events at the air-
port; follows the SRM 5-step process in a formal, proactive manner; is facilitated by a person
well versed in the SRM process; and provides airport management with actionable knowledge
to enhance effective, risk-informed decisions.
In general, an SRA should be conducted if a change to the airport system is planned or deemed
necessary. A planned system change might come in the form of an airport construction project,
such as the renovation of a concourse. A system change that is deemed necessary could be dis-
covered from the analysis of safety reports that highlight an undesirable trend, such as increased
levels of FOD. Some safety issues may be unique to specific airport conditions, but may affect
multiple airport stakeholders. Although certain corrective actions may seem apparent and easy
to correct, the airport personnel who identify the condition may not fully understand all of the
effects of the condition or the range of effects the corrections may have. Similarly, when a change
to the configuration of the airport is planned, the integrated nature of airport operations and the
number of stakeholders affected demand a thorough examination of the change. For scenarios
such as these, an SRA gives airport decisionmakers the information necessary to make fully risk-
informed decisions regarding the allocation of resources.

At small airports, the panel of stakeholders and SMEs might only

need to be two to three people. It is the subject matter that is
most important. The facilitator may be a member of the airport
staff who understands the SRA process thoroughly. The effective
execution of the process is what is most important.

81  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

82   A Guidebook for Safety Risk Management for Airports

16.1  Benefits of an SRA

Among the most important benefits of convening a panel and performing an SRA are as
follows:
• The SRA takes the airport through a full and systematic process to identify hazards and reduce
risk levels.
• The SRA coordinates the actions of multiple airport functions (e.g., operations, maintenance,
engineering, and ARFF) and stakeholders and provides a greater understanding of how each
function may interact to improve overall safety.
• The SRA documents hazards, risks, mitigation actions, and responsibilities for those actions.
• The SRA provides a framework and schedule to manage mitigation actions and accomplish
safety goals.
• The SRA increases awareness of risks affecting the various airport functions and stakeholders.
• The SRA supports airport safety policy, helps the airport achieve its safety goals and acceptable
levels of safety, and promotes regulatory compliance.

16.2  Responsibility to Conduct an SRA

In certain situations, the FAA may require an SRA. With the introduction of SMS in the avia-
tion industry, every line of business within the FAA may initiate an SRA. The FAA ARP may
request an airport conduct an SRA and, depending on the scope of the assessment, may ask par-
ties outside the airport to participate.
ARP uses a process called Safety Assessment Screening (SAS) to “document the evidence
to support whether the proposed action is acceptable from a safety risk perspective.” The SAS
and an SRA follow nearly identical processes. The SAS is internal to the FAA, and airports
will only provide information requested. The FAA ARP project manager will complete the
SAS-1 form (SAS report) as appropriate based on the findings from the SAS. The procedures
for the SAS apply to projects, Modification of Standards, and development/modification of
AC standards. Therefore, airport projects submitted to the FAA for approvals will undergo
an SAS and, according to FAA Internal Order 5200.11, may require SRM actions and deter-
mination as to the requirement for an airport SRA. If so, the FAA may recommend that the
airport sponsor convene an SRA panel for the safety assessment and the airport will pay for
the associated costs.
The costs of the SRA normally will include preparing the SRA briefing documents for distri-
bution to the SRA panel members, arranging for a facilitator, scheduling a suitable meeting place
for the panel, sponsoring SME participation, and other costs related to organizing and hosting
the meeting, and documenting the results.
In addition to FAA-required safety assessments for projects and Modification of Standards,
the airport may organize its own SRAs as part of its internal SMS processes. Any safety issue or
concern is a candidate for an SRA. Typically, only those issues associated with higher risk and
need for a multidisciplinary team to conduct an analysis are selected for a formal SRA. Refer to
Appendix A (SRM and the FAA) for more information on FAA-required SRAs.
An SRA may involve one or more airport functions and departments. An SRA supporting
an airfield construction project will involve several functions of the airport (e.g., operations,
engineering, and ARFF), as well as airport stakeholders (e.g., airlines, ground handlers, and
fixed-base operators [FBOs]). In some cases, an SRA may also involve staff of only one air-
port department. For example, the head of an airfield maintenance department has received

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Introduction to SRA   83  

complaints from the FAA ATCT personnel that maintenance staff is not using proper ingress/
egress procedures to access the airfield movement areas. The Director of Maintenance deter-
mines an SRA may help determine risks and identify actions for the maintenance department
to take to improve the use of correct procedures. In this case, only staff from the maintenance
department may be involved in the SRA because the issue was specific to the department.

16.3  When Is an SRA Needed?

There are many factors to consider when deciding to conduct or not conduct an SRA. Airports
need to determine their own set of requirements for initiating an SRA.

16.3.1  Basic Principles

An SRA should be conducted any time the airport determines that a full safety analysis of an
airport condition or event is warranted. Three rules of thumb can help in the determination:
• A change in the airport system is pending.
• The allocation of significant airport resources is required.
• An undesirable trend in airport safety metrics is revealed.

In each of these instances, airport management will face decisions regarding operations and
assets that will alter the way the airport does business. With change comes potential risk. The
SRA is the most complete method to ensure risk is managed as effectively as possible.
The rules of thumb are not all inclusive. Any issue that affects aviation safety can be the subject
of an SRA. The following questions can be asked when considering the need for a panel:
• Will the FAA require an SRA for a planned change/project?
• Do we have an important safety issue that we have not been able to resolve?
• Do we have undesirable trends in our safety performance indicators and we cannot explain why?
• Was an incident reported at another airport with causes similar to conditions at our airport?
• Are incidents or reported hazards on the rise?
• Does a type of incident occur frequently at the airport?
• Is a safety issue affecting the airport’s reputation?
• Is there an important safety issue on the landside of the airport?
• Have we received frequent complaints from our stakeholders about a certain safety issue at
the airport?
• Is an important decision pending that has safety implications?

If the answer is “yes” to one of these questions, there is a good chance that an SRA will benefit
the airport.
Another determining factor regarding when to conduct the SRA is time. Is there sufficient
time to prepare, conduct, and document the SRA? If a panel of SMEs is needed, an effective and
complete SRA requires time. The amount of time necessary may be a function of the complex-
ity of the issue at hand, the size of the airport and number of stakeholders, or the availability of
data needed to properly analyze and assess the risks. For some airports participating in the SMS
Pilot Studies, an SRA scheduled over 2 days, with one 4-hour block held each day was effective.
This length of time allows the panel members to continue their daily duties and to gather more
information for the SRA if required. Other airports learned that one 8-hour day worked well,
or even two 8-hour days were best if the subject matter was complex and the discussions among
the panel members warranted the added time.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

84   A Guidebook for Safety Risk Management for Airports

In general, the SRA should primarily be considered as a proactive planning evolution. It is best
used in advance of a planned system change or as a result of safety trend analysis.
The airport will generally use its internal resources to support the SRA. On occasion, it
may be necessary, and beneficial, to call upon external resources from stakeholders and con-
sultants. Although the availability of resources may pose a near-term obstacle when deciding
to execute an SRA, it is important to remember that SRM is a key component of an effective
SMS and that absorbing near-term costs may achieve greater long-term safety and capacity
benefits.

16.3.2  SRA Triggers

An SRA Trigger is a condition, a system change, or piece of information that prompts man-
agement to convene a panel to conduct the 5-Step SRM process or an event that automatically
requires convening a panel. In most cases, SRA triggers are associated with safety issues that
require a multidisciplinary team to perform the SRM process thoroughly.

Many of the same triggers that lead to the convening of a panel

can initiate application of the 5-Step SRM process in the field to
manage daily operational risks.

The FAA uses an internal procedure to identify the need to organize an SRA Panel and
complete a safety assessment systematically. The Safety Assessment Screening (SAS) process
is described in FAA Order 5200.11 and ARP SMS Desk Reference guide. Some of the triggers
defined by the FAA (e.g., development and update of ARP standards) will only require internal
FAA actions. Other FAA triggers may require actions by airport operators to participate in and
organize a safety assessment and convene an airport SRA panel. The list below presents the most
common FAA triggers for airport SRAs:
• Airport Planning
• Airport Construction Safety and Phasing Plan (CSPP) Development
• 49 CFR Part 150 Noise Compatibility Planning Projects
• Modification of FAA Airport Design Standards
• Airspace Determinations for Non-Construction Changes
Additional Non-Construction Changes include
• Runway or taxiway designation changes
• Pavement marking and signage changes
• Runway categories changes
• Planned approach/departure procedure changes
• Airport modifications or updates that substantially change an action already approved by
the FAA
Some triggers can be considered universal; all airports can use these as SRA initiation points
or as catalysts for evaluating the need for an SRA. Additionally, each airport should determine
its own SRA triggers that fit the needs of the airport, its available resources, and the philosophy
of airport management. Table 16-1 lists common SRA triggers.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Introduction to SRA   85  

Table 16-1.   Common airport SRA triggers.

SRA Trigger Description Example

Airfield improvement Runway 15 extension

Airfield rehabilitation Resurfacing Taxiway C

Airfield maintenance (beyond day to day work) Rubber removal; chip seal on Runway 10

Construction of tower Construction of new ATC tower

Construction
Terminal expansion Additional gates and gate areas

Landside roadway reconfiguration Additional lanes into the terminal area

Parking area modifications or rehab Parking garage rehab or updating facilities

Changes in access roads onto airport property Adding or subtracting lanes and access points

SOP for towing aircraft; SOP for mowing grass in

New SOP
Standard Operating Procedures safety areas
Changes Changes to SOP on snow removal due to new
Modification to existing SOP
equipment

Significant changes to airport organizational Rearranging the Department of Operations;

Airport Organization
structure or key personnel creating an SMS Division

Safety issues reported by pilots or airport Reports of pavement failure, blind spots, or
employees (including tenants) hazardous conditions on the ramp
Safety Reports (Hazardous
FOD generated by poor pavement conditions at
Condition Reports) Safety issues resulting from daily inspections
the intersection of taxiways

Accidents and incidents Surface or ramp accident; birdstrikes

Super Bowl; Olympic Games; Major College

Special Event Major sport events
Football Game

New aircraft brought in by a carrier Starting operation of A380 or B787 aircraft

Installation of new bridges that have different

New passenger boarding bridge
capabilities
New Equipment or Software
New ramp equipment that requires special
Introduction of towbar less tractor
consideration

Changes to reporting procedures during self

Changes to information management systems
inspections

Proposed New
FAA research and development work (e.g. the
Infrastructure/Facilities and Perimeter taxiway; new NextGen equipment
FAA Tech Center)
Regulatory Standards

Trends identified from safety performance

Increase of birdstrikes with damage to aircraft
indicators (e.g. birdstrikes, FOD, etc.)
Safety Assurance
Unsatisfactory SMS internal or external audit
Safety audits
results

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

86   A Guidebook for Safety Risk Management for Airports

At the time of the development of this guidebook, the FAA ARP,

through the Notice of Proposed Rule Making regarding SMS,
anticipates limiting the application of SMS to the Air Operations
Area (AOA), inclusive of the movement areas. Airports can and
are encouraged to include triggers for those conditions that fall
outside the AOA as well. This promotes an airport-wide approach
to safety management with consistent processes, regardless of
location and regulation.

16.4  Categories of SRA Triggers

This section explains and provides examples of the most common triggers used by airports to
define the need to conduct an SRA.

16.4.1  Hazard Reports

Hazard reports at airports are used to describe safety issues (e.g., presence of wildlife, damaged
NAVAID, and FOD) identified during routine procedures. The diverse sources may include
• Daily inspections by airport staff
• PIREPs
• Observations from airfield workers (e.g., Maintenance, ARFF, and FBO)
• Observations from ATCT personnel
At larger airports, hazards are generally reported using systems designed to capture and save
the information, such as airport intranet systems or telephone communications systems.

At small airports, communication between airport personnel

is normally very effective, and frequently safety issues are
communicated and discussed verbally. A method to document
such discussions will enhance SRM at small airports.

Table 16-2 presents examples of frequently reported airport hazards. In most situations, the
parties listed in the table are those reporting the issues; in special circumstances, other stake-
holders may report the issue. Some of these issues are SRA candidates, particularly if reported
frequently at the airport, frequently at a specific location, or in the movement area of the airfield.
For these hazard categories, only the most serious or frequently reported issues generally lead
to a formal SRA. In fact, convening a panel would only slow the decision-making and reaction
processes necessary for normal daily operations. Airports are encouraged to consider panels in
those cases of frequently recurring issues; an example might be FOD reported every day, in the
same location, at about the same time of day. Examples like this are clear indications of systemic
problems that a panel might be better equipped to solve completely. The SRA process would
identify root causes, determine risk levels, and mitigate the situations more thoroughly rather
than just treating the symptom—routinely picking up the FOD every day.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Introduction to SRA   87  

Table 16-2.   Typical safety issues reported.

Hazard Who Reports

Airport operations personnel performing daily inspections
PIREPs
FOD (debris) Airport maintenance personnel during routine work
ARFF personnel
Airlines’ ground personnel
PIREPs
Low runway friction Airport maintenance staff performing runway friction measurements
Airport Operations personnel
Daily safety inspections

Vehicles and equipment speeding in Ground handlers

ramp areas Airline ground personnel
Airport public safety personnel
Airport operations personnel performing daily inspections
PIREPs
Presence of wildlife ATCT
Airport maintenance personnel during routine work
ARFF personnel
Airport operations personnel performing daily inspections
Inoperable NAVAID PIREPs
ATCT
Airport operations personnel performing daily inspections
Damaged signs and lights PIREPs
ATCT

Faded or removed pavement markings Airport operations personnel performing daily inspections
PIREPs

16.4.2  Accident and Incident Reports

Accident and incident reports constitute an important category of triggers. In most cases,
these reports lead to an accident or incident investigation. The purpose of an investigation is
to determine causal and contributing factors to the event so such factors can be prevented or
mitigated. Airport staff can augment and complement investigations by performing an SRA and
identifying risk mitigation actions and staff responsibilities to reduce the chances of a similar
incident or accident.
The most common types of accidents and incidents in this category are
• Surface incidents/accidents
• Wingtip collisions and incidents
• Runway incursions and excursions
• FOD (damage)
• Wildlife strikes
According to the FAA Order 7050.1A, a surface event is an “. . . occurrence at an airport
involving a pedestrian, vehicle, or aircraft on the movement area that involves an incorrect pres-
ence, unauthorized movement or occurrence that affects or could affect the safety of flight of
an aircraft.” The same reference defines a surface incident as an “unauthorized or unapproved
movement within the designated movement area (excluding runway incursions) or an occur-
rence in that same area associated with the operation of an aircraft that affects or could affect
the safety of flight.” Most frequently, surface events and wingtip collisions happen in the ramp

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

88   A Guidebook for Safety Risk Management for Airports

areas. Having many workers and much equipment in a confined area, often under substantial
time pressure, creates an environment in which injuries and aircraft damage may occur.
Runway incursion and excursion accidents and serious incidents are investigated by the NTSB
and the FAA. Determination of causal and contributing factors will help the airport evaluate
the need for mitigation actions, such as new equipment installations to prevent runway incur-
sions, modifications of airfield layout to avoid confusion and hotspots, or improvements to
runway friction, safety areas, and emergency response. An SRA using the investigation reports
as a resource will assist in the evaluation.
FOD and damage caused by wildlife strikes frequently occur at all types of airports. Although
these events rarely lead to fatal accidents, direct and indirect associated costs are high. Airport
SRM will benefit by tracking these events to evaluate trends in frequency, location, and severity.
The SRA may identify further actions in addition to those outlined in the investigation report to
mitigate risk at specific areas or for certain species involved in wildlife strikes.

16.4.3  Trend Analysis

With the implementation of SMS comes the introduction of safety performance indicators.
These could be new measures of safety developed to support the SMS and its SRA component.
Data for these indicators are collected and trends are followed to determine the need for new
actions if an undesirable trend is identified. Examples of indicators in this category are the fre-
quency of wildlife strikes at the airport, the number of FOD incidents in movement areas, or
the number of specific incidents on the ramp (e.g., frequency of vehicle/equipment speeding
reports).
To illustrate trending, recorded wildlife strikes are used as an example. An airport created a
KPI to measure trends of birdstrikes. Data was collected from the FAA Wildlife Database during
the past 10 years and the trends were graphed (see Figure 16-1).
A wildlife strike with adverse effect (AE) is one that causes some type of effect on a flight (e.g.,
damage, delay, or go around). As shown in Figure 16-1, a general increasing trend to the number
of AE strikes is seen, despite some periods when the number of strikes decreased relative to the
previous year (e.g., 2009 as compared to 2008). The trend is undesirable and the airport intends
to further evaluate the species that may be causing the trend using an SRA.

Airport Example - Wildlife Strikes with Adverse Effect

2004 to 2013
20
18
16
14
# of AE Strikes

12
10
8
6
4
2
0
2004 2005 2006 2007 2008 2009 2010 2011 2012 2013
Year

Figure 16-1.   Trends in wildlife strikes.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Introduction to SRA   89  

Sometimes the simple analysis and trending of data may help identify the focus of actions
to mitigate risks. However, to understand which actions will be more effective will require a
discussion with SMEs or personnel from specific airport functions. In this case, an SRA may be
the best option to understand the problem, the associated risks, and the means to reduce the
likelihood of occurring.

16.4.4  Major System Changes

Major system changes at the airport are sources of risks. Some typical examples of such changes
include
• Airfield improvements: runway rehabilitation and extension, construction of new taxiway,
renovation of terminals
• Operation of a new large aircraft: B747-800, A380
• Changes to airport management: reorganization of Dept. of Operations, new Director at a
small airport
• Introduction of new snow control equipment
• Special events: Super Bowl, college football game, air show
• Introduction of new systems: new NAVAID, new IT system for work orders
• Development of new operational or administration procedures
• Financial priority adjustments
• Rapid airport growth: aircraft operations increases, passenger increases

16.4.5  New SOPs

In most cases, the introduction of a new SOP will not represent a major system change. How-
ever, SOPs that focus on procedures used in the airfield can substantially affect safety. Conduct-
ing an SRA may enhance the safety effect of the changes and enable stakeholders to examine fully
how the change affects their operations.
The effective approach is to develop a draft SOP that highlights the proposed changes and
distribute this draft to the parties involved for review. A follow-up SRA will help identify safety
issues associated with the new procedures as well as necessary modifications to the SOP to reduce
the likelihood of incidents and accidents.

An aircraft towing incident illustrates the use of an SRA to

examine SOPs.

For example, a small airport had a few incidents with aircraft under tow to the hangars. In a
few cases, the wingtip of the aircraft struck the doors or the internal structures of the hangar.
An SRA with the airport director and staff responsible for towing aircraft helped to revise the
existing SOP and reduce the likelihood of the incident occurring. During the brainstorming
session, the group identified each step of the towing process (e.g., place work order, assign tow
crew, select tow equipment, hook up, tow, maneuver aircraft in/out hangar, and park and secure
aircraft). Risks were assessed for each step of the proposed procedure, and the procedure was
reviewed again to address the higher risks.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

90   A Guidebook for Safety Risk Management for Airports

In this example, each towing incident caused major problems and legal actions for the small
airport. The airport management was seeking alternatives to reduce the negative perception of
stakeholders and ensure the view that hiring airport services for towing aircraft was safe. The
results of an SRA would support both of these goals.

16.4.6  Concerns Presented in Meetings

Safety concerns are commonly raised during internal and external airport meetings with
stakeholders. These meetings offer excellent opportunities for important discussions about
safety issues. Time is a critical constraint in multi-stakeholder meetings. How safety issues are
presented can determine the value of the safety decisions that come out of such meetings. Air-
port safety leaders can submit specific issues for inclusion in the agenda with recommendations
for immediate action or convening of an SRA. The presentation of the results from completed
SRAs can also be included in the agenda of an upcoming meeting and can direct the group
toward decisions about the actions proposed.
As an example, one tenant airline pointed out to the airport Safety Manager that traffic speed-
ing on the commercial ramp was a concern voiced by several airline employees. The Safety Man-
ager contacted the airport manager’s office and asked that the issue be added to the agenda of the
next Airport Advisory Board meeting. In the meeting, the group recognized this as a significant
safety issue that should be addressed and the airport manager directed the convening of an SRA.
Following the completion of the SRA, the Safety Manager again requested that a presentation
on the results be added to the agenda of the next Advisory Board meeting. When the recom-
mendations for action were presented, including the estimated costs of each recommendation,
the board decided to act on two of the four SRA recommendations and monitor the progress of
those actions.

16.4.7  Formal Reporting Process for Hazardous Conditions

Formal airport reporting systems take many forms. Many reporting systems are regulatory
requirements to meet compliance standards. For example, Part 139 commercial airports are
required to conduct a “daily safety” inspection of the aircraft movement area. Some airports
use an internal voluntary reporting system or a voluntary reporting system for employees and
passengers, either by online reporting, a voicemail hotline, or written forms submitted to the
airport.
Airport hazard reports can come in the form of pavement management friction reports, wildlife
strike reports, and vehicle accidents reports. Because safety is a job requirement for all employees
of the companies working on the airside, airport hazard reports can also come through tenant
companies. These companies should have internal formal reporting systems for airport hazards
by their employees, with a responsible company representative reporting to the airport. Any and
all concerns reported through a formal reporting process must be evaluated and, if required, an
SRA should be conducted.

16.5  Support Material

Support material for SRAs is presented in the guidebook appendices as follows:
• Appendix A: SRM and the FAA describes interactions and interfaces between FAA internal
SRM processes and those required by Part 139 airports
• Appendix B: SRM Handbook provides practical information that can be customized and used
as a quick reference guide during an SRA

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Introduction to SRA   91  

• Appendix C: SRM Process Tools presents practical processes and associated tools for use
during the SRM process
• Appendix D: SRM Templates presents additional templates, risk matrixes, SRA report struc-
tures and examples
• Appendix E: Preliminary Hazard Lists provides lists of common hazards for various categories
of airport safety issues
• Appendix F: Typical Accident and Incident Rates presents historical accident and incident
rates for airport safety issues that can be used as baselines during the SRA process
• Appendix G: Typical KPIs and Associated Data provides examples of typical Key Performance
Indicators that may be used/created by the airport for monitoring trends after SRA control
actions have been implemented
• Appendix H: Basic Probability and Statistics for SRM presents basic approaches to calculating
probability and statistics which are intended to support the risk assessment portion of SRM

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 17

Conducting an SRA

The SRA process can be divided into three different parts: preparation, conduct, and docu-
mentation. Each part includes two or more subtasks, as illustrated in Figure 17-1. The process
can be used for a range of safety issues with varying degrees of complexity. Some of the sub-
tasks described in this chapter can be eliminated if the SRA Panel is experienced with SRM
processes.

17.1  Before—SRA Preparation and Planning

17.1.1  Review Documents
One way to ensure the SRA is conducted as efficiently as possible is to ensure that appropriate
documentation is collected in advance while developing the SRA Plan. If the SRA is planned to
cover a construction project, then all documentation that explains and describes the proposed
project needs to be reviewed and understood by the appropriate airport staff. Most likely this
will be the SMS manager and the primary project owner or sponsor. The documents should
include all available information about the project’s effect and proposed schedule. Documents
covering the SRM process and SRA procedures are very helpful to ensure the SRA is planned and
executed properly, particularly if the panel members are new to the SRM process. The same is
true for non-construction-related SRAs as well. As an example, documents describing elevators
and escalators in a terminal building would be appropriate to review for an SRA that will cover
passenger conveyance issues in a terminal.

17.1.2  Develop SRA Plan

SRA pre-planning, as with most group exercises, is critical to ensuring the effort is efficient
and effective. As presented later in the templates section of this guidebook, use of SRA checklists
is recommended and examples are provided. By having already reviewed the documents, the
SMS manager and SRA owner or sponsor should be able to determine basic logistics of the SRA
and assign responsibilities. This is helpful to make the SRA as participant friendly as possible,
which will help to support process buy-in.

17.1.3  Identify Panel Members

The number of panel members may vary—from a couple of people for smaller airports to
over 40 as observed in SRAs conducted during the FAA SMS Implementation Pilot Study—
depending on the complexity and reach of the SRA topic. Key personnel with expertise in the
areas affected by the subject or trigger of the SRA will be required attendees, along with select
decisionmakers from the airport staff.

92

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Conducting an SRA   93  

• Review Documents
• Develop SRA Plan
• Identify Panel Members
SRA • Identify Facilitator
• Contact Stakeholders
Preparation • Prepare Material
• Develop Preliminary Hazard List
• Schedule SRA

• Introductions
SRA • SRM Basics
Conduct • SRA Template and Example
• SRA Facilitation
• Identification of System

SRA • Consolidate Info Recorded

Documentation • Prepare Report
• Submit Report for Approval

Figure 17-1.   SRA parts.

SRAs are relatively new and represent a change to business practices for airports. Those that
participate will need prior notification and guidance.
In many cases, it may be beneficial to limit the size of the panel, particularly when the group
is formed with the most experienced personnel involved with the specific SRA theme. Smaller
groups of no more than ten people are easier to manage. The SRA needs to include the ultimate
owner of the subsystem being assessed, the project manager (if the assessment will cover a con-
struction project), the SMS manager, and important stakeholders of the potential impacts of
the assessment.
Examples of required panel members include
• Airport operations
• SMS manager/coordinator
• Risk management
• FAA (as appropriate from ARP, ATC, Tech Ops)
• Airlines
• SMEs
• Facilitator (while not a voting panel member, a facilitator ensures the process is followed)
Panels may also include staff from:
• Airfield maintenance
• Planning
• Development and engineering
• Public safety (Police and Fire)
• Environmental management
• Ground handlers
• FBOs
• Fueling services
• Transportation

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

94   A Guidebook for Safety Risk Management for Airports

17.1.4  Identify Facilitator

Identifying an experienced facilitator is important to a successful SRA. The person should be
selected immediately after a decision is made to conduct the SRA. Ideally, the facilitator is also a
SME with the safety issue that triggered the SRA and has no conflict of interest with the parties
involved. For these reasons, an airport sponsor may choose to use an outside consultant or use
airport staff from another airport if such an arrangement is possible.
According to FAA Order 5200.11 (08/2010), facilitators should complete the SRA Panel Facil-
itation course before leading ARP SRA panels. This is only the case for those panels required by
FAA ARP. However, it is recommended that facilitators engaged by the airport have a similar
qualification, thus, providing a certain level of consistency to the industry. It is also important to
understand the need for and identify necessary support staff—individuals who can take notes,
organize documents, and run presentations, freeing the SMEs to focus on the SRA.
Refer to Chapter 18 for more information on how to facilitate an SRA.

The facilitator should not be responsible for taking the overall

notes that will make up the information contained in the SRA
report. The facilitator should only be responsible to take bullet-
form notes to record information requested from or provided by
panel members. The facilitator bullet-form notes should remain
visible to the panel. This provides a level of reassurance to the
panel members that their input was heard and noted. Ideally,
a designated note taker will assist the facilitator and help with
documentation required for the final report.

17.1.5  Contact Stakeholders

In most situations, when the need for an SRA is determined, a group of stakeholders are
invited to participate in the brainstorming sessions. It is important to contact key stakeholders
and SMEs as early as possible to ensure their availability and avoid conflict of schedules. The
presence of certain key panel members may be critical to achieve effective results and a successful
SRA. Organizing the list of panel members with their respective contacts will save time during
the coordination and scheduling of the SRA session.
When contacting stakeholders, make sure they are aware of the SRA topic and have a timeframe
to check their availability. When confirmed, they should receive documentation to understand
the issue or system to be assessed and prepare for the discussions. Appendix B has a template to
help identify the preliminary information to be passed to panel participants.

17.1.6  Prepare Materials

17.1.6.1  Review Documents
Panel members and particularly the SRA facilitator should review the documents and data
associated with the safety issue. Examples of valuable SRA documentation include the Airport
Certification Manual (ACM), operating procedures, safety performance trends, project plans,
Construction Safety and Phasing Plan (CSPP), and the Airport Master Plan.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Conducting an SRA   95  

17.1.6.2  Develop Preliminary Hazard List (PHL)

A Preliminary Hazard List can save valuable time during the panel’s brainstorming sessions.
Appendix E presents some hazard lists associated with common airport safety issues. Although
these lists address many of the hazards, they are not comprehensive and many of the listed
hazards may not be relevant to the specific problem. The airport should develop its own PHL
before the SRA starts. The lists help the group involved with the SRA select some hazards for the
specific situation.

17.1.6.3  Organize a Template for SRA Flow

A template that follows the SRM 5-step process will help the conduct and flow of the SRA.
A common SRA template is a simple table, often generated using an electronic spreadsheet, which
lists the SRM steps and several sub-steps that will guide the SRA. Annotating an estimated time
allotted to each step can assist in SRA schedule adherence.
The type of template used will depend on the type of SRA. Information used to help select
the type of SRA is provided in the ensuing chapter. The template will help the facilitator and the
panel navigate through the brainstorming session.
Appendix D has typical templates used for different types of SRAs along with information on
how to use each template.

17.1.6.4  Prepare SRA Briefing

A valuable tool used to kick-off the SRA is an introductory briefing to present the problem
and introduce SRM concepts to those less familiar with the process. The duration of the briefing
depends on the complexity of the issue and the knowledge of the panel. The briefing could
last 30 minutes for a focused and narrowly scoped SRA topic or 2 hours or more for a complex
project with a large panel. The briefing content should include the following:
• SRA objective
• SRM basics with examples
• Description of the SRA process with example
• Description of the system that will be assessed during the SRA
• Preliminary plans and initial data associated with the SRA

17.1.7  Schedule the SRA

Scheduling an SRA involving a large panel can be challenging. It is rare that all key participants
and SMEs will be available during the same days; therefore, flexibility must be built into the
schedule. For smaller panels, with six or fewer participants, it may be easier to accommodate
the requirements of the participants and a couple of days can be reserved for the SRA. For larger
airports when a facilitator is brought in from outside the airport, a hard start and end time and
dates are likely, thus requiring more detailed advanced planning. A basic SRA schedule example
is provided in Table 17-1. This type of schedule was used by some of the airports participating
in the SMS Pilot Studies, on various SRA topics, and by different sizes of airports (non-hub,
medium-hub, and large-hub airports). Note: in the example Table 17-1, only 8 hours are planned
for the actual conduct of the SRA itself. The amount of time needed should be driven by the topic
and the complexity of the airport.
It is difficult to estimate the duration of an SRA. Risk assessments associated with airfield
construction may require 8 or 12 hours over 2 or 3 days. It is necessary to limit the time of each
session because brainstorming sessions may be very demanding. After a few hours, the exercise
becomes less effective. Examples from the FAA SMS Pilot Studies include two half-day sessions

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

96   A Guidebook for Safety Risk Management for Airports

Table 17-1.   Basic SRA schedule (example).

Day 1 (2 hours) 1/6/14 Day 2 (4 hours) 1/7/14 Day 3 (4 hours) 1/8/14

12:00 PM to 2:00 PM 8:00 AM to 12:00 PM 8:00 AM to 12:00 PM
Briefing with airport staff Steps 1 3 of the SRM process Steps 4 5 of the SRM process &
Confirm logistics and 1. Describe the System SRA Documentation
processes and procedures 2. Identify the Hazards 4. Assess the Risks
3. Analyze the Risks 5. Mitigate
6. Document the process and
mitigations

(allowing staff to have time for their daily responsibilities and provide more information for the
SRA process if necessary), a single session lasting a full day, and a single half-day session. There
is not enough information in the airport industry yet to recommend a time standard. Airport
operators need to determine what works best at their airports and how best to ensure the process
is followed and productive.
A simple table where each column represents the date and rows represent the period of the
day (i.e., morning or afternoon) is suitable. The cells should contain
• The time period (e.g., from 8:00 AM-12:00 PM)
• The location (e.g., Meeting Room A, Ops Bldg.)
• The parties involved if the sessions involve smaller groups (e.g., Ops and Engineering only)

It may be hard to schedule SRAs with large parties. An alternative is to break the panel into
smaller groups of up to ten people. This approach allows for the accommodation of individual
schedules and organizes more manageable groups to make the process simpler and focused, thus
helping the facilitator and the groups to keep the SRA efficient. The disadvantage of an SRA with
multiple groups is that some synergy and interaction between different parties with varied views
may be lost. To mitigate this disadvantage, the final SRA meeting can be scheduled to have at
least one member of each group present to overcome the loss of interaction. This strategy also
avoids discussions focused to only one or two subgroups, while the other SRA panelists remain
silent and may lose motivation.

17.2  Conducting an SRA

Figure 17-2 presents the recommended steps to conduct an effective SRA and the flow of the
SRA process.

17.2.1  Step 1: Opening Remarks, Introductions, Handouts, & Agenda

The SRA opens with remarks by airport leaders or SRA sponsors describing the subject
of the SRA and introducing the organizations involved. Each participant is asked to introduce
himself/herself, including name, affiliation, and position. Next, the meeting agenda is presented,
describing the steps and any schedule issues. Any handouts (e.g., risk matrix and categories
of hazards) should be provided to participants. Every participant should be aware of the
purpose of the meeting, expected outcomes, and the items to be covered during the SRA.
The agenda will help participants get ready for the discussions. Having start times for each
agenda item will help maintain the pace of the discussions and keep conversations focused.
In addition, this will ensure that the number of agenda items to be covered remains realistic for
the time allotted.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Conducting an SRA   97  

1. Opening Remarks,
Intros, Handouts,
& Agenda

2. SRM Process 3. Rules of the 4. Bound the

Presentation / Meeting Discussion
Training

6. SRM 5-Step Process

•Describe the System 5. Identify
•Identify the Hazards Categories of
• Analyze the Risks Hazards
• Assess the Risks
•Mitigate the Risks

7. Review Actions &

Assign
Responsibilities

8. Review Results 9 . Review Next Steps & Close

Figure 17-2.   SRA facilitation process.

17.2.2  Step 2: SRM Presentation/Training

The introductory briefing is next. An SRM briefing/training is presented to familiarize the
participants (particularly those who have not participated in SRA exercises) with the 5-step
process and the tasks at hand, understand the SRM process, and introduce or review the airport-
specific risk matrix. The presentation ensures all participants are on the same page, whether or
not preliminary information was provided prior to the meeting.

17.2.3  Step 3: Rules of the Meeting

The participants should be briefed on what role they will play, what is expected from them,
and how they should act to help achieve a successful outcome. Before the meeting begins, address

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

98   A Guidebook for Safety Risk Management for Airports

things to avoid during the meetings (e.g., responding to text messages, answering phones, and
sidebar conversations). Only one person should speak at a time during the SRA.

17.2.4  Step 4: Bound the Discussion

Discussing the specific portion of the system involved in the assessment will help participants
further understand the scope of the analysis. For example, a construction job on the airfield assess-
ment may be bounded as the construction area (e.g., Taxiway M, from Taxiway C to Taxiway F),
equipment, haul routes, workers, airport staff and other stakeholders, construction materials
and debris, and the environment comprised by the movement and non-movement areas impacted.
When proceeding through the process and discussing each individual hazard, a new subsystem
may be identified as associated with the specific hazard and should be part of the bounded SRM
process for that hazard.

17.2.5  Step 5: Identify Categories of Hazards

Although a list of specific hazards should not be provided to participants, a list of categories
may help with hazard identification. Hazard categories for a construction job could include
hauling, excavation, and paving.

17.2.6  Step 6: SRM 5-Step Process

One approach is to discuss each category of hazards and perform the SRM 5-step process for
each hazard identified within the specific category. The subsystem for the category is described,
and the first hazard is identified. Risk is determined and assessed for the hazard under existing
conditions and controls for that hazard are identified. The risk should be classified and additional
mitigation actions may be deemed necessary to address medium and high risk. The risk should
be reassessed to determine the expected residual risk following implementation of new mitigation
actions. The process is repeated for each hazard within the specific category. The whole 5-step
process is repeated for each category of hazards.

17.2.7  Step 7: Review Actions and Assign Responsibilities

One or more risk mitigation actions may result from an SRA. These actions will help
further mitigate the risk level in addition to existing controls. A person or group at the airport
should be responsible for implementing these risk mitigations; often, so as to avoid potential
organizational conflicts, the implementation is assigned to one or more stakeholders without
engaging a specific person. In most situations, the results of an SRA will be presented during a
regular airport meeting for decisions related to recommended actions and assignment of parties
responsible.
Although this step could be performed during the SRA facilitation meeting, it may be more
effective to perform after the 5-step process is complete. Grouping mitigation actions before
assigning responsibilities for implementation creates more efficient assignment of responsibilities.
The objective is to identify the party responsible, rather than the person. Each party will later
follow specific management processes to appoint the person responsible for each action.

17.2.8  Step 8: Review Results

Participants usually have different views of what happened during the SRA and what are the
next steps. Five to ten minutes before the end of the meeting, participants should review the main

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Conducting an SRA   99  

risk mitigations resulting from discussions and convert those decisions into action. To improve
the quality of the SRA, the group should be asked “What went well?” and “What can we improve
on next time?”

17.2.9  Step 9: Review Next Steps & Close Meeting

The final step in conducting the SRA is to describe the next steps and the schedule (including
preparation of the SRA report, submittal of the report to the participants for approval, and collec-
tion of information on mitigation actions approved by the parties at their specific decision levels).
Following this, the SRA is closed.

17.3  After—SRA Documentation

17.3.1  Consolidate Information
The SRA process will generate several documents. Regardless of how the information is
collected, either via a computer using MS Excel or a Word document or by using large note
paper, a lot of information will be captured and must be gathered so that it can be easily made
into a report.

17.3.2  Prepare Report

It is necessary to document both the SRA process and the results. The report ensures that the
essential elements of the SRA were discussed. These elements include
• Who was involved with the assessment,
• The hazards and risk levels identified, and
• Particularly the risk mitigation actions that should be implemented.

The report will contain important details and may be used to guide discussions in other
meetings, particularly for decision making on risk mitigation actions that should be implemented
and the persons responsible for those actions.

Small airports may only need a one-page template in order to

document the SRA and the results effectively. Appendix D includes
a template for small airports.

SRA reports, in general, should contain the following sections:

• Cover and Table of Contents
• Quality Assurance and Version Tracking
• List of Participants
• Executive Summary
• Background and Scope
• Description of the System

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

100   A Guidebook for Safety Risk Management for Airports

• Hazards, Risks, and Risk Values

• Mitigation Actions and Responsibilities
• Conclusions and Recommendations
• Attachments
The cover should provide the name of the airport, the type of report, the theme of the safety
assessment, the report number, the report version, and the date.

17.3.2.1  Quality Assurance and Version Tracking

Some SRA reports will be reviewed by several participants and decisionmakers. Track the modi-
fications to ensure that relevant comments and suggestions are properly addressed. Appendix D’s
example SRA reports include
• Mission: The purpose of the system being described, such as the safe movement of aircraft on
the ground, and during takeoff and landing operations, when describing the airfield.
• Machine: A physical description of the site or area involved with existing structures (e.g.,
buildings and facilities, airfield areas, access routes, parking or staging areas, gates, utilities,
equipment, and systems).
• HuMan: A description of the functions involved, including airline operations, airport functions,
and other stakeholders.
• EnvironMent (Media): The environment composed of the types of operations and weather
conditions to which these operations are subject. This may also include key behavioral influ-
ences such as psychological, physical, and physiological stressors (e.g., night shifts or long
working hours).
• Management: A list of safety-significant activities, processes, procedures, rules, and regulations
that govern the conduct of the mission described for the system.

17.3.2.2  Hazards, Risks, and Risk Values

This section summarizes hazards, associated risks, and risk values. It is normally presented
as a table with risk value cells with background color corresponding to the level of risk: green
for low, yellow for medium, and red for high. For simpler SRAs, current risk, residual risk, and
mitigation actions are presented in the same table. Table 17-2 illustrates the concept.
The risk values assigned in Table 17-2 are examples only. The values should be determined
by the definitions for severity and likelihood that were developed specifically for the airport
and then assessed using the airport’s risk matrix. Examples of severity and likelihood definitions
and risk matrixes are included in Appendix C. Some facilitators prefer to sort the risks from
highest to lowest in this type of table. Examples are presented in the example SRA reports in
Appendix D.

Table 17-2.   Hazards, risks, and risk values.

Risk Value
Haz # Hazard Outcome Severity Likelihood Risk Value
1 Haz 1 11 Sev. 1 1 Lik. 1 1 RV. 1 1
12 Sev. 1 2 Lik. 1 2 RV. 1 2
2 Haz 2 21 Sev. 2 1 Lik. 2 1 RV. 2 1
3 Haz 3 31 Sev. 3 1 Lik. 3 1 RV. 3 1

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Conducting an SRA   101  

Table 17-3.   Summary of mitigation actions.

Hazard Identified Hazard

Outcome Potential result associated with the Identified hazard
Risk Value This section provides the severity, likelihood and value of the Identified risk. The field may be colored to
reflect the color scheme set up in the risk matrix used for this exercise. Yellow in this case represents a
Medium level of risk.
Risk Mitigation This section identifies both:
Actions The policies, programs and other measures that the airport or the FAA already has in place that
Haz # contribute to the management of the risk identified; and
The actions that are to be put in place as a result of the specific hazard.
Updated Risk Value This section provides the severity, likelihood and value of the Identified Risk revised in light of the
mitigating actions. The field is colored to reflect the color scheme set up in the matrix used for this
exercise. Green in this case represents a low level of risk, I.E. the airport was able to lower the risk value
through mitigation(s).
Recommended This section provides, when applicable, further actions that could be implemented by the airport to
further Risk further mitigate the risk and reduce its value.
Mitigation Actions

17.3.2.3  Mitigation Actions and Responsibilities

This section can be a single table or multiple tables with each presenting a single hazard.
Table 17-3 presents a description of each field. More examples are in the example SRA reports
in Appendix D.

17.3.2.4  Conclusions and Recommendations

This section summarizes the main hazards, risk categories, and mitigation actions in bullet
form. Tables may be necessary for better organization as shown below.

Risk 2-1 (Medium Level of Risk): Performance of routine operations in the presence
of new structures erected to support construction work causing lack of situ-
ational awareness and potential accidents in ramp area affected by construction.

Risk mitigation actions:

• Markings and signage

• Temporary routes
• Temporary protective structures
• Stakeholder construction meetings
• Employee Awareness campaigns
• Airport staff, airlines and third-party operators training programs
• Daily safety briefings and employee awareness
• Issuing of NOTAMs

A table summarizing the parties responsible for implementing each risk mitigation action is
also desirable in this section.

17.3.2.5 Attachments
This section should include the risk matrix used to determine risk values, along with any
materials supporting the SRA (e.g., plans, procedures, and data).

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

102   A Guidebook for Safety Risk Management for Airports

17.3.3  Submit Report

Following the completion of the documentation, the airport should have a documented process
that describes how the report is to be submitted and accepted by the appropriate management
personnel. These personnel may include the SMS manager, the Accountable Executive, the project
sponsor, or other personnel authorized to accept and ensure the risk mitigation plan is implemented
and tracked to determine if it is successful. Further, the SRA report must be archived so that the
process used and the results are available as future SRA reference material and as evidence that the
airport followed its own SMS processes for audit and regulation purposes.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 18

Facilitating an SRA

18.1  Preparing to Facilitate an SRA

An experienced facilitator can help ensure the success of an SRA. Ideally, a facilitator who is
also a SME in the safety issue that triggered the SRA and who has no conflict of interest with
the parties involved should be selected. The facilitator must be familiar with airport operations
to the extent the subject matter deals with those aspects. If the facilitator is not familiar with the
particular topic of the SRA, time needs to be spent preparing so that the facilitator will have a
basic knowledge of the system to be described during the process.

A good facilitator can make the difference between an SRA

that enhances airport performance and an SRA that “checks a
requirements box.”

The facilitator should spend time with the airport staff in advance of the SRA. The time should
be spent accomplishing preparatory tasks and getting answers to important questions such as
• Learning about and understanding the reason for the SRA. What was the triggering event and
how does it fit into the existing system?
• What is the airport staff’s understanding of the issues associated with the SRA? What are the
underlying conditions, personalities, or hidden agendas that may surface during the SRA?
• Confirm the SRM processes, procedures, and templates to be used. Have these been agreed to
with any outside agencies who are participating? (e.g., FAA and airlines)
• Confirm the logistics associated with the SRA
– Dates
– Times
– Location (exact)
– Refreshments
– Projectors
– White boards and or white paper to capture notes in real time
– Responsibilities for documents, drawings, plans, and data
– Responsibilities for other logistics as needed
• If the triggering event is a construction project, the airport staff should provide a detailed
description of the project, including any preferences the staff may have with regard to project
phasing and priorities to tenant and airport impacts.

103  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

104   A Guidebook for Safety Risk Management for Airports

18.1.1  Invitations to Participate

Following the initial briefing with the airport staff, decisions need to be made concerning
the invitations to participate in the SRA. The first decision is on the responsibilities to prepare
and send the invitations. Usually, airport staff will send the invitations; however, the facilitator,
especially if he or she is an outside consultant, may be assigned to prepare the invitation. In this
case, some questions will need to be answered before the development of the invitation:
• Will the invitation be sent via email or hard copy?
• If via email, who is responsible to ensure that all the invitees’ email addresses are correct?
• How elaborate does the invitation need to be? Will it require photos and/or will appropriate
logos be necessary?
• What are the dates for distribution? Will there be a reminder sent closer to the actual date of
the SRA?
Identifying the right people to invite will set the stage for the success of the SRA. Invitations
should be offered to those having a stake in the issue and to those with expertise in the topic
area. The invitation should explain the purpose of the SRA and outline the topics and issues to
be discussed. Make it clear in the invitation what the needed expertise is and how the airport
expects to benefit from the SRA. Prepare a list of items and information each individual invitee
is expected to bring. This list should be included in the SRA invitation so that other members of
the panel can see and understand who is responsible for what.
After coordination discussions are complete, the invitation can be prepared. The invitation
should include, at a minimum, the following information:
• Title (Example: Invitation to a Safety Risk Assessment).
• Dates.
• Times.
• Location (exact, including room numbers or names if necessary).
• A description of the triggering event for the SRA. If it is a construction project, the project
designer might need to provide this information. The description should be short and concise.
• The exact reason why the invitees are receiving the invitation. (Example: You are receiving
this invitation because of your SME and we are requesting your participation in this SRA to
assist us with making important safety risk management decisions.)
• The list of invitees and all the information they are expected to bring.
• Logistics, such as refreshments.
• Any other pertinent issues.
• An RSVP link or phone number. An exact number of participants is needed for proper
planning.

18.1.2  SRA Templates

The templates for use during the SRA should be identified well in advance. The appendices of
this guidebook offer examples. Appendix D is specific to templates. In general, the three most
important templates for use during the conduct of the SRA are
• Definitions for severity and likelihood
• Risk matrix
• Hazard table (which tracks the SRA process)

Sometimes, airport staff may be able to fill in certain templates as the SRA is being conducted.
However, this approach slows the process because members of the SRA panel begin to assist with
writing the details in the tables and report, rather than responding to questions and providing
information that supports decisions.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Facilitating an SRA   105  

18.1.3  Risk Matrix

The guidebook’s appendices contain several sample risk matrixes for use by an airport.
Appendix D is specifically provided to give airport operators options to select risk matrixes that
best fit their needs. The facilitator needs to be familiar with the risk matrix to be used and under-
stand why that particular matrix was chosen by the airport staff. The airport should determine
which matrix is to be used and it should be included in the SMS manual. Appendix D contains
a 5 × 5 matrix used by various airports of varying size and complexity and recommended in
current FAA SMS guidance.

When presenting or reviewing the risk matrix, the facilitator should

illustrate the two ways to reduce risk—decrease the severity of
the outcome or reduce the likelihood of the undesirable outcome.

18.1.4  SRA Briefing to Participants

One of the most important sessions during the SRA is the initial briefing to the panel par-
ticipants. The initial briefing sets the tone for the level of professionalism expected and enables
the airport and the facilitator to be seen as leaders who will ensure the success of the process.
In most cases, the briefing should be presented by a member of the airport staff, particularly, a
senior member of the staff who most likely is seen as the SRA sponsor or SMS manager. It may
be beneficial for the facilitator to make the presentation, particularly if bias among the panel
members may exist.
For illustration, the assumption is made that the briefing consists of a PowerPoint presentation
outlining the issue to be assessed. In general, the presentation should include the following:
• Introduction slide
• Roles and responsibilities
• Logistics
– Dates and times
– Refreshments and breaks
– Overall agenda. (Note: If the SRA will last over 2 days, indicate which parts of the 5-step
process will be covered on which days)
• Brief description or depiction of the 5-Step SRM process
• Definitions for Hazard, Risk, and Mitigation (if necessary, based on the panel members’
knowledge)
• Risk Matrix to be used
• Definitions of Severity and Likelihood to be used
• Detailed description of the issue to be covered (i.e., the triggering action, event, or proposed
change to the system). If it is a construction project
– Site plans
– Phasing
– Haul routes
– Planned mitigations to be implemented during the project
• Close out slide to allow any questions prior to starting the process
To be effective, the presentation should be complete and concise. To some panel members it
may be their first exposure to SRM, and creating a positive first impression of the SRA process is

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

106   A Guidebook for Safety Risk Management for Airports

important. Alternately, panel members experienced with SRAs may have had a bad experience,
such as a protracted timeline, arguments among panel members, or poor data, which may arouse
negative feelings about the process. The briefing is an opportunity to demonstrate how this SRA
will be improved. Keep the mood professional and focused on the tasks at hand.

18.1.5  Handouts to Participants

The SRA will be more efficient if the SRA panel members have pertinent information at their
fingertips during the SRA. Refer to Appendix B for the minimum recommended information
that should be made available. Appendix B, a brief handbook that can be tailored to fit the needs
of an individual airport, can be printed and bound into a small handout for reference.

18.1.6  SRA Checklist

Appendix B also includes an SRA checklist that can be tailored to any airport. During the
SRA, it is beneficial to have the checklist available to confirm roles, responsibilities, and actions.
Someone on the administrative staff of the airport should be tasked with using the checklist to
confirm that things are occurring as anticipated.

18.2  Facilitating the SRA

An effective facilitator is essential for conducting a successful SRA. The facilitator ensures that
the panel members make the most of their time and that the correct information is gathered
to support timely and pertinent decisions. The facilitator must wear multiple hats to make this
happen. Being the SRA’s leader is one; being the SRA’s number one listener is another; and being
the SRA’s manager is yet another. The panel members need to feel heard and sense that their
opinions matter. However, the facilitator must also ensure that the process is followed and the
information and decisions made are appropriate and timely. This is a tough assignment for even
the most experienced person.
Having some focused facilitation training is very beneficial. The FAA ARP provides guidance
on facilitator training in FAA Order 5200.11 and the FAA SMS Desk Reference Guide, Appendix F.
The Order identifies courses consistent with the training and experience needed to assist with
FAA ARP-required and -led SRAs. The FAA uses this guidance for ARP-led panels.
Although 5200.11 is an internal document to ARP, it does and will affect Part 139 airport
operators because of the requirements placed on airport operators to provide facilities and
facilitation services.
Regardless of the requirement, facilitation is more art than science, and participants in the
SRA will benefit from an accomplished facilitator; this is true whether the facilitator is a third-party
consultant, part of the airport’s staff, or provided by the FAA.

18.2.1  Keeping to a Timeline

To ensure the process is followed and the SRA is accomplished in the time allotted, the facilita-
tor also needs to serve as timekeeper. There are several ways to accomplish this; but, in general,
reminding the panel members of what they have accomplished and what will be covered next is
very effective. It reminds the panel members that more work is needed and that providing infor-
mation and making decisions is why they were asked to participate. Specific techniques include
• Establishing the timeline in advance, making it part of the overall briefing and putting it in the
invitation if the SRA is planned over multiple days

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Facilitating an SRA   107  

• Referring to the timeline prior to taking breaks and coming out of breaks so that panel members
see progress and can adjust accordingly
• Starting on time after breaks and refreshment periods
• Having a plan for how long each step in the process will take for discussion and decisions
• Asking panel members what can be done to ensure the process and the timeline proceeds
efficiently
• Calling time-out and reminding the panel members that their time is valuable and you, as
the facilitator, want to ensure it is not wasted. This may be necessary for those panels
members who insist on straying off topic and discussing matters that do not directly pertain
to the SRA
• Striving to prevent participants from skipping ahead. Following the process is critical to ensure
the best and most accurate results come from the SRA. Some SMEs who are participating on
the panel may want to skip ahead in the process and jump to conclusions. The facilitator must
recognize this and not allow it to happen
The best technique to ensure the timeline is followed is to keep the panel members focused on
the process. Gather the necessary information from them and ask for decisions. By leading the
process, the facilitator can help ensure that the SRA follows the agreed timeline.

Keeping the discussion moving during the earliest stages of the

SRA can help keep to the timeline. Typically, panel members will
become overly focused on individual issues early on and then rush
toward the end realizing they are running out of time.

18.2.2  Focusing the Participants

The SMEs sitting on the SRA panel often come from different organizations, but they are all
related by aviation. Representatives from the airport staff, the FAA, the airlines, airport tenants,
and ground service providers might all sit on the panel as SMEs. Often, the panel members
already know one another and work with each other frequently—thus, panel members want
to “visit” and discuss topics unrelated to the SRA subject. As mentioned in the introductory
sections, SMS and SRM are in various stages of development in the United States. The diverse
background of panel members may also mean they have different views of SRM and how the
SRA process should be followed. These pre-conceived thoughts may slow or hinder the process.
The facilitator must be aware of this possibility before the SRA begins.
To focus the panel members and keep them concentrating on the tasks at hand, the following
techniques can be used:
• Describe the process, the risk matrix to be used, and the definitions for the severity and likeli-
hood up front; get agreement from the panel on what is to be used
• Layout the overall timeline and advise the panel that the facilitator’s job is to ensure participants
stay focused on the process and adhere to the timeline
• Establish the ground rules. Reserve the right as the facilitator to refocus the panel members to
ensure the SRA is accomplished
• Remind the panel members that the process will be followed. To make progress, they need to
work the process as prescribed
• Call on them individually and remind them that they were asked to participate for their expertise
and knowledge

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

108   A Guidebook for Safety Risk Management for Airports

• Allow some discussion, but be mindful of the schedule and call the panel members back if
need be. Some discussion is important because it gives the panel members an opportunity to
debate and perhaps discover issues that otherwise would not be mentioned
• Take breaks. When a break is finished, make it clear when the panel reconvenes as to where
they left off and what is coming next
As mentioned earlier, facilitation is more art than science. Each SRA panel will have a different
dynamic and the members will have different relationships with one another and perhaps bias
about the topic being assessed. To the extent possible, the facilitator should be aware of these
conditions in advance and understand how these conditions may affect the SRA process.

18.2.3  Techniques for Hazard Identification

In general, the facilitator keeps the panel members focused and actively participating in the
process. The facilitator may find it beneficial to summarize the techniques used to make the
process more effective. If the panel members offer suggestions that are not classified as hazards,
but rather the outcome of a hazard, the facilitator may choose to not correct the panel member
specifically. Rather, a successful technique is to allow the process to continue and when no other
hazardous conditions are offered, go back through the list and discuss each one to ensure con-
sensus among the panel; a correction can be made then. In such a case, the process continues
and the panel member who offered the non-hazardous condition will not feel their input was
rejected, thus keeping them engaged in the process.

18.2.4 What to Do When a Preliminary List of Hazards

Is Not Available
Some things can be done in the absence of a PHL:
• Allow time for hazard identification in the process. The SRA panel members will develop the
list of hazards from scratch. Therefore, enough time should be allocated in the schedule.
• Plan to use the techniques described in Chapter 9, Step 2, to develop the list. The panel mem-
bers should be asked to go back through the list to confirm the items are, in fact, hazardous
conditions, and then add or subtract as appropriate.
• Use the general lists of hazards provided in Appendix E of this guidebook as a starting point
for the discussions. The examples provided in Appendix E may not be exact matches for each
individual airport, but the examples can put the hazardous conditions in context and spark
discussion among the panel members.
The facilitator must ensure that hazard identification is as inclusive as possible. Encouraging the
panel members to consider all appropriate conditions and under all appropriate circumstances
is necessary. This critical step in the SRA process should not be cut short; extra time should be
allowed and the panel should be encouraged to continue exploring all possible conditions.

18.2.5  Playing “Devil’s Advocate”

Often panel members may begin to agree with one another as a matter of gradually developing
process routine, rather than as a result of honest deliberation. This may stifle thoughtfulness and
leave out important information. The facilitator must identify this behavior and address it. One
way to do so is to play “devil’s advocate.” This means the facilitator challenges the consensus and
asks “What-If” or “what about.” The facilitator must understand the system and the issue being
assessed well enough to be able to ask such questions and have the panel members recognize
what is being asked.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Facilitating an SRA   109  

SRA panel members will sometimes want to assess risk based on the worst outcome of the
hazardous condition and not necessarily on the worst credible outcome. People tend to believe
that all hazardous conditions could lead to a catastrophic event. Although the worst can happen,
it may not represent what is reasonable or credible. The facilitator needs to challenge this by
specifically asking for data to support the panel’s assertion. Questions the facilitator should ask
include, “Is that truly what you expect to happen?” or “When was the last time that occurred?”
These are simple ways to challenge the panel without stifling discussion and interaction.

18.3  Recording/Documenting the Proceedings

The facilitator is responsible for capturing what is said by the panel members, not verbatim,
but by topic or in a bullet formatted list. The panel members expect to be heard, and the most
effective way to demonstrate that the facilitator did hear them is to capture the topic or issues
they provide. Such capture can be accomplished in several ways:
• Use large whiteboards or poster paper and capture thoughts with a marker. This is a long
standing technique used by facilitators of various industries and provides immediate feedback
to the panel members that they were heard. This technique is taught in detail in the Certified
Master Facilitator’s Course referenced in Section 17.1.4. With this technique, it is important
to keep track of the pages used with a simple numbering system. Also putting headers at the
top of each page will help in tracking progress.
• Use an electronic table and project it on a screen for all the panel members to see as it is being
filled in. This technique may require additional staff to type in the information while the
facilitator manages the process. This technique may save on documentation on the backend
of the SRA by providing the beginnings of the final report. One drawback to this technique
is that panel members may become more interested in editing the projected table rather than
staying on task and working the SRA process.
• Allow each member of the panel to have a template at their place that they can fill in as the
process moves along. This is a way to provide panel members with quick visual references and
feel more involved. This should not replace the facilitator’s documentation. The facilitator
needs to ensure consistency and provide the official results of the SRA.
The facilitator must understand that personally capturing focused comments does not replace
the need for a dedicated note taker to capture the detail of the discussion and the decisions made.

It is very difficult for the facilitator to both take notes and effectively
facilitate during the SRA. SRAs may benefit from having a recorder
or note taker to free the facilitator to focus on keeping the process
moving and productive.

At the conclusion of the SRA, all notes should be gathered and pulled into a draft report
as expeditiously as possible. This ensures the capture of the information while it is still “fresh”
in everyone’s minds. Refer to Appendix D for sample final report templates.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

CHAPTER 19

SRA for Small Airports

19.1  SRA Planning

At small airports, an SRA will likely involve few people, regardless of the complexity of the
issue. Typically, panel members will come from the airport staff. The planning process can be less
formal and a meeting can be scheduled using regular electronic messages or verbal communication.
Scheduling should be easier due to the number of people participating.

19.2  Conducting the SRA

The main challenge faced by a small airport is in finding a facilitator with experience and
training to lead the SRA brainstorming. At airports with limited resources and for airports that
do not fall under FAA SRM requirements, having someone on staff who understands the SRA
process and can lead a group of people through the process is very valuable. Having at least one
employee with formal facilitator training can ensure small airport SRAs are effective and efficient
while relying on internal resources.
For SRA panels with less than five people, the facilitator may only need to ensure the process
is followed and document a discussion as it occurs. The size of the SRA panel will determine how
involved the facilitator will need to be. Some airport panels may only involve two people and
they may simply carry on a discussion about the safety issue being assessed. One person might
act as facilitator by taking notes in a logical and thorough manner. The need for a facilitator
should be driven by the number of people needed to conduct the SRA and the complexity of the
issue being assessed.

Small airport operators should determine the need, roles, and

responsibilities of a facilitator, based on the size of the SRA panel
and the complexity of the issue being assessed. Internal staff may
be acceptable and should be considered first in order to save costs.

19.3  Documenting the SRA

Unless it is an FAA-led panel, there is no need for a formal report to document the SRA.
Appendix D presents an SRA report example from a small hub airport. The report may be as
simple as an SRA template that presents the hazards, risks, and risk mitigation actions, with any
relevant notes or comments presented during the SRA meeting attached to the completed template.

110

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX A

SRM and the FAA

The FAA may require some 14 CFR Part 139 certificated airports to develop and maintain
an SMS that encompasses aircraft movement areas of the airfield. The SMS should include
the four components: safety policy, safety risk management, safety assurance, and safety
promotion.
In addition to the “internal SMS” processes required by the FAA, there are some important
interfaces between Part 139 airports and the FAA lines of business, particularly Airports—ARP
and Air Traffic Organization—ATO, which are summarized in this guidebook. Figure A-1 illus-
trates the interactions among ARP, ATO, and the airport. Some areas are common to two of the
three elements; in some situations, all three SMS will interact. This section describes how these
elements may work together regarding SMS.

The information presented here may be changed and updated by

the FAA, so the airport operator as the certificate holder should
always obtain updated information and advisory material from
the FAA website (www.faa.gov).

A-1 Framework of SMS Amendment to Part 139

Proposed Rule
The basic proposed requirements for SRM described in the Notice of Proposed Rulemaking
for Part 139 SMS are as follows:
• Establish a system for identifying safety hazards;
• Establish a systematic process to analyze hazards and associated risks using the five SRM steps;
• Ensure that mitigations are implemented where appropriate to maintain an acceptable level
of safety;
• Monitor safety objectives for regular assessment of safety level achieved;
• Aim to make continuous improvement to the airport’s overall level of safety; and
• Establish and maintain a process for formally documenting identified hazards, their associ-
ated analyses, and management’s acceptance of the associated risks.
A more detailed look at the minimum elements required in the regulation is presented to help
certificate holders understand the potential effect of the SMS amendment.

111  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

112   A Guidebook for Safety Risk Management for Airports

Figure A-1.  SMS
interactions between FAA
and Part 139 airports.

System to Identify Hazards

A system to identify hazards is a key element of the airport SMS. The airport may decide to
use or create a hotline for hazard reporting or to use its IT systems and create a tool for online
reporting of hazards. A few airports may use drop-boxes and hazard reporting forms in paper
form. At larger airports, this alternative has limitations because there may be a delay in collect-
ing and processing the information. At smaller airports, verbal communication is common. As
an example, a small airport announced to its employees and stakeholders that hazards could be
reported using the same hotline used by operations. The calls are normally documented in the
operations log book and a checkmark was added to identify if the call reported an issue relevant
to SMS. The information is then passed to the staff member responsible to coordinate the SMS,
for actions when necessary.

Process to Analyze Risks

This process consists of the five steps for risk analysis described by the FAA and includes
describing the system, identifying hazards, analyzing the risk, assessing the level of risk, and miti-
gating risks (see Figure A-2). The process presented in the FAA regulatory and advisory material
on SMS is usually documented in the airport’s SRM component of the SMS manual. The process
is one of the most important elements of safety management. An example of a process to analyze
risks is an SRA for an airfield construction project.

Ensuring Mitigations Are Implemented

Following the process to analyze risks and identify actions to mitigate risks, it is necessary to
ensure that mitigation actions are in place and effective. This is done by assigning parties respon-
sible for implementing each action, defining deadlines for completion, checking the status, and
determining if actions are in place when milestones occur. For smaller airports, the electronic
spreadsheet presented in Chapter 15 (Figure 15-1) can be used for this function.

Monitoring of Safety Objectives

Figure A-2.   The 5-step Safety performance indicators are defined by the airport to monitor specific risks of concern
process. to the airport. Reducing the level of risk associated with these performance indicators is part of

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM and the FAA   113  

the objectives defined by the airport and, in some cases, these objectives are documented in the
SMS manual. For example, a large airport established a safety objective of reducing by 40% the
monthly number of birdstrikes causing adverse effect to flights over a period of 2 years. Histori-
cal information collected from the FAA Wildlife Strike Database served as the baseline for future
improvements and actions were implemented to reduce the presence of species causing adverse
effects. The trend was monitored over a 2-year period, with additional measures implemented to
affect the presence of the most hazardous species and a reduction of 55% in the annual number
of serious birdstrikes was achieved after 2 years.

Continuous Improvement to Safety

A more detailed look at the minimum proposed elements of SMS is presented that tar-
get continuous improvement of safety levels in airport operations. In the SRM component,
continuous improvement is achieved with the continuous identification of hazards, trend
analysis of safety performance indicators, and execution of the SRM cycle using the five steps
to identify actions that should be improved or implemented to reduce risks. As an exam-
ple, an airport administrator received reports of miscommunication incidents between the
tower and airfield maintenance staff. Based on the analysis of these incidents, the risks were
assessed and additional training was provided to maintenance staff to mitigate the risk. How-
ever, after the training was delivered, new incidents were reported and a new safety assessment
was conducted. With the new assessment, the airport decided to replace the mobile radios
used by maintenance staff.

The SRM cycle does not end with the implementation of risk miti-
gation actions. Often, it is necessary to monitor both the effective-
ness of those actions and the risk level achieved to ensure risks
are and remain acceptable. Whenever it is identified that risk was
not controlled to acceptable levels, the SRM 5-step process should
be restarted.

Documenting Hazards, Risks, and Actions

The airport should keep track of reported hazards, associated risks, and actions to take risks to
acceptable levels. At larger airports, an IT solution may be beneficial to monitor and document
the processes and actions. At smaller airports, a simple electronic spreadsheet may be sufficient.
In addition, safety issues analyzed by a panel can be documented with reports describing the SRA
study, conclusions, and actions.

A-2  SRM Interface with the FAA

The SRM processes carried out by the airport as part of its internal SMS aim to continuously
and proactively improve the operations’ safety. The proposed SMS amendment in the Part 139
Rule would add another element of compliance for those airports affected by the revised Rule.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

114   A Guidebook for Safety Risk Management for Airports

Table A-1.   FAA internal SMS triggers for airport operator involvement.

FAA SRM Trigger Airport Involvement Type of Involvement

Consultants and representatives of trade organizations may be invited to
Development and Update of ARP Standards No
participate as panel members of safety assessments.
Exceptions include as built airport layout plans and long term planning beyond
Airport Planning Yes
15 years.
Airport Construction Safety and Phasing Plans The airport is responsible for acquiring independent facilitation services for the
Yes
(CSPP) safety assessment when a panel is required.
Safety assessment required for proposed plans that can affect safety critical
49 CFR Part 150 Noise Compatibility Planning
Yes elements of the NAS. The airport is responsible for acquiring independent
Projects
facilitation services for the safety assessment when a panel is required.
The airport is responsible for acquiring independent facilitation services for the
Modification of FAA Airport Design Standards Yes
safety assessment when a panel is required.
Airspace Determinations for Non Construction The airport is responsible for acquiring independent facilitation services for the
Yes
Changes safety assessment when a panel is required.
FAA expects the certificate holder to participate in the FAA risk analysis instead
Operational Changes Impacting ATO’s SMS Yes
of performing an independent risk assessment under its SMS.

Some safety assurance processes used by the FAA, like Part 139 certification inspections, have
been in place for decades.
With the implementation of the FAA ARP’s internal SMS, some triggering actions for safety
assessments have been established and may require interactions with the airport operator, as
presented in Table A-1. Not all safety assessments will require a panel, and the FAA will inform
the airport about the need to convene a panel.
Note: sometimes, the FAA ARP can provide facilitation services, but this is handled on an
individual basis.

A-3 Understanding the SRM Process Used by the

FAA Airports’ Division (ARP)
Understanding the process used by FAA ARP to conduct safety assessments may help airports
support the FAA efforts and strengthen the interface between the FAA’s SMS and the airport’s
SMS. The process is summarized in this section and details can be found in the FAA Office
of Airports Safety Management System (SMS)—Desk Reference “National Policy”—Order
8040.4A (04/30/12) available on the FAA website. The FAA process in Figure A-3 is one where
the FAA leads and the airport sponsor may be asked to procure facilitation services, provide
additional data, and participate on the panel.
The following are the steps in the process:

1. A project plan, change, or other approval is proposed by the airport or the FAA and a Safety
Assessment Screening (SAS) is required.
2. Documents and relevant information are reviewed by the FAA office overseeing or adminis-
tering the project.
3. The appropriate SAS form (Form 5200-8, 5200-9 or 5200-10) is initiated.
4. The airport sponsor and/or facilitator prepares a Proposal Summary and, when necessary,
submits this summary to other FAA offices and stakeholders to verify the effect on aviation/
airport safety and operations.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM and the FAA   115  

Figure A-3.   FAA safety assessment process.

5. Based on the reviews, it is determined if an SRM Panel is required. If a panel is not required,
the project manager completes and signs the SAS form and the process stops.
6. If an SRM panel is necessary, the airport will be notified for coordination, to acquire a facilita-
tor and arrange the panel, and prepare the schedule. Additional safety data and analyses are
assembled by the FAA and the airport to support the SRM panel meeting.
7. The panel meeting is conducted using standard SRM processes and tools, and the discussions,
conclusions, and actions are reported.
8. The SAS Form is prepared, completed, and finalized prior to being signed by meeting partici-
pants, the airport sponsor, and the FAA; the process is then complete.

FAA’s SRMTS is an internal IT system to document and manage hazards and risks. With
this system, the FAA can keep track of hazards identified in its internal processes as well as
those involving airport changes and improvements and monitor risks and the implementa-
tion of actions associated with these risks. With this tool, the FAA can screen the SMS ele-
ments by risk level, risk category, risk priority, airport, and specific categories of mitigation
action.

A-4  SRM Panel Documentation

Whenever the FAA notifies the airport of the need to convene an SRM panel for a safety assess-
ment, the airport will be responsible for coordinating the schedule with the panel participants
and arranging a facilitator for the analysis. The final documentation is prepared by the FAA and
the airport according to Table A-2.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

116   A Guidebook for Safety Risk Management for Airports

Table A-2.   Documentation responsibilities.

Document Responsibility Note

SAS Form completed and signed by panel Airport sponsors sign the SAS form only if
members, FAA official and airport FAA a panel is held and at the conclusion of
sponsor the panel deliberations
Project proposal summary Airport Sponsor Based on proposal documents
Hazard identification and analysis tool
In most situations the facilitator will be
worksheet and hazard mitigation plan Airport Sponsor
acquired/arranged by the airport
completed by the panel
Narrative of discussions and dissenting In most situations the facilitator will be
Airport Sponsor
opinions acquired/arranged by the airport
Pictures, plans and other supporting
FAA and Airport Including proposal documents
documents and data

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX B

SRM Handbook

The following material is designed to be customized, removed, and copied in order to provide
a 5- to 6-page handbook that is scalable for all airports. The information in these examples is
for illustration only. Each airport should use information pertinent to that airport. Having a
handbook for reference during an SRA, especially with a large panel of SMEs, has proven very
helpful. Individual roles and responsibilities of those conducting and participating in the SRM
process are also defined on Page 4 of this handbook. Note: this handbook is intended to assist
airports conducting a SRA by and for their own needs. It is not intended to replace the FAA
ARP process as defined in FAA Internal Order 5200.11 and explained further in the FAA ARP
SMS desk reference guide.

117  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

118   A Guidebook for Safety Risk Management for Airports

The Five Step Safety Risk Assessment Process

1. Describe the System
The system is described to limit the scope of the risk assessment. The system is oen described using
the 5M Model, which includes:
Mission: the specific airport acvity (e.g. taxiway B reconstrucon)
huMan: the personnel involved with the acvity (e.g. construcon workers, airport
engineering and operaons staff, etc.)
Machine: the equipment involved (e.g. trucks, pavers, compactors, etc.)
Media or environMent: the environment including physical areas and ambient condions
(e.g. taxiway B between taxiways J and N, haul routes, night work)
Management: organizaon, procedures, regulaons, advisory material (e.g. FAA ACs,
Construcon Safety Phasing Plan)

2. Idenfy Hazards
There may be mulple hazards associated with the system that is being evaluated. For example, a
construcon project may involve hazards such as FOD and the movement of haul trucks in airfield
areas.

3. Analyze Risk
Each hazard may have one or more outcomes (e.g. FOD may cause damage to aircra if ingested by
the engine, or it may cause injuries to construcon workers due to jet blast). NOTE: It is important to
idenfy exisng controls. The controls should be considered before assessing the level of risk prior to
other migaon acons that are not in place. SOP, ACs, safety plans, and regular inspecons are
examples of exisng controls (e.g., FOD control plan for a construcon project).

4. Assess Level of Risk

The level of risk with the exisng controls is esmated and recorded. Use the risk matrix on Page 2 of
this handbook. The user or the group will esmate the worst credible outcome and then the
likelihood of occurring. The background color to indicate if the risk is low (green), medium (yellow) or
high (red). The colors will provide quick idenficaon of higher risks. Within each box (25) there is a
le’er which represents the overall level of risk, i.e. green, yellow, or red and a corresponding number
which represents the level of risk based on the level of consequence, “1” being the lowest and “25”
being the highest. The combinaon makes up the RAC which can be used to priorize migaons
within a parcular color group.

5. Migaon Acons
The high and medium risks should be controlled with migaon acons. Each risk may have one or
more migaon/control acons to reduce the risk to an acceptable level. An airport that is
experiencing high frequency of FOD may reduce the risk of accidents by taking addional measures
such as increasing frequency of maintenance and removal of debris with sweeper trucks, and
increasing the frequency of inspecons.

PAGE 1

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Handbook   119  

Customizable Checklist for SRM

ITEM DOCUMENTATION OR TASK OWNER STATUS

A Meeting and Logistics
1. SRA Topic
1a. Description of Proposed SRA
2. Onsite Contact
3. Facilitation Date(s)
4. Location
5. Start Time (Airport Team)
6. Start /End Time SME Panelists
7. Documentation
8. Visual Aids
9. Agenda
10. Other Logistics
B Stakeholder Names and Contacts
1. Facilitator
2. Meeting Coordinator
3. Consultants
4. (airport) Ops/Safety
5. (airport) Admin. (properties)
6. (airport) Admin. (risk mgmt.)
7. (airport) ARFF/PD
8. (airport) Maintenance
9. (airport) Engineering and
Planning
10. Major Airline
11. Major Airline & or Cargo
12. FBO
13. Catering Company
14. Others tenants (Part 135
operators, flight schools, etc.)
15. Other federal agencies: Border
Protection, Customs, Federal
Security Administration, FAA
FSDO
16. FAA ATCT
17. FAA Certification
18. FAA Tech Ops

(continued on next page)

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

120   A Guidebook for Safety Risk Management for Airports

C - Supporting Documentation/Information
Document Title (examples) Specific Document Responsible Party Status
1. Gate Assignments
2. e.g. Airline Operations #
3. e.g. Gate Layout (aircraft
restrictions)
4. e.g. Airline Scheduled Aircraft
5. e.g. Snow Removal Plan
6. Others
D Final Documentation
Section/Content Author/Owner Status
1. SRA Draft Report
2. SRA Review Team
3. SRA Final Report
4. SRA Signoff
5. SRA Submittal
6. Hazard Tracking
7. Hazard Status
8. Final Budget

PAGE 2

Sample Risk Matrix (5 X 5)

Severity
No Safety
Minor Major Hazardous Catastrophic
Likelihood Risk

Frequently L5 M13 H20 H22 H25

Probable L4 M12 M15 H21 H24

Remote L3 L8 M14 M17 H23

Extremely
L2 L7 L10 M16 M19
Remote
Extremely
L1 L6 L9 L11 M18
Improbable

Low Medium High

Monitor, Determine if Risk can be Must be Mitigated to
No Action Required
Mitigated to a Low Risk a Medium Risk

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Handbook   121  

Definitions for Severity and Likelihood (Examples)

Severity:
People Assets Environmental Reputation
A spill or release that is
Loss of an aircraft/or over An event or a series of
not contained and
$1,000,000 dollars in events resulting in the
results in long term
Catastrophic Fatality+ damage/or loss of critical community NOT using XXX
damage to the
system(s) for an extended for an extended period of
environment and fines
period of time time.
to the airport.
Damage to an aircraft
An event or a series of
taking it out of service for
events resulting in the
Severe Injury, an extended period of A reportable spill or
community lessening the
Hazardous requiring time/or damage in excess release that requires
use of XXX causing negative
hospitalization of $500,000/or disruption mitigation.
(annual) financial or
of critical services for
operational impacts.
extended period of time
Damage to an aircraft that An event or a series of
Minor Injury
is reparable/or damage to A reportable spill or events resulting in the
requiring
Major equipment or facility that is release that is community lessening the
medical
reparable within a short contained. use of XXX for a short
treatment
period of time. period of time.
Minor injury not Minor damage to an An event or a series of
A spill or release that
requiring aircraft, equipment, or events resulting in the
Minor does not require a
medical facility not requiring it to be community questioning the
report.
treatment taken out of service reliability of XXX.
No Safety
No injury No Damage No Impact No Impact
Risk

Likelihood:

Frequently Occurs once every month or XXXX commercial operations or XXXXXX passenger enplanements

Probable Occurs once every year or XXXXX commercial operations or XXXXXXX passenger enplanements

Remote Occurs once every 5 years or XXXXXXX commercial operations or XXXXXXXXX passenger enplanements

Extremely
Occurs once every 10 years or XXXXXXX commercial operations or XXXXXXXXX passenger enplanements
Remote

Extremely Occurs once every 20 years or over XXXXXXXX commercial operations or XXXXXXXXXX passenger
Improbable enplanements

PAGE 3

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

122   A Guidebook for Safety Risk Management for Airports

Roles and Responsibilities Table (typical examples)

Role Organization Position Held Responsibilities

SRA Airport Accountable Executive, Approve and or require the SRA to be conducted
Sponsor Safety Manager, Ensure it is conducted in accord with the airport’s
Department Head protocols
Participate as needed
Review and approve results

SRA Airport or consultant Consultant, Safety Lead the panel in accord with the documented
Facilitator (FAA led SRA may be Manager, other designee airport’s process
provided by the FAA) in the organization Ensure the five step SRM process is followed
correctly
Ensure the panel members participate as needed
Ensure the documentation is thorough and accurate
(this may be completed by the scribe; however the
facilitator needs to ensure it’s accomplished and
correct)

SMEs AKA: Airport (operations, As appropriate for the Participate as requested

Panel maintenance, subject matter necessary Provide any requested information
members engineering, police, to ensure the SRA has the Bring any requested materials, drawings, maps, or
fire department, needed information to other
properties, other as appropriately cover the Review results (if requested)
appropriate) topic Ensure your information is accurately presented
Airlines (chief pilot,
ground crews,
properties, station
management)
FAA (tech ops, ARP
certification,
environmental
management, project
management, ATCT
personnel)
Other stakeholder(s)

Note taker Airport’s responsibility Airport personnel and or Take all appropriate notes and documentation in
or scribe to ensure someone is consultant order to develop and provide the final SRA report
assigned the duty. Must which represents the SRA, decisions made, and
work hand in hand with actions taken.
the facilitator

PAGE 4

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX C

SRM Process Tools

C-1 Introduction
This appendix presents templates to support risk assessments. The templates guide the user
through the necessary steps to conduct an SRA and identify the most important factors and
parameters in the process.

C-2  How to Use the Templates

The templates may be used to guide the risk assessment. In most cases, a template is presented
as a table or worksheet and each column represents a parameter of the risk assessment. For each
type of analysis, a specific worksheet is presented, each field is briefly explained, and examples
are provided. In most cases, the columns should be filled in sequence, starting from column one.

C-3 Categories
Many techniques may be used to identify hazards and conduct risk assessments. The tem-
plates present techniques for use by airport staff performing analyses of many common airport
issues. Techniques include
• Basic Risk Assessment
• Safety Risk Assessment (SRA)
• Comparative Safety Assessment (CSA)
• Bowtie
• What-if Analysis

C-4  Basic Risk Assessment

This technique includes the FAA-recommended SRM steps. Most of the techniques presented
use this process; however, the process and the parameters evaluated may change. A basic risk
assessment has the following steps:
1. Describe the system
2. Identify the hazards in the system
3. Analyze risk associated with the hazard
4. Assess the level of risk
5. Mitigate the risks

123  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

124   A Guidebook for Safety Risk Management for Airports

An SMS Administrator could use this technique daily to make risk assessments of sim-
ple safety issues reported or identified during self-inspections. A formal report may not be
required. Having software to record the parameters presented in the template may be very
helpful to track implementation of actions and perform trend analysis. Table C-1 illustrates
this process.
The following are the parameters in the template:
Column 1—Describe the System
Describing the system limits the scope of the risk assessment. The system is often described
using the 5M Model, as follows:
• Mission: the specific airport activity (e.g., taxiway B reconstruction)
• Man: the personnel involved with the activity (e.g., construction workers and airport engi-
neering and operations staff )
• Machine: the equipment involved (e.g., trucks, pavers, and compactors)
• Media: the environment, including physical areas and ambient conditions (e.g., taxiway B
between taxiways J and N and haul routes)
• Management: organization, procedures, regulations, and advisory material (e.g., FAA ACs)

Column 2—Identify Hazards

Multiple hazards may be associated with the system being evaluated. For example, a construc-
tion project may involve hazards such as FOD and movement of haul trucks in airfield areas.
Letters may be used to identify each hazard.
Column 3—Analyze the Outcome
Each hazard listed in Column 2 may be associated with one or more outcomes (e.g., FOD may
cause damage to aircraft if ingested by the engine or it may cause injuries to construction work-
ers due to jet blast). Using the hazard letter and a number will help maintain the organization of
the template (e.g., Risk B2 is the second risk associated with hazard B).
Column 3a—Identify Existing Controls
This column should be used to identify existing controls. It is important to consider these
controls before assessing the level of risk prior to other mitigation actions that are not in place.

Table C-1.   Basic risk assessment template.

(1) (2) (3) (3a) (4) (5) (5a)

Describe the System Identify Hazards Analyze Outcome Identify Assess Level of Mitigation Actions Reassess Level of
Existing Control Risk Risk with
Mitigation
Actions in Place
5M: Mission, Man, Hazard A Risk A1 CA11, CA12, … A1 prior MA11, MA12, A1 after
Machine, Media,
Management Risk A2 CA21, CA22, … A2 prior MA21, … A2 after
Risk A3 CA31, CA32, … A3 prior MA31, MA32, A3 after
Hazard B Risk B1 CB11, CB12, … B1 prior MB11, MB12, B1 after
Risk B2 CB21, CB22, … B2 prior MB21, … B2 after
Hazard C Risk C1 CC11, CC12, … C1 prior MC11, … C1 after
Risk C2 CC21, CC22, … C2 prior MC21, MC22, … C2 after
Risk C3 CA31, CC32, … C3 prior MC31, MC32, … C3 after

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Process Tools   125  

SOP, ACs, safety plans, and regular inspections are examples of existing controls (e.g., FOD
control plan for a construction project).
Column 4—Assess Level of Risk
In this column, the level of risk with the existing controls is estimated and recorded. In most
cases, a risk matrix will be used to estimate the risk. First, the user or the group will estimate
the worst credible consequence and then the likelihood of this occurring. In most cases, a code
consisting of a number (corresponding to the severity) and a letter (corresponding to the like­
lihood) will be assigned to identify the level of risk. It is always helpful to use a background color
to identify if the risk is low (green), medium (yellow) or high (red). The colors will provide
quick identification of higher risks. For example, if using the risk matrix used by the FAA, a risk
level 2C represents a risk of hazardous consequences (2) and remote likelihood (C). A 2C risk
level is assumed to be a medium risk (yellow). If colors are not used, the risk may be characterized
as 2C-medium.
Column 5—Mitigation Actions
The high and medium risks should be controlled with mitigation actions. Each risk may have
one or more mitigation/control actions to reduce the risk to an acceptable level. An airport
experiencing high frequency of FOD on the runway may reduce the risk of accidents by tak-
ing additional measures (e.g., increasing frequency of maintenance and removal of debris with
sweeper trucks, planning runway rehabilitation, and increasing the frequency of inspections).
Column 5a—Reassess Level of Risk with Mitigation Actions in Place
This column is similar to Column 5; however, the new control actions are considered in order
to estimate the new level of risk when all mitigation actions are in place.

C-5  Safety Risk Assessment

Table C-2 is a template for use in an SRA. The columns in this table were described in the
previous section. In addition to the basic risk assessment table, it is important to define the par-
ties responsible for each mitigation action developed during the analysis. Table C-3 provides an
example for an airfield construction project. The columns represent the following parameters:
Column 1—Haz #
A number to identify the hazard
Column 2—Hazard Description
A short description of the hazard

Table C-2.   Risk assessment table.

(1) (2) (3) (3a) (4) (5) (5a)

Describe the Identify Analyze Identify Assess Level Mitigation Reassess
System Hazards Outcome Existing of Risk Actions Level of Risk
Control with
Mitigation
Actions in
Place

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

126   A Guidebook for Safety Risk Management for Airports

Table C-3.   SRA mitigation table.

Hazard Planning Contract-

Haz # Description Outcome Risk Mitigating Actions & Design or Ops ATCT Other
(1) (2) (3) (4) (5) (6) (7) (8) (9)
Sweepers at construction site
Establish monitoring procedures by Ops
Establish notification procedures between
FOD from contractor/operations/ATCT
construction Damage to Use trained contractor escort to identify FOD and
1
vehicles on aircraft report to Ops
taxiways
Use trained flagmen equipped with brooms and
shovels
Install rumble strips at hauling route before
pavement
Locate utilities prior to construction activities

Unanticipated Test unidentified utility cables

damage to Loss of systems
Identify non redundant systems for extra
2 utilities due to leading to
precautions
construction accidents
activities Place system cables in conduits
Mark location of utilities
AOA driver trained escorts at both ends of the
Construction Collisions convoy
vehicles between aircraft
4
crossing active and construction Use trained flagmen
taxiways vehicles
Safety briefings
Evaluate blast envelope of larger aircraft
Secure equipment at gates Airlines

Injuries to Safety briefings Airlines

construction
Coordination: ramp tower/airlines/ATC Airlines
workers and
5 Jet blast
gate operators, Implement protective equipment for
and damage to construction workers
equipment
Adjust routing to avoid construction zones if
Airlines
possible
Temporary signage at prone construction sites

Column 3—Outcome
A short description of the outcome involved with the hazard. There may be one or more out-
comes associated with each hazard.
Column 4—Risk Mitigation Actions
Description of risk mitigation actions. There may be one or more recommended risk mitiga-
tion actions that the airport could implement.
Columns 5–9
Columns 5–9 indicate any involvement of a specific stakeholder to implement the specific
mitigation action. In the first line of the example table, the planning and design, as well as
the contractor staff are responsible for ensuring sweepers will be available at the construc-
tion site.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Process Tools   127  

C-6  Comparative Safety Assessment (CSA)

A CSA is a comparison of the relative risk among multiple alternatives for resolving a safety
issue or airport planning consideration. It is common to use a CSA to conduct tower siting stud-
ies. A Preliminary Hazard List (PHL) is normally used to identify the hazards; hazard analysis
worksheets are used to document the severity of consequence and likelihood of occurrence to
assess the risks associated with each alternative being evaluated. For example, an airport may
decide to build a new control tower with four viable sites identified. Each site is evaluated against
each of the system safety hazards identified in the PHL. The hazards are compared using a risk
matrix for relative hazard ranking. The CSA only considers hazards that may affect aviation
safety and does not address other issues (e.g., cost or environmental issues). The basic worksheet
for a CSA is presented in Table C-4 with examples included.
• Column 1—Hazard: Hazards are numbered according to the alternative being evaluated and
a hazard # is assigned. Hazard 2-3 is the third hazard identified for alternative 2.
• Column 2—Hazard Description: Describe each hazard. There is only one description for each
hazard identified (e.g., difficulty in clearly identifying planes approaching runway 15).
• Column 3—Causes: Describe one or more causes for each hazard identified (e.g., it may be
difficult to identify approaching aircraft due to long distance to runway end, and/or under
low-visibility conditions).
• Column 4—System State: Describe the conditions when causes described in Column 3 are
predominant (e.g., identification of aircraft will be difficult under low light conditions or for
smaller approaching aircraft).

Table C-4.   Sample CSA worksheet (example).

Existing Recommended Predicted

Hazard System Control or Possible Severity Likelihood Initial/Current Safety Residual
Hazard Description Causes State Requirement Outcome Rationale Rationale Risk Requirements Risk
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11)

11 Poor visibility Lack of At night #1 Airlines use Aircraft Hazardous, Extremely #1: M16 – #1: Install #1:
on the highmasted wing walkers accident because of remote, Medium highmasted Hazardous
aircraft ramp lighting #1 Consistently and lighted with multiple because it lights and
11 exacerbated wands #1 another aircraft happened #2: M14 – Extremely
Faded lead at night #2 aircraft #1 being once in the Medium #2: Paint new Improbable
in lines at Airlines use damaged past 10 lead in lines and (changed
gates #2 wing walkers Aircraft and driving years #1 aircraft safety likelihood to
and lighted incident up $$$ #1 envelopes every 20
wands #2 with Remote, years) = L11
ground Major, because it – Low
Local NOTAM equipment because of happened
issued to #2 damage to within the #2:
airlines who only one past five Major and
operate at aircraft #2 years #2 Extremely
that airport; Remote
posted in all (changed
airline likelihood to
operations occurring
offices #3 every 10
years) = L1 –
Low

12 Desc. 1 2 … … … … … … … … …

21 Desc. 2 1 … … … … … … … … …

22 Desc. 2 2 … … … … … … … … …

23 Desc. 2 3 … … … … … … … … …

31 Desc. 3 1 … … … … … … … … …

41 Desc. 4 1 … … … … … … … … …

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

128   A Guidebook for Safety Risk Management for Airports

• Column 5—Existing Control or Requirement: Use this column to identify any measures in place
that will help mitigate the risks associated with the hazard (e.g., FAA Orders, binoculars).
• Column 6—Possible Outcome: The hazard may lead to an unsafe condition, which is described
in this column. The hazard may not necessarily be described in terms of consequences. There
may be one or more possible effects for each hazard (e.g., loss of separation and holding air-
craft interference with NAS equipment).
• Column 7—Severity Rationale: This column is used to justify the estimate of the worst
credible consequence. Often, a SME or group of experienced stakeholders may perform
the estimate.
• Column 8—Likelihood Rationale: Similar to Column 7, this column is used to justify the ratio-
nale used to obtain the estimate. A SME may have the experience to make the estimate, or it
may be estimated using available data for the airport.
• Column 9—Initial/Current Risk: In this column, the level of risk with the existing controls
in place is characterized. Usually, a risk matrix will be used to estimate the risk. The user or
the group will estimate the worst credible consequence and then the likelihood of it occur-
ring. Often, a code composed of a number (corresponding to the consequence) and a letter
(corresponding to the likelihood) will be assigned to identify the level of risk. It is always
helpful to use a background color to identify if the risk is low (green), medium (yellow),
or high (red). The colors will provide quick identification of higher risks. For example, if
using the risk matrix used by the FAA, a risk level 2C represents a risk of hazardous con-
sequences (2) and remote likelihood (C). A 2C risk level is assumed to be a medium risk
(yellow). If colors are not used, the risk may be effectively characterized as 2C-medium to
ensure understanding.
• Column 10—Recommended Safety Requirements: In this column, the list of control actions
to address the hazard should be included. Examples of controls to mitigate the risks for a
tower siting study might include pilot position reports and signage to avoid runway/taxiway
incursions.
• Column 11—Predicted Residual Risk: The residual risk is the risk level estimated if the controls
are implemented to reduce the current risk. The new control actions are considered in order
to estimate the residual level of risk when all mitigation actions are in place.
In addition to the CSA worksheet, a summary table can be used to help compare the alterna-
tives being evaluated. Each line represents one of the alternatives evaluated and numbering fol-
lows the order used in the CSA worksheet. Three columns present the number of hazards with
high, medium, and low risk for each alternative. The last column contains key justification for
selection or elimination of the alternative, as shown in Table C-5.

Table C-5.   Example of CSA initial risk ranking results.

Alternative # High Medium Low Comments

1 0 0 1 Recommended alternative
Eliminated because one of the medium risks
2 0 2 1
could not be further mitigated

Eliminated due to two high risks with high cost

3 2 0 1
to mitigate
Eliminated because alternative will not comply
4 1 1 0
with FAA standard

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Process Tools   129  

C-7 Bowtie
The bowtie method of risk assessment is often used when quantitative data is available and
is an excellent tool for communication to management. The focus is a single undesirable event
(e.g., a runway/taxiway incursion at a specific hotspot or an aircraft overrun). The name origi-
nated from the basic shape of the analysis diagram, illustrated in Figure C-1.
The left side of the event (accident) is characterized as the fault tree and the right side as the event
tree. The knot of the bowtie is the undesirable event. The fault tree contains proactive controls that
act as safety barriers to prevent, control, or mitigate the chance that a hazard leads to an accident.
The event tree has proactive controls to mitigate the severity of consequences if an accident/incident
takes place, despite the proactive controls. The diagram helps illustrate the relationships among
hazards, controls, and consequences and supports a systematic approach for the risk assessment.
The following are the steps to conduct a bowtie risk assessment:

1. Identify the Undesirable Event

The objective of the assessment is to reduce the risk of the undesirable event by reducing
the likelihood and mitigating the consequences when the event occurs. This is the focus of
the bowtie analysis (e.g., aircraft overrun accident).
2. Assess the Hazards
Identify the threats that may lead to the undesirable event (e.g., low friction, long touch-
down, or small RSA).
3. Assess the Consequences
There may be different types or levels of consequences. An aircraft overrun may result
in an incident only or it may end up with multiple fatalities and catastrophic consequences
(e.g., damage to aircraft or hull loss with multiple fatalities).
4. Identify Proactive Controls
Proactive controls are used to eliminate or reduce the probability that the event takes place
(e.g., runway grooving, monitoring runway friction, or installing EMAS). Each hazard may
have one or more controls, and each control may address one or more hazards.
5. Identify Reactive Controls
This is the type of control used if the undesirable event takes place. Instead of reducing the
likelihood, reactive controls may only mitigate the consequences of the event (e.g., establish

Hazards Consequences
Proactive Reactive
Haz #1 Controls Controls
Cons #1
PC #1 Undesired
Haz #2
Event
PC #2 RC #1
Haz #3
Accident RC #2 Cons #2
Haz #4 PC #3
RC #3
PC #4
Haz #5
Cons #3
Haz #6

Figure C-1.   Bowtie model.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

130   A Guidebook for Safety Risk Management for Airports

Figure C-2.   Bowtie model with examples.

an emergency plan, reduce emergency response time, improve ARFF training, and establish a
recovery plan for operations). Each reactive control may address one or more consequences
and each consequence may be mitigated with one or more reactive controls.
Figure C-2 illustrates the application of the bowtie method for an airport safety issue. The
undesirable event is an aircraft overrun.

C-8  What-If Analysis

What-If Hazard Analysis is a structured brainstorming method to identify what things can
go wrong and assess the consequences and likelihood should the risk occur. The answers to
these questions help classify the risks and determine a course of actions to control and mitigate
the risks.
The template used for What-If analysis is shown in Table C-6. The example shows an analysis
for aircraft refueling and the list should be considered only partial.
As with the SRM 5-step process, defining the system in which the hazardous condition exists
is essential. In Table C-6, a quick way to define the system is consistent with the 5-M Model. The
5-M Model in this case would be captured as:
(1) Mission: Fueling Aircraft
(2) huMan: Aircraft crews and fueling personnel
(3) Machine: Fuel trucks and or system, the fuel itself, the aircraft
(4) Management: The fueling SOP
(5) Media: The aircraft ramp area/gate area
The What-If analysis then asks: what if certain components of the system failed? Table C-6
presents examples for just part of the system failing as listed above. Use this for all the 5-M Model
components listed above for a complete picture of the What-If analysis.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Process Tools   131  

Table C-6.   Template for What-If hazard analysis.

System What if? Answer Likelihood Severity Control Actions

Failure (1) (2) (3) (4) (5)
Fueling Mechanical failure Fuel may spray Improbable Minor Use of locking
equip. adrift nozzle during out between mechanism
fueling mating faces Inspection and
maintenance
Fueling adapter on
aircraft designed to
prevent back flow
Human Faulty gauge system or Fuel spills from Remote Major Auto shutoff fueling
error human error leads to surge tank (large valves
overfill of aircraft tanks vent on the quantity of Overfill protection with
aircraft wing fuel spill) fuel sensors in surge
onto the ramp tank
Aircraft Aircraft brakes are not Hose may get Improbable Major Operator should detect
equipment applied nor chocks are ruptured aircraft movement
failure used and aircraft moves Release dead man’s
control to stop fuel
transfer
Chock aircraft

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX D

SRM Templates

D-1 Introduction
The SRM templates support the SRM processes and procedures being developed by airports.
Each section presents templates by category and briefly explains their origin. The templates were
developed using MS Excel and Word templates to help airports in effective, efficient application
of SRM. These templates are scalable and include examples used during the SMS Pilot Studies.
There are explanations and an approach to developing individual airport-specific SRM tem-
plates along with these examples. The intent is not to require the use of any one template, but to
provide airport operators with options and an approach so that local philosophy and require-
ments can be incorporated into the SRM process.

D-2  SRA Checklist

Identifying the need for, planning, preparing, executing, monitoring and tracking, and docu-
menting a safety risk assessment (SRA) can be arduous. Depending on the complexity of the
safety issue, system change, or system itself, the amount of effort that must go into the SRA is
proportional. To make this process more manageable for airport stakeholders and operators, a
simple checklist has been developed by several airports that have participated and some airports
that did not participate in the SMS Pilot Studies. These checklists can help ensure the tasks,
information, and panel member duties are accounted for, so that the SRA can be an effective,
efficient process.
Following are two versions of such checklists. Table D-1 contains four sections with four
columns; the last two columns are used to identify who manages or is in charge of the task and
its status. Section A is used to summarize the general information about the SRA. Section B
contains the SRA panel participants with their affiliation and contact information. Section C lists
the documents relevant to the specific SRA. Finally, Section D is used to control the documents
generated in the SRA.
Note: This checklist was used by multiple pilot study airports. It is flexible and not dependent on
the size of the airport.
Table D-2 presents a checklist developed by the research team to support SRAs conducted for
any size of airport and contains the minimum amount of information that may be necessary for
SRA planning. It includes examples of the information.

132

Copyright National Academy of Sciences. All rights reserved.

 A Guidebook for Safety Risk Management for Airports
Table D-1.   SRA checklist from multiple pilot study airports.

ITEM DOCUMENTATION OR TASK OWNER STATUS

A – Meeting and Logistics
1. SRA Topic
1a. Description of Proposed SRA
Copyright National Academy of Sciences. All rights reserved.

2. Onsite Contact
3. Facilitation Date(s)
4. Location
5. Start Time (Airport Team)
6. Start /End Time SME Panelists
7. Documentation
8. Visual Aids
9. Agenda
10. Other Logistics
B – Stakeholder Names and Contacts
1. Facilitator
2. Meeting Coordinator
3. Consultants
4. Airport Ops/Safety
5. Airport Admin.
6. Airport Admin.
7. Airport ARFF/PD
8. Major Local Airline
9. Major Local Airline (Cargo)
10. Any Other Airline Stakeholders
11. FBO
12. Catering Company

(continued on next page)

 A Guidebook for Safety Risk Management for Airports
Table D-1.  (Continued).

ITEM DOCUMENTATION OR TASK OWNER STATUS

13. Others?
14. FAA ATCT
Copyright National Academy of Sciences. All rights reserved.

15. FAA Certification

C – Supporting Documentation/Information
Document Title Specific Document Responsible Party Status
1. Gate Assignments
2. e.g. Airline Operations #
3. e.g. Gate Layout (aircraft restrictions)
4. e.g. Airline Scheduled Aircraft
5. e.g. Snow Removal Plan
6. Other
D – Final Documentation
Section/Content Author/Owner Status
1. SRA Draft Report
2. SRA Review Team
3. SRA Final Report
4. SRA Signoff
5. SRA Submittal
6. Hazard Tracking
7. Hazard Status
8. Final Budget
 A Guidebook for Safety Risk Management for Airports
Table D-2.   SRA checklist developed by the research team.
Copyright National Academy of Sciences. All rights reserved.

Topic: New Taxiway Turnoff A 12 (example)

Item: Item to be Provided Person Responsible Status
Logistics o January 6, 2014 Mrs. Administration Confirmed
o Date o 8:00 AM to 12:00 PM EDT
o Time(s) o Wilber Wright Conference Room
o Place o Coffee provided
o Other
Facilitator John Doe, Airport WYZ Mr. Administration Confirmed
Document Mgr. Mr. Administration Mrs. Administration Confirmed
Data / Information o Construction Drawings Mr. Engineering TBD
o ALP
o Aerial
Panel Members
1. Mr. FBO Mr. Operations Invited
2. Mrs. US Airline Mr. Operations Invited
3. Mr. FAA Mr. Operations Invited
4. Mrs. GSP Mr. Operations Invited
Additional Resources o Incursion # from XYZ Mr. Engineering Confirmed
o Safety data from previous projects Mr. Operations Confirmed
Photos (as required) See above, Aerial Mr. Operations Confirmed
A Guidebook for Safety Risk Management for Airports

136   A Guidebook for Safety Risk Management for Airports

D-3  Risk Matrix

One of the critical steps in SRM is classifying the risks. Classifying the risks provides the
opportunity to prioritize resources necessary to mitigate the risks effectively. To address risks
falling under multiple categories, airports need a consistent and locally generated reference to
help prioritize resources for risk mitigation.
Risk is normally classified using a matrix—a simple table where the columns represent the
levels of severity and the rows represent the levels of probability. The FAA, across multiple
lines of business, has determined that a five-by-five risk matrix is appropriate to character-
ize safety risk in their varied regulatory roles in aviation (i.e., five categories of severity and
five categories of probability). The tool serves FAA needs and is the risk matrix presented in
the ACs for airports (see Figure D-1). The different colors help the user identify the risk level:
high risk (red), medium risk (yellow), or low risk (green). Additional risk matrix examples are
provided to allow users options when selecting the tool that best fits their operational and safety
needs. Another version of the FAA risk matrix is presented in AC 150/5200-37 (Figure D-2).
It is similar to the matrix adopted by all FAA lines of business; however, two red cells were
adjusted for yellow cells. It is expected that this matrix will be replaced with that shown in
Figure D-1.
Figure D-3 illustrates a simple 4 × 4 risk matrix with only two risk classifications: accept-
able and unacceptable risk. This type of matrix may be suitable for smaller airports where the
numbers of identified risks are limited and do not require additional levels of classification for
prioritizing risk management actions.

Severity
Minimal Minor Major Hazardous Catastrophic
5 4 3 2 1
Likelihood
Frequent Low Risk Medi um Risk Medi um Risk High Risk High Risk
A

Probable Low Risk Medi um Risk Medi um Risk High Risk High Risk
B

Remote Low Risk Low Risk Medi um Risk High Risk High Risk
C
Extremely Low Risk Low Risk Low Risk Medi um Risk High Risk
Remote
D
Extremely Low Risk Low Risk Low Risk Low Risk *
Improbable HalfHi
E gh/Half
* Unacceptable with Single Point and/or Common Cause Failures

High Risk
Medium Risk
Low Risk

Figure D-1.   FAA ARP risk matrix as of July 22, 2013 (update to document:
Internal Order 5200.11 V2).

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   137  

*Unacceptable with Single Point and/or Common Cause Failures

Figure D-2.   Risk matrix from AC 150/5200-37.

Predictive Risk Matrix

Frequent – Likely to Occasional – Likely Remote – Unlikely, Improbable – Very
Occur Repeatedly to Occur Sometime but Possible Unlikely to Occur
Catastrophic –
Multiple Deaths,
Critical Damage,
Aircraft Destruction
Serious – Serious
Injury or Death,
Major Damage to
Facility or Aircraft
Minor – Minor
Injury, Minor
Damage to Facility
or Aircraft
Negligible –
Superficial Injury,
Cosmetic Damage or
Inconvenience Only

Acceptable Risk
Unacceptable Risk

Figure D-3.   Example of risk matrix presented in draft AC 150/5200-37A.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

138   A Guidebook for Safety Risk Management for Airports

Severity
No Safety
Minor Major Hazardous Catastrophic
Likelihood Risk

Frequently L5 M13 H20 H22 H25

Probable L4 M12 M15 H21 H24

Remote L3 L8 M14 M17 H23

Extremely
L2 L7 L10 M16 M19
Remote
Extremely
L1 L6 L9 L11 M18
Improbable

Low Medium High

Monitor, Determine if Risk can be Must be Mitigated to
No Action Required
Mitigated to a Low Risk a Medium Risk

Figure D-4.   Risk matrix used by multiple SMS pilot study airports.

Figure D-4 presents another type of risk matrix similar to that in use by the FAA and developed
by consultants during the FAA Pilot Study. The cells are characterized by a letter representing
the risk acceptability (low, medium, and high) and a number that helps classify the risk within
the acceptability level: the higher the number, the higher the level of risk and the priority for
mitigation actions. The combination of the letter and number represents the Risk Assessment
Code (RAC).
In Figure D-4, each category of risk (e.g., Low, Medium, and High) is assigned a Risk Assess-
ment Code (RAC) to enhance risk identification and prioritization. The risk level numbers
increase within risk category from left to right, corresponding to increasing severity. Example:
A risk assessed to be a M14 will carry a higher priority than a risk assessed to be a M12. Both are
assessed to be Medium level of risk; however, the risk with the higher classification of severity
will take priority for mitigation actions.

D-4  Severity and Probability Tables

Severity and probability tables reflect an individual airport’s level of risk tolerance and
are associated with the specific risk matrix adopted by the airport. The definitions for sever-
ity and probability give the risk assessment meaning and allow airports to quantify the risk
associated with each risk of a particular hazard. Because risk is defined by the combination of
severity and probability, those definitions must reflect the airport’s risk acceptance. The fol-
lowing tables represent a broad variety of definitions for severity and probability. Some of the
tables assign a “value” to the definitions. These values are used when risks are assessed using
a risk assessment matrix and help to prioritize risks within a particular category (i.e., Low,
Medium, or High).

Copyright National Academy of Sciences. All rights reserved.

 A Guidebook for Safety Risk Management for Airports
Severity Definitions

Table D-3.   Definitions for severity from the FAA ARP Internal Order 5200.11.

Minimal 5 Minor 4 Major 3 Hazardous 2 Catastrophic 1

Conditions resulting in a
minimal reduction in ATC
services, or Conditions resulting in a slight
ATC Services

Conditions resulting in a partial Conditions resulting in total

A loss of separation reduction in ATC services, or Conditions resulting in a
loss of ATC services, or loss of ATC services (ATC Zero), or
resulting in a Category D A loss of separation resulting in a collision between aircraft,
A loss of separation resulting in A loss of separation resulting
Runway Incursion (RI), or Category C RI, or Operational Error obstacles or terrain
Category B RI or OE in a Category A RI or OE
An Operational Deviation (OE)
Copyright National Academy of Sciences. All rights reserved.

(OD), or
A Proximity Event (PE)
PD due to response to TCAS
Potential for PD due to TCAS
Corrective Resolution Advisory (CRA)
Flight crew receives TCAS Preventive Resolution Advisory (PRA) Near mid air collision (NMAC) results
issued advising crew to take vertical
Traffic Advisory informing of advising crew not to deviate from due to proximity of less than 500 feet
action to avoid developing conflict
nearby traffic or, present vertical profile, or from another aircraft or a report filed
with traffic, or Conditions resulting in a mid
Pilot Deviation (PD) where PD where loss of airborne by pilot or flight crew member that a
Flight Crew

PD where loss of airborne air collision (MAC) or impact

loss of airborne separation separation falls within the same collision hazard existed between two
separation falls within the same with obstacle or terrain
falls within the same parameters of a Category C or more aircraft; or
parameters of a Category B resulting in hull loss, multiple
parameters of OE, or Reduction of safety margin and
OE, or fatalities, or fatal injury
a Category D OE or PE, or A reduction of functional capability functional capability of the aircraft
Reduction in safety margin or
Minimal risk on operation of aircraft but does not impact overall requiring crew to follow emergency
functional capability of the aircraft
of aircraft safety (e.g. normal procedures per procedures as per AFM.
requiring crew to follow abnormal
AFM)
procedures per AFM

Physical discomfort to
passenger(s) (e.g. extreme braking
Physical distress on
action; clear air turbulence causing
Flying Public

passengers (e.g. abrupt evasive

unexpected movement of aircraft
Minimal injury or discomfort action; severe turbulence causing Fatalities or fatal injury to
causing injuries to one or two Serious injury to passenger(s)
to passenger(s) unexpected aircraft movements), or passenger(s)
passengers out of their seats)
Minor injury to greater than
Minor injury to greater than
10% of passengers
zero to less or equal to 10% of
passengers
Severe damage to aircraft and/or
Major damage to aircraft and/or Complete loss of aircraft
Minimal damage to aircraft, or serious injury to
minor injury to and/or facilities or fatal injury
Minor injury to passengers, or passenger(s)/worker(s); or
No damage to aircraft but passenger(s)/worker(s), or in passenger(s)/worker(s); or
Minimal unplanned airport Complete unplanned airport closure,
Airport

minimal injury or discomfort Major unplanned disruption to Complete unplanned airport

operations limitations (i.e. taxiway or
of little risk to passenger(s) airport operations, or closure and destruction of
closure), or Major unplanned operations
or workers Serious incident, or critical facilities; or
Minor incident involving the limitations (i.e. runway closure), or
Deduction on the airport’s ability to Airport facilities and
use of airport emergency procedures Major airport damage to equipment
deal with adverse conditions equipment destroyed
and facilities
A Guidebook for Safety Risk Management for Airports

140   A Guidebook for Safety Risk Management for Airports

Table D-4.   Definitions for severity (ACRP Report 1, Vol 2).

Risk Severity Classification

Criteria No Safety Risk Minor Major Hazardous Catastrophic

A B C D E

Slight reduction in Significant Large reduction in

Risk on
safety margin or reduction in safety safety margin or
aircraft No risk on safety Hull loss
functional margin or functional functional
operations
capabilities capabilities capabilities

Physical distress Serious or fatal

Risk on
Inconvenience Physical discomfort possibly including injury to small Multiple fatalities
people
injuries number of people

Risk on Loss of
Slight to moderate Loss of community Loss of state Loss of national
airport international
impact reputation reputation reputation
reputation reputation

Major damage
Noticeable damage Large damage
Slight damage is between Severe damage
Financial between between
less than $1,000,000 exceeds
loss $10,000 and $100,000 and
$10,000 and $10,000,000
$100,000 $1,000,000
$10,000,000

Table D-5.   Definitions for severity from a medium-hub (SMS Pilot Study) airport.

People Assets Environmental Reputation

Loss of an aircraft/or over A spill or release that is not An event or a series of

$1,000,000 dollars in contained and results in events resulting in the
Catastrophic Fatality+ damage/or loss of critical long term damage to the community NOT using XXX
system(s) for an extended environment and fines to for an extended period of
period of time the airport. time.

Damage to an aircraft taking it An event or a series of

out of service for an extended events resulting in the
Severe Injury,
period of time/or damage in A reportable spill or release community lessening the
Hazardous requiring
excess of $500,000/or that requires mitigation. use of XXX causing negative
hospitalization
disruption of critical services (annual) financial or
for extended period of time operational impacts.

Damage to an aircraft that is An event or a series of

Minor Injury
reparable/or damage to events resulting in the
requiring A reportable spill or release
Major equipment or facility that is community lessening the
medical that is contained.
reparable within a short use of XXX for a short period
treatment
period of time. of time.

Minor injury Minor damage to an aircraft, An event or a series of

not requiring equipment, or facility not A spill or release that does events resulting in the
Minor
medical requiring it to be taken out of not require a report. community questioning the
treatment service. reliability of XXX.

No Safety
No injury No Damage No Impact No Impact
Risk

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   141  

Table D-6.   Severity definitions from a large-hub (SMS Pilot Study) airport.

1 – People 2 – Continuity of 3 – Environmental 4 – Reputation 5 – Assets

Operations

Minimal Less than

No to slight injury No impact No impact No impact
5 $50k

Minor disruption to Non Reportable –

Minor Injury with medic normal operations Containable minimal Minimal media $50K to <$1
4 response Recovery time = volume of hazardous inquiries Million
immediate material

Major disruption to Reportable – Non

Injury with
Major normal operations containable minimal $1 Million to
transport to Local media coverage
3 Recovery time =24 volume of hazardous $100 Million
medical facility
to 48 hours material

Severe disruption to Reportable –

Hazardous Local and national
Multiple injuries normal operations Containable moderate $100 Million
Severe media coverage for
or fatalities Recovery time = volume of hazardous to $1 Billion
2 more than 48 hours
more than 48 hours product/material

Widespread Reportable – Non Widespread

Catastrophic Mass Casualty regional disruption containable significant international media Over $1
1 Incident Recovery time = volume of hazardous coverage and reduction Billion
indefinite product/material of air travel indefinitely

Copyright National Academy of Sciences. All rights reserved.

 A Guidebook for Safety Risk Management for Airports
Probability Definitions
Table D-7.   Qualitative criteria for risk likelihood from the FAA ARP Internal Order 5200.11.

NAS System & ATC

NAS Systems ATC Operational Flight Procedures Airports
Operational
Individual ATC Service/NAS
Per Facility NAS Wide Airport Specific
Item/System Level System
Copyright National Academy of Sciences. All rights reserved.

Expected to occur
Probability of occurrence more than once per
Frequent

Expected to occur Continuously Expected to occur Expected to occur

per operation/operational about once every 3 experienced in the more than once per more than every week or every 2500
A

hour 1x10 3 months for an item system week 1-2 days departures, whichever
Probability of occurrence occurs sooner
per operation/operational
Expected to occur
hour 1x10 5 about once every
Probability of occurrence
Probable

Expected to occur Expected to occur Expected to occur Expected to occur

per operation/operational month or
about once per year frequently in the about once every about several
B

250,000 departures,
hour 1x10 5 for an item system month times per month
whichever occurs
sooner
Expected to occur
Probability of occurrence Probability of occurrence about
Expected to occur Expected to occur Expected to occur Expected to occur once every year or
Remote

per operation/operational per operation/operational

several times during numerous times in a about once every about once every 2.5 million
C

hour 1x10 5 but 1x10 an item’s lifecycle system’s lifecycle year 3 years hour 1x10 5, but 1x10 7 departures,
7 whichever occurs
sooner
Expected to occur
once
Extremely

Probability of occurrence Unlikely to occur, but Expected to occur Expected to occur Expected to occur Probability of occurrence
Remote

every 10 100 years or

per operation/operational possible in an item’s several times in a once every 10 100 about once every per operation/operational 25 million
D

hour 1x10 7 but 1x10 9 lifecycle system’s lifecycle years 3 years hour 1x10 7 but 1x10 9 departures,
whichever occurs
sooner
Improbable

So unlikely that it can

Extremely

Probability of occurrence Unlikely to occur, but Expected to occur Expected to occur Probability of occurrence
per operation/operational be assumed that it per operation/operational Expected to occur <
it is possible in less than every 100 less than every
E

will not occur in an every 100 years

hour < 1x10 9 item’s lifecycle
system lifecycle years 30 years hour < 1x 10 9
A Guidebook for Safety Risk Management for Airports

SRM Templates   143  

Table D-8.   Quantitative criteria for likelihood (ACRP Report 1, Vol 2).

Risk Likelihood Classification

Extremely Extremely
Improbable Remote Remote Probable Frequent
1 2 3 4 5
More than one event in Between 10,000,000 Between 100,000 and Between 1,000 and Less than 1000 operations
1,000,000,000 and 1,000,000,000 10,000,000 operations 100,000 operations per event
operations operations per event per event per event
Less than once in 100 Once every 10 100 Once every 1 10 years Once every More than once every
years years month week

Table D-9.   Quantitative criteria from a medium-hub (SMS Pilot Study) airport.

Likelihood:
Frequently Occurs once every month or 5,600 commercial operations or 336,000 enplanements
Probable Occurs once every year or 68,000 commercial operations or 4,000,000 enplanements
Remote Occurs once every 5 years or 340,000 commercial operations or 20,000,000 enplanements
Extremely Remote Occurs once every 10 years or 680,000 commercial operations or 40,000,000 enplanements
Extremely Improbable Occurs once every 20 years or over 1,360,000 commercial operations or 80,000,000 enplanements

Table D-10.   Quantitative criteria from a non-hub (SMS Pilot Study) airport.

Likelihood:
Frequently Occurs once every month or 3,000 aircraft operations or 25,000 enplanements
Probable Occurs once every year or 34,000 aircraft operations or 300,000 enplanements
Remote Occurs once every 5 years or 170,000 aircraft operations or 1,500,000 enplanements
Extremely Occurs once every 10 years or 340,000 aircraft operations or 3,000,000 enplanements
Remote
Extremely Occurs once every 20 years or over 700,000 aircraft operations or 6,000,000 enplanements
Improbable
Severity:
People Assets Environmental Reputation
Loss of an aircraft/or over A spill or release that is An event or a series of
$1,000,000 dollars in not contained and results events resulting in the
Catastrophic Fatality+ damage/or loss of critical in long term damage to community NOT using XXX
system(s) for an extended the environment and fines for an extended period of
period of time. to the airport. time.
Damage to an aircraft taking
An event or a series of
it out of service for an A reportable spill or
events resulting in the
Severe Injury, extended period of time/or release that causes short
community lessening the
Hazardous requiring damage in excess of term damage to the
use of XXX causing
hospitalization $500,000/or disruption of environment and requires
negative (annual) financial
critical services for extended mitigation.
or operational impacts.
period of time.
Damage to an aircraft that is An event or a series of
Minor Injury
reparable/or damage to events resulting in the
requiring A reportable spill or
Major equipment or facility that is community lessening the
medical release that is contained.
reparable within a short use of XXX for a short
treatment
period of time. period of time.
Minor injury Minor damage to an aircraft, An event or a series of
not requiring equipment, or facility not A spill or release that does events resulting in the
Minor
medical requiring it to be taken out of not require a report. community questioning
treatment service the reliability of XXX.
No Safety Risk No injury No Damage No Impact No Impact
Note: This airport combined severity and likelihood into one table for ease of reference.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

144   A Guidebook for Safety Risk Management for Airports

Table D-11.   Safety risk assessment process.

(1) (2) (3) (3a) (4) (5) (5a)

Describe the System Identify Analyze Identify Assess Mitigation Reassess Level
Hazards Outcomes Existing Level of Actions of Risk with
Control Risk Mitigation
Actions in
Place
CA11, MA11, MA12,
Effect A1 A1 prior A1 after
CA12, …
CA21,
Hazard A Effect A2 A2 prior MA21, … A2 after
CA22,
CA31,
Effect A3 A3 prior MA31, MA32, A3 after
CA32,

5M: Mission, Man, CB11,

Effect B1 B1 prior MB11, MB12, B1 after
Machine, CB12,
Hazard B
Media/environMent, CB21,
Management Effect B2 B2 prior MB21, … B2 after
CB22,
CC11,
Effect C1 C1 prior MC11, … C1 after
CC12,
CC21,
Hazard C Effect C2 C2 prior MC21, MC22, C2 after
CC22,
CA31,
Effect C3 C3 prior MC31, MC32, C3 after
CC32,

D-5  Detailed 5-Step SRM Process

Table D-11 provides easy-to-follow, step-by-step guidance for process application during
an SRA. Airport operators may choose to provide this template to SRA panel members for
use during the SRA process. The SRA is typically led by a designated facilitator. The facilitator’s
role is to guide the SRA panel members through the process, document results, and provoke
interaction, thought, expertise, and information exchange. Parameters in the template are
as follows:
• Column 1—Describe the System: The system is described to limit the scope of the risk assess-
ment. The system is often described using the 5M Model:
– Mission: the specific airport activity (e.g., taxiway B reconstruction)
– Man: the personnel involved with the activity (e.g., construction workers and airport
engineering and operations staff)
– Machine: the equipment involved (e.g., trucks, pavers, and compactors)
– Media or environMent: the environment including physical areas and ambient conditions
(e.g., taxiway B between taxiways J and N and haul routes)
– Management: organization, procedures, regulations, advisory material (e.g., FAA ACs)
• Column 2—Identify Hazards: Multiple hazards may be associated with the evaluated system.
For example, a construction project may involve hazards such as FOD and movement of haul
trucks in airfield areas. Letters may be used to identify each hazard.
• Column 3—Analyze Outcomes: Each hazard listed in Column 2 may be associated with one or
more outcome(s) (e.g., FOD may cause damage to aircraft if ingested by the engine, or it may
cause injuries to construction workers due to jet blast). Using the hazard letter and a number
will help maintain the organization of the template (e.g., Effect B2 is the second outcome
associated with hazard B).

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   145  

• Column 3a—Identify Existing Controls: This column is used to identify existing controls. It is
important to consider these controls before assessing the level of risk and developing other
mitigation actions. SOP, ACs, safety plans, and regular inspections are examples of existing
controls (e.g., FOD control plan for a construction project).
• Column 4—Assess Level of Risk: In this column, the level of risk with the existing controls is
estimated and recorded. In most cases, a risk matrix will be used to estimate the risk. Initially,
the user will estimate the worst credible outcome or risk and then the likelihood of that out-
come occurring. Usually, an alphanumeric code (a letter for likelihood and a number for
severity) will be assigned to identify the level of risk. It is helpful to use a background color to
identify if the risk is low (green), medium (yellow), or high (red). The colors allow for quick
identification of higher risks. For example, if using the FAA risk matrix, a RAC 2C represents
a risk of hazardous severity (2) and remote probability (C). A 2C risk level is assumed to be
a High risk (Red). If colors are not used, the risk may be described as 2C-High to ensure the
correct characterization.
• Column 5—Mitigation Actions: Any risk classified as a high level of risk must be mitigated
and cannot be accepted. Any medium risk level may be accepted, but should be controlled
with mitigation actions to the degree possible, given the airport resources. Each risk may
have one or more mitigation/control actions to reduce the risk to an acceptable level. An
airport experiencing high frequency of FOD on the runway may reduce the risk of accidents
by taking additional measures (e.g., increasing frequency of repairs and removal of the
debris with sweeper trucks or planning runway rehabilitation and increasing the frequency
of inspections).
• Column 5a—Reassess Level of Risk with Mitigation Actions in Place: This column is similar to
Column 5; however, the new control actions are considered to estimate the new level of risk
when all mitigation actions are in place. An example using this template is presented in the
guidebook.

D-6  Hazard Tables

Sound documentation of processes and procedures is vital to both the success of the SRA
and the proper implementation of follow-on actions. To track the SRA process effectively, a
Hazard Table was used during several SRA at Pilot Study airports. The tables capture the results
from the SRA. The SRA report documents why changes and/or decisions were made (i.e., why
the remaining risk may have decreased in priority from the risk assessment). The hazard tables
should capture the following information:
• Hazards
• Outcome (NOTE: during the pilot studies, several airports used the term Risk)
• Severity
• Likelihood
• Risk assessment (high, medium, or low) for each risk
• Mitigations
• Residual risk (high, medium, or low)
The hazardous condition within the context of the overall system is listed first. Then the
outcome of that hazardous condition is listed (note: many airports that participated in the SMS
Pilot Studies and those that have developed SMS on their own used the terms “risk” or “conse-
quence” instead of outcome.) An outcome is a possible occurrence resulting from the hazardous
condition. Risk is the combination of severity and likelihood.
Tables D-12 through D-14 present examples of Hazard tables.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

146   A Guidebook for Safety Risk Management for Airports

Table D-12.   (Example) Hazard table from large & medium-hub airports.

Risk Assessment
Result (Risk Remaining
# Hazard Outcome Severity Likelihood Level) Mitigation(s) Risk
1 Men and 1. Aircraft 1. Hazardous 1. Remote 1. M17 1. Marked and lighted 1. M16
equipment and vehicle 2. Hazardous 2. Extremely 2. M16 equipment 2. M16
working in accident Remote 2. Reflective vests on all
Taxiway N 2. Aircraft personnel in area
safety area and 3. FAA ATC ground radios
pedestrian in vehicles and actively
accident monitored
4. Airport Ops personnel
bi hourly inspections and
actively monitoring radio
traffic.
2 XXXX 1. 1. 1. 1. 1. 1.
2. 2. 2. 2. 2. 2.

In Table D-12, the hazards are numbered. There can, and most likely will, be multiple effects
associated with each hazardous condition. In this table each risk is tracked through the risk
assessment process, mitigations are considered which may address multiple risks, and a risk reas-
sessment is conducted and documented to determine the residual level of risk post mitigation.
The RAC is highlighted to indicate the level of risk (in this case yellow, representing medium).
In most cases, mitigations decrease the likelihood of the risk, not the severity. Severity can be
reduced (e.g., wearing a helmet while riding a motorcycle).
In Table D-13, the smaller airport elected to provide the same level of information as provided
in Table D-12 by using fewer cells and combining the information often presented in multiple

Table D-13.   (Example) Hazard table from a non-hub airport.

Remaining
Hazard Outcome Risk Assessment Mitigation
Risk

1. Pedestrians on the Impact to Severity – Minor 1. The FBO provides designated walking paths. MEDIUM
airfield pedestrians personal injury 2. The FBO escorts all pedestrians to and from
GA.
3. The FBO and the XXXX maintain visual
Likelihood – contact with all pedestrians while they are
Probable on the airfield.
4. The FBO train all staff from other airports.
Medium Risk 5. The FBO maintains a list of between 5 and
10 employees from other airports. Only
those employees are allowed to work on
major event days.

2.

3.

Copyright National Academy of Sciences. All rights reserved.

 A Guidebook for Safety Risk Management for Airports
Copyright National Academy of Sciences. All rights reserved.

Table D-14.   Hazard table from a comparative risk assessment (FAA ATO).

Existing Recommended Predicted

Hazard System Control or Possible Severity Likelihood Initial/Current Safety Residual
Hazard Description Causes State Requirement Effect Rationale Rationale Risk Requirements Risk
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11)

11 Desc. 1 1 Cause #1 SS 1 EC #1 Eff. #1 SRat. #1 LRat. #1 4D Low RSR #1 4D – Low

Cause #2 SS 2 EC #2 Eff. #2 SRat. #2 LRat. #2 RSR #2

EC #3 LRat. #3 RSR #3

12 Desc. 1 2 … … … … … … … … …

21 Desc. 2 1 … … … … … … … … …

22 Desc. 2 2 … … … … … … … … …

23 Desc. 2 3 … … … … … … … … …

31 Desc. 3 1 … … … … … … … … …

41 Desc. 4 1 … … … … … … … … …
A Guidebook for Safety Risk Management for Airports

148   A Guidebook for Safety Risk Management for Airports

cells. This airport also elected to use color coding to provide a visual cue for the reader (yellow
representing a medium RAC).
In Table D-14, the CRA is used by the FAA ATO in tower siting studies and SRM panels for
proposed changes to the NAS. Table D-14 provides a more granular level of information than
Tables D-12 and D-13. This approach can mitigate causes and system state factors, thus chang-
ing the hazard condition rather than only mitigating the risks. An example of this: A hazardous
condition exists on a commercial aircraft ramp at night because it is dark. By simply lighting the
ramp with highmasted ramp lights, in accord with ACs, the hazardous condition has changed;
the hazard probability of the possible effect of a vehicle—aircraft accident occurring has been
lessened.

D-7  Mitigation Tables

The mitigation table serves as a means to document the mitigations for each individual
hazardous condition and its associated risks. The mitigation descriptions should explain what
will be done by whom and any deadlines associated with the actions. The template should include
a column to record the end date (if appropriate) for any mitigation. Tables D-15 through D-18
provide examples of mitigation tables used by pilot study airports.
Table D-15 is designed specifically for construction projects. Sample language is provided
in the respective columns. Because Table D-15 was developed for a construction project, the
users assumed the mitigation(s) will continue over the life of the project, so no end-dates
are assigned.
Table D-16 was used by multiple pilot study airports choosing to include a separate table in
their SRM Final Reports. This sample table includes some example language that was typical
for a specific airport. The Person Responsible column includes departments and organiza-
tions, rather than individuals, unless the mitigation involves contract matters. With only
one column provided for a proposed completion date, milestone dates were included there
as well.
Table D-17 comes from an overall comprehensive worksheet used to document hazards, risk
assessments, and mitigation plans. Each hazardous condition is documented on an individual
worksheet. The mitigation(s) are included as an individual section on the worksheet.
Table D-18 was used by multiple pilot study airports choosing to include a separate table in
their SRM Final Reports. This allowed the airports to use the table as a separate document, to
make assignments, work orders, and planning work load for staff.

D-8  Sample Final SRA Report Structure

Thoroughly documenting the SRM and SRA processes is critical to the success of an airport
SMS. SRM documentation provides historical data that can be used during future SRAs, holds
individuals accountable for required tasks, demonstrates SMS compliance when audits are
conducted, and demonstrates to airport staff and stakeholders that the SMS, SRM, and SRA
processes are part of the business at the airport.
The airport must have an acceptable and consistent means to document the process. The
report format should represent the business practices of the airport and ensure that the nec-
essary information is captured concisely. The following sections present three examples of
SRM reports for reference: D-9 Medium-Hub Airport, D-10 Small-Hub Airport, and D-11
Large-Hub Airport.

Copyright National Academy of Sciences. All rights reserved.

 A Guidebook for Safety Risk Management for Airports
Copyright National Academy of Sciences. All rights reserved.

Table D-15.   SRM example mitigation table (construction).

Hazard Planning &

Haz # Description Effect Risk Mitigating Actions Design Contractor Ops ATCT Other
(1) (2) (3) (4) (5) (6) (7) (8) (9)

Sweepers at construction site

Establish monitoring procedures by Ops

Establish notification procedures

FOD from
between contractor/operations/ATCT
construction Damage to
1
vehicles on aircraft
Use trained contractor escort to identify
taxiways
FOD and report to Ops

Use trained flagmen equipped with

brooms and shovels

Install rumble strips at hauling route

before pavement
 A Guidebook for Safety Risk Management for Airports
Table D-16.   SRM example mitigation table (pilot study airport).

# Mitigation Person Responsible Proposed Completion Date

1. Training: controllers, airfield XXX (airport) operations work with Plan complete by XXX, XXXX
Copyright National Academy of Sciences. All rights reserved.

personnel (GSE and Ops, flight ATCT…

crews (chief pilots) for… Begin familiarization by XXX, XXXX

2. Improve communications: XXX operations will address updating All to be completed and in place by XXX, XXXX
determine… publications
XXX operations will create diagram
and advertise at FBOs
XXX ATCT will assist with departure
card content and provide to XXX
operations

3. Facility: install Runway guard XXX planning and engineering Runway guard light investigation should be concluded with a report of results by XXX,
lights… departments will investigate… XXXX

4. System changes – Ground The XXX ATCT management will Form the working group by XXX, XXXX.
based radar… investigate the status of ground based
radar for XXX. Provide an interim report of findings by XXX, XXXX
XXX operations and XXX ATCT
management will form a working Make a recommendation for… XXX, XXXX
group to investigate if there’s any
benefit to pursuing video cameras and
camera analytics…

5. Add a brochure to foreign air Individuals named (due to contract Provide an interim report by XXX, XXXX
carriers… issues) will investigate the necessary
contents of a brochure and discuss
this issue with XXX property
department for inclusion in LOA.
A Guidebook for Safety Risk Management for Airports

SRM Templates   151  

Table D-17.   SRM example mitigation table (pilot study airport).

Action Plan Steps Milestone Date Responsible Person Completion Date

1.

2.

3.

4.

Table D-18.   SRM example mitigation table (pilot study airport).

Hazard # Mitigation Person Responsible Proposed Completion Date

1 (mitigations are numbered to Specific individuals are Includes any milestone dates.
correspond with the hazard, risk, named.
and mitigation table)

D-9  Example of SRA Report from a Medium-Hub Airport

Safety Risk Assessment #

Topic: Represent the Issue or System

Date: PHOTOS of Area Assessed

Presented by:

Authored by:

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

152   A Guidebook for Safety Risk Management for Airports

Table of Contents
NOTE: insert a table of contents here for the report as necessary.

Introduction
The introduction should include the reason (trigger) for the SRA, a brief description of what
is to be assessed, and who is taking the lead or sponsoring the SRA.
The introduction should also summarize the process that will be used. Because each airport
may have a slightly different way of working the SRA process, here is one example:
The SRA facilitation and subsequent documentation is based on the 5-Step Safety Risk Assessment
process plus a 6th step for monitoring. The six steps are
1. Define the System,
2. Identify the Hazards,
3. Analyze the Risk (Effect),
4. Assess the Risk (through use of a risk matrix),
5. Treat/mitigate the Risk,
6. Mitigation and Monitoring Plan, mitigating the risk also includes a monitoring plan that assigns
tasks, timelines, and responsibility for implementation and management.

Background
The background should include what led to the SRA. The background section should describe
the actions, reference regulations, and outline how the airport is authorized to conduct the SRA
(i.e., if the airport developed and implemented an SMS program and the SRM component of
that program requires an SRA to be conducted). The timeline for the SMS development and
implementation should be referenced. Any additional information pertinent to the SRA (e.g.,
any interaction between FAA ATCT and the airport staff that jointly identified this need) should
be noted.

Logistics
The logistics should include the date, time, location, and panel members and should briefly
mention responsibilities (e.g., facilitation, documentation, and results acceptance).Table D-X
provides an example.

Table X.  SRA #X participants.

SRA Panelists
Parcipants Role Represenng
1
2
3
4
5
6

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   153  

Define the System

This section should follow a known approach in order to ensure the system is accurately cap-
tured. This guidebook promotes the use of the “5M” model. An example of how to document
it is provided:

Overall System
In order to focus the discussion, the panel agreed to bound the system and discussion specifi-
cally to the issue that was identified . . . The system . . .
The panel employed the 5-M Model as a guide to define the system. The 5-M Model is:
1. Mission
2. Management
3. Machine
4. huMan
5. environMent
Following are examples of the 5-M Model:

Mission
  1.1.1 The airfield is intended to provide for the safe movement of aircraft on the ground and
during takeoff and landing.
a.  One or two sentence brief statement.

Management
 1.1.2 FAA ATCT SOPs
a. Describe what processes and procedures one of the stakeholders has that need to be
accounted for. Such as FAA ATCT procedures.
  1.1.3  The Airport’s Air Operations Area (AOA) Rules and Regulations
a. Describe what processes and procedures one of the stakeholders has that need to be
accounted for. Such as the Airport’s procedures.

Machine
 1.1.4 Aircraft
a. Describe what machines need to be accounted for. Use the number of them if it is
appropriate.
b.  Aircraft operations (example)
c.  Type of aircraft (example)
  1.1.5  Airport Maintenance and Operations Vehicles
a.  Vehicles (example)
 1.1.6 FAA Vehicles
a.  Vehicles: airport snow removal, fuelers, FAA tech ops (examples).
  1.1.7  Runways and Taxiways
a.  Runway XXX

huMan
  1.1.8  Airport Operations and Maintenance Personnel
a.  Operations Managers
b.  Break it down if needed

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

154   A Guidebook for Safety Risk Management for Airports

 1.1.9 Pilots
a.  Airlines (example)
1.1.10 FAA
a.  ATCT personnel (example)
b.  Tech ops personnel (example)
EnvironMent
1.1.11 Weather
a.  Note if the condition being assessed is contingent upon the weather
1.1.12  Time of Day
1.1.13  Time of Year
1.1.14 Other
a.  Terminal area (example)
b.  Parking garage (example)
c.  Public roads (example)

Identify the Hazards

The hazard identification process is essential to the overall SRA. This section should describe
the method used to identify the hazards and whether hazards are a result of a proposed change
or already exist in the system. This section should also explain any limitations or boundaries the
panel members chose to use. An example follows:
The Panel considered the information documented from the system description and focused on
the area of
1. Aircraft movement on the commercial ramp on the south side of Concourse A.
Refer to where the hazards are being captured (documented): Table XX provides the hazards,
risks, risks assessment, mitigations, and risk analysis results.

Risk Analysis and Assessment

This section should briefly describe what tool(s) were used to identify and quantify the risk
associated with the hazardous condition and should reference where and how they are docu-
mented. An example follows:
The Panel used Table X to guide and track the discussion through the risk assessment portion of
the SRA. The Consulting Team used a projector for Table X, thus allowing the Panel members to
track the process and discuss the language used in the documentation as the SRA progressed. The risk
matrix and definitions for Severity and Probability are attached in Appendix X.

Copyright National Academy of Sciences. All rights reserved.

 A Guidebook for Safety Risk Management for Airports
Table X.  Hazards, outcome (previously risks), risk assessment, mitigations, and residual risk table (example from a SMS pilot study airport).

# Hazard Outcome (previously Risk Assessment Residual Risk

Risk) Mitigation(s)
Severity Likelihood Result (if any)
1 1. Weather, 1. AC accident (AC to 1A – Asset – 1A – Extremely 1A = M 1 – Training controllers, airfield personnel (GSE vs. 1ª = M
Copyright National Academy of Sciences. All rights reserved.

visibility, AC, AC to V) Catastrophic Improbable 1B = M Operations), flight crews (chief pilots) for accuracy of 1B = M
human 2. Incursion 1B – People – 1B – Extremely 1C = M location reporting could include discussion with station 1C = M
accuracy, etc. 3. Deviation (Pilot or V) Catastrophic Improbable 2A = L manager’s level of awareness training. Situational 2ª = L
(including 4. Delay in operations 1C – Reputation – 1C – Extremely 3A = L awareness to be emphasized. Training focus on staff 3ª = L
erroneous Major Improbable 4A = M that are based at XXX. 4ª = L
information) 2A – Reputation –
Minor
2A Remote
3A – Extremely
D – Improved communications, add
information to Airport Facility Directory; no
3A – Reputation – Remote
ground radar available, add to Jeppesen chart
Minor 4A – Frequent
notes, airport 5010 form, in publications (in
4A – Reputation –
general) for safety notes. Advertise at FBOs.
Minor
Issue airport diagram for all pilots. Automatic
terminal information system (ATIS). Include
the communication in special event cards, i.e.
knee board cards/departure cards add
information on the specific area’s challenges.
D – Facility – install in pavement runway guard
lights. This mitigation requires further
investigation. Future planning consideration
for expansion of the Northeast side of airfield.
4 – System changes – Ground based radar, video
cameras, camera analytics.

5 – Existing mitigations – standalone FLM/CIC,

heightened awareness, team work emphasis, currently
developing scenarios for tower simulator, controller
training without visual aids (back turned). Emphasis in
On the Job Training (OJT). Training program addresses
the lack of visual aids and physical limitations without
electronic system support. Included in the
Indoctrination checklist.
A Guidebook for Safety Risk Management for Airports

156   A Guidebook for Safety Risk Management for Airports

Mitigation Plan
The mitigation action plan identifies the item to be investigated and/or deployed; the responsi-
ble party for implementing the investigation, documentation, reporting; and the completion date.

Table X.  Mitigation plan (example from a SMS pilot study airport).

# Mitigation Person Responsible Proposed

Completion Date
1. 1 – Training: controllers, airfield personnel (GSE and Ops, XXX operations work with Plan complete by
flight crews (chief pilots) for accuracy of location reporting ATCT management to April 1, 2012
could include discussion with station managers’ level of provide a briefing for those
awareness training. Situational awareness training focus personnel. Begin familiarization
on staff who are based at XXX by May 1, 2012
2.
3.
4.
5.

SRA Accepting Authority

This section documents who is accepting the results of the SRA. By accepting, they are accept-
ing the levels of risk identified and the mitigation plan.

Responsible Person Accepting

SRA Document Preparer
Residual Risk
Signature: Signature:

Title: Title:

Date: Date:

Signature:

Title:

Date:

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   157  

Example Appendix A—Airport Diagram

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

158   A Guidebook for Safety Risk Management for Airports

Example Appendix B—Photos (Document the condition)

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   159  

Example Appendix C—Draft Definitions of Severity and Likelihood,

and Risk Matrix
XXX Definitions for severity and likelihood.

Likelihood:
Frequently Occurs once every month or 5,600 commercial operaons or 336,000 enplanements
Probable Occurs once every year or 68,000 commercial operaons or 4,000,000 enplanements
Remote Occurs once every 5 years or 340,000 commercial operaons or 20,000,000 enplanements
Extremely Remote Occurs once every 10 years or 680,000 commercial operaons or 40,000,000 enplanements
Extremely Occurs once every 20 years or over 1,360,000 commercial operaons or 80,000,000
Improbable enplanements

Severity:
People Assets Environmental Reputaon
A spill or release that An event or a series
Loss of an aircra/or over
is not contained and of events resulng in
$1,000,000 dollars in
results in long term the community NOT
Catastrophic Fatality+ damage/or loss of crical
damage to the using XXX for an
system(s) for an extended
environment and fines extended period of
period of me
to the airport. me.
Damage to an aircra An event or a series
taking it out of service for of events resulng in
Severe Injury, an extended period of A reportable spill or the community
Hazardous requiring me/or damage in excess release that requires lessening the use of
hospitalizaon of $500,000/or disrupon migaon. XXX causing negave
of crical services for (annual) financial or
extended period of me operaonal impacts.
An event or a series
Damage to an aircra that
of events resulng in
Minor Injury is reparable/or damage A reportable spill or
the community
Major requiring medical to equipment or facility release that is
lessening the use of
treatment that is reparable within a contained.
XXX for a short period
short period of me.
of me.
An event or a series
Minor damage to an
Minor injury not A spill or release that of events resulng in
aircra, equipment, or
Minor requiring medical does not require a the community
facility not requiring it to
treatment report. quesoning the
be taken out of service
reliability of XXX.
No Safety Risk No injury No Damage No Impact No Impact

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

160   A Guidebook for Safety Risk Management for Airports

Example Risk Matrix

Severity

No Safety
Minor Major Hazardous Catastrophic
Risk

Frequently L5 M13 H20 H22 H25

Probable L4 M12 M15 H21 H24

Likelihood Remote L3 L8 M14 M17 H23

Extremely
L2 L7 L10 M16 M19
Remote

Extremely
L1 L6 L9 L11 M18
Improbable

Low Medium High

No Action Required Monitor, Determine if Risk can Must be Mitigated to a Medium Risk
be Mitigated to a Low Risk

Figure X.  Risk matrix.

D-10  Example of SRA Report for Small Hub Airport

1. Background
The XXX airport staff tows aircraft to and from a hangar and relocates aircraft following arrival to
ramp parking positions. Some aircraft are towed on the aircraft movement area which raised addi-
tional concerns in the review of the processes and procedures. In addition, the YYY Flight School
operates and maintains over 50 aircraft ranging from single engine trainers to twin engine aircraft.
The Flight School operates several hangars and tows aircraft across ramps and on a nearby taxiway
or in close presence to the taxiway. At times the tow routes cross the air carrier operations ramp
or in close proximity to it. Minor incidents/accidents have occurred in the past usually resulting in
minor damage to the aircraft in tow. A few incidents have resulted in the XXX airport insurance
premiums being increased. Causal factors vary from weather related events, training, equipment
issues, situational awareness and standard procedures. This SRA report summarizes the safety risk
management process conducted at XXX and presents the process, findings and recommendations.

2.  SRA Panel

The SRA process was conducted in two steps. A preliminary safety assessment meeting with
representatives from XXX airport management, Operations and FBO operations was step one.
Step two was the formal conduct of the SRA and convening of a panel. Before the SRA process

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   161  

was carried out, towing procedures and each step of aircraft towing and phases were discussed to
identify activities. This preliminary step assisted in facilitating the identification of hazards asso-
ciated with each step and activity. Following the initial meeting, the SRA panel proceeded with
additional analysis and prepared a draft report for review by the participants of the panel.
List of Participants: Name and affiliation of seven participants

3. References
• FAA AC 150/5200-37, Introduction to Safety Management Systems for Airport Operators
• FAA Order 5200.11, FAA Airports (ARP) Safety Management System
• XXX Safety Management System Manual (2008)
• ACRP Report 1—Safety Management Systems for Airports—Volume 2: Guidebook

4.  Safety Risk Management (SRM) Process

SRM Process
The risk assessment process conducted for this SRA was that presented in FAA AC 150/5200-37
and incorporated to XXX SMS Manual. The process consists of five steps, as follows:
Step 1—Describe the system
The first step in performing SRM is to describe the system under consideration. The system
description includes the functions, general physical characteristics and resources, and opera-
tions of the system.
Step 2—Identify hazards
Hazard identification is the act of identifying any condition with the potential of causing
injury to personnel, damage to equipment or structures, loss of material, or reduction of the
ability to perform a prescribed function.
Step 3—Determine the possible effect
This step is to identify the possible effect associated with each hazard listed in the previous
phase. One hazard may have one or more risks associated with it.
Step 4—Assess and analyze the risk
Risk assessment is the process which associates “hazards” with “risks.” The process involves
both estimating and classifying risks. The simplest way to estimate the risk associated with a
specific hazard is to ask the following two questions:
• What possible harm could the hazard present (the risks)?
• How likely is it that harm could occur (the likelihood)?

After estimating the risks and the likelihood, this information is used to classify risk according
to XXX Risk Matrix, which follows that presented by the FAA in Order 5200.11. Risk classifica-
tion is necessary to identify how serious is the risk and to define the priorities to treat these risks.
Step 5—Treat and monitor risk
Risk treatment alternatives should address the risk probability, the risk severity, or both.
More detailed information on these steps is described in ensuing sections of this report.

5.  Description of the System

The system includes the phases, steps, location and activities involved with towing aircraft,
the XXX airport FBO staff and Flight School for activities, related XXX Aircraft Tow Procedures

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

162   A Guidebook for Safety Risk Management for Airports

(see Attachments A and B). These include escorting, coordination, training and SOPs activities
performed by XXX staff and the Flight School staff. Towing operations usually take place in the
ramp area and inside the hangars of XXX airport.

6.  Activities, Major Hazards and Risks Assessment

The table below presents a summary of major hazards, associated effect and risk levels assessed.
In addition, the table contains the basic control actions to mitigate the risk levels assessed prior
to the control measures. The current risk levels were arrived at after assessing the risks for their
associated severity and probability. The treated risk levels were arrived at after mitigation actions
were taken into consideration.
Medium and low-risk levels are presented in the table; no high-level risks were identified by
XXX staff:

Current
Treated
Activity Hazards Effect (previously Risk) Risk Control Actions
Risk
Level
Work order Errors in work Damage to aircraft, injury to Recheck tow order data
verbal or written order persons, damage to facilities before initiating tow actions
containing and equipment
aircraft data, Low Low
location and
planned tow
route
Assign tow crew Inexperienced Damage to aircraft and injury Provide training
operator to persons, damage to
Fatigue facilities, and equipment Medium Low Promote awareness
Training
Awareness
Assign tow crew Insufficient crew Damage to aircraft, facilities Mandate at least 2 crew
staff and equipment, and injury to staff to each aircraft tow
Medium Low
Sense of persons by SOPs
urgency/pressure
Select tow Equipment Damage to aircraft Mark towing safety rules
equipment maintenance Injury to persons on tug
Obstructed
visibility Add to SOP’s, clean
Low Low windshield of tug
Improper tow bar
Mark tow bars with list
of aircraft that can be
towed
Select tow Obstructed Injury to persons Improve awareness
equipment visibility Medium Low Place safety/operating
checklist in tugs
Position tug and Careless driving Damage to aircraft, injury to Promote awareness
hook up Approach aircraft persons, damage to facilities Medium Low
too fast Review SOP

Tow aircraft Driving careless Damage to aircraft and Review SOP and training
facilities, injury to persons Medium Low

Turn limits Damage to aircraft and Review SOPs, clearances

exceeded facilities, injury to persons Low Low on ramp, no wing
overlaps

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   163  

Current
Treated
Activity Hazards Effect (previously Risk) Risk Control Actions
Risk
Level
Maneuver aircraft Hangar doors not Damage to aircraft and Already addressed by
in/out of hangar fully open facilities, injury to persons XXX, use reflective
Medium Low materials on hangar
doors and include
recheck in SOP
Multiple Damage to aircraft and Training and recurrent
command orders facilities, injury to persons Low Low
training
Lack of Damage to aircraft and Training and recurrent
conspicuity of facilities, injury to persons Medium Low training. SOPs
obstacles
Promote awareness
Park and secure Lack of visible Damage to aircraft and Medium Low Implement centerline
aircraft centerline marking facilities, injury to persons markings outside hangar

7.  Summary of Risk Mitigation Actions

This section includes a list of safety issues for this particular safety risk assessment that should
be addressed by the XXX staff and Flight School. The list of mitigation actions under the respon-
sibility of the XXX staff shall be addressed in the XXX Aircraft Tow Procedures and the Flight
School Safety Manual.

XXX List of Risk Control Actions

• Review SOP for towing aircraft
– Mandate at least two persons to towing of large aircraft, recommend two persons always for
all towing
– Evaluate fatigue conditions of crew due to weather events/other
– Address specific daily safety issues (hazardous situations, construction, etc.)
– Confirmation of aircraft tow work order information
– Develop incident reports to include causal factors
– Review procedures, training, recurrent training
– Tow route inspection prior to tow operations to check for obstacles and improve situational
awareness
– Explore development of standard tow routes for approach to and behind aircraft parking/
tie-down spots, other factors
– Reading/completing a checklist for towing safety rules posted in tug prior to each tow ­operation
• Plan to provide basic safety training to workers addressing:
– Awareness promotion
– Equipment inspections
– Obstructed visibility
– Escorting (for vehicle drivers)
– Communication and coordination with tow crews
– Driving and working in the AOA
– Obstruction clearance
• Review SOP to include hangar ingress/egress of aircraft
– Signage, markings and lighting
– Wing-walker procedures
– Communication and coordination procedures
– Reflective materials use as required

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

164   A Guidebook for Safety Risk Management for Airports

XXX FBO List of Risk Control Actions

• Comprehensive review of aircraft tow safety procedures prepared by XXX
• Coordination with ATC, Contractors, airlines, Tenants and XXX FBO services escorting,
ingress and egress procedures, airfield closures, marking and lighting, emergency routes
• Ensure coordination with ATC to identify aircraft towing/relocation in close proximity to
taxiway boundaries for each tow operation
• Ensure availability of effective communication measures
• Ensure XXX SOPs are followed
• Ensure tow crew is briefed and has clear instructions on tow route and steps
• Identify areas of jet blast potential tow route
• Ensure vehicles are properly marked/lighted inside the AOA

8. Attachments
• XXX Towing Procedures
• XXX FBO Towing Procedures
• Pictures of Accidents

D-11  Example of SRA Report for Large Airport

TABLE OF CONTENTS
1. Introduction
1.1 Background
1.2 Scope
2. Methodology
2.1 General
2.2  Workshop Participants
2.3  Bound the Discussion
2.4  Identify the Hazards
2.5  Determine the Risk
2.6  Assess and Analyze the Risk
2.7  Treat the Risk
3.  Description of the System
3.1  Systems Characteristics
3.2  Safety-Significant Activities
3.3 Dependencies
4. Results
4.1  Hazards, Risks and Risk Values
4.2  Mitigating Actions
5. Conclusions
5.1  Main Hazards
5.2  Risk Categories
5.3  Mitigation Actions
5.4  Risk Value
6. Recommendations
6.1  Further Mitigating Actions
6.2 Monitoring

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   165  

LIST OF FIGURES
Figure 1: Brainstorming Tool
Figure 2: Risk Matrix
Figure 3: XXX AOA and Deicing Pads
Figure 4: Risk Reduction

LIST OF TABLES
Table 1: SRA Panel Participants
Table 2: Likelihood Classification Criteria
Table 3: Severity Classification Criteria
Table 4: Safety-Significant Activities
Table 5: Safety-Significant Activities—Anchor Elements
Table 6: Hazards, Risks and Risk Values

Introduction
Background
The Federal Aviation Administration (FAA) is conducting a Part 139 Safety Management System
(SMS) Implementation Study. This study serves as a continuation of the Airport SMS Pilot Studies.
The intent of the current implementation study is to examine how airports can implement
the SMS pillars of safety risk management (SRM) and Safety Assurance throughout their airfield
environment including the aircraft movement and non-movement areas. The study will also
evaluate the validity of SMS documentation developed during the first pilot studies.

Scope
This report outlines the conduct of a safety risk assessment (SRA) that is part of the FAA Pilot
Study on SMS. The focus areas for this SRA are Winter Weather Operations and this risk assess-
ment was conducted to address only hazards in the aircraft movement and non-movement areas
of the airport as applicable.

Methodology
General
The approach followed for the execution of the risk assessment is in line with the phases of
SRM described in the FAA Advisory Circular: AC 150/5200-37—Introduction to Safety Manage-
ment Systems for Airport Operators, namely:
1. Describe the System
2. Identify the Hazards
3. Determine the Risk
4. Assess and Analyze the Risk
5. Treat the Risk (i.e. mitigate, monitor and track)
The execution of these phases was achieved by conducting some facilitated workshops held at
XXX. Participants in these workshops are provided in the following section.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

166   A Guidebook for Safety Risk Management for Airports

Table x.  Panel participants.

Name Position Organization

Name1 Facilitator Org1

Name 2 SME Org1

Name 3 Facilitation Assistant Org2

Name 4 XXX Operations

Name 5 XXX Operations

Name 6 XXX Engineering

Name 9 FAA FAA airports

Name 10 FAA XXX ATC

Name 7 Airline 1 Operations

Name 8 Airline 2 Safety

… … …

Workshop Participants
The individuals indicated in the table represented XXX Airport and other airport stake-
holders and provided SMEs support with respect to the risk assessment focus areas and SRA
facilitation.
During the workshops, members of the facilitation team guided the XXX stakeholders through
the SRM process described below and documented the SRA.

Bound the Discussion

This phase began with a documentation review by the facilitation team. This was done such
that the facilitation team became familiar with XXX operations as they relate to the risk assess-
ment focus area.
Once on site, the facilitation team asked XXX stakeholders to describe the system associated
with the risk assessment focus area in terms of their:
• Physical Characteristics
– e.g.: the physical layout and/or contents of the system (e.g. dimensions, proximity to roads,
taxiways or runways, structures, etc.)
• Functional Characteristics
– e.g.: what is the system used for and who are the users
• Environment
– e.g.: under which conditions are the activities within the system taking place (weather,
­operational environment, behavioral stressors)
These system characteristics allowed the facilitation team and XXX stakeholders to have a
common mental picture of the systems associated with the risk assessment focus area.
Based on this information, XXX stakeholders were then able to define the specific activities
that take place within the system. These activities are the safety-significant activities.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   167  

Identify the Hazards

Once XXX stakeholders had described the system, they were asked “what could go wrong?”
while performing each of the functions within the different safety-significant activity. Through
the conduct of this exercise, XXX stakeholders considered both the system physical and func-
tional characteristics as well as the environment under which they are performed.
This part of the exercise was guided through the use of anchor elements. The anchor elements
used were:

• People
• Equipment
• Materials
• Environment
• Procedures

For each of these elements the attributes specific to the system in question were used as a guide
(e.g. type of equipment used, personnel in the area, etc.).
Based on these “what could go wrong?” scenarios, the facilitation team and XXX stake­holders
were able to identify the conditions or situations that could create adverse safety risks to the
airport (i.e. hazard).
A brainstorming tool developed by the facilitation team was used to facilitate the identifica-
tion of hazards. This tool is provided below.

Figure X.  Brainstorming tool.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

168   A Guidebook for Safety Risk Management for Airports

Determine the Effect (previously Risk)

For each of the hazards identified for each “what could go wrong?” scenario, XXX stakeholders
were encouraged to identify the worst reasonable or credible outcome(s) that can occur within
the operational lifetime of the system (i.e. effect) for each hazard.
Hazards and risks were documented by the facilitation team to be assessed for severity and
probability to determine risk values.

Assess and Analyze the Risk

For each risk determined in the previous phase, XXX stakeholders defined the severity of
the stated risk, and then determined the likelihood or probability that each occurrence will
take place.
The assigned values were based on the classification criteria given below, which are based on
the FAA National Policy, Order 5200.11—FAA Airports (ARP) Safety Management System.
It should be noted that the facilitation team also included qualitative classification criteria
for likelihood to assist XXX stakeholders during this phase.

Table X.  Probability classification criteria.

FAA National Policy, Order 5200.11 Qualitative

Expected to occur more than once per week

Frequent
or every 2,500 departures, whichever occurs Expected to occur frequently for an item
A
sooner

Expected to occur about once every month

Probable Expected to occur several times in the life of an
or 250,000 departures, whichever occurs
B item
sooner

Expected to occur about once every year or

Remote Expected to occur sometime in the life cycle of
2.5 million departures, whichever occurs
C an item
sooner

Extremely Expected to occur about once every 10 100

Unlikely but possible to occur in an item’s life
Remote years or 25 million departures, whichever
cycle
D occurs sooner

Extremely
So unlikely, it can be assumed that it will not
Improbable Expected to occur less than every 100 years
occur in an item’s life cycle
E

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   169  

Table X.  Severity classification criteria.

Minimal Minor Major Hazardous Catastrophic

5 4 3 2 1

No damage to Minimal damage Major damage to Severe damage to Complete loss of

aircraft but to aircraft; or aircraft and/or injury aircraft and/or aircraft and/or
minimal injury or Minimal injury to to passenger(s)/ serious injury to facilities or fatal
discomfort of passengers; or worker(s); or passenger(s)/ injury to
little risk to Minimal Major unplanned worker(s); or passenger(s)
passenger(s) unplanned airport disruption to airport Complete /worker(s); or
/workers operations operations; or unplanned airport Complete
limitations (i.e. Serious incident; or closure; or unplanned airport
taxiway closure); Deduction on the Major unplanned closure and
or airport’s ability to deal operations destruction of
Minor incident with adverse limitations (i.e. critical facilities; or
involving the use conditions runway closure); or Airport facilities
of airport Major airport and equipment
emergency damage to destroyed
procedures equipment and
facilities

Following the assignment of likelihood and severity values, each risk was assigned a value
based on the risk matrix given in FAA National Policy, Order 5200.11—FAA Airports (ARP)
Safety Management System.

*Unacceptable with Single Point and/or Common Cause Failures

Figure X.  Risk matrix.

Treat the Risk

Upon completion of the assignment of risk values, XXX stakeholders were able to assign miti-
gation actions based on the following criteria:
• High Risk (Red)
– Unacceptable, mitigating actions required

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

170   A Guidebook for Safety Risk Management for Airports

• Medium Risk (Yellow)

– Medium Risk can be classified in the following three (3) ways:
� Unacceptable due to the absence of risk control, mitigating actions required;

� Unacceptable in the presence of existing risk control, mitigating actions required; or

� Acceptable in the presence of existing risk controls.

• Low Risk (Green)

– Acceptable
Therefore, following these criteria, XXX stakeholders suggested mitigating actions for all
high-risk values as well as any medium risk values that were deemed to warrant them.
Following the assignment of mitigating actions, XXX stakeholders derived new values of
severity and likelihood for the risk with these mitigating actions in place following the process
described in previous sections. These revised risk values were then evaluated for the assignment
of mitigating actions following the process described above. If a revised risk value was deemed by
XXX stakeholders as requiring further mitigation, actions would be assigned with the risk value
being revised once more. XXX stakeholders would repeat this process as long as the risk value
was determined to be unacceptable.
In certain cases, XXX stakeholders suggested further actions for risks that were deemed accept-
able. These suggestions were documented by the facilitation team and included in the final report
for completeness. However, these suggestions were not subject to a further derivation of risk value
and should be considered actions to be taken as part of continuous improvement efforts.

Description of the System

Systems Characteristics
The system involved with the analysis of winter weather operations at XXX involves several
areas, facilities, equipment and activities that take place within the XXX AOA.

Physical Description
Both XXX aircraft movement and non-movement areas are affected by winter weather opera-
tions. It may involve any runway(s), taxiway(s) and ramp(s) where aircraft can be de-iced and
where airfield areas require to be cleaned or treated for winter surface contaminants (e.g. snow, ice,
slush). The following are the main categories associated with winter weather operations at XXX:
• Airfield operational areas
• Snow removal and deicing equipment staging areas
• Storage of surface treatment material

Figure X.  XXX AOA and deicing pads.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   171  

Functional Description
There are several activities that are associated with winter weather operations at XXX, includ-
ing the following categories:
• Aircraft inspection and deicing operations
• Snow and ice removal
• Treatment of airfield areas contaminated with ice/snow
• Airfield condition assessment
• ...
These functions are managed and performed by specific groups of XXX staff and stakeholders,
including the following:
• Snow and Ice Control Committee (XXX staff, tenants, and FAA ATC collaboration) convened
at the beginning of winter weather season in October then whenever a winter weather emer-
gency is declared for XXX Airport with continuing communications as needed
• XXX Operations Department
– Airfield Operations
– SMS Coordinator
– AOC
• Asset Management
• . . .

Environment
Operational
During winter weather operations several organizations and XXX staff will be performing
duties in the AOA specifically related to winter weather operations and will be transiting with
various vehicles and equipment.
During special inspections and aircraft deicing operations there will be personnel on foot
performing activities in certain areas where aircraft and vehicles may also be present.

Weather
Low temperatures and frozen precipitation are likely conditions during operations with ­winter
weather conditions. The airport area is susceptible to snow and icing conditions, typically from
November through March.
Wind
The prevailing winds at XXX are from the south and they average 5 to 10 mph. However,
quadrant changes and gusts of 50 mph and above are not uncommon.
Snow
Accumulation with an annual average of 43 inches.
Ice
From October to April it can be expected that temperatures fall below 32°F and ice is encountered.

Behavioral Influences
The following key stressors, which could negatively influence human performance, are pos-
sible within the environment of the working area:
Psychological Stressors
Restricted operations under hazardous conditions for aircraft, vehicles and people create an
environment prone to many psychological stressors.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

172   A Guidebook for Safety Risk Management for Airports

Physical Stressors
Very low temperatures, frozen contaminants, deicing fluids and poor visibility will also influ-
ence the working environment.
Physiological Stressors
Early shifts, night shifts, weekend shifts, changing working hours, long working hours, very
intensive work conditions.

Safety-Significant Activities
Once a description of the system to be assessed was achieved, the hazard identification
­process was started. As described in the methodology section earlier, the hazards are identi-
fied from safety-significant activities, which are derived by the SMEs from the system char-
acteristics above. In this analysis, the SMEs were participants of the workshops held at XXX
airport.
The following list is the summary of the key safety-significant activities identified by the SMEs:

Table X.  Safety-significant activities.

SAFETY SIGNIFICANT ACTIVITIES – XXX SRA Winter Weather Ops

Mobilization of essential personnel Snow and ice removal and control
Aircraft deicing Management of ASDE X situational
Airfield anti icing, deicing or sanding displays
operations Staff training
Aircraft towing Driving on the AOA
Aircraft taxi Operation of equipment on the AOA
Aircraft marshalling Snow removal
Passenger boarding bridge operation Emergency response
Passenger handling Aircraft incident response
… …

Dependencies
During the brainstorming sessions, participants were reminded of the following anchor
elements:

Table X.  Safety-significant activities—

anchor elements.

SAFETY SIGNIFICANT ACTIVITIES ANCHOR ELEMENTS

PERSONNEL
EQUIPMENT
MATERIALS
ENVIRONMENT
PROCEDURES

Based on these anchor elements, participants were able to generate some system dependen-
cies to consider during the hazard identification process. A sample of some of the dependencies
identified can be found in the sections below.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   173  

Personnel
Presence of
• XXX staff that is unfamiliar with the Aircraft Movement Area (AMA) and FAA ATC
coordination
• Airline personnel operating deicing equipment that has limited experience working in
the AOA
• . . .

Types of personnel in the area:

• Airline staff
• XXX Asset Management staff (snow/ice removal)
• XXX ARFF staff
• XXX Airfield Operations staff
• Others

Equipment
Aircraft
• Propeller/Turbine
• Low profile turbine
• Others

Vehicles/Equipment
• Aircraft deicing equipment
• Snow/ice removal and control equipment
• Airfield operations vehicles
• Others
Operational
• Push/tow tractors
• Baggage tractors
• Others

Service vehicles
• Fuel trucks
• Catering trucks
• Maintenance vehicles
• Others
Service Equipment
• Baggage carts
• Cargo dollies
• ULDs
• Others
Other
• Radios
• Telecommunications equipment
• Others

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

174   A Guidebook for Safety Risk Management for Airports

Procedures
• Procedures associated with the safety-significant activities

Materials
• Snow and ice
• Water
• Type I deicing fluid
• Type II deicing fluid
• Type IV deicing fluid
• Sand
• Others

Environment
• Open Area
• Snow
• Ice
• Wind

Results
Hazards, Risks and Risk Values
The following is a summary of the Hazards, Effect (previously Risks), Risk Severities (S) and
Probabilities (P) and Risk Values (V) identified during the workshops. Risk Values are given as
High (H) in red; Medium (M) in yellow; and Low (L) in green. These risk levels are associated
with the risk matrix presented in XXX SMS Manual.
The list is sorted in descending order from the highest to the lowest risk value.

Table X.  Hazards, outcome and risk values.

# Hazard Outcome (previously Risk) P S R

1. Inaccurate runway assessment Takeoff and landing overruns under hazardous conditions
measurements leading to runway excursions and aircraft damage/passenger D 1 H
injury
2. Runway snow removal covering only Lateral deviations during landing and takeoff and snow
central portion of runway width windrows causing asymmetric drag on landing gears and C 2 H
potential lateral runway excursions
3. … …
… … H

4. Air crew unfamiliarity with deicing pad Aircraft to aircraft or deicing equipment collision
E 1 M
layout/operations
5. Miscommunication during emergency Delay in response to an emergency resulting in personnel or
call due to equipment failure passenger fatality E 1 M

6. … … … … M
7. Non standardized training program Shortcomings on the delivery of existing training leading to
E 2 L
equipment failure and damage or personnel injury
8. Improper training for winter operation Equipment damage/personnel injury
D 3 L
equipment
9. ... … … … L

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   175  

Mitigating Actions
Once the risk values were determined, a second evaluation took place in light of the mitigating
actions associated with the winter weather operations at XXX and other actions XXX will put in
place to control the identified risks.
The following table provides a summary of the information derived for each hazard, associ-
ated risk and mitigating actions used to reduce the risk value. The information is presented in
the following format:

# Hazard Identified Hazard

Effect Possible Effect associated with the Identified Hazard
Risk Value This section provides the severity, probability and value of the Identified Risk. The field is colored
to reflect the color scheme set up in the matrix used for this exercise.
Mitigating actions This section identifies the Policies, Programs and other measures that XXX already has in place
that contribute to the control of the Risk identified.
Residual Risk Value This section provides the severity, probability and value of the Identified Risk revised in light of
the mitigating actions. The field is colored to reflect the color scheme set up in the matrix used
for this exercise.
Recommended This section provides, when applicable, further actions that could be implemented by XXX to
further mitigating further control the risk and reduced its value.
actions

Considerations
In some instances, despite the existence of mitigating actions, the risk value presented remains
unchanged. This is because the granularity of the matrix suggested by the FAA does not allow
for capturing differences within each bracket. For example, if the probability of an identified
risk is that it may be expected to occur every 10 years, as per the matrix a probability “D” would
be assigned. If mitigating actions implemented are deemed to reduce this probability to occur
every 90 years, as per the matrix a value of “D” would remain, even though the probability has
been reduced ninefold.

1 Hazard Inaccurate runway assessment measurements

Effect Takeoff and landing overruns under hazardous conditions leading to runway excursions and aircraft damage/passenger
injury
Risk Value 1 D HIGH
Mitigating actions XXX training program Airlines internal training program
PIREPS Restrict ops after 3 consecutive PIREPs of poor runway
Snow & Ice Committee meetings friction conditions
Revised Risk Value 1 E MEDIUM
Recommended further
mitigating actions

2 Hazard Runway snow removal covering only central portion of runway width
Effect Lateral deviations during landing and takeoff and snow windrows causing asymmetric drag on landing gears and
potential lateral runway excursions
Risk Value 1 D HIGH
Mitigating actions PIREPS Airlines internal training program
Special inspections Snow & Ice Committee meetings
Revised Risk Value 1 E MEDIUM
Recommended further Increase snow removal capability to reduce probability of partial snow removal
mitigating actions

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

176   A Guidebook for Safety Risk Management for Airports

4 Hazard Air crew unfamiliarity with deicing pad layout/operations

Effect Aircraft to aircraft collision
Risk Value 1 E MEDIUM
Mitigating actions XXX Winter Weather Operations Manual XXX Non Movement Area Familiarization Manual
Airlines internal training programs
Revised Risk Value 1 E MEDIUM
Recommended further
mitigating actions

5 Hazard Miscommunication during emergency call due to equipment failure

Effect Delay in response to an emergency resulting in personnel or passenger fatality
Risk Value 1 E MEDIUM
Mitigating actions Asset management maintenance program Use of backup communication equipment (mobile
Asset management QA program phones)
Revised Risk Value 2 E LOW
Recommended further Establish need to use mobile phone for backup
mitigating actions

7 Hazard Non standardized training program

Effect Shortcomings on the delivery of existing training leading to equipment failure and damage or personnel injury
Risk Value 3 D LOW
Mitigating actions XXX departmental OJT Snow & Ice Committee meetings
Revised Risk Value 3 D LOW
Recommended further Develop standardized training program for winter weather operation conditions
mitigating actions

8 Hazard Improper training for winter operation equipment

Effect Equipment damage/personnel injury
Risk Value 3 D LOW
Mitigating actions XXX departmental OJT XXX Winter Weather Operations Manual
Revised Risk Value 3 D LOW
Recommended further Develop standardized training program (Curriculum, refreshers, etc.)
mitigating actions

Conclusions
Main Hazards
The key hazards identified in this analysis as a result of winter weather conditions at XXX can
be summarized as follows:
1. Potential runway excursions as result of the following hazards:
a. Low runway surface friction due to snow/ice accumulated due to partial snow/ice removal
or severe weather conditions surpassing XXX capability to remove winter contaminants
b. Inaccurate reporting of runway surface conditions
c. Inaccurate assessment of runway conditions
d. Partial removal of winter contaminants leaving snow banks, drifts or windrows leading to
differential drag of landing gear during aircraft operations
2. Loss of situational awareness due to working conditions
a. Pressure to maintain operational capacity
b. Exposure to low temperatures, winter precipitation, high noise and possible low visibility
and/or night conditions
c. Need to coordinate with operators of snow/ice control equipment
d. Fast paced and changing work environment
e. Non-routine working conditions
f. Obscured markings and lights making it harder to get oriented in the airfield
g. Increased communication traffic
h. High density of personnel, equipment and aircraft in operational areas (e.g. de-ice pads)

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

SRM Templates   177  

3. Limited airport capacity leading to:

a.  Traffic delays and pressure to maintain operational areas open
b.  Pressure to maintain aircraft deicing capacity
4. Non-routine operational conditions
a. Few winter weather events per year restrict staff from gaining more experience
b. Limited airport capability to handle very severe and unique winter weather conditions
c. Limited capability to provide standardized winter weather conditions training to personnel
d. Pilots unfamiliar with deicing pad layout/operations

Effect Categories
The major effects categories associated with winter weather operations at XXX can be sum-
marized as follows:
1. Runway excursion accidents (overruns and veer-offs) due to poor runway surface friction
conditions or asymmetric braking and drag
2. Runway incursion accidents due to loss of situational awareness
3. Aircraft/vehicle/equipment/personnel collisions due to loss of situational awareness under
winter weather conditions and limited experience of staff working under such conditions
4. . . .

Mitigation Actions
A series of mitigating actions have been identified to control risks associated with winter weather
operations at XXX. The key actions as they refer to the summary risks described above are:
Risk #1: Runway overruns and veer offs due to poor runway fricon condions resulng from winter
weather contaminants and leading to major accidents
Migaon Acons
XXX Winter Weather Operaons Manual
Snow & Ice Commiee meengs
XXX Movement Area Familiarizaon Manual
XXX Policy Radio Standards AO.006.00
XXX Policy Runway Crossing by Authorized Ground Vehicles
…

Risk #2: Runway incursion accidents due to loss of situaonal awareness

Migaon Acons
XXX Winter Weather Operaons Manual
Snow & Ice Commiee meengs
XXX Movement Area Familiarizaon Manual
XXX Surface Movement Guidance and Control System Plan
…

Risk #3: Aircra/vehicle/equipment/personnel collisions due to loss of situaonal awareness under

winter weather condions and limited experience of staff working under such condions
Migaon Acons
XXX Winter Weather Operaons Manual
Snow & Ice Commiee meengs
XXX Movement Area Familiarizaon Manual
XXX Surface Movement Guidance and Control System Plan
XXX Policy Authorized Ground Vehicle Access to AMA safety area
…

Risk #4: …
…

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

178   A Guidebook for Safety Risk Management for Airports

Risk Value
As result of applying the identified mitigating actions, and their effect on the risk values, the
following conclusions can be drawn:
1. There are no “unacceptable” (HIGH) risks
2. The overall risks associated with XXX winter weather operations can be effectively mitigated
using procedural measures developed by XXX and the airlines
3. Additional measures targeting specific risks can further reduce the probability and/or severity
of airside accidents during winter weather conditions. These measures are recommended in
the ensuing section of this report
4. Figure X summarizes the potential risk levels with and without mitigation actions adopted.
Significant improvements to safety associated with winter weather conditions at XXX can be
achieved with the actions presented in this SRA.

High, 0
100.0% High,
21 Medium
30
80.0%
Medium
21
60.0%

Low
40.0%
Low 59
47
20.0%

0.0%
Original With Mitigation Actions

Figure X.  Risk reduction.

Recommendations
Further Mitigating Actions
Many risk mitigating actions and procedures listed in previous sections were already imple-
mented by XXX. This section describes additional measures to further reduce risk levels when
winter weather conditions arise.
1. Upgrade snow removal equipment to increase XXX capacity
2. Retrofit radios to accommodate headsets plugs
3. Develop standardized training program for winter weather operations and provide refresher
training during the fall
4. . . .

Monitoring
It is recommended that XXX ensures that the actions are implemented and monitored for
effectiveness over an appropriate period. If monitoring reveals that any action is not effective,
new actions should be developed and implemented to maintain the identified risk at an accept-
able level.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX E

Preliminary Hazard Lists (PHLs)

Airfield Construction

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Airfield Operations
Haul routes crossing operational Collision with aircraft, Use “flagmen”; Escorts; Traffic control
areas vehicles, equipment and signals; Training; FAA AC for construction
ground personnel safety; Part 139; Construction Safety
Phasing Plan (CSPP); SOP
Temporary haul routes crossing rapid Collision between Use “flagmen”; Escorts; Traffic control
exit taxiways vehicles and aircraft signals; Training; FAA AC for construction
safety; Part 139; CSPP; SOW
FOD Debris causing damage to Wheel wash stations for construction
aircraft vehicles; training; use of sweepers and FOD
crews; CSPP; FAA AC; Part 139
Jet blast Flying Debris into Use “flagmen”; Escorts; Traffic control
aircraft, vehicle, or signals; Training; FAA AC for construction
workers safety; Part 139; Construction Safety Plan
(CSPP); SOP
Deficient communication Runway/taxiway Training; supervision; Part 139; FAA AC;
incursion CSPP; SOP
Deficient coordination between Collision with aircraft, Training; supervision; SOP; Part 139; CSPP
maintenance shifts/workers vehicles, equipment and
ground personnel;
runway/taxiway
incursion, FOD, obstacles
Construction Safety and Phasing Plan
(CSPP)
Changes to airfield operations Runway/taxiway Training; written distribution of changes and
incursion, collision, delay confirmation of receipt; Part 139; FAA AC;
responding to SOP; CSPP
emergencies
Construction worker job related Occupational accident Training; Part 139; FAA AC; SOP; CSPP; OSHA
processes, procedures, and tools Regulations; supervisory monitor

179  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

180   A Guidebook for Safety Risk Management for Airports

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Construction traffic crossing airfield Runway/taxiway Escorts; training; SOP; FAA AC; Part 139;
areas incursion; Collision; CSPP
Delay responding to
emergencies
Tall equipment Interference with Training; SOP; internal review process; Part
NAVAIDS or Part 77 139; FAA AC; CSPP
surfaces
Interaction between construction, Runway/taxiway SOP; training; daily shift construction safety
operations, maintenance, ARFF incursion, collision, delay meetings; Part 139;FAA AC; CSPP
activities responding to
emergencies
Unfamiliarity of construction workers Damage to NAVAIDS, Training; construction manager presence
with airfield activities runway/taxiway with workers; supervision by airport
incursions, damage to operations personnel; marked and lighted
aircraft areas; Part 139; CSPP; FAA AC; SOP
Unfamiliarity of construction drivers Runway/taxiway Training; escorts; marked and lighted areas;
with characteristics of airfield traffic incursion, collision Part 139; CSPP; FAA AC; SOP
ARFF unaware of changes to access Delay in emergency SOP; Part 139; CSPP; FAA AC; Operational
routes response briefings
Construction equipment breakdown Collision, interference Training; SOP; internal review process; CSPP;
with Part 77 surfaces FAA AC; Part 139
Coordination and Communication
Deficient coordination of construction Runway/taxiway SOP; training; daily shift construction safety
activities with other airport activities incursion, aircraft meetings; notification process; Part 139;
(air traffic, ramp management, collision, obstacles, CSPP; FAA AC
security, emergency, etc.) vehicle accident
Pilots unaware of airfield Runway/taxiway SOP; NOTAMs; ATIS recordings; notification
configuration changes, limitations incursion, aircraft to chief pilots’ offices, FBOs; timely
and construction areas collision, obstacles, publication change submittals to FAA and
vehicle accident, aircraft, Jeppesen chartings; Part 139; FAA AC; Air
equipment, people, Traffic Orders
injuries
Airport staff and construction Runway/taxiway SOP; training; daily shift construction safety
workers unaware of hazardous incursion, aircraft meetings; Part 139; FAA AC; CSPP
situations collision, obstacles,
vehicle accident, injuries
Radio failure Runway/taxiway SOP; training on Air Traffic Control light gun
incursion, aircraft signals; use of cell phones; escorts; CSPP;
collision, obstacles, FAA AC; Part 139
vehicle accident, injuries
Emergency Response
Failure to update ARFF of Delay in emergency SOP; Part 139; CSPP; FAA AC; daily shift
construction areas and temporary response briefings
access routes and closures
ARFF unaware of deactivated water Delay in emergency SOP; daily shift briefings; FAA AC; CSPP;
lines response Part 139
ARFF unaware of emergencies Delay in emergency SOP; daily shift briefings; FAA AC; CSPP;
associated with construction activities response Part 139

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   181  

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Security
Unauthorized access to airfield areas Runway/taxiway Continuous inspections of areas as possible;
incursion, surface guards at gates/open areas; use of radar or
incidents FLIR security and CCTV systems; CSPP; FAA
AC; Airport Security Plan; TSA Part 1542
Construction traffic outside defined Runway/taxiway Use of escorts; marked and lighted routes;
work area ingress/egress routes incursion, surface guards at ingress/ egress points; SOP; CSPP;
incidents FAA AC; Part 139
Failure of conspicuous identification Runway/taxiway Use of escorts; temporary ID badges and
of construction workers and incursion, surface temporary vehicle signage; Part 139; TSA
equipment incidents Part 1542; Airport Security Plan; onsite
supervisor; CSPP; FAA AC; SOP
Fences and Gates
Temporary opening in airfield fences Unauthorized access to Continuous inspections of areas as possible;
or gates due to construction activities AOA, runway/taxiway guards at open gates/areas; TSA Part 1542;
incursion, surface Part 139; CSPP; FAA AC; SOP
incident, wildlife strikes
Construction equipment outside Runway/taxiway Training; SOP; designated marked and
designated work areas incursion, surface lighted work areas; CSPP; FAA AC; Part 139;
incident escorts/construction managers on site
Haul Routes
Improper identification of temporary Runway/taxiway Escorts; training; SOP; CSPP; FAA AC; Part 139
access routes incursion, surface
incident
Barricades and fences blocking Runway/taxiway Safety inspections by airport and
driver’s vision of oncoming traffic incursion, surface construction management (CM); SOP;
incident training; escorts; Part 139; FAA AC; CSPP
Low visibility conditions Runway/taxiway SOP; PART 139; Surface Movement
incursion, surface Guidance Control System Plan(SMGCS); FAA
incident AC; training; use of escorts; FAA AC; CSPP;
Air Traffic Orders
FOD generated by construction traffic FOD damage to aircraft, SOP; CSPP; FAA AC; Part 139; FOD patrols;
construction equipment, sweepers; wheel wash stations
airport equipment
Haul routes crossing operational Runway/taxiway Escorts; training; SOP; FAA AC; Part 139;
areas incursion, surface CSPP; FAA AC; Air Traffic Orders; routes
incident marked and lighted
Deficient maintenance of haul routes FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols;
sweepers; wheel wash stations
Vehicles interfering with Part 77 Runway/taxiway Training; SOP; internal review process; CSPP;
surfaces incursion, surface FAA AC; Part 139
incident
Construction workers unaware of Emergency response SOP; daily shift briefings; FAA AC; CSPP;
ARFF right of way delays Part 139

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

182   A Guidebook for Safety Risk Management for Airports

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Driving
Vehicle and equipment operators Runway/taxiway Training; SOP; Part 139; CSPP; escorts; speed
who are unfamiliar with regulations incursion, collisions limit signs; vehicle speed regulators;
pertaining to vehicle operations on supervision monitoring FAA AC
the airfield
Escorting of construction equipment Runway/taxiway Training; SOP; Part 139; CSPP; speed limit
operators incursion, surface signs; vehicle speed regulators; FAA AC
incident
Driving under low visibility Runway/taxiway Training; SOP; Part 139; CSPP; FAA AC;
conditions incursion, surface Surface Movement Guidance Control System
incident Plan (SMGCS); escorts
Construction drivers unfamiliar with Runway/taxiway SOP; training; daily shift construction safety
airfield activities incursion, surface meetings; Part 139; FAA AC; CSPP; escorts;
incident marked and lighted work areas
Operating equipment and or vehicles Runway/taxiway SOP; training; daily shift construction safety
off of designated construction routes incursion, surface meetings; Part 139; FAA AC; CSPP; escorts;
incident, FOD marked and lighted work areas and routes
Backing dump trucks and other Occupational accident Backup walkers/flaggers; FAA AC; CSPP;
equipment Part 139
Deficient construction equipment Runway/taxiway SOP; training; daily shift construction safety
maintenance incursion, FOD meetings; Part 139; FAA AC; CSPP; escorts;
equipment shift inspections
Escorting
Failure to have “positive control” of Runway/taxiway SOP; training; daily shift construction safety
escorting procedures incursion, surface meetings; Part 139; FAA AC; CSPP; use of
incident more than one escort; handout of escort
route map on airfield and briefing of vehicles
being escorted
Low visibility conditions Runway/taxiway SOP; PART 139; SMGCS; FAA AC; training;
incursion, surface use of escorts; CSPP; Air Traffic Orders
incident
Deficient communication or training Runway/taxiway SOP; training; daily shift construction safety
of escorting procedures incursion, surface meetings; Part 139; FAA AC; CSPP; use of
incident more than one escort; handout of escort
route map on airfield and briefing to vehicle
operators being escorted
Earthmoving, Excavation, and Paving

Excavation close to utilities and Power and system FAA AC; CSPP; Part 139; excavation plan/
cables outages, collisions, SOP and onsite supervision; daily shift
runway/taxiway briefings; hand digging until utilities/cables
incursions and excursions located
Generation of debris to operational FOD damage SOP; FAA AC; CSPP; Part 139; training; FOD
areas patrols; sweepers; wheel wash stations

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   183  

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Deficient identification of Surface accident, aircraft SOP; FAA AC; CSPP; Part 139
construction areas collision
Failure to issue timely and accurate Runway/taxiway SOP’s; FAA AC; CSPP; Part 139; AIM
NOTAMs incursion, surface
incident
Low visibility conditions Runway/taxiway SOP; PART 139; SMGCS; FAA AC; training;
incursion, surface use of escorts; CSPP; Air Traffic Orders
incident
Stockpiling spoils/soil in/near Aircraft collision SOP; PART 139; FAA AC; training; use of
taxilane/taxiway/runway escorts; CSPP; Air Traffic Orders; Part 77;
safety/obstacle free areas/zones FAA AC
Staging equipment in/near taxiway Collisions between SOP; PART 139; FAA AC; training; use of
or runway safety areas equipment and aircraft escorts; CSPP; Air Traffic Orders; Part 77;
FAA AC
Out of service obstruction lights Collisions between Part 139; FAA AC; CSPP; safety inspections
equipment and aircraft
Deficient equipment maintenance Runway/taxiway SOP; training; daily shift construction safety
incursion, collision, meetings; Part 139; FAA AC; CSPP; escorts;
surface incident, FOD equipment shift inspections; a planned/
preventive maintenance program by the
contractor
Dust generated by construction Runway/taxiway SOP; CSPP; Part 139; contractor dust control
activities incursion, surface plan
incident, FOD
Equipment left unattended at night Collisions FAA AC; Part 139; Part 77; Air Traffic Orders;
CSPP; daily shift construction safety briefings
Deficient construction quality FOD damage SOP; training; daily shift construction safety
meetings; Part 139; FAA AC; CSPP; Quality
control plan
Collision, runway SOP; training; Part 139; CSPP; FAA AC
Disruption of weather reporting excursion, major system
services failure, flooding
Runway/taxiway Training; supervision; Part 139; FAA AC;
incursion, surface CSPP; Air Traffic Orders; SOP
Miscommunications incident
Training
Construction workers cannot Runway/taxiway Training; Part 139; FAA AC; CSPP; escorts;
understand English incursion, surface onsite supervision
incident
Construction workers in movement Runway/taxiway SOP; PART 139; SMGCS; FAA AC; training;
area without an understanding of incursion, surface use of escorts; CSPP; Air Traffic Orders
airport rules and regulations for incident
operations in the movement area

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

184   A Guidebook for Safety Risk Management for Airports

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Construction workers in movement Runway/taxiway SOP; PART 139; SMGCS; FAA AC;training;
areas incursion, surface use of escorts; CSPP; Air Traffic Orders
incident
Deficient communication between Runway/taxiway SOP; FAA AC; CSPP; Part 139; training
contractor and airport operations incursion, surface
incident
Deficient driver and escort training Runway/taxiway SOP; written and OJT testing; FAAAC;
incursion, surface Part 139; CSPP
incident
Lighting, Marking, Signage
Deficient marking, signaling and Collision, surface Part 139; CSPP; FAA AC; SOP; training
lighting of construction areas incident, runway/taxiway
incursion
Out of service obstruction lights Collision Part 139; CSPP; FAA AC; SOP; training
Incorrect use/installation of Collision, surface Part 139; CSPP; FAA AC; SOP; training
temporary marking and lighting incident, runway/taxiway
incursion
Power outage Runway/taxiway Part 139; CSPP; FAA AC; SOP; training
incursion, surface
incident, collision
Off Peak Construction
Failure to build temporary ramps Blown tires, broken Part 139; CSPP; FAA AC; SOP; training
when resurfacing runways landing gear
Deficient procedures to open closed Runway/taxiway Part 139; CSPP; FAA AC; SOP; training;
areas to operations incursion, collision supervision and monitoring
Temporary ramps not complying with Blown tires, broken Part 139; CSPP; FAA AC; SOP; training
FAA recommendations landing gear
Aircraft operations in opposite Blown tires, broken Part 139; CSPP; FAA AC; SOP; training; Air
direction of paving operations landing gear Traffic Orders
Stockpiling
Height and location of stockpiles Collision Part 129; Part 77; CSPP; FAA AC; SOP;
close to safety areas training
Generation of FOD FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols;
sweepers; wheel wash stations
Work in Safety Areas, Object Free
Areas (OFA), Object Free Zone (OFZ)
Height of equipment Collision Part 139; Part 77; CSPP; Air Traffic Orders;
FAA AC; SOP; training
Equipment breakdown Collision Part 139; CSPP; FAA AC

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   185  

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Deficient coordination with ATO Runway/taxiway Part 139; CSPP; SOP; FAA AC; Air Traffic
incursion, surface Orders; training
incident
FOD FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols;
sweepers; wheel wash stations

Loose maintenance tools and parts FOD damage SOP; CSPP; FAA AC; Part 139; FOD patrols;
escorts following vehicles
NAVAIDS
Construction workers unaware of Aircraft accident, NAVAID SOP; CSPP; Part 139; Part 77; Air Traffic
NAVAIDS restrictions damage Orders; training; onsite supervision; FAA AC
Proximity of construction vehicles to Aircraft accident, NAVAID SOP; CSPP; Part 139; Part 77; Air Traffic
NAVAIDS damage Orders; training; onsite supervision; FAA AC
Changes to airside aircraft traffic Runway/taxiway SOP, NOTAMs; Part 139; Air Traffic Orders;
patterns due to construction incursion, surface FAA AC; CSPP
incident, collision
Trash from Construction
Trash as wildlife attractants Wildlife strikes SOP, NOTAMs; Part 139; FAA AC; CSPP;
FOD/ trash patrols
Generation of FOD FOD damage SOP; CSPP; Part 139; FAA AC; FOD patrols
Wildlife Movement
Installation of temporary gates Wildlife strikes Guards; Part 139; Wildlife Hazard
Management Plan (WHMP); CSPP; FAA AC;
TSA Part 1542; SOP
Temporary removal of fences Wildlife strikes Guards; Part 139; WHMP; CSPP; FAAAC;
TSA Part 1542; SOP
Drainage
Construction debris obstructing FOD damage Part 139; CSPP; FAA AC; SOP
drainage systems
Excavation close to utilities and other Circuit light outages on FAA AC; CSPP; Part 139; excavation plan and
systems AOA onsite supervision; daily shift briefings;
hand digging until utility/cables located;
SOP
Flooding or ponding in movement FOD damage, closed CSPP; Part 139; FAA AC; SOP; sweepers on
areas areas resulting in delay in call
operations

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

186   A Guidebook for Safety Risk Management for Airports

Wildlife Hazards

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Birds
Landfill close to the airport Birdstrikes Local ordinances; Wildlife Hazard
Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP
Wastewater treatment facilities near Birdstrikes Local ordinances; Wildlife Hazard
the airport Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP
Wetlands, grasslands, wooded areas Wildlife strikes Local ordinances; Wildlife Hazard
at or near the airport Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP; FAA AC
Dredge spoil containment areas near Birdstrikes Local ordinances; Wildlife Hazard
the airport Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP; FAA AC
Development of favorable habitat Wildlife strikes Local ordinances; Wildlife Hazard
conditions for certain species Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP; FAA AC
Agricultural activities on and off Wildlife strikes Local ordinances; leases; Wildlife Hazard
airport Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP; FAA AC;
training; crop control and clean up after
harvest
Urban areas at or near the airport Wildlife strikes Local ordinances; leases; Wildlife Hazard
Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP; FAA AC
Construction and demolition (C&D) Wildlife strikes Local ordinances; leases; Wildlife Hazard
debris facilities at or near the airport Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP; FAA AC
Uncovered garbage cans and Wildlife strikes Local ordinances / Airport Rules &
dumpsters Regulations; leases; Wildlife Hazard
Management Plan (WHMP); local Letter of
Agreement; FAA AC; Part 139; SOP; FAA AC;
training
Construction workers leaving food in Wildlife strikes CSPP; FAA AC; Part 139; FOD patrols;
open areas training; daily shift briefings; SOP
High grass Wildlife strikes SOP’s; Part 139; Wildlife Hazard
Management Plan (WHMP); FAA AC; SOP
Low grass Wildlife strikes SOP; Part 139; Wildlife Hazard Management
Plan (WHMP); FAA AC
Grass type attracts certain species Wildlife strikes SOP; Part 139; Wildlife Hazard Management
of wildlife Plan (WHMP); airport design standards;
FAA AC
Type of vegetation attracts certain Wildlife strikes SOP; Part 139; Wildlife Hazard Management
species of wildlife Plan (WHMP); airport design standards;
FAA AC
Earthworm presence in airfield areas Birdstrikes SOP; Part 139; Wildlife Hazard Management
Plan (WHMP); FAA AC
Nesting on or near the airport, areas Wildlife strikes SOP; Part 139; local ordinances; Federal laws
that allow for ease of roosting and regulations; FAA AC
animals
Delay removing dead animals Wildlife strikes, disease Local Letter of Agreement with USDA/ SPCA
animal control; training; Wildlife Hazard
Management Plan (WHMP); Part 139; FAA
AC; SOP

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   187  

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Migratory season for certain species Birdstrikes SOP; Part 139; local ordinances; Federal laws
and regulations; FAA AC; training; Wildlife
Hazard Management Plan (WHMP);
NOTAMs; ATIS
Feeding of wildlife Wildlife strikes SOP; Part 139; local ordinances; FAA AC;
training; Wildlife Hazard Management Plan
(WHMP)
Flocks of birds frequently seen in Birdstrikes SOP; Part 139; local ordinances; FAA AC;
airfield areas training; Wildlife Hazard Management Plan
(WHMP); NOTAMs; ATIS
Large species (raptor birds, deer, wild Wildlife strikes SOP; Part 139; local ordinances; FAA AC;
boars, etc.) frequently seen in airfield training; Wildlife Hazard Management Plan
areas (WHMP)
Approaching season of high Birdstrikes SOP; Part 139; local ordinances; FAA AC;
frequency for certain bird species training; Wildlife Hazard Management Plan
(WHMP); NOTAMs
Presence of rodents (food) attracting Birdstrikes SOP; Part 139; local ordinances; FAA AC;
birds of prey training; Wildlife Hazard Management Plan
(WHMP); grass height; vegetation control
Golf courses near the airport Birdstrikes Local Letter of Agreement; training; Wildlife
Hazard Management Plan (WHMP); Part
139; FAA AC; SOP
Livestock production operations near Birdstrikes Local Letter of Agreement; local ordinance;
the airport training; Wildlife Hazard Management Plan
(WHMP); Part 139; FAA AC; SOP; NOTAMs
Open aquaculture operations Wildlife strikes Local Letter of Agreement; local ordinance;
training; Wildlife Hazard Management Plan
(WHMP); Part 139; FAA AC; SOP; NOTAMs
High frequency of most hazardous Birdstrikes SOP’s; Part 139; FAA AC; Wildlife Hazard
birds to aircraft: vultures, geese, Management Plan (WHMP); training;
cormorants/pelicans, cranes, eagles, depredation; SOP; NOTAMs
ducks, osprey, turkey/pheasants,
herons, hawks, gulls, rock pigeons
and owls
Other Wildlife
Low fences Wildlife strikes Airport design standards; training; Wildlife
Hazard Management Plan (WHMP); Part 139;
FAA AC; SOP
Type of fence does not restrain Wildlife strikes Airport design standards; training; Wildlife
wildlife from entering airfield Hazard Management Plan (WHMP); Part 139;
FAA AC; SOP
Topography and vegetation allow Wildlife strikes Airport design standards; training; Wildlife
wildlife to enter airfield areas Hazard Management Plan (WHMP); Part 139;
FAA AC; SOP
Culverts without grids Wildlife strikes Airport design standards; training; Wildlife
Hazard Management Plan (WHMP); Part 139;
FAA AC; SOP
Presence of most hazardous Wildlife strikes Airport design standards; training; Wildlife
mammals to aircraft: deer, coyote Hazard Management Plan (WHMP); Part 139;
FAA AC; SOP; catch and relocate release
program; depredation

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

188   A Guidebook for Safety Risk Management for Airports

Foreign Object Debris

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Pavements and Safety Areas
Surface cracking with generation FOD damage SOP; FAA AC; Pavement Management
of lose fragments, chips Program (PMS); Part 139; training;
sweepers; FOD patrols
Raveling of pavement surface FOD damage SOP; FAA AC; Pavement Management
with generation of lose Program (PMS); Part 139; training;
aggregates sweepers; FOD patrols
Loose dirt blown by aircraft FOD damage, injuries SOP; FAA AC; Part 139; training; sweepers;
engines FOD patrols; special inspections
Loose material from freshly FOD damage SOP; FAA AC; Part 139; training; sweepers;
mowed areas FOD patrols; escorts; special inspections
Proximity of helipads to unpaved FOD damage SOP; FAA AC; Part 139; training; sweepers;
areas FOD patrols
FOD generated by construction FOD damage SOP; FAA AC; CSSP; Part 139; training;
activities sweepers; FOD patrols
Weathering during freeze thaw FOD damage SOP; FAA AC; Pavement Management
cycles Program (PMS); Part 139; training;
sweepers; FOD patrols
Loose rubber joint materials FOD damage SOP; FAA AC; Pavement Management
Program (PMS); Part 139; training;
sweepers; FOD patrols
Maintenance
Tools and parts left after FOD damage SOP; FAA AC; FOD patrols; training; special
maintenance operations inspections
Open garbage cans or dumpsters FOD, wildlife strikes SOP; FAA AC; FOD patrols; training; Wildlife
Hazard Management Plan (WHMP)

Personnel
Trash in open areas FOD, wildlife strikes SOP; FAA AC; FOD patrols; training; Wildlife
Hazard Management Plan (WHMP); Part 139
Trays, bags and trash from FOD, wildlife strikes SOP; FAA AC; FOD patrols; training; Wildlife
catering services Hazard Management Plan (WHMP); Part 139
Loose flight line items (wheel FOD damage SOP; FAA AC; FOD patrols; training; Part 139
chalks, badges, pens, tags, etc.)
Other
Loose branches and vegetation FOD damage SOP; FAA AC; FOD patrols; training; Part 139
Rain water and drainage FOD damage SOP; FAA AC; FOD patrols; training; Part 139
streaming mud, pebbles and
other debris
Pieces of aircraft tires or parts FOD damage SOP; FAA AC; FOD patrols; training; Part 139;
NOTAM’s
Winter contaminants (snow, ice) FOD, runway excursion, SOP; FAA AC; FOD patrols; training; Part 139;
surface accident Environmental regulations; Snow Plan for
aircraft deicing; NOTAMs

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   189  

Airfield Configuration

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Hotspots
Complex airfield configuration Runway/taxiway incursion Hotspots map; Letter of Agreement with Air
and intersections Traffic; MOS special lighting; signage,
markings; Runway Safety Action Team
(RSAT) team recommendations; Air Traffic
Orders; NOTAMs; training; SOP; FAAAC;
ATIS; Part 139
Nearness of taxiway Runway/taxiway incursion Hotspots map; Letter of Agreement with Air
intersections to runway Traffic; MOS special lighting; signage,
thresholds markings; Runway Safety Action Team
(RSAT) team recommendations; Air Traffic
Orders; NOTAMs; training; SOP; FAAAC
Part 139
Joint use of runway as taxiway Runway/taxiway incursion, Hotspots map; Letter of Agreement with Air
surface accident Traffic; special lighting; signage, markings;
Runway Safety Action Team (RSAT) team; Air
Traffic Orders; NOTAMs; FAA and Jeppesen
charting; training
Environment
Deficient weather conditions Runway/taxiway incursion, SOP; FAA AC; Air Traffic Orders; training;
surface accident escorts; Part 139; halting all AOA
construction; Letter of Agreement
Low visibility Runway/taxiway incursion, Surface Movement Guidance Control Plan
surface accident (SMGCS); SOP; FAA AC; Air Traffic Orders;
training; escorts; Part 139; halting all AOA
construction; Letter of Agreement
Nighttime conditions Runway/taxiway incursion, SOP; FAA AC; Part 139; Letter of Agreement;
surface accident training
Other

Construction and temporary Runway/taxiway incursion, CSSP; Part 139; ATIS; NOTAM’s; training; Air
markings, signs and lighting surface accident, collision Traffic Orders; Letter of Agreement; FAA AC;
SOP
Deficient airfield driver training Runway/taxiway incursion, Part 139 recurrent driver training;
surface accident, collision Airport/City policies on punishment; FAA AC;
SOP
Deficient taxi route planning Runway/taxiway incursion Part 139; Air Traffic Orders; Letter of
Agreement; ATIS; NOTAMs; “standard taxi
routes” chart publishing; signage, lighting,
marking; FAA AC; SOP
Temporary closures, Runway/taxiway incursion, Part 139; Air Traffic Orders; Letter of
construction, and changes in surface accident, collision Agreement; ATIS; NOTAMs; “standard taxi
status of NAVAIDS routes” chart publishing; signage, lighting,
marking; CSPP; training; maps provided to
airport departments, construction crews and
airlines, FBOs and pilots; FAA AC; SOP

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

190   A Guidebook for Safety Risk Management for Airports

Winter Operations

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Airfield Operations
Snow removal ops in airfield areas Runway/taxiway incursion, Part 139; Air Traffic Orders; Letter of
runway excursion, surface Agreement; ATIS; NOTAMs; training; FAA AC;
accident SOP; escorts; Snow Plan
Adverse weather elements and Runway/taxiway incursion, Part 139; Air Traffic Orders; Letter of
extended shifts surface accident Agreement; ATIS; NOTAMs; training; FAA AC;
SOP; escorts
Slippery pavement conditions Runway excursion, surface Part 139; Air Traffic Orders; Letter of
accident Agreement; ATIS; NOTAM’s; training; FAA AC;
SOP; escorts; treat or close areas
Radio failure Runway/taxiway incursion, SOP; training on Air Traffic Control light gun
surface accident signals; use of cell phones; escorts; FAA AC;
Part 139
Deficient coordination between Runway/taxiway incursion, Training; supervision; record of shift
maintenance shifts and/or airport runway excursion, surface briefings; SOP; Part 139
operations and/or FAA ATC accident
Shortage of personnel due to Runway/taxiway incursion, SOP; training; Snow Plan; IROPS Plan; cross
inability to report to work runway excursion, surface training of personnel
accident
Deficient coordination during Runway/taxiway incursion, SOP; FAA AC; training; Snow Plan; shift
snow removal ops runway excursion, surface safety briefings; supervision on site
accident
Snow / Ice Plan
Deficient planning to mitigate Runway excursions, SOP; Snow Plan; IROPS Plan; training; FAA AC
impact to airport operations runway/taxiway incursions
Deficient coordination between Runway/taxiway incursion, SOP; Snow Plan; IROPS Plan; training; FAA
tenants, airlines and airport runway excursion, surface AC; scheduled conference call briefings
departments accident
Deficient Irregular Operations Runway/taxiway incursion, FAA AC; Snow Plan; SOP; training
Plan (IROPS) runway excursion, surface
accident
Airfield condition reports that are Runway excursion, surface FAA AC; Snow Plan; Air Traffic SOP and
not accurate accident Orders; ATIS; NOTAMs; notification to
airlines/FBOs
Missing contact info for key Delay emergency response Activate emergency recall through Airport
operational and emergency recall Emergency Plan list; SOP; news media
personnel announcements
Deficient training of airport Runway excursion, surface SOP; Snow Plan; IROPS Plan; escorts
maintenance workers on airfield accident
winter operations
Deficient training of contractor Runway excursion, surface SOP; Snow Plan; conduct emergency
personnel to support snow accident training; onsite supervision
operations
Deficient coordination to notify Delay emergency response SOP; notification recording; FAA AC;
ARFF/EMS/Police when access temporary signage
routes have changed
Deficient coordination to prioritize Runway excursion, surface Snow Committee and Air Traffic notification;
clearing of runways and taxiways accident SOP; FAA AC

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   191  

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Coordination and Communication
Deficient coordination to notify Delay emergency response SOP; notification recording; signage; FAA AC
ARFF/EMS/Police when access
routes have changed
Deficient coordination to prioritize Runway excursion, surface Snow Committee and Air Traffic notification;
clearing of runways and taxiways accident SOP; FAA AC
NOTAMs not submitted in a timely Runway excursion, surface Snow Committee and Air Traffic notification;
and coordinated manner accident SOP; FAA AC; ATIS
Deficient communication to pilots Runway excursion, surface Snow Committee and Air Traffic notification;
on airfield condition reports, accident, collision SOP; FAA AC; ATIS; NOTAMs; scheduled
closed areas and limitations to conference call briefings
operations
Failure to monitor deice fluid Impact on environment Monitoring system with alarms for pre
capture tank levels critical, critical areas; physical monitoring of
tank/system levels; water/deice fluid water
shed volumes reporting; Storm Water
Pollution Prevention Plan (SWPPP)
Insufficient coordination of Runway excursion, surface Snow Committee; SOP; training; scheduled
AOA/AMA inspections with airline accident conference call briefings
representatives (Chief Pilots)
Emergency Response
Changes to status of access Delay of emergency Scheduled conference call briefings; SOP
roads/AOA routes response, surface accident
AOA Security
Unauthorized access to airfield Runway/taxiway incursion, Security radar, FLIR systems; airfield CCTV;
areas surface accident, wildlife SOP; FAA AC; TSA Part 1542
strike
Open fence or gates due to Runway/taxiway incursion, SOP; post guards; use temporary fence/
weather damage surface accident, wildlife gates to secure
strike
Fencing and Gates
Open AOA gate Runway/taxiway incursion, SOP; training; post guards
surface accident, wildlife
strike
Open construction gate or fence Runway/taxiway incursion, SOP; training; post guards
area surface accident, wildlife
strike
Absence of security guards due to Runway/taxiway incursion, Secure/close open area to no access
weather surface accident, wildlife
strike
Environmental Issues
Stockpiling location of Environmental impact Identify predetermined stock pile locations
contaminated snow/ice and mark; training; SOP; FAA AC
Improper deicing fluid runoff Environmental impact Monitoring and reporting of deice
operations; shutdown deice operations until
corrected; training; sweep /contain deice
fluid runoff and collect

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

192   A Guidebook for Safety Risk Management for Airports

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Low visibility Environmental impact Monitoring and reporting of deice
operations; shutdown deice operations until
weather improves; training
Deficient trained contract Environmental impact, Monitoring and reporting of deice
personnel occupational accident, operations; shutdown deice operations until
collision, surface accident deice operations properly conducted; onsite
supervision; training; SOP
Deicer fluids and other Environmental impact Sand contaminated areas, boom fluids and
contaminants outside of collect later; monitor and assess if
containment system contaminants will have regulatory impact;
SOP
Radio failure in deice vehicles Runway/taxiway incursion, SOP; training; Part 139; cell phone use;
surface accident backup radios/onsite supervision with radio
Breakdown of deice vehicles Collision, surface accident SOP; close area; mark/light area of vehicle
Driving and Escorting
Operating equipment outside of Collision, surface accident Training; SOP; Part 139; escorts; speed limit
accepted regulations signs; vehicle speed regulators; supervisory
monitoring; FAA AC
Improper escort training for Runway/taxiway incursion, Part 139; FAA AC; SOP; use of other qualified
drivers surface accident personnel
Impaired road signage on ramps Runway/taxiway incursion, Part 139; FAA AC; SOP; monitor and correct
due to snow/ice/low visibility surface accident, collision issue
Towing of Aircraft

Slippery surfaces Surface accident, collision Part 139; FAA AC; SOP; training; pre check
tow route and sand/treat
Training
Deficient training of personnel Environmental impact, SOP; FAA AC; Part 139; use of other qualified
involved with deicing collision, surface accident personnel
Snow clearing crews and Surface accident, collision Escorts; close runway and taxiways to be
equipment in movement areas cleared; NOTAMs; conference call briefing;
ATIS; training; SOP; FAA AC
Deficient communication between Surface accident, collision Training; SOP; FAA AC; onsite supervision
snow clearing crews and and monitoring
airport/airfield operations crews
Deficient SMGCS training Surface accident, collision Training; SMGCS Plan review; SOP; FAA AC;
use escorts
Lighting, Marking, Signage
Deficient conspicuity of markings, Surface accident, collision Part 139; FAA AC; SOP
lights and signs
Out of service obstruction lights Surface accident, collision Part 139; FAA AC; SOP
Equipment and Stockpiling
Large equipment parked on/near Collision Part 139; FAA AC; SOP; Part 77; training
safety areas
Large stockpiles of snow on/near Collision Part 139; FAA AC; SOP; Part 77; training;
safety areas Snow Plan
Snow accumulated in proximity of Aircraft accident, loss of Part 139; FAA AC; SOP; Part 77; training
NAVAIDS operational capabilities
Ruts or wash outs and ponding Runway excursions Part 139; FAA AC; SOP
of water

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   193  

Hazard Outcome Common Mitigations or Source Material for

Mitigations
NAVAIDS
Snow clearing crews unaware of Aircraft accident, loss of Part 139; FAA AC; SOP; Snow Plan; training;
NAVAIDS location operational capabilities onsite supervision
Snow clearing vehicles near Aircraft accident, loss of Part 139; FAA AC; SOP; Snow Plan; training;
NAVAIDS operational capabilities onsite supervision
Changes to traffic routes causing Aircraft accident, loss of Part 139; Air Traffic Orders; Letter of
aircraft to interfere with NAVAIDS operational capabilities Agreement; SOP; Snow Plan; training
FOD
Ice/snow debris from aircraft and FOD damage Part 139; FAA AC; SOP; Snow Plan; training
vehicle routes
FOD sweepers inoperative FOD damage Part 139; FAA AC; SOP; training
Drainage
Ponding and slippery surfaces due Runway/taxiway Part 139; FAA AC; SOP; Snow Plan; training
to melting/freezing snow/ice excursions, collision

Severe Weather

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Airfield Operations
Strong winds, flooding, or hail Aircraft damage, equipment Part 139; Severe Weather Plan; SOP; FAA
impacting aircraft, airline damage AC; Emergency Plan; training
equipment stored on ramps
Deficient lightning and flood Damage to equipment, Part 139; Severe Weather Plan; SOP; FAA
notifications to outside workers, aircraft, worker injuries or AC; Emergency Plan
tenants, airlines death
Changes to operation conditions Aircraft or vehicle accidents Part 139; Severe Weather Plan; SOP; FAA
AC; Emergency Plan; conference call
briefings
Coordination and Communication
Deficient coordination between Delay of emergency Part 139; Severe Weather Plan; SOP; FAA
airport activities (e.g., air traffic, response, surface accident, AC; Airport Emergency Plan; IROPS Plan; FAA
ramp management, security, runway/taxiway incursion AC; training; shift or special conference calls
emergency)
Airport staff and construction Delay of emergency Part 139; Severe Weather Plan; SOP;
workers unaware of hazardous response, surface accident Weather radios; CSPP; FAA AC; Emergency
situations Plan; training; shift or special conference
calls

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

194   A Guidebook for Safety Risk Management for Airports

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Emergency Response
Changes to emergency routes Surface accident Part 139; Severe Weather Plan; SOP; FAA
AC; Emergency Plan; training; shift or special
conference calls
Impact of weather on water lines Reduction of ARFF capacity Part 139; Severe Weather Plan; SOP; FAA
AC; Emergency Plan; training; conference
call
Security
Damaged gates and broken fences Runway/taxiway incursion, Part 139; Severe Weather Plan; SOP; FAA
surface accident, wildlife AC; Security Plan; TAS Part 1542; provide
strikes guards at open areas

Airside Driving

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Airfield Driving
Extended shifts, distractions, Runway/taxiway Part 139; FAA AC; SOP; proper rest periods;
weather conditions, etc., impacting incursion, surface onsite supervision; cross–train personnel;
situational awareness accident training
Vehicle improperly marked, lighted, Runway/taxiway Part 139; FAA AC; SOP; shift safety briefings;
equipped and not inspected prior to incursion, surface training; supervisory monitoring
operation accident
Jet blast/prop wash on vehicles Damage to vehicle, injury Part 139; FAA AC; SOP; shift safety briefings;
to personnel training
Changes to procedures affecting Runway/taxiway Part 139; FAA AC; SOP; shift safety briefings;
airfield service routes incursion, surface training; shift conference calls
accident
Deficient equipment/vehicle Surface accident, FOD Part 139; FAA AC; SOP; shift safety briefings;
maintenance training; vehicle inspections
Shared service/emergency/haul Surface accident Part 139; FAA AC; SOP; shift safety briefings;
routes and crossings training; escorts
Vehicle operators unaware of Runway/taxiway Training; SOP; Part 139; escorts; speed limit
regulations regarding vehicle incursion, collision signs; vehicle speed regulators; physical
operations on the airfield monitoring; FAA AC
Nighttime driving conditions Runway/taxiway Training; Part 139; FAA AC; SOP; shift safety
incursion, surface briefings
accident
Coordination and Communication
Deficient coordination with other Runway/taxiway Training; Part 139; FAA AC; SOP; shift safety
airport activities (e.g., air traffic, incursion, surface briefings; shift conference calls; IROPS Plan
ramp management, security, accident, damage to
emergency) aircraft

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Preliminary Hazard Lists (PHLs)   195  

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Changes to operations conditions Runway/taxiway Training; Part 139; FAA AC; SOP; shift safety
and service routes incursion, surface briefings; shift conference calls
accident
Use of improper aviation Runway/taxiway Training; Part 139; FAA AC; SOP; shift safety
phraseology incursion, surface briefings; supervision monitoring
accident
Loss of communication with ATC Runway/taxiway Training; Part 139; FAA AC; SOP; training in
incursion, surface use of alternative communication methods
accident
Emergency Response
Shared service/emergency routes Surface accident Training; Part 139; FAA AC; SOP; shift safety
and crossings briefings; shift conference calls
Security
Unauthorized vehicle access to Runway/taxiway Training; Part 139; FAA AC; SOP; shift safety
airfield areas incursion, surface briefings; shift conference calls; Airport
accident Security Plan; TSA Part 1542
Weather
Adverse weather conditions (heavy Runway/taxiway Training; Part 139; FAA AC; SOP; shift safety
rain, snow, moderate ice) incursion, excursion or briefings; shift conference calls; GPS (with
surface accident alarm capability for infringement of safety
area, etc. surfaces) tracking vehicles
operating on airfield
Low visibility conditions Runway/taxiway Training; Part 139; FAA AC; SOP; shift safety
incursion or surface briefings; shift conference calls; GPS (with
accident alarm capability for infringement of safety
area, etc. surfaces) tracking vehicles
operating on airfield; SMGCS Plan
Escorting
Speeding during escorting operations Collision Training; SOP; Part 139; speed limit signs;
vehicle speed regulators; physical
monitoring; FAA AC; CSPP
Deficient escort training Runway/taxiway Recurrent training; SOP; Part 139;
incursion or surface supervision; FAA AC; driving simulators; OJT
accident
Unfamiliarity with airfield plan and Runway/taxiway Training; SOP; Part 139; speed limit signs;
service routes incursion or surface vehicle speed regulators; FAA AC; airfield
accident maps with escort route provided to vehicles
being escorted; use of 2 or more escorts
Deficient communication with Ops Runway/taxiway Training; SOP; Part 139; FAA AC; Letter of
and ATC incursion or surface Agreement; conference call
accident

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

196   A Guidebook for Safety Risk Management for Airports

Hazard Outcome Common Mitigations or Source Material for

Mitigations
Safety Areas/Obstacle Free
Zones/NAVAIDS
Interference with NAVAIDS Aircraft accident, loss of Training; SOP; Part 139; FAA AC; escort
operational capabilities, briefing prior to start of escort; map of
delay in operations escort route provided to vehicle operators
being escorted
Vehicle breakdown in aircraft Collision, loss of SOP; FAA AC; training; notify supervision for
operations or safety areas operational capabilities, action and close area to aircraft and
delay in operations emergency operations
Changes to traffic routes causing Runway/taxiway Training; SOP; Part 139; FAA AC; escort
interference with NAVAIDS incursion or surface briefing prior to start of escort; map of
accident escort route provided to vehicle operators
being escorted
FOD
Transition from unpaved areas to FOD damage Training; SOP; Part 139; FAA AC; escort
operational areas, carrying FOD briefing prior to start of escort; map of
escort route provided to vehicle operators
being escorted; inspection of escorted
vehicles prior to entering AOA operational
areas; sweeper on call

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX F

Typical Accident and Incident Rates

Risk Category Subcategory Rate Source Data Period

Runway/Taxi Towered airports 2.5 runway/taxiway incursions per day GAO, 2008 Partial data
way Incursion in the U.S. from 2008
Towered airports 1 incursion per 167,000 operations GAO, 2008 1998 to 2007

Towered airports 1 collision per 37,500,000 operations FAA, 2004 2000 to 2003

Towered airports 1 fatality per 65,500,000 operations FAA, 2004 2001 to 2003

Runway Overrun landing 1 overrun in 1,050,000 landings ACRP Report 50,

Excursion 2010
Overrun takeoff 1 overrun in 4,120,000 takeoffs ACRP Report 50, 1982 2009
2010
Undershoot 1 undershoot in 4,160,000 landings ACRP Report 50, 1982 2009
2010
Veer off landing 1 veer off in 840,000 landings ACRP Report 51, 1982 2009
2010
Veer off takeoff 1 veer off in 3,860,000 takeoffs ACRP Report 51, 1982 2009
2010
Fuel Spills Hydrant airport high 1 spill per 6,700 operations WS ATKINS, 2000 1994 1998
pressure
Hydrant airport low 1 spill per 1,100 operations WS ATKINS, 2000 1994 1999
pressure
Refueler airport low 1 spill per 1,460 operations WS ATKINS, 2000 1994 1999
pressure
Ignition probability 1 ignition per 10,000 spills WS ATKINS, 2000 1994 1999
Risk of passenger fatality 1 fatality per 8,130,000,000 WS ATKINS, 2000 1994 1999
hydrant airport movements
Risk of passenger fatality 1 passenger fatality per WS ATKINS, 2000 1994 1999
refueler airport 379,000,000,000 movements
Ground Incidents with aircraft 1 incident per 5,000 movements NLR, 2008 NA
Handling damage
Damage rate in North 1 damage per 10,000 movements ACRP Report 62 2006 2007
America
Damage rate in Europe 1 damage per 3,000 movements ACRP Report 62 2006 2007

197  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

198   A Guidebook for Safety Risk Management for Airports

Risk Category Subcategory Rate Source Data Period

Birdstrikes Birdstrikes with damage to 1 birdstrike with damage to FAA, 2012 1990 to 2011
commercial aircraft commercial aircraft per 75,200
movements
Birdstrikes with damage to 1 birdstrike with damage to GA aircraft FAA, 2012 1991 to 2011
GA aircraft per 417,000 movements
Birdstrikes commercial 1 birdstrike to commercial aircraft per FAA, 2012 1992 to 2011
aircraft 7,300 movements
Birdstrikes GA aircraft 1 birdstrike to GA aircraft in 132,000 FAA, 2012 1993 to 2011
movements
Foreign Annual cost to aerospace USD 4 billion Boeing, 1998
Object industry
Damage Annual direct cost to USD 1.26 billion ACRP Synthesis
global aviation industry 26, 2011
Annual direct cost to US USD 474 million ACRP Synthesis
aviation industry 26, 2011
Annual total cost to global USD 13.9 billion ACRP Synthesis
aviation industry 26, 2012
Annual total cost to USD 5.2 billion ACRP Synthesis
aviation industry 26, 2013
Total no. of engine FOD 1 event per 3,200 aircraft movements McCreary, 2008
events
Tech test/inspection 1 test/inspection per 6,700 McCreary, 2008
movements
Blade pairs replaced 1 blade pair replaced per 5,900 McCreary, 2008
movements
Tire FOD events 1 tire FOD event per 1,030 movements McCreary, 2008
Tires replaced due to FOD 1 tire replaced per 2,940 movements McCreary, 2008
Aircraft fuselage damage 1 aircraft fuselage damage per 3,850 McCreary, 2008
movements

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX G

Typical KPIs and Associated Data

G-1 Introduction
KPIs are quantifiable measures that a company or industry uses to gauge or compare per-
formance in terms of meeting strategic and operational goals. KPIs vary among companies and
industries, depending on priorities and performance criteria. KPIs are also referred to as “key
success indicators (KSIs).” When measuring safety performance, some organizations use safety
performance indicators (SPIs). Regardless of the term used, an airport must be able to assess
safety performance. The indicators need to be measurable and in line with an organization’s
goals and objectives. Indicators can change and should be updated as progress is made. In this
appendix, the term KPI is used.
For airports, KPIs represent known data sources and existing data collected through the nor-
mal course of business. If an airport is Part 139 certificated, the airport operator is obligated to
collect, document, and retain certain safety data points, including Part 139 daily inspections,
ARFF inspections, driver training, and incursions. For airports that are not Part 139 certificated,
operators must consider the data points they already have in place and those missing that might
provide a more complete safety performance picture. Two lists of KPIs or potential KPIs that
all airports should consider including in their SMS and subsequently use to support their SRM
process follow.

Part 139 KPIs

1. Part 139 self-inspection results
a. Completed as described in the ACM
b. Number of discrepancies documented
c. Time to correct noted discrepancies
d. Trends
2. ARFF inspections
a. Number of discrepancies by location and tenant
b. Time to correct noted discrepancies
c. Trends
3. ARFF run reports (non-medical related)
a. Trends
4. ARFF medical run reports
a. Trends
5. Airfield driver training
a. The number of individuals trained (used to put data in context)
6. AOA access training (badging)
a. The number of individuals trained (used to put data in context)

199  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

200   A Guidebook for Safety Risk Management for Airports

7. FOD program results

a. Completed inspections and documentation (as appropriate)
b. Results of FOD inspections
c. Trends
d. Level of tenant and airline participation in the program

Non-Part 139 KPIs

8. Baggage area program results (as appropriate)
a. Completed inspections and documentation (as appropriate)
b. Results of baggage area inspections
c. Trends
d. Level of tenant and or airline participation in the program
9. Ramp inspection program results
a. Completed inspections and documentation as described in Appendix C
b. Results from inspections
c. Trends
d. Level of tenant and airline participation in the program
10. Terminal and Landside inspections (if appropriate)
a. Results from inspections
b. Trends
c. Level of tenant and airline participation in the program
11. Airport operator employee incident and accidents
a. OSHA Reportable (if applicable)
b. OSHA non-reportable (if applicable)
c. Trends
12. Property damage reports
a. Trends
13. Hazard reports
a. Public reports
b. Internal Authority reports
c. Tenant and airline reports
d. Time to investigate
e. Time to corrective action(s) completion
14. Incident and accident reports (non-aircraft related)
a. Public reports
b. Internal airport operator reports
c. Tenant and airline reports
d. Time to investigate
e. Time to corrective action(s) completion
15. Safety Training
a. Number of tenants and or airlines employees trained in SMS orientation
b. Airport operator staff and employees trained in SMS orientation, SRM process, and
Assurance
c. Test results
d. Trends

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

APPENDIX H

Basic Probability and Statistics

for SRM

Introduction
SMS and SRM are terms that have been recently introduced to the airport industry—they
highlight the need to understand some basic principles of probability because risk has two com-
ponents: severity and likelihood. While the meaning of severity is straightforward, understand-
ing the term likelihood requires some basic understanding of probability.
This appendix will help airport workers understand basic principles and notations used to
describe the chance of an accident or incident occurring. Reviewing these principles will help
airport workers understand and participate in discussions about risk and in panels assembled
for safety assessments.
Catastrophic accidents in aviation are rare and estimating the probability of occurrence is
best estimated using historical data. However, many types of incidents are frequent, particularly
at larger airports, because of the associated volume of operations and activities. Birdstrikes and
FOD incidents may occur daily at some airports.
The initial sections of this appendix describe basic concepts that airport staff can use in deal-
ing with SMS at the airport. The last section presents mathematical operations with probabilities
to help staff understand more advanced concepts.

Likelihood vs. Probability

The words probability and likelihood are often used as synonyms, but in statistical use, there
is a clear technical distinction. To illustrate the statistical difference between these terms we
can use a die. If we roll a die 6 times, what is the probability that we will get a “4” in every
roll? If we roll the die 6 times and we get a “4” in every roll, what is the likelihood that the
die is fair?
Statistically, it would be incorrect to switch likelihood and probability in the two sentences.
Probability has to do with the chances of an observation, and likelihood refers to the chances of
the parameters being correct, given an observation. However, for this guidance, no distinction
will be made between likelihood and probability and the terms will be used interchangeably.
Probabilities fall on a scale between 0, or 0%, (impossible) and 1, or 100%, (certain). There is
no such thing as a negative probability (i.e., less than impossible) or a probability greater than 1
(i.e., more certain than certain). Some types of accidents are very rare and the probability may
be very small (e.g., 0.00000001%), however, probability is never negative.

201  

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

202   A Guidebook for Safety Risk Management for Airports

Determining Probability Values

Three methods typically are used to determine probability values.
1. Subjective Probability
This value reflects the best available knowledge (which may be an educated guess). This
is a common method used by SRA panels. For example, to estimate the probability that an
airfield worker will be injured by jet blast, it is not possible to use baseline values because each
situation is unique and will depend on variables (e.g., is it in an area that aircraft will power
up engines or is FOD present in the area between the aircraft and the construction area). For
this scenario, an educated guess is the best alternative.
2. Empirical Probability
This value is determined by experimentation or historical data. An example of this is the
probability of a runway veer-off. Based on the total number of runway veer-offs that occurred
between 1982 and 2009 in the United States, and the number of aircraft operations during
the same period, it was found that the probability of an aircraft veering-off during the takeoff
is 1 in 3,861,000 departures (ACRP Report 51, 2009).
3. A Priori Probability
This value can be determined prior to any experimentation or data collection. For example,
the probability of obtaining a tail in tossing a coin once is 50%. The coin is not actually tossed
to determine this probability. It is simply observed that there are two faces to the coin, one of
which is tails and that heads and tails are equally likely. This type of probability is seldom used
in the aviation industry.

Understanding Probability Language

This section presents basic concepts associated with risk analysis and the language used by
the FAA to characterize the likelihood of an accident or incident. When taking the risk matrix
defined by the FAA for its internal SMS and to illustrate SMS guidance and advisory material
for Part 139 airports, likelihood definitions are presented in two forms: expected period for one
event to occur and expected number of departures to occur, as shown in Table H-1.
For example, “Remote” likelihood characterizes an event “expected to occur about once
every year or 2.5 million departures.” The first part of this definition describes the chance
that an event may occur within a certain period—in this case, 1 year. The second part pres-
ents the odds that the event will occur in 2.5 million departures (or approximately 5 million
operations).

Table H-1.   FAA likelihood definitions.

Likelihood Classification 1 Event in Every

Frequent Week or less 2,500 departures or less

Probable 1 Week – 1 Year 250,000 departures

Remote 1 – 10 Years 2.5 million departures

Extremely Remote 10 – 100 Years 25 million departures

Extremely Improbable 100 Years or more N/A

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Basic Probability and Statistics for SRM   203  

Table H-2.   Number of ramp accidents at

example airport.

Year # of Ramp Year # of Ramp

Accidents Accidents
1 0 9 0
2 0 10 2
3 0 11 1
4 1 12 2
5 3 13 2
6 1 14 0
7 2 15 1
8 1 16 2

The interpretation is simple; however, it is sometimes misleading. That an event is expected

to occur in 1 year does not mean that the event will take at least 1 year to occur. The event
may occur today or it may be many years before it happens. The period is an average period if
the time to obtain the data was long enough to measure the frequency of occurrence and the
conditions remained the same. When reviewing the number of accidents on the ramp over a
period of 15 years, an airport found that 18 accidents had occurred in that period, as shown in
Table H-2.

If we divide the number of events by the total observation period (18 events divided by
15 years), the result is approximately 1.1 events per year, which is about one event per year. In
this case, the probability of that event is ranked as “Remote.” However no event occurred in the
first 3 years, three events occurred in the 5th year, and so on.

Given two options to classify likelihood, which one should we use? Should we use the criteria
based on the number of operations or that based on the period? When the risk is associated with
aircraft operations, the likelihood definition to be applied will depend on the volume of opera-
tions at the airport. If the volume of operations is small, the likelihood definition based on time
should be used. At larger airports, a criterion based on the number of departures is the correct
one to apply. As a rule of thumb, airports with less than 200 departures per day should use likeli-
hood definitions based on the expected period for an event to occur.

Another important aspect is that risk management at an airport may be associated with other
operational areas of the airport. For example, many airports have extended the SMS scope to
terminal operations and landside. In addition, some airside risks, like collision between vehicles/
equipment at the ramp are not directly associated with the total number of operations at the air-
port. For such cases, likelihood definition based on the period or criteria defined by the airport
may be the best alternative.

As a rule of thumb, those airports having less than 200 departures

per day may use only the criteria based on the expected period for
an accident or incident, rather than the rate based on the number
of operations.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

204   A Guidebook for Safety Risk Management for Airports

Notations for Likelihood or Probability

Different notations can be used to represent the likelihood or probability of an accident or
incident as follows.

Events per operation.

Notation Example Description Note

One event (incident) per 100 1 incident per 100 operations is
1 in 100
operations (takeoffs and approximately 1 incident in 50
(incidents/operation)
landings) departures
One percent chance of occurring 0.01 chance incidents per operation
0.01 incidents per
an accident/incident per is similar to saying 0.02 incidents
operation
operation per departure
One percent chance of occurring 1% incidents per operation is similar
1% incidents per
an accident/incident per to saying 2% incidents per
operation
operation departure
1 x 10-2 incidents per One incident per 100 operations This is scientific notation and 1 x 10-2
operation (takeoffs and landings) is similar to 1/100, or 0.01, or 1%
This is scientific notation and 5 x 10-3
5 x 10 -3 incidents per Five incidents per 1,000
is similar to 5/1000, or 0.005, or
operation operations
0.5%

Events per period.

Notation Example Description Note

It is wrong to assume that no event
1 incident in 10 One incident is expected to occur is expected in the next 10 years.
years or 1 in 10 in 10 years assuming conditions The event may take place tomorrow
years remain constant or it may take many more years
beyond 10 years to occur

Although smaller airports with less than 400 movements per day
should use the FAA likelihood criteria based on the period, the
probability may still be calculated using a baseline risk based on
the number of operations. For example, based on historical data,
the probability of birdstrikes with damage to GA aircraft is 1 in
417,000 movements. If the airport has 4,000 annual operations
of GA aircraft, it may take over 100 years for an incident with air-
craft damage due to birdstrike. In this situation, the likelihood is
assumed to be extremely improbable.

Types of Events
Mutually Exclusive Events: These are events that cannot occur at the same time. It is unlikely
that a runway overrun will occur following a runway undershoot and these two events can be
assumed as mutually exclusive. In another example, aircraft damage and injury to passengers
may result from an aircraft accident; in this case, the events are not mutually exclusive.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Basic Probability and Statistics for SRM   205  

Complementary Events: These are events that have two possible outcomes. The probability of
event A plus the probability of A′ equals one. P(A) + P(A′) = 1. Any event A and its complemen-
tary event A′ are mutually exclusive. Heads or tails in one toss of a coin are complementary events.
Independent Events: These are two or more events for which the outcome of one does not
affect the other (i.e., the events are not dependent on what occurred previously). Each toss of a
fair coin is an independent event.
Conditional Events: These events are dependent on what occurred previously. If a plane
catches fire on the ground during a taxiway operation, there is a chance of fatalities due to the
fire. The number of fatalities depends on the severity of the fire and the effectiveness of the
emergency response.

Probability Calculations
Sometimes it is necessary to calculate the total probability that two events will occur simul-
taneously or in succession. For example, if we know that the probability of an aircraft over­
running a runway is 1 in 1 million operations and that approximately 20% of those incidents
result in accidents, we can calculate the probability that an overrun accident occurs. In this case,
the probability is calculated by the product of the two probabilities.
The first step is to identify different types of events for which the probability will be calculated,
as follows:
• Mutually Exclusive Events: These are events that cannot occur at the same time. It is extremely
improbable that a runway overrun will occur following a runway undershoot and these two
events can be assumed as mutually exclusive. In another example, aircraft damage and injury
to passengers may result from an aircraft accident; in this case, the events are not considered
mutually exclusive because damage to aircraft may cause injury to passengers.
• Complementary Events: These are events that have only a few possible outcomes. For example,
an event may have outcome A or B. The probability of event A plus the probability of B equals
one. P(A) + P(B) = 1. Any event A and its complementary event B are mutually exclusive. Heads
or tails in one toss of a coin are complementary events.
• Independent Events: These are two or more events for which the outcome of one does not
affect the other. They are events that are not dependent on what occurred previously. Each
toss of a fair coin is an independent event.
• Conditional Events: These are events that are dependent on what occurred previously. If a
plane catches fire on the ground during a taxiway operation, there is a chance of fatalities due
to the fire. The number of fatalities depends on the severity of the fire and the effectiveness of
the emergency response.
Sometimes an airport wants to estimate the total probability of an accident occurring at the
ramp. It involves accidents involving people, aircraft, vehicles, and equipment that have occurred
on the ramp within a certain period.

Total Probability
Sometimes it is necessary to calculate the total probability that an event may occur and it is
possible to add the probabilities if the events are mutually exclusive. An airport may define a
safety performance indicator as the probability of an accident at the ramp. The probability is
estimated by adding the probabilities for each type of accident on the ramp.
P (A) is the probability that accident A type occurs
P (B) is the probability that accident B type occurs

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

206   A Guidebook for Safety Risk Management for Airports

P (C) is the probability that accident C type occurs

P (A or B or C) = P (A) + P (B) + P (C)
For example, historical data available at an airport were used to calculate the probability of
birdstrikes. The chance of a birdstrike during a landing operation is approximately 1.3 bird-
strikes per week and the probability that a birdstrike takes place during a departure is 1.1 per
month. The airport wants to find the probability of a birdstrike during any movement (arrival or
departure). In this case, the events are mutually exclusive; either a landing or takeoff operation
and the total probability can be calculated by adding the probabilities.
However the probabilities are presented in different units: incidents per week, and incidents
per month. The first step is to make the units uniform. We can say that 1 month has approxi-
mately 4 weeks and 1.3 birdstrikes per week represents 5.2 birdstrikes per month. We can now
add the probabilities and obtain 6.3 birdstrikes per month as the chance of a birdstrike during
any operation.

Probability of Simultaneous Events

As shown in the example presented for aircraft overruns, sometimes it is necessary to estimate
that two events take place during the same incident. The probability of events A and B occurring
simultaneously is the probability of event A multiplied by the probability of event B, if the events
can be assumed independent. In mathematical notation:
P (A & B) = P (A) × P (B)
Using the example for runway overrun:
P (A) = 1/1,000,000 = 0.000001 overruns per operation (probability of a runway overrun)
P (B) = 20% = 0.2 (percentage of overruns that result in accidents)
P (A & B) = P (A) × P (B) = 0.000001 × 0.2 = 0.0000002 overrun accidents per operation
(probability of an overrun accident)
Although the consequences of an overrun are associated with the speed that the plane departs
the runway, we are using two independent probabilities for the calculation: the rate (or prob-
ability) of overruns and the percentage of accidents during overruns.

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

Abbreviations and acronyms used without definitions in TRB publications:

A4A Airlines for America
AAAE American Association of Airport Executives
AASHO American Association of State Highway Officials
AASHTO American Association of State Highway and Transportation Officials
ACI–NA Airports Council International–North America
ACRP Airport Cooperative Research Program
ADA Americans with Disabilities Act
APTA American Public Transportation Association
ASCE American Society of Civil Engineers
ASME American Society of Mechanical Engineers
ASTM American Society for Testing and Materials
ATA American Trucking Associations
CTAA Community Transportation Association of America
CTBSSP Commercial Truck and Bus Safety Synthesis Program
DHS Department of Homeland Security
DOE Department of Energy
EPA Environmental Protection Agency
FAA Federal Aviation Administration
FHWA Federal Highway Administration
FMCSA Federal Motor Carrier Safety Administration
FRA Federal Railroad Administration
FTA Federal Transit Administration
HMCRP Hazardous Materials Cooperative Research Program
IEEE Institute of Electrical and Electronics Engineers
ISTEA Intermodal Surface Transportation Efficiency Act of 1991
ITE Institute of Transportation Engineers
MAP-21 Moving Ahead for Progress in the 21st Century Act (2012)
NASA National Aeronautics and Space Administration
NASAO National Association of State Aviation Officials
NCFRP National Cooperative Freight Research Program
NCHRP National Cooperative Highway Research Program
NHTSA National Highway Traffic Safety Administration
NTSB National Transportation Safety Board
PHMSA Pipeline and Hazardous Materials Safety Administration
RITA Research and Innovative Technology Administration
SAE Society of Automotive Engineers
SAFETEA-LU Safe, Accountable, Flexible, Efficient Transportation Equity Act:
A Legacy for Users (2005)
TCRP Transit Cooperative Research Program
TEA-21 Transportation Equity Act for the 21st Century (1998)
TRB Transportation Research Board
TSA Transportation Security Administration
U.S.DOT United States Department of Transportation

Copyright National Academy of Sciences. All rights reserved.

A Guidebook for Safety Risk Management for Airports

ADDRESS SERVICE REQUESTED

Washington, DC 20001
500 Fifth Street, NW
TRANSPORTATION RESEARCH BOARD
NON-PROFIT ORG.

ISBN 978-0-309-30865-6
COLUMBIA, MD
PERMIT NO. 88

90000
U.S. POSTAGE
PAID

9 780309 308656

Copyright National Academy of Sciences. All rights reserved.