01/2012

GOVERNMENT OF INDIAOFFICE OF THE DIRECTORR GENERAL OF CIVIL AVIATIONOpp. Safdarjung Airport, New Delhi – 110 003SSP Division Circular No.1 of2012Subject: Hazard Log TemplateFile No.:AV-15011/ASC/3/2012-AS (2)Dated 26.10.2012CAR Section 1 Series C Part I requiresAir operators, Aerodrommeoperator, ATS/ANS Service provider to develop, establish, maintain andadheree to a Safety ManagementSystem. Effective safety reporting ofhazards by operational personnel,their analysis and documentation is acornerstone for management of safety.The formal documentation of hazards is an essential requirement forhazard identification as well as a trait of mature safety management.Safety information (i.e. analysed raw data)and safety intelligence (i.e.safety information that has been corroborated and further analysed byadding context)combine to generate safety knowledgethat mustformallyreside in the organizationn and not with the individual membersof the organization. A formal repositoryof safety knowledge is asafeguard against volatility of the information.In addition, anorganization that has historical safety knowledgee will make safetydecisions based upon facts and not opinions.Appropriate documentation management regarding hazard identificationis important as a formal procedure to translate rawoperational safetyinformation into hazard-related knowledge.Continuous compilation andformal management of this hazard-related knowledge becomes the“safety library” of an organization.To document thehazardsin an objective manner, DGCA has developeda template which is appended tothis circular. Thetemplatee providesminimum fields for the documentation of thehazard. All the stakeholdersare advised to utilize this Hazardlog template for documentation andanalysis purpose.Sd/-(Lalit Gupta)Deputy Director General of Civil AviationDistribution: All Aircraft Operators /AerodromeAuthority of IndiaOperators/Airports

DGCA Template for Hazard Log.This excel spreadsheet is a template for theproduction of a hazard log ‐ also known as a riskregister.The aim is to identify the high level risks the organisationfaces, to assess them, identify mitigations, and put in placeactions to assure the risk control is implemented.Detailed hazard logs will not be approvedby the DGCA, and remain the responsibilityof the individual operator.Scroll downWhat does this spreadsheet do?The template laid out in this Excel file is intended to assist organisations in preparing a hazard log. It contains guidance on the areas to be completed, along with a suggested hazard tolerabilityscheme. The hazard log is a critical part of the "safety library" of an organisation.What is a hazard log?Definition 1"Unawareness and unwillingness can be overcome only through knowledge. Theformal documentation of hazards is therefore an essential requirement for hazardidentification as well as a trait of mature safety management. Safety information(i.e. analysed raw data) and safety intelligence (i.e. safety information that hasbeen corroborated and further analysed by adding context) combine to generatesafety knowledge that must formally reside in the organization, not in the heads ofindividual members of the organization."What does the DGCA template contain and why?IDSource: ICAO Doc 9859 section 4.6.3Definition 2“The continually updated record of the Hazards,incident sequences and incident / accidents associatedwith a system. It includes information documentingrisk management for each Hazard and accident(incident). These Hazards, incident sequences andaccident / incidents are those which could conceivablyhappen, and not only the ones which have alreadybeen experienced.”Source: Def Stan 00‐56 Issue 4Definition 3"Organisations should wherever possible maintain acentralised log of all identified hazards. The nature andformat of such a log may vary from a simple list ofhazards to a more sophisticated relational databaselinking hazards to mitigations, responsibilities andactions (as part of an integrated safety riskmanagement process)."Source: EASA European Strategic Safety Initiative ‐Guidance on Hazards IdentificationUnique Hazard ID number assigned by organisations ‐ this allows traceability of the hazard (particularly if discovered via multiple sources)OriginatorSourceLocationFunctional areaHazard descriptionWorst credible effect and reasonExisting controlsOutcome pre‐mitigationAdditional risk controlsOutcome post‐mitigationActionOwnerDeadlineReview periodName of organisation (as used by DGCA)Method from which hazard was identified. Examples could include accident/incident investigations, safety audits, proactive methods etc. See sheet 4 ofthis fileIf applicable, the location of the hazard (identified by its ICAO designator if relevant)The area (or function) of the operation within which the hazard residesA short description of the hazard. For guidance on hazard types, see sheet 5 of this file which gives a non‐comprehensive listA short description of the worst credible effect of the hazard (what risk could the hazard potentially lead to?) and the reasons for the hazard leading to thisriskIdentification of the existing mitigations (or controls) which prevent the hazard leading to the end effectAn analysis of the risk, in terms of probability, severity and ultimately tolerability (or acceptability) ‐ guidance on this process is shown in sheet 3If the risk is found to not be acceptable (or acceptable with additional mitigations), additional controls will be shown hereFollowing the implementation of additional controls, the new outcome (risk) is analysed for acceptabilitySpecific actions are identified to implement any new risk controlsSpecific action owners are identified for each action ‐ the responsibility for implementation of the risk control lies with themA deadline for the action should be fixed. It is not enough to identify risk controls and leave them to be implemented in five years' timeA review period should be specified, upon which the effectiveness of the new controls should be assessed. Are they effective, or are new risk controlsnecessary?

ID Originator SourceHazIDworkshop ‐Example 1 AAIMarch2012 (ref)12345678910WorstLocationDate addedcredible(ICAOFunctional area Hazard descriptionto hazlogeffect anddesignator)reasonn/a 15‐03‐12 ANS ‐ TWR service Loss of comms AccidentExisting controls (defences)Procedural mitigations promulgatedinternally to TWR ATCOs (exact ref to begiven)Additional risk controls (riskStatus andOutcome Pre‐mitigationOutcome post‐mitigationAction Owner DeadlineReview periodmitigation strategy)completion dateSeverity Likelihood Risk tolerable? Severity Likelihood Risk tolerable?Liaise with base airlines and vehicleProcedural mitigations promulgated toMr A.N.Other,owners to develop and1 4 N flight crews and vehicle drivers (exact 1 5 Ysafety manager, 01 January 2013 Open 01 January 2014communicate procedures in case ofrefs to be given)TWR servicesloss of comms

Hazard tolerability (or acceptability)In assessing the tolerability of various hazards, you must examine the worst credible effect (risk) associated with the hazard. Guidance on this can be found in ICAO Doc 9859 (Safety ManagementManual). The characterisation of the worst credible effect is carried out using the variables of severity and probability (likelihood).Scroll downFrom ICAO Doc 9859: "The process of bringing the safety risks of the consequences of hazards under organizational control starts by assessing the probability that the consequences of hazardsmaterialize during operations aimed at delivery of services. This is known as assessing the safety risk probability. Safety risk probability is defined as the likelihood that an unsafe event or conditionmight occur.The second step in the process of bringing the safety risks of the consequences of hazards under organizational control is the assessment of the severity of the consequences of the hazard if itsdamaging potential materializes during operations aimed at delivery of services. This is known as assessing the safety risk severity.Once the safety risk of the consequences of an unsafe event or condition has been assessed in terms of probability and severity, the third step in the process of bringing the safety risks of theconsequences of the unsafe event or condition under organizational control is the assessment of the tolerability of the consequences of the hazard if its damaging potential materializes duringoperations aimed at delivery of services.This is achieved by combining the safety risk probability and safety risk severity tables into a safety risk assessment matrix."The safety risk matrix, and specific scales used, can be individual to each organisation . However, in the interest of providing guidance to Indian stakeholders and maintaining a consistent approach,the DGCA is providing these two matrices below as a basis for stakeholders' hazard analyses. All stakeholders other than small NSOPs( operating 1‐2 aircraft) should use Matrix 1.Matrix 1 - defaultSeverityMatrix 2 - to be used by small NSOPs onlySeverityCatastProbabilitytrophicHazarrdousMa ajorMin norNegliigibleLead ds toaccide ent orserious s injurySerireductsafety mioustion inmarginsNuisa anceimpact t, or noimp pactFrequent 5 Several times per year, or more 5Occasional 4 Once per year for individual operation 3Remote 3 Very unlikely to occur during lifetime 1Improbable 2 A C EExtremely improbable 1A B C D EProbabilityGreen means Tolerable riskYellow means Tolerable risk if risk mitigations applied, and may require management decision for acceptanceRed means Intolerable under existing circumstances

Sources of hazard dataThe following non‐exhaustive list shows the potential sources for hazard data. A reminder: a hazard is an event with the potential to cause risk (harm).Accident / incident investigationsFlight Operations Quality Assurance (FOQA) ‐ also known as Flight Data Monitoring (FDM)Cockpit Voice Recorders (CVR)Internal safety auditsFlight reports (flight crew, cabin crew) ‐ including operational reports, hazard reports, incident reports etcMaintenance reportsHazard workshops (proactive brainstorming)DGCA regulatory audits and surveillance activitiesMandatory Occurrence ReportsVoluntary reporting systems (anonymous)Safety surveysLine Operations Safety Audits (LOSA)Change risk assessments (for operational changes)Other organisations' hazard logsQuality auditsManufacturers reportsSafety Information Exchange programmesCAR‐145 audits (if applicable)

Example hazards ‐ by type and per organisationThis spreadsheet gives some initial examples of hazards. It is in no way exhaustive.•Non stabilised approach•Fatigue• Defect control• Runway incursion• Standard OperatingProcedures not followedOperationalTechnical• Failures of components• Malfunction of systems• Adequate facilities andsystems• Inappropriately appliedtools and techniquesAircraft Operators (SOP and NSOP)•Fatigue•Loss of communications•Expired aeronautical informationANSPs•Incorrect clearance given•Wrong call‐sign•Adverse weather conditionsBy typeBy organisation• Weather (monsoon, icing,low visibility etc)• Geographical context(aerodrome specific)• Economic context (e.g.cost of fuel)ContextOrganisation• Unclear responsibilities•Re‐organisation• Unclear authority for riskdecisionsAirport Operators•Unclear signage for runway•Fuel spilllage•Badly lit rampMaintenance Organisations•Use of non‐certified parts•Improper tools used•Chemical spillage