Attachment_0016_System_Safety_Management_Plan.pdf

UNCLASSIFIED

PdM Air Warrior SSMP

SYSTEM SAFETY

MANAGEMENT PLAN (SSMP)

Approved By:

John J. Maher

LTC, AV

Product Manager Air Warrior

09 February 2017

TABLE OF CONTENTS

Section/Topic Page

1. Purpose 4

2. References 4

3. Scope 4

4. Safety Policy 5

5. Safety Policy Objectives 5

6. System Safety Organization 6

7. Tasks to Meet Objectives 6

8. Milestones 9

9. Risk Management 9

10. Risk Resolution 10

11. Risk Decision Authority 11

12. Software System Safety 11

13. Health Hazard Assessment 12

14. Lines of Communication and Information 12

15. Administration 12

16. Resource Requirements 12

17. Schedules 12

Appendices Appendix A Air Warrior System Safety Working Group (SSWG) Charter Appendix B Air Warrior Safety Milestone Schedule Appendix C System Safety Risk Assessment Forms Appendix D Safety Issue / Hazard Item Form Appendix E Hazard Status Coding Guide Appendix F Log Number Coding Guide Appendix G Risk Assessment Methodology

Figures Figure 1. System Safety Management Hierarchy

AIR WARRIOR SSMP

04 November 2016

1. Purpose

This System Safety Management Plan (SSMP) establishes oversight management policies, objectives, and responsibilities regulating execution of a System Safety Program for Product Manager Air Warrior (PdM AW). Execution shall also provide guidance for contractors to format safety related Contract Delivery Requirements and to establish System Safety Program Plans in support of PdM AW acquisition programs.

2. References

a. AR 385-10, 27 Nov 2013, The Army Safety Program

b. AR 40-10, 27 July 2007, Health Hazard Assessment Program

c. MIL-STD-882E, 11 May 2012, DOD Standard Practice System Safety

d. DA PAM 385-16, 13 August 2013, System Safety Management Guide

e. AMCOM Regulation, AMCOMR 385-17, AMCOM Software System Safety Policy, 15

March 2008

f. Memorandum, SFAE-AV, 27 Sept 2013, Subject: Program Executive Officer, Aviation

Policy Memorandum Number 13-08, System Safety Program Management Process

g. Memorandum, Army Acquisition Executive, SAAL-PE, 10 Dec 2010, ESOH

3. Scope

The SSMP defines the relationship between PdM AW, the Air Warrior (AW) System Safety Working Group (SSWG) and design contractors. The SSMP establishes the methodology by which PdM AW may oversee and execute internal and contractor support System Safety programs. This plan applies to both legacy AW systems and components and the Air Soldier System (Air SS) Engineering and Manufacturing Development (EMD) Program. Air SS sub-systems and components will be added/deleted as the program matures. This plan is prepared in accordance with Department of the Army Pamphlet 385-16 and is in compliance with Army Regulation 385-10 as well as guidance from other references listed above.

The Air SS is an ACAT II program that is managed, developed and fielded by the PdM AW Office. Air Soldier requirements are contained in the Joint Requirements Oversight Council approved Air Soldier Capabilities Development Document (CDD). The Air SS will replace the legacy AW system upon completion of the Production and Deployment phase. Air SS consists of:

PdM Air Warrior SSMP

a. An integrated personal protective clothing ensemble and gear carriage system that provide reduced bulk and weight through a reduction in layering and utilization of active thermal regulation.

b. Personal electronics that replace select legacy components and provide improved data processing, control and presentation technologies to reduce weight, bulk and overall pilot workload.

c. An improved flight helmet system featuring a day/night common helmet mounted display with enhanced symbology and head tracking to reduce/prevent aircraft mishaps in Degraded Visual Environments.

d. Increased mission duration when operating in worst case protective posture configurations.

4. Safety Policy

It is the policy of PdM AW to sensitize design engineers to be attentive to component and system hazards while creating the design. The idea is to minimize the number and severity of hazards initially residing in the system. Once “design in safety” is maximized, system hazards are identified through testing and ongoing operational use which could cause personal injury or equipment damage. PdM AW shall continue to evaluate program associated risks, to eliminate, minimize, or mitigate the system hazards, and to aggressively document risk management efforts and decisions throughout the life cycle of PdM AW programs.

5. Safety Policy Objectives

a. Assure all hazards associated with PdM AW acquisition programs are identified and formally tracked, and risks associated with those hazards are properly managed and resolved.

b. No hazard is accepted without formal documentation of associated risks.

c. Ensure risk acceptance decisions by the appropriate authority are documented. (Section 11)

d. Relevant historical safety data (lessons learned) and safety measures consistent with mission requirements are included in all PdM AW system development, production and fielding.

e. Ensure significant safety data are documented and submitted through government representative to the U.S. Army Combat Readiness Center, Defense Technical Information Center, and other appropriate data banks and/or are submitted as proposed changes to applicable design handbooks and specifications.

f. Retrofit actions required to improve safety are minimized through the timely inclusion of safety features early in the life cycle of the AW and Air SS Programs.

g. Changes in design, configuration, or mission requirements are accomplished in a manner that maintains risk level acceptable to the decision authority.

h. Consideration is given to safety, ease of disposal, and demilitarization of any hazardous material during each phase of system design, production, and fielding.

PdM Air Warrior SSMP

6. System Safety Organization

a. The PdM AW safety management organization is illustrated in Figure 1. Specific contractor organizations will vary for each AW program and sub-system.

PM AIR WARRIOR

AMCOM Safety PEO Aviation

Safety Manager Air Warrior

AED

Software Engineering Directorate

TPO-AB

Logistics Management Air Warrior

Project Engineers Air Warrior

Air Warrior Contractors

PEO Soldier

Figure 1. System Safety Management Hierarchy

b. PdM AW System Safety management includes a wide range of technical and support disciplines required for each program under development and during all phases of fielding. The AW SSWG will be the focal point for the integration of design and testing disciplines. The chairperson of the SSWG will develop the necessary lines of communication and information exchange with, as a minimum, the following:

(1) The PdM AW MANPRINT Working Group.

(2) The Test Integration Working Group.

(3) The Human Research Laboratory, to integrate the Human Factors Engineering Assessment of PdM AW acquisition programs.

(4) Surgeon General Representative, to integrate Health Hazard Assessment into AW products.

7. Tasks to Meet Objectives

a. The PdM AW will:

(1) Charter and guide the AW SSWG (Appendix A).

(2) Designate the program system safety manager and chairperson of the SSWG.

PdM Air Warrior SSMP

(3) Ensure compliance with the established decision authority for the acceptance of residual risks associated with program hazards.

(4) Establish procedures for Government and contractor interaction; ensure contracts stipulate these procedures. Ensure the AW SSWG representatives are requested to attend appropriate system reviews, demonstrations, surveys, and tests.

(5) Assign budget and manpower resources to accomplish system safety management tasks.

(6) Establish and update system safety milestone schedules (Appendix B).

(7) Identify residual risks and provide recommendations for risk acceptance or resolution at each milestone review.

(8) Establish procedures for evaluation of materiel changes for safety impacts.

(9) Integrate hazards and safety issues identified by associated disciplines and input data into the Hazard Tracking System (HTS) database. The current HTS database is HazTrak sponsored by PEO Aviation.

(10) Prepare System Safety Risk Assessment (SSRA) for serious and high risk hazards; see Appendix C for format. The SSRA will be sent to the appropriate acquisition manager for review no later than 60 days before each decision authority review.

(11) Participate in Source Selection Evaluation Boards; ensure adequate criteria are established.

(12) Establish and maintain documentation on all risk acceptance decisions.

(13) Request the Army Institute of Public Health perform a health hazard analysis of each AW program and provide a copy to the technical test agency 60 days before the start of a technical test.

(14) Provide field units with provided equipment safety hazards 60 days prior to fielding a system (usually included with operational and maintenance Technical Manuals).

b. The SSWG will:

(1) Review acquisition documents, both Government and contractor, for safety and health implications.

(2) Collect and evaluate “lessons learned” and “case studies” that may be relevant to the acquisition programs.

(3) Implement a risk assessment and acceptance methodology, as well as a hazard tracking database. Review and track progress on system safety tasks.

(4) Evaluate and monitor contractor system safety documentation.

(5) Provide input for revisions to the SSMP.

(6) Independently assess and verify the degree of risk for identified hazards.

(7) Review and recommend best technical approach regarding resolution of safety and health hazard risks.

PdM Air Warrior SSMP

c. The AMCOM Materiel Safety Office will:

(1) Review test plans and documentation to ensure that safety issues identified by the SSWG are included and evaluated. Provide safety representation at each Test and Evaluation IPT meeting to capture possible safety hazards.

(2) Review procurement documentation for compliance with Department of Defense (DoD) system safety policy.

(3) Review and comment on system safety portions of PdM AW request(s) for proposal (RFP).

(4) Participate as co-chairperson for the PdM AW SSWG.

d. The AMCOM, Aviation and Missile Research, Development, and Engineering Center (AMRDEC) will:

(1) Provide engineering support to PdM AW to identify, and analyze hazards, to recommend solutions to PdM AW safety issue/hazard items.

(2) Participate as a member of the PdM AW SSWG.

(3) Participate in the preparation of PdM AW SSRAs in conjunction with AMCOM Materiel Safety Office.

e. The AMCOM Safety Office Software System Safety Organization will:

(1) Serve as the AMCOM Safety Office central point of contact regarding software safety.

(2) Interact with joint and other Army and Service agencies to coordinate software safety reviews.

f. Contractor efforts include a System Safety Program Plan (SSPP) that serves as the basic foundation for executing the contractors safety program. The SSPP defines the logical, systematic, and efficient approach for applying system safety principles to system development;

thereby serving as the guiding document for the “what, when, how, where” aspects of the contractor planned system safety program. The SSPP identifies the contractor’s organizational resources and responsibilities for executing the contractor system safety program, specific system safety tasks and procedures, risk assessment methodology and risk acceptance criteria, system safety products, and critical milestones. If applicable, the SSPP details how software system safety tasks will be accomplished within the specific software development lifecycle for the project. The SSPP also addresses health hazard safety concerns. Contractors shall report all system safety hazards to the PdM AW Safety Manager.

(1) Example outline for a SSPP.

Introduction System Safety Program Description

Contractor Organization Contractor Responsibilities System Safety Tasks

PdM Air Warrior SSMP

Milestones System Safety Requirements

Task Descriptions Specific Hazard Analyses System Safety Data

Risk Assessment and Mitigation Methodology Safety Verification Process (should be same as described in PdM AW SSMP)

8. Milestones

See Appendix B “Air Warrior Safety Milestone Schedule”.

9. Risk Management

a. Safety Issue. A safety issue is a perceived or observed safety condition for which a corrective action is considered necessary to eliminate or reduce the condition. A safety issue may be submitted to the AW System Safety Manager (ATTN: SFAE-SDR-AW), during a SSWG meeting or at any time that a real or potential unsafe condition is identified. The basic information needed to determine that a safety hazard exists is indicated in Appendix D. Any additional data or information that is available will assist in the disposition of the safety issue.

b. Safety Hazard. A safety hazard is a real or potential condition that can cause injury or death to personnel, damage to or loss of equipment or property, loss of mission capability due to material malfunction or damage to the environment. Safety hazards may originate from different sources such as: material, hardware, software and may be classified as a health hazard. Hazards may occur at the system or sub-system level. A safety issue that meets these criteria will be classified as a safety hazard and will be coordinated with the AMCOM Materiel Safety Office, forwarded to the appropriate engineering and logistics elements for corrective action, and entered into the hazard tracking database for appropriate action. SSWG meeting minutes will record the status coding (Appendix E) of each safety hazard item, all corrective action assignments and schedules, and other pertinent information for the PM and higher authority.

c. Hazard Description. The PM will ensure that hazards are completely described with a brief narrative of the human, machine, and/or environmental conditions that could lead to a mishap.

The hazard description will be composed of three elements: source, mechanism, and outcome.

The source is an activity, condition, or environment where harm can occur that serves to initiate the actual or potentially hazardous chain of events. The mechanism is the means by which the source can bring about the harm. The outcome is the harm that might be suffered. Hazards containing multiple sources, mechanisms, or outcomes should be broken out into individual hazards.

d. Risk Assessment.

(1) The process of identifying and managing system safety risks is a proven approach. It is important for the PM to integrate the results of the system safety risk assessment process into the overarching risk assessment methodology used for managing the entire acquisition program. The PM evaluates the hazards and associated risks in the context of user requirements, potential mission capability, the operational environment, and program constraints.

PdM Air Warrior SSMP

(2) All hazards will be evaluated by the SSWG to verify classification; the risk associated with a hazard is a function of its probability and severity. Probability will be categorized as frequent, probable, occasional, remote, improbable and very improbable. The categories for severity will be catastrophic, critical, marginal, and negligible. The specific definitions of these terms along with a Risk Decision Authority Matrix can be found in Appendix G. The Risk Decision Authority Matrix will be used to assign a hazard classification, also known as Risk Assessment Code (RAC).

(3) Once a hazard has been identified and a hazard classification assigned, a determination shall be made as to what action, if any, should be taken to remedy the hazard. Not all hazards are severe enough or occur often enough to warrant the effort/resources required to eliminate or control them.

10. Risk Resolution

a. The SSWG will identify the potential methods of controlling or eliminating a hazard and the expected effectiveness of each method. Within 30 calendar days after each SSWG meeting, PdM AW shall publish the minutes, stating assessment results and hazard control recommendations. Additional reports are required immediately upon the identification of IA, IB, IC, IIA, or IIB (High risk) hazard conditions.

b. Hazard resolution action shall be assigned by PdM AW, and will serve as initial documentation for risk acceptance decisions. Appendix G illustrates the appropriate levels to which each hazard must be reported and the decision authority for accepting the risk associated with each hazard on the AW Program. Hazard acceptance decision authority is explained in detail within section 11 of this SSMP.

c. The consequences of risk acceptance of the proposed configuration and alternative actions shall be expressed using projected costs of injuries, death, material losses, and environmental impact if applicable. Information concerning application and projected costs shall be obtained from the contractor by the SSWG. The decision to accept the risk shall also consider other factors such as the impact on schedule and operational effectiveness. U.S. Army Training and Doctrine Command (TRADOC), specifically the TRADOC Capability Manager – Aviation Brigades (TCM-AB), provides recommendation(s) regarding alternative corrective measures in accordance with Reference c.

d. Hazard Tracking. The system will employ the standard format of the automated HTS currently in use throughout AMCOM and PEO Aviation. All hazards will be tracked through their HTS log number. To maximize the information conveyed in this critical data element, a key for decoding the log number is shown in Appendix F.

e. Preparation for Milestone Decision Review (MDR).

(1) U.S. Army Combat Readiness/Safety Center is responsible for preparation of the AW Independent System Safety Assessments (ISSA). PdM AW is responsible for preparation of SSRAs.

(2) PdM AW is responsible for the presentation of the AW SSRA to the review authority. The assessment will include a hazard listing with recommendations as to the alternative/corrective

PdM Air Warrior SSMP action for each hazard (Appendix C). The hazard database (HazTrak) which includes the SAR is the primary source for information used in preparing the presentation.

11. Risk Decision Authority

All residual risks must be managed and accepted by an appropriate risk decision authority as specified below:

a. High Level Risks - PdM AW will staff an SSRA; the PEO, Soldier/Aviation will review the draft SSRA of High Level Risk(s) and notify the Army Safety Action Team as soon as possible when there are insufficient means to reduce the risk to a lower level. The Army Safety Action Team will provide direction toward risk mitigation. Signature authority for acceptance of High level risk shall be the Army Acquisition Executive (AAE).

b. Serious Level Risks

(1) PdM AW will staff an SSRA for a serious risk for which available controls cannot reduce the residual risk to a medium or low level in less than one year. It is understood that SSRAs apply to safety risks present in equipment at Materiel Release or those discovered after fielding which cannot be resolved in a timely manner by PM action or through application of an Aviation Safety Action Message (ASAM) or Safety of Flight (SOF). SSRAs should include mitigation plans and an expiration date with the intent of reducing risk to baseline.

(2) Risk Decision Memorandum (RDM) may be used to accept serious level risk for residual materiel safety hazards that will be mitigated through an actionable path-ahead near term, as defined by the PM and approved by the PEO, Soldier/Aviation. The RDM shall include sufficient detail to describe the hazard (using the Source-Mechanism-Outcome method) and any controls that serve to reduce the risk to the lowest level. The RDM shall also define the strategy for mitigating the risk to an acceptable level. RDMs will be coordinated with AMCOM Safety Office and AED, as appropriate and coordinated through APEO ET for review prior to forwarding to the Program Executive Officer (PEO) for signature. Signature authority for acceptance of Serious level risk must be the PEO.

c. Medium / Low Level Risks. For medium and low residual risks PMs will document risk acceptance with a RDM. In accordance with reference g “Memorandum”, acceptance authority for medium and low level risks shall not be delegated below the Project Manager (O-6 or civilian equivalent).

12. Software System Safety

a. The Software Engineering Directorate (SED) will provide software safety support to the PM for the identification, analysis and recommended solution to the respective system software and software hazard actions report to ensure respective system is compliant with MIL-STD-882E and AMCOM Regulation 385-17. SED will also provide software support to the PM in preparation of SSRAs and RDMs through the established Airworthiness Impact Statement process.

PdM Air Warrior SSMP

b. The assessment of risk for software, and consequently software-controlled or software-intensive systems, cannot rely solely on the risk severity and probability. Determining the probability of failure of a single software function is difficult at best and cannot be based on historical data. Software is generally application-specific and reliability parameters associated with it cannot be estimated in the same manner as hardware. Therefore, another approach shall be used for the assessment of software’s contributions to system risk that considers the potential risk severity and the degree of control that software exercises over the hardware.

c. It should be noted that any hazard reported as a result of software functionality is recorded in association with the affected hardware system. The hazard analysis and documentation will indicate software as the source. A comprehensive analysis of software contribution to risk can be found in MIL-STD-882E, Para. 4.4. and shall be applied in support of PdM AW programs.

13. Health Hazard Assessment

The Health Hazard Assessment (HHA) focuses on the identification of potential health hazards and costs due to system component materials and evaluates potential alternative materials to reduce the associated risk to users/operators of the system. Specific health hazards and impacts assessed during a HHA include chemical, physical, biological, and/or ergonomic hazards, as well as other potential hazards that may be introduced by the development, test, production, transport, operation, training, maintenance, or disposal of the system. The degree of personnel exposure to a health hazard is an integral part of the evaluation process and is based on the potential routes, the cause, magnitude, frequency, and duration of exposure. Refer to Army Regulation 40-10, “Health Hazard Assessment Program in Support of the Army Acquisition Process” for assessment and processing of health hazards.

14. Lines of Communication and Information

The System Safety Manager will develop lines of communication and information exchange with:

a. AW subsystem safety activities

b. MANPRINT Working Groups

c. Human Engineering Laboratory

d. The Surgeon General

e. Test Integration Working Groups

f. Army Research Institute

g. System Safety Working Group (SSWG)

h. Others as deemed necessary

15. Administration

a. The System Safety Manager shall accomplish the following:

PdM Air Warrior SSMP

(1) Act as Chairperson of the AW SSWG in accordance with the SSWG Charter (Appendix A).

(2) Maintain hazard tracking database and its software.

(3) Coordinate preparation and distribution of minutes of each SSWG meeting based on existing/available contract vehicles.

b. AMCOM Materiel Safety Office Representative will act as Co-Chairperson of the AW

SSWG.

16. Resource Requirements

a. Budget – The program is funded in the current Program Objective Memorandum.

b. Manpower – The PdM AW System Safety Manager is safety lead, sponsored by PdM AW working under direction of technical management and reports directly to the PdM AW. Other members of the PdM AW system safety team are identified in section 6 of this document.

PEO Aviation sponsored HazTrak database system shall be used to record and track hazards.

17. Schedules (See Appendix B “ Air Warrior Safety Milestone Schedule”)

SSWG Charter A - 1 Appendix A

Appendix A

CHARTER

PROJECT MANAGER (PM)

AIR WARRIOR (AW)

SYSTEM SAFETY WORKING GROUP (SSWG)

SSWG Charter A - 2 Appendix A

1. Purpose

To establish a technically qualified advisory group for Product Manager Air Warrior (PdM AW) system safety management as a means to enhance the design and safe operation of program system acquisitions.

2. Scope

The AW SSWG will function as an element of program management to monitor the accomplishment of the AW System Safety Management Plan (SSMP) including:

a. Validation of system safety tasks.

b. Identification of system safety requirements, to include crashworthiness and crash safety.

c. Organizing and controlling those interfacing Government efforts that are directed towards the elimination or control of system hazards.

d. Coordinating with appropriate organizations and agencies on AW safety matters.

e. Analyzing and evaluating the contractor's System Safety Program Plan; provide timely and effective recommendations for improving program effectiveness.

3. Authorization

AW Project Manager's Charter and Army Regulation (AR) 385-10

4. References

a. AR 385-10, 27 Nov 2013, The Army Safety Program

b. DA PAM 385-16, 13 Nov 2008, System Safety Management Guide

c. MIL-STD-882E, 11 May 2012, DOD Standard Practice System Safety

5. Tasks

The AW SSWG will be responsible to PdM AW for the following:

a. Review of AW program requirements, such as the Capability Development Document and Memorandum of Agreement (MOA) for safety impacts.

b. Review and evaluation of the safety aspects of AW technical approach activities.

c. Recommendations to PdM AW to request, in light of existing system safety, new or revised requirements from the Combat Developer.

d. Response to requests from PdM AW for recommendations on program matters potentially influencing system safety.

e. Coordination with other elements of AW Project Manager’s Office (PMO) to identify and evaluate those areas in which safety implications exist.

f. Review of the safety aspects of AW Request(s) for Proposal (RFP).

g. Evaluation of AW Source Selection Evaluation Board (SSEB) criteria for system safety.

h. Evaluation of contractor proposals for system safety, to include crashworthiness, software and environmental impact.

SSWG Charter A - 3 Appendix A

i. Development of a Hazard Tracking System (HTS) to identify, eliminate (if possible), mitigate, estimate the likelihood of occurrence, and track hazards throughout the life cycle of the program. Recommendations for corrective actions should be provided to PdM AW as appropriate.

j. Development of an AW SSMP.

k. Review and evaluation of the contractor's System Safety Program Plan.

l. Assistance to PdM AW(or representative) during safety reviews sponsored by contractor support. Comments or recommendations for corrective action should be provided to PdM AW as appropriate.

m. Periodic updating of the AW Hazard Tracking System database.

n. Collection and evaluation of lessons learned pertaining to AW system safety.

o. Recommendations to PdM AW to requesting residual risk acceptance from the appropriate decision acceptance authority.

6. Operation

a. Voting Members

(1) Chairperson: AW System Safety Manager (if necessary, the senior representative of the AW PMO present)

(2) Co-Chairperson: AMCOM Materiel Safety Office representative.

(3) Combat Developer, TRADOC Capabilities Manager – Aviation Brigades (TCM-AB) representative

(4) Aviation Engineering Directorate representative

(5) PEO Aviation representative (platform safety when applicable)

b. Non-Voting Members: Non-Voting Members will be invited to attend AW SSWG meetings on an as-required basis when their expertise, opinions, or comments are required or solicited.

Minutes of each SSWG meeting will be provided to all members and other attendees.

(1) Representatives from other DoD components, when applicable.

(2) Other Major Army Commands (MACOM) when applicable.

(3) Designated AMCOM Directorate/Office representatives having AW subsystem matrix support responsibilities.

(4) Developmental Test Command (DTC) representative.

(5) Army Test and Evaluation Command (ATEC) representative.

(6) US Army Aeromedical Research Laboratory (USAARL) representative.

(7) Army Research Laboratory (ARL) representative.

(8) Designated Prime/Subcontractor Safety Manager representative.

(9) Human Factors representative

c. Department of the Army (DA) observer from U.S. Army Safety Center: The DA observer will be invited to SSWGs for input concerning safety issues affecting platform PM’s.

d. Meetings. Meetings of the AW SSWG will be held when required by PdM AW or when requested by a majority of the SSWG voting members; however, the SSWG meeting plan objective is to meet semi-annually or as a minimum - annually. Voting members are requested to attend all SSWG meetings. Non-Voting Members will attend SSWG meetings at the invitation of PdM AW System Safety Manager when their specialized expertise is required.

e. Voting. All SSWG participants (voting and non-voting) will be provided an opportunity to discuss safety issues and hazards prior to a decision on the disposition and/or assignment of risk

SSWG Charter A - 4 Appendix A or action items. Voting members will advise the Chairperson of their respective vote regarding issues, recommended hazard closures, hazard risk assessment code changes, proposed corrective actions to reduce or eliminate a hazard, and other related SSWG actions during the SSWG Meeting. A unanimous vote is required by the voting members to change the status and/or associated risk level of a hazard, proposed hazard or issue. After each SSWG meeting the Chairperson shall provide a summary report to PdM AW in oral or written format as directed.

The Chairperson shall include preliminary minority opinions in the summary presentation.

f. Administration.

(1) The AW System Safety Manager will establish and provide meeting notices and agendas to all participants, as required, no later than 30 days prior to each SSWG meeting.

(2) Proposed safety issues and agenda items may be submitted by any organization to the SSWG through either the SSWG Chairperson or Co-Chairperson. Appendix D of the SSMP provides the format to be used to record and report potential safety issue/hazard.

(3) A summary of action items, action agencies, and suspense dates will be prepared before the end of each SSWG meeting. The System Safety Action Item Report (blank located on A-5) will be used to record assigned actions and to report action item results to the SSWG.

(4) Minutes will be prepared under the authority of the PdM AW for each meeting and will be distributed not later than 30 days after each SSWG meeting. The Minutes shall include all Action Items appropriate to the respective programs. The Minutes shall constitute formal documentation of issues raised, decisions reached, and actions directed.

(5) The SSWG does not have the authority to accept residual risks associated with identified hazards. All safety conditions, identified by any source, will be entered in the HTS database as either an issue or hazard based on SSWG review. Recommendations for the elimination or mitigation of each safety issue or hazard will be provided to PdM AW for appropriate action by the AW System Safety Manager. Hazards determined by the SSWG to be re-coded as a non-residual risk (i.e. non-hazards) may be closed by the Chairperson.

(6) All items from previous SSWG meetings will be reviewed by the Members and other invited attendees prior to the next meeting to determine whether or not an action should be closed or that adequate progress is being made on each Action Item.

(7) Accident or incident experience will be reviewed at each SSWG meeting to identify trends and monitor and evaluate the corrective actions taken.

(8) Implementation of the provisions of this Charter will be governed by the SSMP approved by PdM AW.

(9) This Charter and the AW SSMP will be reviewed at least annually and will be updated or modified as required.

7. Time Period

The AW SSWG shall function during the life of the AW Project Manager's Office.

SSWG Charter A - 5 Appendix A

SYSTEM SAFETY WORKING GROUP

ACTION ITEM / REPORT

AW/Air Soldier Program: ____________________________

Subject (Action Item): ___________________________________________________________

Action Item Number: _________________ Suspense: _______/_______/_______

Related Hazard/Issue Log Number: _____________________

Action Office/Action Officer: _____________________________________________________

Originator: _______________________________________ ATTN: ____________________

Organization: __________________________________________________________________

Action deliverable to: ___________________________________________________________ Office: _______________________________________________________________________ Phone: (_____) _______-_________ FAX: (_____) ________-__________

Assigned: _____/_____/_____ Completed: _____/_____/_____ Closed: _____/_____/_____

Actions Taken: ________________________________________________________________

Safety Milestone Schedule B - 1 Appendix B

Appendix B

AIR WARRIOR SAFETY MILESTONE SCHEDULE

Safety Milestone Schedule B - 2 Appendix B

Item Schedule SSRA for Serious and High risk hazards Send to TCM-AB for review no later than 60 days before each decision authority review.

HHAR from Army Institute for Public Health At each major milestone

AW System Safety Management Plan (SSMP) Updated and provided at each MDR (as per AR 385-10)

AW System Safety Working Group (SSWG) Charter Update as required, review no less than annually

AW System Safety Risks Assessments (SSRA) 60 days following direction of PdM

AW

AW Hazard Tracking System (HTS) Updates Update monthly

AW System Safety Working (SSWG) Group Meetings Semi-annually or as required by PdM AW

Safety and Health Data Sheet (one per managed system) Generate and update as required, review no less than annually

CONTRACTOR RESPONSIBILITY

Specific contractor responsibilities pertaining to system safety may vary from contract to contract but could include some or all of the deliverables listed below:

DID Number DID Title

DI-SAFT-80101B System Safety Hazard Analysis Report DI-SAFT-80102B Safety Assessment Report (SAR) DI-SAFT-80103B Engineering Change Proposal System Safety Report DI-SAFT-80104B Waiver or Deviation System Safety Report (WDSSR) DI-SAFT-80105B System Safety Program Progress Report DI-SAFT-80106B Health Hazard Assessment Report DI-SAFT-80913B Explosive Ordnance Disposal Data DI-SAFT-81299B Explosive Hazard Classification Data DI-SAFT-81300A Mishap Risk Assessment Report DI-SAFT-81626 System Safety Program Plan

Appendix C

SYSTEM SAFETY RISK ASSESSMENT (SSRA) FORMAT

For

SERIOUS AND HIGH LEVEL RISK

SSRA FORMAT

(SERIOUS AND HIGH LEVEL RISKS)

PART I:

1. Item/System identification. (For systems containing radioactive materials or explosives, a brief statement will include identifying the status of the radioactive material license, Army authorization, range fans, or the applicable hazard classifications as listed.)

2. For each residual hazard provide the following:

a. Hazard topic.

b. Hazard description and consequences of risk acceptance of proposed configuration.

c. Hazard classification (severity and probability according to MIL-STD-882E).

d. Source document reference.

e. Alternative actions that could reduce hazard level.

3. Recommendations regarding risk acceptance. (e.g. "Recommend acceptance of residual risk" or "Recommend the following corrective/risk reduction actions...")

Product Manager, AW

PART II:

Recommendations of the AMCOM Materiel Safety Manager.

Chief, Materiel Safety Office

PART III:

Recommendations of the Combat Developer, U.S. Army Aviation Center.

Commanding General

PART IV:

Recommendations of the Program Executive Officer.

Program Executive Officer

PART V:

Decision of the Acquisition Manager.

(For HIGH Level Risk)

Army Acquisition Executive (AAE)

Appendix D

SAFETY ISSUE / HAZARD ITEM FORM

SAFETY ISSUE/HAZARD ITEM

Organization: __________________________________________________________________

Point of Contact: _______________________________________________________________

Telephone: DSN ________-__________ Commercial: (______) ________-____________

Aircraft S/N involved (if applicable): ________________________________

Condition is: [ ] POTENTIAL SAFETY ISSUE [ ] ACTUAL EVENT EXPERIENCED ON (date) ______/______/______

POTENTIAL SEVERITY AND FREQUENCY OF OCCURRENCE:

Severity: [ ] Catastrophic [ ] Critical [ ] Marginal [ ] Negligible

Occurrence: [ ] Frequent [ ] Probable [ ] Occasional [ ] Remote [ ] Improbable

Description of Proposed Safety Issue (use back if more space is needed): __________________

SYSTEM SAFETY WORKING GROUP USE ONLY

Accepted by SSWG: [ ] YES [ ] NO (If "YES" include preliminary action; if "NO" provide reason for rejection below):

Initial Identification: [ ] ISSUE [ ] HAZARD

Title (if accepted): ______________________________________________________________

Hazard Tracking System LOG NO Assigned: ______________ Date: ______/______/____

Hazard Status Coding Guide E - 1 Appendix E

Appendix E

HAZARD STATUS CODING GUIDE

STATUS RISK REDUCTION/ELIMINATION

ACTIVE / OPEN • Hazard identified (entered into hazard tracking system database).

• Technical analysis/engineering definition of the problem established.

• Corrective action options developed.

• Residual risk determined.

• Corrective action approved.

• ECP / MWO on contract.

• Corrective action completed in production/field.

• Corrective action completion documented.

• Recommendation to appropriate authority to close the hazard item.

CLOSED • Hazard eliminated by mitigation or system associated with hazard eliminated.

PROPOSED • Potential hazard identified with planned submittal to the SSWG for evaluation.

ISSUES • A safety issue is a perceived or observed safety condition for which a corrective action is considered necessary to eliminate or reduce the condition. Issues may be opened or closed upon SSWG evaluation and determination.

Log Number Coding Guide F - 1 Appendix F

Appendix F

LOG NUMBER CODING GUIDE

FOR HAZARD TRACKING SYSTEM (HTS)

The coding of Air Warrior Hazard LOG numbers are created to identify first, the program system or sub-system, followed by the system / sub-system component, then a three character numerical sequence value beginning with 001 for each system/sub-system.

First Block – Program (two characters):

AI Aircraft Integration

MI Modular Integrated Helmet and display System (MIHDS)

PE Personal Electronics Sub-System

SI Soldier Integration Sub-System

SY Air Soldier System Hazard

Log Number Coding Guide F - 2 Appendix F

Second Block – Program Sub-system Component (three or four characters):

037 SRU-37/P Life Raft 056 AIHS Aircrew Integrated Helmet System (Basic Helmet) 56A AIHS-A AIHS - Apache Helmet 56M AIHS-M AIHS - Maxillofacial Shield 072 72 hour survival Equipment AMSS AMSS Aircrew Modular Survival System AWIS AWIS Aircraft Wireless Intercom System CABS CABS Cockpit Airbag System CBT Conformal Battery CEPS CEPS Communication Enhancement and Protection System CHMD CHMD Common Helmet Mounted Display CVST CV Cooling Vest DPS DPS Dismounted Power Storage Module EDM EDM Electronic Data Manager HTS HTS Head Tracking System HEAT HEAT Heating Element for the Aircrew Torso HUD HUD Heads Up Display IPE IPE Integrated Protective Ensemble JPAE L-JPACE Lightweight Joint Protective Air Crew Ensemble JSAM JSAM Joint Service Aircrew Mask LCE LCE Layered Clothing Ensemble LECS LWECS Lightweight Environmental Control System LEP LEP Laser Eye Protection LISA LISA Lightweight Immersion Suit for Aviation LPT LPT Liquid Pass Through MDM MDM Mission Display Module NVG NVG Night Vision Goggles PHOS PHODS Portable Helicopter Oxygen Delivery System PSGC PSGC Primary Survival Gear Carrier RICM RICM Radio Interface Control Module SABI SABI Soft Armor Ballistic Insert SCM SCM Soldier Computer Module

Third Block - The Sequence (three characters):

Assign a three digit sequential number beginning with 001 for each program system/ sub-system hazard.

Risk Assessment Methodology Appendix G

Appendix G

RISK ASESSMENT METHODOLOGY

The following guidelines are a combination of Program Executive Officer Aviation policy (Reference f) and instructions specific for PdM Air Warrior.

Assumptions:

1. Personnel (operators/users/maintainers) obey regulations, follow written instructions, and exercise reasonable caution during the performance of their duties.

2. The only hazards covered under this SSMP are those on which the PMO can have an effect.

Specifically, hazards that are introduced by ALSE equipment, hazards that the equipment is specifically designed to eliminate or minimize, and hazards that can be effected by PdM Air Warrior systems and its proper or improper functioning.

Decision Authority Matrix

Severity

Probability

Catastrophic

Critical

Marginal

Negligible

Frequent

A

1A

HIGH

AAE

2A

3A

SERIOUS

PEO

4A

MEDIUM

PM

Probable

<=100 but > 10 B

1B

2B

3B

PEO

4B

Occasional

<= 10 but > 1 C

1C

2C

3C

4C

Remote

<= 1 but > 0.1 D

1D

2D

3D

4D

Improbable

<= 0.1 but > 0.01 E

1E

2E

3E

4E

LOW

Very Improbable < =0.01 but > 0

F

1F

2F

3F

4F

Risk Assessment Methodology Appendix G

Decision Authority

CATEGORY

ACCEPTANCE LEVEL

HIGH Component Acquisition Executive

SERIOUS Program Executive Officer

MEDIUM / LOW Program Manager (0-6)

SEVERITY

The first step in determination of hazard classification is to determine the severity of a particular mishap should it occur. If a hazard has varying degrees of severity based on varying degrees of probability, a separate hazard for each degree of severity should be considered. If this is not possible, the hazard should be identified by the highest risk acceptance category (High, Serious, Medium, or Low) applicable, and with the highest severity rather than the highest probability.

The following classifications shall be used:

Severity 1- CATASTROPHIC Death or permanent total disability; aircraft loss; irreversible significant environmental damage; or monetary loss equal to or exceeding $10M.

Severity 2 - CRITICAL - Severe injury or severe occupational illness (permanent partial disability) or hospitalization of 3 or more personnel, reversible significant environmental damage or monetary loss equal to or exceeding $1M but less than $10M.

Severity 3 - MARGINAL - Minor injury or minor occupational illness (no permanent effect/1 or more lost work days), reversible moderate environmental damage, or monetary loss equal to or exceeding $100K but less than $1M.

Severity 4 - NEGLIGIBLE - Less than minor injury or occupational illness (less than one lost workday), minimal environmental damage or monetary loss less than $100K.

Risk Assessment Methodology Appendix G

PROBABILITY

Description Level Specific Individual Item System

Frequent A Likely to occur often in the life of an item or Greater than 100 occurrences per 100,000 flight hours.

Continuously experienced.

Probable B Will occur several times in the life of an item or Less than or equal to 100 and greater than 10 occurrences per 100,000 flight hours.

Will occur frequently.

Occasional C Likely to occur sometime in the life of an item or Less than or equal to 10 and greater than 1 occurrences per 100,000 flight hours.

Will occur several times.

Remote D Unlikely, but possible to occur in the life of an item or Less than or equal to 1 and greater than

0.1 occurrences per 100,000 flight hours.

Unlikely, but can reasonably be expected to occur.

Improbable E So unlikely, it can be assumed occurrence may not be experienced in the life of an item or Less than or equal to 0.1 and greater than or equal to

0.01 occurrences per 100,000 flight hours.

Unlikely to occur, but possible.

Very Improbable

F Virtually incapable of occurrence or Less than

0.01 but greater than 0 occurrences per 100,000 flight hours.

Extreme low probability

SUMMARY INFORMATION

Project leaders should maintain a Hazard Summary Worksheet for their project as follows. The focus of summarization is to answer the question, "What is the likelihood that this system will cause or allow a catastrophic failure to occur?" The same question applies for critical, marginal and negligible failures. By grouping the hazards in severity class and adding the probabilities together, the project leader will arrive at the overall probability that an incident of the specific severity will occur. If the summarized probability cannot be arrived at numerically, the project leader should note that the determination has been made subjectively. If all associated hazards are low risk, but the summarized hazard is medium or high risk, the project leader shall explore risk reduction opportunities with the goal of reducing the summarized hazard to low level.

However, summary probabilities do not represent actual hazards and the actual hazards may not be reducible.

Risk Assessment Methodology Appendix G

Example:

A B C D E

All together, the likelihood of each severity class is:

1 2 E - Improbable 2 1 2 D - Remote 3 12 D - Remote 4 2 6 35 C - Occasional

Hazard Summary Worksheet Table

Indicates two hazards with Severity 1 and Probability E.

The Probability should be E unless the combination of 12 hazards represents a more likely probability that a Severity 3 mishap will occur. The key is “combined probability.”

If there is even one Probability D hazard, then the aggregate hazard Probability must be at least D.

Risk Assessment Methodology Appendix G

HAZARD SUMMARY WORKSHEET

The following worksheet is for the use of project leaders.

1. Summary

Enter the total number for each class of hazard. Count all valid hazards whether open, closed, or being reduced. Then sum the aggregate probability for each severity class.

A

B

C

D

E

All together, the likelihood of each severity class is:

If summarized probability can be objectively (vs. subjectively) determined, then enter the

1 numerical 2 probability in 3 these spaces.

2. Open Hazards (use hazard tracking number only)

Hazards undergoing risk reduction actions:

Hazards recommended for acceptance and closure:

Hazards in a monitor status:

3. Notes: