Safety Risk Safety Risk

Assessment/Assessment/

AcceptanceAcceptance

Air Force Materiel CommandAir Force Materiel Command

Chuck Dorney, P.E., C.S.P.

Chief, HQ AFMC/SES

DSN 787-6007

I n t e g r i t y - S e r v i c e - E x c e l l e n c e

Developing, Fielding, and Sustaining America’s Aerospace Force

2

Overview

• Description of safety risk

acceptance process

• Current policies

• Issues

• Recommendations

3

Description

• Identify hazards

• Assess their risks – two factors– Severity (worst that can happen)– Probability (how often)

• Apply corrective actions– Design change, safety devices– Warning devices, procedures, etc.

• Accept residual risks– Include ‘interim’ risks

4

Example Risk Matrix (MIL-STD-882D)

PROBABILITY

LEVELS

SEVERITY CATEGORIES

I

CATASTROPHIC

II

CRITICAL

III

MARGINAL

IV

NEGLIGIBLE

(A) Frequent

1 3 7 13

(B) Probable

2 5 9 16

(C) Occasional

4 6 11 18

(D) Remote 8 10 14 19

(E) Improbable

12 15 17 20

HIGH(CAE) HIGH(CAE)

LOW (PM)LOW (PM)

SERIOUS (PEO)SERIOUS (PEO)

MEDIUM (PM) MEDIUM (PM)

5

Policies

• DODI 5000.2– CAE accepts High risks– PEO accepts Serious risks– PM accepts Medium and Low risks– As defined by DOD std practice for system safety

(does not specifically name ‘MIL-STD-882’)• AFI 63-101 (Capabilities-Based Acq)

– Same as DODI 5000.2, but calls out -882D

• AFI 91-202 (Safety) and AFMC sup 1– Use the specific matrix in 882

• ASC/CC Policy memo, Jun 05– Emphasize the above– Annual review of High and Serious risks

6

Policy Issues

• DODI 5000.2 and AFI 63-101 do not:– Mention ‘residual’ nor ‘interim’ risk– Require any user coordination– Differentiate between Acquisition and Sustainment.

• ALCs frequently do• Who accepts structural risk? PEO or ALC/CC?• Users?

• AFI 91-202 Sup does address, but not well– New sup will require CAE/PEO acceptance with

• User coord• ALC/CV coord

7

Policy issues (Cont’d.)

• Some SPOs not sending High/Serious risks forward for the following reasons:– Unaware or misinterpretation of the rules

– 'Operational' hazards do not apply - incorrect, DODI 5000.2 and 63-101 do not differentiate

– 'Sustainment' hazards do not apply - this is also incorrect

– 'Interim' hazards (i.e., those with a solution in work) do not apply. Yes, they do apply, because until the fix is in place, users are still operating at risk

8

Recommendations

• Revise DODI 5000.2 and AFI 63-101– Require user accept High and Serious risks

• They control the funding

• But, not always for developing programs

– Define ‘interim’ and ‘residual’ risks

9

Questions?

10

AFMC Safety

BACKUP SLIDES

11

DODI 5000.2

• E7.1.6. Environment, Safety and Occupational Health (ESOH). As part of risk reduction, the PM shall prevent ESOH hazards where possible, and shall manage ESOH hazards where they cannot be avoided. The acquisition strategy shall incorporate a summary of the Programmatic ESOH Evaluation (PESHE), including ESOH risks, a strategy for integrating ESOH considerations into the systems engineering process, identification of ESOH responsibilities, a method for tracking progress, and a compliance schedule for NEPA (42 U.S.C. 4321-4370d and Executive Order 12114, references (x) and (az)). During system design, the PM shall document hazardous materials used in the system and plan for the system's demilitarization and disposal. The CAE (or for joint programs, the CAE of the Lead Executive Component) or designee, is the approval authority for system-related NEPA and E.O. 12114 documentation. For acceptance of ESOH mishap risks identified by the program, the CAE is the acceptance authority for high risks, PEO-level for serious risks, and the PM for medium and low risks as defined in the industry standard for system safety.

12

Mishap Severity CategoriesDescription Category Environmental, Safety, and Health Result Criteria

Catastrophic I Could result in death, permanent total disability, loss exceeding $1M, or irreversible severe environmental damage that violates law or regulation.

Critical II Could result in permanent partial disability, injuries or occupational illness that may result in hospitalization of at least three personnel, loss exceeding $200K but less than $1M, or reversible environmental damage causing a violation of law or regulation.

Marginal III Could result in injury or occupational illness resulting in one or more lost work day(s), loss exceeding $10K but less than $200K, or mitigatible environmental damage without violation of law or regulation where restoration activities can be accomplished.

Negligible IV Could result in injury or illness not resulting in a lost work day, loss exceeding $2K but less than $10K, or minimal environmental damage not violating law or regulation.

13

Mishap Probability LevelsDescription Level Specific Individual Item Fleet or Inventory

Frequent A Likely to occur often in the life of an item, with a probability of occurrence greater than 10-1 in that life.

Continuously experienced.

Probable B Will occur several times in the life of an item, with a probability of occurrence less than 10-1 but greater than 10-2 in that life.

Will occur frequently.

Occasional C Likely to occur some time in the life of an item, with a probability of occurrence less than 10-2 but greater than 10-3 in that life.

Will occur several times.

Remote D Unlikely but possible to occur in the life of an item, with a probability of occurrence less than 10-3 but greater than 10-6 in that life.

Unlikely, but can reasonably be expected to occur.

Improbable E So unlikely, it can be assumed occurrence may not be experienced, with a probability of occurrence less than 10-6 in that life.

Unlikely to occur, but possible.

14

Draft AFI 91-202 Supp

• 9.2.4.2. (Added) Preparation of a written or electronic risk assessment/acceptance document will be accomplished with all using MAJCOM participation, and will be coordinated with the lead MAJCOM prior to routing the documentation to the AFAE, or PEO, or equivalent with info copy to AFSC/SEF/SEP. PEO documentation will have MAJCOM/DR/XR/SE coordination and AFAE documentation will have MAJCOM/CV coordination.

• 9.2.4.2.4. (Added) If the mishap risk acceptance package requires AFAE approval, HQ AFMC/SES will obtain HQ AFMC/CV coordination prior to forwarding the package to the PEO for coordination and submittal to the AFAE. If the package requires PEO approval, HQ AFMC/SES will obtain HQ AFMC/SE approval prior to submittal to the PEO.

• 9.2.4.2.1. (Added) Program offices will coordinate mishap risk acceptance packages within the program office to include Chief Engineer/Director of Engineering, appropriate division chiefs, the test community, the System Program Manager, and, if applicable, the ALC vice commander.