Air Operators’ Safety Assurance System

Construction of air operators’ safety assurance system is important for national civil aviation authority to perform the safety oversight work systematically and efficiently on the air operators. The system is a combination of management process, tools, information platform, which utilize system configuration model and data collection tools to accomplish the air operator system design evaluation and performance evaluation, and output the advice for national civil aviation authority inspectors to take action to improve the air operators’ safety design and performance according to the regulation. Process has been designed to realize design and performance evaluation, and strengthen the safety assurance function during the air operator certification and surveillance phases. Based on the system configuration model, risk indicators, data collection tools and other tools, the system could perform configuration setting, planning, task assignment, data collection, analysis and action during the certification and surveillance. The application of the safety assurance system to different operators has been considered. 1 Necessity for the Regulator to Construct its Safety Assurance System As international civil aviation organization promotes the safety management system (SMS) globally, each member state should develop the State Safety Program (SSP) to promote its safety management on civil aviation industry. The regulatory authorities of member states, apart from formulating regulations to require air operators to set up SMS, should also construct their own mechanisms of risk management and safety assurance for their oversight. Air operators’ safety assurance system (SAS) is the specific embodiment of the regulatory authorities’ safety assurance work on air operators’ oversight. As the target of the aviation safety oversight, air operators vary in their business models and operational scope. Some air operators operate commercial transport with jumbo aircraft and some with small aircraft. Some are civil aircraft maintenance companies. The former two types of companies undertake commercial air transport activities necessary for the economic and social development, and the latter provides maintenance support services for the former two. The overall configuration framework of the regulatory elements applicable to different operators can be developed through the construction of operators’ SAS. The oversight may be much more systematic and standardized if we formulate inspection plans for different operators by choosing applicable elements under this framework. A large proportion of air operators engage in commercial air transport operations, featuring cross regional activities. Air operators have several sub-bases and a number of stations besides their main operational base where aircraft fly to and from the bases and stations as the nodes of their network. Regarding such operational feature, the Chinese regulators, especially CAAC regional administrations and their agencies, execute corresponding oversight responsibilities by the region, which makes it very complicated to coordinate among the certificate administration where a certain air operator’s main base resides, the local administrations where the operator’s bases reside and the local administrations of the stations where the operator flies in terms of oversight task allocation, oversight information collection, information analysis and assessment. On the other hand, the air operator’s SAS is to formulate monitoring programs and collect monitoring information centered on certification management office. The development of such system will be conducive to realize the centralized allocation and management of monitoring tasks as well as centralized analysis and decision-making of monitoring information. The national civil aviation authority’s traditional way of oversight on air operators is to verify the compliance of their system design and actual operation against the regulations by implementing certification and supervision. This focuses on the inspection of the air operators’ compliance with the regulatory procedures, but the traditional oversight seldom collects the information such as the air operator’ s control and measurement of its own implementation of the procedures, and the implementation of the procedure-related authorities and responsibilities. In DOI: 10.1051/ , 03026 (2017) 7120 12 ITA 2017 ITM Web of Conferences itmconf/201 3026 © The Authors, published by EDP Sciences. This is an open access article distributed under the terms of the Creative Commons Attribution License 4.0 (http://creativecommons.org/licenses/by/4.0/). terms of system safety management, the national civil aviation authority also needs to expand the collection of such data 2 Concept and Characteristics of Air Operators’ Safety Assurance System Concept of air operators’ SAS: air operators’ safety assurance system is a safety assurance system that adopts the systematic safety concepts such as system configuration and safety properties to design data collection tools, collect and analyze the information needed to carry out air operators’ safety oversight, update the oversight program, formulate correction requirements and track the operators’ corrective activities. The system, supported by the certification team or the certification management office of the national civil aviation authority, assesses the operator’s safety management status in terms of design and operational performance. The system, via IT platform, realizes the collection and analysis of cross-region and cross-department safety monitoring information on the operator, as well as the centralized allocation and control of monitoring tasks, and centralized and scientific decision-making on operators’ oversight. 3 Framework Design of Air Operators’ Safety Assurance System 3.1 Function of Air Operators’ Safety Assurance System Through air operators’ safety assurance system, the national civil aviation authority may conduct functions of initial certification as well as supervision and inspection on air operators. The national civil aviation authority, on the basis of civil aviation safety regulations, conducts certification and monitoring on air operators, and facilitates them to implement their own safety responsibilities accordingly. The basic oversight process is as follows: at the start of the air operator, the regulator will conduct certification to the operator according to the corresponding civil aviation regulations in five steps, i.e. advance application, formal application, documents review, demonstration and verification, and certificate issuance. The operation certificate and operation specifications will be issued upon acceptance. After the establishment of the operator, the inspectors will, by supervision and inspection, confirm the air operator’s actual operation constantly meets the safety standards for certification. If the operator has substantial changes in its operational scope and operation features, the operator needs to go through the regulator’s supplementary certification so as to ensure that the operator’s operational system meet the regulatory requirements after the changes, and the operation specifications should be revised accordingly and accepted by the regulator during the supplementary certification. 3.2 Framework of Air Operators’ Safety Assurance System To better support the operational certification as well supervision and monitoring, air operators’ safety assurance system set up two closed-loop processes including design assessment process and performance assessment. Within each closed loop, there are five work modules, i.e. system configuration, program management, task management, data collection, analysis and assessment, and action. The five work modules complete the closed-loop management of operational certification and supervision. In addition, after each closed-loop cycle, based on the analysis and assessment. DOI: 10.1051/ , 03026 (2017) 7120 12 ITA 2017 ITM Web of Conferences itmconf/201 3026


Necessity for the Regulator to Construct its Safety Assurance System
As international civil aviation organization promotes the safety management system (SMS) globally, each member state should develop the State Safety Program (SSP) to promote its safety management on civil aviation industry.The regulatory authorities of member states, apart from formulating regulations to require air operators to set up SMS, should also construct their own mechanisms of risk management and safety assurance for their oversight [1] .Air operators' safety assurance system (SAS) is the specific embodiment of the regulatory authorities' safety assurance work on air operators' oversight.
As the target of the aviation safety oversight, air operators vary in their business models and operational scope.Some air operators operate commercial transport with jumbo aircraft and some with small aircraft.Some are civil aircraft maintenance companies.The former two types of companies undertake commercial air transport activities necessary for the economic and social development, and the latter provides maintenance support services for the former two.The overall configuration framework of the regulatory elements applicable to different operators can be developed through the construction of operators' SAS.The oversight may be much more systematic and standardized if we formulate inspection plans for different operators by choosing applicable elements under this framework.
A large proportion of air operators engage in commercial air transport operations, featuring cross regional activities.Air operators have several sub-bases and a number of stations besides their main operational base where aircraft fly to and from the bases and stations as the nodes of their network.Regarding such operational feature, the Chinese regulators, especially CAAC regional administrations and their agencies, execute corresponding oversight responsibilities by the region [2] , which makes it very complicated to coordinate among the certificate administration where a certain air operator's main base resides, the local administrations where the operator's bases reside and the local administrations of the stations where the operator flies in terms of oversight task allocation, oversight information collection, information analysis and assessment [3] .On the other hand, the air operator's SAS is to formulate monitoring programs and collect monitoring information centered on certification management office.The development of such system will be conducive to realize the centralized allocation and management of monitoring tasks as well as centralized analysis and decision-making of monitoring information.
The national civil aviation authority's traditional way of oversight on air operators is to verify the compliance of their system design and actual operation against the regulations by implementing certification and supervision.This focuses on the inspection of the air operators' compliance with the regulatory procedures, but the traditional oversight seldom collects the information such as the air operator' s control and measurement of its own implementation of the procedures, and the implementation of the procedure-related authorities and responsibilities.In terms of system safety management, the national civil aviation authority also needs to expand the collection of such data [4]

Concept and Characteristics of Air Operators' Safety Assurance System
Concept of air operators' SAS: air operators' safety assurance system is a safety assurance system that adopts the systematic safety concepts such as system configuration and safety properties to design data collection tools, collect and analyze the information needed to carry out air operators' safety oversight, update the oversight program, formulate correction requirements and track the operators' corrective activities.The system, supported by the certification team or the certification management office of the national civil aviation authority, assesses the operator's safety management status in terms of design and operational performance.The system, via IT platform, realizes the collection and analysis of cross-region and cross-department safety monitoring information on the operator, as well as the centralized allocation and control of monitoring tasks, and centralized and scientific decision-making on operators' oversight.

Function of Air Operators' Safety Assurance System
Through air operators' safety assurance system, the national civil aviation authority may conduct functions of initial certification as well as supervision and inspection on air operators.The national civil aviation authority, on the basis of civil aviation safety regulations, conducts certification and monitoring on air operators, and facilitates them to implement their own safety responsibilities accordingly.The basic oversight process is as follows: at the start of the air operator, the regulator will conduct certification to the operator according to the corresponding civil aviation regulations in five steps, i.e. advance application, formal application, documents review, demonstration and verification, and certificate issuance.The operation certificate and operation specifications will be issued upon acceptance.After the establishment of the operator, the inspectors will, by supervision and inspection, confirm the air operator's actual operation constantly meets the safety standards for certification.If the operator has substantial changes in its operational scope and operation features, the operator needs to go through the regulator's supplementary certification so as to ensure that the operator's operational system meet the regulatory requirements after the changes, and the operation specifications should be revised accordingly and accepted by the regulator during the supplementary certification.

Framework of Air Operators' Safety Assurance System
To better support the operational certification as well supervision and monitoring, air operators' safety assurance system set up two closed-loop processes including design assessment process and performance assessment.Within each closed loop, there are five work modules, i.e. system configuration, program management, task management, data collection, analysis and assessment, and action [5] .The five work modules complete the closed-loop management of operational certification and supervision.In addition, after each closed-loop cycle, based on the analysis and assessment. 1 System configuration.The operators' safety assurance system uses system configuration function to review the monitoring scope and elements of each operator.The system, targeted at typical air operators, designs the system configuration model of air operators, which divides the operators' major internal systems into six systems, and each system is subdivided into a subsystem and elements.The allocation of the systems, subsystems and elements determines the scope and weight of the oversight data collection.The inspectors may, if necessary, adjust the certification monitoring fields by adjusting and setting certain operators' system configuration.Scenarios that need to set or adjust the operators' configuration include: at the operator's initial certification; when the operator's operational model undergoes a substantial change; in addition, when the government regulator considers it necessary to do so due to other reasons.For air operators with different operational features, based on the above systems/subsystems framework, we may set specific elements of the subsystems.For example: taking a large-aircraft public air operator as an example, its operation control system can be divided into three subsystems of training and qualification, flight operations and maintenance engineering management, flight planning and monitoring, and within each subsystem, specific elements are also set.In addition, at configuration design, for specific subsystems, we can divide elements into three weight categories of high, medium and low criticality according to their significance on operation safety, which will affect the priorities of the design and performance assessment of these systems in the future.3 Task management.After the certification team or the supervisor of the certification management office completes the overall design of the monitoring program via the planning function, they may assign specific certification or monitoring tasks to inspectors in various professions and regions.The time needed for an inspector to complete the corresponding monitoring task can be rationally assessed via the system, which will match the monitoring task arrangements with the inspector's available work time.At the same time, through the task management function, we may review the inspector's profession and training status, and better integrate the assigned monitoring tasks with the inspector's professional qualification, and finally form a detailed task monitoring plan.
4 Data collection.The monitoring tasks, finalized through task allocation function, are carried out by inspectors of specific professionals.An important task of the monitoring is to collect the data of the operator's safety status by monitoring activities.The system provides the inspectors with systematic data tools, among which the most important one is: the element design checklist and the element performance monitoring checklist.
As for the element design checklist and the element performance monitoring checklist, the inspectors collect data for design and assessment by using the questions designed in the checklist for safety attributes monitoring.On the one hand, the government inspectors use them when they conduct design assessment at the time of certification; on the other hand, the government inspectors also use them when they conduct assessment of the operator's systematic design at the time of supervision.At the same time, the operator, as the applicant at initial certification, can also use the checklist for safety attributes monitoring to review their own safety management design in order to have better compliance with the regulations.In the design of checklist for safety attributes monitoring, the system has designed six safety attributes for each monitoring element so as to assess the systematic design related to the air operator.The six safety attributes include: procedure attribute, control attribute, process measurement attribute, interface attribute, responsibility attribute and authorization attribute.Please see the following table for meaning of the six safety attributes.Each element in the air operator configuration corresponds to one of the operational processes of the air operator.The following figure shows that the six safety attributes can be used to carry out the process design and performance assessment corresponding to the elements.5 Analysis assessment and action.Based on the operator's data collected via the data collection function, the operator's safety assurance system will be analyzed and assessed in areas of analysis and assessment module and action module: assess the design and the performance, and take necessary measures accordingly.Based on the risks of the problem and the severance for the government regulators to take action, the results of the design or performance assessment may be divided into the following four scenarios can.

Application Prospect of the Air Operator's Safety Assurance System
The safety assurance system of air operators not only decides whether the operator's operational system meets the regulatory requirements in terms of design and performance assessment, but also identifies major hazards or risks uncontrolled in the existing regulations, which provides an important basis for the revision of the regulations and adjustment of safety oversight policies in the future.
The existing safety oversight model reflects the concept of adopting approaches of design assessment and performance assessment to ensure the operators' operational safety level: at the time of the airline's establishment, the regulator uses operation certification to ensure the carrier complies with the civil aviation regulations' in system design; After the carrier starts operation, the regulator, by supervision and inspection, ensures the carrier's operational safety level meets the standards at the time of the operation certificate issuance; After the certification, the regulator uses supplementary certification to assess the operator's changes to the system.The establishment of the air operator's safety assurance system will enable the regulator to use the design assessment function on the operators more systematically at the time of certification or supplementary certification, and conduct updated assessment on a periodic or non-periodic basis to check whether the system design complies with the regulations and the safety attributes; in addition, when the regulator conducts demonstration and verification as well as the follow-up supervision and inspection of the operation certification, the system's performance assessment function may be used for the assessment of the operational effectiveness.The combination of design assessment and performance assessment embodies the idea of system safety.The system may especially be useful for fairly comprehensive design assessment and performance assessment on air operators that do not update operational systems for years and may, for a long time, focus more on the performance assessment rather than receiving fairly comprehensive design assessment.
The application of the system may be further conducive to air operators' cross-regional regulation.The existing organizational structure of the government's oversight on carriers classifies the oversight responsibilities by geographic regions whereas the operational scope of the air carriers breaks through such segmentation of administrative areas as air carriers operate cross regionally.Thus, supervision or supplementary certification on a single carrier often requires the coordination of several regional civil aviation regulators.Safety assurance system can be adopted to realize the centralized oversight planning, cross-regional and separate implementation of the oversight tasks, standardized collection and analysis of the oversight data, and air operators' real-time safety status so as to take prompt oversight action.

Figure 1 .
Figure 1.Major flow chart of air operators' safety assurance system

Figure 2 .
Figure 2. Configuration: Breakdown of operators' major systems and subsystems2 Planning management.The core of planning management is to determine the priority of the monitoring tasks, to confirm the monitoring areas of special attention by identifying major hazards at the air operator's system level and operational environment level.The system designs 25 risk indicators to assess major hazards at the air operator's system level and operational environment level.The 25 risk indicators are correlated to the systems, subsystems and elements, which enables risk indicators to correlate with the specific monitoring programs broken down from the

Table 1 .
Risk indicators classification

Table 2 .
Description of safety attributes