Santa’s Just Culture

Santa’s Just Culture

By OffRoadPilots

On 15 March, 1960, Santa Claus was on a reconnaissance trip to review his last delivery trip, and verification that he had not forgotten or left someone out this time. Since Santa implemented the SMS (Streamlined Mission Service), he would do a verification trip, or a quality assurance of his deliveries to learn from the past and improve for next deliveries. Since the SMS was implemented, Santa also does triennial travel audits of the operations during the month of March. On this day in March, the reindeers suddenly lost all their flying powers. Santa had been so busy with the quality assurance program and audit preparations that he had forgotten to tell the elves to feed the reindeers that morning, and they ran out of power. This was an embarrassing moment for Santa. He was known all over the world for timely deliveries, safe transportation, except for a few roof-top crashes, and with a unique quality to know what presents people in different areas of the world wants. When the power ran out, all electrical systems also failed, including Rudolph’s red nose landing light. All Santa know at that time was that he was somewhere where it was very cold, very flat and many lakes, so he established a nice three degrees straight in approach into the unknown. 

It was a dark night, but Santa had faith in the reindeer autonomous landing system, which was powered by an onboard emergency-elf who generated power by running on a treadmill. Without lights, without a glideslope and without any visible clues on the ground, Santa prepared for the worst. One hazard Santa had identified in his SMS, was that a total power failure was a real probability and gliding to roof-tops without power was implemented in his new training program. It was the SMS Director, Mrs. Santa who discovered in her accident reviews that many of the roof tops incidents were due to lack of power for the hoof-reversals to assist braking a higher speeds. After many glide-approaches, the reindeers became very proficient in hitting their landing spots. But this time it was dak, which they had not experienced before. Santa and Mrs. Santa conducted their no-red-nose power approach scenarios by fist establishing s risk classification number, a risk analysis for a safety risk level, a root cause analysis and at the conclusion, a system analysis of the approach. 

 

Santa could now see the ground, but he had no manual control of the autonomous landing system, so he buckled up the best he could and prepared for a crash landing. The system worked well and commanded the reindeers to flare at exactly the right time and it was a smooth landing. After all the snow was cleared and Santa was looking around, he could see nothing else by snow covered land. He knew he had landed on a lake, and with his extensive knowledge of world geography, he knew exactly what lake it was. It was actually his favourite lakes for summer fishing, and he had been there several times. He had landed in his favorite narrows fishing spot at 466212.95E, 6089107.56N, 48U. Some years earlier a bush pilot flew him in a float plane to this spot, and the pilot did the worst water landing ever. Santa’s friend who came on the fishing trip was a senator and named the landing the Norwegian landing, since he had spent time in the Norwegian Sea with high waves. Santa jumped out of his sleigh and thanked Rudolph and the other reindeers for their smooth landing. After he had looked over the crash site, he got angry and wanted to punish the responsible elf. Luckily, Santa had a direct elf-to-elf telephone and could instantly communicate with Mrs. Santa. When Santa asked her for the name of the responsible elf, she answered that this is not how we run our Streamlined Mission Service (SMS) in a just culture. She also informed Santa that he was the Accountable Elf, and needed to follow the same process as everyone else when conducting root cause analyses. Santa then understood that he could not change a risk level just by the stroke of a pen, but it required hard work. 

 

Santa has struggled with the just culture principles since they implemented SMS. Just culture is a different behavioral concept and must become lasting habits to achieve positive, sustainable change. Generally speaking, there are two types of organizational cultures. The old way is the blame culture, and the new way is the just culture. The old way blame culture is simply to blame the last link in the chain for the occurrence, lack of competency, incompetent to follow procedures and the root cause for the catastrophic evens. A simple old-way example is when a Santa in training was blamed for a crash when both Santa and the Santa trainee were focused on a hoof-down and locked light malfunction, and failed to stay in the air. The blame culture is simple and easy, but human errors or other negatives are not useful for intervention to improve safety. 

In Santa’s SMS there is a just culture and a place where there is trust, learning, accountability, and information sharing. Santa comprehends the principles that elves nature is to resist changes and that Santa and Mr. Santa must take the very fist step, which starts with an action and not words, text messages or social media shows. A just culture change is to move from known into unknown. Some of the senior elves are in opposition to Santa’s SMS because they do not see their own benefits by changing. There is also uncertainty and insecurity when moving into unknown territories and there is opposition to the way changes to a just culture was presented. Santa’s objective is to instill trust since trust is a key ingredient for a successful change. Trust must be earned, and Santa realized that it cannot be implemented organizational wide supported by any other platform. 

 

Santa implemented four just culture platforms in his streamlined missions service (SMS) system. 

 

Trust

·      Believe in reliability

o   Without trust there cannot be expectations to perform

Learning

·      Self improvements

o   Organizations conduct training, but an individual can only improve by learning

§  Without trust, learning becomes difficult

Accountability

·      Forwardlooking accountability

o   With trust and learning, accountability to tasks becomes possible

Information sharing

·      Learn from others and the past

o   Without trust, learning and accountability there is no valuable information to be shared

 

The sun was rising in the East and finally help arrived for Santa. The rescue crew brought food, dry clothes (a used Santa suit) and tools to repair the broken systems. Santa enjoyed the company talked about the old days and all the landing he did over many centuries on the roof of their homes. This was the first time anyone had actually seen Santa and his reindeers. When the repair was done, the snow was cleared off the ice, Santa wanted to do a taxi-run to feel the condition of the ice surface. However, the repair was so well done, that when Santa reach 70 elves-steps per hour, the reindeers lifted off and he was on his way back to the new secret location since the pandemic. 

Santa arrived at home and had a long conversation with Mrs. Clause, who is the SMS Manager and elves, including their process coordinator. Santa did a root cause analysis, since the incident was a special cause variation, and his opinion was to site electrical failure as the root cause, since that caused the reindeer autonomous landing system. Mrs. Santa opposed strongly, but Santa demanded he had the right as the Accountable Elf to decide the root cause by the stroke of a pen. When the elves heard about the root cause, one of the elves came forward and admitted that he had forgotten to feed the reindeers and that is the reason they ran out of power. With Mrs. Santa’s support to the elves, they proposed the root cause to be the reindeer feeding system processes itself and 40% contributed by organizational factors, when compared to elves-factors (15%), supervision factors (25%) and environmental factors (20%). 

 

Santa reviewed his observations and was glad that he knew the area without relying on the GPS (Genuine Path for Santa) for travel routes. Over several centuries Santa had travelled the globe and visited every home, child and adult in the world and provided them with gift. There were no such thing as good kids or bad kids when Santa delivered. This year Santa had heard rumors that the GTS folks are changing the route to only include the good kids. However, within a Santa SMS system there is a just culture and he plan to turn off the GPS route, use his personal rout knowledge and visit all the kids in the world.  

 

Several years later Santa’s emergency landing on a remote and cold lake was published in the newspapers. The newspaper story was very different from the actual events and blamed the reindeers for the emergency. When Santa read the story, he smiled and felt good about living in an SMS just culture where issues can be resolved and improved.  

 

 

OffRoadPilots

 

Accepting or Rejecting Risks

 Accepting or Rejecting Risks

By OffRoadPilots

Accepting or rejecting risks is a fundamental principle in a successful safety management system (SMS). A person managing the safety management system is expected to maintain a process for identifying hazards to aviation safety and for evaluating and managing the associated risks and ensuring that personnel are trained and competent to perform their duties as they apply to the safety management system. This includes training for both the accountable executive and SMS manager, in addition to other airport and airline operations personnel.

A level of risk is an inherent element of aviation safety and there are several types of risks to consider when accepting or rejecting risks. One type of risk may take precedence over another type even if it is not directly associated with operations. Risk control strategies are beyond accepting or rejecting a risk, it is to justify control actions based on defined criteria. There are five categories of risks. The total risk is the sum of identified and unidentified risks. Identified risks are risks which has been determined through various analysis techniques. A task for the SMS manger is to identify all possible risks. Unidentified risks are risk not yet identified. Some unidentified risks are identified by occurrences, and some risk will never be known. Unacceptable risks are risks that are beyond a limit to what is acceptable to an SMS enterprise. Unacceptable risks may be controlled or eliminated. Acceptable risks are identified risks that is allowed by the SMS enterprise to persist without further engineering actions. Residual risks are the left-over risks after all other options has been fully explored. The residual risk is the sum of acceptable risks and unidentified risks and integrated in airport or airline operations. 

 

Conventional wisdom is that the safety management system is about safety, while the fact is that the SMS is about processes, and how things are done. The expected output of these processes is to eliminate harm and create prosperity. When decisions are based on emotional safety principles, rather than data points of facts, the end result may change risk levels to unknown risk level, or unmanageable risk levels.

The AE is the final decisionmaker to accept or reject risks, system analyses or predictive SMS operations plans. Accepting or rejecting risk is not an authority to deviate from any of safety risk management (SRM) processed, or to base accepting or rejecting on common sense and prior practices. In the past, several practices which were acceptable for an airport operator are unacceptable today within an SMS environment. Airport operators has a responsibility for their airport operations to be compatible with aircraft operations, which is the purpose of an airport. In the past, a NOTAM that a runway was covered with ice or snow contaminants were a sufficient action. However, today within an SMS-world, an airport operator must comply with the airport standards, which includes a friction index requirement, or close the runway. An AE may be the final authority, but when risk acceptances are based on prior practices, both safety in operations, and certificate compliance are jeopardized. Risk acceptance based on prior practices, with the justification that it was done before without incidents doesn’t hold water. In addition, data from prior practices applied to hazard classifications and risks may be outdated. 

 

An easy trap for an AE to fall into is to believe that they have the authority to change a risk level by the stroke of a pen. Nothing can be further from the truth. When an AE wishes to change a risk level, they must follow established processes for root cause analysis, risk assessment and system analysis, which include a signature page that they rejected a risk level advise from the SMS manager. In most organizations, an AE is the President of the company and the business management expert. An AE is not the data analysis expert but is still the person with final authority to change a risk level. Should an AE reject a recommended risk level, operations affected by the hazard in question is paused until an acceptable risk decision is made. On the other hand, an accountable executive has the prerogative to manipulate risk decisions after reviewing other apparent risks, or identified residual risks, and combined exceeds the effect of proposed risk control. 

The role of an SMS manager is not to lower a risk level due to pressure, but to assess mitigation options for assigned risk level, and options for processes to conform to regulatory requirements and acceptable to the AE. A trap for an SMS manager to fall into, is to change the risk level to the demand of an accountable executive. When an SMS manager is a non-employee at a remote location, temptations to manipulate risk levels are reduced. In a just culture there is no personal liability associated with the position of an AE as this individual represents the certificate holder. The certificate holder retains all liability for non-compliance with the regulations. It is crucial to the success of an SMS that an AE works within the just-culture principles of trust, learning, accountability and information sharing when considering recommended risks controls. 

 

A purpose of regulations is to establish operational limits acceptable to the interest of public safety as determined by the regulatory authority. Public safety may be a floating object and change with circumstances. In the aviation industry this became evident during the pandemic period, where regulatory aviation limits were changed to justify the cause of a greater threat to public safety. This makes risk control measures only applicable under the regulatory jurisdiction. Unless there are international agreements, a just culture, or non-punitive policy is not applicable beyond the regulatory jurisdiction. For airlines, an acceptable risk control within its own borders my be acceptable, while the same risk control internationally may be rejected, or in worst case a criminal action. A recent event occurred when a charter flight crew discovered an indication in the cockpit that something was wrong in the avionics bay. During an inspection of the bay, a duffel bags with illegal substances were discovered, and the flight crew reported this to the authorities. Since the crew was outside of the jurisdiction of their safety management system they were detained for seven months.

 

Accepting or rejecting risks is therefore more than just organizational related, it is also related to areas of operations, wherever that might take you. A principle of a successful SMS is that hazards are locally identified.  

 

 

OffRoadPilots

Predictive SMS

Predictive SMS

By OffRoadPilots 

Predictive SMS methods are applied research to entail the development of an expanded and well-organized safety database, as well as the use of predictive, or forecasting methods to identify potential and emerging hazards, trends and behaviour patterns. Using data analysis and predictive methods to identify latent hazards is a tool to prevent future adverse events in operations of any organization. SMS has generated wide support in the aviation community as an effective approach that can deliver real safety and financial benefits. SMS integrates safety concepts into repeatable, proactive processes in a single system. The structure of SMS provides organizations greater insight into their operational environment, including their reactive phase, proactive phase, and predictive phase. A prerequisite for a fully operational predictive safety management system are system analyses. 

 

There are several purposes to operate with a predictive safety management system, and one of these are to move special cause variations into common cause variation for specific operators and locations. A predictive analysis is forecasted expectations as opposed to special cause variations, where expectations are unknown. A predictive analysis is also different from a proactive approach, since the proactive approach is to assume potential hazards, and predictive approach is to analyze known hazards as facts. It is impossible to predict when a hazard will affect operations and cause an occurrence, but it is possible to predict that a hazard will appear in operations within a pre-established time, location, and direction. A predictive SMS does not predict accidents, incidents, or events since the affect of latent hazards are only available with reactive analyses. A predictive safety management system operates within a 3D system and in a virtual moment of the flight, taxi, vehicle operations or other movements. A 3D identification process is measured in time (speed), space (location), and compass (direction). When 3D thinking is applied in a safety management system, future scenarios can be designed with a defined exposure level to predictive hazards.

 

 

Root cause analyses of hazards for specific phase of operations and locations have already been conduced and accepted when operating with a predictive safety management. There is a requirement for the person managing the SMS to analyze and identify the cause or probable cause of all hazards, but this requirement does not extend to identify the cause of every hazard, or the same hazard multiple times. The cause of a hazard needs to be identified once, with subsequent same hazard classification numbers to be monitored in a control chart for pattern and frequency. Note that a predictive SMS is applicable to hazards of same classification number, and not of hazards with similar classifications. A successful SMS operates with a hazard classification system of safety critical areas and safety critical functions within identified areas. 

 

Analyzing birdstrike data in a predictive SMS generates control charts for reliability pattern and frequency. The outcome of this experiment unfolded as the post was written. Data applied in this scenario are from publicly available data for a specific airport between 2010 and 2022. Adding bird observations by airport personnel, tenants or users would enhance the analysis and improve predictive SMS operations. Data are reactive facts, since there are no expected, or assumed data applied in a predictive SMS analysis. 

 

“The X-mR control chart is used with variables data - data that can be "measured" like time, density, weight, conversion, etc.  Like all control charts, the X-mR monitors variation over time.  The X-mR chart will tell if your process is in control (only common causes of variation present) or if there are special causes of variation.  You use the X-mR chart when you have only one data point to represent the situation at a given time.  For example, suppose your company is tracking accounts receivable each month.  You have limited data - one data point a month.  You can use the X-mR in these situations.  You plot the monthly result on the X chart.  You plot the moving range between consecutive months on the mR (for moving range) chart.” -SPCforexcel.com

 

An X-mR variable chart detects special cause variations. The X-mR chart below shows five spikes of special cause variations, or an out-of-control process, between 2010 and 2022. When a special cause variation is identified requires an SMS enterprise to conduct a full-scale Root Cause Analysis. 

When analyzing the out-of-control points, it is noticeable that they occurred during the summer seasons, with the last spike in 2017. What steps the airport took to eliminate special cause variations in 2018 is unknown. Since the main migratory bird routes through the area did not change overnight in 2018, it is assumed that the airport operator implemented changes. If operating with a proactive SMS, an operator would need to conduct a root cause analysis, system analysis and applied a predictive SMS approach to migratory bird behavior. With a predictive SMS approach to   migratory bird travel, systems may be put in place to direct the birds locally away from airport approaches. This particular airport is previously known for changing local bird travel routes by applying the principles of landuse in vicinity of airport, to divert, or eliminate bird activites. Such activities include diverting travel to and from landfills, water reservoirs, or removal of cereal crops in the area. Previous research has identified that bugs are attracted to the blacktop runway surfaces, which again attracts birds. Without any out-of-control points since 2018, it is assumed that a predictive SMS approached fulfilled its expectations.

“A Pareto chart is a data-based approach to determine what the major problem or cause is.  All companies have lots and lots of problems on which to work.  There is not enough time in our day to work on everything.  The Pareto chart gives us a way to determine which problem to work on first – where we will get the most return for our investment.  And the Pareto chart is also a great communication technique as we shall see.

Vilfredo Pareto, an Italian economist, developed the Pareto chart in the late 1800s.  He discovered that 80% of Italy’s wealth was held by 20% of the people.  This has become known as the 80/20 rule or the Pareto principle.  It is at the heart of the Pareto chart.  The 80/20 rule applies in many places – 20% of our customers are responsible for 80% of the customer complaints; 20% of the workforce account for 80% of employee issues.  The Pareto chart is one method of separating that 20% - the vital few – from the 80% - the trivial many.  This allows us to focus our time, energy, and resources where we will get the most return for our investment.”

 – SPCforexcel.com

A pareto chart detects the frequency of hazard classifications. When frequencies are identified, an SMS enterprise may prioritize action plans for classifications with the highest frequencies. In a normal distribution, 20% of events are the cause of 80% of all hazards. 

This pareto chart identifies the months of July, August and September as the months when 73% of hazards are occurring during 25% of the months. For the airport operator, these three months now becomes the target focus area to manage bird activities. For airlines operating out of the airport, these three months become the target focus area for their predictive SMS. However, before jumping to a conclusion to apply these analyses to their predictive SMS, airline operators should approach the airport operator for detailed information about actions applied in their bird and wildlife control program. If no actions were taken by the airport operator, then other factors would have affected the bird activity process to reduce birdstrikes.  

 

In a search it was learned that the airport had implemented corrective actions, and revealed that in 2018 the airport implemented a new bird control system. Here is an excerpt of the news article (redacted): “The airport is pleased to welcome (company) to the airport. The company brings a specialty Falconry Bird Control Program to the airport which augments the airport’s existing wildlife management program. The company provides a service with trained falcons and other species of birds of prey to manage issues that are caused by wild birds in commercial and industrial environments. Bird control falconry is one of the only target specific methods of control which has the minimum impact of the environment and other non-evasive species within it.”

 

With the new bird control system, a new control chart analysis from 2018 was conducted that produced a similar special cause variation result. 

Migratory bird routes are common cause variations in the bird movement process. Their travel in the vicinity of airports or using airport lands as their feeding grounds is integrated into their process. The same birds come back year after year. For an airline or airport operator, this bird activity becomes a special cause variation when affecting the planned air travel or airport operations, since it is not an integrated part of their operations. When a common cause variation is manipulated, or controlled, the outcome may deviate from statistical expectations. As noted in this experiment, when the bird activity process is controlled by falconry, both the reliability pattern and frequency were slightly altered. 

 

The responsibility for improving a process in statistical control lies with management, while front-line personnel may have excellent suggestions on how to do this. Improving a process that is in control may mean changing the average or reducing variation. It is a never-ending process. The system must be changed to improve the process. From the birds’ point of view, their process may now be out-of-control, since a common cause variation was manipulated. The bird control system at this airport changed and monitoring the effect of implemented action verified that the birdstrike counts went down. This is a classical example of how simple, but effective, the concept of a safety management system is. 

With this new information an airline or airport has an opportunity to apply a predictive SMS to their operations. It is not the birdstrike that is predictive, but the bird activity. A root cause analysis can only be conducted of a hazard that the operator has control over, both control over data required for the analysis and control over the corrective action plan. In the bird experiment example, an airline operator has control over publicly available birdstrike data, and they have control over aircraft operations. A root cause analysis may have identified the migratory bird season as a root cause and their control measure may have been to accept the risk, reduce flights to this airport to mitigate aircraft damages, or pause operations during the hours when birds are present. Since an airline is in the business of generating money, it is impractical to reduce, or close down flights due to bird activities. Their own birdstrike data becomes their preferred tool to assess the likelihood and severity in their operations. At this particular airport, with approximately 1.3 mill movements and 5.2 birdstrikes annually, or one birdstrikes per 250,000 movements, any reasonable SMS manager would accept the risk. Zero birdstrike is an unacceptable goal. Both the airport and airline conducted their root cause analyses, their system analyses and is now ready to operate with a predictive SMS. At this particular airport, they continue to track the counts of birds, and birdstrikes, but a root cause analysis is not needed since it is already done for this hazard classification. 

 

A trap that is easy to fall into, when birdstrike numbers, or any hazards are low, is to reduce or eliminate current mitigation processes. The return of investment (ROI) in an SMS is inverted, with relatively higher investment and fewer occurrences returned. Most often justification for changing the mitigation process is due to cost and the low number of hazards. A Canadian airport voluntarily gave up their airport certificate a while ago since that allowed them to change their mitigation processes and eliminate their safety management system. Just this month they experienced what this trap could cause, by operating without an SMS, which also includes a plan of construction operations. “A privately registered Cessna P210N from (airport) to (airport) was taxiing on the hangar line and fell into an unmarked 3-foot wide strip where the pavement was taken away. The front wheel fell 4 to 5 inches into the construction area. There was propeller damage and engine damage to the aircraft.”

 

 

 

OffRoadPilots

Remote SMS Manager

 Remote SMS Manager

By OffRoadPilots

The person managing the SMS (SMS Manager) for an airline or airport has more opportunities to positively affect safety processes in an organization when there is a physical distance between the operator and SMS Manager. For the integrity of an SMS program, the person managing the SMS is expected to report directly to the Certificate Holder (CH) and remain independent and separate from both airline and airport operations. 

 

It is the CH who appoints a person to manage the safety management system, it is the CH who appoints the Accountable Executive (AE), and it is also the CH who maintain the safety management system. The CH is also the operator, or the operator my be any person in charge of operations, whether as employee, agent, or representative of the CH. The two executive positions as AE and SMS Manager play unique roles by their appointed positions to remain independent of airline or airport operator and preserve the integrity of the SMS. The CH appoints two positions to be responsible for meeting the requirements of the regulations on behalf of the certificate holder. Since their roles are to ensure regulatory compliance, these positions are at equal level in an organisation chart. That an SMS Manager is required to make progress reports to the accountable executive at intervals determined by the accountable executive is a component of the SMS and is not an organizational hierarchy position. However, the AE is the final authority for meeting the requirements of the regulations on behalf of the CH.

The Quality Assurance Program (QAP) is component of the SMS and maintained by the CH. The QAP Manager is not an appointed position by the CH but is an administrative position under the SMS Manager to manage and facilitate QAP responsibilities. By placing the QAP under control of the person managing the safety management system, the program’s integrity is achieved by its independence from the operator. A quality assurance program includes an audit function that consists of an audit of the entire quality assurance program carried out every three years, or a series of audits conducted at intervals set out in a controlled manual to be fully completed triennially. This audit function is performed by an operational independent source and by a person who is not responsible for carrying out operational tasks. An operator does not collect and assess data and performs an audit of its own performance unless the risk is accepted by the Regulator due to size, complexity, and nature of its operations. 

The role of an SMS Manager is to implement a reporting system for the timely collection of information related to observations, hazards, incidents, and accidents. Effective SMS Managers collect data in a timely manner and maintain safety compliance oversight by electronic means, rather than by unreliable paper documents.  An SMS Manager identifies hazards and carry out risk management analyses of those hazards. They investigate, analyze, and identify the cause or probable cause of all hazards, and also identify the root cause of special cause variations. SMS Mangers are required to implement a safety data system, by either electronic or other means, to monitor and analyze trends in hazards. The purpose of data collection and trend analysis in SMS is not to find errors, but to collect data to analyse how the system works compared to its expected outputs. As an example; checking the oil level, tire pressure, or adjusting rear-view mirrors in a vehicle is data collection to learn how a system function, and is not data collection to find errors. In addition, SMS trend analyses must be done within an SPC system (Statistical Process Control) which is not based on opinions or emotions caused by any graph charts. I often hear the phrase: "it is nice that the graph has a downward trend” A downward trend could be a latent hazard ready to explode, or it could be a safety improvement. One does not know if it is a safety improvement or not just because the graph is trending downward. An invaluable program to use is to apply p-control charts and xmr-control charts. These two control charts supplement each other with performance (80/20 rule) and timely delivery (UCL - LCL). A primary responsibility for an SMS Manager is to monitor. SMS Managers also monitor and evaluate the ongoing results of corrective actions, monitor the concerns of the civil aviation industry in respect of safety, and determine the adequacy of the training required. Monitoring is achieved by collecting data daily, or more frequently due to size and complexity, and applying control charts to identify drift in operations. Every role and responsibility of an SMS Manager has already been established as a remote function, even if operations and safety share the same office. 

The safety management system in aviation is a product of a continuing evolution in aviation safety. Early aviation pioneers had little safety experience, or practical experience to guide them. Over the years, each reactive approach to occurrences has led to significant gains in safety. However, even with these significant advances, the term "organizational accident" was developed to describe that accidents are related to organizational decisions and attitudes. SMS is an approach to improving safety at the organizational level. A superior SMS Enterprise applies this concept and include system analyses to examine its operations, its impact on sub-systems, and the effect of decisions implemented. SMS allows an organization to adapt to change, increasing complexity, and limited resources. SMS is also about enhancing organizational policies and processes, the organizational culture of leadership management and forward-looking accountability. 

 

The role of a person managing the safety management system is about processes, and to what level operational processed conforms to regulatory compliance, standard compliance and their safety policy. Since it’s all about processes, an SMS Manager located off-site has greater opportunities to analyze processes independently of operations. A pre-SMS process only expectation was that a safety officer had unlimited powers to fix all unsafe conditions and to make stern statements of the issues. The pre-SMS culture is still alive in SMS organizations, and with the SMS Manger in the office every day, there is a temptation to just “say hi” and ask for an immediate fix. With the SMS Manager at a remote location, this temptation is removed, and the SMS manager has more time to focus on processes. In a successful and effective SMS Enterprise, the person managing the SMS is a confidential adviser to the AE, located in a physical remote location from the operator, independent of operations and is without bias ties to oversight and management by an SMS Enterprise. In other words, a successful SMS Enterprise are using expertise services of a contracted SMS Manager, just as they are contracting other expertise third-party services. This enables the SMS Manager to freely, and without interference, to establish unbiased processes to be presented to the AE for acceptance or rejection. If rejected, the AE must alter identified processes to their own liking, and sign-off in a risk assessment, or system analysis, that the recommendation by SMS Manager was rejected. 

One reason for a safety management system to go off the rails, is that emotions are applied to safety, rather than data, facts and processes. A remote located SMS Manger has a-million more opportunities to successfully keeping SMS on track, than what an in-office employee has.  

 

There are three tools that an SMS Enterprise cannot effectively function without: The SMS Memory Jogger for out-of-control tests, SPCforexcel to analyze trends in performance and delivery, and SiteDocs as an electronic data collection tool.

 

 

OffRoadPilots

System Analysis

 System Analysis

By OffRoadPilots

A System Analyses is Safety Risk Management (SRM) and is the highest achievable level of a successful Safety Management System (SMS). Systems analysis is the process of studying a system and its interacting systems. System analysis projects are fundamental to define problems or issues, discover opportunities for incremental improvements, and to publish directives or operations plans. System analyses are what makes the SMS a common-sense approach to incremental process changes

When applying safety risk management an SMS enterprise conducts system analyses for implementation of new systems, revision of existing systems, development of operational procedures, and for identification of hazards or ineffective risk controls. When conducting a system analysis, an SMS enterprise considered function and purpose of the system, the system’s operating environment, an outline of the system’s processes and procedures, personnel, equipment, and facilities necessary for operation of the system maintain processes to identify hazards within the context of the system analysis. 

 

The context of a system analysis is the circumstances that form the setting for an event or observation in terms of which it can be comprehended and assessed. A system analysis is more than checkbox completion, is a comprehensive task to analyze details of how each system interacts with other systems within the analysis. A system analysis includes analysis of common cause variations but excludes special cause variations from the analysis. A common cause variation is a variation required for the system to function as intended. Common cause variations are controlled and managed for the process to produce a desired output. The difference between an intended output and desired output is that an intended output is a process where common cause variation is without control action, and a desired output is a process with a control action applied. 

The vast majority of issues come from common causes of variation, due to the way processes are managed on a day-to-day basis. If special causes of variation are present, a root cause analysis mut be conducted to identify the issue and for a process to change course of action. The only effective way to separate common from special causes of variation is through the use of SPC control charts. A process is in statistical control when only common cause of variations are present and this is determined by examining SPC control charts. When there are no points above or below the upper and lower control limits and without trends, then a process is said to be in statistical control.

 

For a system analysis to be effective and make a difference, an identified hazard is within the context of the system analysis. The context of an analysis is the area, or segment of operations affected by the event or observation. A new gate assignment at an international airport may affect flight operations, dispatch, and maintenance, while a new parking location for a single engine freight carrier, the pilot might be the only context of a system analysis. 

 

Within a safety management system there are five generic features to characterize a SMS. There is a comprehensive systematic approach to the management of aviation safety within an organization, including the interfaces between the company and its suppliers, sub-contractors, and business partners. There is a principal focus on the hazards of the business and their effects upon those activities critical to air operations or airport safety. In addition to the safe operations of aircraft or airport, there is full integration of safety considerations into the business, via the application of management controls to all aspects of the business processes to safety critical areas. It is crucial for the success of an SMS that there are active monitoring and audit processes to validate that the necessary controls are in place, and to for a continued commitment to safety. The fifth characteristics of an SMS is the use of quality assurance principles, including improvement and feedback mechanisms or tools. 

An SMS enterprise must operate with a process to identify hazards and associated risks, analyze risks, and develop new risk controls that affect multiple processes, or hazard owners, within its organization. A final risk acceptance may be made at a management level above the process owner, by a committee, or by the accountable executive. Processes may be decided by the process owner, while policies are decided on management level. A comprehensive system analysis requires technical knowledge of areas within the context of the analysis and how identified hazards affect those areas. 

 

A system analysis is an invaluable tool when maintaining a safety management system. At the time of the SMS phase-in implementation, operators were required to conduct a gap-analysis, which is very different from a system analysis. System analyses are ongoing and applied at stages parallel to the process flow. Processes in an SMS system is to operate pursuant to a safety management plan, maintain documentation management, safety oversight, training, quality assurance and emergency response preparedness. For each one of these SMS sub-systems, or components, a system analysis is conducted and applied to air operations or airport operations prior to a complete system analysis of the SMS. 

 

Audits are prerequisites for a full SMS system analysis. Audit results are unbiased, they are based on facts and paint a true picture of operational processes. Each system, or sub-system audited, becomes an independent system analysis. At the conclusion these systems are combined and will paint a picture of flaws in the operations, or paint a picture of an operation where common cause variations are managed and controlled.   

 

 

OffRoadPilots