The Seven Lines of Defence Of An SMS

 The Seven Lines of Defence Of An SMS

By OffRoadPilots

A Safety Management System (SMS) must be effective to conform to the regulatory performance requirements to have in place a process for reviewing the safety management system to determine its effectiveness. A general definition of effective is a process that is successful in producing a desired or intended result or fulfilling a specified function. SMS is a simple concept to operate within a just culture where there is trust, learning, accountability, and information sharing, while determining effectiveness of the system includes several tasks and processes to capture data relevant to effectiveness. SMS in itself cannot fail since it paints a true image of the enterprise. What can fail is trust, learning, accountability, and information sharing to operate within a just culture. As with any effective system, unless there are lines of defence in place, the system is not an effective system. There are seven lines of defence in an effective safety management system. It is difficult to detect failures or errors when aircraft and airport operations were safe prior to implementation of the SMS. Aviation was actually said to be the safest mode of transportation with acceptable levels of accidents with fatalities. Since then, SMS was implemented by a regulatory requirement, but no changes were made to operations, since it was safe in the first place. 

 

In a business organization the lines of defence follow the same lines as their hierarchy pyramid, or organizational chart. In this type of organizational structure, it is expected that persons on the bottom of the chart make several mistakes, it is also expected that their managers catch some of their mistakes and that the middle managers catch more mistakes. At the top of the pyramid is the hero who catches all other mistakes. Then, just to be sure that all mistakes are captured, caught, or identified, they bring in a third-party auditor, or the regulator comes for an inspection and issue findings. Civil aviation inspectors with a delegation of authority from the Minister are the only persons who have the authority to issue regulatory findings. Everything else are opinions and observations. 

Lines of defence are within the system itself

There are seven lines of defence within the SMS system itself and each defence system are performed daily. A principal role of an accountable executive (AE) is to be responsible for operations under the certificate and accountable on behalf of the certificate holder for meeting the requirements of these regulations. Their roles go far beyond having control of human and financial resources, which is only a condition for acceptance and not an operational requirement. Their operational requirement is to ensure that every process within the SMS enterprise conforms to regulatory compliance. Lines of defence within an SMS are the regulatory conformance level of any operational tasks in an airline or airport operations. These lines are not governed by the organizational hierarchy to catch errors or mistakes, but within a balanced system each spoke in a wheel are the lines of defence. Data is an external source, it is neutral, it is not biased, it has no agenda, and it flows into an SMS enterprise minute by minute. This data may not be observed, captured, or analysed, but it is still flowing into the SMS system as an unnoticeable background application. Data captured by an SMS enterprise is processed into information, which is the foundation of their lines of defence are building on.

 

Data is entering the safety management system via the information entrance. This is the only external gate to and from the outside world. Data may be flowing within the SMS enterprise, but it has no consequences or usage until it is captured and processed into information. Data is often associated with hazards but does not exclusively equal hazards. Conventional wisdom of an effective SMS is that there are processes in place to capture hazards. A component of an SMS is that an enterprise has a process for identifying hazards to aviation safety and for evaluating and managing the associated risks. While it is true that an unidentified hazard is a risk and a potential trigger for an incident, it is also true that by focusing on hazards only, other elements of data is floating by undetected. Another component of an SMS is to monitor results, or drift, of corrective actions. Recognizing drift is only possible when data of actual result or output is compared to the expectation of a corrective action. Capturing data of how a job is expected to be performed is a critical skill when observing processes for drift. 

The answers to safety are within the numbers of PI

Information comes in different shapes and forms but needs to be recorded to be useful to an SMS system. An example could be an odor which is processed to information by the sese of smell and indicating a fire. This data needs to be documented and submitted to the SMS as a hazard or incident report. Information is received by the five human senses, taste, sight, touch, smell, and sound. Data may come in the form of a taste or smell if fuel is spilled. It comes as a touch when an item is dropped on a foot, or as a sound when an item is dropped. Data also comes as sounds during training, conferences, or telephone calls. Data comes as sight when observing a hazard, a text document, flight operations, or watching a video. Most of the data does not arrive as a text in written format, but as an observation and informal delivery. Information is the first line of defence since it opens the floodgates to design and development. 

 

Information is processed to knowledge. With knowledge millions of opportunities comes alive. Knowledge is both theoretical and practical of how data may affect an event or causing an occurrence. Knowledge is also a prerequisite to perform tasks. Both a pilot and aircraft mechanic need to have aircraft knowledge. While it is different knowledge required, their task, or job performance is critically dependent on their knowledge. Knowledge is also power. In a conventional organizational hierarchy knowledge at lower levels may be viewed as a threat to the higher levels. When knowledge is in the spokes of a wheel, it flows independently of the organizational structure. Knowledge is the second line of defence since it is a prerequisite for the other lines of defense. 

 

With knowledge a person has a tool to comprehend systems and processes. Not only individual systems, but integration and interaction between related and unrelated systems. Comprehension is a 3D environment and measured in time (speed), space (location), and compass (direction). Comprehension is not to predict the future, but to have the ability to place yourself in the moment prior to an incident and to view the future without applying the known outcome. Comprehension is a line of defence since it recognizes process deviations, or processes predisposed to incidents. 

 

Data, information, knowledge, and comprehension are prerequisites for information sharing, which is an additional line of defence. Another component of the SMS is that there are processes for sharing information in respect of hazards, incidents and accidents among aircraft operators and an airport operator. Information shared is not assumptions or unverified, but information comprehended by the person sharing it. As example, it is difficult for a non-SMS person to share SMS information, and it is difficult for a non-pilot, or non-mechanic to share aircraft information. Information sharing may flow on the wheel to any of the other lines of defence. 

 

With data, information, knowledge, comprehension, and information sharing it is possible to gain a persons’ trust. Without trust there is no just-culture or a safety management system. Trust is an assured reliance and repetitious acceptance behavior when an event could cause retaliation against a person. Trust is not just to apply a non-punitive policy but is also a behavior to unconditionally accept facts and outcome. Trust is also a line of defence. Without trust an SMS enterprise is relying on threats to learn what they want to learn, and not what they must learn. 

The line of defence of learning is an incomprehensible component in an organization where learning is viewed as a tool to acquire knowledge. There are still aviation operators who are viewing learning, training, courses, and seminar as busy time, or as an excuse to be recused from the job. Learning is as much of a job performance as the job-task itself. As a line of defence, learning is a component to capture deviations and alternations.

 

Forward-looking accountability is not to know the outcome but to apply a behavior

Accountability as a line of defence is a forward-looking accountability. When a person is held accountable it implies that the person intentionally committed a behavior leading to an unpleasant outcome or result. Accountability within an SMS is forward-looking accountability when a person is accountable to the future of their job performance, their training and expectation of outcome. Accountability is not to foresee the future or avoid errors, but it is to perform job-tasks to the skill of training and expectations. If an expectation is established beyond a skill requirement, accountability is to inform that there is a link between training and job performance expectations. As the wheel comes together with seven spokes of lines of defence and each line links to the rim, these lines of defence flow along the rim in any direction, and to and from the SMS enterprise hub. 

 

Remember; If you don't design your own line of defence plan, chances are you'll fall into someone else's plan. And guess what they have planned for you? Not much.

 

OffRoadPilots

When does a “mistake” become CRIMINAL?

 When does a “mistake” become CRIMINAL?

By Dennis Taboada, M.eng.,CQE,CQM

This past week a jury convicted a former Nashville nurse of reckless homicide and impaired adult abuse  after she was accused of inadvertently injecting a patient with a deadly dose of a paralyzing drug. RaDonda Vaught, 38, was indicted in 2019 on two charges – reckless homicide and impaired adult abuse – in the death of Charlene Murphey at Vanderbilt University Medical Center.Murphey, 75, died on Dec. 27, 2017, after being injected with the wrong drug. This was a terrible tragedy and certainly there is plenty of blame to go around. 

Former Nurse RaDonda Vaught

When does a “mistake” become CRIMINAL?

Of course there needs to be reparations for the family involved. I support the right to sue for “malpractice.” The nurse in this case did not try to hide or cover-up what she did. I guess we need to define what a “Mistake” or “Error” is. According to Merriam-Webster Dictionary: “a wrong action or statement proceeding from faulty judgment, inadequate knowledge, or inattention.” According to Atlanta Attorney Alex Freeman, “The difference between a mistake and a criminal act is “WILFUL INTENT.”  If there is no “wilful intent” then there is no crime, but there are legal liabilities. According to an NPR article While Vaught's defense acknowledged the tragic nature of Murphey's death, her attorneys argued that her mistake was not a conscious, criminal act of homicide.

"What struck me most about RaDonda Vaught's interviews was not her honest recitation of the facts ... but her genuine worry and concern about Charlene Murphey and concern for her family," defense attorney Peter Strianse said during the defense's closing statement Thursday. "She was not thinking about herself."

 In a Safety Management System, SMS, we have an important element called NON PUNITIVE REPORTING. What does Non-Punitive reporting mean? In order to continuously improve, we need to know what is happening in our “SYSTEM.” The good and the bad. If we punish someone for “self reporting” and error or mistake they made, we create an environment where people are “Fearful” to report any incidents or hazards. It is bad enough for employees to receive administrative discipline, but when you cross the line to “criminal” you now create a very Toxic environment. I would add that this criminal threat to employees would lead to a much more dangerous environment because nurses/doctors will NOT act in situations that may save a person’s life in fear of being arrested.

What makes this case even more ominous is the fact that there was no autopsy performed. so there was no objective proof that the drug mistake was the cause of death. My question here is this: 

What happened in the “SYSTEM” to cause this accident?

The "SYSTEM" Forces as defined by Dr. W. Edwards Deming

Dr. W. Edwards Deming, “The system is responsible for the outcomes. NOT the people.”  Why did nurse RaDonda make this mistake? Let’s look at the Deming “system” forces that may have affected her judgement.  Machines, Material, Methods, People, Environment. There may not be machines involved, but the Material: Was it properly labeled? Was it identified properly to the patient? Methods: Is there a procedure in place for administering medication? Was the procedure followed? People: How many people did this medication pass through? Why didn’t others catch this mistake? Was there proper training given to administer drugs? Environment: Is the nurse working in a pressured environment? Is the Management supportive or toxic? We must examine the “System!” If the nurse is held criminally liable, why is not the management held criminally liable as well?

THE RESULT OF THIS RULING

Janie Harvey Garner, Founder of "Show me Your Stethoscope"

Janie Harvey Garner, the founder of Show Me Your Stethoscope, a nursing group on Facebook with more than 600,000 members, worries the conviction will have a chilling effect on nurses disclosing their own errors or near errors, which could have a detrimental effect on the quality of patient care. "Health care just changed forever," she said after the verdict. "You can no longer trust people to tell the truth because they will be incriminating themselves."

 

Certainly, nurses and others in the medical and pharmaceutical professions are going to think twice about reporting any mistakes or errors. Many will now refuse to make decisions without some sort of legal personal liability waiver. Before this ruling, Nurses would fall under the malpractice umbrella of the hospital or doctor. Yes there certainly need to be lawsuits. There needs to be a system to compensate the injured. This is the purpose of malpractice insurance. What is criminal prosecutions going to do to patient care?  Will criminalizing mistakes improve the Patient Process? As a society, we are driving in Fear to our medical workers. How can they work with this “gavel” hanging over their heads?  Yes, mistakes are going to happen! We need to learn from these mistakes and not merely BLAME the person. Management is responsible for the medical System and should be constantly evaluating processes to look for variations that may get out-of-control. By blaming the person, we let the same broken system continue and  most certainly contribute to future tragedies.  

Dennis Taboada, M.eng.,CQE,CQM

Note: Janie Harvey Garner is the sister-in-law of Dennis Taboada, author. 

Your SMS Conversion Rate

Your SMS Conversion Rate

By OffRoadPilots

Within the world of a Safety Management System (SMS) the task is to identify desired outcomes in operations for both airlines and airport operators. The SMS regulations are performance based, and in a performance-based environment it is crucial to success that goal strategies are researched, designed, developed, and carried out. SMS are building blocks of data, information, knowledge, comprehension, triggers, tasks, oversight, and monitoring. What makes SMS different than tangible project, such as an apartment complex, is that the building blocks within a safety management system are abstract without tangible or physical dimensions. Without physical or measurable limits or perimeters, it becomes a difficult task to assess performance value of the SMS itself.  

Performance is a system in harmony with itself.

Elements of a safety management system are performance goals and a means of measuring attainment of those goals and processes to develop and maintain performance parameters that are linked to goals and objectives. Parameters are defined differently if applied in a technical environment, to mathematics, or statistics. However, its common core is that a parameter is any characteristic that can help in defining or classifying a particular system. Parameters within an SMS are characteristics classifying each sub-system within the SMS itself. Parameters are also different from perimeters. A perimeter establishes a physical boundary which a system must remain within. Going back to the apartment complex, these buildings must remain within established boundaries. Look at parameters as challenges and perimeters as task. A parameter establishes opportunities, challenges, or objectives, while perimeters within an SMS system are task performed to move in a desired direction.  

 

It is just as important to know what parameters are not, as it is to know what parameters are. At an airport a parameter is not the number of runway edge lights failures in a year, or the number of safety discussions held with airport tenants. For an airline, a parameter is not how many runway excursions they had, or the number of flat tires upon landing in a year. The reason these are not parameters is that they are applicable to operational tasks, or objectives, such as maintenance or training, and are not applied to operational challenges, or goals, such as an established quality assurance program. A parameter applied to these conditions would be a daily quality control program with a defined purpose to monitor the daily operations of both acceptable and unacceptable performance. A parameter does not assess for unacceptable performance only, but for the whole system itself. On the other hand, a perimeter assesses only for unacceptable performance when a system exceeds beyond its physical limits, or perimeter, and reports only when a runway edge light is burned out.    

Performance of a timepiece without parameters are unidentifiable events.

Parameters are pre-defined within the operational management of an SMS system. A safety management system has process in place to develop and maintain performance parameters that are linked to goals and objectives, which forms the basis for a performance analysis. This analysis in not how many failures there were over a period of time, but how well, or poorly, they system itself performed. In aviation weather is what has the most impact on operational reliability. 

There are operational performance reasons why METARs are published hourly and TAFs are published several times per day. For an airport operator these weather parameters affect their level of success to in operational performance. An airport cannot do anything about the weather, but their response, or reaction to the reports and events are critical to their success. An airport’s pre-defined performance parameter, or challenge or goal during a heavy snowstorm could be established within their quality assurance program for the airport to maintain operational status. Other airport operations parameters could be to maintain a FOD-free runway prior to each arrival and departure, or maintain runway markings to maintain ongoing compliance with the standards, or runway edge lights to meet illumination and operational standards. These parameters, challenges, or goals for an airport operator triggers objectives to execute tasks, or defined perimeters of what, when where, who, why and how to collect data and establish records for an analysis of performance parameters. 

 

A requirement of the quality assurance program is to include a process for periodic reviews or audits of the activities and reviews or audits, for cause, of those activities. The beautify of a quality assurance program is that after a comprehensive line-item audit, an SMS enterprise has a wealth of information to use in their strategic planning of goals with associated objectives and processes. 

 

Parameters within an SMS is to assess how an SMS performs as data collection tool, information development system, conveyor of knowledge, and as an overall system comprehension platform. SMS parameters is to measure the value of what percentage of personnel buy-in, or unconditionally accept and support the SMS as their environmental culture. While it is true that parameters are numerical values, they are not values of failures, or occurrences, but numerical values of what percentage level an SMS has the capability to identify prospects, or challenges and the conversion rate needed to master these challenges.  

 

 

OffRoadPilots

Is Aviation Risk Assessment really “VooDoo?”

Is Aviation Risk Assessment really “VooDoo?”

By Dennis Taboada, M.eng.,CQE,CQM

Coming from a strictly Quality Assurance, QA, background, both education and vocation, I have been engrained with the concept of “OBJECTIVITY!” All analysis and action must be based on DATA and ACCEPT/REJECT criteria. When I was first introduced to the process of Risk Assessment, RA, using a risk matrix, my reaction was, “Are you kidding me?”  The Risk Assessment was mostly based on OPINION and SUBJECTIVITY of the team conducting the Risk Assessment session.  The result of the Risk Assessment was a numerical RISK RATING based on the OPINION of a safety committee. Depending on the composition of the Risk TEAM, the Risk Rating can change to meet the objective of the company. I say that this process itself is a “RISK” to SAFETY!  Hey, at least the process is using the QA concept of  TEAMING!  

Risk Assessments are Subjective

In 2003, Sol and I were contracted by NASA at Kennedy Space Center to Design, Develop and Deploy Quality Assurance Training for all NASA Safety and Mission Assurance personnel. This was the first time I was introduced to the NASA Goddard Risk Program. 

Dennis and Sol Taboada Contracted by NASA at Kennedy Space Center

The NASA Goddard Space Flight Center (GSFC) Risk Assessment Tool is based on the Quality Assurance concept known a Failure Mode, Effects, and Critical Analysis, (FMECA).  FMECA was originally developed in the 1940s by the U.S military, which published MIL–P–1629 in 1949. By the early 1960s, contractors for the U.S. National Aeronautics and Space Administration (NASA) were using variations of FMECA under its Risk Assessment Program.

When Sol and I were first contracted by Transport Canada to help design and develop QA training for the CAR 107 Safety Management System, SMS, deployment to 705 carriers, I mentioned FMECA as a more “objective” means of risk analysis.  The idea was promptly rejected, why?  I touched upon the “3rd Rail” of risk in Aviation:  MONEY!  The Goddard Risk Matrix includes “cost” and “scheduling” as factors!  No way could cost be considered as part of “SAFETY” in aviation! 

Another division of the Quality Assurance science is something called, “Cost of Quality.”  That was a misnomer because the actual process determines the cost of “NON-QUALITY.”  Why can’t we have the “COST OF NON-SAFETY” in SMS?  This is a discussion for future articles. 

Is it possible to use the FMECA concepts to help “Objectivize” Risk Assessment even without cost factors? The answer is YES! We can use the actuarial Failure rate formula:

lambda = ln( 1 – pf )/- time

Where lambda represents the density of occurrences within a time interval, as modelled by the Poisson distribution. We can us lambda as “Failure Rate.” 

Where is our DATA for calculation coming from?

In Aviation Risk Management, we are required to have a “HAZARD REGISTER” in which we categorize the Hazards and Incidents. By simple modification of the Hazard Register categorization cells to include a probability calculation, we can now obtain objective probability numbers that can be introduced into our every day Risk Assessments through a modified Risk Matrix. Let’s face it, We use the Risk Matrix to create our Safety Risk Profile that drive our Safety Goals and Objectives.  Then why can’t we use the Hazard Registry to provide Quantifiable information for our Risk Matrix? At least this would make the PROBABILTY side of the RISK MATRIX more OBJECTIVE. The SEVERITY side can also use the “MODE” and “EFFECT” components of the FMECA to quantify the “Effects” of an incident or hazard based on history. 

Yes I know this is going to raise questions in the AVIATION Safety world! Why can’t we bring together the science of Quality Assurance into the world of Safety Management Systems to provide better “Processes” that can actually make Aviation Safer and more efficient? Without the Voodoo!

Dennis Taboada, M.eng.,CQE,CQM

For more information:  Request Training from  dtiquality.com. 

 

SMS Is A Business Approach

 SMS Is A Business Approach

By OffRoadPilots

A Safety Management System (SMS) is a businesslike approach to safety as a dedicated, planned, and systematic approach. In a business, a financial audit is an objective examination and evaluation of the financial statements of an organization to make sure that the financial records are a fair and accurate representation of the transactions they claim to represent. An audit of a Safety Management System is no difference than a business audit. 

Every day starts with a blank sheet of paper.

An SMS includes a general journal, or a data collection tool, where each transaction, or events are entered in order of time and date. The daily quality control tasks performed are credits, and the daily quality control tasks required to be performed are debit entries. The general ledger in an SMS summarized all the journal entries of an account to get the ending balances, where each daily quality control task is its own account and number of tasks performed are compared to the number of tasks required to be performed for that account. As an example, an airport operator is required to conduct runway inspections (an SMS account). Smaller airports may do a daily inspection, while larger airports may do an inspection every eight-hours, or an inspection prior to each departure or arrival. Each airport has defined how many inspections are expected to be performed daily and at the end of the day inspections performed are summarized and should be equal number of inspections required for that day. Any differences must be identified and recorded. Accounts are recorded in the daily rundown of accounts sheet.  

A purchase journal in a business is a special journal used to record purchases on credit, or payable to a supplier. The supplier is the operations itself, and any daily operational tasks are the purchases. The purchase journal of a Safety Management System is the register of safety critical areas, where each event is assigned a purchase value, or a hazard priority level, and identified by a number in a numeric value system as safety critical areas and the safety critical function of that area. As an example, a grocery store may have an isle of laundry detergent, i.e., safety critical area, and a supply of a specific brand, i.e., safety critical function, with a hazard priority level 7. An airport may have the runway identified as a safety critical area, with runway 04/22 as a safety critical function, with a hazard priority level 5. Tasks are purchases since they are both proactive and reactive to an occurrence as a mitigation of safety. It is expected that at the time a report is received the immediate corrective action, or avoidance action is completed. The priority level action is the time to initiate a policy corrective action plan. It took several years to finalize a regulatory runway end safety area after a large aircraft overran the runway, the immediate corrective or avoidance actions were already implemented at time the occurrence report was received, at which point it was decided to move forward with a regulatory requirement. 

Business success is in the sales.

A sales journal in a business is a special journal used to record sales on credit, or payable by a customer. The customer is also the operations itself, and any daily unexpected events, or occurrences are the sales. The sales journal of a Safety Management System is also the register of safety critical areas, where each occurrence is assigned a sales value, or a hazard priority level, and identified by a number in a numeric value system as safety critical areas and the safety critical function of that area. As an example, a grocery store may experience an occurrence where a stack of water supplies, i.e., safety critical area, is unstable and falls, i.e., safety critical function, with a hazard priority level 2, to initiate a policy action response. An airline may experience a taxiway occurrence identified as a safety critical area, and a wing-strike classified as the safety critical function, and priority level 5. Occurrences are sales since they are not time specific pre-identifiable. 

Commonly applied hazard priority level action times are: level 1 (immediately) level 2 (24 hours), level 3 (7 days), level 4 (28 days), level 5 (90 days), level 6 (12 months), level 7 (indefinite). 

Businesses produce financial statements (i.e., income statement, balance sheet, cash flow statement, etc.) to provide information about their financial performance to stakeholders, such as investors, employees, banks, regulatory bodies. In comparison, an SMS Enterprise produces safety statements, (i.e., statements of occurrences, balance statement of expected outcome to actual outcome of processes, data collected of daily tasks and events, etc.). Both systems are systematic oversight and operational management approaches. 

The first step for a comprehensive audit of an SMS Enterprise is the regulatory compliance step. Regulatory compliance is the bases for all operations. There are no activities, actions, tasks, or events at an airline without an operating certificate, or at an airport without an airport certificate, or a pilot, dispatcher, or mechanic without their certificates. As always, there are exemptions to the rules, as written in a book of an airline pilot who flew for thirteen years without a pilot license. However, an audit would have discovered the discrepancy. 

An audit of regulatory compliance is a line-item audit of all required regulations to maintain a certificate, standard compliance requirements and audit of manuals requiring approval by the regulatory oversight body. Each line-item of a regulatory compliance audit are transactions required to break even. If a business or an SMS Enterprise does not break even, they are very soon eliminated from operations. Compliance with regulatory requirements is described in operations manuals. Some operators are referencing the regulation paragraph in their manual for compliance made easy. For the appointment of an Accountable Executive (AE), an operations manual contains a flowchart to determine how an AE could be selected. 

The flowchart itself is a document showing how an operator maintain regulatory compliance, while the input of the selection process, including supporting documents is how the process an operator is applying conform to regulatory compliance. The next step, and often forgotten task when selecting the AE is that an AE is the person responsible for operations authorized under the certificate and accountable on behalf of the certificate holder for meeting the requirements of the regulations. This requirement also conforms to a businesslike approach to safety, where in a business the Chief Executive Officer (CEO) is the responsible person for processes to conform  to regulatory audit compliance. Over time it will become evident or not if an AE has enough knowledge, skills, and oversight to meet the requirements of the regulations. As the CEO of a corporation is not expected to be the expert on everything in a business, an AE is not expected to be an expert on regulatory compliance in an SMS Enterprise. 

Oversight is not to catch errors but to analyze data

As a financial audit of a business, their inventory is not directly audited by inventory count. Inventory is audited by the business adhering to requirement for inventory compliance factor. Manuals and operations plans are inventory and to be audited by the operator themselves. An operator conducts a line-item audit of their emergency response plan and include supporting documents as required to justify the audit result. A one-page signature page that a manual conform to regulatory compliance is not a valid confirmation document without the support of a line-item audit of that manual. Just as a business starts with a set amount a cash 

In the drawer every morning, record their itemized transactions, remove at the end of they day the recorded cash from drawer and count the drawer cash as their daily quality control, an SMS Enterprise begins the day with a pre-selected tasks required to be performed and at the end of they day compare the day to their daily quality control system.         

 

It is a misconception in SMS operations that only occurrences or errors are what is to be recorded, when in fact all transactions, or events are to be recorded. It is also a misconception that quick or spontaneous action to an occurrence makes aviation safer. When SMS is applied as a businesslike approach to safety it becomes simple and manageable for small and large operators. 

 

 

OffRoadPilots

THE MINI BLACKBOX

 THE MINI BLACKBOX

By Catalina9

BACKGROUND

Data recorders are primary tools in aircraft accident. The recording of an aircraft condition and operation can provide additional data to reconstruct the flight profile during all stages of flight, enhancing the investigation’s ability to comprehend data during the events leading up to an accident or incident. This information is a critical tool in assisting in preventing future accidents or incidents.

 

Flight data recorders (FDR) and cockpit voice recorders (CVR) are considered comprehensive methods of capturing flight data and can assist investigators in determining the reasons for an accident. FDRs record information such as altitude, airspeed, heading, and other aircraft parameters, many times per second. CVRs record radio transmissions and ambient cockpit sounds, such as pilot voices, alarms, and engine noises.

A blackbox is a special gift to be opened after an occurrence

LIGHTWEIGHT BLACKBOX

A lightweight blackbox is a unit which collects cockpit voice and video, or frames of images, and in addition collects data of established event triggers parameters. The unit comes with an internal hard drive for storage and a removable storage card for increased storage space and uploading into the analysis system. As an “after market” installed unit, (not originally installed when the aircraft was manufactured) the unit is mounted to the bulkhead behind the captain for viewing and videotaping pilot’s activities, performance instruments and engine instruments. The regulators work with the industry to implement a requirement to install lightweight flight data recorders in aircraft currently not require cockpit voice reorders or flight data recorders to be installed. 

 

The lightweight blackbox is an autonomous unit without direct links to aircraft operational performance, such as yaw, roll, pitch or engine performance. The unit is reliant on satellite reception to calculate geoposition, altitude, elevation, rate of descent, groundspeed, yaw, roll and pitch. Engine performance is not monitored but is viewed through the integrated camera. In essence, a lightweight blackbox is a smartphone nailed to the wall. 

 

A digital animation of data collected is available for view in a flight data analysis software, with an overlay on Google Maps, or other map suppliers. The data itself is available for download to spreadsheet for analysis. When this spreadsheet data is analyzed correctly it becomes a valuable tool for continuous safety improvements in operations. However, when data is analyzed to an exceedance level of established event trigger parameters, it becomes its worst enemy to safety. 

 

SELECTING PARAMETERS

A flight data recorder or cockpit voice recorder is only available for discovery after an accident or after a reportable incident to the Transportation Safety Board. This data is then used as a tool to learn what events lead up to the crash. Exceedance limits analyzed after an incident are aircraft design limits, aircraft performance limits, engine performance limits, and crew comprehension limits. None of these limits are analyzed prior to an accident when operating with a regulatory required FDR and CVR, or a comprehensive blackbox. 

 

With a regulated mini-blackbox, or flight data recorder, several parameters are established and defined as operational exceedances. The exceedances may be set at a lower value than safety in flight operations requires, they may be set at a lower value than what the flight crew is trained for, or they might be set at a lower limit than the manufacturer’s recommendation.

 

There are hundreds of parameters, or exceedances which may be set as event triggers, but some common triggers are excessive roll, excessive roll below 400 feet after takeoff, maximum approach speed below 300 feet, maximum descent rate, maximum G-force, maximum pitch, stabilized approach descent rate, or stabilized approach roll.  

 

As examples, event exceedances could be an excessive roll to be greater than 30° bank, excessive roll below 400 feet greater than 5° of bank, maximum approach speed below 300 feet for a light twin greater than 130KTS airspeed, a maximum descent rate greater than 2000 FT/min rate of descent, maximum G-force 4.0 G or greater, maximum pitch greater than 20° of nose pitch up, stabilized approach descent rate with rate of descent grater than 1000 FT/min, or stabilized approach roll at 10° of bank. 

Boundaries has consequences, except for the lightweight blackbox arbitrary event triggers.

These are examples of exceedances available for an operator to view and assess the flight-behavior of their company flight crew. A flight crew could be dinged with an exceedance violation of an excessive airspeed, when maintaining an IAS of 120 KTS, if on a high, hot, and light quartering tailwind day. A ground speed at 120 KTS indicated, could be 135-140 KTS ground speed. A flight crew on a regular run to this airport could easily get more red-flags against them than other flight crew who are arriving at lower and cooler elevations. When this type of data, where the input is ground speed, but data is analysed as indicated airspeed, and to its level of exceedance, an air operator has passed the fork-in-the-road and already took the wrong turn. When data is analysed to the level of exceedance, of criteria for success is to see a reduction of the bars in the graph. What is not understood when using this approach, is that fewer events does not equal improved level of safety in flying. It is a real temptation when conducting these analyses to overcontrol all processes, since an exceedance in itself is an unacceptable level of hazard independent of what event trigger is exceeded. The only process to run and operate with a successful mini blackbox is to apply spcforexcel.com, which is a highly recommended and userfriendly statistical process control software. It is impossible to run and operate a true safety management system without a statistical process control system and to establish safety critical areas and safety critical functions to scale hazards within human factors, supervision factors, organizational factors, and environmental factors. 

 

    

OVERCONTROLLING A PROCESS  

When a policy, system, objective or process is not comprehended, the only reaction is to overcontrol a process to ensure, in their own mind, that this person did everything possible to improve safety for the public and flight crew. If we take this to a practical level where the speed limit is 50, any exceedance is unacceptable, since it is the limit that is exceeded, and any associated issues becomes irrelevant. An operator may feel a pressure or temptation to overcontrol the process to ensure that no values exceed 50. If the number 50 is assigned as a level of safety, the next question to answer is what makes the speed 51 unsafe, which is also impossible to answer, and overcontrolling, or enforcing the 50 limit becomes even more forceful, or the limit could be raised to 100. 

 

The same holds true with the arbitrary established event trigger in a flight data recording system. When analyzing only to the event trigger exceedance level, the three options available for an operator is to enforce, or overcontrol, flight crew behaviors, or ignore the exceedances, or establish event triggers parameters beyond any reasonable expected flight maneuver. E.g. set the parameters to a level that scares the flight crew. 

 

WHEN VARIATIONS ARE NOT UNDERSTOOD

If an operator or management does not understand the information contained in variation, the operator would be over-controlling the process and increase the variation itself. 

 

To understand variation, it is essential to understand the difference between a process that is in statistical control (stable) and a process that is out of control (unstable). A process is in statistical control if there are no special causes present, or a cause required within the process for the process to function as intended. An example is the migratory bird season. Season migratory bird activities is a common cause variation and an in-control process but can easily be mistaken as an out-of-control process and special cause variation. 

 

A major fault, which exists in many places today, is the assumption that every event is attributable to someone or is related to one event. The fact is, however, that most troubles with aeronautical violations lie in the system and are not attributable to one person or one event.

 

There are two types of variation. Common cause variation is variation due to the system. Reducing common cause variation is the responsibility of management. Special cause variation is variation due to sporadic, unnatural events. Special cause variation is the responsibility of the flight crew or front-line personnel to correct. 

 

There are two types of mistakes we can make when looking at data. One mistake is to assume that a data point is due to a special cause when in fact it is due to common cause and the other type of mistake is to assume that a data point is due to common cause when in fact it is due to special cause. As an example, the migratory bird season is a common cause variation, and required for the process to function, but could easily be assumed to be a special cause variation since birds is a hazard to aircraft operations. An exceedance of an event trigger could be viewed as a special cause variation, but when analyzed within a statistical process control system, it is actually a common cause variation. 

 

WHEN SAFETY BECOMES A HAZARD

When a safety reaction to an event is to over correct, the correction is not at all useful even if it includes the word safety. When safety is an argument for safety itself is when the safety-card is played. Safety becomes a hazard when a person in authority makes event trigger decisions based on random sampling or emotional criteria. Within an SMS enterprise, and if two event triggers are disagreed on, it is tempting to split the number and meet in the middle. This is a process beyond an acceptable process to establish triggers and is also a process out-of-control since the special cause variation, e.g. how to select a number became the determining factor in selecting an operational safety exceedance trigger. When the selection process is out-of-control, the process is in-control to the level at which it conform to the selected parameters, and to as the process relates to safety itself.   

 

 

Catalina9

Anniversary

 Anniversary

By Catalina9

This month is nine years ago since I wrote the first post, and 235 posts later there is no end of writing Safety Management System (SMS) stories. An SMS is a tremendous system, and asset to an enterprise, when applied as an oversight tool but can also its worst enemy when applied as a compliance tool. A high compliance score is often associated with safety in operations and if decisions are solely based on a compliance score, there is a risk to overlook, or assume, the inherent risks in aviation. An inherent risk is also a common cause variation. On the other hand, when SMS is applied as an oversight tool, it is applied to the outcome or results with an analysis of occurrences, or special cause variation. A line in one of the first posts is still true, that one grassroot method to evaluate the effectiveness of an SMS is to learn how many hazard reports an AE has submitted. In an enterprise where the AE is actively submitting hazard reports, there is a hope that other personnel also voluntarily submit reports. In an enterprise where the AE does not submit hazard reports, their organizational culture may come to reflect that behavior. This very first post is an interesting post about aviation safety and the “trial-and-error” method. 

Hazard comprehension has evolved over the years.

In prior years of aviation, hazard identification was short-sighted. If the hazard was not an immediate threat, the hazard was not of any concerns. In a later post, an aircraft was departing from a grass-strip and the general public with a breathtaking close view. An on-the-fly risk assessment at that time was that as long as the propeller is pointing away from me, I am safe. The physics of a departing taildragger was excluded from the risk assessment, since the public did not know about hazards involved.  When humans adapt to hazards, we establish subjective standards in hazard mitigation. Airports, airlines, pilots, mechanics, or aviation leaders also have the ability to adapt to hazards.  When human adapt, subjective standards are applied to hazard management, which is a scenario for hazard escalation. This is also true in an SMS world today, that without leadership, subjective, or opinion-based standards are applied to hazard mitigation. An example of an opinion-based hazard is that the Titanic was an unsinkable ship. In 1911, Shipbuilder magazine published an article on the White Star Line’s sister ships Titanic and Olympic. The article described the construction of the ship and concluded that Titanic was practically unsinkable. 

SMS is to know the next move to achieve desired result

One of the most difficult decisions for a brand-new SMS enterprise is how to manage interpersonal conflicts, or the reporting of another person for making mistakes. Everyone wants to be safe, and “arguing with safety” is considered to be an unacceptable behavior. When a person states that something is unsafe, or that an action must be initiated for the safety of a person, an aircraft, or the public, they have the upper hand, and many will agree to avoid being viewed as being against safety. In a previous posts, it was written about being SMS’d. When someone is SMS’d the person submitting the report expect that the other person will be blamed for any occurrences related to the issue. When using a hazard report to get someone SMS’d, it becomes just as ineffective as an attempt to eliminate all hazards. It’s not the correct tool, it does not improve aviation safety and the desired result is not reached. Even if a fully competent person is included in the equation, the outcome does not improve safety. A process may work great and all the pieces in the puzzle fits, but the design inputs are incorrect when placing blame one a person. An effective SMS root cause analysis consider at least human factors, organizational factors, supervision factors and environmental factors. When an SMS enterprise consider these factors against one single person who has been SMS’d, the outcome still reflects their organizational safety culture. One of the greatest hazards within an SMS is to assume that a person reporting an issue as a safety issue is correct.   

One of the few accidents where a speculative, or subjective cause still exists.

A prior post was about training and how training has evolved. Training is the foundation of a successful SMS. In the pre-SMS days, it was expected a pilot would know everything there was to know. If there was a question, the answer was that you should know since you have a license. Back then training was only a function of a regulatory requirement and was also viewed as waste of time. It's a misconception that training only has one function of learning, and that this function is to become qualified. Human culture associates training with learning, where learning begins in preschool, graduates to kindergarten, then elementary, and finally to high school. Each step is required as a level of learning to qualify for the next level. These are building blocks of learning moving from unknown to known. It's to instill knowledge in someone who didn't have that knowledge. Training has several other functions and cannot only be associated with learning, or lack of knowledge. Functions of training are associated with human performance, which again have multiple subsections. Some of these subsections are human behavior, organizational performance, human factors, medical performance, aviation performance, optimal operational design, interaction modeling and more. In an SMS world, the concept of training has evolved to a high level of importance and are components of both regulatory compliance and safety in operations. 

 

There are several interesting posts in this blog. Most of the posts are about the Safety Management System, and how aviation safety evolved into SMS. Several posts were used as reference when building one of the most successful SMS manuals. Several times a post would also ask a relevant and everlasting question: “Why does the Global Aviation Industry, being Airlines or Airports, need a Safety Management System (SMS) today, when they were safe yesterday without an SMS?” Take a minute and review the posts to learn how SMS has evolved within your enterprise. 

 

 

 

Catalina9