Staying In The Rut

 Staying In The Rut

By OffRoadPilots

Conventional wisdom is that a healthy safety management system (SMS) stays in the rut without deviation from current course. One reason for this belief is that the SMS regulations states airlines and airports must operate with a process for reporting and analyzing hazards, incidents, and accidents, and for taking corrective actions to prevent their recurrence. When this regulation is interpreted that only one reoccurrence is a regulatory violation, the operation, airlines, or airports, must shift gears to operate with an abundance of caution for every flight or airside task. As reoccurrence continues, they must then overcontrol their processes with additional abundance of caution to their processes that already had received several abundances of cautions from their magic wand. Eliminating all hazards, incidents, and accidents is beyond what the magic wand of a safety management system can do.

The regulatory requirement to prevent their recurrence is applied without consideration for the principles of the safety management system, the principles of performance- based regulations, but applied as a prescriptive requirement, as opposed to a performance requirement, and the requirement is incorrectly interpreted as never to occur. Airlines and airport operators are operating under a false assumption that the same hazards, incidents, or accidents are never to occur again. By living under this assumption, they must make new policy statements, develop corrective action plans (CAP), and forbid the root-cause factor that caused the occurrence in the first place, e.g. the principle of sterile flight deck. The principle behind this theory is when a policy is implemented, then there will never again be a recurrence, and for every occurrence a new policy must be implemented. Policy CAPs that forbid behaviors causing occurrences are non- conforming processes to the regulatory requirements of a safety management system. This does not imply that airlines and airports should not implement policies, but that relying on policies, or directives as a function to eliminate behaviors by making new policies are a non-conforming CAPs.

Prevent their recurrence is about the system’s frequency of occurrences and preventing from occurring again is about periodically or repeatedly. The requirement is about human factors, organizational factors, supervision factors, environmental factors, and is not about the outcome or one single event. In a data driver risk matrix, the frequency range is from times between intervals being imaginary, theoretical, virtual, or fictional at the low end in a system, to times between intervals being methodical, planned, and dependable, without defining the operational system or processes involved at the high end in a system.

Another regulatory requirement for an SMS enterprise to operate with a process for setting goals for the improvement of aviation safety and for measuring the attainment of those goals. When operating with a healthy safety management system, goals are measurable, and they are attainable within acceptable timeframes. Without a goal achievement completion time, goals are dreams, or wishes only, and are without tangible results. A goal to be safe is not a measurable goal, and therefore not an attainable goal. Playing the safety card is a tool used to distract from the real issue when a person does not have justification for their reasoning for their demands.

A goal to reduce number of accidents is also not a goal, since accidents must be an integrated part of the system for this goal can be used. At a car race, where they have crash data collected for years and accidents are acceptable, they can improve the track design, vehicle design, and assess the risk ratio for crash excitement to

spectators’ expectations. A car race system is a system where accidents are expected as an entertainment value and as a businesslike approach to safety. A reduction in accidents is therefore a measurable and attainable goal within the timeframe of one race. In aviation, accidents are not entertainment values, accidents are not a businesslike approach to safety, and a reduction in the number of accidents is therefore not a measurable or attainable goal. A measurable and attainable goal for an airport is a daily inspection to what level an airport conforms to airport standards, and for an airline a goal could be to what level they conform to crew duty and rest requirements.

An SMS enterprise cannot have a goal that is not a part of the process, e.g. accidents. A car race event cannot operate with a goal that drivers do not exceeds 51 MPH.

A regulation to prevent their recurrence and another regulation to set attainable goals may at first glance appear not to be compatible, or they appear to be conflicting requirements. It is not about if one regulation is more important than the

other when it appears to be conflicting performance requirements, but it is about how SMS processes are applied to conform to regulatory compliance in both instances. Appearance of conflicting regulatory requirements are when one requirement is to prevent, or for an event to never happen again, and the other requirement is to set an attainable goal for that same event, since a corrective action plans to prevent their recurrence were implemented.

Since regulators are performance based, there are no opposing regulatory requirements. An SMS enterprise must implement processes to conform to each

regulatory requirement by implementing different processes for the requirements. In an advanced and healthy SMS environment, an airport and airline have designed processes where one process conforms to multiple regulatory requirements.

When an SMS enterprise decide to apply performance regulations as prescriptive regulations, a trap to fall into is to stay in the rut. They are not stuck in the rut, but they voluntarily stay in the rut, since that is the safe place to stay. It is human nature to remain within their comfort zone and not to leave the someday island. The someday island is a virtual island, and it is a fantasy island where it is safe to be. The comfort zone is also a reason for procrastination. Getting things done now, or making decisions, are for many an extreme and humongous task. They have learned that when the wrong decision is made, they are being punished, demoted, or even fired. When living in such an environment, it is much better for a person to make no decisions, than making the wrong decision. A wrong decision is not the same as an incorrect decision, but is a decision that the supervisor, manager, or president of an organization did not approve of. Within a healthy SMS environment, they say thank you even when they disagree with a decision, and they say thank you when incorrect decisions are made.

Several years ago, a brand- new worker did a costly error. Feeling upset and disappointed, the worker was certain to be fired, and packed up tools and all belongings ready to walk out the door after being fired. The boss came in and asked why all belongings and tools were paced up. The worker replied that they

were packed up so it would be easier to leave after being fired. The boss replied: I cannot fire you now. In just one day I spent over 100-thousand dollars training you.

This is a true story, and true stories are good. To this day, the worker is acting as a consultant to the boss on billion-dollars projects.

Operating with a safe SMS is to stay in the rut, where there are none, or very few changes. When operating in the rut, on the someday island, each checkbox can safely be checked and show a compliant safety management system. And yes, an SMS is compliant when staying in the rut on someday island since there have not been any changes to the SMS since the SMS was implemented. In a total safe environment there are no changes, all operations are halted, and life is safe and protected from scrutiny.

Staying in the rut is a learned behavior with little or no knowledge of why things are the way they are. An aircraft runup prior to take off is done because someone crash and got scared when an engine quit. Expanding airnavigation radars were done because two airplanes crashed over Grand Canyon in 1956, and the most interesting rut is that the standard railroad gauge (distance between the rails) is 4 feet, 8.5 inches, which is an exceedingly odd number. The reason for the distance between rails is because that's the way they built them in England and English engineers designed the first railroads. The people who built the tramways used the same jigs and tools that they had used for building wagons, which used that same wheel spacing. Roman war chariots formed the initial ruts, which everyone else had to match or run the risk of destroying their wagon wheels. Since the chariots were made for Imperial Rome, they were all alike in the matter of wheel spacing. Therefore, the railroad gauge of 4 feet, 8.5 inches is derived from the original specifications for an Imperial Roman war chariot, which was built to follow the tracks of two horses.

Now, here is the rest of the story. When you see a Space Shuttle sitting on its launch pad, there are two big booster rockets attached to the sides of the main fuel tank, and they are made in another part of the country. The engineers who designed bit fatter, but the SRBs had to be shipped by train from the factory to the launch the SRBs would have preferred to make them a site. The railroad line from the factory happens to run through a tunnel in the mountains, and the SRBs had to fit through that tunnel. The tunnel is slightly wider than the railroad track, and the railroad track, as you now know, is about as wide as two horses. So, a major Space Shuttle design feature, of what is arguably the world's most advanced transportation system, was determined over two thousand years ago by the width of two horses’ tracks. Ancient horses and staying in the rut control almost everything in transportation. Applying processes to performance-based regulations is to move out of the tracks and make new tracks. New tracks are not always comprehended by the accountable executive, and therefore rejected. An accountable executive is not an expert, in most cases, in statistical process control, process analysis, risk analysis, system analysis and audits, but is an expert in financial management to ensure a successful business. The move from prescriptive regulations to performance-based regulations and the safety management system, created challenges and obstacles to overcome. Two major obstacles were to design and apply processes that conform to regulatory compliance, e.g. the output, as opposed to the input, and the other challenge to overcome was to take the first step and move out of the rut.

Staying in the rut with a safety management system is a compliant SMS, but it is an unhealthy SMS with undetected flaws. A healthy SMS has moved out of the rut and is on a path into uncharted territory.

OffRoadPilots

Santa’s System Analysis

Santa’s System Analysis

By OffRoadPilots

Since Santa implemented the Streamlined Mission Service (SMS) 10 years ago, hisSMS system has evolved into a business of its own, and a business system within the Streamlined Mission Service system. Santa runs his operations as a non- profit organization. This is not a charity organization, but a not-for-profit enterprise, with Santa who is the AE, Mrs. Santa who is HR Director, the Elf Superintendent, the Elf Director of Reindeer Operations, and the Elf Director of Airfield Management as the Board of Directors. The purpose of Santa’s operation is to deliver, without profit, gifts to billions of people once a year during a 24-hour period. The task in itself is simple, since delivery methods remains the same for centuries. However, task to deliver within a 24-hour period has become more strenuous

The first time Santa delivered gifts was in the year 872, when he helped a king of the Arctic to convince farmers, laborers, ship builders, accountants, lawyers, and risk management officers to join the king as one nation. Santa used his gifted talent as a used-sleigh salesman to give out gifts to everyone who agreed. Since this gift-giving process went so smooth, and the reindeers loved it, Santa decided to give gifts to all the nations on the day of the Arctic mid-winter fest when the sun is returning to the region again, the earth is coming back to life, and continuous darkness must give way to daylight. Santa did not plan much for this, since travel and giving gifts were common sense tasks. He gathered up all the nine reindeers he had in the safety corral, where they were protected from hazards. These nine reindeers were carefully selected from the prime of the best reindeer-stock in the mountains. The reindeers were used as helpers for the 2-day build-up of the mid-winter fest and the return of the sun, and the 7-day cleanup after the fest. This was not a rowdy and wild fest, but the cleanup needed to take 7-days as a part of a tradition only.

At the next winter-fest in 873, Santa departed with gifts that him and Mrs. Santa had prepared. The nine reindeers were happy to go and was looking forward to seeing other parts of the flat-shaped earth. Santa and the reindeers had been up in the air before, and when climbing to 3,000 feet above ground, they could easily see the end of the world. Santa didn’t think this would take much time or presents and departed on a full moon morning and bright stars. These were the modern times, and there was nothing that was not known to be bright and intelligent people at this time. On the first takeoff one of the reindeers failed and stumbled after a famous wolf crossed the runway, and the reindeer got one of the runway edge lights stuck in his nose. The nose turned red, Santa named the reindeer Rudolph, after the famous wolf, and put Rudolph at the front for safety, since the nose was red.

Santa travelled from home to home and landed on the rooftops. They didn’t have chimneys back then, but there was a hole at the gable end for smoke to escape from the living areas. This was a convention place to drop the gifts, and if Santa had to, he could use a rope to slide down into their living room.

Every delivery went well, until Santa ran out of gifts. Santa had travelled for hundreds of miles but did not make it to the earth’s end yet. There were still yard lights as far as the eye could see. Santa was disappointed but had to turn around before the reindeers ran out of energy. Safety back at Santa’s yard, he sat down and wondered what went wrong since he couldn’t deliver to every single home.

Over the next few months Santa analyzed the system to learn what went wrong. He researched famous scholars about the flat earth and reindeer energy consumption. After reading and learning more about the earth, Santa came to realize that the earth is round like the sun and the moon. Also, Santa found out that the reindeer need solid food on their travel and cannot make the full trip by using power from the windturbine installed under the sleigh to supply water when they stop on the rooftops. Santa completed his system analysis for the next trip. The system analysis included the reindeer feeding system, the power generating system, and the earth-shape system. The reindeer feeding system was made automated and powered by the power generator to supply solid and liquid food to the reindeer. The windturbine was placed on top of the sleigh since it was damaged by rooftop landings when installed below. The power generator system added two backup windturbines to ensure power supplies for the whole trip. While Santa had problems defining, or changing the earth’s shape, he discovered that he could draw a map of the earth on a round rock and use the rock as his GPS (Grand Path System).

New inventions had come on the market since last year, and now, in the year 874, everything that was needed to be known about global travel was known. Santa had no worries since the experts had given him expert’s advice for every possible scenario and ensured his safety. After several hours of travel Santa was surprised that the sun did not set. Where he came from the sun did not rise all day, but here it was just the opposite. The sun did not set during the night. This reminded Santa of home and how the summer night are long and bright. Santa used an old wheel with six spokes to calculate his travel distance. Santa called his device every 6 balcony (E6B), since he needed to recalculate his route after six rooftop landings. To his surprise, he now was at the bottom of the round rock. Santa continued his deliveries, and he did not look back. The reindeer followed the direction from Rudolph, and the red nose pointed in a straight-ahead direction. After severalmore hours, Santa began to recognize places on the ground, and soon he found his landing airstrip. Santa was surprised to learn that he could make it home without turning around. When he told this to the experts, they expelled him from the toy factory since this could not be true. The earth was flat, and anyone who went of the edge never came back. Santa was more eager now than ever to continue his journey and deliver toys to everyone. Just a few days later Santa and Mrs. Santa started their own toyshop with help from all the elves in the area. Their future looked promising.

By now Santa realized that another system analysis needed to be done, since more systems were added, and he was planning for additional changes for the next toy delivery season. This time Santa included his own experts to do a system analysis. Mrs. Santa as the Director of Financial and Human Resources has roles and responsibilities to ensure that their processes from material to finish product were stable and userfriendly, and the system analysis expert for theses areas. Santa as the Accountable Elf (AE) has responsibility for human factors, organizational factors, supervision factors and environmental factors. In the system analysis Santa used the SHELL model, which stands for self-awareness, health-awareness, encroaching-awareness, limbo-awareness, and lane-awareness. sub-factors of environmental factors are designed environment, user friendly environment, design and layout, accessibility, tasks-flow, social environment, distancing, experiences, culture, language, climate, geo location, weather, temperature, methods, machines, manpower, materials, and measurements. Santa’s areas of expertise are applied in a system analysis of these mentioned factors. The Elf Superintendent brought her skills and expertise to the system analysis for Airfield maintenance, construction, and movements. The Elf Director of Reindeer Operations was responsible for all areas of operations, and to bring her expertise skills to the table for the system analysis. The Elf Director of Airfield Management brought his skills to the system analysis for safety, processes, and operation plans management to the system analysis. Santa was satisfied that this year, in year 875 and the year of major constructions, production and delivery of toys around the world would be a success. As the preparation continued, Santa was ready at the mid-winter fest to head out on his delivery adventure. This time he headed south until the sun did not set, and then northbound until the sun did not rise. By repeating this 24 times, he covered every single home and person all over the globe in a 24-hour period, and all children around the world was as happy as ever.

Santa, with approval by Mrs. Santa, made continuous improvements to production and deliveries, and continued support to the reindeer with helpful navigation aids, food delivery, and Santa also included a rest period for two of the reindeer at a time. With the annual new and improved processes, two of the reindeer were able to take a rest period without affecting the delivery process.

As homes were improved, the chimney became an obstacle. Santa noticed one year, in 1346, that some homes had build chimneys. At first Santa did not know but learned the hard way when the reindeer crashed into one. After the first incident Santa started to track every home with a chimney and documented this in the Chimney Tracking program. Since Santa had helped out the king in 872, he continued to report to the new kings of the Arctic. In 1537 a king who spoke a different language took over, and at first it was difficult for Santa to understand. Mrs. Santa developed a communication process in addition to the text and spoken word, to include colors and images. This was very helpful, and over time Santa also learned the new language.

Over the years there were ongoing improvements. Just as the chimney improvement, these improvements became a hazard for Santa and his deliveries. One year, one of the homeowners had placed a large evergreen tree inside their house. When Santa

dropped down the chimney and rolled into the living room, he rolled over the tree, and it fell over. All decorations broke, and everyone, including the children, woke up and ran to rescue. Santa made note of this and learned from his experience. Santa also notified the reindeers that there were trees inside some of these homes, which could cause more chimney smoke when branches and wood from the trees were burned on the fire. Santa tracked and documented every home with a tree and recorded it in the Tree Tracking system. Santa realized that system analyses also were useful in predicting hazards and avoid incidents when travelling. In 1814 Santa reported to a new king, who spoke his old language. Santa modified the written text in his messages so that elves and homeowners could understand the message. Santa documented and defined the text in the Write and Talk Tracking system.

Over the years Santa conducted several system analyses. A new invention on December 17, 1903, caught Santa by a surprise when another object, and Santa was not sure what it was, approach him in the air when travelling to a different district for

deliveries. Even if Santa was not sure of what the object was, him and Mrs. Santa conducted a system analysis of the event and implemented it in the safety manual for the annual toy-run. Santa did not mention this to anyone else, or to the king, since he had concerns that it could create to punitive actions to damage Santa’s reputation.

One day, a scientist invented an ultra-resilient strain of wheat that would grow food in places where food did not grow before. This also helped out Santa with feeding the reindeer while on the road, since he did not need to do as many detours to fill up the food supplies in the sleigh. In addition, since more food became available, Santa could carry a lighter weight of food, which made the job

easier for the reindeer. This worked out so well for Santa that Mrs. Santa awarded the scientist in 1970 the highest medal of honor since the new ultra-resilient strain of wheat helped to make peace between people. Santa, Mrs. Santa, and the elves were all happy to meet the scientist, visit with him and give him a hug and thank you for his hard work over many years.

Over centuries, decades and years, there were many challenges to overcome for Santa, and over time he made improvements to increase production, and improve delivery processes to ensure timely deliveries within a 24-hour period. For any changes that were made, minor or major, Santa and Mrs. Santa conducted their system analyses to be prepared for the known and unknown hazards awaiting Santa on his journey.

OffRoadPilots

What A Healthy SMS Looks Like

 What A Healthy SMS Looks Like

By OffRoadPilots

After several years of operating with a safety management system (SMS), an SMS enterprise should be operating with zero regulatory findings. The accountable executive (AE) should have full control over the path their SMS has taken in the past and established a vision in their SMS policy of what to expect in the future. The are three regulatory compliance principles for a successful safety management system. The accountable executive is responsible for compliance with all regulations, the certificate holder (CH) is responsible for the quality assurance program (QAP), the person managing the safety management system (SMS manager) is responsible for monitoring concerns that the aviation industry has about your airport. A healthy SMS includes a risk management officer (RMO) position. Risk management is what makes a safety management system a healthy SMS within a fluid environment and ever-changing priorities.

The duties of a risk management officer are often assigned to an SMS manager when the CH appoints a person to managing their SMS. The person managing the safety management system shall identify hazards and carry out risk management analyses of those hazards. Other duties assigned to an SMS manager are to maintain a reporting system, investigate, analyze and identify the cause or probable cause of all hazards, incidents and accidents, maintain a safety data system, by either electronic or other means, to monitor and analyze trends in hazards, incidents and accidents, monitor and evaluate the results of corrective actions with respect to hazards, incidents and accidents, monitor the concerns of the civil aviation industry in respect of safety and their perceived effect on the your airport, and determine the adequacy of the training required. These responsibilities which are assigned by the regulations to an SMS manager are extremely labor intensive, research intensive, data collection intensive and comprehension intensive. There are not enough hours in a 24-hour day for one person to comply with these requirements in addition to carry out daily risk management analyses.

If anyone for a minute thought that risk management analyses are not a daily and ongoing tasks, an SMS is not only rolling downhill, but it is also rolling down a path to operational failure. SMS itself cannot fail since all it does is to paint a true picture of a failed operation, but operations can fail by ignoring SMS drift and trends. Just as investments professionals must assess the risk daily, an airline and airport operator must also assess their risks daily.

Conventional wisdom is that airlines and airports only need to assess the risks for accidents that already have happened. This is also a misconception, but it does not imply that it is wrong or incorrect. When SMS first was introduced, there were little to no information or literature available of what an aviation safety management system actually is. Airlines and airports required to implement SMS continued the path they were on, which was to react reactively to incidents and accidents. SMS was not fully understood at that time. Common phrase was that safety is common sense, knowing that common sense had produced accidents since the beginning of time on December 17, 1903.

Some time ago, I received a practice SMS report, and this is what the report said:

“On 17 DEC 1903 two unlicensed pilots, Orville and Wilbur Wright, made 4 unauthorized flights in an unregistered aircraft. They departed and arrived without

communicating with air traffic control or utilizing local CTAF. Their airplane, which had not received its annual inspection by a licensed Aircraft Mechanic, was damaged during their last flight. They failed to report the incident to the TC and TSB, neither of which had been invented yet. Corrective Action: Recommend TC to be invented immediately, and Wilbur and Orville Wright's pilot certificates to be issued then revoked.”

In the Safety oversight component, the reactive reporting process was the first

operational task for airlines and airports. This task was fully understood, since

reactive reporting with corrective actions was how safety was managed prior to a

regulated implemented SMS. There were several other options available on how to

initiate the regulated SMS process, and the consensus was to begin with the

reactive reporting process.

When operating with a reactive process system, an incident or accident must first

happen before it is reported and analyzed by applying statistic process control

(SPC). The first step to report an accident was familiar to operators, but the

challenge came when the analytical process took place. In the pre-SMS days, the

broken piece was fixed, forgotten about, and nobody conducted process analysis.

Special cause variation for root cause analysis was unknown, and most operators

could not identify the difference between common cause variations and special

cause variations. SMS was implemented with several other new definitions and

tasks in the reactive system, which immediately caused confrontations. Since the

SMS regulations are performance based, the golden rule is that if the regulation

does not specifically state what needs to be done, that is the exact reason why an

airline or airport operator must do what it takes to meet the intent of the

regulations. A common phrase with the SMS implementation was that “the

regulations does not say that.”

The next step of the safety oversight element was to phase-in the proactive

process. There was still a confusion among airlines and airport operators, including

the Regulator, of what defined an SMS process. Since the phase-in was a proactive

task, the consensus became to identify hazards and do something about that

hazard before it became a bigger problem or would lead to an incident. Operators

dangled carrots, or bribes, for employees to report hazards. Whoever reported the

most hazard in a month would receive a gift. Gifts, or bribes, when initiating a

process to learn the process itself is acceptable, but within a fully operational SMS,

bribes, or carrots do not paint a true picture of the health of an SMS.

The Heinrich Pyramid, or the Heinrich Law, was used as justification to action to

prevent minor hazards immediately, since they would, unquestionable, lead to

accidents. Heinrich's law is based on probability and assumes that the number of

accidents is inversely proportional to the severity of those accidents. It leads to the

conclusion that minimizing the number of minor incidents will lead to a reduction

in major accidents, which is not necessarily the case. In a workplace, for every

accident that causes a major injury, there are 29 accidents that cause minor

injuries and 300 accidents that cause no injuries. Hinrich Law is applicable to an

overcontrolled environment with common cause variations only, and where

special cause variations are excluded. Eventually, several airline and airport

operators put the Heinrich Law aside and referenced this principle as guidance and

instruction material only, rather than a law written in stone.

After the reactive and proactive process systems were phased-in, the next step in

the SMS was to implement investigation and analysis. The first constraint for this

phase-in period was to determine what to investigate and a consensus made sense

to investigate accidents and incidents. After all, this is what TSB did, so operators

assumed they were expected to do the same. Accidents and incident investigated

by operators were not limited to the severity of the outcome, but anything that

failed were placed in the investigation hat. Upon completion of an investigation an

operations bulletin was issued for personnel to read and accept, and after just a

few months, the paper clipboard was overloaded with bulletins. An airport would

conduct a root cause analysis and investigate a burnt-out runway edge light, and

airline would do the same for a burnt-out aircraft taxi light. During the phase-in

period SMS personnel had limited training to comprehend the safety management

system. Investigations and analysis of incidents that were done at that time were

not the wrong thing to do, since it was common sense based on their current

knowledge. Investigating the outcome itself was the incorrect thing to do. The

difference between doing the wrong thing and the incorrect thing, is that doing the

wrong thing is to do a task against better knowledge, and doing the incorrect thing

is the lack of knowledge of what needs to be done. As the SMS learning level

progressed, it became clear that the investigation was not to investigate the

outcome, but to investigate the hazard and how a hazard was carried forward in

the operational process.

The final step in the 4-year

phase-in period was to

implement the quality

assurance program and

assess the effectiveness of

SMS. The struggle with this

phase-in period was to

determine what makes an

effective SMS. Conventional

wisdom was that operating

with zero accidents or

incidents was the prime key-

performance indicator, and the SMS performance level was assessed to the

number of incidents during an established time period. This is still an ongoing

assessment process used to establish an effective SMS. Effectiveness is analyzed in

graph-charts and run-charts, where a downwards trends are good, and upward

trends are bad. Applying this process provides some useful information, but the

analysis is based on opinions and emotions. When opinions and emotions are the

foundation for analyses, the trap to fall into is overcontrolling of processes. When

there is overcontrolling of processes, the ops-bulletin clipboard gets filled up faster

than the paper can be printed. An invaluable tool to operate with a paper-format

SMS is that process overcontrol can easily be identified by viewing the number of

paper files. When operating with a flawed system, e.g. flying an airplane without

required maintenance, by random chance that flight will be successful and safe. If

a pilot on a precision approach misread the approach chart minimums, e.g. a flawed training system, and lands in zero-zero, the odds by random chance is that

the flight will be successful. The moral of the story is that lack of accidents is not a

key performance indicator (KPI) of how effective an SMS is.

The most critical task and difficult task in assessing the effectiveness of a safety

management system is to rate, or classify processes to different risk levels, safety

critical areas and safety critical functions within these areas. From a non-analytical

point of view, all processes in flying must be assessed as high-risk levels since there

are always possibilities for an element to cause an accident. Operating with

possibilities is an emotional assessment of effectiveness. There is no evidence that

missing one or all items on a landing checklist will cause an accident. The

effectiveness of a safety management system cannot be determined without

applying statistical process control since it must be assessed by probabilities, as

opposed to possibilities.

The quality assurance program is a component of the safety management system

and is therefore an integrated part of an SMS in the same manner as the safety

polity, processes for setting goals, measuring the attainment of goals, hazard

identification, training, reporting system, process manual, communication to

personnel, periodic review of the SMS and review for cause are integrated

components of the SMS.

A regulatory requirement of a safety management system is to conduct an audit of

the entire quality assurance program carried out every three years. During the 4th

year phase-in period, the struggle with this requirement was to identify what the

quality assurance program actually was and what it should look like. Since the

quality assurance program is a component of the SMS system, it must be treated

the same way as a safety policy, goalsetting processes, or reporting processes.

Since none of these components include specific text on what an airline or airport

must include to meet the performance requirement, an airline or airport must

design their own quality assurance program tailored specifically to their

operations. One vital component, and prerequisite of a healthy quality assurance

program is an operational daily quality control system. This system is not included

in the text of the regulations but is a component of the overarching quality

assurance system. With the daily quality control program implemented, and just as

any small or large grocery store counts the cash at the end of the day, an SMS

enterprise must count their daily quality control processes daily. When the quality

control system is counted, an audit of the quality assurance program is possible,

and the checkboxes may be downgraded to be incidental to the daily quality

control.

Over a period of four years,

both airlines and airport had

been operating with an SMS

without knowing or

comprehending its definite

purpose. This also caused

conflicts and struggles

within the industry to define

the SMS path of how to apply 

this to operations. A consensus for a solution was to ensure that all required

checkboxes were completed, and the aviation SMS quality assurance program built

its platform on this principle. The checkbox syndrome is still the basis of SMS

performance and effectiveness and has become so powerful that it was also

implemented in the initial pilot training programs. Checkboxes are necessary for a

healthy SMS, but when checkboxes become the primary task, the accountable

executive takes their SMS down the wrong path. As I learned from a

groundbreaking woman in aviation, who also become one of the first female pilots

hired by a major airline, that completing all checkboxes have become a more

important task than the actual individual flight training.

Operating with a healthy SMS is a simple task when all the groundwork is

completed. A healthy SMS does not interfere or affect roles, responsibilities or

assigned tasks that an airline or airport has assigned to a consultant, director of

operations, airside crew, airport manager, SMS manager, airfield maintainers,

airside operations personnel, or cloudbased SMS resources systems. A healthy SMS

is scaled to the size and complexity of operations by assigning multiple regulatory

requirements to one task and operating with a regulatory element of the SMS and

an operational element of the SMS separately, but with both integrated in the SMS

analysis.

The single most significant role for a healthy SMS to accept that the accountable

executive is the person who is responsible for complying with the regulatory

requirement to be responsible for operations, and to be accountable on behalf of

the certificate holder for meeting the requirements of the regulations. A healthy

SMS looks like an organization where major factors affecting operations are

monitored daily. A healthy SMS collects data from multiple different sources, such

as web cameras, internal and external reports, and publicly available flight critical

observations and predictions. A healthy SMS operates with an Above the Fold

system, where factors that the risk management officer has assessed as

operational priority risk levels for that day are placed above the fold,

communicated to the AE, and monitored by the SMS manager.

A healthy SMS is when an accountable executive accepts that a healthy SMS is a

maturity system.

OffRoadPilots

The Devil Is In The Details

 The Devil Is In The Details

By OffRoadPilots

The Titanic disaster was caused by a detail in the watertight compartment design flaw that the walls separating the bulkheads extended only a few feet above the water line, so water could pour from one compartment into another, especially if the ship began to list or pitch forward.

The Alexander Kielland disaster was caused by a fatigue crack in one of its six bracings, which connected the collapsed D-leg to the rest of the rig. This was traced to a small 6mm fillet weld which joined a non-load-bearing flange plate to this D-6 bracing.

The Sioux City IA air disaster was cause by a catastrophic failure of its tail-mounted engine due to an unnoticed manufacturing defect in the engine's fan disk, which resulted in the loss of many flight controls. None of these details were identified as issues of any concerns, but they caused some of the most horrific and catastrophic historical events within their own areas of history. Titanic was built to be unsinkable, a deep-sea diver once said to me that there were terrible working conditions for underwater welders, and it was known ten years prior to the disk failures that these disks had flaws and could fail.

Details may be known by management, but are often dismissed, they are brushed aside as being unimportant, or seen as irrelevant to the issue. Details are not only important in operations, but also for regulatory and standard compliance.

both airlines and airports have to maintain compliance with a comprehensive safety management system (SMS). I concept, an SMS is simple but unless details are identified within a system analysis, the system becomes complex and often unmanageable. A manageable SMS is based on daily quality control, established processes and each operational task is linked to multiple compliance requirements. When processes are established, an SMS has been simplified and manageable, with the primary tasks to monitor for deviations from assigned path. The more details paid attention to in an SMS make the SMS simpler and easier to use. When details are known, it is easy to see where the pieces fit into the whole picture, as opposed to fit a large piece into a detailed issue. When SMS is forced, it makes it difficult and complex to apply in operations. A symptom of an SMS that is too complex or unmanageable for operations, is therefore when SMS is overloaded, or overcontrolled, and safety information is a tool to justify its existence.

Paying attention to details is a regulatory requirement for a certificate holder to adapt their safety management system to the size, nature and complexity of the operations, activities, hazards, and risks associated with the operations. Adapting to size and complexity requires detailed knowledge of their operations. When an operator only has a high- level knowledge and overview of their systems does not allow for a

certificate holder to apply operational targeted processes that suits their size of operations. A certificate holder is required to appoint an accountable executive (AE) to be responsible for operations or activities authorized under the certificate and accountable on their behalf of the certificate holder for meeting the requirements of the regulations. This requirement does not imply that an AE only need to be familiar, or only have partial knowledge of the regulations, but is a requirement for the AE to have detailed knowledge of regulations to detect deviations from established paths and non-conforming processes. Conventional wisdom is that an AE only need to be responsible for financial and human resources, which is a job description of their position, while the knowledge of regulations is the requirements for accepting the role. SMS is a businesslike approach to safety, and no business owners, corporate directors or airport authority would hire an accountant or lawyer who have limited knowledge of regulatory requirements and their areas of responsibilities. However, they continue to hire accountable executives who do not have the knowledge base to fulfil their obligations to the regulations.

Obligations of an airport operator is to review each issue of each aeronautical information publication on receipt and, immediately after a review, notify the Regulator of any inaccurate information. Detailed knowledge of how to obtain a copy of the aeropub is required, detailed knowledge of how often a new revision is issued, and what date it is published is required. They need detailed knowledge of what information pertains to their operations, what action to take in addition to reporting any errors to the Regulator, and how their internal SMS process capture these requirements. An operator must design, develop, and submit to the Regulator an operations plan for airside construction, and operate with airside operations plans for maintenance and repairs. Operations plans must include details of operations for processes to conform to regulatory requirements.

The person managing the safety management system, or SMS manager is required to monitor the concerns of the civil aviation industry in respect of safety and their perceived effect on the certificate holder and determine the adequacy of the training for personnel. In-depth and detailed knowledge of their own operations are required for an SMS manager to monitor the aviation industry in respect to safety and how they view different independent operators. An airport operator who frequently closes their runways due to maintenance and repairs, may be viewed as unsafe since this particular airport does not have project plans in place for airside management and for runways to remain open for business. An airport operator may choose to close a runway between 2AM and 4AM for daily maintenance and inspection, which is different that publish NOTAMS for unexpected maintenance requirements during hours of operations. An SMS manager is required to determine requirement of training, and without the details of expected outcome of the training this function cannot be performed.

Comprehension of details in operations, the text of regulations, and the intent of performance-based regulations are required for an operator to design processes that conform to regulatory requirements.

Generally speaking, a regulation is applicable to any airline or airport, unless there are special provisions for size and complexity. One such regulation is the airport winter maintenance regulations, where the regulation is applicable to airports serving turbojet aircraft, and the other part appliable to airport serving propeller aircraft and on-demand operations only. Winter operations for airports serving propeller aircraft is to consult a representative sample of the air operators that use the airport about the intended level of winter maintenance and the remove sand from movement areas when it is no longer needed. Additional requirements for airports serving turbojet aircraft are that they have a winter operations plan, snow removal priority areas, pre-threshold maximum snow accumulation, use of ice control and chemicals, friction measurement and movement area inspection reports. The detail of this regulatory requirement is not in this regulation itself, but in the requirement for an airport certificate. An applicant for an airport certificate must maintain verification records that they can operate with a safety management system and is requirement for non-certified aerodrome operations prior to the issuance of an airport certificate. When a certified airport operator elects to operate as an airport serving propeller aircraft only, they voluntarily give up their SMS records for operations serving turbojet aircraft. Should an airline operator wish to operate turbojet aircraft out of this airport, they must delay their operations until the airport can verify their capability to operate with an SMS supporting turbojet aircraft. The detail of this requirement is to connect the link between two regulations to conduct a system analysis of future operational restrictions. With the implementation of the safety management system, any operational regulations must be linked to the SMS regulations. This is a detail that an AE must be aware of and able to distinguish between multiple regulations and how they are linked to same SMS regulation.

An airport is required to maintain a runway strip, or an area beyond the side of the pavement of a runway, and beyond both threshold, that are without aeronautical obstructions. This includes natural obstructions and other encroachments such are riverbanks. One airport decided, without consultation, to fill in a riverbend to widen their runway strip.

After the construction application was submitted, the community responded with opposition to this initiative. The airport boundary needed to be expanded by filling in the river and bird wetlands. In practice, this means that birds, wildlife, and plants are forced to leave their habitats. In the application, the airport manager wrote the following: "Regarding natural diversity: The airport does not have the professional expertise to assess any special impacts on natural diversity. Our experience from operating the airports over several years is that there is very limited animal and bird life in that area. We assume that this is due to the presence of the lake on the opposite side of the runway, which has a bustling wildlife and bird activities, and which therefore seems to be more attractive. Nor has any extensive movement of wildlife or birds been observed between this lake and the riverbend, which is probably due to the activity on the runway. In addition, the airport has limited data entries in their bird and wildlife register.” The airport manager states in their application that they do not have the professional expertise to assess impact on bird and wildlife, and due to airport operations, bird and wildlife activities are scared away and therefore does not exist as a justification to stop the construction project. This application is in non-compliance with an SMS to conduct system analysis of projects and comprehend all details included. An accountable executive needs to be able to comprehend the details and impact on the community by reading their own submission. There is also a regulatory requirement for airport extensions to consult with their neighbors, stakeholder, and other interested parties.

When the Regulator conducts an inspection, and since the regulations are performance based, they will inspect what is not written in the text of the regulations. An inspection includes the regulations itself, how it is linked to other regulations, and how an SMS enterprise maintain a path to monitor processes. An AE needs to have knowledge to link for an airport to publish NOTAM (Notice To Air Men, and the new definition is Notice To Air Missions), and for the captain of an aircraft to be able to assess an airport for suitability. The intent of an airport operator, and a certificate requirement, is for an operator to operate an aerodrome as an airport. This requirement implies that the airport meet certification standards 24/7. A published NOTAM does not change that requirement but is a tool for an airport operator to fix or repair an unexpected issue within a short timeframe.

The devil is in these details and other safety or regulatory details. For all practical purposes, what this mean is that an SMS enterprise does not have any justifiable cause to operate outside of the intent of the regulations, or exempting themselves from standards, or their own policies as they please, and most important, it is a responsibility for an accountable executive to know what this entail to ensure ongoing compliance.

OffRoadPilots