Saturday, June 25, 2022

Unintended Consequences of Hazard Identification

 Unintended Consequences of Hazard Identification

By OffRoadPilots

An SMS enterprise is required to operate with a process to identifying hazards to aviation safety. Defining hazards to aviation safety is subjective and based on prior experiences, guidance, or fear of failure. When there are none, or very few, hazards in the hazard register, the regulator view this as a nonconforming to a regulatory requirement to identify hazards. A limited hazard register is a red flag to the regulator who then will issue findings to operators. An experienced and high time pilot may view a gravel-runway as a non-hazardous condition, while a low time pilot with, or a pilot without gravel-runway experience rates gravel-runway as a hazardous condition. Both pilots view the same scenario, at the same location, at the same time and with the same meteorological conditions, but experience, guidance and fear of failure leads to two different conclusions. One accepts the condition as hazardous, while the other rejects the conditions as a hazard to aviation safety. However, there are several examples in flying that highly experienced bush-pilots operates with a lower risk level bar than new and inexperienced bush-pilots. 

There is a difference between observing for hazards and actively searching for hazards.

In addition to tangible hazards there are abstract hazards. An example of an abstract hazard is time pressure for on-time departures. Abstract hazard conditions are higher risk levels than tangible hazards, since their outcome cannot be predicted, they cannot be measured, or produce the same outcome each time. A common cause explanation to overlook abstract hazards, such as fatigue or time pressure, is to “get the job done”. When there is a conflict between abstract hazards and tangible hazards, the tangible hazard takes precedence. Red flags are more likely to be attached to personnel who reports abstract hazards than personnel who reports tangible hazards. These types of organizations operate with a systemic fear of failure culture. 


An SMS enterprise is required to operate with a proactive process or system that provides for the capture of information identified as hazards and other data relevant to SMS and develops a hazard register. A hazard register are list items of conditions that could cause occurrences, and it is also a list of hazards derived from past occurrences. Hazards should be assessed and mitigated through safety oversight, training and awareness, and the use of a flight data monitoring system. Performing a proactive assessment within a daily quality control system, and a review of SMS database is necessary to verify the rate of occurrences. An SMS enterprise who indicates that they do not have hazards to report should demonstrate how they have reached this conclusion. 


A hazard register contains two distinct different types of hazards, which are assumed hazards and experienced hazards. These different types of hazards should be separated into different hazard registers to analyze the rate of hazards from occurrences and the rate of assumed hazards occurring. 


A third variant of hazard identification is the planned self-evaluation and actively searching for hazard. Requiring pilots and airport workers to actively search for hazards is a distraction and take away time from their roles and responsibilities leading to unintended consequences. There is a difference between observing for hazards while flying and actively searching for hazards. Most everyone has experienced how a new vehicle changes alertness and observations. When a certain make and color of vehicle is purchased, the same vehicles and colors that were not noticeable before, now attracts attention. These vehicles were still within sight before but were not noticed since they were irrelevant to the operator. There is a universal principle called the Law of Attraction, which says that you attract into your life people, ideas, and resources in harmony with your dominant thoughts. Other ideas and resources become irrelevant and not noticeable. The fact is that humans are living magnets, like iron filings are attracted to a magnet, human nature, or human factors, is to attract the people and professions that are in harmony with your current level of knowledge, wisdom, and experience.

A tangible hazard is comprehended, while an abstract hazard is interpreted.

Awareness is a key element for a successful flight and successful airside maintenance. Human factors is to understanding the effect of why a task is required and the effect of how distraction deviates attention from a priority task. When a flight crew's attention is diverted from the task of flying, the chance of error increases. Over the years there have been dozens of air carrier accidents that occurred when the crew diverted attention from the task at hand and became occupied with items totally unrelated to flying. An example is the Everglade crash in 1972 when three green lights failed to illuminate gear down and locked. The crew conducted a fact-finding task to find a solution. While they were focused on the gear-lights, they did not realize that the airplane was continuing to descend, causing the left engine to strike the ground then the aircraft crashed. The flight crew were actively searching for what hazard had caused the lights not to illuminate. 


When an SMS enterprise expects pilots and airport workers to report hazards, the effect of human factors is to focus on finding a hazard and then focus on the immediate threat. The pilot of a small single engine aircraft taxiing at night may be blinded by the taxi lights of an approaching heavy aircraft, causing the small aircraft to taxi across taxiway islands. Hazards, if they are factual or virtual, have a distractive effect on human behavior. When flight crew and airside workers feel obligated to identify unknown hazards, it is unknown to an SMS enterprise how their attention to hazards distract their attentions from current assigned priority tasks.  


The requirement to actively search for hazards is also a regulatory non-conforming behavior. A regulatory requirement for operations involving taxi, takeoff, landing, and all other flight operations conducted below 10,000 feet MSL is that no flight crewmember may engage in, nor may any pilot in command permit, any activity during a critical phase of flight which could distract any flight crewmember from the performance of his or her duties or which could interfere in any way with the proper conduct of those duties. Activities such as eating meals, engaging in nonessential conversations within the cockpit and nonessential communications between the cabin and cockpit crews, and reading publications not related to the proper conduct of the flight are not required for the safe operation of the aircraft. Actively searching for hazards during critical phase of flight is a violation of the regulatory requirement to maintain a sterile cockpit. Unintended consequences to require active hazard identification is regulatory non-compliance and an induced risk level. 


A review of the effect of non-compliance with the sterile cockpit principle finds that 48% were altitude deviations, 14% were course deviations, 14% were runway transgressions, 14% were general distractions with no specific adverse consequences, 8% involved takeoffs or landings without clearance, and 2% involved near mid-air collisions due to inattention and distractions. 


A key to good Human Factors practice is awareness. It is not enough for pilots and airside workers to know what can affect them, It is also necessary for them to be aware that they are in a position to be affected. As an example, knowing that fatigue affects performance is not useful unless pilots realize that they are fatigued. Realizing fatigue is applicable to all professions, not only pilots. In the old days of long-haul trucking, before automatic transmission, drivers realized that they were fatigued when shifting gears became difficult. In aviation, a pilot realized fatigue by altitude or heading deviations. Automation in aviation has reduced the ability to recognize fatigue, without applying an SMS safety case to operational hours. Regulated flight and duty times does not ensure fatigue compliance since the regulation is not broad enough to cover every aspect of fatigue. When the regulation is incomplete, it is the role and responsibility of an SMS enterprise to add additional layers to identify fatigue. A fear of failure culture marks a red flag to pilots reporting fatigue prior to the end of regulatory flight and duty day, or airside worker reporting fatigue prior to end of their shift.  





Saturday, June 11, 2022

The Successful AE

The Successful AE

By OffRoadPilots

A successful Accountable Executive (AE) is a person who fully comprehend their Safety Management System (SMS). The successful AE is result oriented and focuses on leadership motivation. The AE set clear goals and provide personnel with their empowerment and tools needed to achieve success. The successful AE is a motivational leader inspiring personnel with directions to work toward goals, and successfully complete one goal at a time. A goal without directions is not a goal but a wish, or a dream. Just as a successful CEO is surrounded by highly qualified personnel to guide them with business transactions, a successful AE accepts the confidential adviser as their go-to person to maintain processes that conform to regulatory requirements.    

During phase one, the SMS knowledge was limited, and no questions were asked.

A safety management system is an evolving system through three phases. A successful AE is in the third phase of their SMS evolution. Evey SMS enterprise go through the same three phases before the accountable executive becomes a successful SMS leader. Achieving success in the third phase is not the completion of an SMS system but it is the beginning of comprehensive application of the safety management system. Canada was the first ICAO state to regulate the safety management system and there was a struggle for operators throughout the four implementation phases. The expectation that an AE was only responsible for their financial and human resources was the wrong turn at the fork-in-the-road and the root cause for the ongoing SMS struggle. Throughout the four implementation phases the regulator misled operators by acting as consultants and they were extremely generously with opinion-based SMS guidance to both airport and airline operators. 


The first phase of SMS extends from the implementation phase to the first audit. During the first SMS phase the AE complies with implementation directions and outcome expectations without hesitation, or concerns. The initial phase-in process of the SMS was a learning process with an objective to establish a successful SMS. Every person in the organization at this stage were learning about their roles and responsibilities and were applying tasks without justifications, or reasons for the task. The general guidance at that time was that an SMS was a tool to reduce incidents and accidents. Those safety visions were quicky shattered as there were no evidence that SMS had reduced the number, or severity of incidents, or improved safety at all. Airlines without a fatal incident for over 30 years, experienced their first fatal accident as an SMS enterprise. 


The AE, as well as other personnel began to question the purpose and effectiveness of their SMS. Their SMS manuals included safety policies, reporting systems, hazard identification systems, investigation systems, root cause analyses, safety data systems, corrective action processes, monitoring the concerns of the civil aviation industry, and determining the adequacy of training, but without any significant effect on the outcome. Operators began to question why the global aviation Industry, being airlines or airports, needed a safety management system (SMS) today, when they were safe yesterday without an SMS. Without any guidance material of how to reach these goals, airport and airline developed their own systems, with different processes, to reach the same expected outcome. It became more complicated a successful AE, when the regulator took the position that the solution to conform to regulatory compliance was to implement electronic data collection tools, with checkboxes for result completion. The SMS had deviated from its purpose and turned onto a path where completing checkboxes for individual results became the primary task, as opposed to the task to analyse processes for regulatory compliance. This became evident in a survey published in the JDA Journal, April 13, 2017, where the vast majority of oversight inspectors view themselves as having better knowledge of airline and airport operations than the operator themselves, and that they are better qualified than operators to fix safety problems before they become accidents or incidents.  

There is a process for everything.

The second phase of a successful AE is the reactive phase of a safety management system. In the reactive phase, there is no daily quality control, errors and findings are accepted as a normal part of the processes, daily performance tasks are not assigned links to regulatory compliance and the accountable executive is struggling to maintain regulatory oversight and compliance in their operations. The reactive process in phase two was different than the reactive process during the initial SMS phase-in processes. An SMS enterprise may establish a proactive process by including a daily inspection at airports, or a pre-flight inspection for airlines, but during this second phase of SMS, established proactive processes became inactive and transformed into reactive processes. While it is true that these processes discovered findings and trigger repairs, they did not extend beyond the repair itself to become an integrated part of a daily quality control system and system corrections. When FOD was found on the runway, it was removed, or when a damage was found to an airplane, the airplane was grounded, and the damage repaired. These repairs were the initial part of a reactive process, but without a link to an action item beyond the repair itself, they were only reactive processes, and events repeated themselves. An action item is different than a root cause analysis, in that the link to a regulatory component becomes the proactive element of the process. In phase two of a successful AE, they relied on the opinion of external auditors, and the AE’s goal was to become a platinum-members of the auditor’s safety-club. The scenario of an AE in phase two plays out in the global airline industry today where there is a shortage of flight crew and more tickets sold to passengers than airlines capacity. 


During the second phase of SMS, it is also common is to assume compliance by reaction, or by performing regulated operational tasks, while non-regulated operational tasks were excluded. With non-regulated tasks excluded, an SMS enterprise became in non-compliances with the SMS regulations. A successful AE in phase two excluded specific tasks that were not included as regulatory tasks to be performed. What the AE was missing, was that the time for an operator to define and design operational tasks is when the tasks are not included in the regulations as regulatory tasks. The AE also assumed during phase two that completing regulatory operational processes automatically conform to regulatory requirements. This assumption was false and was not followed up with data to support their opinion. Some accountable executives carried this believe to the extreme, where their certificates were threatened. It was not until the certificate was threatened that the successful AE realized that the only way forward is to implement a daily quality control and a regulatory oversight plan.  


When the successful AE entered into the third phase of SMS, they accepted their accountability that they have several more tasks and responsibilities to comply with than only human and financial resources. At this time the successful AE understood that their roles and responsibilities were much more than just human and financial recourses. In addition, their responsibilities were to scale and adapt their SMS to size, nature and complexity of the operations, activities, hazards, risks associated with the operations and daily quality control for their triennial audits. In the third phase of a successful accountable executive, operational processes were linked to regulatory requirements, and one task was linked to several regulations or standards as a tool to scale and adapt to size and complexity. Airport operations is a relatively small-scale operation in aviation compared to airlines. However, airports provide essential services to the aviation industry for successful flights and customer satisfaction. An airport AE must have comprehensive knowledge of airport operations, they must have general knowledge of airline operations and be familiar with air navigation services. A successful AE has accepted that operational tasks for airports or airlines are many and is more than a full-time job. There are several standards they must ensure compliance with, in addition to many regulatory requirements. Scaling the operations and SMS down to size and complexity is not to exclude unimportant regulations, but to assign multiple regulatory requirements to one single operational task. A critical task for the successful AE is to conform to SMS regulations by ongoing research and development. 

A successful AE knows the path through the SMS maze.

The first task for a successful AE in the third phase is to review and amend their current safety management system manual. When their initial manuals were built, SMS knowledge was limited and data available how to apply processes to human behaviors were inadequate. Quality control and quality assurance had been applied to material strength and material fatigue for decades and the same approach was now applied to the SMS. Over time both airports and airlines found that using this same approach was not complete or effective. Their initial SMS manuals were correctly designed and approved by the regulator based on what was known at that time. Over time SMS evolved to include several unknown factors and changes to SMS became inevitable. The successful AE understands that SMS process applied to mechanical breakdown, material fatigue or occurrences are different than processes required when the human factors system breaks down. The hazard pyramid becomes inverted in a human factor system, since there is a learning factors involved, which is not available to mechanical breakdown, material fatigue or occurrence likelihood. For each vivid event a person is exposed to, that person learns to avoid incidents and near-misses. Exposure to vivid events is crucial to safety in aviation and any pilot who grew up in a protected environment with little or no exposures to vivid events, has lost the value of these experiences. 


Roles and responsibilities for a successful AE is oversight, while roles and responsibilities for the person managing the SMS is operations. The successful AE has comprehensive knowledge of each statement in their safety policy to deliberate and speak on the policy in a complete matter. A successful AE has established a comprehensive goal setting program that includes a process to complete one goal by applying the 14-days goal setting process. A successful AE has researched and developed processes to identify hazards. These are not only limited to hazards discovered by the AE or other personnel, but researched hazards, hazards from targeted inspections and hazards identified by in the regular data collection processes. Hazard identification is ongoing and monitored. A successful AE is responsible for oversight of training and that the person managing the SMS is completing training on schedule and on-demand as required. Training is both formal and informal and is ongoing and a part of a daily self-development process. Most importantly, a successful AE is able to deliberate on why operations are safe most of the time. 


A successful AE applies a proven statistical control process to analyze how processes conform to regulatory requirement. An SMS manual contains all safety management system processes and a process for personnel to be aware of their responsibilities. In phase one and two, the SMS manual was often handed over to personnel and they were expected to do self-study and learn on their own. In phase three of a successful AE, the AE has established a system where daily on-the-job tasks are targeted for personnel to maintain awareness of their responsibilities. A successful AE operate with a quality assurance program, which includes a daily quality control system as a prerequisite and process for their triennial audits. 


A major change for a successful AE is to include in both airport and airline operations any additional requirements for the safety management system. This includes unregulated tasks. As an example, a pilot is required to ensure that an aerodrome is suitable for the intended operation. An aerodrome operator is responsible for compliance with their published services. During the pre-SMS era, an aerodrome operator could publish a runway surface condition NOTAM without any further responsibility. With the global reporting format requirement and SMS regulation, an aerodrome operator at a certified airport, must ensure that the airport maintain compliance with airport standards for each arrival and departure. It is no longer acceptable to publish a NOTAM only. In addition to the NOTAM, the aerodrome operator must do something to ensure compliance, which is achieved by a simple risk analysis or a risk assessment for comprehensive tasks.  


An airport operator is required to complete an Aircraft Movement Surface Condition Report during their published hours of operations and at least every 8 hours, or when there are operational changes. A change in wind direction would trigger a new report, since a new runway is now active. Monitoring the weather is a responsibility of the successful AE, while the person managing the SMS implement project the plans assigned by the AE. A daily quality control system includes several tasks to be completed hourly, daily, weekly, monthly annually or on-demand as required. 


An addition change for the AE in their third phase of the SMS, is to develop internal Operations Plans as their long-term corrective action plans, and to monitor the concerns of the civil aviation industry in respect of safety and their perceived effect on the holder of the airport certificate. The requirement list for a successful AE could continue for several pages with line-item tasks to conform to regulatory requirements.  


There is no magic wand out there to make anyone a successful accountable executive for an airport or airline. Electronic data collection tools and cloudbased SMS are great and necessary tools, but they are not the solutions to become a successful AE. 





Saturday, May 28, 2022

A Successful SMS Policy

A Successful SMS Policy 

 By OffRoadPilots

There are seven traits to a successful safety management system (SMS) policy. 

1)    The SMS policy is written on behalf of the customers;

2)    The policy is written in plain language;

3)    The policy express accountability;

4)    An SMS policy conveys an attainable vision;

5)    The policy details task performance expectations;

6)    The policy is unambiguous; and

7)    A successful SMS policy is short.

Every successful SMS policy begins with a blank page

When writing an SMS policy, it is critical to know that an SMS policy is not about safety. Safety is a buzzword, and a safety-card, used when there are no justifications for applied actions. It is important to understand that the safety-card is applied to emotions and opinions rather than data and facts. When the safety-card is played all oppositions are silenced, since nobody wants to argue against safety. The safety-card is a manipulative statement often used in aviation. When someone wants a specific result, they use the safety-card to get what they want, and they draw root-cause solutions from an emotional data base rather than an analytic data base. Definition of safety is the condition of being safe from undergoing or causing hurt, injury, or loss. When applying safety to aviation, being airlines or airports, all operations and movements must cease to ensure safety by this definition. There will always be an inherited risk in aviation. In a healthy SMS environment, there is no censorship to opposition or concerns.  


A successful SMS policy protects high value assets.

The first criteria of a successful SMS policy are that the policy is written on behalf of customers, clients, users, vendors, and workers. SMS is a businesslike approach to airport and airline operations, where your customers pay your bills, and your competitors set your sales price. SMS is a systematic and proactive process for operational management. As with any management systems, it provides goal setting, planning, and performance monitoring. A safety management system is woven into the fabric of an organization. An SMS policy must make commitments for customers to be assured of a successful flight and reliability in airport operations. A successful flight is heavily dependent on airport operations since any flight originates and terminates at an aerodrome. A customer may be an airline, an air carrier, an airport, a freight carrier, a flight crew, an aircraft owner, an aircraft manufacturer, or a travel agent. A client is a customer who purchases professional on-demand services from an airline or airport, such as an aerial fire-fighting operator or alternate airport user. A client establishes a direct business relationship, while a customer is relying on the business relationship between airports and airlines. A travelling customer may choose to travel an additional 2-3 hours by ground to depart out of a preferred airport or with a preferred airline. Users are both air operator and ground operators with a role in servicing airport or airline operations. A vendor is a person or organization servicing airline or airport customers. The workers are airline or airport workers and include all personnel who are involved in airport reliability and aircraft operations. An SMS policy that is written on behalf of workers, include workers as a foundation for a successful SMS policy with a commitment to support workers in their daily tasks.    


The second part of a successful SMS policy is that it is written in plain language. A plain language is written to an elementary grade level. The purpose of an SMS policy is not to tell the world that you are a subject matter erudite by your enthusiastic and complex language, but it is to tell the world what your SMS policy is all about. 


The third element of a successful SMS policy is to express accountability. This is forward-looking accountability and is not the backwards-looking accountability to be “held accountable”. A forward-looking accountability environment is a just-culture, where there is trust, learning, accountability, and information sharing. Accountability is about job-performance and to complete job-tasks to the level of conforming to regulatory requirements, job-description, expertise, and training, to an acceptable standard, or to an expected outcome. Accountability is also a commitment to excellence and to do the right thing when nobody is watching. 


A successful SMS policy is simple and accessible.

Number four of a successful SMS policy is to convey a vision. It is not enough to state a vision in the SMS policy, but the vision must carry an emotion to reach an outcome. A vision to be safe, or to be the safest airline or airport, does not mean anything to anybody, except for the writer of the policy. Feel-good words were often used in pre-SMS policies to make feel-good statements. Many of these policy manuals were literarily collecting dust on the shelf and never applied to operations. People do not remember what you said, but they will remember how they felt when the words were spoken or read. The emotions in the SMS policy is what convey your message of a vision.


The fifth part of an SMS policy is to detail task performance expectations. This does not imply to spell out in details what the performance expectations are, but to highlight the roles of positions in the organizational chart. Within an SMS enterprise there are generally speaking five positions with roles under the SMS. The role of the Accountable Executive is to be responsible for operations authorized under the certificate and accountable on their behalf of the certificate holder for meeting the requirements of the regulations and the role of an SMS manger is operational management of the SMS. The roles of a Quality Assurance Program manager is to review and audits all areas of operations for compliance with regulations, standards, and policies, and audits of processes conformity level to regulatory compliance, expectations, and risk level in operations. The role of all other personnel in the org-chart is to submit hazard, incident and accident reports and provide suggestions for incremental process improvements. The fifth position within an SMS Enterprise is a voluntary position as a confidential adviser to the accountable executive. Normally, an AE has other job functions, such as being the CEO or President of an organization, in addition the task to “be responsible for operations authorized under the certificate”. The certificate responsibility includes the daily quality control task, which is a prerequisite for a quality assurance program. The role of an AE includes daily oversight of all activates of the SMS Manager, QAP Manager and all personnel, in addition to ensuring regulatory compliance for oversight inspections. The AE task is a full-time job in itself, and when an AE has other than AE responsibilities to the organization, it becomes impossible to maintain ongoing regulatory compliance. Just as an AE, or CEO, is supported by accountants, attorneys or subject matter experts, they also need the support of a confidential adviser to maintain operational regulatory compliance as an airport or airline.  


Number six of an SMS policy is to write a policy that is unambiguous. The policy is not open to more than one interpretation of each statement in the policy. 


The seventh element of a successful SMS policy is that the policy is short. That an SMS policy is short does not imply that the policy contains incomplete statements or justifications, but that items addressed in the policy are in paragraphs with individual sub-headings of the policy. 


Objectives and goals are addressed separately from an SMS policy, but a successful policy includes a statement that there is a goal-setting process established to comply with the seven elements of this policy, and for measuring the attainment of these goals.




Saturday, May 14, 2022

Why Long-Term CAPs Crash

 Why Long-Term CAPs Crash

By OffRoadPilots

When the Safety Management System (SMS) regulations came into force, there were little or no guidance material available to design useful long-term corrective actions to findings. Long-term corrective actions were defined by how long time it would take to implement. While short-term corrective actions also were defined by time between design and implementation, short-term corrective action did not change with the SMS, since the fix or repair required to return to normal operations was already in place. If an aircraft engine failed, the short-term corrective action was to change out the engine with an engine that had not failed yet. 

Paved roads are a long-term CAPs. No need to change the road after an accident.

A long-term corrective action is a system level change and there are seven levels to a long-term corrective action. The first level is discovery, either by hazard identification, audit finding, or an unplanned event occurrence. The second level is the immediate corrective action, which is an immediate reaction to a hazard, finding or event to establish a degree of supervision and operational management. The third level is the short-term corrective action, or the repair to return to normal operations. The fourth level is the root cause analysis, which is new with the introduction of SMS. The fifth level, and another new element of the safety management system is the long-term corrective action, or the system repair by continuous, or continual changes. For the purpose of a safety management system, continuous is a change to the current system, while continual change is a change of the system itself. A continuous change could be to move from hand-written paper copies to typewriter copies, while a continual change would be to change the system from a paper-document system to an electronic system. At this time in the process, it is unknown if a change implemented is an improvement or deterioration of a system. The sixth and crucial to success of the SMS is to define what the expected outcome of a long-term system change is. The seventh level of a corrective action plan is the analysis of expected outcomes and to compare expectations with actual outcome. Root cause analysis and long-term corrective action are not new to the aviation industry but became new as additional elements for operators to consider since prior to SMS they were only considered by accident investigators and regulators. 

All parts, or systems, of a car is not changed out if one of the systems fails.

Systems are inter-dependent processes to achieve a defined result which comprises of policies, processes, procedures, and acceptable work practices. A system is the cause or expected outcome and conditions are the tasks requirements triggered by the system design. A system could be the document and records system, where an expected outcome is to generate data for an SMS enterprise to design, develop and implement action plans. A process is to define the 5-W’s + How (What, When, Where, Who (position), Why and How) to compete a task. A process could be to collect data for flight planning. A procedure are the tasks, sequence and timing of steps required to complete a process. A procedure could be the specific tasks, sequence, and timing of steps to control an engine failure. Acceptable work practices are practices accepted by an SMS enterprise since it is impossible to have procedure for everything. An acceptable work practice could be a person’s operational judgement decision such as to land an aircraft or initiate a go-around.  


Long-Term corrective actions are highly influenced by the Accountable Executive (AE) and their opinion of the best approach to achieve their goals. The position of an AE is often the CEO of the company, who has a successful track record in business administration, but without being a data analytical expert is still the final decision maker for safety in operations. 


April 28 was World Day for Safety and Health at Work, recognized around the world to draw attention to the estimated 317 million accidents that take place on the job each year across all industries. A common safety statement is to keep safety above all as the priority, meaning that an AE will never sacrifice safety for any other purpose. This is a well intended statement, but without safety analytical expertise the statement falls apart when it continues to read that a safety approach is common sense and simple by never sacrifice safety rules or policies and procedures for any other goal, always adhere to rules, policies, and best practices for ensuring quality service, and report any incidences that negatively impact the safety of team members. If safety was common sense and as simple as to adhere to rules and policies, there would not be any incidents to report. Pilots of the 1957 Grand Canyon crash followed the rules. 


Long-term CAPs go wrong because they are not long-term CAPs. They are corrective action plans which takes a long time to complete, but the effect of the CAP is still a short fix, or repair. Long-term CAPs are system CAPs. Systems are not as complicated as we often make them and by making it complicated CAPs often go wrong. The regulator has shown a trend that they do not comprehend long-term system CAPs. This became evident to an operator, who submitted a comprehensive long-term CAP for regulatory findings. The regulator rejected the CAP with the reasoning that it was too comprehensive, that it was complex, and it was detailed, and it was irrelevant to the regulator that the outcome was a simple system long-term CAP. The regulator’s long-term CAP form is no larger than a 3x6 index card. It takes more time to plan a project than it takes to build it. Designing long-term CAPs are operational project plans. 

Long-term CAP is incremental improvements within a system

 A long-term corrective action plan is to provide long-term solutions to correct problems in the system that led to the unexpected event. An unreasonable expectation is that a long-term CAP ensures that this type of event will never happen again. There are no unreasonable expectations or goals, there are only unreasonable timelines. With an exception for the same event to never happen again, the timeline of “never” is an infinite timeline. An expectation of “never” is an unreasonable timeline, since an event which has occurred, will occur again at a later date. History repeat itself. An unreasonable timeline is a reason why a CAP goes wrong. A second unreasonable expectation in a long-term CAP is that all contributing causes and associated systems are corrected. An associated system in a birdstrike event, includes birds. Some of the birds have a system they call the migratory bird seasons. This is a common cause variation system, which is a requirement for their system to work, and it is impossible for anyone to correct that system. An unreasonable expectation is a second reason why a CAP goes wrong. When task with these two requirements to ensure that an event will never happen again and an expectation to change a common cause variation, the trap operators fall into, both airlines and airports, large and small, is to design their CAP to include these items for one reason only, which is to complete the checkbox task to conform to an expectation of what it takes for regulatory compliance. Since regulatory compliance is when operations is in a static state of operations, it is possible to comply by ensuring there are no aircraft movements. However, this is not how the real world works and the purpose of an airport is aircraft movements. When movements are happening, that’s when the regulatory compliance gap comes into play. 


Long-term CAPs is not to do root cause analysis and make changes to operations so that an unexpected event never happens again. Making long-term CAP project plans is to design, develop, and operate with safety cases and internal operations plans. When you have these plans in place, the only change, or long-term CAP that is needed, is to make short-term changes to the plans for incremental safety improvements. Take a minute an assess a gravel runway. There are still airports out there that offer gravel runway services only. An airport operator makes a safety case for a gravel runway. Based on the safety case they make a gravel operations plan. Their long-term CAP is now the operations plan itself. In the plan they grade the runway once a month. Then one day there is a runway excursion because of the large ruts in the runway. Their long-term CAP fix is now in their operations plan and the fix is to change grading of the runway to every two weeks and after heavy rain. This is literally how simple a long-term CAP is when an operator comes prepared for it with safety cases and operations plans. The reason for long-term CAP crashes is because they are designed to crash.




Sunday, May 1, 2022

The Unintended Consequences of a Non-Punitive SMS Policy

 The Unintended Consequences of a Non-Punitive SMS Policy

By OffRoadPilots

An SMS enterprise is required to implement a non-punitive reporting policy. The intent of this policy is that more incident reports or near misses will be submitted to management when there is a policy in place that a contributor will not be reprimanded, fired, criminally charged, or other punitive actions, such as a reduction in pay or benefits, will be taken against them. An implied benefit from a non-punitive reporting system is that an operator, being airline or airport, will learn from the content of these reports and implement changes to operations as needed for safety improvements. 

A non-punitive policy that needs to be decoded is not a policy.

An objective of a non-punitive SMS policy is to support the overarching SMS policy goals of an SMS enterprise. Examples of an SMS policy goals are to have a goal-setting process in place, processes for live hazard identification, reporting and corrective actions, processes to train personnel, a process to operate with a daily quality control program as a prerequisite for their quality assurance program, processes for conducting periodic audits of the safety management system, or a non-punitive reporting policy. Conventional wisdom is that the non-punitive reporting policy is the only element of an SMS policy that ensures reporting disclosure of all near misses, incidents, or hazards. When an SMS enterprise is relying on their non-punitive reporting policy as their only tool for sole-source reporting, they are taking the SMS down the wrong path. Sole-source reporting is reporting of an event that otherwise would be unknow to the operator since no other person had knowledge of the event to report it. A sole-source report could be an IFR altitude deviation in uncontrolled airspace, or operational deviations out of a remote airport without air traffic services.  


Negative thinking generates an incorrect root cause.

A non-punitive reporting policy is a crucial tool for an SMS enterprise, but it is not, and cannot be the only tool for sole-source reporting. If there is no benefit for the contributor to report, the intervals between receiving reports are imaginary, theoretical, virtual, or fictional when solely based on a non-punitive policy. There is no benefit for a contributor to report an undetected event that was corrected. Individuals reporting more reports than other is actually a red-flag and does not contribute to safety but is a contributor for suspicions. Suspicion or qualification assumptions is a hazard to incremental safety improvements. A negative mind, such as suspicion, attracts negative behaviors. Negative thoughts are the greatest resource for destroying success. The greatest enemies to success are negative thoughts of all kinds. They hold you down, tire you out, and take away all your joy in life. From the beginning of time, negative thoughts have done more harm to individuals and societies than all the plagues of history. One of the most important goals is to remove all negative thinking about operational personnel. A non-punitive reporting process foster negative thinking in an organization. Some of the causes for negative thinking are rationalization, which causes automatic negative thoughts. When you rationalize, you attempt to give a socially acceptable explanation for an otherwise socially unacceptable act. Rationalization is to explain away or put a favorable light on something that you have done that you feel bad or unhappy about. Rationalization cast yourself in the roles of the victim, and you mark the other person or organization into the oppressor.


Negative thinking applies to all organizational structures and to small and large organizations. When information is analyzed by emotions rather than data analyzed within a statistical process control system, the findings will lead to an incorrect conclusion. When incorrect conclusions are applied to incremental safety improvements, safety improvements become random. Relying on an SMS manager’s random skills for safety improvements is a hazard in itself. As an example, when analyzing the root cause for aircraft wing strikes while towing between a sample of operators, negative thinking affects the root cause finding. In this example, a graph shows one operator with several more wing strikes than another operator and another operator shows several more days without a towing strike than the rest of the group. When analyzed in the negative thinking mode, the root cause is to enforce towing policies for operators with higher towing strike events and fewer days since a strike occurred. When analyzed as data and applying an SPC analysis, the processes between operators are in-control. Negative thinking applied an enforcement root cause, while an SPC analysis shows in-control processes. After it was concluded that the right thing was to enforce towing policies, one operator in the group asked what the other operator without strikes did correctly. When asked, the answer was: “We don’t tow, since we don’t have hangars to move aircraft in and out of”. 

Sometime ago, several news papers published a report that a stash of cocaine was found by a maintenance worker in the plane's avionics bay. The flight crew reported to the authorities that they found illegal drugs on the plane, and then they were detained and arrested by the local authorities for possession of illegal drugs. The flight crew reported in good-faith and under the assurance of the company’s non-punitive policy their findings to the authorities. Their reporting of a finding caused them to be arrested. 


When SMS was implemented as a regulatory requirement several years ago, the regulator acted as a consultant and advised operators to write a non-punitive policy to include conditions under which punitive disciplinary action would be considered, e.g., illegal activity, negligence or wilful misconduct. Transporting illegal drugs in aircraft is an illegal activity, it is negligence, and it is wilful misconduct, so the non-punitive policy does not apply to the flight crew. Some might say that the crew did not know about the drugs. However, the expectation applied to a non-punitive policy did not include to have knowledge of, as a condition for the policy to be applied. The non-punitive policy failed this flight crew considerably. When implementing the SMS recommendations, operators did not include in the non-punitive policy that the policy is only applicable in a jurisdiction where the policy is accepted, or by international agreements. In addition, the regulation itself was not applied to the non-punitive policy. The regulation sates in part: “…including the conditions under which immunity from disciplinary action will be granted…”   The regulation states that immunity is not granted unless specifically granted by the operator. When SMS is elevated to a level without accountability by the operator, and to a level where a person acting in good faith when reporting is punished, there is no just-culture in operations. Without just-culture there is no safety management system. 


The unintended consequence of a non-punitive policy is to foster negative thinking, and the promise to grant immunity in other jurisdiction than of the SMS enterprise. 





Unintended Consequences of Hazard Identification

  Unintended Consequences of Hazard Identification By OffRoadPilots A n SMS enterprise is required to operate with a process to identifying ...