A Successful SMS Policy

A Successful SMS Policy 

 By OffRoadPilots

There are seven traits to a successful safety management system (SMS) policy. 

1)    The SMS policy is written on behalf of the customers;

2)    The policy is written in plain language;

3)    The policy express accountability;

4)    An SMS policy conveys an attainable vision;

5)    The policy details task performance expectations;

6)    The policy is unambiguous; and

7)    A successful SMS policy is short.

Every successful SMS policy begins with a blank page

When writing an SMS policy, it is critical to know that an SMS policy is not about safety. Safety is a buzzword, and a safety-card, used when there are no justifications for applied actions. It is important to understand that the safety-card is applied to emotions and opinions rather than data and facts. When the safety-card is played all oppositions are silenced, since nobody wants to argue against safety. The safety-card is a manipulative statement often used in aviation. When someone wants a specific result, they use the safety-card to get what they want, and they draw root-cause solutions from an emotional data base rather than an analytic data base. Definition of safety is the condition of being safe from undergoing or causing hurt, injury, or loss. When applying safety to aviation, being airlines or airports, all operations and movements must cease to ensure safety by this definition. There will always be an inherited risk in aviation. In a healthy SMS environment, there is no censorship to opposition or concerns.  

 

A successful SMS policy protects high value assets.

The first criteria of a successful SMS policy are that the policy is written on behalf of customers, clients, users, vendors, and workers. SMS is a businesslike approach to airport and airline operations, where your customers pay your bills, and your competitors set your sales price. SMS is a systematic and proactive process for operational management. As with any management systems, it provides goal setting, planning, and performance monitoring. A safety management system is woven into the fabric of an organization. An SMS policy must make commitments for customers to be assured of a successful flight and reliability in airport operations. A successful flight is heavily dependent on airport operations since any flight originates and terminates at an aerodrome. A customer may be an airline, an air carrier, an airport, a freight carrier, a flight crew, an aircraft owner, an aircraft manufacturer, or a travel agent. A client is a customer who purchases professional on-demand services from an airline or airport, such as an aerial fire-fighting operator or alternate airport user. A client establishes a direct business relationship, while a customer is relying on the business relationship between airports and airlines. A travelling customer may choose to travel an additional 2-3 hours by ground to depart out of a preferred airport or with a preferred airline. Users are both air operator and ground operators with a role in servicing airport or airline operations. A vendor is a person or organization servicing airline or airport customers. The workers are airline or airport workers and include all personnel who are involved in airport reliability and aircraft operations. An SMS policy that is written on behalf of workers, include workers as a foundation for a successful SMS policy with a commitment to support workers in their daily tasks.    

 

The second part of a successful SMS policy is that it is written in plain language. A plain language is written to an elementary grade level. The purpose of an SMS policy is not to tell the world that you are a subject matter erudite by your enthusiastic and complex language, but it is to tell the world what your SMS policy is all about. 

 

The third element of a successful SMS policy is to express accountability. This is forward-looking accountability and is not the backwards-looking accountability to be “held accountable”. A forward-looking accountability environment is a just-culture, where there is trust, learning, accountability, and information sharing. Accountability is about job-performance and to complete job-tasks to the level of conforming to regulatory requirements, job-description, expertise, and training, to an acceptable standard, or to an expected outcome. Accountability is also a commitment to excellence and to do the right thing when nobody is watching. 

 

A successful SMS policy is simple and accessible.

Number four of a successful SMS policy is to convey a vision. It is not enough to state a vision in the SMS policy, but the vision must carry an emotion to reach an outcome. A vision to be safe, or to be the safest airline or airport, does not mean anything to anybody, except for the writer of the policy. Feel-good words were often used in pre-SMS policies to make feel-good statements. Many of these policy manuals were literarily collecting dust on the shelf and never applied to operations. People do not remember what you said, but they will remember how they felt when the words were spoken or read. The emotions in the SMS policy is what convey your message of a vision.

 

The fifth part of an SMS policy is to detail task performance expectations. This does not imply to spell out in details what the performance expectations are, but to highlight the roles of positions in the organizational chart. Within an SMS enterprise there are generally speaking five positions with roles under the SMS. The role of the Accountable Executive is to be responsible for operations authorized under the certificate and accountable on their behalf of the certificate holder for meeting the requirements of the regulations and the role of an SMS manger is operational management of the SMS. The roles of a Quality Assurance Program manager is to review and audits all areas of operations for compliance with regulations, standards, and policies, and audits of processes conformity level to regulatory compliance, expectations, and risk level in operations. The role of all other personnel in the org-chart is to submit hazard, incident and accident reports and provide suggestions for incremental process improvements. The fifth position within an SMS Enterprise is a voluntary position as a confidential adviser to the accountable executive. Normally, an AE has other job functions, such as being the CEO or President of an organization, in addition the task to “be responsible for operations authorized under the certificate”. The certificate responsibility includes the daily quality control task, which is a prerequisite for a quality assurance program. The role of an AE includes daily oversight of all activates of the SMS Manager, QAP Manager and all personnel, in addition to ensuring regulatory compliance for oversight inspections. The AE task is a full-time job in itself, and when an AE has other than AE responsibilities to the organization, it becomes impossible to maintain ongoing regulatory compliance. Just as an AE, or CEO, is supported by accountants, attorneys or subject matter experts, they also need the support of a confidential adviser to maintain operational regulatory compliance as an airport or airline.  

 

Number six of an SMS policy is to write a policy that is unambiguous. The policy is not open to more than one interpretation of each statement in the policy. 

 

The seventh element of a successful SMS policy is that the policy is short. That an SMS policy is short does not imply that the policy contains incomplete statements or justifications, but that items addressed in the policy are in paragraphs with individual sub-headings of the policy. 

 

Objectives and goals are addressed separately from an SMS policy, but a successful policy includes a statement that there is a goal-setting process established to comply with the seven elements of this policy, and for measuring the attainment of these goals.

 

 

OffRoadPilots

Why Long-Term CAPs Crash

 Why Long-Term CAPs Crash

By OffRoadPilots

When the Safety Management System (SMS) regulations came into force, there were little or no guidance material available to design useful long-term corrective actions to findings. Long-term corrective actions were defined by how long time it would take to implement. While short-term corrective actions also were defined by time between design and implementation, short-term corrective action did not change with the SMS, since the fix or repair required to return to normal operations was already in place. If an aircraft engine failed, the short-term corrective action was to change out the engine with an engine that had not failed yet. 

Paved roads are a long-term CAPs. No need to change the road after an accident.

A long-term corrective action is a system level change and there are seven levels to a long-term corrective action. The first level is discovery, either by hazard identification, audit finding, or an unplanned event occurrence. The second level is the immediate corrective action, which is an immediate reaction to a hazard, finding or event to establish a degree of supervision and operational management. The third level is the short-term corrective action, or the repair to return to normal operations. The fourth level is the root cause analysis, which is new with the introduction of SMS. The fifth level, and another new element of the safety management system is the long-term corrective action, or the system repair by continuous, or continual changes. For the purpose of a safety management system, continuous is a change to the current system, while continual change is a change of the system itself. A continuous change could be to move from hand-written paper copies to typewriter copies, while a continual change would be to change the system from a paper-document system to an electronic system. At this time in the process, it is unknown if a change implemented is an improvement or deterioration of a system. The sixth and crucial to success of the SMS is to define what the expected outcome of a long-term system change is. The seventh level of a corrective action plan is the analysis of expected outcomes and to compare expectations with actual outcome. Root cause analysis and long-term corrective action are not new to the aviation industry but became new as additional elements for operators to consider since prior to SMS they were only considered by accident investigators and regulators. 

All parts, or systems, of a car is not changed out if one of the systems fails.

Systems are inter-dependent processes to achieve a defined result which comprises of policies, processes, procedures, and acceptable work practices. A system is the cause or expected outcome and conditions are the tasks requirements triggered by the system design. A system could be the document and records system, where an expected outcome is to generate data for an SMS enterprise to design, develop and implement action plans. A process is to define the 5-W’s + How (What, When, Where, Who (position), Why and How) to compete a task. A process could be to collect data for flight planning. A procedure are the tasks, sequence and timing of steps required to complete a process. A procedure could be the specific tasks, sequence, and timing of steps to control an engine failure. Acceptable work practices are practices accepted by an SMS enterprise since it is impossible to have procedure for everything. An acceptable work practice could be a person’s operational judgement decision such as to land an aircraft or initiate a go-around.  

 

Long-Term corrective actions are highly influenced by the Accountable Executive (AE) and their opinion of the best approach to achieve their goals. The position of an AE is often the CEO of the company, who has a successful track record in business administration, but without being a data analytical expert is still the final decision maker for safety in operations. 

 

April 28 was World Day for Safety and Health at Work, recognized around the world to draw attention to the estimated 317 million accidents that take place on the job each year across all industries. A common safety statement is to keep safety above all as the priority, meaning that an AE will never sacrifice safety for any other purpose. This is a well intended statement, but without safety analytical expertise the statement falls apart when it continues to read that a safety approach is common sense and simple by never sacrifice safety rules or policies and procedures for any other goal, always adhere to rules, policies, and best practices for ensuring quality service, and report any incidences that negatively impact the safety of team members. If safety was common sense and as simple as to adhere to rules and policies, there would not be any incidents to report. Pilots of the 1957 Grand Canyon crash followed the rules. 

 

Long-term CAPs go wrong because they are not long-term CAPs. They are corrective action plans which takes a long time to complete, but the effect of the CAP is still a short fix, or repair. Long-term CAPs are system CAPs. Systems are not as complicated as we often make them and by making it complicated CAPs often go wrong. The regulator has shown a trend that they do not comprehend long-term system CAPs. This became evident to an operator, who submitted a comprehensive long-term CAP for regulatory findings. The regulator rejected the CAP with the reasoning that it was too comprehensive, that it was complex, and it was detailed, and it was irrelevant to the regulator that the outcome was a simple system long-term CAP. The regulator’s long-term CAP form is no larger than a 3x6 index card. It takes more time to plan a project than it takes to build it. Designing long-term CAPs are operational project plans. 

Long-term CAP is incremental improvements within a system

 A long-term corrective action plan is to provide long-term solutions to correct problems in the system that led to the unexpected event. An unreasonable expectation is that a long-term CAP ensures that this type of event will never happen again. There are no unreasonable expectations or goals, there are only unreasonable timelines. With an exception for the same event to never happen again, the timeline of “never” is an infinite timeline. An expectation of “never” is an unreasonable timeline, since an event which has occurred, will occur again at a later date. History repeat itself. An unreasonable timeline is a reason why a CAP goes wrong. A second unreasonable expectation in a long-term CAP is that all contributing causes and associated systems are corrected. An associated system in a birdstrike event, includes birds. Some of the birds have a system they call the migratory bird seasons. This is a common cause variation system, which is a requirement for their system to work, and it is impossible for anyone to correct that system. An unreasonable expectation is a second reason why a CAP goes wrong. When task with these two requirements to ensure that an event will never happen again and an expectation to change a common cause variation, the trap operators fall into, both airlines and airports, large and small, is to design their CAP to include these items for one reason only, which is to complete the checkbox task to conform to an expectation of what it takes for regulatory compliance. Since regulatory compliance is when operations is in a static state of operations, it is possible to comply by ensuring there are no aircraft movements. However, this is not how the real world works and the purpose of an airport is aircraft movements. When movements are happening, that’s when the regulatory compliance gap comes into play. 

 

Long-term CAPs is not to do root cause analysis and make changes to operations so that an unexpected event never happens again. Making long-term CAP project plans is to design, develop, and operate with safety cases and internal operations plans. When you have these plans in place, the only change, or long-term CAP that is needed, is to make short-term changes to the plans for incremental safety improvements. Take a minute an assess a gravel runway. There are still airports out there that offer gravel runway services only. An airport operator makes a safety case for a gravel runway. Based on the safety case they make a gravel operations plan. Their long-term CAP is now the operations plan itself. In the plan they grade the runway once a month. Then one day there is a runway excursion because of the large ruts in the runway. Their long-term CAP fix is now in their operations plan and the fix is to change grading of the runway to every two weeks and after heavy rain. This is literally how simple a long-term CAP is when an operator comes prepared for it with safety cases and operations plans. The reason for long-term CAP crashes is because they are designed to crash.

 

 

OffRoadPilots

The Unintended Consequences of a Non-Punitive SMS Policy

 The Unintended Consequences of a Non-Punitive SMS Policy

By OffRoadPilots

An SMS enterprise is required to implement a non-punitive reporting policy. The intent of this policy is that more incident reports or near misses will be submitted to management when there is a policy in place that a contributor will not be reprimanded, fired, criminally charged, or other punitive actions, such as a reduction in pay or benefits, will be taken against them. An implied benefit from a non-punitive reporting system is that an operator, being airline or airport, will learn from the content of these reports and implement changes to operations as needed for safety improvements. 

A non-punitive policy that needs to be decoded is not a policy.

An objective of a non-punitive SMS policy is to support the overarching SMS policy goals of an SMS enterprise. Examples of an SMS policy goals are to have a goal-setting process in place, processes for live hazard identification, reporting and corrective actions, processes to train personnel, a process to operate with a daily quality control program as a prerequisite for their quality assurance program, processes for conducting periodic audits of the safety management system, or a non-punitive reporting policy. Conventional wisdom is that the non-punitive reporting policy is the only element of an SMS policy that ensures reporting disclosure of all near misses, incidents, or hazards. When an SMS enterprise is relying on their non-punitive reporting policy as their only tool for sole-source reporting, they are taking the SMS down the wrong path. Sole-source reporting is reporting of an event that otherwise would be unknow to the operator since no other person had knowledge of the event to report it. A sole-source report could be an IFR altitude deviation in uncontrolled airspace, or operational deviations out of a remote airport without air traffic services.  

 

Negative thinking generates an incorrect root cause.

A non-punitive reporting policy is a crucial tool for an SMS enterprise, but it is not, and cannot be the only tool for sole-source reporting. If there is no benefit for the contributor to report, the intervals between receiving reports are imaginary, theoretical, virtual, or fictional when solely based on a non-punitive policy. There is no benefit for a contributor to report an undetected event that was corrected. Individuals reporting more reports than other is actually a red-flag and does not contribute to safety but is a contributor for suspicions. Suspicion or qualification assumptions is a hazard to incremental safety improvements. A negative mind, such as suspicion, attracts negative behaviors. Negative thoughts are the greatest resource for destroying success. The greatest enemies to success are negative thoughts of all kinds. They hold you down, tire you out, and take away all your joy in life. From the beginning of time, negative thoughts have done more harm to individuals and societies than all the plagues of history. One of the most important goals is to remove all negative thinking about operational personnel. A non-punitive reporting process foster negative thinking in an organization. Some of the causes for negative thinking are rationalization, which causes automatic negative thoughts. When you rationalize, you attempt to give a socially acceptable explanation for an otherwise socially unacceptable act. Rationalization is to explain away or put a favorable light on something that you have done that you feel bad or unhappy about. Rationalization cast yourself in the roles of the victim, and you mark the other person or organization into the oppressor.

 

Negative thinking applies to all organizational structures and to small and large organizations. When information is analyzed by emotions rather than data analyzed within a statistical process control system, the findings will lead to an incorrect conclusion. When incorrect conclusions are applied to incremental safety improvements, safety improvements become random. Relying on an SMS manager’s random skills for safety improvements is a hazard in itself. As an example, when analyzing the root cause for aircraft wing strikes while towing between a sample of operators, negative thinking affects the root cause finding. In this example, a graph shows one operator with several more wing strikes than another operator and another operator shows several more days without a towing strike than the rest of the group. When analyzed in the negative thinking mode, the root cause is to enforce towing policies for operators with higher towing strike events and fewer days since a strike occurred. When analyzed as data and applying an SPC analysis, the processes between operators are in-control. Negative thinking applied an enforcement root cause, while an SPC analysis shows in-control processes. After it was concluded that the right thing was to enforce towing policies, one operator in the group asked what the other operator without strikes did correctly. When asked, the answer was: “We don’t tow, since we don’t have hangars to move aircraft in and out of”. 

Sometime ago, several news papers published a report that a stash of cocaine was found by a maintenance worker in the plane's avionics bay. The flight crew reported to the authorities that they found illegal drugs on the plane, and then they were detained and arrested by the local authorities for possession of illegal drugs. The flight crew reported in good-faith and under the assurance of the company’s non-punitive policy their findings to the authorities. Their reporting of a finding caused them to be arrested. 

 

When SMS was implemented as a regulatory requirement several years ago, the regulator acted as a consultant and advised operators to write a non-punitive policy to include conditions under which punitive disciplinary action would be considered, e.g., illegal activity, negligence or wilful misconduct. Transporting illegal drugs in aircraft is an illegal activity, it is negligence, and it is wilful misconduct, so the non-punitive policy does not apply to the flight crew. Some might say that the crew did not know about the drugs. However, the expectation applied to a non-punitive policy did not include to have knowledge of, as a condition for the policy to be applied. The non-punitive policy failed this flight crew considerably. When implementing the SMS recommendations, operators did not include in the non-punitive policy that the policy is only applicable in a jurisdiction where the policy is accepted, or by international agreements. In addition, the regulation itself was not applied to the non-punitive policy. The regulation sates in part: “…including the conditions under which immunity from disciplinary action will be granted…”   The regulation states that immunity is not granted unless specifically granted by the operator. When SMS is elevated to a level without accountability by the operator, and to a level where a person acting in good faith when reporting is punished, there is no just-culture in operations. Without just-culture there is no safety management system. 

 

The unintended consequence of a non-punitive policy is to foster negative thinking, and the promise to grant immunity in other jurisdiction than of the SMS enterprise. 

 

 

 

OffRoadPilots