Saturday, May 14, 2022

Why Long-Term CAPs Crash

 Why Long-Term CAPs Crash

By OffRoadPilots

When the Safety Management System (SMS) regulations came into force, there were little or no guidance material available to design useful long-term corrective actions to findings. Long-term corrective actions were defined by how long time it would take to implement. While short-term corrective actions also were defined by time between design and implementation, short-term corrective action did not change with the SMS, since the fix or repair required to return to normal operations was already in place. If an aircraft engine failed, the short-term corrective action was to change out the engine with an engine that had not failed yet. 


Paved roads are a long-term CAPs. No need to change the road after an accident.


A long-term corrective action is a system level change and there are seven levels to a long-term corrective action. The first level is discovery, either by hazard identification, audit finding, or an unplanned event occurrence. The second level is the immediate corrective action, which is an immediate reaction to a hazard, finding or event to establish a degree of supervision and operational management. The third level is the short-term corrective action, or the repair to return to normal operations. The fourth level is the root cause analysis, which is new with the introduction of SMS. The fifth level, and another new element of the safety management system is the long-term corrective action, or the system repair by continuous, or continual changes. For the purpose of a safety management system, continuous is a change to the current system, while continual change is a change of the system itself. A continuous change could be to move from hand-written paper copies to typewriter copies, while a continual change would be to change the system from a paper-document system to an electronic system. At this time in the process, it is unknown if a change implemented is an improvement or deterioration of a system. The sixth and crucial to success of the SMS is to define what the expected outcome of a long-term system change is. The seventh level of a corrective action plan is the analysis of expected outcomes and to compare expectations with actual outcome. Root cause analysis and long-term corrective action are not new to the aviation industry but became new as additional elements for operators to consider since prior to SMS they were only considered by accident investigators and regulators. 


All parts, or systems, of a car is not changed out if one of the systems fails.


Systems are inter-dependent processes to achieve a defined result which comprises of policies, processes, procedures, and acceptable work practices. A system is the cause or expected outcome and conditions are the tasks requirements triggered by the system design. A system could be the document and records system, where an expected outcome is to generate data for an SMS enterprise to design, develop and implement action plans. A process is to define the 5-W’s + How (What, When, Where, Who (position), Why and How) to compete a task. A process could be to collect data for flight planning. A procedure are the tasks, sequence and timing of steps required to complete a process. A procedure could be the specific tasks, sequence, and timing of steps to control an engine failure. Acceptable work practices are practices accepted by an SMS enterprise since it is impossible to have procedure for everything. An acceptable work practice could be a person’s operational judgement decision such as to land an aircraft or initiate a go-around.  

 

Long-Term corrective actions are highly influenced by the Accountable Executive (AE) and their opinion of the best approach to achieve their goals. The position of an AE is often the CEO of the company, who has a successful track record in business administration, but without being a data analytical expert is still the final decision maker for safety in operations. 

 

April 28 was World Day for Safety and Health at Work, recognized around the world to draw attention to the estimated 317 million accidents that take place on the job each year across all industries. A common safety statement is to keep safety above all as the priority, meaning that an AE will never sacrifice safety for any other purpose. This is a well intended statement, but without safety analytical expertise the statement falls apart when it continues to read that a safety approach is common sense and simple by never sacrifice safety rules or policies and procedures for any other goal, always adhere to rules, policies, and best practices for ensuring quality service, and report any incidences that negatively impact the safety of team members. If safety was common sense and as simple as to adhere to rules and policies, there would not be any incidents to report. Pilots of the 1957 Grand Canyon crash followed the rules. 

 

Long-term CAPs go wrong because they are not long-term CAPs. They are corrective action plans which takes a long time to complete, but the effect of the CAP is still a short fix, or repair. Long-term CAPs are system CAPs. Systems are not as complicated as we often make them and by making it complicated CAPs often go wrong. The regulator has shown a trend that they do not comprehend long-term system CAPs. This became evident to an operator, who submitted a comprehensive long-term CAP for regulatory findings. The regulator rejected the CAP with the reasoning that it was too comprehensive, that it was complex, and it was detailed, and it was irrelevant to the regulator that the outcome was a simple system long-term CAP. The regulator’s long-term CAP form is no larger than a 3x6 index card. It takes more time to plan a project than it takes to build it. Designing long-term CAPs are operational project plans. 



Long-term CAP is incremental improvements within a system

 A long-term corrective action plan is to provide long-term solutions to correct problems in the system that led to the unexpected event. An unreasonable expectation is that a long-term CAP ensures that this type of event will never happen again. There are no unreasonable expectations or goals, there are only unreasonable timelines. With an exception for the same event to never happen again, the timeline of “never” is an infinite timeline. An expectation of “never” is an unreasonable timeline, since an event which has occurred, will occur again at a later date. History repeat itself. An unreasonable timeline is a reason why a CAP goes wrong. A second unreasonable expectation in a long-term CAP is that all contributing causes and associated systems are corrected. An associated system in a birdstrike event, includes birds. Some of the birds have a system they call the migratory bird seasons. This is a common cause variation system, which is a requirement for their system to work, and it is impossible for anyone to correct that system. An unreasonable expectation is a second reason why a CAP goes wrong. When task with these two requirements to ensure that an event will never happen again and an expectation to change a common cause variation, the trap operators fall into, both airlines and airports, large and small, is to design their CAP to include these items for one reason only, which is to complete the checkbox task to conform to an expectation of what it takes for regulatory compliance. Since regulatory compliance is when operations is in a static state of operations, it is possible to comply by ensuring there are no aircraft movements. However, this is not how the real world works and the purpose of an airport is aircraft movements. When movements are happening, that’s when the regulatory compliance gap comes into play. 

 

Long-term CAPs is not to do root cause analysis and make changes to operations so that an unexpected event never happens again. Making long-term CAP project plans is to design, develop, and operate with safety cases and internal operations plans. When you have these plans in place, the only change, or long-term CAP that is needed, is to make short-term changes to the plans for incremental safety improvements. Take a minute an assess a gravel runway. There are still airports out there that offer gravel runway services only. An airport operator makes a safety case for a gravel runway. Based on the safety case they make a gravel operations plan. Their long-term CAP is now the operations plan itself. In the plan they grade the runway once a month. Then one day there is a runway excursion because of the large ruts in the runway. Their long-term CAP fix is now in their operations plan and the fix is to change grading of the runway to every two weeks and after heavy rain. This is literally how simple a long-term CAP is when an operator comes prepared for it with safety cases and operations plans. The reason for long-term CAP crashes is because they are designed to crash.

 

 

OffRoadPilots

Sunday, May 1, 2022

The Unintended Consequences of a Non-Punitive SMS Policy

 The Unintended Consequences of a Non-Punitive SMS Policy

By OffRoadPilots

An SMS enterprise is required to implement a non-punitive reporting policy. The intent of this policy is that more incident reports or near misses will be submitted to management when there is a policy in place that a contributor will not be reprimanded, fired, criminally charged, or other punitive actions, such as a reduction in pay or benefits, will be taken against them. An implied benefit from a non-punitive reporting system is that an operator, being airline or airport, will learn from the content of these reports and implement changes to operations as needed for safety improvements. 


A non-punitive policy that needs to be decoded is not a policy.


An objective of a non-punitive SMS policy is to support the overarching SMS policy goals of an SMS enterprise. Examples of an SMS policy goals are to have a goal-setting process in place, processes for live hazard identification, reporting and corrective actions, processes to train personnel, a process to operate with a daily quality control program as a prerequisite for their quality assurance program, processes for conducting periodic audits of the safety management system, or a non-punitive reporting policy. Conventional wisdom is that the non-punitive reporting policy is the only element of an SMS policy that ensures reporting disclosure of all near misses, incidents, or hazards. When an SMS enterprise is relying on their non-punitive reporting policy as their only tool for sole-source reporting, they are taking the SMS down the wrong path. Sole-source reporting is reporting of an event that otherwise would be unknow to the operator since no other person had knowledge of the event to report it. A sole-source report could be an IFR altitude deviation in uncontrolled airspace, or operational deviations out of a remote airport without air traffic services.  

 

Negative thinking generates an incorrect root cause.


A non-punitive reporting policy is a crucial tool for an SMS enterprise, but it is not, and cannot be the only tool for sole-source reporting. If there is no benefit for the contributor to report, the intervals between receiving reports are imaginary, theoretical, virtual, or fictional when solely based on a non-punitive policy. There is no benefit for a contributor to report an undetected event that was corrected. Individuals reporting more reports than other is actually a red-flag and does not contribute to safety but is a contributor for suspicions. Suspicion or qualification assumptions is a hazard to incremental safety improvements. A negative mind, such as suspicion, attracts negative behaviors. Negative thoughts are the greatest resource for destroying success. The greatest enemies to success are negative thoughts of all kinds. They hold you down, tire you out, and take away all your joy in life. From the beginning of time, negative thoughts have done more harm to individuals and societies than all the plagues of history. One of the most important goals is to remove all negative thinking about operational personnel. A non-punitive reporting process foster negative thinking in an organization. Some of the causes for negative thinking are rationalization, which causes automatic negative thoughts. When you rationalize, you attempt to give a socially acceptable explanation for an otherwise socially unacceptable act. Rationalization is to explain away or put a favorable light on something that you have done that you feel bad or unhappy about. Rationalization cast yourself in the roles of the victim, and you mark the other person or organization into the oppressor.

 

Negative thinking applies to all organizational structures and to small and large organizations. When information is analyzed by emotions rather than data analyzed within a statistical process control system, the findings will lead to an incorrect conclusion. When incorrect conclusions are applied to incremental safety improvements, safety improvements become random. Relying on an SMS manager’s random skills for safety improvements is a hazard in itself. As an example, when analyzing the root cause for aircraft wing strikes while towing between a sample of operators, negative thinking affects the root cause finding. In this example, a graph shows one operator with several more wing strikes than another operator and another operator shows several more days without a towing strike than the rest of the group. When analyzed in the negative thinking mode, the root cause is to enforce towing policies for operators with higher towing strike events and fewer days since a strike occurred. When analyzed as data and applying an SPC analysis, the processes between operators are in-control. Negative thinking applied an enforcement root cause, while an SPC analysis shows in-control processes. After it was concluded that the right thing was to enforce towing policies, one operator in the group asked what the other operator without strikes did correctly. When asked, the answer was: “We don’t tow, since we don’t have hangars to move aircraft in and out of”. 


Sometime ago, several news papers published a report that a stash of cocaine was found by a maintenance worker in the plane's avionics bay. The flight crew reported to the authorities that they found illegal drugs on the plane, and then they were detained and arrested by the local authorities for possession of illegal drugs. The flight crew reported in good-faith and under the assurance of the company’s non-punitive policy their findings to the authorities. Their reporting of a finding caused them to be arrested. 

 

When SMS was implemented as a regulatory requirement several years ago, the regulator acted as a consultant and advised operators to write a non-punitive policy to include conditions under which punitive disciplinary action would be considered, e.g., illegal activity, negligence or wilful misconduct. Transporting illegal drugs in aircraft is an illegal activity, it is negligence, and it is wilful misconduct, so the non-punitive policy does not apply to the flight crew. Some might say that the crew did not know about the drugs. However, the expectation applied to a non-punitive policy did not include to have knowledge of, as a condition for the policy to be applied. The non-punitive policy failed this flight crew considerably. When implementing the SMS recommendations, operators did not include in the non-punitive policy that the policy is only applicable in a jurisdiction where the policy is accepted, or by international agreements. In addition, the regulation itself was not applied to the non-punitive policy. The regulation sates in part: “…including the conditions under which immunity from disciplinary action will be granted…”   The regulation states that immunity is not granted unless specifically granted by the operator. When SMS is elevated to a level without accountability by the operator, and to a level where a person acting in good faith when reporting is punished, there is no just-culture in operations. Without just-culture there is no safety management system. 

 

The unintended consequence of a non-punitive policy is to foster negative thinking, and the promise to grant immunity in other jurisdiction than of the SMS enterprise. 

 

 

 

OffRoadPilots






Why Long-Term CAPs Crash

  Why Long-Term CAPs Crash By OffRoadPilots W hen the Safety Management System (SMS) regulations came into force, there were little or no gu...