The Devil Is In The Details

 The Devil Is In The Details

By OffRoadPilots

The Titanic disaster was caused by a detail in the watertight compartment design flaw that the walls separating the bulkheads extended only a few feet above the water line, so water could pour from one compartment into another, especially if the ship began to list or pitch forward.

The Alexander Kielland disaster was caused by a fatigue crack in one of its six bracings, which connected the collapsed D-leg to the rest of the rig. This was traced to a small 6mm fillet weld which joined a non-load-bearing flange plate to this D-6 bracing.

The Sioux City IA air disaster was cause by a catastrophic failure of its tail-mounted engine due to an unnoticed manufacturing defect in the engine's fan disk, which resulted in the loss of many flight controls. None of these details were identified as issues of any concerns, but they caused some of the most horrific and catastrophic historical events within their own areas of history. Titanic was built to be unsinkable, a deep-sea diver once said to me that there were terrible working conditions for underwater welders, and it was known ten years prior to the disk failures that these disks had flaws and could fail.

Details may be known by management, but are often dismissed, they are brushed aside as being unimportant, or seen as irrelevant to the issue. Details are not only important in operations, but also for regulatory and standard compliance.

both airlines and airports have to maintain compliance with a comprehensive safety management system (SMS). I concept, an SMS is simple but unless details are identified within a system analysis, the system becomes complex and often unmanageable. A manageable SMS is based on daily quality control, established processes and each operational task is linked to multiple compliance requirements. When processes are established, an SMS has been simplified and manageable, with the primary tasks to monitor for deviations from assigned path. The more details paid attention to in an SMS make the SMS simpler and easier to use. When details are known, it is easy to see where the pieces fit into the whole picture, as opposed to fit a large piece into a detailed issue. When SMS is forced, it makes it difficult and complex to apply in operations. A symptom of an SMS that is too complex or unmanageable for operations, is therefore when SMS is overloaded, or overcontrolled, and safety information is a tool to justify its existence.

Paying attention to details is a regulatory requirement for a certificate holder to adapt their safety management system to the size, nature and complexity of the operations, activities, hazards, and risks associated with the operations. Adapting to size and complexity requires detailed knowledge of their operations. When an operator only has a high- level knowledge and overview of their systems does not allow for a

certificate holder to apply operational targeted processes that suits their size of operations. A certificate holder is required to appoint an accountable executive (AE) to be responsible for operations or activities authorized under the certificate and accountable on their behalf of the certificate holder for meeting the requirements of the regulations. This requirement does not imply that an AE only need to be familiar, or only have partial knowledge of the regulations, but is a requirement for the AE to have detailed knowledge of regulations to detect deviations from established paths and non-conforming processes. Conventional wisdom is that an AE only need to be responsible for financial and human resources, which is a job description of their position, while the knowledge of regulations is the requirements for accepting the role. SMS is a businesslike approach to safety, and no business owners, corporate directors or airport authority would hire an accountant or lawyer who have limited knowledge of regulatory requirements and their areas of responsibilities. However, they continue to hire accountable executives who do not have the knowledge base to fulfil their obligations to the regulations.

Obligations of an airport operator is to review each issue of each aeronautical information publication on receipt and, immediately after a review, notify the Regulator of any inaccurate information. Detailed knowledge of how to obtain a copy of the aeropub is required, detailed knowledge of how often a new revision is issued, and what date it is published is required. They need detailed knowledge of what information pertains to their operations, what action to take in addition to reporting any errors to the Regulator, and how their internal SMS process capture these requirements. An operator must design, develop, and submit to the Regulator an operations plan for airside construction, and operate with airside operations plans for maintenance and repairs. Operations plans must include details of operations for processes to conform to regulatory requirements.

The person managing the safety management system, or SMS manager is required to monitor the concerns of the civil aviation industry in respect of safety and their perceived effect on the certificate holder and determine the adequacy of the training for personnel. In-depth and detailed knowledge of their own operations are required for an SMS manager to monitor the aviation industry in respect to safety and how they view different independent operators. An airport operator who frequently closes their runways due to maintenance and repairs, may be viewed as unsafe since this particular airport does not have project plans in place for airside management and for runways to remain open for business. An airport operator may choose to close a runway between 2AM and 4AM for daily maintenance and inspection, which is different that publish NOTAMS for unexpected maintenance requirements during hours of operations. An SMS manager is required to determine requirement of training, and without the details of expected outcome of the training this function cannot be performed.

Comprehension of details in operations, the text of regulations, and the intent of performance-based regulations are required for an operator to design processes that conform to regulatory requirements.

Generally speaking, a regulation is applicable to any airline or airport, unless there are special provisions for size and complexity. One such regulation is the airport winter maintenance regulations, where the regulation is applicable to airports serving turbojet aircraft, and the other part appliable to airport serving propeller aircraft and on-demand operations only. Winter operations for airports serving propeller aircraft is to consult a representative sample of the air operators that use the airport about the intended level of winter maintenance and the remove sand from movement areas when it is no longer needed. Additional requirements for airports serving turbojet aircraft are that they have a winter operations plan, snow removal priority areas, pre-threshold maximum snow accumulation, use of ice control and chemicals, friction measurement and movement area inspection reports. The detail of this regulatory requirement is not in this regulation itself, but in the requirement for an airport certificate. An applicant for an airport certificate must maintain verification records that they can operate with a safety management system and is requirement for non-certified aerodrome operations prior to the issuance of an airport certificate. When a certified airport operator elects to operate as an airport serving propeller aircraft only, they voluntarily give up their SMS records for operations serving turbojet aircraft. Should an airline operator wish to operate turbojet aircraft out of this airport, they must delay their operations until the airport can verify their capability to operate with an SMS supporting turbojet aircraft. The detail of this requirement is to connect the link between two regulations to conduct a system analysis of future operational restrictions. With the implementation of the safety management system, any operational regulations must be linked to the SMS regulations. This is a detail that an AE must be aware of and able to distinguish between multiple regulations and how they are linked to same SMS regulation.

An airport is required to maintain a runway strip, or an area beyond the side of the pavement of a runway, and beyond both threshold, that are without aeronautical obstructions. This includes natural obstructions and other encroachments such are riverbanks. One airport decided, without consultation, to fill in a riverbend to widen their runway strip.

After the construction application was submitted, the community responded with opposition to this initiative. The airport boundary needed to be expanded by filling in the river and bird wetlands. In practice, this means that birds, wildlife, and plants are forced to leave their habitats. In the application, the airport manager wrote the following: "Regarding natural diversity: The airport does not have the professional expertise to assess any special impacts on natural diversity. Our experience from operating the airports over several years is that there is very limited animal and bird life in that area. We assume that this is due to the presence of the lake on the opposite side of the runway, which has a bustling wildlife and bird activities, and which therefore seems to be more attractive. Nor has any extensive movement of wildlife or birds been observed between this lake and the riverbend, which is probably due to the activity on the runway. In addition, the airport has limited data entries in their bird and wildlife register.” The airport manager states in their application that they do not have the professional expertise to assess impact on bird and wildlife, and due to airport operations, bird and wildlife activities are scared away and therefore does not exist as a justification to stop the construction project. This application is in non-compliance with an SMS to conduct system analysis of projects and comprehend all details included. An accountable executive needs to be able to comprehend the details and impact on the community by reading their own submission. There is also a regulatory requirement for airport extensions to consult with their neighbors, stakeholder, and other interested parties.

When the Regulator conducts an inspection, and since the regulations are performance based, they will inspect what is not written in the text of the regulations. An inspection includes the regulations itself, how it is linked to other regulations, and how an SMS enterprise maintain a path to monitor processes. An AE needs to have knowledge to link for an airport to publish NOTAM (Notice To Air Men, and the new definition is Notice To Air Missions), and for the captain of an aircraft to be able to assess an airport for suitability. The intent of an airport operator, and a certificate requirement, is for an operator to operate an aerodrome as an airport. This requirement implies that the airport meet certification standards 24/7. A published NOTAM does not change that requirement but is a tool for an airport operator to fix or repair an unexpected issue within a short timeframe.

The devil is in these details and other safety or regulatory details. For all practical purposes, what this mean is that an SMS enterprise does not have any justifiable cause to operate outside of the intent of the regulations, or exempting themselves from standards, or their own policies as they please, and most important, it is a responsibility for an accountable executive to know what this entail to ensure ongoing compliance.

OffRoadPilots

SMS Reviews

SMS Reviews

By OffRoadPilots

A role for an accountable executive (AE) are to review their safety management system (SMS) and determine their SMS deviation from its planned course and path. A fully functional SMS cannot fail since it paints a true picture of operations, and any deviations from the path come from operational drift. An SMS enterprise operate with processes for conducting reviews or audits of their safety management system at regular intervals, and reviews or audits for cause or on- demand, of the safety management system when there are planned deviations from their current SMS. In addition to reviews and audits of deviations, an SMS enterprise operates with processes for reviewing the safety management system to determine its effectiveness. The first step to determine an SMS effectiveness is to determine what an effective SMS looks like. 

There are several views of what an effective safety management system should look like, and one effective SMS may be different for one organization to another. Effectiveness also changes with new tools, new inventions, or changes in expectations. A simple example are the changes from a paperformat SMS to electronic SMS and to a live cloudbased and automated SMS. The foundation of an effective safety management system is that the system conforms to regulatory requirements. Regulatory requirements are the foundation for an effective SMS, the foundation for airline or airport operations, and the foundation for issuance of their operating certificates. There are twelve factors of building blocks forming the platform for an effective SMS. A factor is circumstance, fact, or influence that contributes to a result or outcome of the SMS. When one of the blocks drift away, or deviate from its path, there is a change in the effectiveness of an SMS. The twelve building blocks are human factors, organizational factors, supervision factors, environmental factors, trust factors, learning factors, accountability factors, information sharing factors, data factors, information factors, knowledge factors and comprehension factors. When combined in one system, these blocks of interacting systems form the foundation for SMS effectiveness to be built.

Conventional wisdom is that after a goal is established, the next steps in the processes are to wait for the goals to be reached. Goals are not reached by doing nothing but are only reached by hard work. Operating with a safety management system is hard work and it is without a guarantee that this hard work will payoff, or that future accidents are eliminated. SMS is hard work by applying a daily quality control system and monitor processes for drift within its path and deviates outside of its path. Operating with an effective SMS, or a high-performing SMS is also hard work and requires strategic operating processes.

Several items are tools to operate with an effective SMS. A formalized safety policies is the first step to a successful SMS. Effective and regular communication about safety is another sign of a successful SMS. Having safety policies that are frequently communicated and accessible to everyone is important. An accountable executive is the base of support for behavior-based safety and accountability. It is crucial for an effective SMS that habits around safety are established. An SMS enterprise must focus on behavior-based safety, which is a safety methodology that focuses on improving safety through habit creation.

Unsafe behavior, or deviation from processes, are naturally habitual for workers, and they are often unaware of their own unsafe behaviors. Oftentimes, an activity has been done the wrong way for so long that workers do not consider an incorrect behavior in many cases. SMS organizations can create acceptable behavior by forming positive habits while breaking old ones. According to behavioral expert James Clear, it takes 66 days on average to develop a new habit. That means that time must be dedicated to continuous improvement in order to achieve results. The three main triggers to change habits are reminder (the trigger that initiates the behavior), routine (the behavior itself, or action taken), and reward (the benefit gained from doing the behavior). An SMS enterprise with an outstanding safety records has developed a systematic method to measure what is going on throughout their entire operation. It enables them to quickly and easily understand why something went wrong when it does.

The ability to identify high-risk situations quickly and precisely should be on every SMS manager’s and AE’s checklist for safety performance. Leading indicators can provide insight for an SMS enterprise to predict what could happen and take action to avoid accidents or incidents from occurring. SMS enterprise with low injury rates equip their workers for success and they do so through more than just processes and safety management programs. They leverage cutting-edge tools and systems to keep workers prepared and ready to handle whatever they need to. The most impactful safety management system is one that links worker with easy access the information they need and report an issue. SMS enterprises needs SMS managers who recognize the importance of continuous learning and schedule regular learning activities. Learning should be easy, practical and be tailored to expected job performance. Workers that may become leaders also needs to be prepared with tasks, tools, and support to take on leader roles when they are ready. Learning activities for managers, supervisors and workers should instill knowledge of proper practices, develop awareness of how to manage hazards to reduce risks, and gain specialized skills when their specific roles require unique preparations. The foundation of learning is for personnel to know where their comfort zone is, that they must step outside of their comfort zone, and have the tools, skills, and support required to move forward beyond their comfort zone.

Empowering personnel through the safety management system yields tremendous outcomes for an SMS enterprise. Often, the challenge with a safety management system is when focus is on preventing injuries by highlighting how bad things can get and scaring workers straight. Scaring people and information overload does very little to motivate workers to perform better. This results in a fear- based culture rather than one based on success, thus reducing the morale. A successful safety management system consistently promotes proper safety through continuous education, consistent reinforcement, and ongoing improvements.

It is natural to want to get the job finished on schedule, or even ahead of time, but with a “get it done quick” attitude is the focus, there is an increased risk for incidents to happen. Personnel may take shortcuts to “get the job done” and deviate from a specified path. Shortcuts may not be a wrong process to complete the job, but a shortcut is a deviation from a planned process with an acceptable track record. A shortcut is overcontrolling a process and over time, overcontrolling processes may cause other or additional hazards that are unknown and unaccounted for. An accident impacts productivity more than anything in a 

The review of a safety management system is ongoing in the daily quality control system. When it is time for a complete review for effectiveness, all data is already surveyed, determined, collected, recorded, classified, and reported in the safety management system. The final step in assessing the effectiveness of an SMS is to allocate goals to sensitivity levels.

OffRoadPilots

SMS Owners

 SMS Owners

By OffRoadPilots

Two owners of a safety management system (SMS) are flight operations and airport operations. In their own area of operations, they are the hazard owners and hands-on process control managers. With the implementation of SMS operational safety was moved away from the safety manager’s office and to areas of operations where they belong. In addition to social media opinions, there are still aviation managers who believe that a safety manger’s role is to keep everyone safe, it is their role to establish acceptable risk levels, and that it their role to overrule operations mangers and airport mangers if a safety manager decided a decision to be unsafe.

A safety management system is about processes and daily work practices. The final authority for risk acceptance is the accountable executive (AE). It is important to know that an SMS is not the magic wand that prevents future accidents from happening but is a tool to lay out the path for success. The first task on this path is to develop work practices with an output that conforms to regulatory requirements. One daily task may combine compliance with several compliance requirements. Another task is to develop work practices that conforms to safety in operations. Safety in operations is more than preventing accidents, it is also reliability of operational tasks. This could be reliability of the daily inspection at an airport, reliability of developing aside operations plans, or reliability to communicate non-standard airside work practices and decisions in a timely manner to the SMS manager and AE. A healthy SMS is not about prohibition and restraints but is about communication and accountability.

Taking ownership at work is to take initiative and responsibility for success or failure of SMS enterprise. SMS teams needs players willing to step up and take ownership of mistakes or challenges, as opposed to wanting to blame others for any issues. In practice, taking ownership within an SMS system means being proactive, solution-oriented, accountable, and committed to continuous improvement. Anyone who takes on ownership at work are prepared and ready to take on whatever challenges come their way. They have strong problem-solving skills and anticipate problems to prevent them before they happen, rather than waiting for things to go wrong and scrambling to fix them. They are also looking for ways to improve things. They're the ones who come up with new ideas and find creative solutions to complex problems. Workers who take ownership also take responsibility for their own actions. They own their mistakes and take responsibility for their successes. SMS team members don't shy away from accountability, they embrace it. Ownership is key to having a high-performing team. When a worker buys into the SMS, and its vision and they feel that they have a stake in its success, they are more likely to be engaged in their work.

There is a difference between a worker taking initiatives and a worker accepting a risk or developing risk controls outside of their area of responsibility. Accepting or rejecting a risk is the role of an accountable executive. A worker’s initiative is not to make changes that affects operations, but to take initiatives to communicate suggestion, hazards or options with managers and the accountable executive when issues arise. It is also to make initiatives and take actions when there is an apparent threat to personnel, equipment, or structures. Such action could be to initiate a missed approach without being instructed by ATC.

Unknowingly to the flight crew their airliner on final approach was lined up on the taxiway with several sequenced aircraft for departure. The flight crew observed lights, that they thought were aircraft on the runway. They made an inquiry to the tower who informed them that the runway was clear. Within an SMS world, a pilot is allowed to conduct a missed approach even if they are wrong in their assessment of an apparent danger. An airside ground vehicle with a clearance to cross a runway, may decline the clearance if there is something they have concerns about, even if their concern was not an actual issue. Taking initiatives within an SMS enterprise is to take initiative without consideration for punitive actions, or to take initiative for actions that later was shown not to be necessary.

The safety management system was sold as the solution for airlines and airports to identify risks before they become bigger problems, and that the regulations was required as an extra layer of protection to help save lives. When the safety card is played, i.e. that the regulation will “save lives”, is a red flag since their safety statement is without merit for an effective safety management system. It sounds good that SMS will save lives, but accidents have still happened after SMS was implemented. SMS was, and still is, sold as “saving lives” tool. If this statement is true that an SMS actually saves lives, it is not the fault of an SMS operator when there are occurrences.

In 2011 an SMS enterprise crashed an airliner. In this instance their SMS did not prevent the accident from happening. The aircraft was cleared to descend out of controlled airspace for an approach. The crew initiated the pre-descent checklist and the FO contacted the terminal controller and provided an ETA, with their intentions to conduct a Runway 35 approach. The crew then contacted tower controller, who advised them of the altimeter setting, winds, and instructed them to report 10 nm final for Runway 35. The crew asked tower controller for a runway condition report and was advised that the runway was a little wet and that no aircraft had used it during the morning. The crew initiated the in-range checklist, they configured the aircraft for approach and landing, and initiated the landing checklist. At 10 NM final for Runway 35 the captain called for the gear to be lowered and for flaps 15. At this point in the approach, the crew had a lengthy discussion about aircraft navigation. The aircraft flew a controlled flight into terrain about 1 NM east of the runway.

Another incident that an SMS was unable to prevent, was a taxiway overfly at a busy airport. An aircraft was cleared to land on runway 28R but instead lined up with parallel taxiway. Four air carrier airplanes (a Boeing 787, an Airbus A340, another Boeing 787, and a Boeing 737) were on the taxiway sequenced for takeoff. On approach the flight crew contacted ATC with a concern that there were aircraft lights on RWY 28R, and ATC informed them that the runway was clear. The flight crew of one of the sequenced aircraft then informed ATC that the approaching aircraft was “on the taxiway”. The tower controller instructed the incident flight crew to go-around. The approaching airplane descended to an altitude of 100 ft above ground level and overflew the first airplane on the taxiway continued its descent to 60 ft overflying the second airplane on the taxiway before starting to climb.

The flight crewmembers had recent experience flying into this airport at night and were likely expecting the airport to be in its usual configuration, but on the night of the incident, parallel runway 28L was scheduled to be closed. The captain later stated that, as the airplane approached the airport, he thought that he saw runway lights for runway 28L and thus believed that runway 28R was runway 28L and that taxiway C was runway 28R. The captain asked the first officer to contact the controller to confirm that the runway was clear, at which time the first officer looked up. By that point, the airplane was lined up with taxiway C, but the first officer presumed that the airplane was aligned with runway 28R due, in part, to his expectation that the captain would align the airplane with the intended landing runway. Neither flight crewmember recognized that the airplane was not aligned with the intended landing runway until the airplane was over the airport surface, at which time the flight crew initiated a low-altitude go-around.

Both incident airlines were operating with a regulatory conforming safety management system, but their SMS were unable to prevent the incidents. There are several reasons, or justifications, for these occurrences, but one fundamental SMS principle lost in the equation, was for the rightful owner to take ownership of their SMS and do something about it. In the second example, both ATC and one of the sequenced flight crew took ownership and prevented a disastrous outcome. SMS ownership is what made a difference, and SMS ownership is what prevented a major accident. SMS in itself did not prevent any of these occurrences, but taking ownership of progressing events would have made a different outcome.

A successful SMS is built on a foundation that personnel accept their roles as hazard owners. An SMS that does not identify its rightful hazard owners is an ineffective tool. A captain is the final authority and decisionmaker of a flight and this principle must not change. Everyone else need to accept that the captain is the final authority, and that other flight crew members have other ownership roles.

An accountable executive is the owner of regulatory compliance and safety in operations. However, an AE is not the owner of an SMS manager, and when they reject a recommendation from an SMS manger, the AE must take ownership and develop their own action to implement in their safety management system. Just as a CEO of a corporation may reject a recommendation made by an accountant or lawyer, a CEO, or AE may also reject a recommendation by an SMS manger and design their own action plan. Ownership is different than authority. Authority is to make decisions on behalf of someone else, while ownership is applied to a floating task for a person to pick up. Ownership is not an action that someone else need to do but is an action that I need to do at this moment.

An accountable executive is the owner of all hazards, director of flight operations is the owner of all flight hazards, director of maintenance is the owner of all maintenance hazards. In addition to these SMS owners, each person within these departments are the owners of hazards as they are applicable to their job performance expectations.

OffRoadPilots

SMS Performance Evaluation

 SMS Performance Evaluation

By OffRoadPilots

When competing in the Daytona 500, the key performance indicators are not how many errors each driver made during the race to lose, but how many laps they did better than the others to win. Each driver’s performance was compared to the other drivers in the race and the winner is the driver who performs better than everyone else. A safety management system (SMS) is in concept not any different than a Daytona 500. It is a race to perform at the highest level for operators to win their internal race to operate without regulatory findings. A regulatory compliant safety management system does not guarantee an accident-free environment, but both airport and airline operator must first adhere regulatory compliance to achieve success. There are no sound reasons to operate with regulatory non- conformances.

SMS performance assessment is a regulatory requirement, but it is not as obvious to pick a winner in an SMS as it is in the Daytona 500. After all drivers have crossed the finish line is when the winner is awarded a gold medal. It is an incomprehensible task to establish the finish line in an SMS when there are expectations to operate in a hazard-free environment without occurrences. A high performing SMS does not ensure that accidents never happen again, but it is to be prepared when they happen. Just as a Daytona 500 winner needs to be prepared when things go wrong, maintain control, and stay ahead of in the game, an SMS enterprise must have control measures in place as needed for their own operations.

The first part of a goalsetting process is for the improvement of aviation safety. Improving aviation safety is a regulatory requirement, but the regulation does not define what it means to improve safety. Since the regulations are performance based, and when the regulation does not state requirements, or definitions, it is up to each airport and airline operator to define what improving aviation safety is. If aviation safety is new and improved today implies that it was old and inferior yesterday, which is not necessarily true. Aviation may have been safe yesterday, but without process patterns to follow, it was undocumented why it was safe until SMS regulations came along. The old quote that “if it ain’t broke, don’t fix it” is not what improving safety is. Improving safety are minor, almost unnoticeable changes, within the patterns, in human factors, organizational factors, supervision factors or environmental factors.

An SMS enterprise is required to have a process for setting goals for the improvement of aviation safety and for measuring the attainment of those goals. After they have crossed the finish line is when it is possible to evaluate and analyze their performance of how they reached that goal. One trap to watch out for when setting goals is to make an attainable goal timeline so far into the future that it becomes irrelevant to the goal what an airport or airline do today. An attainable goal for an airport operator for the improvement of aviation safety could be to conduct an obstacle survey every five years of obstacles in any of the approaches. This goal is correctly assigned a five-year irrevocable timeline which is closing the timeframe gap for the goal. With this five-year timeline goal, an airport operator, which is a task normally assigned to an airport manager (APM), may set a target date for the next survey in five years and file the goal on the shelf.

When a goal is out of reach, it is also out of mind until it is triggered by a notification. This is absolutely the correct method to use for an obstacle survey, and this was how airports operated prior to SMS. However, what is forgotten in the equation is that the person managing the safety management system (SMS manager) is required to implement a reporting system to ensure the timely collection of information related to hazards, incidents and accidents that may adversely affect safety. It is crucial for the performance of a safety management system that there is an open communication line between the APM and SMS manager. An SMS manager must also define what information may adversely affects safety. Unknown obstacles in the approach may adversely affect safety, since the obstacle may cause an avoidance action by an airliner on final approach. An SMS manager may define in their safety management system manual that the definition of “adversely affect safety” is when a pilot is required to make an immediate avoidance actions. When an SMS manager has assigned definitions, and these definitions are accepted by the Accountable Executive (AE), an APM has a tool to assign daily quality control tasks for meeting the requirement of a five-year survey timeline. The first goal a daily communication line between APM and SMS manager, and the second part of the goal is for airside personnel to daily observe for new obstacles in the approach. A five-year survey goal timeline becomes manageable when an airport operator applies their daily quality control system.

Airport standards accuracy requirements for aeronautical data are based upon a 95% confidence level with three types of positional data identified. Position data are identified as surveyed points (e.g. runway threshold), calculated points (e.g. mathematical calculations from the known surveyed points of thresholds for determination of the aerodrome reference point), and declared points (e.g. flight information region boundary points). Compliance with airport standards is a condition for the issuance and maintaining an airport certificate.

Linked to the accuracy requirements are the Integrity classification of aeronautical data. Classification based upon the potential risk resulting from the use of

 

95% confidence level that all data points are acceptable.

corrupted, or incorrect data. Aeronautical data is classified as routine data where there is a very low probability when using corrupted routine data that the continued safe flight and landing of an aircraft would be severely at risk with the potential for catastrophe.

Essential data is when there is a low probability when using corrupted essential data that the continued safe flight and landing of an aircraft would be severely at risk with the potential for catastrophe.

Critical data is when there is a high probability when using corrupted critical data that the continued safe flight and landing of an aircraft would be severely at risk with the potential for catastrophe.

Another task for an airport manager is to assign classification in accordance with airport standards to aeronautical data. When all data points have been classified, an airport operator may set attainable goals for compliance. Most of these points are assumed to be permanent unless there is a major airport project planned. When surveyed points are assumed to a permanent location, a long-term goal is beyond the timespan in a position as the APM or SMS manager. An attainable goal for a permanent surveyed, measured or calculated aeronautical point comes with challenges. An attainable goal is therefore a reversal process and it is to comply with a requirement to review each issue of each aeronautical information publication and notify the regulatory of any inaccurate information. An attainable goal is then established on a 56-day cycle for review of published information, and compare this information to surveyed data points.

An SMS manager is required to implement a safety data system, by either electronic or other means, to monitor and analyze trends in hazards, incidents and accidents, monitor and evaluate the results of corrective actions, and monitor the concerns of the civil aviation industry in respect of safety and their perceived effect on their operations. All these requirements are goal oriented, and it is up to an airport operator to decide on what monitoring tool to use, and what monitoring processes to use.

A system is a set of components that works together in harmony. A system is reliable and performing its assigned purpose within a pattern. A requirement of a safety data system is not necessary that it is automated, but that it is linked to a performance expectation flow chart. Processes are impossible to design without expectations. A safety data system must show performance in data collection, data storage, data retrieval and data analysis. Without operating with a data storage system, each new data collected become its own new system. If an airport has operated with an acceptable quality control system over the past few years, and one day decide to change over to a different system, all previous collected data becomes invalid unless data, including data from inspections, audits and corrective actions are transferred into the new safety data system. A performance goal for a safety data system is not how may reports it received, but how adaptable it is to changes and to carry forward previously collected and analyzed data.

Performance evaluation of a safety management system is an evaluation of how components work together in harmony to produce a conclusion as an output. A system concludes by its deviation in time (hours- minutes-seconds), space (geographical location), and compass (direction) from an established goal. A Daytona 500 driver enters the race to win, and to be on target, but at the end of the race there is only one winner, and all other drives crossed the finish line successfully, but deviated from their goal. Deviation from goals is not a failure of a safety management system, but a success of a system without corrupt processes. A process in a race, being the Daytona 500, a 100-meter track and field, or a speedskating race could be overcontrolled, manipulated and corrupted by an expectation that everyone should cross the finish line at the same time. A corrupt SMS system is identified in statistical process control (SPC) control charts.

Performance evaluation of an SMS is to evaluate deviations from goals in time, space, and compass, and apply adjustment to human factors, organizational factors, supervision factors, or environmental factors. A Daytona 500 driver who finished second in the race today, may have to make an adjustment to the engine oil to perform with a winning team tomorrow.

OffRoadPilots

Overcontrolling Or Adjusting

 Overcontrolling Or Adjusting

By OffRoadPilots

Overcontrolling of a stable process for a result that is undesirable, or for a result that is extra good, the output that follows will be worse than if the process had been left alone. Overcontrolling or tampering with a process is to make immediate modifications to a process in good faith with the intent for the process to produce a desired result. Adjusting a process is to adjust a process for drift, or identified work practices that are moved away from the pattern designed. An adjustment to a process is to move the process back on track and to adjust for drift. Overcontrolling and adjusting processes are two different operational tasks. Overcontrolling makes the result worst, while adjusting maintains a process on a predetermined path.

Control options are required to operate with a safety management system. These control options are designed, formalized, documented, and applied to all areas of operations for airports and airlines. Control options are used to maintain processes on track for a desired outcome. For airports and airlines to apply control options of processes, they must operate with a daily quality control system. Simplified, this is a system where each task is tagged to one or more regulatory requirements, a task is tagged to the SMS safety policy, and a task is tagged to one expected outcome. A task within a daily quality control system may be tagged to multiple regulatory requirements, an outcome will complete those requirements, but there is still only one expected outcome of the task.

For airport operators, a daily inspection task is expected to complete a daily inspection daily, or at shorter intervals as defined in their controlled manual. A daily inspection task, depending on tasks assigned to the daily inspection pattern, conforms to the accountable executive requirement for meeting the requirements of the regulations, the task conforms to the SMS requirement to maintain a quality assurance program, it conforms to the obligations of operator, and it conforms to the requirement for an SMS manager to identify hazards and carry out risk management analyses of those hazards, and to determine the adequacy of the training required for airside workers. For airlines, a pre-flight inspection is required prior to each flight and, depending on the size and complexity of the aircraft and airline operations, this inspection may be done by the flight crew, or other assigned personnel. A pre-flight inspection conforms to the accountable executive requirement for meeting the requirements of the regulations, the task conforms to flight operations requirements, and aircraft equipment requirements.

As a daily inspection, or pre-flight inspection progresses, each task assigned in the pattern is entered into a monitoring system. Upon completion, these two tasks must be analyzed in a statistic process control (SPC) system and viewed in control charts for process reliability and if a process is in-control, or out-of-control. The first level of SPC analysis is to analyze if the processes itself is in-control, as opposed to any findings documented during the process. A trap for both airports and airlines, is to immediately jump to target findings before it is known if their processes are in-control or out-of-control. Data collected from an out-of-control processes, and a processes with special cause variations, are unreliable data to be applied in a decisionmaking process.

A control chart is a chart with data point plotted above or below an average, and plotted within six zones, or 6-sigma. Zones C-B-A are above the calculated average, and 3-sigma are below the average. Zone C is the zone closest to the average, zone B is the middle zone, and zone A is the zone farthest from the average, where a point beyond its most outer limit is an out-of-control point. A control chart removes emotions from the analysis and without bias displays a process to be in- control, or out-of-control. There are several different control chart and different statistical analyses of processes available. One control chart displays out-of-control tests when 7 points in a row are trending up or down, or 2 points in zone A or beyond, or 4 points in zone B or beyond, or zone C when 8 points in a row on one side of average, or with 8 points in a row, but no points in zone C, or 15 points in a row within zone C, or 14 points in a row altering up/down. Out-of-control processes are caused by special cause variations, or variations that are not necessary to be a part of the process for the process to function. A common cause variation is required for the process to function, such as how long it takes to complete a daily inspection or a pre-flight inspection.

The rules of seven tests are often used as an initial test for SMS enterprises to learn a simple method for interpreting control charts. As above, the rule of seven test is when there are seven points in a row above the average, or seven points in a row below the average, or seven points in a row trending up, or seven points in a row trending down. The other simple test to apply as a beginner when using control charts for an airport or airline operator, is when there are two points in zone A or beyond.

An out-of-control process and special cause variation requires a root cause analysis. A root cause analysis within an SMS enterprise includes consideration of human factors, organizational factors, supervision factors, and environmental factors. There are two paths for a root cause analysis within an SMS world, and one is for regulatory noncompliance, and the other is for operational variations. Regulatory compliance is a prerequisite for both airline and airport operations. Without regulatory compliance, both airline and airport operations are operating outside of their authority given to them by their certificates. Regulatory noncompliance affects the whole operations, and not just affect the items that were noncompliant. Regulatory compliance is based on a static environment, without any movements. E.g. an operations certificate is issued prior to the fist flight or the first day of airport operations.

When an SMS enterprise is in noncompliance one day, and the noncompliance continues, a control chart will show another data point in zone A or beyond the next day. When a control chart displays an out-of-control process for regulatory compliance, a root cause analysis must be conducted as soon as the noncompliance is identified. A regulatory non-compliance is compatible to a system breakdown in manufacturing, where one breakdown has a fundamental impact on their processes. On the other path leading to operational noncompliance, a root cause analysis is applied to trends, or applied to a risk level severity. A daily inspection at an airport that normally takes 20-30 minutes to complete, may one day take over an hour due to a flat tire. The next day there is another flat tire and now there are two data points in zone A or beyond defining the special cause variation. Normally, this would generate a root cause analysis, but since all tires on the vehicle were changed to new tires, the issue was resolved, and there is no need for a root cause analysis of the special cause variation identified in the daily inspection.

On the other hand, if the tires keep blowing daily, then a root cause analysis of the daily inspection is required, and include considerations of human factors, organizational factors, supervision factors and environmental factors. When a special cause variation is identified with a severe outcome, then a root cause is required. E.g. an aircraft slides off the runway due to icy spots. A root cause analysis is required to identify the cause of icy spots, and a cause for not reporting or NOTAM the ice. In short, a root cause analysis is required when there is an event with an unacceptable risk level but is not needed when the event remains within an acceptable risk level until a trend is established.

Both overcontrolling and adjusting are linked to human factors, organizational factors, supervision factors and environmental factors. Overcontrolling in one area affects outcomes in the other areas. On the same note, adjusting in one of the areas for a process to remain within its assigned pattern, has an affect the other areas. 

A controlling function is an accomplishment of measures that further makes progress towards the organizational goals and brings to light the drift and directs corrective action. A trap in process control is overcontrolling by feathering processes and to manipulate an outcome for any justified reasons. Overcontrolling is done in good faith to reach a goal, or to produce a perfect outcome. Perfectionism is a fundamental flaw in process management and is a hazard when causing overcontrolling. A crucial function of control is to be used as a tool for workers to know in advance what is expected of their job performance. Controlling is a motivational tool and helping workers to reach their performance potential. Overcontrolling has an opposite effect and is a motivational obstacle for performance improvements and causing a deteriorating working environment. There is overcontrolling in a process when there is interruption by management, or others for a worker to make immediate and unauthorized changes to their job task.

An air carrier normally departed without passengers and freight due to a short runway and flew to a longer runway 10 miles away. One day, the operations manager interrupted the process by overcontrolling and loaded more fuel, freight and passengers than the process pattern allowed for. The aircraft crashed on departure due to overload for what the runway environment could support. The intent of overcontrolling was to catch up to lost time and provide a better service to their customers.

Adjusting a process is to analyze drift and make correction to remain on track. In the aircraft crash scenario above, an operations manger may have detected a drift if the pilot had taken it upon themselves to accept the risk and deviate from the normal process. An option for the operations manager would be to adjust the drift and move the process back on track to depart empty. However, when overcontrolling becomes a part of the daily routine and process patterns are ignored, then workers become hesitant to follow an acceptable process without receiving pre-approval from an authority.

When a process is overcontrolled it might produce an acceptable outcome the first time, but as changes to the process are made, each change makes the point of origin in the process move farther and farther away from the original point of origin established by the pattern. One day, one passenger may be boarding for take off at the shorter strip, the next day two passenger, the third day three passengers and so on. They do not keep boarding passengers until an aircraft crash, but they are satisfied that their process is safe and acceptable. What is missing is that the process is so far removed from the pattern that when there is an undetected change, such as higher temperature, wind direction, or a change in runway surface conditions, an accepted overcontrolled process fails, and the aircraft crash.

A root cause analysis of an overcontrolled process includes consideration of human factors, organizational factors, supervision factors, and environmental factors. Human factors are the five senses of vision, hearing, smell, taste, and touch, and how they affect a reactive or proactive action. Human factors are not the same as human errors but is a description of a cause to justify overcontrolling a process. E.g. The accident happened because a pilot failed to follow the checklist. The five senses affect human behavior. Overcontrolling of human factors could be to ignore reactions to any of the five senses.

Organizational factors are the organization where a pattern is engaged. Organizational factors are the flight crew organization and their operations manual, or the airside operations organization and their airport operations manual. An organizational factor must be assigned to the patterns where their tasks belong. When organizational factors are assigned to top management, they are removed by several levels from where tasks are performed to be effective in operations. Overcontrolling of organizational factors could be to demand timely performance as opposed to pattern performance.

Supervision factors are the effect supervision has on operations. Supervision could by lines of authority and organizational charts, but also by self-supervision of checklists and acceptable work practices. Supervision is a function of accountability. Overcontrolling of supervision factors could be a self-induced expectation for a pilot to complete all tasks items of an approach and landing checklist without considering other factors, such as the most important task at hand at the moment, or to terminate the checklist and initiate a missed approach.

Overcontrolling this process could also be when an operations mangers assigns faults to a person due to a missed approach.

Three environmental factors are the

• Designed Environment

  o User Friendly Environment, Design and Layout, Accessibility, Tasks- flow

• Social Environment
  o Distancing, Experiences, Culture, Language

  • Climate
  o Geo Location, Weather, Temperature

  Overcontrolling environmental factors could be when a person in authority, such as an accountable executive, expects a worker to perform tasks flawlessly within these environments without first having received training.

  Overcontrolling moves a process farther away from its original track, and is opinion based, while adjusting maintain a process on track based on data with a proven end results.

  OffRoadPilots

SMS Patterns

 SMS Patterns

By OffRoadPilots

Unless patterns are implemented, regulatory compliance and safety in operations are achieved by random chance only and is not the result of a safety management system (SMS) and its processes.

The purpose of an SMS is to identify patterns and build these patterns. Patterns is what makes SMS unique. Incidents are trends in operational patterns, but their root causes may vary from event to event. The root causes of Cali air disaster on December 20, 1995, and Andes air disaster October 13, 1972, had different root causes, but both airliners flew a controlled flight into mountainous terrain. Often, but not always, a common denominator of a root cause is lack of situational awareness, or the flight crew failed to complete one task. Since both flight crews assumed they were tracking on their desired track, and on their way to their destinations, in their mind they had situational awareness.

When a root cause is determined to be the loss of situational awareness, solving the problem is a simple solution by storing situational awareness is a place where it cannot be lost. Situational awareness needs to be trained for to a point where a pilot knows which way is up, down, left or right. This can only be achieved by training, and when stored in a pilot’s mind, it cannot be lost. Just as a deep-sea diver needs to know which way is up, a pilot needs to know what lays ahead. A pilot needs to know their pattern by heart and use other tools to verify their actions. When flight 447 crashed on June 1, 2009, the flight crew attempted to leave a pattern without a tool to get out.

SMS patterns are the foundation of a safety management system. Trends and patterns are two distinct and different tools, each one tells their own important story of an SMS enterprise, and both are crucial tools for a successful SMS. A pattern has rules of which objects belong to the pattern and which objects do not belong to the pattern. Patterns are stable and reliable, and tasks have repetitiously been completed to their expected outcomes. Trends that are moving up, down, or sideways in number values, and when a value is above or below control limits, there is an unstable processes in the pattern.

Conventional wisdom is that a trend is when there are two of the same occurrences. When applying two occurrences as a trend, there could be a runway incursion one year, and another incursion three years later, which now makes runway incursion a trend for this operator. The four seasons, spring, summer, fall, and winter are patterns, but the air temperatures during seasons are trends. Aircraft automation are patterns, while operational functionality and reliability of automation are trends. When applying two events as the threshold for trends, overcontrolling of processes is the result. An overcontrolled process is unstable and cannot be stabilized by continued overcontrolling. Overcontrolling a process makes the result worst than a process in control containing errors. The only option is to ship the error or damaged goods and provide the same level service with that process. A process needs to be monitored adjusted for drift from assigned patterns, which is a different task than over-controlling and making process changes for a different output.

Constructing the base, or cornerstone, of a safety management system that is built on trends provides a weak support base for an SMS. That there are zero incidents does not imply that an SMS is effective. Trends, even stable processes, includes variables in its foundation and is unreliable for a system to be based on. A system needs to be built on patterns with a base constructed of repeatability, consistency, and accountability. Repeatability is its function for the same task to be repeated over and over again by any trained worker and producing the same outcome. Consistency is a system where ongoing tasks to performed at dependable intervals. Accountability is when repeatability and consistency are unaffected by common cause variations, or variations that are built into any systems for the system to function as intended, and for accountability to be applied as a long-term master planning tool.

Daily inspections and daily quality control are two patterns in airport operations, and they are building blocks for completing patterns. These patterns are laid out to paint a true picture of airport accountability and its expected outcome. Common cause variations do not affect accountability, since there is a built-in variables in the time it takes an airport operator complete their daily inspection. A daily inspection could vary between 20-30 minutes at a medium size airport. An inspection does not complete at 23 minutes every day. Another common cause variation is the time of day when an airport operator has completed their quality control task and communicate this to airside personnel. An airport’s daily quality control task may be completed between 4AM and 7AM but does not complete exactly at 4:35 AM every day. These variations are common cause variations built into processes, but are not flaws, or findings in patterns.

A supreme example of how critical patterns are to produce a desired result is cross-stitching. Cross-stitching patterns are designed and built before any operational tasks takes place. Cross-stitching comes with design patters which includes a final display of what an image or text will look like upon completion. Cross-stitching a wolf that comes in all different shades of grey is one of the most strenuous patterns to complete. A wolf pattern comes with explanations, directions, and process to follow to complete the pattern and by scaling down the process to one stitch at a time the pattern leads workers to a light at the end of the tunnel. A cross stich pattern may include thousands of stitches before the pattern is completed. The pattern is the foundation and is what a cross-stitching person has built their service and production upon. Their one goal is to complete the pattern. After a pattern is built, or the foundation for the cross-stitching output is finalized, that is when roles, responsibilities, expectations kick in, and tasks are assigned to individuals. As their work progresses and patterns are completed is the time to analyze a pattern for compliance with repeatability, consistency, and accountability.

An SMS enterprise lives by the same pattern concept as a cross-stitching person does. Airlines and airports have several patterns they need to complete at regular intervals, and it is not just one grey-wolf pattern. They have mountain-patterns, they have field-patterns, they have city-patterns, or anything else you can think of to be completed. When all patterns are designed and built, they can start building operational policies for each pattern. When policies are established, they can build processes, procedures, and acceptable work practices to move their design patterns out of the office and over to operations to be completed. When operations, at airlines or airports, have completed one pattern, that pattern is stored in records and a new pattern with the same image, or task, is to be produced over again by operations the next day. Just as a cross-stitching person hang their image on the wall, give it away as a gift or sell it, and then they do the same pattern over again with the same image. A pattern for an airplane to depart does not being at their taxi but begins several hours before departure for the flight crew to be rested and fit for flying.

One pattern often used by airport operators is to wait for the regulator to complete their inspection and assign them findings. When findings are identified, an airport operator develops and implement corrections, but then wait again for the next oversight inspection show up and issue more finings. This is a true story and true stories are good.

A regulator replied to an email that their responsibility is to inspect for regulatory compliance, and that they accepts that an active runway is compliant when it is 100% ice covered. Their email states about an icy runway that “there is no issue from a regulatory perspective...” The regulator accepts a pattern for an airport operator to operate with icy runways, as long as there is a pattern for the operator to publish a runway surface condition report when icy. What the regulator omitted was that the person managing the safety management system is required to identify hazards and carry out risk management analyses of those hazards. If an SMS manager recommend the hazard, and their accountable executive (AE) accepted the hazard, then an airport operator has been authorized to operate with an icy runway and must publish their NOTAM. However, it is not incumbent on airside workers, or an airport manger to accept that risk and publish a NOTAM without an SMS Manager’s recommendation and an AE’s acceptance of the hazard.

The regulator also omitted the regulatory requirement for an SMS manger to maintain a reporting system to ensure the timely collection of information related to hazards, incidents and accidents that may adversely affect safety. They omitted a regulatory requirement for an SMS manager to monitor the concerns of the civil aviation industry in respect of safety and their perceived effect on the certificate holder. After an intercontinental 8-hour flight an airline and its flight crew expect that their runway is

suitable for their operations, and that it is not covered with ice. Finally, the regulator also omitted in their reply that the required safety policy for an airport operator may commit to do what it takes for their airport environment and runway conditions to be compatible for the safe operations of an aircraft. SMS changed everything in airport and airline operations, but it didn’t change anything for the regulator.

With the implementation of the SMS, patterns became crucial for both regulatory compliance and safety in operations for airlines and airports, while trends are still the crucial component for regulatory compliance only. The regulator’s own guidance material states that “Runway conditions which may permit the safe take off and landing of one aircraft may not be suitable for another aircraft...,” and they left out that since the runway no longer is suitable for certain types of aircraft, an airport operator should change their Aircraft Group Number (AGN) to aircraft suitable for icy runway operation. This will put the level of service decision in the hands of the airport operator since it is ultimately their business decision. This certification level of service assists the flight crew to determine the suitability of the aerodrome for the intended operation.

A pattern established by the regulator is that they are only conducting oversight of regulatory compliance and not of safety in operations, which was always the case, and their role did not change with the implementation of the safety management system. What changed with the SMS, was that airlines and airport operators are now required to build their operational patterns for safety in operations and regulatory compliance.

Designing, building, and moving patters into operations is the foundation that a successful safety management system is built on. Patterns is the tool for operators to remain focused on tasks at hand, monitor and adjust drift, and to prevent overcontrolling of processes to adjust an outcome. Patterns is a tool established for repeatability, consistency, and accountability.

OffRoadPilots