1569 Walker Street SE, Smyrna, GA, 30080 Tour - $430,000

When Human Factors Snaps

When Human Factors Snaps

Post by CatalinaNJB

Quality assurance is a vital part of production in the manufacturing industry. There are several data collection points during the processes with the end result that the product is reliable. Whatever the manufacturing is, products are tested over and over again to ensure the quality delivered equals quality promised. These tests could be NDT (Non Destructive Testing) tests, destructive tests, endurance tests, or any other tests that are applicable to establish a confidence level of quality above the bar, or above promised quality. If the quality level is below the bar, there are two available options; 1) lower expectations of the product or promises; 2) improve the quality to a desired and acceptable quality level. The simplest solution is to lower the expectations of the product, which some manufacturer decide to do when coming to a fork in the road. There is some truth to the saying that “you get what you pay for”. 

Quality assurance is decided at the fork in the road.

When a product is manufactured as a larger piece of a system, it is tested prior to entry onto the assembly line. It becomes obvious that not all products, or all 100% of a sample, can be tested for quality by destructive testing, since there then would not be any parts left to assemble. The quality of parts within a system where a destructive testing is required is therefore based on random sampling of these pieces and applied to the remaining sample. Turbine blades and vanes in a jet engine cannot all be tested for material stress. Random samples are tested to establish a confidence level of product warranty. Should the sample “fail”, and the test is performed according to standard, it’s not the failure of the sample itself, but the process that lead up to the finished sample. Service industries also perform sampling of services for quality assurance. A service industry may sample how personnel perform in customer service relations, and they may sample the product they are servicing. A gas station may find that one supplier of gas often deliver poor quality, or they may find that one vendor often delivers poor quality dairy products. When a customer is complaining about the product, they are actually complaining about the service delivered. A customer expects that a service provider (E.g. gas station or general store) have a quality assurance system in place to ensure that each product they service is delivered to expected quality. This type of quality control is more difficult than strictly product quality, since the service provider must have confidence in, not only the manufacturer, but also in the vendor. The service provider must establish a confidence level of a manufacturer and the vendor that is at or above the bar of what a customer expects, and do this for each product they sell. 

Both manufacturer quality assurance and service provider quality assurance can be tested and evaluated based on known data that affects products or services. Sampling of what the vendor delivers can be evaluated based on known data that affects products or services. Sampling of what the vendor delivers can be taken at each delivery. Yes, they would lose the sale of that one item, but by sampling they can apply this data in their quality assurance system. Some years ago, a small produce wholesaler conducted their product quality assurance by asking each employee to pack themselves a bag of randomly selected fruits and vegetables every weekend. This competitive edge of testing the product weekly blew the larger and established competitors away. Eventually this small organization purchased the well established large produce wholesale companies. Not only did this improve their edge of product quality, but it improved their edge in customer service by having live and current testimonies of their quality. It could be that the manufacturer delivered a good product, while the quality deteriorated while in the possession of the vendor. By sampling the vendor, the quality of the product itself cannot be sampled. However, this is often the only practical solution to collect samples for quality assurance. This solution points the blame at the vendor and may not address the actual root cause. This approach is often applied, since it’s a simple and a justifiable action, to blame the nearest source when the failure happened. In addition, this type of root cause assessment does not have any cost incurred and it doesn’t require any special skills, knowledge or training.

Data is collected to analyze why the selected process didn’t win.

An effective Safety Management System operates the same way as a manufacturing system and service system by collecting data for quality assurance. Except that the SMS collects data of human factors, or human errors for lack of better words, of how much pressure it takes for human factors to snap, break or to malfunction in job performance. Personnel may be required to perform conflicting tasks in job performance, work with incomplete systems and must have resilience to change or divert a process when things go wrong, as they sometimes will. When applying this concept to an airport or airline, the airport makes an effort to maintain safe customer service, while regulatory requirements may demand that the airport temporary closes. A pilot may be tasked with flying in hazardous weather conditions, while simultaneously being tasked with unacceptable ATC clearances due to the closed airport. The question becomes how many combine tasks does it take before the performance of human factors snaps.

Human factors system was the forgotten system until the concept of SMS was introduced. After an aircraft accident the blame was immediately assign to the pilot. The pilot became the root cause, and it was named pilot error. Simple, closed and no questions allowed to be asked. This was safety in the old days. Nobody had the right to argue with safety. When the safety-card was played, the discussion ended. SMS is different. In a healthy safety system, there are discussions about safety issues and the root cause does not paint a person into a corner. However, there are few options to test human factors and test a person for acceptable pressure level. The task is not as simple as in a manufacturing process. Often the acceptable pressure level is not identified until after an accident. Now it’s time to investigate the underlying systems, organizational processes, environmental factors, supervision and the human factors concept itself to establish a root cause that can be further discussed and mitigated. 

When human factors become the subject of testing for quality assurance there are different processes than testing for material quality or product quality. However, the principles remain the same, that testing is required to establish to what level of quality systems are performing. First, it becomes a factor to establish the expected performance level of human factors and second, establishing training programs to ensure that pilots always perform above the established expectation, or their breaking point of performance. Everybody has a breaking point at witch time they are not capable of performing expected tasks.  E.g. Air France 447: “…completely surprised by technical problems experienced at high altitude and engaged in increasingly de-structured actions until suffering the total loss of cognitive control of the situation.”-BEA Report

The point of no return back to safe operations is the point when human factors snaps. The beauty of an effective Safety Management System is not only to assess for accidents, but to lead personnel on a path where they will never fly beyond a point of no return. In other words, SMS is not just about preventing accidents, it’s to establish a confidence level of air service safety warranty. Remember, without an SMS there is a safety confidence level of zero. 

CatalinaNJB

There Is No SMS Without A Just Culture

There Is No SMS Without A Just Culture

Post by CatalinaNJB

A safety management system cannot exist without a just culture since a non-just culture in itself is an opposition to forward looking accountability. Not only does a non-just culture oppose forward looking accountability, but it also opposes the principles of continuous safety improvements. In a traditional safety culture, safety is a mandate established by senior management and demanded that all personnel strictly follow these mandates. Aviation accidents are still classified as a failure to comply with regulations, policies or procedures. The conclusions are often that If only those pilots had complied with regulations, policies and processes there would not be a single aviation accident anymore.  Well, we know that’s not true. In 1956 and the Grand Canyon disaster both Captains of both airlines were following regulations, policies and procedures and they ended up in a mid-air collision. On the other hand, if KLM 4805 had continued their first takeoff roll without a clearance, is there a possibility they could have cleared Pan Am 1736? There are times when following the rule could have avoided an accident, but there also are times when not following the rule prevents an accident. Regulatory requirement serves a different purpose, or role, than operational safety. A finding that following regulations, policies and processes would have prevented an accident is not a fact of the true root cause. A true root cause analysis identifies what was done rather what was not done.

Just culture is to line elements for comprehension and continuous safety improvements.

An enterprise may conduct a self analysis of their own just culture. There are several variations of valuable just culture assessments tools available for an enterprise to conduct evaluation. A just culture self-evaluation is more than tick the correct boxes. It is to find the true culture in the organization. With a fully operational safety management system an operator is expected to operate within a just culture. It becomes a failure to the SMS unless the culture is present. An operator could believe that they are operating within a just culture while there is no data to support their opinion.  A just culture is not the same as a non-punitive culture, but a culture that is just in the assessment of root causes. A non-punitive culture is in itself a hazard to aviation safety when it is not incorporated in a just culture. The four parameters of a just culture are trust, learning, accountability and information sharing. When the system of just culture is effective the outcome is comprehension of SMS and continuous safety improvements.

Visualizing a just culture is to line up six dices in a row where all dices are displaying equal numbers. SMS process implemented needs one process to generate trust, one process to instill learning, one process to accept accountability and one process to share information. When these four processes are established, the effectiveness is shown in the output of system comprehension and continuous safety improvements.

A great safety change today could be obsolete over time.

In a non-just culture there is only one dice; the pilot. When things go wrong the pilot is blamed. By improving the process, a second dice was added; the nav-aids. Eventually other processes are put in place and with the third dice; the air traffic controller. In this example of a just culture, these are the three first elements of the culture, where the pilot is trusted the authority, the nav-aids provide guidance and support, the third is to place accountability on ATC, in that ATC has the authority to maintain safe air to air and air to ground separation. The fourth element of a just culture is to share this information by reporting of hazards, incidents accidents and safety concerns. Sharing this information improve individual comprehension of the SMS systems and how implemented improvements equals continuous safety improvements.

A just culture is expected to eliminate accidents. Some might say that it’s not possible to eliminate all, but if one flight can be safe, what are the reason for the next flight not to be safe. In a true story the safety process did not include all four elements with a fatal outcome. A person had sat down in front of a fire-trucks door and dozed off. The fire department was called out, opened the doors and run over the person sitting there. The fire department process had placed the role of safety on the person at the door, without considerations of the other elements. This is also the old-way in aviation safety. There is only one safeguard and that is the pilot. This safeguard is placing unreasonable expectations on one person to be perfect in all tasks, to always be vigilant and to never let person or mind leave the post. The new way of SMS and just culture is to implement support systems for continuous safety improvements for the flying customers and aviation services.  

CatalinaNJB

What To Report In SMS

What To Report In SMS

Post by CatalinaNJB

The Safety Management System (SMS) is a safety tool for an imperfect organization, being an airline or airport, to discover hazards and maintain an acceptable level of safety. Airlines and airports in North America are mostly implementing their SMS for regulatory compliance and not for safety improvements. SMS is simply implemented as a requirement to maintain the operations certificate. As a regulatory demand SMS might be viewed as another bureaucratic burden to satisfy paperwork trails. However, after working with SMS and comprehend the systems, operators may experience changes of opinion and discovered the benefits, including a higher return on investment, by the implementation of SMS.  Any operator, who does not require an SMS for regulatory compliance, would benefit strongly by implementing an SMS program voluntarily and be ready when SMS eventually becomes a regulatory requirement. This timeframe period would build SMS comprehension and readiness for SMS compliance. SMS is a safety tool, and a speciality tool required, to coordinate both complex and simple systems and as a tool for cooperation with continuous safety improvements. 

The Safety Bunny is attentive, listens and looks out for hazards.

SMS is a tool in the beginning stage of supporting safety in aviation. Safety does not happen overnight but is a change in operational culture. SMS is a tool to be accepted on an equal platform as an accounting department, human resource department and sales and marketing department in a successful business. In addition, there are several other organizational functions that are required to support the business success. However, SMS is not just another tool, but the single most important tool in promoting business activities. Aviation cannot be promoted without SMS as the core purpose in bringing passengers and freight safely home. 

Hazard reporting in SMS has everything to do with an effective SMS and continuous safety improvements. When SMS is first implemented there is no prior data collected to establish the organizational confidence level of safety. An enterprise without an SMS may believe that they are 100 % safe, while in fact they operate with a zero percent confidence level of safety. Without documented safety processes there is no safety. It’s only the random probability of hitting the jackpot. A common trend when rolling out the SMS is to promote everything to be reported. Everything includes hazard reports and any incident or accident observed or being involved in. Hazards are subjective and individually assessed as a risk based on opinion and experience. Exposure intervals to specific hazard often changes the opinion of the safety risk involved. When rolling out a brand-new SMS all hazards should be reported. It should not be expected that untrained personnel make risk assessment of a hazard and decide if it is reportable or not. There is a reason why a hazard was observed, and it is that a condition caught someone’s attention. It is simply a hazard because it was discovered. There is no magic to discover and report hazards. When assessing the risk factor of a specific hazard it could well be that it is irrelevant to aviation safety, but it doesn’t take away the fact that in the moment someone determined that it was. 

What's important is how changes are managed when the line is washed out.

The first purpose of SMS is to establish a baseline of current operational processes. This baseline is not a safety level baseline, but strictly a baseline of current processes. The next step is to assess current processes to regulatory requirements. If current processes are equal to or exceed an outcome for regulatory compliance, then this baseline is acceptable to proceed to the next step. An enterprise must have processes in place where the outcome of these processes conforms to regulatory compliance before continuing to the next step, which is continuous safety improvements.  The continuous safety improvement step is to draw the line in the sand or establish an objective of where to set the safety bar. When the safety bar is accepted and set by an enterprise the opportunities for improvements are infinite. This bar may vary from one operator to another operator. It is vital for success in safety not to compare safety bar levels between operators, but to compare current result to established goals. When an operator restricts hazard reports, they are restricting the evolution of SMS and safety will maintain status quo. This might be acceptable for an operator who is safety-superior, but not for operators with a goal for continuous safety improvements.     

CatalinaNJB

Special Cause Variations vs Common Cause Variations

Special Cause Variations vs Common Cause Variations

Post by CatalinaNJB

Before a corrective action plan is applied to a special cause variation, it must first be established if the variation itself is a special cause or a common cause variation. On the surface it might look like a simple task to identify a common cause variation since this variation is known to occur each time the process is applied. This could be in a manufacturing process, a service process, a training process, a safety improvement process or in any other processes. That a variation is common in the process does not necessary define that variation as a common cause variation. It could be a special cause variation disguised as a common cause and embedded into the process. It is conventional knowledge that new pilots are less qualified than long-time pilots. While this might be true, by accepting this as a common cause variation, there is no corrective action required for continuous improvements. There are opportunities for an increased return on investments by making minor adjustments to processes, but some operators don’t see the forest for all the trees.

A common cause variation may also be disguised as a special cause variation. By incorrectly assigning a special cause variation as a common cause, a finding could be applied to a common cause variation of that type of process. When a finding incorrectly is applied to a common cause variation it becomes a task in itself to develop a corrective action plan, since this variation is necessary for the process to function effectively. The weather process is a common cause variation. It commonly varies by the day or by the hour. If the weather is defined as a special cause variation, then a corrective action plan must be applied to the weather process.  

SPC of standard operating parameters and operating in a virtual reality.

It might not be obvious to discover when a common cause or special cause variations are incorrectly identified. There might be times when standard parameters are applied to simplify the flight planning process. A standard fuel burn is established and no matter what the weather and winds are that day, the operator does not change time enroute to compensate for a common variation and the variations in weather. Weather variations are common cause variations. When analyzing standard operating parameters in SPC it becomes obvious that something is not right with the process. It’s a straight line! Real life processes do not produce straight lines.

A standard weight may also be applied as a passenger weight. When a standard weight is applied, the actual weight of the airplane will not be correct and fuel burn deviates from standard. Passenger weight variations are also common cause variations. It is common for this weight to change. In a statistical process control, the process may show an out of control process when a common cause variation is applied as special cause variation. Should an airplane run out of fuel due to incorrect passenger weight when applying company accepted standards, the passenger weight might incorrectly be identified as a special cause variation. Applying standard inputs to processes is to operate in a virtual reality. Applying SPC as a tool to identify a virtual reality is a simple task and the control chart will show that there are no variations. When it has been established that a process is a virtual reality process, implementing corrective actions to that process becomes an impossible task, since the process itself is not applicable to any real data. A new process must be implemented.

Special cause variations identified.

Standard weights are still used in calculations as it has been since the first flight. Then, when there is an incident the weight could be assigned as a contributor factor to the incident, while it was known all along that the weight was manufactured.

This Fuel Burn SPC Chart shows that there is an out of control process. However, because of the red point, the process cannot automatically be scrapped, but needs to be investigated. The investigation revealed that another type of aircraft was utilized during the days of red points and it was determined to be a special cause variation. A CAP was implemented to utilize one type of aircraft only for these runs the next 30 days to monitor the process.

Variations are acceptable. Make sense that a different aircraft did not affect safety.

Special cause variations require that corrective action plans are implemented. Defining the special cause variations becomes a safety critical area in operations. Not everything is equally unsafe in flying. There is no need for an incident to occur before special cause variations are identified.  

The next safety question might be to identify if by using another type of aircraft affected safety in operations. Another SPC Chart was developed with the following result that for the process to be in control, it is acceptable to utilize another type of aircraft and still maintain safety in operations.

CatalinaNJB

One Root Cause

One Root Cause

Post by CatalinaNJB


There can only be one root cause when analysing an occurrence for the root cause. The objective with a root cause analysis is to identify the time and location when a different direction would have generated another outcome. At that time of intercepting time and location, or the fork in the road, a risk assessment is applied to the decision in form of a checklist risk assessment tool, or in the form of a crew-experience risk assessment tool. A risk assessment in the form of a predetermined checklist decision maker, or crew-experience risk assessment tool could have produced two different outcomes. Not only is the fork in the road a point when a decision needs be made of what action to take but is also a time to make a decision of what risk-assessment tool should be applied. 

The root cause is what supports a system in operations

What if there could be more than one root cause. In a different scenario and if several root causes were identified, this would require operators to develop corrective action plan (CAP) for each one of the root causes and to implement multiple CAPs, for all root causes. 

Since there are several root causes, the weight of each corrective action plan would be applied indiscriminately equal to each one. If the weights of each CAP are assigned different weight, then the one with most weight becomes the primary root cause and the other are secondary root causes. Still, with this scenario we are back to one root cause.

"So, what is actually a root cause?"

The root cause of a nonconformity or an undesirable event, is the course of action applied at a decision point within a process at a “fork in the road”. In other words, at the point when there is a time or location to make a decision (which there will be). That decision is based on data, information, knowledge and comprehension of how interacting systems may shape the future. A root cause is not just something to consider when things go wrong but is something to consider when things are going right. There are no reasons to wait for something to go wrong before assigning a root cause. In an SMS world root causes are identified proactively. The question then becomes how to identify a root cause before an event has occurred. It’s just as simple as identifying the root cause after an event. The root cause is based on the safety risk level in the risk assessment. Prior to changes or implementation of new processes a risk assessment should be conducted. In this risk assessment the risk is accepted with the known hazards or accepted with mitigation of these hazards. Simple example of mitigation is that an airplane is de-iced prior to departure when icing conditions exists. 

A risk analysis sets the bar and draw the line in the sand

Going a step further with the de-icing scenario, it is already known what the root cause is if the aircraft departs in icing condition and crash-lands in the trees. The root cause is not that the airplane was not de-iced, but that the de-icing system is broken down. This is simply known by the fact that flight crews operating in icing conditions have knowledge of the effect of ice on critical surfaces, but elected not to apply the mitigation of de-icing. 

The flight crew did not comprehend the de-icing system. There was no comprehension of how other systems interact with other systems. (If it was, it is assumed that the flight crew would not depart in icing conditions without mitigation). There are several systems included in a de-icing system, being environmental factors, human factors, organizational factors, supervision factors, technical factors and performance factors. The process flow of system comprehension is derived from data (collected by hazard reports), information (data is turned into information), knowledge (absorbed information) and comprehension (interacting systems) When comprehension is missing the system is faulty, or data is not analyzed, system comprehension is faulty. This faulty system comprehension does not rest with the flight crew but with the operator. 

It is the organization that conduct the risk assessment and what mitigation to apply for operations of the de-icing system. This risk assessment includes environmental factors. Is the de-icing equipment suitable for that type of aircraft? A spray bottle is no suitable to de-ice a large passenger jet. Human factors are assessed of what impact on the deicing system the flight scheduling might have. Organizational factors may have overlooked holdover times weather information availability. Supervision factors may have expected the flight crew to “remember” to de-ice with another million tasks to take care of on this flight. There might be other technical factors causing a de-icing unit to malfunction, or the operator accepted standard performance data for takeoff. All these factors are affecting the total de-icing system, which is the system that makes the airplane fly after takeoff. 

With all this information, the root cause becomes predictive in scope that there is a high probability and above an acceptable risk level of an aircraft incident while operating in icing condition if the operator overlooked or disregarded one or more of these affecting factors. The root cause to prevent an aircraft crash in icing condition is an organizational system that had a catastrophic failure. This is simply true since an operator under these conditions did not comprehend the complete de-icing system…which makes it only one root cause. 

CatalinaNJB

The Concept Of SMS

The Concept Of SMS

Post by CatalinaNJB

The first thing when giving Safety Management System (SMS) taring to personnel, is to provide training in the concept of SMS. It is crucial to success of a newly implemented SMS that the concept of SMS is introduced at all levels in the organization prior to any other SMS training takes place. This includes management and the CEO in addition to all other personnel. The CEO, President or Accountable Executives are just as new to SMS as the airport manager, pilots, mechanics and other personnel in the organization. That a person ranks higher in an organizational hierarchy does not imply that there is a greater knowledge of SMS, or that this person has a comprehension of the SMS.  It could be an intimidating task for a brand-new SMS Manager approach the CEO and suggest SMS training. It could also be an assumption that since the AE has final authority over SMS financial and human resources they are already SMS experts. However, when the AE accepted the AE position and appointed an SMS Manager, the SMS Manager became the only SMS expert within that organization with accountability to the SMS program itself to train the AE from the ground up. 

Compliance with regulations, standards and policies is not a safety guarantee    

There are two primary concepts to the SMS. The first concept of an SMS is for an abstract idea to produce an abstract result. This is applied when developing SMS manuals and processes for regulatory compliance. Regulatory compliance is a static-state of the operations and therefore abstract in nature.

The second concept of SMS is for an abstract idea to produce a tangible result. This combination in itself is a direct conflict with normal operations, where an abstract input, or existing in thought or as an idea but not having a physical or concrete existence, is expected to only produce an abstract output. [E.g. Brainstorming sessions are not expected to produce real results but are expected to produce safety plans for implementation.] An Enterprise could easily fall into a trap where the only purpose of their SMS becomes to produce a paper-trail, or the collection of data, as evidence of safe operations. It becomes evident in the Regulator’s validation of an SMS that there are distinct differences between abstract compliance and tangible compliance, by their design and demonstration validation.

Since hazards are opinion based, hazards become the abstract concept of SMS, while the task of initiating hazard reporting becomes the tangible output. Incidents and accidents cannot be reported until after the fact and are not staged for the purpose of reporting. On the other hand, real hazards may be staged for the purpose of reporting within a supervised environment. During a training session multiple hazards could be introduced to the group for hazard reporting. Each person may place different weight on the same hazard based on learning, expectation, experience and opinions and therefore abstract conditions. One person may report all conditions as hazards, while others may report none or just a few. Within an effective SMS, opinions of hazards are transformed into an output of hazard reports. Continuous safety improvements and proactive safety measures are dependant on data received by hazard reporting. When the concept of SMS is defined beyond the hazard reporting, SMS becomes reactive in concept.

In the eye of the beholder a sunset is a hazard.

Incidents and accidents cannot be predicted, but the intent of hazard reporting is to prevent accidents. Some years ago, the root cause of a 747-airliner accident was an event that had occurred twenty-two years earlier. During these years the airplane had been in and out of the shop many times, but nobody reported what they had observed. Hazard reporting was not an acceptable approach and by reporting a hazard caused by a faulty repair and questioning workmanship could be disrespectful to the mechanics. Over several years a discoloring on the airframe was observed, but there was no toolbox for personnel available to report this concern. A hazard report of these observations would have required at least one person to review the hazard and sign off on a safety risk analysis. Investigation of a hazard report may have guided personnel to inspect a damaged bulkhead.

The old saying is that “selling is not telling” also goes for the concept of SMS that “teaching is not telling”. Training in the concept is to introduce SMS as a toolbox full of tools to use for continuous safety improvements. Tools available to all personnel are sorted by their roles, responsibilities and accountability. The role, responsibility and accountability of the AE is to ensure that each person feels included in the SMS processes, that they take ownership of their hazard report and that they are following their own report from beginning to end. The end result of a hazard report may discover options that could never be imagined.

 

CatalinaNJB