Saturday, December 31, 2016

New Year Resolution: Non-Punitive Actions

New year is the time of the year when most of us make promises to ourselves to live a different lifestyle or take on challenges that have been out of reach before. These promises are often made in the spur of the moment and without consequences if not kept. Often, when a new-year resolution is made, it becomes a game to see if anyone can make it last past the first month of the year.

Illegal activity of the SMS.
This year a new-year’s resolution could be to implement a non-punitive policy in the organization. When a safety management system in aviation is required by the regulations a non-punitive policy must be in place to conform to regulatory requirements. This policy is written and implemented, but there are several options to find an “out” when there are issues that goes against operational practices. Unless there is a total commitment to safety in aviation, where information and data is critical to improve safety, the expectations for a non-punitive policy is that it is not applicable to: illegal activity, negligence or willful misconduct. These conditions make fully sense not to include as a “get out of jail free” card to personnel. However, when organizations are unable to pre-qualify and define what actions are included in illegal activity, negligence or willful misconduct, decisions are made in the spur of the moment and after the fact.

Illegal activity must be pre-defined in a job description, or for a job performance evaluation and based of decisions made by the courts. Illegal activity cannot be applied as punishment by a private individual, or an organization, to any person for a job description violation, or lack of job performance. When integrating illegal activity into SMS the management has an obligation to determine if there was an act of illegal activity to any and all incidents or accidents.
Negligence becomes a challenge to defined in a job-description or apply to a job-performance evaluation since this would involve the organization’s effectiveness of training. When an error, mistake, on unplanned event happen to someone the organization has an obligation to determine if the action must be classified as negligence. For a safety management system to identify negligence data must be collected, analyzed and investigated. Within the SMS system there are no regulatory requirement, or standard to assess, or audit a job performance against negligence as this also would jeopardize the just-culture of the SMS system.

Willful misconduct is a human behavior action and the violation is enforceable by a regulation, standard or policy. An organization that includes willful misconduct in their job description, or as a standard for an on-the-job evaluation, have an obligation to assume that every incident, or
Without data, it’s just some person’s opinion.
accident are the result of willful misconduct. When willful misconduct is applied in the SMS investigation processes the organization has developed a culture where job-performance reviews are elevated to a level beyond a functional SMS.

The Safety Management System is a system that can only operate within a just-culture, or a culture where learning is accepted and encouraged. When applying illegal activity, negligence or willful misconduct opportunities for learning are eliminated since these activities are only intended as enforceable policies. When applying these criteria, an organization is moving outside the scope of operational activities and job-performance standards. In addition, these policies are contradictory to a functional Safety Management System and an operational safety culture within a just-culture. Illegal activity, negligence or willful misconduct are the new-year resolutions of aviation safety.


Friday, December 16, 2016

Santa's UAV Deliveries

Santa Claus is manufacturing gifts and presents like never before, with production going exceptionally well. A new toy is the “magic rock” toy, which has the ability to project someone’s thoughts to the rock for viewing. Santa ran into production issues when the supply of rock at the North Pole was running out, but after months and weeks of production Santa finally completed these super-orders and is set for deliveries all over the world.

Santa’s improvement of effectiveness.
This year Santa had improved the SMS, or the Streamlined Mission Service, to include continuous improvement. During the pre-production period Santa did much research of industry standards for deliveries, but since Santa is the only supplier of this specialty delivery service, industry standards were not available. Over the years of deliveries Santa often crashed on roof-tops and damaged the equipment. These crash-variable were not only expenses which reduced profit, but also causing lack of customer service when presents were not delivered on time, or in good working order. In the old days, before technology and fragile freight handling, a crash or two on a roof top did not totally destroy, or damage the gifts and often the snow would cushion the impact. However, with the change in the gift market to almost all electronic gifts, the impact of service had changed. Santa reviewed the Santa Production’s SMS policy annually for applicability to operations, but some changes were not major, or immediate detectable. When reviewing the Safety Policy this year Santa Claus discovered a trend of incident reports and the affect it had on customer service and delivery reliability.

This year Santa had made an improvement to the delivery process by using the UAV, (Universal Autonomous Vessel), or drone. This improved process includes no-landing deliveries and is expected to improve customer service and delivery reliability. As a test-run, Santa loaded up the sleigh with samples and UAV. The size of the UAV fits in the Santa Sleigh by replacing the helpers. Santa completed the test-run and found this new process to be effective above and beyond expectations, but with two hazards. One was that the reindeer would not get rested since the UAV are launched on-the-fly. The other residual hazard was that by doing UAV deliveries, Santa’s long time personal contact with home-owners, home-decorations and getting stuck by climbing down the chimneys was identified as a hazard to customer service with a high probability that customers would be unsatisfied and search for other delivery options.

Santa’s deliveries are tailored to individual homes.
Santa had improved the delivery processes, but was not sure if the success story of this business over of Santa’s deliveries was the gift that people received, or if it was the many centuries visit from Santa that was behind the success. Santa had to implement a safety risk control, since there was a probability that the UAV’s effectiveness could ruin the business. Santa needed to monitor processes and collect data of customer satisfaction. As a safety risk control and data collection, Santa included a mini magic-rock that automatically sends back to Santa a customers’ satisfaction survey of delivery method and the impact that had on the appreciation of the gifts. Santa needed to know if it was his short visit to the families that made Christmas wonderful, or if it was receiving the presents.  Santa’s timeline for evaluation was established and for a review the success of this year’s service package prior to the Elves’ Delivery Review in May of 2017.


Saturday, December 3, 2016

Non-Punitive Reporting of Hazards, Incidents Or Accidents

Variables are the forks in the road and A simple non-punitive reporting policy is the road to success.
A non-punitive policy under an SMS program is a policy for the internal reporting of hazards, incidents or accidents, including the conditions under which immunity from disciplinary action will be granted. The intent of the policy is for organizations to receive data from personnel and then analyse how organizational processes are functioning, or why they are not being as safe as first
A simple non-punitive reporting policy.
assumed. Within an SMS organization, the outcome of processes is not totally dependant on inputs, but also on human factors variables. The concept in process management that outcome is dependant on what is put into the process is based on standard inputs without variation. Within an SMS environment the variables are human factors, where the same input to a process may yield a different outcome with different personnel involved. If the outputs of SMS processes did not vary the variables of human factors, a non-punitive policy would be redundant and ineffective.

Since the beginning of aviation, airports and airlines, have been audited, inspected and assessed for compliance. One year the audit result was found to be in compliance, while the next year the same systems were found not to be in compliance. Often, there were changes to audit and inspection results when an organization hired new personnel to do audits and inspections. This does not imply that one was more correct than the other, but that the variables of human factors made a change in outcome with the same process. In a real world, human factors variations spread out like a dropped bag of marbles.

Human factors variations could be controlled by enforcement. When applying this concept, variations are not managed, or considered, they are only enforced. Some industries are heavily into enforcing technical standards. When enforcing an outcome, the enforcement is of the outcome, or process result itself, and not of the processes which lead up to the result. This is an effective tool for selective non-compliance discovery, but an extreme ineffective and resource demanding tool for an unbiased process compliance discovery. In addition, for fully compliance with this enforcement process, the technical enforcement process itself must also self be enforced, which is a concept causing an indefinite level of layers of enforcement. However, when applying a non-punitive policy of process compliance, the resource demand is drastically reduced, compliance increased and higher profit generated.

Variables are the forks in the road.
Safety Management System in aviation has recognized that human factors exist and that identifying these variables will increase safety margins of processes with the result of a more effective and streamlined organization. With a non-punitive policy in place, the odds of receiving data of critical importance to safety are increasingly in favor of the airports, or airlines. A non-punitive policy does not imply that in times prior to SMS, personnel received punitive punishment for internal reporting of a hazard, an incident or an accident. The non-punitive policy is a defined link within an SMS system for the system be compliance with organizational polices, that it is documented, approved, accountable and applied to operational processes.


Saturday, November 19, 2016

Implement Safety Policy At All Levels

In some countries drivers are expected to drive on the right side of the road, while other places the expectation is to drive on the left side. At times a country may change this practice and change from driving on one side of the road over to the other side. Several years ago when one country changed from driving on the left side to the right side it was said that for a smooth transition they would first begin with trucks and busses to drive on the right side, and a month later cars would change over to right hand side driving.

The safety policy belongs in all branches.
Human nature is to ease into changes to slow down the reaction of emotional impact of changes, rather than make a determination to change and move beyond emotions. Stories says that some, when starting a new job, must ease into the job by only working a few hours a day. And most of us do not appreciate the emotions of the sudden change of ice-cold water, and is very hesitant to just jump in without first ease into it first.

A Safety Management System (SMS) Safety Policy is still in a developing stage and new to most aviation service suppliers. Safety may have been implemented in several of the exploration and mining industries, but in aviation safety became the hit-and-miss approach. The fact that the majority of airlines operate without major accidents does not support that there are streamlined and effective safety operational processes in place. What this data of few accidents tells us is that there were few accidents. The data don’t tell any stories of how effective operational safety processes are.

A safety policy keeps the tracks lined up at all levels.
The effectiveness of safety processes begins with the Safety Policy and have no ending, but continues on with human factors. A Safety Policy is only applicable to an organization when implemented at all levels. There are positions in any organization, aviation industry included, which at first sight does not appear to be a part of safety. However, these positions will always be a part of the second phase of implementing driving on left-hand-side to right-hand-side. Or, in other words, when the Safety Policy is not implemented at all levels in the organization, these positions become a hazard to aviation safety.

The top management is an SMS organization is the Accountable Executive (AE). Should an aviation organization not make the Safety Policy applicable to the AE, the organization does not have a Safety Management System in place, no matter what processes are implemented. At the opposite end, unless lower level personnel are included in the Safety Policy there is no SMS in place. A safety polity that is selectively implemented is not a valid policy and if not applicable to all, it’s applicable to none.

Safety in aviation must be viewed from a customer’s point of view and what safety risk the customer is willing to accept. All travelling customers only accept Zero Tolerance to Compromise Aviation Safety, which begins with the Safety Policy and have no ending, but continues on with human factors.


Saturday, November 5, 2016

Communicate Safety Policy to All Personnel

For effective SMS management an airport or airline is accountable to safety by communicate the safety policy to all personnel with the result that they are made aware of their safety obligations. A safety policy on the shelf is not practical at all. If no one knows what the safety policy is, nobody can adhere to the policy and the airport, or airline is in violation of its own processes. When the accountable executive signs off on the safety policy that person makes a commitment to safety which
Authority is the foundation of a safety policy.
is a commitment of zero tolerance to compromise aviation safety. In addition, this safety policy includes a just-culture where it becomes fundamental to safety to discover hazards and incidents at an early stage to make organizational changes for continuous safety improvements. The safety policy does therefore not only affect this one organization, but all organizations in the aviation community.

Communicating the safety policy to all personnel is info-sharing. Info-sharing is critical to an airport or airline to gather intelligence for the discovery of safety critical information. Without a safety policy in place, and a safety policy that is approved at the organizational policy level, either an airport or airline have the authority to promote safe operational processes. An undefined, or unwritten safety policy does not delegate to any persons the authority to implement safety promotions.

Without a safety policy an airport or airline do not have tool to develop processes to improve effectiveness and safety. Any on-the-fly process is not a tool for continuous improvement to further improve safety within an organization, or to establish a confidence level of safety performance. Safety improvements are not achieved by improvisations of processes, but by the safety authority to document, prepare, test, assess and implement.

The safety policy is communicated to all personnel as a link in a chain of all safety policies to be shared within other organizations. Safety improvement is not an independent task, but an info-share task between airports and airlines to improve safety without the loss of life of equipment. Sharing of the safety policy within an organization and ensuring that all are aware of their safety obligations is a
Cost-factors are results of safety parameters.
step forward in identifying, maintaining, and improving safe operational processes. Aviation safety has historically been in an experimental stage of preventing accidents by not defining safety parameter cost-factors. By applying a safety policy and ensuring all are aware of their accountability to safety, the aviation industry is moving from undefined cost-factor parameters and into econometrics design parameters.


Sunday, October 23, 2016

Review Your Safety Policy

There is an expectation that the safety policy is reviewed periodically for continuing applicability. A safety policy establishes guidance for safety objectives and goals for the safe operation of an airport or aircraft. A safety policy is a practical applied document and tailored to each operator for the purpose of being accepted by all personnel within the organization.  Policies that are not accepted by all personnel are impractical to operations and more of a deterrent to safety than no policy at all. A policy that is influenced by a third-party requirement is a not an unfettered policy and is also a deterrent for the safe operation of an airport or aircraft.

A Safety Policy is based on data only.
The expectation that the safety policy is reviewed periodically is to identify processes that has influenced the policy and that the policy is still applicable to detected, or undetected changes of operations. There are several parties involved in airport or airline operations, from tenants, customers, auditors and the environment itself. When there is interference in development, or maintenance of a safety policy the policy sets the stage for unexpected, or undecided results.  

When operational changes go undetected they becomes “normal” to operations. A policy may at first sight appear to be applicable indefinite, since at the time of implementation its intentions were to promote safety and if the policy is questioned, or reviewed it could appear to be an attack on safety itself.  Over the history of aviation, it has been unheard of to question safety. However, by allowing for a safety review of the policy, or in other words question safety, new doors are opened for continuous improvement to aviation safety.

Almost safe doesn’t cut it.
Reviewing the safety policy is a responsibility of the accountable executive. This does not necessary imply that the accountable executive, who often is removed from the operational processes, does the actual review, but implies that the accountable executive accepts accountability to the safety policy itself. This renewed safety policy is then signed by accountable executive and promoted throughout the organization with explanation of why these changes were necessary for the safe operations of airport or aircraft.


Sunday, October 9, 2016

Promotion of Safety Policy

There is an expectation that the safety policy is promoted by the accountable executive. Without promotion a safety policy is ineffective, but when actively promoted by accountable executive, who is senior management of an airport, or airline, the safety policy becomes personal and the most important safety document in the organization. A safety policy must be clear, policy specific, overview of organizational structure and include a commitment to continually improve safety.

Accountability is to apply the intent of a safety tool.
A Safety Management System is from the top-down safety management system, with roles and responsibilities for top management and all personnel.  One of the top management roles is the safety role as accountable executive with a responsibility to promote the safety policy.

The reason why it is important who promotes the safety policy is to establish an organizational commitment to safety. The policy must be promoted by someone who has organizational authority to promote and who has safety authority respected in the organization. Often the accountable executive is the Chief Executive Officer (CEO) of the airport, or airline. If the airport, or airline is operated by a government, the accountable executive may be the highest ranking non-elected person, or even an elected political person. However, if the organization is of a large size and complexity, the CEO may be too far removed from reality for an effective role as accountable executive. Statements and policies from a political elected person, or a highest ranking non-elected person, who has been assigned role as an accountable executive, may be viewed as nothing else but political statement without any powers to impact personnel at other organizational levels. The success of a safety policy is viewed from the ground up.
Respect is a result of accountability.
When the expectation is that the accountable executive promotes the safety policy, the intent is for the highest organizational role to be responsible for safety. One of the requirements to qualify as accountable executive is that the person has control over financial and human resources. The regulations, or expectations do not state, or imply that the accountable executive has to be the person who allocate, or distributes funds, or the person who assign human resources. The only requirement is that the person has to be in control of these items. In a large organization, a person at one or more levels below the CEO may be the person who has control over financial and human resources. This is the person who then should be appointed as the accountable executive for this position to be an effective safety tool.

When the accountable executive at an accountable organizational level promotes the safety policy it becomes an authorial document that other personnel will accept and further accept their own accountability role within the organization of an airport or airline. Accountability is not just at the top management level, but at all levels in the organization. Everyone are accountable to their own job description, accountable to the intent of their job performance and accountable to aviation safety.


Saturday, September 24, 2016

Safety Policy Expectation

Safety Policy Expectation

There is an expectation that the organization has a safety policy that is agreed to and approved by the accountable executive. An accountable executive is the person who is responsible for operations or activities authorized under the certificate and accountable for meeting the requirements of the regulations. Without accountability for meeting the regulatory requirements an airport, or airline is applying a reactive safety management system where it becomes a simple task to point fingers at the last link in the chain of an accident. It takes initiative, effort and planning for accountability to be effective with proactive operations and includes all links in the chain of event.

A safety policy expectation is to ensure safety for all.
The very specific reason for the accountable executive to approve and agree to the safety policy is to establish a safety management system where senior management accept accountability, which then trickles down to all personnel. Personnel do not have safety authority and authority to question safety unless this authority is given by senior management. Everybody talks safety, but very few actually know how to implement it.  Safety is the analyses and “plan-do-check-act” of regular day-to-day processes.

Definition of accountability is often incorrectly applied as the definition of responsibility. Although accountability and responsibility cannot be applied independently, or one without the other, they cannot be interchanged with each other. Responsibility is a description of authority, while accountability is operations of that task, or the action of carry out that task of authority. Accountability the behavioral action as expected by responsibility.

The difference between responsibly and accountability could be described as the responsibly and accountability of driving down a two-lane highway. Opposing traffic, going 60MPH towards each other are only separate by an imaginary wall of a yellow line. This is not a logical separation of two vehicles approaching within just a few feet of each other at 120MPH. If applying logic to this, it could be categorized as an insane solution and not practical. However, when applying the variable of accountability into the equation it works.  The responsibly to stay on the correct side of the yellow line remains with each driver, whether they are driving or not.

Accountability is the expectation of responsibility.
When the expectation of a safety management system is that the accountable executive has agreed to, and approved the safety policy, the airport, or airline, set the bar of where in the organization accountably is expected. With the accountable executive accepting responsibly for accountably it has been established that the bar is set at the senior management level. Accountability is a tool to identify hazards and operational practices, which if left unattended, could lead to an accident.


Monday, September 5, 2016

Strategies for SMS Expectations

Expectation 2 – Safety Policy

The beginning of a Safety Policy.
There is an expectation that the organization has based its safety management system on the safety policy and there is a clear commitment to safety.
The reason for this expectation is to ensure that there is a system in place for design and performance of a safety policy that has a clear commitment to safety. A clear commitment to safety is an organizational Zero Tolerance to Compromise Aviation Safety. If there is a tolerance to compromise safety, for any reasons, there is not a clear and accountable commitment to safety. An organizational clear commitment to safety is necessary for all personnel to accept their roles and responsibilities.

The safety policy is required by CARs 107.03, which is a safety policy on which the system is based. This is the design portion of a safety policy where an airport, or airline, includes the safety structures and safety systems of their organizations. The safety policy is then signed by accountable executive to communicate senior management commitment to safety. Without a signature by the senior management team, the policy is without an organizational authority to be implement and executed.

The performance portion of this safety policy is required by CARs 305.502 and CARs 705.152, which requires the organizations to communicate their safety policy to all personnel. Communication
with a Safety Management System (SMS) is a two-way communication, where feedback is required for safety policy to be a valid operational document. Often, communication is a one-way street with organizational posts, or email, where information is provided as mass-communication, or to specific individuals without expecting a reply. However, for a safety policy of SMS to be valid, feedback is required for management to assess how personnel interprets the safety policy and how they intend to apply the policy to their daily roles and responsibilities.

It takes ownership and accountability to do great things.
An effective Safety Policy is a policy tailored to the organization that all personnel can recognize, accept accountability for and take ownership of. Without ownership of the Safety Policy, the policy is not effective and could more of a distraction from safety than an asset to safety. Without accountability to the Safety Policy, it often becomes more important to adhere to the text than to the intent of safe operations.

The expectation to have a safety policy in place, and that the safety policy has a clear commitment to safety is just another piece of the complete SMS package for regulatory compliance and safe operations of an airport or airline.


Saturday, August 27, 2016

Strategies for SMS Expectations

Expectation 1

A Safety Policy is an organizational guidance principle which describe the operational culture and core purpose for airport or airline operations. Canadian Aviation Regulations (CARs) requires airports and airlines to operate a Safety Management System which is based on this Safety Policy. In addition to the generality of a Safety Policy, this policy requirement is to establish a clear enterprise commitment to safety. The challenge for airports and airlines becomes to define what a clear commitment to safety is. A clear commitment to safety is not just a statement to be safe, but it is to capture defined expectations for operational processes. 

A Safety Policy has the ring of permanent nature.
Expectations are defined by Transport Canada in their SMS Document Review Guide (DRG), which was distributed to airlines and airports during the implementations phases of SMS. An airport, or airline that has not established a link to the expectation of a safety policy is assessed to be in non-compliance with the Canadian Aviation Regulations. Often the findings by Transport Canada states that “There is an expectation that…” 

The comment continues that there is no link between SMS design, or SMS operations and the expectation of a Safety Policy. The expectation is that an airport or airline fully comply with the expectation for complete regulatory compliance. 

The Document Review Guide of a Safety Management System has established an expectation of a Safety Policy that: “The organization has based its safety management system on the safety policy and there is a clear commitment to safety.” Reference to CARs are 107.03, 302.502(a)(i), 705.152(1), where 107.03 and 302.502 are applicable to airports and 107.03 and 705.152 are applicable to airlines. Under CARs 107.03 the requirements are to design a Safety Policy and CARs 302.502 and 705.152 are operational processes which are expected to conform to regulatory requirements.

A clear commitment to safety is blurred by assumptions of safety.
A Safety Policy is expected to have a design with a clear commitment to safety. An overarching safety policy is a commitment of Zero Tolerance To Compromise Aviation Safety and includes all Components of a Safety Management System. The first commitment of a Safety Policy is for an airport or airline to establish and maintain regulatory compliance. Without regulatory compliance there is no authority to establish, or maintain operational processes as airport or airline.  

As a second component to the Safety Policy is the performance requirements. These components are found in CARs 302.202 for airports and 705.152 for airlines. This intent of a Safety Policy is to establish and maintain operational processes which perform to regulatory compliance and that these processes do not in any way compromise aviation safety. There is no guarantee that a regulatory conforming process at all the times promote safety. However, the guarantee to safety is when an airport or airline accepts accountability, establish and follow-up in all aspects of operational processes with a commitment of Zero Tolerance To Compromise Aviation Safety.    


Tuesday, August 16, 2016

The Building Blocks Of A Safety Management System

SMS regulatory compliance is depending on building block design
A Safety Management System (SMS) for Canadian airports, or airlines are built up by components, elements and expectations. These components, elements and expectations are in reference to the Transport Canada Document Review Guide (DRG), which was made available to all operations for implementation of a Safety Management System.
The 6 Components, 17 Elements and about 95 Expectation SMS building blocks are defined for operators to design a regulatory compliant SMS with performance processes that conform to regulatory requirements.

The components and underlying elements and expectations are defined in the DRG as follows:

Safety Management Plan;

  • Elements
  • Safety Policy;
  • Non Punitive Reporting Policy;
  • Roles and Responsibilities and Employee Involvement;
  • Communication;
  • Safety Planning
  • Performance Measurements; and
  • Management Review.
  • Expectations (multiple)

Document Management;

  • Elements
  • Identification and Maintenance of Applicable Regulations;
  • SMS Documentation; and
  • Records Management.
  • Expectations (multiple)

Safety Oversight;

  • Elements
  • Reactive Processes;
  • Proactive Processes;
  • Investigation and Analysis; and
  • Risk Management.
  • Expectations (multiple)


  • Elements
  • Training, Awareness and Competence.
  • Expectations (multiple)

Quality Assurance;

  • Elements
  • Quality Assurance.
  • Expectations (multiple)

Emergency Preparedness

  • Elements
  • Emergency Preparedness and Response.
  • Expectations (multiple)

Canadian Aviation Regulations are performance based regulations, where the output of processes becomes the determining factor of operational compliance with regulations. Components, Elements and Expectations are opinions designed by Transport Canada of what to include in a Safety Management System for regulatory compliance. Components and Elements are based on regulatory design requirements and performance requirements for operational processes. Expectations is a list of opinions of what is required within a system for design and for operational performance. Expectations provided in the DRG is a comprehensive list, but is not exhaustive for complete regulatory compliance in either design or performance.  

SMS design and performance must be in harmony.
Let’s take a moment and look at the Components, Elements and Expectations of an SMS and apply these building blocks to the Canadian Aviation Regulations. CARs 107.02 is a design regulation for a certificate holder to maintain an SMS. This regulation is applicable to both airports and airlines.
The component linked to this regulation is a Safety Management Plan. However, for a Safety Management Plan to be designed for regulatory compliance, there are elements of building blocks in support of the component, with one of these building blocks being a Safety Policy. The expectation, or opinion of a safety policy is that the policy exists, is followed and understood.

The making of a safety policy is a design of SMS, while the followed and understood expectations are performance expectations of SMS. SMS performance regulations for a safety policy are found in CARs 302.501 for airports and 705.152 for airlines. With the information provided in the DRG by Transport Canada, all information required for making and designing an SMS are provided to operators. Operational processes for regulatory conforming performance SMS are dependant on operator’s size and complexity. However, all operators must apply both an SMS design solution and process flow strategy for complete regulatory compliance with the CARs.


Monday, May 30, 2016

Risk Assessments And Exposure

Risk assessments are tools to prioritize risks and assign risk values to specific events. Higher risks values have greater safety impact to operations and are affecting operational processes more immediate than lower risk factors. A high number is an immediate shutdown, while a low number that no action is required. A risk is an active condition, but if left alone without mitigation or removal, will cause harm to person or property.

Aircraft parts are manufactured and tested to perform within parameters.
The risk value number is a factor derived from a risk matrix with assigned categories of probability, severity and exposure. This formula is calculated by probability x severity x exposure = risk factor. Risk factors are assigned numbers for acceptance, mitigation, or not acceptable and colored green, yellow and red respectively.  A risk is not a latent hazard, but an active condition at the time and location of intercepting an airport, or aircraft in flight or taxiing.

At one end of the spectrum there are visual clues of exposure to hazards. Some of these hazards are birds and freezing rain. Birds is a hazard, but does not become a risk until there is an intersecting path between birds and aircraft. Freezing rain is another identified hazard, but not does not become a risk until it is in the path of a flying aircraft, or falling at the airport. When exposures are applied to birds and freezing rain, these risks compute to higher risk value number and are mitigated, or avoided. An aircraft is only exposed to birds, or freezing rain when these hazards are on an intersecting path with an aircraft, and an airport is only exposed when birds are at the airport, or freezing rain are falling. At any other time, birds and freezing rain are no risks, but identified hazards.

At the other end of the spectrum there are non-visual clues, but assumed exposures to risks. These risks are more difficult to assess, since they contain probability hazards that are not active events affecting an airport or aircraft. These hazards are not to be ignored, but to be assessed differently than visual clues risks in the exposure of a risk assessment.

Pilots train extensively to manage engine failures at rotation, climb-out, departure, approach, or in-flight. The reasoning for training is that there is a virtual reality of probability that a modern aircraft engine could fail during any of these phases of flight. When an aircraft is setting thrust for take-off, that aircraft, or pilots are not exposed to an active risk of an engine failure. They are only exposed to the hazard within the system for an engine failure. If airlines are applying an engine failure exposure factor to take-off and departure, they are incorrectly assigning a risk, or an active hazard to the initial phase of flight. Aircraft and pilots are only exposed to an engine failure at the time and location of when the engine operating system is intercepted by an external event. Just as birds and freezing rain, there is no exposure until the hazard becomes an active event. If there is a possibility for an aircraft engine failure, the principle of Zero Tolerance to Compromise Aviation Safety is jeopardized. When aviation safety is compromised, the flight cannot continue.

In a virtual reality world anything can happen, any scenarios can be introduced and any outcome are possible. During the first 100 years of aviation, when data were limited and SMS was not included in planning, engines quit, wings fell off and preventable accidents happened. Aviation today is totally changed where data is analyzed, proactive measures are taken, processes are assigned confidence levels and mathematical equations and statistical process control are foundation for safety assessment. From the manufacturing of an engine, NDT testing of parts, installing on aircraft and to
Justification of exposure affects the outcome of a risk assessment.
flight operations, every step has multiple quality control and safeguarding processes, including quality assurance and quality assurance of the QA program itself. The aviation industry is moving into the new era of safety, from doubting the production quality to the reality where it is inconceivable that an engine will fail. With this in mind, when an aircraft sits at the threshold and sets take-off thrust, there is a 100% confidence level that the engines will function as designed. There are other external and accountable events causing engines to fail.

When applying engine failure to a take off exposure, risk management is incorrectly making assumptions that engines fails without pre-existing conditions being present, or that incomprehensible hazards intercepted the engine at the time of takeoff, or that the failure was caused by an unforeseen event. With the millions of safety processes included in manufacturing, training and operations an engine does not just fail on its own.  


Sunday, May 22, 2016

Non-Punitive Policy Is Enterprise Accountability

An applicant for, or an operator of an airport or airline certificate is required to have in place a non-punitive for reporting of hazards, incidents, or accidents and is one of the elements of a Safety Management System (SMS). A non-punitive policy is a policy for an airport or airline to allow for free flow of reports in a Just Culture and collection of data within the organization. In a Just Culture environment, a contributor may not fear repercussion from supervisors, managers or other personnel for reporting. A non-punitive policy is not a get-out-of-jail free card, but a policy of organizational accountability.

A non-punitive policy must be understood. 
A non-punitive policy is a policy for the internal reporting of hazards, incidents and accidents, including the conditions under which immunity from disciplinary action will be granted. The fundamental of a non-punitive policy is that it is unconditional with “no strings attached” and with pre-established conditions for when immunity for disciplinary actions are granted.
It may be tempting to simplify a non-punitive policy and apply conditions when immunity is not granted. Some of these conditions could be illegal activity, negligence or willful misconduct.

When applying these conditions, a fundamental principle of accountability in a Safety Management System is jeopardized. These are conditions which places the burden of proof on the last link in chain of events without considering human factors, organizational factors, environmental factors and supervision factors.

In most judicial systems illegal activity is an act committed in violation of law where the consequence of conviction by a court is punishment and where the punishment could be as serious one such as imprisonment. An illegal activity is not a fact until convicted by a court. The basic principle is innocent until proven guilty. It is therefore impossible to apply illegal activity to job performance evaluation and make it a condition of a non-punitive policy.

Negligence is failure to take proper care in doing something. When applying this as a condition of a non-punitive policy it becomes a decision by a supervisor who was not present at the time of incident, or accident. The supervisor was not in the moment of events and included in the ongoing decision making process at the time. Applying negligence as a condition to a non-punitive policy places the burden of proof on person involved without considering human factors, organizational factors, environmental factors and supervision factors.

Any act, or failure to act, by a person that was intended to cause harmful consequences to the safety or property of another person is willful misconduct. When assessing for willful misconduct an evaluation of the mindset at the time of event is required and based on supporting data collected. Applying willful misconduct as a condition to a non-punitive policy places the burden of proof on person involved without considering human factors, organizational factors, environmental factors and supervision factors.

An enterprise has established a maze for options when applying illegal activity, negligence or willful misconduct
A non-punitive policy is only credible, without bias and with organizational accountability when including pre-established conditions for when immunity for when disciplinary actions are granted. These conditions are based on job performance criteria, job descriptions with associated tasks and the intent of job performance outcome. When applying organizational accountability, personal accountability and that mistakes are not accepted to a non-punitive policy, the policy considers human factors, organizational factors, environmental factors and supervision factors to ensure correct training and competence.


Monday, May 9, 2016

When Safety Policy Is A Regulatory Requirement

Canadian Aviation Regulations (CARs) requires the Safety Management System (SMS) for airports and airlines to have a safety policy in place for regulatory compliance to operate under CARs 302 or 705. This safety policy sets targets for objectives and goals to conform to regulatory requirements. CARs are performance based regulations, where results of operational processes are the determining factors for compliance.

There are two parts for Safety Management System CARs compliance. One is design of regulatory compliance, or layout of the plans, while the other is the operational processes for regulatory compliance, or layout for expected outputs.  Regulatory compliance is documented in a manual with descriptions of requirements and operational process regulatory compliance are descriptions of how an airport, or airline plan to execute operations and collect data.

Operational safety polices comes in any forms and shapes.
Transport Canada developed a set of expectations for regulatory compliance. These expectations, while short coming in some areas, are guidance for developing regulatory compliant documents, or manuals. Regulatory compliance is simple, since it happens in a static environment without operational interaction or movements. On the other hand, operational process compliance is complex, since there are millions of variables, both internal and external variables which affect the outcome of processes. Regulatory process compliance becomes available only after review of data collection, or in other words, after the fact. It is not possible to predict the future with processes for compliance, and the data therefore has to speak for itself. However, regulatory compliance, or the layout of the plan, is future-predictable.

CARs 107.02 is applicable to both an applicant and a holder of an airport, or airline certificate. The certificate is an authority to operate and without a certificate there is no operations taking place. An applicant is not authorized to operate, while an operator is. That an operator has an authority to operate doesn’t change 107.02 to be applicable to operational processes.

CARs 107.03 is applicable to both airports and airlines to have in place a safety policy on which the system is based. As long as the safety policy is in place there is regulatory compliance. There is no requirement for operations to take place for this safety policy to be regulatory compliant.

The operational process for regulatory compliance are governed by 302.502 for airports and 705.152 for airlines. A safety policy for airports under 302.502 and airlines under 705.152 have actions involved, which is that the accountable executive has approved and communicated the safety policy to all personnel. Further, no matter how many operational errors, or findings there are under 302.502, or 705.152, these findings do not change applicability to become findings under Canadian Aviation Regulations 107.02.

Examples that findings under 302.502 or 705.152 do not convert to 107.02 findings can simplified be explained by comparing aviation to highway travel. Generally speaking, there are two important regulatory requirements to operate a highway, which are markings and signs. Markings and signs are planned, developed and installed prior to highway operations. It is known, or predicted, where these signs and markings will be when the highway is completed. These markings and signs are the highway’s safety policy, with maximum speed established on a sign or marking that clearly identify the limits.

Speed bugs for operational compliance.
As the highway opens and become operational the users must have processes in place to stay within the markings and conform to regulatory compliance of the signs. If the sign is a maximum speed sign, operators, or drivers must have in place processes to stay at or below this speed limit. These processes could be application of cruise control, manual speed control, a speedometer, or manipulation of a manual gear shift. How the result is achieved is irrelevant to conform to regulatory compliance, as long as processes produce desired results.

After data is collected, results are analyzed and assessed for operational compliance. If the majority of drivers violates the speed limit, does affect the system of how markings and signs are planned, developed and installed.

Non-confirming highway users are not charged, or made findings, under the system of planning, developing and installing markings and signs, but under the operational component of maximum speed limits. This could be compared to airport and airlines, where CARs 302.502, or 705.152 operational findings remains operational findings and do not convert to CARs 107.02 system findings.


Remote Management of a Safety Management System

A Safety Management System (SMS) may be managed from a remote location, by a Strategy Process Solutions (SPS). There are two components to a Remote Management System. One is the SMS, which is an onsite process verification how the job is done, while SPS is the strategy of planning and implementing design processes that conform to regulatory compliance and organizational objectives and goals.

Runway management is dependent on type of operations.

It is of vital importance to manage processes, both for regulatory compliance and safe operation, as a tool to evaluate how effective job-performance descriptions are.  During prior years without SMS the confidence level of how well processes were functioning was in all cases zero. There was no method, or tools available to assess how well the systems worked. There were no data collected to measure the confidence level of any processes, or give guidance of potential malfunctioning processes. It was assumed that it worked well as long as there were no accidents. However, after every major accident a lesson-learned statement was issued to explain the lack of known process effectiveness.

At an airport, runway inspections are conducted regularly throughout the day, depending on size and complexity of the airport. Managing these inspections are operational management and must be an onsite activity. Management of the processes itself is data collection and can be administered from a remote site. The processes include established timelines, a check list, runway items to be check and other critical safety conditions. This process would require all areas to be checked and reported as acceptable or non-acceptable, or with variances in between. Since there is a set timeline, or a goal for process to be executed, there is an open loop to be closed with the submission of report within a few

minutes after inspection is done. At the conclusion of submitting the report, there is data available to process for management for effectiveness of the Strategic Process System. Other options for runway inspection processes could be the use of drones, flying the approach checking for obstacles and flying the runway checking for Foreign Object Debris (FOD), or in the form of satellite sweeps of approach and runway.
SMS is an onsite process verification of how the job is done. 
Data and results of these inspections are irrelevant to the confidence level of how effective the inspection processes themselves are. If the goal is that a runway and approach is swept for obstacle and FOD status prior to every flight and the process is actually conducted prior to each flight, then the process is functioning within the expected confidence level. The processes of management of obstacles or FOD is an operational SMS process. Operational status of runways is an onsite management process, where data is collected establish the effectiveness of processes for safe flight operations. Data from onsite processes are applied to operational aviation Safety Management System of the runways.

Remote Management of a Safety Management System requires a remote Strategic Process System, combined with onsite aviation Safety Management System.

Friday, April 22, 2016

A Businesslike Approach To SMS

A businesslike approach to Safety Management System (SMS) is to establish a budget for incidents and accidents with established budget goals. SMS is believed to be a cost savings from accident prevention and promoted as having enormous cost savings benefits. Nothing could be farther from the facts. SMS is nothing else but another operational cost, just as any other operational costs. 

The cost effectiveness of SMS is not how many fewer accidents there are, but how cost of SMS is managed in a businesslike system. If an SMS system could predict future accidents, or lack of future accidents, operations of airport and airlines affected would have to cease operations during those hours or minutes when SMS had predicted accidents or incidents. 

For an enterprise to identify cost savings there must be one or more defined activities attached to that identification. A virtual, or future prediction of non-accidents are fantasy wishes. SMS is only as effective as collected data explains reliability of processes involved. That an airport, or airline with zero accidents and a good safety track record does not equal a prediction that future airport operation, or next flight would not encounter unexpected events and cause an accident. These unexpected events are variables, and becomes effective at the moment there is presence of kinetic energy. 

SMS is not a cost saving from accident prevention, but an operational cost to prevent incidents and accidents.
There is only one way to manage cost of SMS is to take a businesslike approach to safety. The first step to a businesslike approach is to define and apply a cost factor to operations of the Safety Management System and establish a weight to cost factors of undesired events. Budget cost factor is an applied weight to operational cost and are in all instances $ 1.00 per second of time spent on categories, events, hazards, incidents, or accident tasks. This is not the same as predict future events, but to make a cost factor applicable to non-desired budgeted events. Cost of safety is nothing else but an operational cost just as there is a cost to goods sold, or a cost to services provided.  

A successful business would not consider to operate without cash flow directives, goals and a budget. However, in SMS for aviation, the accepted concept is that the more cash an airport or airline spend on safety, the more they will save as a cost saving from accident prevention. 

When it comes to SMS in aviation, airports and airlines are operating in the blind without a budget applied to cost of safety. When the savings of safety becomes the cost savings from accident preventions there is no strategy business solutions, or businesslike approach of their SMS system.  

There is an operational cost to safety that cannot be avoided. This cost becomes a cost factor applied to time spent on accidents or incidents reports, analysis, investigations and corrective actions. An airline crash with multiple fatalities could have a cost of $ 31,536,000.00 while a smaller accident could have a cost of $3,600.00. That an airport or airline do not experience these accidents does equal cost savings from accident prevention, or a savings of millions. In other words, SMS is not a saving in the value of accidents that did not occur. 

Cost of safety businesslike approach in a pareto frequency chart. 
When applying safety, accidents and incidents to the equation, an enterprise does not apply the correct parameters. If any airport or airline are to budget for how many accidents they plan for this year, the answer is zero. By default, human nature does not wish to plan for accidents and the flying public do not accept accidents. When applying safety, or lack of accidents as goals, the process output becomes incorrect and root causes to accidents are concealed. 

The question to ask is what the cost of safety is worth for an airport or airline. When applying this businesslike strategy approach to safety it becomes possible to address processes that are not desirable and could cause unexpected events. 

The future cannot be predicted since there are millions of variables in a kinetic energy environment. The only time an airport or airline is guaranteed a safe future without accidents, is when there is no movement. When applying cost of safety in a cost factor budget to safety, it becomes possible to manage and reduce cost of safety to a desirable goal. When a cost factor budget is compared to actual operational cost, airports and airlines have established the bar to shoot for when setting cost factor goals for the next operating budget and apply this cost factor to accident and incident management. 


Monday, April 4, 2016

Selective Confidence Levels

An effective Safety Management System (SMS) is for personnel to know and understand how safe airlines and airport operations are. Knowledge and understanding is a product of in depth analysis of data, establishing and applying confidence levels to selective processes and to place each component of a system in relevance to desired outcome. Not all processes are equally safety critical for safe operations of airport or aircraft. However, all processes are regulatory critical to regulatory requirements for compliance. Any regulatory requirements are to conform, without deviations, to a 100% confidence level of regulatory requirements. Regulatory requirements do not differentiate on a scale of safe or unsafe, but differentiate only on a scale of compliance or non-compliance. The two impact levels of SMS are regulatory and operational. 

Regulatory compliance of a system is an authorization for operational processes.
In a regulatory system selective confidence levels are not acceptable, since complete regulatory requirements are fundamental to a valid operations certificate. When the regulations require a Safety Policy to be in place, or to have an Emergency Plan in place, these requirements have to be met for the issuance, or continuing compliance of an operations certificate. There are no sliding scales for regulatory requirements to be excluded based on bias, or personal opinions. In preparation for an audit, an enterprise has no options but to enter into an audit with a 100% confidence level of regulatory compliance. A regulatory impact level does not consider customer service, business competition or cost of compliance to regulatory critical requirements. This level only considers regulatory compliance. 

On the other hand, there are magnitudes of opportunities in the operational impact level of an SMS system to establish selective confidence levels for operational processes. An operational impact level considers customer satisfaction, as viewed by the customers, when applying selective confidence levels to safety critical processes. These processes are without beginning or end, but follows the travelling public through their path of life experiences. Simplified, this can be said that an airplane crash also affects the general public who did not book on that particular flight, or who were on anther flight, or at the time was without any travel plans. One single airplane crash, or hijacking affects the life, or lifestyle of everyone. 

A regulatory compliant design is affected by operational processes.
Without SMS in aviation, the confidence level of regulatory compliance and operational processes for safe operation of airport or aircraft are unknown. In a non-SMS organization, the confidence level is 100% certain to be completely unknown for performance of processes applied and if these processes are skewing towards safe or unsafe operations.  

Selective confidence level is to apply Safety Management System processes selectively to the impact of cost of safety for each process. Some processes require a 100% confidence level not to compromise aviation safety, while other processes, with lower safety impact, may be acceptable with a 95% confidence level for safe operations.   


Monday, March 21, 2016

Controlled Flight Into Terrain

Whenever an airworthy aircraft, with all mechanical, electrical, hydraulic, electronic, flight control and automation systems operating normally, wings level, or in a coordinated controlled bank and all crew members at their stations, but is at an altitude where the aircraft encounters ground level, it is called controlled flight into terrain. If all systems are operating normally and within set parameters, there is no possible opportunity for an airplane to crash. Any unscheduled event that leads to an airplane crash is the result of one or more system failures.

All systems are operational without elimination of any required for flight. 

Controlled Flight Into Terrain (CFIT) exists only in a virtual world of perfectionism. CFIT definition of airplane accidents is removing a system from total flight operational systems required to complete the flight, which is the Human Performance System.

As early as the late 50’s Human Performance System analysis were in a beginning stage and included in behavioral studies. Over the years since then, human behavior, or human factors developed into a science of management of the Human Performance System. This system does not only include the last link of events, but is viewed in a Safety Management System as organizational accountability of zero tolerance to compromise aviation safety. During the early days of aviation, human behavior, or Human Performance System, were often assigned to be the cause of accidents and defined as pilot error. Pilot error is not a system failure, but a procedure failure during a specific and last segment of the flight just prior to the crash. As data of accidents and unscheduled events were collected and analyzed over years, the industry realized that human job performance factors are manageable factors of a functional Human Performance System. By the 1990’s human factors in flight was widely accepted as system factors of a safe flight.

On November 28, 1979 a passenger jet crashed into a mountain and the cause was identified as Controlled Flight Into Terrain, since all known technical systems were operating normally. At some point during the flight an unplanned event happened and the airplane crashed.

Systems are often pushed to the limit.
On July 19, 1989 there was a system failure in a passenger jet, which again caused a complete flight control system malfunction. Pilots, or automation were unable to produce yaw, roll and pitch control for a safe flight. During the flight an unplanned event disabled required systems for a safe flight, except for the Human Performance System. Pilots and flight crew were in essence the only viable operational system available to continue the flight.

These two flights produced the end result of an airplane crash. The first one was identified as pilot error, or CFIT, while the second as a technical system failure. Both accidents have one common denominator, which is the Human Performance System. In one accident there was a system breakdown, while with the second accident human performance raised to the challenge in management of technical system failures and went above and beyond expected job performance. Human Performance System is as much as a requirement for a safe flight as operational technical systems. However, when Controlled Flight Into Terrain becomes the cause of accidents, Human Performance Systems are ignored as a requirement system for the completion of a safe flight.  


Sunday, March 6, 2016

Situational Awareness Are Emotions And Decisions

After severe accidents involving major air carriers, new technology and automation were developed and implemented into aircraft systems to make flying safer for the public. All these safety improvements to safety came at the ultimate price, but were justified for future safety improvement and for accidents never to happen again. 

Over years there have been midair collisions, controlled flights into terrain and airplanes on approach to occupied runways. Loss of situational awareness was assigned as root causes for several of these accidents. With loss of situational awareness as the determining point of failure, the solutions became to help pilots to always know where they were by installing more automated systems. Without a clear definition and collected data about loss of situational awareness, the cause of accident was assigned to pilot error as the last link in the chain of events leading up to these catastrophic accidents.  

Situational awareness is more than geographical location.
Situational awareness is more than just knowing where you are at point in space over the surface of the earth. Situational awareness is to understand where in the process the automated system is, it is to understand what is coming next in the process, it is to understand the effect of flight control inputs, including long-term effect, it is to understand power plants, it is to understand human factors, it is to understand the environment, it is to understand topography, it is to understand law of physics, it is to understand aircraft systems, it is to understand navigation aid inputs, it is to understand display outputs, including visual navigation, it is to understand positions as to point in space, it is to understand air traffic controller communication and intent, it is to understand outside visual clues, it is to understand airport environment and it is to overlay all these situational awareness clues in correct order onto visual cockpit displays and instrument communication, with a mental picture of what effect it will have on continuing the flight. In addition, when in visual meteorological conditions, or on a visual approach, situational awareness is to transfer this virtual information onto the visual view ahead. 

When there is an overload of information driving a vehicle, the driver can stop, rest, review and catch up. When there is an overload in an airplane the pilots are behind the airplane and the task becomes to move out of being behind by having situational awareness of what is current relevant information and then discharge all irrelevant information and clues.

The only available option to discharge all information and start over again is to initiate an overshoot, climb to an obstacle free altitude and level off. At that point, when the pilot has regained control of situational awareness, the pilot may request further clearances to proceed to destination. When data from loss of situational awareness reports are analyzed with defined root cause, then there are data and tools available to make changes to reduce, or eliminate loss of situational awareness in flight.  
Definition of situational awareness is a contributing factor. 
Situational awareness can be trained for and learned within a just culture of a safety management system where there is organizational accountability to incidents. When pilots are experiencing momentarily loss of situational awareness, it may not be reported due to fear of job performance punishment. Without incident reports there are no information available to justify that loss of situational ever occurred and therefore initiate awareness training, or operational corrective actions. Since it is not reported, loss of situational awareness is not analyzed as a regular occurrence but as an extremely remote operational risk and possibility. 

Training for situational awareness is more than learning what situational awareness is. It is to understand the emotions of loss of control when a pilot is behind the airplane, how to overcome these emotions, to make interpretations and decisions, do a quality assurance check of interpretations and to discard all non-required information. When it is determined that continuing the flight could cause harm, or that the short term outcome of continuing the flight is unknown, then the pilot must go to ground zero and start over again from that point. 

Training for situational awareness can be summarized as training to recognize emotions, training for analyzing data under stress, training of an ongoing operational quality assurance test, decision making training and training to implement corrective action. Restoring situational awareness training is not only for the pilot to be situational awareness confident, but also for co-pilot and all other flight crew members. 

Confirmation of situational awareness is the most critical step of training. In the process of navigation, a human mind has a tendency to manipulate the facts to match wishes and assumption. This is learned early on in flight training with the cross country training exercises.
A brand new student pilot navigating an aircraft for the first time with visual reference to the ground, following roads, rivers, lakes, towns, or dead reckoning by time and estimated distance, learns quickly that assumptions of situational awareness are not always facts. A lake on the ground may look identical to the lake on the map if the map is rotated, a valley in the mountains appears to be the valley to fly if the compass had been set correctly and the duration flown must be right because the timing that was off.  In hindsight, all these clues of not being on flight planned path make sense. However, at the time of emotional inputs, distress and refusal of accepting to be lost, all incorrect information seems right. In their own mind, the pilots had situational awareness at the time just prior to the accidents. There are many examples of loss of situational awareness, but one that stands out in history is Flight 571 in 1972. 

In an organization operating within a just culture and with an operational non-punitive incident reporting policy, there is a much greater chance that incidents are reported. These incidents then become available as a tool to analyze, track, categorize and address in training and operational management. In aviation, the hazard that is not known eventually becomes the unknown risk that will cause harm. 

Loss of situational awareness is when information of collected data is rejected and overpowered by emotional decisions. Automation and human factors are integrated functional areas adding to safer operations of flights. However, when automation become the default fail-safe recovery system, then human errors are transferred from pilots into the hands of automation analysts and software programmers. The most valuable resource available for recovery from errors and malfunctions, is human resilience and for pilots to collect data, analyze, take actions, bounce back and start over again.