Thursday, August 24, 2017

Safety Critical Areas and Safety Critical Functions

In the production of aircraft parts there are parts and systems that are more important to maintain safety than other systems. Not all systems are equal important for the safe operations of an aircraft and these systems are the safety critical areas. Within these systems there are parts with identified functions that have a higher probability of causing a catastrophic outcome of the flight when malfunctioning.

Safety critical tools are vital to safety performance.
As with parts, within flight operations there are operational systems that are safety critical areas for the safety of a flight. Within these areas there are safety critical functions, or processes, that are safety critical to operations. Not all flight operational systems and processes are critical for the safety of a flight. In an SMS world, the tasks become to identify what are the vital few safety critical areas and functions of flight operations and what are the trivial many areas and functions.

It is commonly said, accepted in the aviation industry and demanded by the public that regulatory requirements are the minimum requirements for the safe operations of an aircraft. Nothing is farther from the facts than this statement since regulatory compliant pilots, aircraft and operators have since the first flight of 1903 experienced catastrophic accidents. If regulatory requirements were minim safety requirements there would be no accidents. Regulations are the risk level accepted by a Governing State for a Certificate to be issued to an operator with an expectation that catastrophe accidents could happen within undefined intervals. The intent, or design of regulations is not to set up for failure, or accidents, but regulatory compliance itself does not prevent accidents. Regulatory compliance is the authority for an Operator to provide a service to the flying public. However, there is one exemption to this: Where a Safety Management System is regulatory required the accountability and responsibility for safety is placed on the Operator. For an Operator, it is not acceptable to operate within a culture that accepts a catastrophic accident at any intervals, or operate with a risk level that accepts accidents. “We don’t manage Risks; we lead personnel, manage equipment and validate operational design for improved performance above the safety risk level bar.”

The flying public does not accept that safety critical is identified at the onset.
Safety critical areas and safety critical functions are the safety risk level bar which must be exceeded for continuous safety improvements in operations. The demanding task becomes to define and decide on what systems are safety critical, what processes are safety critical functions and what is not safety critical in operations. The purpose of defining safety crucial areas and functions is to operate an SMS that is compatible with safety and not a bureaucratic system for the purpose of supporting the SMS design. If what we do does not promote safety or improve safety, we are just spinning our wheels and reactive processes becomes the determining factor for safety improvements. A proactive safety management system is to define safety critical areas and functions.

Safety Critical Factors in aviation are Human Factors, Organizational Factors, Supervision Factors and Environmental Factors. Derived from these Safety Critical Factors are SMS processes as tools for continuous safety improvements. Data collected are analyzed in a Statistical Process Control software, SPC for Excel ( and analyzed in Pareto charts, Attribute control charts or Variable control charts. If an Operator has not collected enough data to analyze processes it is possible to “borrow” data and analyze as applicable to the Operator. These tools are for each Operator to define within their Enterprise what are Safety Critical Areas and Safety Critical Functions and analyze data collected for applications to implement safety changes. Unless SMS is transformed into action it is nothing else but a check-box tool in support of defined processes.


Thursday, August 10, 2017

SMS And Captain’s Authority

There are several accident reports of Captains making one single decision which is leading to a fatal accident. The first officer of other flight crew members may have attempted to communicate with the Captain but without luck. Often investigations would assume that if another flight crew member would have interfered with the Captain’s duties the accident would have been avoided. When sitting at an office desk with 20/20 hindsight, these accidents could have been averted, but at the time and location of event the Captain and first officer were not performing anything else but what they were trained for.

Training is more than the official training where check-boxes are filled in. Training also includes normal operations or organizational expectations of priorities and unwritten rules. Air Florida 90 departing Washington National Airport VA, United 173 on approach to Portland OR, Air Ontario 1363 departing Dryden ON, Uruguayan Air Force 571 in the Andes Mountains and KLM 4805 departing Los Rodeos Airport are all examples of Captain’s decision as the final link of an accident. When a Captain is about to make a fatal decision a lower ranking flight crew member may view this as a responsibility under a Safety Management System program to make safety decisions and interfere with the Captains’ duties, or physically take control of the aircraft.

Major accidents have generated great safety improvements.
The Captain of an aircraft is a person who is acting as the pilot-in-command and having responsibility and authority for the operation and safety of the aircraft during flight time. Flight time is the time from the moment an aircraft first moves under its own power for the purpose of taking off until the moment it comes to rest at the end of the flight.

A Safety Management System does not override this regulatory requirement. The purpose of the Safety Management System is to operate with an additional layer of safety and improve safety by continuous or continual improvements. Continuous improvement is to make changes to the current processes for improvement, while continual improvement is achieved by identifying process capability and making changes to the capability of operations, or processes to produce a more desired outcome. The beauty of an SMS is that the Safety Management System contains a process for ensuring that personnel are trained and competent to perform their duties and that they are accountable to safety. The Captain must always be trained to be competent to make final decisions and perform duties as the final authority. This authority can not be removed from the Captain. Accountability within an SMS-world is for a person, without supervision, to comply with regulatory requirements, standards, policies, recommendations, job descriptions, expectations or intent of job performance and for personnel to be actively and independently involved. Derived from accountability comes a Just Culture, which is an organizational culture where there is Trust, Learning, Accountability and Information Sharing.

When an Enterprise expects a lower ranking crew member to interfere with the Captain’s duties, based on this person’s opinion, the Enterprise has neither trained the Captains nor other flight crew members to perform their duties. The Captain’s duties are the authority for the operation and safety of the aircraft, which includes analyzing any information available for decision making. The Captain is the ultimate authority for the safe operations of an aircraft and interfering with this authority is a regulatory non-compliance activity. Any air operator should have a training program in place where the lower ranking flight crew members has an opportunity to volunteer safety information to the Captain at any time during flight time without the authority to take operational control of the aircraft. When an Enterprise is widely accepting that a lower ranking officer has the authority to interfere with the Captain’s duties there is no opportunity for safety improvements since the Enterprise is relying on the non-captain to make decisions.

Major Accidents Generates Safety Improvements

After the Air Florida 90 departing Washington National Airport VA airlines began enacting policies to ensure that at least one and more seasoned crew member was on board planes at all times. They
Major accidents have generated great safety improvements.
also began reappraising the traditional unwritten rule that the captain could not be questioned. From that point onward, first officers were encouraged to speak up if they believed a captain was making a mistake. Applying this concept is SMS in an undocumented format, where the Captain has access to information from flight crew members to make the best decision for safe operations.
After the United 173 on approach to Portland OR training addressed behavioral management challenges such as poor crew coordination, loss of situational awareness, and judgment errors frequently observed in aviation accidents. Applying this concept is SMS in an undocumented format and accepts that human behaviours or human factors play a role in safety.
After the Air Ontario 1363 departing Dryden ON many significant changes were made to the Canadian Aviation Regulations. These included new procedures regarding re-fuelling and de-icing as well as many new regulations intended to improve the general safety of all future flights in Canada. Applying this concept is SMS in an undocumented format in that proactive measurements are implemented for continuous safety improvements.
After the KLM 4805 departing Los Rodeos Airport accident changes were made to international airline regulations and to aircraft. Aviation authorities around the world introduced requirements for standard phrases and a greater emphasis on English as a common working language.
Cockpit procedures were also changed. Hierarchical relations among crew members were played down. More emphasis was placed on team decision-making by mutual agreement, part of what has become known in the industry as crew resource management. Applying this concept is SMS in an undocumented format where an Enterprise accepts that not only knowledge, but also comprehension of data is vital to safety.
After the Uruguayan Air Force 571 in the Andes Mountains there were no major safety
Remember rules or comprehend safety.
improvements implemented. However, this is also to apply the concept of SMS where the risk level, based on data, is accepted or rejected. In this case the risk level for this type of accident to happen again was accepted and no major changes to safety were implemented. As knowledge and comprehension were gained, human factors later became a safety component which had been overlooked in 1972.

SMS is that aviation safety has no end. SMS is that current safety comprehension level may be different in a few years and that other latent hazards are discovered. SMS is continuous or continual improvements where every day is a new challenge to ensure complete safety for the traveling public.