Many aviation professionals remember Eastern Air Lines Flight 855, a Lockheed L-1011 that lost all three engines due to the omission of oil seals in the master chip detector assemblies. In today’s era of the safety management system (SMS), the May 5, 1983, accident still yields important lessons about the key safety role played by senior management.
The L-1011 was en route with 10 crewmembers and 162 passengers from Miami to Nassau, Bahamas, when the no. 2 engine’s low oil pressure warning light illuminated. The flight crew shut down the engine, and, due to worsening weather conditions at Nassau, the captain decided to return to Miami. On the way, the low oil pressure lights for no. 1 and no. 3 illuminated, and both engines subsequently flamed out. The airplane descended without power to about 4,000 ft, where the crew was able to restart no. 2. The airplane was landed at Miami with only that engine operating. No one was hurt, but the engines had been damaged because of the loss of lubrication.
The U.S. National Transportation Safety Board (NTSB) determined that the accident had resulted from “the failure of mechanics to follow the established and proper procedures for the installation of master chip detectors in the engine lubrication system, the repeated failure of supervisory personnel to require mechanics to comply strictly with the prescribed procedures and the failure of Eastern Air Lines management to assess adequately the significance of similar previous occurrences and to act effectively to institute corrective action.”1
As this accident demonstrates, decisions made by senior management have very important implications for a company’s safety performance. Senior aviation managers have the responsibility for embedding positive safety cultures in their organizations. This involves the provision of adequate resources and guidance in SMS implementation.
‘A Matter of Time’
The International Civil Aviation Organization (ICAO) says that senior management sometimes faces the dilemma of the two Ps, which arises “because of the perception that resources must be allocated on an either/or basis to what are believed to be conflicting goals: production (delivery of services) and protection (safety).”2
“In cases when such competition develops, protection is usually the loser, with organizations privileging production objectives,” ICAO said.
“Inevitably, such partial organizational decision making leads to catastrophe. It is simply a matter of time.”
“There has to be a conscious effort to ensure that objectives are not competing,” says Nancy Rockbrune, assistant director of safety and fatigue risk management systems at the International Air Transport Association (IATA), “For example, on-time performance should be pursued, [but] not at the cost of ground damage and/or employee injuries.”
It is ultimately senior management that must properly address the dilemma of the two Ps. Because it has the most decision making power in the distribution of organizational resources, senior management has an eminent role in providing adequate resources for safety management.
Among key resources are policies for effective risk assessment. Senior management should ensure that people are trained accordingly and that accountability/responsibility and authority are clear. Moreover, appropriate action must follow risk assessment.
The importance of well-executed risk assessment is illustrated by the Sept. 23, 1999, overrun at Bangkok, Thailand, by Qantas Flight 15, a Boeing 747-400. The runway was wet, but braking action had been reported as good, and the 747 crew elected to use the company’s preferred procedure of landing with flaps 25 and idle reverse thrust.
The Australian Transport Safety Bureau (ATSB) found that this procedure had not undergone proper risk assessment before it was introduced three years earlier to cut costs of brake and thrust reverser maintenance, and noise levies.3 Although the company emphasized that the previous standard procedure of using flaps 30 and full reverse thrust should still be used in certain conditions, such as for contaminated runways, it did not define what constitutes a “contaminated” runway or provide flight crews with associated procedures or training to evaluate the effects of runway conditions on aircraft landing performance.
Other factors, such as the captain’s cancellation of the first officer’s (the pilot flying’s) decision to go around, were involved in the accident, which substantially damaged the 747 but caused no serious injuries to the 410 people aboard. However, ATSB said that the overrun would not have occurred if the crew had used the flaps 30/full reverse thrust procedure.
Establishing an effective SMS involves a shift to performance-based safety management. This means that each organization manages safety according to its unique operations, safety performance and safety needs. There is no such thing as an “out of the box” SMS that works for every organization. Executives must create the appropriate environment for the capture of relevant safety information, the identification and analysis of risks, and the determination of mitigation actions.
Embedding a positive, or just, safety culture within the organization is key in the shift to performance-based safety management. People need to feel confident that they can report safety deficiencies without retribution and that due action will follow their reports.
The ideal safety culture is characterized by openness and demonstrated support. In its guidance for SMS development, Transport Canada said, “Senior management should be accessible and dedicated to making the changes necessary to enhance safety. They should be available to discuss emerging trends and safety issues identified through the system.”4
Moreover, a positive safety culture recognizes that “errors will be made and that it is not the apportionment of blame that will resolve the problems,” the U.K. Civil Aviation Authority (CAA) said.5
Management should create an environment that encourages open reporting, seeks to learn from its failures and is just in dealing with those involved. Punitive action must not automatically follow the open acknowledgement of human error. However, as the U.K. CAA noted, it must be made clear that indemnity will not be guaranteed if there has been gross negligence and willful disregard.
An SMS will work only if senior management sets the example and demonstrates its leadership in proactive and performance-based safety management. ICAO affirms that “the safety ethos of an organization is established from the outset by the extent to which senior management accepts accountability for safe operations and for dealing with emerging safety concerns.”
Similarly, Transport Canada recommends that senior management foster the SMS by “setting personal examples in day-to-day work to demonstrate unmistakably that the organization’s commitment to safety is real, and not merely lip service, by clearly and firmly discouraging any actions that could send a contrary message.”
Demonstrated leadership inevitably leads to the successful attainment of organizational safety goals. “Our company safety culture, like our business culture, comprises the same elements of strong leadership, the right structure and action focused clearly on core values and critical operating tasks,” said William O. McCabe, former director of DuPont Aviation. “When all members of the work force follow such leadership and truly feel this accountability from top to bottom, they integrate their efforts to achieve the safety goals.”6
As McCabe indicates, implementing an SMS is indeed a top-down process, with strong guidance provided by senior management. The first task is to write the company’s safety policy statement. Then, and most important, says Rockbrune, senior management must live up to it, ensuring that the safety policy is perceived as relevant throughout the organization.
According to Transport Canada, accountable executives must agree, approve, promote and periodically review the safety policy for continuing applicability. Senior management also has to communicate the safety policy to all employees and ensure that they are aware of their safety obligations.
Planning for Improvement
Another key to effective safety management is a safety improvement plan, which describes “how a company will achieve its corporate safety objectives and targets, and how it will meet any new or revised safety requirements, regulatory or otherwise,” the U.K. CAA said. “Significant items in the safety plan will normally be included in the corporate business plan. A safety plan … details the actions to be taken, by whom and in what time scale.”
With a mature and effective SMS, executives have a full understanding of their companies’ safety performance. “In a mature SMS, executives provide SMS guidance out of familiarity with safety KPIs. They are acutely aware of how their organization is performing with regards to safety and what needs to be done,” Rockbrune said.
Mario Pierobon, who worked in safety performance management at IATA, recently earned a master of science degree in air transport management at City University London. This article is based on a paper submitted in conjunction with his studies.
- NTSB Aircraft Accident Report AAR-84-04.
- ICAO. Safety Management Manual. Doc 9859 AN/474, 2nd Edition, 2009.
- ATSB Investigation Report 199904538.
- Transport Canada Advisory Circular 107-001. Guidance on Safety Management Systems Development. 2008.
- U.K. CAA Civil Aviation Publication 712. Safety Management Systems for Air Transport Operations. 2002.
- Flight Safety Foundation. “Unlocking the Potential of a Safety Management System.” Flight Safety Digest Volume 24 (November–December 2005).