It has been many years since safety management systems (SMS) began to be adopted by the commercial aviation industry. Today, most airlines that have effectively implemented an SMS are acutely aware of its benefits and have trouble picturing life without it. However, a different reality exists among other types of operators that are not required by regulations to have an SMS. While it is true that many of them may have successful SMS programs in place, a large number of aviation companies still operate without complying with even the most basic principles of an SMS, such as safety reporting.
Not having an SMS doesn’t mean that an operator is unsafe. Nevertheless, experience has shown that the system gives operators the chance to considerably enhance safety by uncovering important hazards and risks. Recent investigations by the U.S. National Transportation Safety Board (NTSB) demonstrated that many accidents in the past three years, including the crash of the Sikorsky S-76B that killed basketball star Kobe Bryant and eight other people, could have been averted had the operators better managed safety by means of an SMS. As a result of their findings, since last year, the NTSB has advocated the adoption of SMS by operations governed by U.S. Federal Aviation Regulations Part 135 and, more recently, has extended its recommendation to all revenue passenger-carrying operators in response to some high-profile accidents that involved aircraft operating under Part 91, such as the crash of a FlyNYON Airbus AS350 B2 in New York City’s East River, which killed five people.
There are myriad reasons why operators may decide not to pursue SMS. They may see no use in them, lack knowledge about them, lack support from aviation authorities, perceive them as an additional reason to possibly fail an inspection, or see them as excessively complicated. What these operators often fail to understand, however, is that behind an effective SMS, there is a strong safety culture, which, unlike an SMS, doesn’t have to abide by any set of rules or regulations. An operator that builds a robust safety culture is only a few steps from having a successful and effective SMS, the only gap to close being the recording of the company’s safety efforts under the four SMS pillars: policy and objectives, risk management, safety assurance and safety promotion.
Safety culture is about people. It’s about how a company — regardless of its size and number of aircraft — deals with its employees and their errors and violations. Any term that contains “culture” is not easy to define, as culture is something highly subjective and often intangible. However, a good strategy to facilitate its understanding is to break it down into four subcomponents, as suggested by psychologist James Reason: learning culture, flexible culture, reporting culture and just culture.
Safety and learning go hand in hand. The point of investigating mishaps is to ensure that they don’t happen again, and the only way of achieving this is by learning. Failing to learn is likely to generate negative consequences, as demonstrated by the space shuttle Challenger disaster in 1986. Seventy-three seconds into the flight, the U.S. National Aeronautics and Space Administration (NASA) shuttle disintegrated after a joint in its right solid rocket booster (SRB) failed at liftoff, killing all seven crewmembers. Contributing to the accident was the failure of O-ring seals used in the joint, which were not designed to handle the unusually cold conditions that existed at the launch. According to the investigation report, NASA managers had known since 1977 that the design of the SRBs contained a potentially catastrophic flaw in the O-rings, but they had failed to address this problem properly. The managers also disregarded warnings from engineers about the dangers that the low temperatures forecast for the morning of the accident could pose to the launch, and failed to adequately report these concerns to their superiors.
As stated by systems scientist Peter Senge, “Learning disabilities are tragic in children, but they are fatal in organizations.” Learning leads to information gathering, and an informed organization knows where to better allocate its precious resources to ensure that hazards are duly contained and risks mitigated.
According to Reason, flexible culture is an organization’s ability to rearrange itself hierarchically to cope with a challenging situation. While managers may know how to lead, a potential lack of expertise may render them clueless as to how to manage certain critical scenarios. Therefore, a flexible hierarchy allows experts to temporarily take the lead and dictate the best course of action. A prime example of such organizational behavior is what happened in most countries when COVID-19 appeared. Since most national leaders didn’t have the knowledge to respond adequately to the emerging health crisis, the decision-making powers were partially transferred to ministers of health or heads of disease centers as they were the ones with expertise in handling matters of that nature. A similar dynamic can be observed in helicopter search and rescue operations. While the pilot-in-command (PIC) is ultimately responsible for the safe conduct of the aircraft, during a rescue, he or she is expected to delegate part of that responsibility to the observer or hoist operator. This happens because the pilot’s downward visibility is usually obstructed by the airframe, so the PIC has to maneuver the aircraft according to the instructions provided by the observer or hoist operator to ensure that it remains at a safe distance from obstacles and is correctly positioned over a victim.
A reporting culture is the most fundamental pillar of an SMS, since an organization is not able to mitigate its risks if it doesn’t know what or where the risks are. Safety reporting is not the only way to identify risks — there are also flight data monitoring; audits, including line operations safety audits; event investigations, etc. However, safety reports are by far the most effective and proactive method of identifying risks, as they serve as a means for frontline workers and other staff members to expose safety concerns or conditions that could potentially contribute to an accident.
Safety reporting should not be restricted to negative events and conditions such as hazards and close calls but also should be a way to identify resilient behavior and allow the organization to learn from things that went well. For example, if a pilot finds himself or herself in a tricky situation, such as an inadvertent encounter with instrument meteorological conditions, but is able to make it out alive, it is obvious that the organization may — and should — want to know what went wrong in the first place for the pilot to end up in such a bad position. Nevertheless, it is equally important that the organization learns what allowed the crewmember to survive and save the aircraft. Was it sheer luck or perhaps the upset recovery and prevention training that company pilots are required to undergo every two years? If evidence points toward the latter, why not make it an annual training session? What aspects of the training were most useful to the event pilot? Could this information be given to the training provider so the syllabus could be improved? Avionics-wise, did the synthetic vision feature help the pilot steer clear of terrain while in the clouds? If so, why not allocate a budget to enable such a feature in other company aircraft?
A good reporting culture must be heavily supported by a just culture, in which people feel comfortable reporting their own errors and mistakes without fear of reprisal. Author Sidney Dekker defines it as “a culture that allows the boss to hear bad news” and in which human fallibility is embraced as an argument to design better systems and give people better tools to work with. No one goes to work wanting to suffer or cause an accident — human performance is a product of the system in which the individual is required to work, Reason says.
In a just culture, the understanding of why mishaps occur begins with trying to make sense of the decisions and actions of the people involved. People don’t make decisions in a vacuum. Multiple factors, like background, cues from the environment and external pressures, determine the course of action adopted by an individual and compose what many authors refer to as “local rationality.” This means that people act in ways that make sense to them in response to the information they have at a given time. Therefore, the key to understanding accidents is comprehending why, in the eyes of those involved in an unwanted event, it seemed reasonable to act in they way they did. Adopting such a perspective is of utmost importance for the simple fact that what made sense to one may very well make sense to others and lead to new accidents.
Operators that would like to establish a good reporting culture should first reflect upon the way they currently deal with errors and violations at their organizations. If blame and punishment are often used in response, operators should question themselves about what kind of safety benefits such an approach has truly brought. If safety indicators have in fact showed some improvement, has that been because the operator has successfully punished human error away, or has it been because people have stopped reporting their slips and lapses due to a fear of repercussions?
While violations deserve slightly different treatment than errors, they may equally be surrounded by systemic issues. People violate for many reasons, and rarely is it for their own benefit or thrill. Most types of violations stem from a wish to get the job done in an environment constrained by rules that prevent workers from achieving the production goals set by the organization itself. The Danish author Erik Hollnagel calls this the efficiency-thoroughness trade-off principle, meaning that workers often find themselves in a position where they have to decide whether they want to accomplish an assigned task on time or to follow the rules. The key to preventing violations is to bring the individuals who make the rules closer to the ones who are expected to follow them. Or better, to present to workers the goals that must be met — both in terms of productivity and safety — and allow them to write the rules. Why not? After all, they are in the best position to say what is feasible or not and, most times, what is safe or not.
When handling violations, the same logic must be applied. Determining whether a violation is blameworthy must be a task carried out by an impartial group of individuals who truly understand — and ideally have lived — the difficulties and details of the job performed by the person under scrutiny. That is the only way a fair and just judgment may be conducted.
Building the four cultures (or subcomponents) that comprise a safety culture paves the way to the implementation of a successful SMS, which not only is in tune with what regulatory agencies expect from operators but also generates real and tangible gains in operational safety. The secret, in summary, is to acknowledge human error as something inherent to the human being and to understand it as a result of systemic deficiencies, to recognize the importance of learning not only from negative past events but also from successful recoveries, and, finally, to make frontline workers part of the rulemaking process. Once this is accomplished, complying with the SMS regulatory requirements will become a mere task of putting everything down on paper and computer spreadsheets.
Lucca Carrasco Filippo is a former commercial helicopter pilot currently working as a flight safety analyst at a large European business aviation company. He holds a degree in aeronautical sciences and multiple qualifications in safety management systems, human factors and incident investigation.