Article by Lloyd Watson published in New law Journal 16.09.19

During my tenures both as an Airline Operations Director and a Director in a major Oil & Gas company - accountable for the aviation safety and assurance of a global operation - success in my view was making sure that every employee using aviation through the business went home safely to their families. In order to achieve this, we had to drive the highest risk management standards possible.

A Safety Management System (SMS) saves lives and prevents injuries. It provides a systematic way to identify hazards, control risks and assure that the risk controls are effective. The reactive, proactive and predictive management of hazards is essential. To be a credible aviation expert it is, in my view, necessary to be able to demonstrate mastery of this elusive subject.

An effective SMS should:

1. Define how the organisation is set up to manage risk.
2. Identify the risks inherent in aviation, the risks associated with a particular operation and implement suitable controls.
3. Implement effective communications across all levels of the organisation.
4. Implement a process to identify and correct non-conformities.
5. Implement a continual improvement process.

The terms hazards and risks appear interchangeable, but it is important to understand the difference. The identified hazard is something we want to prevent. The risk is a measure of likelihood and consequence and drives where we place our resources. If we measure a risk as high, the likelihood is that people will get hurt and we therefore need barriers (procedures, processes) to prevent the hazard. We also need to accept that the hazard may happen and additional barriers are needed to reduce the consequence.

For example, an oxygen mask in an aircraft will not prevent sudden decompression at 35,000 feet, but it will keep you alive whilst the aircraft descends. Sudden decompression is a hazard and there are barriers in place to ensure it doesn’t happen, but the real hazard to passengers is loss of life through lack of oxygen.

The critical components listed above are vital. Take point 2 for example:

In July 2014 the airspace over Eastern Ukraine was closed to passenger transport aircraft up to 32,000 feet. Above this the airspace was open, there was not considered to be a credible threat to high flying aircraft. Clearly, a hazard to be considered when flying over an area where conflict is occurring is of becoming a victim of that conflict. MH17 was shot down on the on 17 July 2014 while flying over Eastern Ukraine, killing all on board. This disaster could not have occurred to British Airways or Quantas - to name a couple - as these companies had considered the risk and decided it required proactive management. The barrier implemented was to avoid the area and incur the higher cost associated with rerouting.

In my view the weakest area but in some ways the most important, is number 5. Generating the hazards and implementing the barriers / controls is partly subjective and a consequence of subjectivity is that your management of safety will be incomplete. It will also have procedures, processes or ways of working that are either ineffective or partially ineffective in preventing the hazard.

Take a simple example:

Engines have cowls which open to allow access and it is necessary that these are closed before take-off. Google ‘lost engine cowls’ and you will find dozens of examples detailing the subsequent loss of engine power, engine fire and in one case the entire engine coming off. There are numerous barriers to prevent this - typically making an entry into a technical log, pilot conducting a walk round and ground staff doing a final security check on push back. Yet, this happens again and again. If point 5 was truly considered there would be additional barriers less reliant on the human, such as a warning in the cockpit or an interlock to prevent engine start or a physical device that makes it obvious that the cowls are not locked together. What tends to happen is, we apportion blame to the humans concerned, re-train and move on.

With respect to ‘aviation experts’, in my role both as an expert and as Managing Director of GMR Aviation Consulting, I have noticed that it is a common request for the potentially instructed expert - be they pilot or engineer - to be type rated on a certain aircraft variant. Whilst I agree this can be vital, it is also in my view inadequate unless the expert also has the necessary depth and expertise in SMS and root cause analysis. Without this depth in SMS and an ability to get to the root cause, what you get is the defence or blame of the human factor - such as in the example above - as opposed to truly understanding the systemic nature of aviation. In my experience the root cause(s) of an incident or accident is rarely just the pilot, engineer or Air Traffic Controller but often goes deeper and is buried under multiple aspects such as organisation, supervision, training and operational procedures.

In summary we will doubtless continue to see numerous aviation incidents. These incidents should be viewed as warning signs. A great hazard management system makes good use of these warning signs, thereby reducing the frequency of incidents. Fail to see the signs and one day the incident becomes serious and then one day disastrous.