13 APR 2009 _______________________________________ *Emirates A340 Takeoff Rated 'A Near Disaster' *Report: Delta Flight's Hijacking Alert Scrambles Israeli Jets *Old emergency beacons go dead *Jackson Hole Airport to close next month for runway work *Safety Management Systems for Business Aviation *Southwest flight makes emergency landing *Gearbox failure caused North Sea helicopter crash *EASA requires A300, A310 co-pilot seat deactivation *************************************** Emirates A340 Takeoff Rated 'A Near Disaster' Heavily Loaded Airliner Barely Got Off The Ground An Emirates Airlines flight departing Melbourne's International Airport for Dubai last month came close to tragedy, authorities revealed Saturday. Investigators upgraded the classification of what happened from an "incident" to an "accident." Preliminary investigation details published by The Melbourne Herald Sun said that on March 20, a heavily laden Airbus A340-500 (type shown above) operating as Emirates Flight EK407 barely made it off the ground. The plane carried a load of 225 passengers and about 350,000 pounds of jet fuel. The A340 pilots apparently used all 11,500 feet of the runway before rotating at an estimated 175 mph. The plane's tail scraped the runway due to excessive upward pitch, producing a shower of sparks and smoke in the cabin. The plane staggered into the air, wiping out a 70 cm tall (2 foot, 3.5 inch) strobe light that was 170 meters (557 feet) off the end of the runway, and barely cleared a 2.5 meter (8 foot) perimeter fence half a kilometer (1640 feet) from the runway's end. The report added the airliner took out an antenna and narrowly missed a small building before eventually gaining more altitude. It then flew over Port Phillip Bay and dumped some of its fuel load, before returning to land at the airport over a half hour later. Neville Blyth, a senior transportation safety investigator with the Australian Transport Safety Bureau, said the aircraft suffered heavy damage in the accident. "It can't be flown again without repairs," he said. The ATSB has released the plane to Emirates, but it remains in a cargo hold at Melbourne Airport. Blythe added, "It's a serious investigation. There are a fair bit of resources being put into this one." ATSB investigators have already examined the aircraft's flight data recorders and interviewed the crew. The pilots have since resigned. Australian aviation expert Dick Smith said, "It's the closest thing to a major aviation accident in Australia for years. The people (passengers) are incredibly lucky, it was an overrun where the plane didn't get airborne." Despite the close call, no injuries were reported. An Emirates spokesman said, "The report from the ATSB has not yet been finalized, and as such it would be inappropriate for Emirates to make any comment at this point in time." FMI: www.emirates.com, www.atsb.gov.au aero-news.net *************** Report: Delta Flight's Hijacking Alert Scrambles Israeli Jets False Alarm Activated By Mistake... Or Equipment Failure? A Delta Air Lines Flight enroute from New York to Tel Aviv received an unexpected jet fighter escort Saturday. The Associated Press said Israeli fighters were scrambled after air traffic controllers detected a hijacking alert the pilots of the airliner had activated by mistake. The Delta pilots were unable to communicate directly with controllers due to a technical problem, further raising ATC's concern over the well-being of the flight. Israeli Transportation Ministry spokesman Dani Shenar said that two jet fighters were dispatched, and escorted the plane carrying over 100 passengers to a safe landing at Tel Aviv's Ben Gurion airport. Details of the exact circumstances of the situation were sketchy at press time. Early reports seemingly indicated the pilots may have squawked the wrong transponder code -- 7500 is hijacking, 7600 is lost comm. However, at least one Israeli media outlet pointed a finger at a breakdown in the new "Code Positive" security system, now in testing, which requires airliners bound for Israel to establish secure communications before entering Israeli airspace. "On Saturday one of this system's many potential failings was seen," Boaz Hativa, chairmain of Israel's National Pilot Association, told Haaretz. The Israeli Transportation Ministry is investigating. FMI: www.delta.com, www.mot.gov.il/wps/portal/HOME aero-news.net **************** Old emergency beacons go dead Not everyone has newer ELT device Starting in February, flying in Alaska potentially got a lot riskier for some people. Certainly it did for those unfortunate enough to be in an accident with an aircraft without an emergency locator transmitter that broadcasts on the 406 megahertz frequency. An ELT is a small battery-operated device that mounts in an aircraft and is turned on either manually or by impact forces. When on, it sends a signal to a network of satellites that processes the signal and routes it to the appropriate rescue coordination center. The 406 MHz ELT is the new generation. The old-style ELT, which broadcast on121.5 MHz, is no longer being received by search and rescue satellites. These are the satellites that have been so successful in getting help fast to those in need. Now, the only 121.5 MHz receivers are those in a few FAA facilities and other select receivers in some aircraft that could be used in a search. Given weather extremes, the vastness of Alaska and the very limited range of the 121.5 MHz ELTs, being found quickly with the old-style ELT or being found at all is really more like rolling dice. It’s a crap shoot, possibly with your loved ones or your survival at stake. Unfortunately, it appears that a large percentage of aircraft flying in Alaska today are not equipped with the 406 MHz beacons. How did this happen? During the past decade, the decision was made worldwide to stop listening to the 121.5 MHz ELTs because of their high false alarm rate and other factors, such as frequency congestion. The 406 MHz ELT was a much better choice because of its ability to immediately send digital GPS signals with a unique, aircraft-specific identifier to search and rescue satellites. These satellites can tell rescuers very precisely where a 406 MHz beacon is transmitting from, right now. The older analog ELTs required several satellite passes to resolve the position of the accident site, potentially taking hours to get a resolved position, and that position was not nearly so accurate. The international search and rescue community decided the 406 MHz was obviously far superior, and, in 2000, the date to unplug the old 121.5 MHz satellite receivers was set: Feb. 1, 2009. However, there was no legislation to mandate a change in the United States. So if you fly in Alaska, or anywhere in the United States, even with a commercial air taxi operator, you have no guarantee that the aircraft is equipped with a 406 MHz ELT. Last month, there were two air taxi accidents near Nome and Kotzebue in bad weather. Neither airplane had a 406 MHz ELT, only the 121.5 MHz. Fortunately, both were fairly close to airports, and only one required rescue (although that rescue might have been expedited by a 406 MHz ELT). In 1972, Alaska’s U.S. Rep. Nick Begich, House Majority Leader Hale Boggs and two others were lost in an airplane crash and have never been found. That airplane did not have an ELT and was not required to, although they were readily available at the time. An aircraft flying today without the 406 MHz ELT is in the same situation. In 1993 and again in 2007, my agency, the National Transportation Safety Board, made recommendations seeking mandatory adoption of the 406MHz ELT. We are not a regulatory agency, however, and only can make recommendations. To date, those recommendations have not been mandated. Even though some commercial operators have elected to purchase the newer ELTs, no one is keeping a tally, and there’s no way to tell without asking. Also, some of Alaska’s commercial operators are using a satellite–based flight following system — which is an excellent addition to, but not a replacement for, a 406 MHz ELT. When air safety investigators at the Alaska Region of the NTSB need to fly to an accident site, we ask the operator if their fleet has the 406 MHz ELT. Even though we recognize that aircraft accidents are fairly rare, we want to do all that we can to ensure we are flying with a safety conscious organization. We have seen far too many serious accidents not to realize how critical a timely rescue can be. Perhaps you, too, will want to know before you take that next sight-seeing tour with a friend, place your family member aboard that chartered aircraft for a hunting or fishing expedition or put the village basketball team on a flight to the next village. Ask what kind of ELT is aboard — just to be on the safe side. Jim La Belle of Anchorage is chief of the Alaska Region of the National Transportation Safety Board. http://newsminer.com/news/2009/apr/12/old-emergency-beacons-go-dead/?opinion ************** Jackson Hole Airport to close next month for runway work JACKSON, Wyo. (AP) — Officials plan to close the Jackson Hole Airport for about four days starting next month to perform work on the runway. The airport is scheduled to close starting at 5 p.m. Memorial Day, May 25, for runway rehabilitation. Airport manager Ray Bishop said contractors think they can complete the work in about four days. The airport will reopen sometime between May 30 and June 2, depending on fast the work can be completed. U.S. Secretary of Transportation Ray LaHood announced this week the Federal Aviation Administration will provide $5 million to rehabilitate the runway. The planned closure sparked criticism from Maj. Gen. Ed Wright, head of the Wyoming National Guard. Wright wrote to airport officials that 54 National Guard generals and their staffs are scheduled to meet in Jackson for a conference from June 1-5. "I was more than surprised this week to hear thirdhand that the airport is proposing to close at exactly the time the majority of our attendees are scheduled to arrive," Wright wrote to airport board chairman Jerry Blann. Bishop said about 450 passengers had been scheduled to fly into Jackson during the closure. Bishop said airlines have agreed not to charge a fee to passengers who wish to change their flights to either Idaho Falls or Salt Lake City while the Jackson airport is closed. Airlines that would normally fly into Jackson during the closure also fly into Idaho Falls. Bishop said the Jackson airport is considering running a shuttle service from Idaho Falls during the closure. The repairs are necessary before big planes begin landing at the airport this summer. "The runway needs to get resurfaced," Bishop said. Wright, in his letter to Blann, stated that he hoped the airport staff simply failed to contact the local chamber of commerce or major area resorts to determine what events were scheduled at that time. "I certainly don't believe they would purposely single out a military event at a time when our nation is at war and Wyoming is deploying the greatest number of guardsmen in our state's history," Wright wrote. He said that many of the generals have tight schedules. Blann defended the closure. He said it would be too cold to resurface the runway any earlier. And he said big jets start flying into the airport only a few days after the tentative completion date. "We're jammed in on either side," Blann said. "We're tying to execute this in the most expeditious manner that we can while inconveniencing as few people as possible." http://www.usatoday.com/travel/news/2009-04-10-jackson-hole-airport-closure_ N.htm *************** Safety Management Systems for Business Aviation When you're engaged in an activity as mundane as crossing a busy street, you're subtly exercising risk management. So says NTSB member and former vice-chairman Robert Sumwalt, whose career has embraced both airline flying (he's an ex-USAir captain) and business aviation flight department management, as well as university instruction and many years of aviation safety activism. As you stand at the curb preparing to cross, you're unconsciously exercising all the precautions your mother taught you long ago: Obey the traffic signals, but for insurance, look both ways to make sure no vehicles will be bearing down on you when you step off the curb. Make sure you have sufficient time to make the crossing on foot. Don't walk against the signals or between parked cars. So essentially, you're gathering data, making an analysis of the situation and governing your behavior accordingly in order to avoid getting flattened by an 8,000-pound SUV driven by a self-anointed Master of the Universe frantically directing margin calls on his cell phone. You've done all this according to a set of behavioral standards and best practices set by your parents and reinforced by your educators. Nevertheless, in the middle of the crosswalk, you barely survive a near miss by that SUV as its distracted driver runs the light and, consequently, you tell yourself you'll be more observant next time - effectively reporting your experience back to the memory chip inside your head. And you also take in the admonition of your spouse to "be more careful at that crazy crossing." So you've just (a) fed experience back into your database for further consideration and (b) received an outside audit of your performance. All of these actions, as we'll see, form the basis of a safety management system, or SMS, which is simply a formalized and documented approach to risk management. SMSes are in the news these days since ICAO ruled that they be required for commercial operators and voluntarily adopted by noncommercial operators of turbine-powered and heavy aircraft, e.g., business aviation flight departments of ICAO signatory states. In the United States, the NTSB has taken up the SMS campaign by recommending adoption of SMSes in the conclusions of its investigations of two fatal accidents, one airline and the other business aviation (see sidebar). And as Sumwalt, whom we'll hear from later, points out, in concurrence with ICAO, the Safety Board has also recommended to the FAA that SMSes be mandatory for commercial operators. And even though the FAA is not duty-bound to adopt the NTSB's recommendations, according to Don Arendt, manager of the Flight Standards SMS Program Office at FAA headquarters, the agency is "considering" rulemaking that would require operations for hire to maintain and adhere to SMSes. (Also, as an ICAO signatory, the United States is now obligated to require them for airlines and charter operators.) "But we are not considering it for [FAR] Part 91 operators, although I figure we may include Subpart K, or fractional operators," Arendt told Business & Commercial Aviation. "A certificate isn't required for Part 91," Arendt elaborated, "so at this time, there's no regulatory hook to hang it on. We do encourage Part 91 operators to adopt SMSes on a voluntary basis, as we think it's a good idea and offer mentoring and assistance to any operator within the scope of our resources, but right now there is no current management intent to require SMSes for Part 91." But other sources consulted by Business & Commercial Aviation believe that it's only a matter of time before SMSes are declared mandatory for Part 91 operators of jet and turboprop aircraft. They base this assumption on ICAO's strong support of safety management for operators of these sophisticated aircraft, the fact that Canada has not only made commercial-like certification of flight departments the law but has built the approval program around adoption and use of an SMS including periodic auditing, and an initiative of the European Aviation Safety Agency (EASA) to require, as of Jan. 1 this year, SMSes for commercial operators fielding "complex motor-powered aircraft," e.g., turboprops and jets. So it's clear a trend toward mandatory SMSes for all classes of heavy jet operators is gathering steam worldwide. Mandatory for Part 91? Dick Van Gemert, former aviation manager for Xerox Corp. and one of the facilitators of the post-World War II era of business aviation proliferation, subscribes to this point of view. "In Canada," he told Business & Commercial Aviation, "SMSes are coming over the fence from commercial operations, and I expect that this will occur here, since Nick Sabatini [former FAA associate administrator for safety], before he retired from FAA headquarters, was focused on implementing SMS and ASAP [Aviation Safety Action Program] under a concept of ýýýone level of safety.' If I get on a Part 25 airplane, the level of safety should be the same whether it's a Part 135 operation or a Part 91 operation. This isn't new, but it's been gaining weight lately. Watch what Europe and Canada are doing. The Euros are way down the street from us on this, as well." Steve Witowski, aviation safety program manager at Aviation Research Group/U.S. (ARG/US) in Cincinnati, agreed. "The international folks are going to do it for large aircraft," he observed. "I assume that at one point worldwide it's going to be consistent, and the FAA has been far slower in terms of implementation than the rest of the aviation world. The fact is that other regulatory authorities like EASA are requiring it, so I'm seeing it as a possibility that the FAA will eventually do the same." The focus on safety management owes its origins to the early years of the decade when ICAO began work on an amendment to update Annex 6, Part 2, the rules for international general aviation operations. Essentially, the Part 2 regs had not been meaningfully changed since the early 1960s, and as Canadian Ray Rohr told Business & Commercial Aviation, they were "horribly out of date." A retired top manager at Transport Canada (he was in charge of aviation oversight for the entire Eastern provinces), Rohr in his second career at the International Business Aviation Council (IBAC) conceived and managed development of the International Standard for Business Aircraft Operation, or IS-BAO, and currently holds down the position of regulatory affairs director at the Council. As Rohr reminisced, around the same time as the Annex 6, Part 2 overhaul, ICAO convened a Director General's Civil Aviation Conference where the U.N. agency indicated that SMSes would be required for air operations, maintenance, ATC and airports. "The logic is that aviation was getting larger and more involved and needed guidance for risk management since operator exposure was increasing," Rohr said. "You can approach it with prescriptive rules or performance-based rules, including SMSes, where the assumption is that the operator is responsible for safety and can do its own risk management, and the regulator can then audit the operator to ensure compliance." This allows the national authority to achieve the same result as prescriptive rulemaking but with a lot less manpower. Thus, the shared government/private sector program can be viewed as an efficiency initiative as well as a safety one. "Meanwhile, the SMS requirements came into place for commercial operators in January 2009," Rohr continued, "and the FAA, along with other ICAO signatory states, has yet to meet it. It is a major challenge for the FAA, and they won't have a motivation to do anything that isn't absolutely necessary, like pushing this toward [FAR Part 91] flight department certification. Canada is the only country in the world that requires certification for noncommercial ops. It has a long history behind it dating from the 1980s and a series of accidents. The CBAA [Canadian Business Aviation Association] worked with Transport Canada to change the rules to standardize operations." This evolved into a certification process (see sidebar on Canada's Private Operator Certificate program), and, remarkably, the Canadian business aviation community agreed that it served overall interests and got on board. "[T]he good operators had ops manuals they were following but were concerned about new entrants who might play fast and loose," Rohr explained. The thinking was that more accidents could result in a plethora of Transport Canada regulations that could ultimately be restrictive to business aviation operations. Annex 6 also requires the operator to have an ops manual and a maintenance control system, training program, operational control system and MEL for large and jet aircraft. "It's done in a performance-based manner so even the smaller operators can do it," Rohr said. "The FAA will have to introduce a whole collection of new rules to implement this, and so I doubt that they will be able to go into a Part 91 certification system, as there's no incentive to do it. In Europe, EASA will require operators to file a declaration that they have met the EASA Ops (formerly JAR Ops 2) rules; this will be considered a legal document so that if operators are cited for not meeting the rules, they can be prosecuted for fraud. So there's a real incentive there to play by the rules." At the FAA, SMS guru Arendt pointed out that two years ago the agency published Advisory Circular 120-92, Introduction to SMS for Air Operators, which has an appendix for voluntary adoption of an SMS program. "It contains no implementation processes but is a set of standards like ISO [the International Organization for Standardization, the Geneva-based group that administers numerous standards programs, e.g., ISO 9000 for organizational quality and ISO 14000 for environmental protection]. "This is what we think a program should look like," Arendt continued. "Since then, ICAO has published what it calls a ýýýframework' that looks a lot like this." So in early February, Arendt's office composed an "informal revision" of the standards in AC120-92 as the basis of a future revised edition. "We hope in two months to have an SMS page as part of the FAA Web site where we can post these documents," he said, claiming that most of the revisions in the informal document were "mouse work" that, rather than changing content, harmonizes it with the ICAO format. Among the revisions is a provision in the SMS for self auditing. SMS: The 'Next Step in Safety' ARG/US's Witowski believes "there's no question" that SMS represents the maturation of a safety program. "As we want to strive to do better as an industry," he said, "we have to come up with a human-factors concept for an organization." In the history of safety management, the aviation industry began with a commitment to do better by learning lessons from accidents. "This was the initial thrust of aviation safety," Witowski explained. "That is, we studied where mistakes were made and decided not to make them again. Then we focused on the human factors, human performance in the cockpit, the things humans do to affect the safety of flight." So now in the next phase of safety management maturation, SMSes strive to coordinate information inside the organization and process it. "That's difficult because the organization is a living, breathing dynamic organism, and it is hard to change the culture of the people who make it up, as well as all the influencing factors, like regulations," Witowski said. "Now safety management is going to try to recognize all those influences and illuminate them so that organizations can determine and evaluate the risks they face from internal and external influences." Business aviation first and foremost is dedicated to safe flight. We have ops manuals and many of us pay for third-party safety audits, so why do we need a safety management system on top of that, you may ask. (Indeed, the NBAA requires as a condition of membership that operators have and adhere to operations manuals.) To answer this question, it is essential to understand exactly what an SMS is and how, if followed religiously - and this is the concept's Achilles heel: actually making SMS adherence company policy and enforcing it - it affects the larger organization's decision making, resultant operations and ultimate success. First, let's consider ICAO's official definition of the concept from Document 9859: "An SMS is an organized approach to managing safety, including the necessary organizational structures, accountabilities, policies and procedures." According to the NTSB's Sumwalt, "When a company adopts one, it systemically attends to those things it believes are important and manages safety the way it manages other valued business aspects." So you begin to see the SMS as not being confined to just the flight department but permeating the entire organization - more on this later. "Many flight departments are doing things reasonably well but have no documented processes," Van Gemert, who now serves Jet Aviation as senior vice president for government relations, pointed out. "What the SMS requires is that you first determine how you will operate and then document those processes and train to them. Then, follow up with self-audits. Now, like a Part 121 carrier, those processes become a chapter in your ýýývirtual Op Spec.'" (Beyond the virtual kind, Van Gemert claims that many corporate flight departments have approached the FAA to obtain voluntary Op Specs "to give them a level of authority when they fly abroad and are subject to SAFA [Safety Assessment of Foreign Aircraft] inspections.") At the NBAA, Doug Carr, vice president for safety, security and regulation, reminded readers that an SMS "doesn't have to be a four-inch binder that sits on your shelf. It is pretty basic and addresses data and analysis, procedures, problem tracking and resolution, standardization - all basic concepts, risk management is at the heart of it - and identifying risk and putting processes in place to reduce it to an acceptable level. If I am an operator with a single aircraft who has just a couple pilots and a maintenance tech who lives in a community hangar, an effective SMS can be only 20 or 30 pages. So we talk about risk reduction and management, and an SMS accomplishes it in several ways, as it tasks you with closure on operational discrepancies and risky operational profiles." Arendt's SMS definition is a little different. "It is not a safety program, it is about decision making and posits safety as part of the decision-making management process just like any other part of running a business," the FAA man said. "It has a set of practices - a policy - that gives it a structure. It is nothing more than looking at your operation and your environment and finding out what hazards are there and deciding what you are going to do about them. The other side of it we call safety assurance, and we take steps to gain confidence that our processes are working using evaluating tools like auditing. I investigate where I've made shortfalls and have a management-review process to make sure the controls are working." Back to Van Gemert, who pointed out that one of the SMS concept's influences was ISO, which "requires you to define and document your processes and then conduct self-audits and represents one of the first SMS-type standards programs. It [ISO] is an international system applicable to any business or process and has garnered strong international acceptance. NetJets/EJM and Jet Direct both have done ISO and have approved SMS and ASAP in their Op Specs. If you have an SMS system in place and all the processes documented and you have an event, you will be 99 percent home in case of a legal prosecution." An SMS "gives you a predictable series of processes that give you a predictable level of output," Van Gemert claimed. "Think of a box around the airplane at 35,000 feet. As you get closer to the surface, that box gets smaller. The box symbolizes your set of procedures for risk management. It should also serve as a contract with the management of your company that ensures both a safe operation and an understanding among managers that it will always be adhered to." Define How You Want to Operate - Then Operate That Way NTSB member Sumwalt believes "you can make these things as complex as you want to" but all SMSes are composed of four components. Written policies, procedures, and guidelines: the standards by which you will conduct your operations. "You write down what you want to do - how you want to operate - and then you operate that way," Sumwalt said, a statement which more than anything else concisely describes what an SMS should be all about. Data collection and analysis. You need as many sources of data as possible. An analogy would be the engine instruments in your airplane, each of which gives you a piece of information about a parameter within the powerplants. By analyzing these data, you can determine what your engines are doing and, to some extent, their condition. Risk management. With data in hand, you can define your risks and set policy and procedures to mitigate them. For example, you might set company minimums for nonprecision approaches that exceed the published examples or set a rule not to operate into fields with runways less than, say, 5,000 feet. Establishment of a safety culture where people do the right thing even when they aren't being watched. Reporting of mistakes, incidents and perceived risks into the data collection mechanism is an essential part of the safety culture, and open disclosure without fear of retribution must be encouraged and protected. As we'll see below, the safety culture has to begin with upper management and be talked down through the company. The FAA's Arendt believes that the SMS concept is "overrated in terms of complexity." It can be either a complicated process or simple and straightforward, he said, "and the latter is what we are trying to make it. Document your process accurately, but don't over-document it. It is all about decision making. Collect the information you need to make good decisions and use it. Have repeatable processes." Part 91 operators successfully implementing SMSes will find their management processes tightening up, Arendt claimed. "Companies that have done it have told us that they have found out a lot about their organizations and how they are or are not using resources effectively, how processes are being used in the field, and have learned how their processes are or are not working, how they are saving or wasting money. You can't separate safety management from other aspects of operation at a company. The smart people are finding SMSes are making their businesses better. But to achieve these results, they must incorporate it as a decision-making system and not over-document it. It has to be flexible, workable." ARG/US's Witowski, though, is more circumspect about SMS construction. "All experts say it takes somewhere between four and five years to fully develop an SMS," he said. "If you start now, you'll just be finalizing it by the time the anticipated FAA regulation is implemented [for commercial and Part 91 operators, he predicted]. There is no question that adopting an SMS is the right thing to do. But these are robust systems, and it takes some rigor getting into it - it is an organizational-factored exercise. So like a supertanker, it takes some time to get the organization to change course. If you take it in smaller bites, it will have less negative impact on the organization." And only when it matures will the operator gain the full benefit from the SMS. Because of the lower frequency of business aviation operations compared to the airlines, it will take longer to see a result. "It may take up to 36 months to see a positive result from it, so in order to prime the pump, you should get started early," Witowski advised. "The goal is to get to a point where you're doing business on the outputs from the SMS. After a series of audits, trends begin to emerge. After information is compiled, identified and trended, then decisions will be influenced by identified weaknesses." Witowski provided this example of how an SMS can be applied to a specific task, in this case, a decision to purchase an aircraft of international capability and begin flying abroad. "What decisions that go into that can be influenced by the SMS in order to address the risks the department will face operating internationally. Through the audits, hazard reporting and collection of data, the flight department should be able to identify the risk the operation will face by expanding into an international venue." A properly compiled SMS strives to diverge from a "siloed," or channelized, approach. "It's supposed to be an umbrella over an entire operation," Witowski said. "Instead of a safety program for each department, an SMS takes those concepts and imbeds them in everybody's daily processes. So now instead of the safety department paying attention to safety processes, under an SMS they are imbedded in every component of an organization." Establishing the Safety Culture To function properly, the SMS must be inserted into a larger safety culture that permeates the entire organization, top to bottom. And the keystone of that culture must be open disclosure to support safety reporting by all employees. "A major issue for an operator is the development of a positive safety culture because for an SMS to work, there must be an open and free exchange of information, and employees must feel free to report hazards, risks and any concerns without any fear of retribution," IBAC's Rohr emphasized. "For example," he continued, "for a fatigue risk management system to work, the employees must be prepared to provide feedback when they feel they may be at risk of suffering fatigue and must also report when the limits are such that additional work could not safely be done. Those reports are key to optimizing resource utilization within the limits of safety. As this demonstrates, employees must feel certain in their minds that management is paramount in its commitment to a safe operation, and employees must willingly play their part to ensure maximum resource utilization. The other side of it is that there are pilots out there who think that cutting the margins is what the company wants them to do. So the safety culture must work both ways to be effective." According to Russ Lawton, director of safety and security for the Air Charter Safety Foundation (or ACSF, which was launched and is supported by the National Air Transportation Association), the safety culture and open disclosure are interlinked, "because the first, establishing a positive safety culture, allows the second, the development of an employee reporting program that is confidential and non-punitive so people can feel comfortable coming forward and admitting their mistakes. When you establish the boundary of what non-punitive means, you then have to back that up so that when someone comes forward, they can speak freely. This is how you recognize trends occurring, like altitude deviations, as one operator I know found out. That's when it works at its best." Two sure ways to hobble a safety reporting program are to kill the reporter, or otherwise make an example of her or him for screwing up, and to do nothing with the reported information. (In other words, it doesn't work to have the appearance of a safety culture to give everybody a warm and fuzzy feeling, like the iconic cartoon of the company suggestion box on one side of a wall and a waste basket under the slot on the other side of the wall.) "If there isn't a feedback loop in place that reports are being looked into, the program will fail," Lawton warned. One operator after implementing a reporting program received a submission from a captain about a landing he made without being cleared by the tower. The operator conducted an investigation, and it was determined that the crew had landed at a field with a VFR tower while the en route control center acted as approach control. "It was a setup for a misunderstanding or miscommunication," Lawton said. " So the follow-up they did was to visit the center facility, discuss what happened, and lo and behold, some of the ATC procedures were changed to eliminate the confusion. The point is that management didn't make a scapegoat of the captain and was serious in determining what events caused the outcome." But Support for the SMS and Safety Culture Must Be Top-Down In order for an SMS to be truly effective - for the safety culture to be meaningful - senior management of the organization, whether a Part 91 flight department or a Part 135 charter operation, has to buy into the concept and continuously support it. As mentioned earlier, the Achilles heel of any SMS is casual adherence to it. You're late, so you cut corners and don't do a thorough preflight. The passenger is anxious to get on the ground to make his meeting, and so you bust minimums on the approach. A senior vice president leaves her seat in the cabin to complain directly to the captain that he isn't being paid to fly to the alternate, so get this airplane on the ground now or there'll be hell to pay! The truncated preflight inspection, the need to please the anxious passenger, the clueless executive pressuring the cockpit crew are all examples of breakdowns in the safety culture. "So it really has to be a top-down activity," Lawton said. "It can't go the other way, because it won't work that way - you can't drive it from the bottom up. [That's like pushing string. - Ed.] Making a profit is why you exist, but managing risk to an acceptable level is what keeps you in a condition to make a profit. Safety means freedom from harm and risk, but there is no time when we aren't free from harm or risk. Any time you move the airplane there is risk involved, and this is where an SMS comes into it, because safety management means being proactive in managing risk." And the safety culture has to be reinforced repeatedly by management before employees will believe and consciously participate in it. Recounting his days as a safety auditor, Lawton related a visit to one Part 91 operation where management was reinforcing a positive safety culture. "The chairman's policy was to be informed beforehand when it wasn't safe to fly, and when he was told it wasn't, he rescheduled his meetings and trips." From there, the policy to not question the discretion of the crews - with encouragement from the aviation manager - filtered down to mid-level managers. "So the chairman sent a strong message that the flight operation decides when and when not to fly, and those decisions aren't to be questioned." What makes an SMS is management involvement and use as a decision-making tool, the FAA's Arendt believes. "Any SMS has to be championed by management and adhered to by all employees," he said. "We have to be realistic that risk is there and that we can't eliminate all of it. If you employ good decision-making media, you can be assured you're doing the best you can - you are looking for hazard, trying to get feedback and assuring that your decisions are in place." A common misconception is that SMSes are safety programs run by the company safety director. But one of the measures of an SMS's success, Arendt said, "is when the management of the operational functions are the drivers of the SMS, that those responsible for all costing resources are using the SMS as part of their decision-making processes. It shouldn't be just a clause in a management agreement. It isn't a signed statement in the manual or a plaque on the wall. We look for who's there in the training reviews, that there is more than just paying lip service to management commitment and who is personally involved in using the SMS in their decision-making processes. It has to permeate through the organizational structure and go both ways, up and down." Insulating Flight Crews From Sophie's Choices Witowski, who teaches SMS courses under the auspices of ARG/US, related some of what he has learned from his students about cross pollination of safety culture between departments in a typical company. "Generally, what I would expect is that when the aviation department is tasked with setting up an SMS, they will find that the aviation side is behind the industrial safety department, that is, they will discover that there are already a lot of these processes going on in the industrial side. Ours implies a lot more human factors stuff, because the machinery moves around and operates in bad weather, but I know we have something to learn from the industrial side. "SMS figures out what the best application of those principles is for the aviation side," he continued. "The first challenge is identifying the risks your operation faces. You then prioritize them and determine which ones require attention and attack them as you best see fit. If you have to drive it down to one analogy, it is risk management. You have to have the right policies in your organization to build on where you can effectively manage risk. For example, if you do not have a non-punitive safety reporting policy for employees, then hazard communication is going to be significantly hampered because employees will fear retribution for reporting a mistake." Sumwalt, the NTSB member who formerly managed a flight department, observed that "There are pilots who think that the metric for a successful flight department is how cheaply they can run the department. This is why you need corporate buy-in for safety and security for the passengers as the first goal of the operation. The second goal should be having the airplane ready for use when it's needed, and then the third goal is cost control." A proper safety culture supported by all levels of management "insulates" flight crews from pressure to shave the margins of safety. Sumwalt addressed this issue from his own experience: "Because there's always the possibility of an executive demanding a flight crew do something unsafe and the pilots then doing it to please the passenger, at my corporate flight department, we relieved that Sophie's choice from the crews by giving the captains the authority to say no, with no fear of recrimination, to any request that was outside the accepted operating standards we had agreed to. You have to have those decisions made at the right level to insulate the flight crews from compromising situations. If you can insulate them from making the wrong decision then it vastly reduces the opportunity to make more serious errors downstream." SMS Resources In addition to guidelines contained in FAA Advisory Circular 120-92, IBAC and the Air Charter Safety Foundation have developed resources to assist operators in setting up a safety management system. Citing the EASA SMS requirement (which he claimed was defined by European Commission politicians rather than EASA technical experts), the NBAA's Carr said it was initially confusing as to which entities the requirement applied, the E.U. member states or the operators within them. "We decided it applied to the operator, and this led us to consider an SMS program [for business aviation] as a result," Carr said. "So early in 2008, IBAC constituted a group to develop an ýýýSMS Tool Kit.' They spent eight months putting it together, and just recently they released it. We believe that this represents a very reasonable approach to an implementable program specifically tailored for business aviation and on-demand charter." IBAC's Rohr took it from there. "We did the Tool Kit because we already had some basic guidance in IS-BAO for an SMS. We reviewed that and decided we could improve it, because there had been a lot of evolution in the concept since 2002 when IS-BAO was introduced. The Tool Kit replaces the SMS guidance in IS-BAO and will be offered independently for operators that need SMS but don't elect to do the full IS-BAO program." The SMS Tool Kit will be sold by the business aviation associations that constitute IBAC and priced in the United States at $650. It consists of a 57-page hard copy document that provides a step-by-step process of SMS development and implementation and a CD containing multiple tools and reference documents. The tools booklet is also on the CD with hyperlinks to the tools. Among subjects addressed by the tools are hazard identification and analysis, safety policy development, SMS implementation, and safety culture and assessment development. "We will be doing workshops, too," Rohr continued, "two days of introduction to SMS and safety management and a one-day tools workshop." IBAC will distribute the workshop course syllabus and training materials to its 19 member associations worldwide and also train presenters. In the United States and Canada, it is expected that the workshops will be conducted by contractors to the NBAA and CBAA. At the ACSF and NATA, the mission is "to promote SMS in the charter world," Lawton said. On the ACSF Web site (www.acsf.aero) are pages on SMS and safety auditing, as well as one on parent organization NATA's Aviation Safety Information System, a software program developed originally in the U.K. as a safety manager's tool for collecting information for risk and cost analysis. It can be used in preparation of metrics, measurement and reports as part of an internal safety reporting program. Meanwhile, the NBAA "wholly supports" SMS as a safety concept, Carr affirmed. "It is the next safety enhancement or level that we believe the community should be working toward. We are promoting it to our members, taking the IBAC concept that we helped to create and talking it up everywhere we can." So why do we need to move to that next level? Or as Witowski at ARG/US asked, "Why do we want to do this? We have progressed through all the previous steps. For my answer, I yield to that great philosopher Yogi Berra: "If you keep doing what you're doing, you're going to keep getting what you got." In hindsight, we so often ask, how could this have happened? The only way to continue to improve is to address the weaknesses in the organization. We have focused in the past on the airplane and the people flying it. Now we have to address the organization and its dynamics. ICAO says, ýýýStatistically, millions of operational errors are made before a major safety breakdown occurs.' Rooting out those errors is what SMS is all about." Now, if we could just make SMS mandatory for those cell phone-addicted SUV drivers. http://www.aviationweek.com/aw/generic/story_generic.jsp?channel=bca&id=news /bca0409p1.xml&headline=Safety%20Management%20Systems%20for%20Business%20Avi ation *************** Southwest flight makes emergency landing DALLAS — A Southwest Airlines flight from Orlando, Fla., to Austin made an emergency landing at Tyndall Air Force Base in Panama City, Fla., as a precaution after a sensor detected an apparent problem in the cargo hold. Airline spokeswoman Olga Romero said the pilot elected to make the emergency landing Sunday. She said there was no fire. The 104 passengers on the plane were taken to the Officer's Club at the base for Easter lunch and continued on their flight after another Southwest plane was brought to the base from Dallas. http://www.chron.com/disp/story.mpl/ap/tx/6370708.html ************** Gearbox failure caused North Sea helicopter crash LONDON (Reuters) - The North Sea helicopter crash that killed 16 people last week was caused by a "catastrophic failure" that led to the aircraft's main rotor breaking away, air accident investigators said on Friday. In an initial report, the Air Accidents Investigation Branch (AAIB) said the failure occurred in part of the helicopter's main gearbox. The rotor then broke off, hitting and severing the aircraft's tail boom, the AAIB said, adding there was also a rupture in the helicopter's right-hand engine casing. The 14 passengers and two crew were returning from a BP oil platform when the Super Puma helicopter crashed in the sea in fine weather on April 1. The AAIB said the Puma's manufacturer Eurocopter should instruct all operators to increase main rotor gearbox inspections. It also said Eurocopter should "improve the gearbox monitoring and warning systems on the (Puma) helicopter so as to identify degradation and provide adequate alerts." It was the second Super Puma crash in the North Sea in six weeks. In February, all 18 on board a Super Puma travelling to a BP oil rig were rescued after it went down into the sea after hitting a fog bank. Both aircraft were operated by Bond Offshore Helicopters, which runs a fleet of Super Puma twin-engined helicopters to supply sea-based oil rigs. *************** EASA requires A300, A310 co-pilot seat deactivation The European Aviation Safety Agency (EASA) is giving operators of Sogerma pilot seat-equipped Airbus A300-600, A300-600ST and A310 aircraft until 9 May to deactivate the horizontal and vertical electrical adjustment controls on the seats. The mandate was spawned by a report of an A300-600 co-pilot seat sliding back uncommanded to its rearmost position during takeoff, says EASA. Following a change out of the seat's horizontal movement actuator, the aircraft was put back in service, but the seat again slid back during the next takeoff. According to the airworthiness directive (AD) issued 9 April, an investigation of the two removed actuators revealed that the clutch was broken inside the shaft, unlocking the seat horizontal movement. "An unwanted movement of the pilot or co-pilot seat in the horizontal direction is considered as potentially unsafe, especially during the take off phase when the speed of the aeroplane is greater than 100kt and until the landing gear is retracted," EASA states in the AD. Along with deactivating the seats entirely, the agency provides for two alternative interim actions that can be implemented to restore partial or full use of the electrical controls until a final airworthiness directive (AD) is issued at a later date. Source: Air Transport Intelligence news ************* Curt Lewis, P.E., CSP CURT LEWIS & ASSOCIATES, LLC