Features Safety
Merlin Preuss on SMS

Call it ‘2010: An Airspace Odyssey,’ because that’s what it will have
been by the time Transport Canada has a new Safety Management System
(SMS) in place. This particular journey began in the mid-1990s and
Merlin Preuss, the department’s director general of civil aviation,
says that when everything falls into place at the end of this decade,
Canada’s already enviable aviation record should be even more so.

Preuss
explained in an interview that the first step was identifying issues
and then developing potential solutions, which was completed last year.
The next step is to truly engage all stakeholders, to convince the
lingering naysayers that while the fundamental act of flight will
always carry with it an element of risk, it can be managed to
acceptable levels. “Every instructor in this department has been
trained to do risk assessment,” he said. “When we talk about our
mission in civil aviation, we’re also talking about a systemic approach
to managing the risks.”

The latest numbers indicate that there
were more accidents last year in Canada and the US than a year earlier.
The tally here was 258 involving Canadian-registered aircraft,
excluding ultralights, compared with 252 in 2004 but even so, last
year’s count was below the 2000-04 annual average of 287. There were 18
accidents involving foreign aircraft in 2005 compared with 20 in 2004
and the 2000-04 average of 22. There also were 823 reportable incidents
here in 2005, better than 909 the year before and the 2000-04 average
of 837. The pattern was similar south of the border with 1,779
accidents in 2005 against 1,717 in 2004, and although one year is
hardly a trend, Mark Rosenker, acting chairman of the National
Transportation Safety Board, said it nonetheless underscored the “need
to maintain a strong focus on safety in all segments of the aviation
community.”

Preuss said there was a particularly vivid reminder
in mid-2005 when there were six accidents of varying severity over a
period of a few weeks. “The forecasts from Boeing and others is, ‘if we
keep going this way, we could have an accident on the front pages every
week.’ That’s not good for business.” That said, “it doesn’t matter
whether it happens here or elsewhere,” which is why Transport Canada
Civil Aviation (TCCA) is focusing on SMS development, which has
involved pilot projects at several locations across the country. And
internationally, TCCA works through the Montreal-based International
Civil Aviation Organization (ICAO) and, on a north-south axis, with the
Western Hemisphere Transportation Initiative and its spin-off Group of
Experts on Aviation Safety, Security & Assistance which Preuss
co-chairs with his Colombian counterpart.

“It’s catching on,”
Preuss said of the SMS trend. “Good as it is, the current system is
flatlined; it can’t get any better.” However, if he were starting from
scratch, he would remove the word “safety” from the description. “A
better way to describe is that it’s a risk management framework. If you
really want to take this approach in your company – whether it’s an
airport or airline or whatever – you end up changing the whole
management to include risk assessment. In this case, we’re demanding,
by regulation, risk assessment of safety issues.” Since assessing risk
is in many ways a subjective exercise, proving success is a challenge.
“You can prove when you fail!” Preuss pointed out. “You have a smoking
hole somewhere.”

Also, while all kinds of SMS models are
published around the world, they are fundamentally the same. There’s a
reporting system and in each report a hazard, accident or occurrence is
identified and analyzed. If corrective action is necessary, it is
taken. If nothing has to be done, then it becomes a database entry. For
example, if a major carrier’s maintenance manager receives a report
about a blown tire, it likely is a fairly routine item to be filed. But
what happens when periodic database analysis shows that there have been
a dozen blown tires on a left bogey of a particular aircraft? Maybe a
bogey’s axle bearing is shot. Is the maintenance manager going to
accept that risk? Hardly. If a new bearing is in stock, there’s no
additional cost except maintenance hours but if a new bearing or,
worse, axle or even a whole bogey is involved, there are new costs to
consider.

SMS takes that process a step further, with varying
degrees of success. “Whether you’re talking about an airport in Ottawa
or an AMO in Vancouver, we’re processbased,” Preuss said. “We do
forensic audits against processes that are in place to prove that
they’re meeting the standards, the regulations. That’s where we are
today.” The next step after that is cultural and is fundamental if
there’s to be a compliant SMS in Canadian civil aviation. The systems
we now have in place are predominantly reactive in how they address the
‘smoking hole’ or a blown tire, and once a cause has been identified,
repeat occurrences can be avoided or at least minimized. A better
approach is to address a problem before it becomes an occurrence,
incident or accident.

“You do that by creating within your
organization a reporting culture,” Preuss said. “You start with the
creation of a blame-free environment; as an employer, you assume that
the person who walked in your door didn’t walk in there to screw up.”
If something does go wrong, the cause is determined right down to the
fundamentals. “People tend to take the first exit: ‘well, it was
training.’ So they train more when in fact it maybe wasn’t training.
Until you’ve got to the bottom of it, you’re not going to be
successful. The cultural part here is to change the attitude of people
not to stop at the Band-Aid but to get right down into this fundamental
area of human and organizational planning. This is very complex, grey
and fuzzy … but it has to permeate the whole company.”

Montreal-based
Air Transat could be a case study for SMS. While it hasn’t had a fatal
accident since beginning service in 1987, it had a significant
safety-related event with an Airbus A330 that ran out of fuel on a
Toronto-Lisbon flight. It was cruising at 39,000 feet when the
starboard engine lost power, followed by the port engine 13 minutes
later. It was caused by fuel starvation; a system leak near the
starboard engine, coupled with an open crossfeed valve, let fuel drain
from both wing tanks. The leak had been noticed by the crew about an
hour before engine shutdown and they had already diverted toward a
military airfield in the Azores. Even so, the crew managed to hold the
A330 in a glide for 20 minutes or 115 miles to avert an ocean ditching.
The landing gear was damaged during the hot landing, and while all 13
crewmembers and 291 passengers survived, some of the latter were
injured during the emergency evacuation of the aircraft.

Transport
Canada fined Air Transat $250,000 for improper installation of an
engine hydraulic pump. Later, when TCCA knocked on the carrier’s door
after it had agreed to put SMS in place, Preuss had made it clear that
he wanted every one of the vicepresidents present, including finance
and marketing. “In the end, they went willingly,” he recalled. “I had
the hammer, but I convinced them.” Preuss said it wasn’t Air Transat
management’s reluctance to acknowledge they had a problem; it was
simply such a different approach being proposed. He said TCCA’s
regulatory oversight of Air Transat had given the department “really
high confidence” in the company.

“Their reports indicated that
they were as good a company as any other company,” he said. “So why did
they almost kill 300-odd people? There’s no logical reason today why
any of them are alive! A series of events permitted them to escape,
that’s all. Statistically, it shouldn’t have happened.”

The
chilling potential of the Air Transat incident drove TCCA to find out
why this sort of thing happens, and led the regulators into human and
organizational factors. “What were the priorities of the company at the
time?” was a key question put by Preuss. “Did they put a lot of
pressure on the maintenance people to get the aircraft out of the
hangar for whatever reason? When we delved in, we found out that those
things were true.” He said Air Transat’s initial reticence about SMS
was that it had a “great” culture with safety their No. 1 priority.
“But when we dug back in, it ended up that ‘no, it’s not No. 1,’ so we
had to overcome that with education. And then, once the leadership
understood what was meant to happen, it took a long time to get going.”

How
deep does the human resources part of an analysis go? How would it
address a maintenance person whose performance is affected by, say,
financial or marital problems? “That’s what we do now,” Preuss said,
“if the person shows up and is totally preoccupied with something at
home, and that’s the reason the process or procedure wasn’t followed.”
That’s where a reporting culture comes into play. “If that person walks
in and says ‘I can’t work today because’ of whatever reason, a smart
employer will say, ‘hey, I’m not going to take the risk of putting that
person on the line.’ But to even be in a position where they could make
that decision, the person has to walk in with confidence and report the
problem without having to worry about getting fired.”

The final
cultural element, which is why people such as the VP Marketing are
routinely drawn into the SMS discussion, is to ensure that an operator
cannot make any decision without somebody asking what the impact is on
safety. “When you do that, you’ve got a compliant system,” Preuss said.
“These will be things that you need to do to have the other parts
work.” He acknowledged that many TCCA staff – imports from the private
sector who have been turned into forensic inspectors and auditors –
were still getting up to speed. “We’re changing their minds, their
culture, to have them looking at performance rather than process. I’ve
got to get them to think the same way we’re expecting the companies to
think.”

But he’s had to do it without additional funding, by
reallocating from within an already tight budget. “SMS is
resource-intensive, which means we’re taking higher risk on some of the
surveillance. But it’s not all loss, because as soon as we start
working with the companies, there’s a safety bonus.” Preuss said a fair
number of his former military colleagues are now flying for Air Transat
and that they count it as “the best working environment they’ve ever
been in.”

Preuss said that when TCCA’s internal system is up and
running, it should be audited for effectiveness by an independent third
party such as KPMG, if only for credibility in the industry. “The
advantage is, first of all, we’re ‘walking the talk.’ Second, we can
understand viscerally and with concrete examples what the industry is
going through because we’re putting the same thing in place.” The only
significant difference is that TCCA is missing a critical indicator:
the fiscal bottom line. Government agencies don’t work that way,
shouldn’t work that way in such a critical area. “But I should be able
to gather everything else,” Preuss said, volunteering with a chuckle
that his staff tend to find the former air force mechanical engineer
“logical to the point of being anal.”

He took polite issue with
industry concern about the way an ‘accountable’ executive must be
identified within each company. “It’s a way to promote the cultural
change,” he said. “If it doesn’t start at the top, it isn’t going to
happen. It puts a face on the individual who’s responsible.” It could
be argued that if the cultural change is successful, an operator’s
personnel would naturally buy into the SMS process and regulatory
oversight wouldn’t be needed. Not necessarily so, as was shown in
Australia, where it was a tremendous challenge to reach to 10-20% of
people who cause 80-90% of the problems.

But he conceded that
‘accountable’ has been problematic because of the way it has been
redefined by some as ‘liable’ from a legal standpoint. “The thing
that’s scaring some people is personal liability on the CEO.” That’s
how the Canadian Environment Protection Act plays out; it holds senior
officers in an offending company personally responsible if an accident
results in pollution. Preuss insisted that the Aeronautics Act doesn’t,
because while that punitive wording was part of the original package,
the people who draft legislation evidently were persuaded that it
wouldn’t have been right.

“Nobody is more personally liable
under this system than they were yesterday,” he said. “I’m not
predisposed to use a hammer. Culture change isn’t driven by a hammer.
You need a hammer in the end to make sure it happens but if you don’t
meet the requirements, what do we do today? We remove the certificate.”
What about using the hammer to get their attention? “If you put
personal liability in there, it gives everybody else a big hammer too,
and as soon as people start worrying about personal liability, what
happens? They don’t take decisions, you don’t get data and then you
can’t go forward.”

What about the growing tendency toward
class-action lawsuits whenever something goes wrong? Some lawyers were
quick to initiate suits after an Air France Airbus A340 skidded off the
runway at Toronto International Airport last August during a driving
rainstorm and burst into flames. Only 43 people sustained minor
injuries but the parasitic suits were for huge amounts of money.
“That’s going to happen anyway,” Preuss allowed. “They’re going to go
after the CEOs and the board, but they will find nothing in law,
nothing in regulation, that indicates any personal liability….
Generally, you’re talking in your defence about due diligence. What
better way to prove due diligence than to have an up-and-running SMS
endorsed by the government? You can show that every time something came
up, you followed the proper process. No judge is going to debate that
with Transport Canada – at least they haven’t historically and I doubt
they will in the future – and decide themselves what’s safe and what
isn’t.”

If you hold a certificate in this country, Preuss said,
“that means to me that you’re equipped and able to provide some service
or another, whether that’s an airport or a nav system or an air
operation. Then you will have an SMS.” There will be operations and/or
activities that fall outside the SMS ambit but there’s uncertainty
about where the cutoff line will be. Preuss assumes it will be above
the individual general-aviation Cessna 172 pilot. For larger operators,
the biggest savings are to be found in cost-avoidance measures. They
could easily top six figures monthly, adding up hugely over the course
of a year in an industry struggling to contain costs to be competitive.
Preuss said ramp operations can be “a toilet” for carriers, flushing
money away because of poor or non-existent quality assurance.

On
the whole, industry generally is keen to see SMS in place, but Preuss
said implicit trust is still not universal. “There are still naysayers
who pop out,” he said, attributing it possibly to inadequate
communication on his part. There’s also, to a degree, the longstanding
private-versuspublic sector distrust, but the relationship is better
than even just a decade ago.

And what about a decade from today?
Preuss said the systems approach will be pervasive and he has seen a
lot of other countries pick up on it. “It will permit globalization to
happen a lot faster because right now we still have all kinds of
barriers,” he said. “There are very few northsouth but there are still
a lot of them east-west and north- ‘way-south.’ So if you want to
really open up the market, which is probably what will be the future,
you’ve got to have a regulatory basis to do that.” It helps that SMS
has evolved beyond the “buzzword” stage within ICAO. Bill Voss,
Director of ICAO’s Air Navigation Bureau since January 2004 and before
that Director of Terminal Business Service at the U.S. Federal Aviation
Administration, is firmly behind the concept.

When it was
suggested that some interests within ICAO “talk the talk but don’t walk
the walk,” Preuss said that has been true in Canada too. “But it’s got
to start somewhere and I’m doing everything I can to support their
endeavour. In a way, if you can make even the processes work, you’re
going to leapfrog a lot of learning.” He likened it to the huge boom in
mobile phone technology in underdeveloped countries where telephone
poles and lines have never taken root. “They’ve leapfrogged that whole
infrastructure development and gone right to satellite. If you’re a
regulator in some underdeveloped country and you want to go from
building up a huge workforce of forensic auditors, if you want to skip
that stage, go to SMS if you can do it. Then you set up the
accountability framework inside the industry rather than creating an
infrastructure in government, which can be very expensive and
timeconsuming. SMS has tremendous potential to stabilize the industry.
I don’t see a quicker, more efficient, more effective way to affect the
areas that are going to have the worst accident rates.”

The
long-term expectation is that as the SMS culture takes over, the need
for regulatory oversight should diminish. “There are benefits if you
start out with the target, to reduce the accident rate, and you’re
successful by using this method,” Preuss said. Among other things, TCCA
will do even fewer pilot checkups than the small number it does today.
Rather, the focus will be on showing Canadians and the department that
every pilot on an airline is competent. “If the system works, why would
we do checkups on Air Canada pilots? Most of the checking we do is on
the people who are doing the checking on behalf of the government.
That’s the system that’s on the verge of now going to the next step.
When they put in a competent quality-assurance, transparent system that
we can verify, we’ll let them go.”