Learning From Poor SafetyManagement Systems

The Safety Conference 2008:OHS for The New Era

Kym Bills, FSIAExecutive Director ATSB28 October 2008

Multi-modal ATSB

ATSB context• Multi-modal body to investigate, analyse and

report independently on aviation, interstaterail & major marine safety occurrences

• Transport safety investigations are notintended to be the means to apportionblame or liability, in accordance with theTransport Safety Investigation Act 2003 (TSIAct) & Annex 13 to the Chicago Convention

• Powers to investigate, including to searchand compel evidence even if incriminatory

• But reports/evidence can’t be used in courtswith the exception of Coronial inquests.

• The ATSB is part of the CommonwealthDepartment of Infrastructure, Transport,Regional Development & Local Governmentfor administrative and resourcing purposes

• Separate from State bodies like Police andrail regulators, and federal bodies like theCivil Aviation Safety Authority (CASA),AMSA, the ARTC and Airservices Australia

• Importantly, separate investigations bypolice, regulators and OHS bodies occurconsistent with a ‘just culture’ (perhaps 10%of accidents via a form of culpable actions).

• The ATSB’s no-blame safety investigationis only one part of the system

• To reinforce independence, under the TSIAct S15, neither the Minister nor Secretaryare to influence ATSB investigations

• ATSB aviation occurrence reporting,voluntary confidential reporting and dataanalysis and research supplement bothinvestigation & industry schemes, eg SMS

• Approx 100 ATSB staff, most in Canberra& ¾ aviation-related including notifications- Brisbane, Adelaide & Perth field offices- annual budget about $16 million.

Safety Management Systems

• The ATSB is naturally strongly supportiveof robust safety management systems

• Prior to the ATSB’s formation, from 1996BASI developed and promulgated a basicSMS guide for small operators in aviation

• International Civil Aviation Organization(ICAO) has produced a 2006 SMS Manualas a key document - soon to be updated

• SMS compulsory in aviation from 1/1/2009(already at airports etc)

ICAOManual2006

Doc 9859AN/460

ICAO 2006 Manual

• “Safety is the state in which the risk of harm topersons or of property damage is reduced to, andmaintained at or below, an acceptable levelthrough a continuing process of hazardidentification and risk management.”

• “A safety management system is an organizedapproach to managing safety, including thenecessary organizational structures,accountabilities, policies and procedures….As a minimum, such SMS shall: identify safetyhazards; ensure that remedial actions necessaryto mitigate the risks/hazards are implemented;and provide for continuous and regularassessment of the safety level achieved.”

ICAO 2006 Manual

• ICAO Annexes “require establishment of a safetyprogramme to achieve an acceptable level ofsafety in aviation operations. The acceptable levelof safety shall be established by the State(s)concerned. … [and] may include provisions for suchdiverse activities as incident reporting, safetyinvestigations, safety audits and safety promotion.To implement such safety activities in an integratedmanner requires a coherent SMS.”

• An organization’s SMS accepted by the State shallalso clearly define lines of safety accountability,including … senior management.”

ICAO 2006 Manual

• ICAO stresses ‘acceptable level of safety’ isthe overarching concept and regulatorycompliance has to be complemented by aperformance-based approach [ie ‘both/and’]

• Further, an ‘acceptable level of safety’ canvary across industry sectors and should beset with regard to implied risk, cost-benefit ofimprovements, operational context andcomplexity, and public safety expectations

• This is not an easy or uncontroversial task!

ICAO 2006 Manual• ICAO says an ‘acceptable level of safety’ is

expressed via safety performance targetsand safety performance indicators, andimplemented through safety requirements

• Many bodies share responsibility for safetyand effective safety management - ICAOsees ‘considerable merit’ in a regulatorysystem with ‘a well-balanced allocation ofresponsibility’ between the regulator and theoperator or service provider that is justifiablegiven the economic resources of the State- & risk-based regulatory resource allocation

ICAO 2006 Manual• Specialist independent accident & incident

investigation authorities are important toavoid potential conflicts of interest [cf ATSB]

• A positive safety culture is crucial, including:- a senior management safety emphasis;- realistic view of ST and LT hazards;- fostering feedback & deal with safety deficiencies;- non-punitive ‘just culture’ (but punish if culpabilty);- communicating safety at all levels;- good training & learning;- safety ethic so little risk-taking behaviour;- human factors understood and defences in place;- pro-active data gathering, analysis & response.

Anca (2007)

• Swinburne’s Dr Joey Anca in MultimodalSafety Management and Human Factors,uses a squirrel as an iconic representationof SMS because a squirrel is in constantmotion, anxiously scanning theenvironment for threats and opportunities:“the essence to the mad anxiety is an incessantmonitoring of what goes as expected (normaloperations) and what doesn’t (deviations)”

Hopkins (2005)

• ANU’s Professor Andrew Hopkins in Safety,Culture and Risk emphasises organisationalsafety culture, collective mindfulness, andrisk-awareness

• “Major accidents are frequently traced to failures insafety management systems and investigationssometimes reveal SMS are little more than sets ofmanuals occupying metres of shelf space …”

• Hopkins argues that the Royal Commissionon the Esso Melbourne gas plant explosionin 1998 came close to describing the SMSat the site as ‘virtual’

Perhaps a deadwombat cf asquirrel is anappropriateicon for a pooror virtual SMS?

ATSB perspective on SMS

• The ATSB’s primary perspective on SMSis as a no-blame safety investigator

• In the context of an accident or a moreserious incident, we may need to look atwhat type of Safety Management Systemwas in place and how it was operating

• Often the greatest learning can be fromwhat went wrong and poor SMS if we areprepared to be honest and put ourselvesimaginatively in the context and situation

Collision with Terrain11 km NW Lockhart River Aerodrome7 May 2005, RPT 2 crew/13 pax fatalitiesVH-TFU, SA227-DC (Metro)

Safety Investigation200501977

Lockhart River approach profile

South Pap

Accident site

Lockhart River and SMS

• In addition to pilot and other contributingsafety factors, the ATSB investigation foundTransair’s SMS to be poor

• These contributing safety factors includedthe poor company organisation structure,weak Chief Pilot commitment to safety,inadequate risk management processes,and variable training

• Other safety factors included the OpsManual & lack of HF training including CRM

Transair’s SMS

• Chief Pilot was also MD & head of Check &Training and regularly in PNG – overloaded& poor organisational structure back-ups

• He did not demonstrate a high level ofcommitment to safety, eg Cairns baselargely unsupervised and checked itself,reported pilot hazards not addressed, nosafety committee minutes available,incidents not reported to the ATSB etc

• SMS largely in manuals not reality: virtual

Transair’s SMS

• Transair did not have a structured processfor proactively managing safety-relatedrisks associated with its flight operations

• This included the move from charter intoRPT with passengers in QLD, & expansionof operations in QLD and NSW to 25 pilotswith new ports such as Lockhart River

• Training was variable and sometimesentailed little more than an open book exam

Transair’s SMS

• Transair’s Operations Manual involved amass of Word documents slapped onto aCD with no indexing or version control

• Manual requirements for human factorstraining, like crew resource management formulti-crew operations, did not happen

• Transair appeared to have a SMS and acommitment to best practice but actualpractice reflected a poor safety culturedriven from the top (cf ICAO 2006 Manual)

Garuda 737-400, Yogyakarta

International example: AdamAir

• The ATSB has a longstanding relationshipwith Indonesian counterparts (NTSC)

• Assisted with Garuda 7 March 2007Jogjakarta 737 landing overshoot accident

• Also assisted with AdamAir 737-400 highspeed ocean crash of 1 January 2007

• The final report into this accident wasreleased by NTSC on 25 March this year

• All on board died instantly: 2 pilots, 4 cabincrew, 96 passengers (11 children)

Final Adam AirInvestigationReport released25 March 2008

AdamAir SMS

• Based on flight recorder data, at FL350the crew were trouble-shooting InertialReference System (IRS) anomalies

• Didn’t notice auto-pilot disengage andaircraft begin to bank and when the crewtook action on aural alerts, they did notroll wings level before pitch recovery

• Aircraft reached 3.5g and negative 2.8gand Mach 0.926 – well beyond designlimits– before ‘thumps’ and CVR ended

AdamAir SMS

• In addition to pilot inattention, AdamAirprovided no training in upset recovery

• Indonesian regulations didn’t require it• In 3 months prior to accident, 154

recurring defects in IRS logged but littleor no action by company or regulator

• A good SMS requires timely action onaccident precursors – this was opposite

• Late 2007 still IRS issues before actiontaken. AdamAir was wound up in 2008.

A Marine example

International Safety Management Code

•The IMO requires that safety managementobjectives of the company should:- provide for safe practices in ship operationand a safe working environment,- establish safeguards for all identified risks,- continuously improve safety managementskills of personnel ashore and aboard ships,including preparing for emergencies relatedboth to safety and environmental protection.

Nego Kim 18 November 2001

NegoNego Kim: SMS Failures Kim: SMS Failures

The ATSB investigation also found that theship management company contributed tothe explosion and eight deaths by:• Failing to recognise the risks associatedwith the operation and thus provideappropriate instructions and safeguards,• Failing to provide appropriate equipment,• Failing to ensure that basic safetyinformation in relation to the use of the paintwas available to the crew.

Rail example: Two Wells, 6 Aug 2007

•In rail, there is ‘co-regulation’ and both ‘safetycases’ and SMS are utilised by state regulators

•Level crossing collision between The Ghanpassenger train and a loaded sewage truck

•Truck drove into the path of The Ghan andtruck driver seriously injured, truck destroyed

•Train driver not injured, lead locomotiveseverely damaged; minor injuries suffered bytwo passengers, minor track damage

Road/Rail: Two Wells, SA, 6 Aug 07

Farm Road Crossing, Two Wells

•ATSB found insufficient sighting distance for truckdriver to see The Ghan approaching from north

•Vegetation growing adjacent to track whichimpeded sighting

•Maintenance practices for vegetation clearing atthe level crossing were inadequate

•Programmed works to clear vegetation within 28days not carried out in accordance withmaintenance specification

•Maintenance priority revised from 28 days to 180days without re-assessment of sighting hazard

View from the Stop signposition to the north(where The Ghan wascoming from)

View to the south

Two Wells SA – 6 Aug 2007

ATSB Investigation Safety Recommendations:•Action required on maintenance practices forcontrol of vegetation in rail corridor• Placement and proximity of crossing signage• Interface agreement required between trackmanager & local council defining eachorganisation’s responsibilities regardingmaintenance of level crossings and landadjoining rail corridor (ie system perspective)•No issues for rail operator in this accident•Truck driver used a ‘rolling stop’ procedure.

Some Lessons from Poor Transport SMS

• ICAO: a positive safety culture is crucial- senior management safety emphasis;- realistic view of ST and LT hazards;- fostering feedback & deal with safetydeficiencies;- non-punitive ‘just culture’ (but punish ifculpabilty);- communicating safety at all levels;- good training & learning;

Some Lessons from Poor Transport SMS

- safety ethic so little risk-taking behaviour;- human factors understood and defences inplace;- pro-active data gathering, analysis &response.

• Systemic perspective, avoidcomplacency, learn from pastaccidents and incidents.

Be a scanningSMS squirrelnot a dead SMSwombat!

Questions?

www.atsb.gov.au