Corporate Aviation Safety Seminar: Speakers shine spotlight on importance of SMS, FOQA

 - May 25, 2010, 6:54 AM

sMS (safety management systems) and FOQA (flight operations quality assurance) are no longer just buzzwords, said Flight Safety Foundation (FSF) president and CEO Bill Voss in remarks opening last month’s FSF/ NBAA Corporate Aviation Safety Seminar. Noting that the emergence and maturation of these initiatives is becoming increasingly prevalent in corporate aviation, Voss added that language in the Senate version of the FAA reauthorization bill includes the same privacy protection of FOQA data that is accorded flight data recorder and cockpit voice recorder information.

Twelve of the 16 presentations over the next two days addressed a mix of management and airmanship issues related to implementing SMS and C-FOQA (Corporate FOQA) programs, along with the operational imperatives for pilot avoidance of destabilized approaches and high-altitude upset recovery. Other topics included an overview of helicopter issues, maintenance error avoidance and fatigue management.

Several speakers focused on the need to gain the unconditional acceptance and support of top management when creating a corporate SMS. Pete Agur, founder of the VanAllen Group, summarized case studies of 49 organizations operating a total of 129 aircraft. The organizations’ annual revenue ranged from less than $50 million to several billion.

In his presentation, “Selling Safety Uphill,” Agur rated company CEOs at five levels on leadership effectiveness in promoting safety, ranging from “world class” to “unacceptable.” “Three percent of these company leaders were world class, and ten percent were unsatisfactory.” Thirty-seven percent of those, he added, “had a significant safety event, including nine percent who had accidents.” The largest segment in the study, 53 percent, adhered to “best practices.” Agur noted a clear correlation between the CEO’s rating and safety event occurrences. Those with the lowest safety rating exhibited a “disconnect between top management and operational personnel. These people created risks to improve service at the expense of safety.”

He related a story about one such “high risk” executive who was unresponsive to safety initiatives until Agur made it personal. “‘You’re putting your kids on the aircraft and taking those kind of risks?’ I asked him. I explained the risks and their likely consequences. Change resulted.” However, Agur continued, “The department manager is the key,” the linchpin who influences both the CEO and flight crews. “The middle manager can create a different result depending upon his attitude.”
Rick Boyer, aviation department manager for Scana, a South Carolina energy company, described the flight department’s role in establishing a corporate SMS at the state’s only Fortune 500 firm. Scana operates two King Air 350s under Part 91. “I emphasized making the flight department an indispensable part of the company. That included empowering the entire team. Next was a willingness to accept outside help.” Boyer got that help on a visit to Mississippi Power, which had a functioning SMS already in place. High-level managers at Scana were impressed that a similar company had such a program, and Boyer borrowed liberally from Mississippi Power’s best-practices protocol to build the Scana SMS.

Risk-assessment Procedures
Thomas Lintner, president and CEO of consulting firm Aloft Group, described a process he calls the aerospace performance factor (APF) to measure safety performance. He said it integrates safety data from a specific company’s operation to shift focus from reactive to preventive. Lintner described APF as a systematic procedure to quantify, organize and address risk factors to define a clear path to risk forecasting, which in turn can be invaluable in designing an SMS.

Describing FOQA as “the glue that holds an SMS together,” Jim Kelly, aviation safety manager for Pfizer’s Trenton, N.J.-based flight department, said, “SMS is driven by your safety culture, and the goal of C-FOQA is to define and promote a ‘just culture.’” That culture he defined as: informed, reporting (free to communicate without fear of retribution), openness to learning as a lifetime process, and flexible. C-FOQA does that by promoting–indeed requiring–a full, free flow of information and opinion throughout the organization without the threat of punitive action, while providing a steady stream of operational data on which to base safety management decisions. A key FOQA element is confidential reporting of potential or imminent safety hazards.

Policy, risk management, assurance and promotion are the “four pillars of SMS,” according to Kelly. Policy, he said, controls the other three through procedures and process controls. Risk management consists of system description, hazard recognition, analysis, assessment and control of risk. Assurance includes data from audits, investigations and reports, analysis, assessment, prevention and corrective action. Promotion aims to foster a just safety culture through communication and training.

Lessons Learned from Recent Accidents

Turning to the subject of airmanship, Jim Burin, FSF director of technical programs, noted that while runway incursions have received considerable FAA attention, they constitute only a small percentage of accident causes. Incursions such as the 1977 Tenerife runway collision of two 747s receive wide publicity. However, the runway excursion–an uncontrolled or marginally controlled departure from the end or side of the landing surface–accounts for most of the accidents and incidents in the runway environment. Of 1,429 runway accidents between 1995 and 2008, some 75 percent were excursion.

“A runway excursion is not usually a total surprise to the crew,” Burin noted. He listed avoidance measures such as, foremost, adherence to stabilized approach criteria. Close behind came a true no-fault go-around policy, followed by training in decision-making at or near the threshold.

He conceded that ATC plays a big role in runway excursions, by “slam dunk” descents and other commands that can cause an unstable approach. Among the Top 10 factors leading to runway excursion Burin listed unsuccessful takeoffs rejected after V1, and landing rather than going around out of a fast approach to a fast and long touchdown. Further down the list was thrust reverser malfunction.

In a significant number of cases a combination of factors existed, including a contaminated (water-covered or icy) runway surface and a crosswind or tailwind. In such cases, the former Navy attack pilot and air wing commander emphasized maintaining a stabilized approach with immediate thrust reverser deployment, after determining that sufficient runway is available given the conditions. He recommended the FSF’s Alar Tool Kit CD for detailed guidance.

Addressing a subject closely related to maintaining a stabilized approach, John Cox asked, “Why are professional aviators stalling airplanes?” The CEO of D.C.-based consulting firm Safety Operating Systems called for updated knowledge and training to prevent in-flight upset. While “upset” could include sudden departure from controlled flight in a high-altitude “coffin-corner” clear-air turbulence encounter, most, Cox said, happen in the approach and landing environment following failure to maintain a stabilized approach.

“CFIT numbers have decreased over time, much of that due to Taws. But loss-
of-control numbers are getting worse, including stall-spin, which is number one. Why,” he asked, “are professional aviators stalling airplanes?” He cited lack of recognition and recovery. Cox showed a detailed visual simulation of Colgan Flight 3407’s last moments at Buffalo, N.Y., on Feb. 12, 2009. Pointing out the control yoke positions, as well as primary flight display tapes of power, gear and flap settings, he concluded, “The aircraft stalled three times! This was a case of ineffective training.”

Later, NTSB member Robert Sumwalt III quoted from the Board’s finding on the Colgan 3407 accident: “…flight deck chatter irrelevant to conduct of a flight distracted crew from performing essential duties…” thus causing unnecessary delay in configuring the aircraft for landing.

Turning to the high-altitude case, Cox said, “We don’t teach high-altitude stalls.” He said too many pilots do not realize that at high flight levels it might not be possible to power out of an incipient stall. Attempting to will likely produce an accelerated stall. “Ailerons are ineffective. The only recourse is to reduce angle of attack.”

Simulators, Cox pointed out, will not replicate all stall conditions. He then showed a short video of how Boeing test pilots “did it right” to recover control after an upset, stall and inverted nose-down attitude at 15,300 feet in a fly-by-wire aircraft.

Sumwalt cited details of a fatal Learjet 60 accident initiated by tire under-inflation, which caused it to fail close to V1 speed. The Board found that attempting a rejected takeoff after V1 is a major accident cause, exacerbated by thrust reversers being disabled by debris from the disintegrating tire. “Some operators are not sufficiently aware of tire inflation intervals,” Sumwalt quoted from the finding. It has been recommended, he added, that the FAA “require a remote tire pressure monitoring system on all transport-category aircraft” as with current automobiles.
Matt Zuccaro, president of the Helicopter Association International, reported that HAI has reached its 10-year safety goal of an 80-percent reduction in the rotorcraft accident rate. Technology “is no magic bullet,” he averred, expressing a strong preference for training. He outlined ADS-B operations over the Gulf of Mexico since January, citing the resulting gains in safety and utility for helicopter operators. The helicopter accident rate is unrealistically high as reported, Zuccaro claimed, because total rotary-wing flight hours are under-reported. He added that HAI is seeking to change the term EMS (emergency medical service) to helicopter medical transport in hope of reducing a public perception of rotary-wing medical transport as risky.

Todd Chisholm, managing director of V2climb, had some good news about a voluntary, non-jeopardy incident-reporting system by line operations people. These reports are protected from FAA certificate action. The bad news: the advisory circular establishing the ASAP reporting program limits it to Part 121 and Part 135 operators.

Chisholm seeks to establish what he dubs ASAPv2.0, a corporate aviation safety-reporting program that he called “a safety reporting system multiplier that would provide a researchable database.”

Steve Charbonneau offered “Stabilized Landing Criteria: A Practical Application of the C-FOQA Program.” The senior aviation safety and security manager for Altria Client Services of Richmond, Va., said the stabilized approach criteria concept will focus pilot attention on risky practices.

It would revise landing distances given on type certificates to more realistic
“real-world” numbers. Charbonneau said a C-FOQA monitoring program can provide a precise breakdown of landing criteria and encourage improved landing performance. The standard should be, he suggested, “Plan for the worst; hope for the best.”

The safety benefit of head-up display (HUD) guidance could reduce approach and landing accidents just as EGPWS technology has reduced CFIT mishaps, suggested Flight Safety Foundation fellow Robert Vandel. He showed a video of actual flight seen through a Collins HUD combiner aboard an Embraer E190. A flight path vector cue overlaying a guidance cue with flare guidance to touchdown in addition to flight path accelerations showed how the 90-passenger airliner could be “hand flown” to a perfect spot landing. “It makes energy management intuitive,” Vandel said.

Renee Dupont-Adam, v-p of System Safety Services, presented an outline of the causes of maintenance errors. She noted that human-factors training for maintenance techs is mandatory in Canada and will be “eventually in the U.S.” Alexandra Holmes of Clockwork Research touched on one possible cause of maintenance error: fatigue. She said a more flexible alternative to rigid duty-time hour limits has been in force in Australia and New Zealand since 1995, and suggested that fatigue risk-management systems could apply SMS protocols to aviation personnel. Ed Williams, CEO of the Metropolitan Aviation Group, announced that a significant number of corporate operators are extending to their maintenance personnel the same duty-time limits for flight crews.