Griffith Aviation Assignment: 3515NSC Safety …michellekshiels.weebly.com/.../safety_management_report.pdfMichelle Shiels S2942509 3515NSC Safety Management Written Assignment Page

Michelle Shiels S2942509 3515NSC Safety Management Written Assignment Page 1 of 15

Griffith Aviation

Assignment: 3515NSC

Safety Management

Due:1700 015 May 2015

Assignment: Air Ontario Written Assignment

Weight: 30%

Word Count: 1982 words

Student Name: Michelle Shiels

Student Number: S2942509


Abstract

On March 10, 1989 an Air Ontario Fokker F-28 Mk1000 (registration C-FONF) crashed on take-

off from Dryden Municipal Airport, Canada, at 12.11pm Central Standard Time. Flight 1363 had

been travelling from Thunder Bay to Winnipeg via Dryden. Of its 65 passengers, 21 died, as well

as Captain George Morwood, First Officer Keith Mills and one of two flight attendants aboard.

The initial cause found for the incident was ice contamination which led to a loss of lift. Previous

incidents of a similar nature had attributed sole responsibility to the captain of the aircraft;

however the report issued by Virgil Moshansky (1992) identified a complex system with failures

on many levels, each of which contributed to the accident. As a result, the Dryden incident has

become a study in how to create, implement and monitor an effective Safety Management

System (SMS).


Table of Contents

1. INTRODUCTION .................................................................................................................................. 4

2. IDENTIFIED SAFETY DEFICIENCIES AT AIR ONTARIO ......................................................................... 5

2.1 Incompatible Goals.................................................................................................................... 5

2.2 Organisational Deficiencies ....................................................................................................... 5

2.3 Poor Communications ............................................................................................................... 6

2.4 Poor Defences against Design Failures ..................................................................................... 6

2.5 Poor Defences against Hardware Failures ................................................................................ 6

2.6 Poor Training ............................................................................................................................. 6

2.7 Poor Procedures ........................................................................................................................ 7

3. HAZARD IDENTIFICATION AND MITIGATION .................................................................................... 8

3.1 Safety Policy and Objectives ..................................................................................................... 8

3.2 Safety Risk Management ........................................................................................................... 9

3.3 Safety Assurance ....................................................................................................................... 9

3.3 Safety Promotion .................................................................................................................... 10

4. CONCLUSION .................................................................................................................................... 11

References ............................................................................................................................................ 12

APPENDICES .......................................................................................................................................... 13

A: Example of a Safety Policy Statement ...................................................................................... 13

B: Example of key safety personnel placement within an organisation ....................................... 14

C: Risk Management Process and Risk Analysis Matrix ............................................................... 15


1. INTRODUCTION

“When anyone asks me how I can best describe my experience in nearly forty years at sea I merely

say uneventful… I have never been in an accident of any sort worth speaking about… I never saw a

wreck and have never been wrecked, nor was I ever in any predicament that threatened to end in

disaster of any sort.”

Captain John Edward Smith, H.M.S. Titanic (New York Times, 1912)

The statement above derives its poignancy from the fate of its author, which was to become a part

of one of the greatest disasters in history. It highlights that a period of time without accidents does

not necessarily indicate an absence of hazards. The system approach to safety management

recognises that humans make mistakes, and plans for multiple levels of redundancy to prevent a

single error from causing catastrophic consequences (Reason, 2000, p.768). The system will only fail

when it is neglected to the point of failure occurring on multiple levels, as was the case with Air

Ontario. The Reason model of General Failure Types (Figure 1.1) depicts how process failures in

various areas of an organisation contribute to error-enforcing conditions. There is considerable

overlap, and it is important to note

that failures at the top of the

organisation filter down to other

areas. In the case of Air Ontario,

latent failures as high as goals of the

organisation affected error-enforcing

conditions. This filtered down to

affect the company’s organisation,

communications, design, hardware,

training and procedures. This report

will identify deficiencies that existed

at Air Ontario and then outline how the

implementation of an SMS could have

avoided the accident.

Figure 1.1: The relationship between General Failure Types, Safety Management System Processes and Error Enforcing Conditions. (Reason, 1997, p.136)


2. IDENTIFIED SAFETY DEFICIENCIES AT AIR ONTARIO

2.1 Incompatible Goals

2.1.1 Air Ontario was a growing company, making its first movements into jet operations.

Productivity was seen to be more important than protection due to economic pressure. The conflict

is evident in Air Ontario’s mission statement (June 17, 1988):

“The creation of a safe and reliable diversified Air Transportation system serving Central Canada and

Northern United States, whose primary goal is the maximisation of profitability and return on its

shareholders’ investment while optimizing feed traffic to and from the Air Canada network.”

2.2 Organisational Deficiencies

2.2.1 Safety audits were not conducted in an effective manner. Air Ontario did not conduct internal

audits, although Air Canada did perform an audit on the company via a contractor as part of its

operational review when it obtained controlling interest in the company. William Rowe, member of

the Board of Directors for Air Canada expressed dissatisfaction with the audits conducted on Air

Ontario, as logbooks, aircraft and maintenance records were not examined as thoroughly as he

would have expected them to be. It did not assess Air Ontario’s new F-28 jet program and the fact

that Air Ontario had no Flight Safety Officer (FSO) was not reported.

2.2.2 For a period of more than 12 months leading up to Dryden Air Ontario did not have an FSO.

This is particularly significant as a new aircraft type, the F-28, was being introduced to the fleet. In a

reactive measure, Air Ontario appointed Captain Ronald Stewart as FSO to head their internal

investigation into the incident.

2.2.3 The role of the project manager for the F-28 jet program was not formally defined, and was

carried out by the Chief Pilot in addition to his regular duties, overburdening his workload.

2.2.4 The position of F-28 project manager was filled by an individual without the necessary

experience.

2.2.5 No supervision of the F-28 project manager was in place.

2.2.6 Check Captains received inadequate company support, as cited by Check Captain Castonguay,

who resigned in 1988 after just 6 weeks.


2.3 Poor Communications

2.3.1 Reporting systems lacked confidentiality. Air Ontario FSO Captain Ronald Stewart initially set

out to conduct a phone survey of F-28 pilots, however he discontinued the survey after just 5 calls

because a pilot in a position of superiority became emotional about the possibility of incrimination.

2.3.2 Reporting systems lacked documentation, accountability or assurance of feedback. Two

incidents of a similar nature had occurred prior to Dryden, involving Air Ontario F-28s in icing

conditions. Causal investigations were not conducted, and information was passed onto other pilots

in the form of a bulletin containing generalised information.

2.4 Poor Defences against Design Failures

2.4.1 The aerodynamic design of the F-28’s wings makes it extremely intolerant to even a small

amount of ice accretion. Previous reports of icing incidents had not been acted upon in an effective

manner.

2.4.2 Two previous incidents of a similar nature had occurred, which Air Ontario had failed to

investigate and learn from.

2.5 Poor Defences against Hardware Failures

2.5.1 Air Ontario did not have a Minimum Equipment List (MEL) in place for the F-28.

2.5.2 Smoke was reported in the cabin of the F-28 four days prior to the accident. This was found to

be caused by oil leakage from the APU. The APU was not fixed. The APU was not working on the day

of the accident.

2.5.3 Air Ontario had a history of deferred maintenance due to a shortage of parts.

2.6 Poor Training

2.6.1 Air Ontario did not have any pilots who were experienced with the F-28, and outside resources

were not utilised. Management determined that flying the aircraft more would solve this problem.

2.6.2 F-28 training manuals and training syllabi had not been developed by Air Ontario at the time

the aircraft began operations.


2.6.3 The Systems Operational Control (SOC) dispatcher for Air Ontario in London dispatched a flight

release containing numerous errors. SOC provided no training on the F-28 to dispatchers when the

aircraft was introduced to the fleet.

2.6.4 There was a low level of F-28 expertise in Air Ontario Maintenance Operations.

2.7 Poor Procedures

2.7.1 A survey revealed that Air Ontario pilots felt that Safety Operating Procedures (SOP) were not

written or controlled well enough.

2.7.2 Policies were not in place to prevent the operation of the F-28 without a standard operating

procedures manual (SOP) or Minimum Equipment List (MEL).

2.7.3 Policies were not in place requiring Air Ontario to have scheduled internal audits.

2.7.4 No policies were in place to require pilots to de-ice a second time before departure. Some Air

Ontario pilots were not even aware that de-icing was available at Dryden. The Route Manual did not

contain these services.

2.7.5 No procedures were in place to assist pilots with dealing with the fuel load/pax last minute

changes (as per Dryden) that were common with Air Ontario.

2.7.6 Captain Morwood was forced to refuel at Dryden with one engine running due to the broken

APU. No operational guidance was provided for refuelling/de-icing procedures with the engines

running.

2.7.7 The first officer observed snow on the wings prior to take-off (looking out the cockpit window).

A flight attendant observed a thick layer of clear ice on the wings prior to take-off (looking out the

cabin window). No procedure existed instructing the pilot to observe the wings from the cabin.


3. HAZARD IDENTIFCATION AND MITIGATION

“We cannot change the human condition but we can change the conditions under which humans

work.”

James Reason, 2000, p.769

If we are to accept that humans will always make mistakes, then it is necessary to implement an

effective Safety Management System (SMS) to provide redundancies as a safeguard against human

error (Simmons, 1989, p.13). The Australian Civil Aviation Safety Authority defines SMS as “a

systematic approach to managing safety, including the necessary organisational structures,

accountabilities, policies and procedures,” (CASA, 2009, p.8).. The 12 Elements of SMS (categorised

under 4 Elements) provide a sound guideline for the creation of such a system (ICAO, 2013, 5.3).

What follows is an outline of SMS features that Air Ontario could have implemented, which would

have spared them the Dryden occurrence. Specific deficiencies that would have been addressed by

these measures are listed at the conclusion of each section.

3.1 Safety Policy and Objectives

3.1.1 Development of a Safety Policy Statement which explicitly detailed the company’s SMS (and

how it conformed to regulations), committed management to achieving high safety standards, and

described how safety would be monitored and improved upon (Appendix A).

3.1.2 Communication of the Safety Policy Statement and associated safety goals to staff.

3.1.3 Appointment of key safety personnel, who were qualified, trained, dedicated to their

respective areas and exercised a degree of independence from management (Appendix B).

3.1.4 Creation and communication of clear definitions of the safety responsibilities and

accountabilities for each role within the company.

3.1.5 Development of an Emergency Response Plan delegating personnel and resources to specific

areas in the event of an emergency.

3.1.6 Development of an SMS manual containing the Safety Policy Statement, legislated SMS

requirements, policies and procedures related to SMS, accountabilities and responsibilities of

personnel and company SMS goals.


3.1.7 Development of safety policies to address known issues encountered within the company, such

as de-icing procedures, fuel load/passenger last minute changes and standardised icing check

procedures.

3.1.8 Development of a Minimum Equipment List for each aircraft type held by the company,

specifying who was accountable for ensuring parts were available.

Deficiencies Addressed: All deficiencies are directly affected by safety policy and objectives and

management’s commitment to safety.

3.2 Safety Risk Management

3.2.1 Utilisation of a standardised risk management process involving identification (linked to

reporting systems and audits), analysis of probability and severity (Appendix C), assessment and

mitigation.

3.2.2 Regularly scheduled safety meetings for each sector of operations as well as meetings between

safety officers and management to pass on safety critical information and discuss safety data

collected in safety assurance processes.

Deficiencies Addressed: 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.3.1, 2.3.2, 2.4.1, 2.5.2, 2.5.3, 2.7.3.

3.3 Safety Assurance

3.3.1 Implementation of a

voluntary reporting system

that was confidential, non-

punitive and accessible. The

Head of Safety could have

been responsible for

reviewing data, implementing

appropriate actions, providing

timely feedback to the

reporting agent and

documenting the process in a

Figure 3.1: Characteristics of an effective reporting system (ICAO, 2013, Figure 2.7)


centralised data base.

3.3.2 Development of a policy outlining occurrences for which it would have been mandatory that

employees report.

3.3.3 Development of a policy which mandated a schedule for comprehensive internal and external

safety audits (which included contractors). These audits would have gathered information to drive

continuous improvement of the SMS.

3.3.4 Appointment of a qualified project manager who was dedicated to overseeing any major

change implemented by the airline and who was supervised by and accountable to the Head of

Safety.

3.3.5 Development of a policy which mandated minimum requirements for training, documentation

and resources (e.g. manuals, training materials, spare parts) prior to the introduction of a new

aircraft type, and which spanned Systems Operation Control, Flight Operations and Maintenance

Operations.

3.3.6 Development of a policy which mandated compulsory safety reviews upon the introduction of

any significant change. Checklists, surveys and confidential interviews could have formed part of the

review.

Deficiencies Addressed: 2.2.1, 2.2.2, 2.2.5, 2.3.1, 2.3.2, 2.4.1, 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.6.2, 2.6.3,

2.6.4, 2.7.1, 2.7.2, 2.7.3.

3.4 Safety Promotion

3.4.1 Development of a Safety Induction Manual for each operational sector, which would have

contained a checklist of safety items for new employees to be introduced to upon entry to the

company, and specified who was accountable for inducting new employees. It could have included

company safety policy, roles and responsibilities, details of the reporting system and general SMS

principles.

3.4.2 The provision of ongoing safety training (professional development) specific to each

employee’s role within the company (including senior management).

Deficiencies Addressed: 2.2.6, 2.3.1, 2.3.2, 2.4.1, 2.7.4, 2.7.5, 2.7.6, 2.7.7.


4. CONCLUSION

Although companies place

strong focus on profitability,

nothing should be more

important that creating a

culture of safety in an

organisation, bearing in mind

the adage, “If you think

safety is expensive, try an

accident,” (Chamberlain,

1996, p.20; Peterson, 1996,

p.65). Air Ontario stands as a

poignant example of this. For it to be effective, safety culture needs to filter down from the top of

the organisation to permeate every level (ICAO, 2013, 2.6.5). “Practical drift” occurs from baseline

safety in any system, and so the company must commit to undertaking continual SMS monitoring,

measurement and improvement (ICAO, 2013, 2.3.15). Had Air Ontario implemented the SMS

features outlined in this report, the deficiencies that were contributory factors at Dryden would not

have cumulated in such a catastrophic event. If anything positive has emerged from Dryden, it is the

opportunity to learn from the mistakes that were made, and recognise the critical nature of SMS in

any organisation.

Figure 4.1: James Reason’s Safety Space Model (ICAO, 2013, Figure 2.6)


REFERENCES

Civil Aviation Safety Authority (CASA) (2009). Safety Management Systems for Regular

Public Transport Operations. Civil Aviation Advisory Publication (CAAP).

Chamberlain, H. Dean (Sept 1996). “Thinking Safety” in FAA Aviation News. U.S.

Department of Transport, Washington. (Pp.20-24)

Commission of Inquiry into the Air Ontario Crash at Dryden, Ontario (Canada), &

Moshansky, V. P. (1992). Final report. Ottawa: The Commission.

Hudson, Patrick. (2014). “Accident Causation Models, Management and The Law” in the

Journal of Risk Research. Vol.17. No.6. (pp.749-764)

International Civil Aviation Organization (ICAO). (2013). Document 9859 Safety

Management Manual (SMM) – Third Edition. Published by the International Civil Aviation

Organisation, Montreal, Quebec, Canada.

New York Times (16th

April, 1912). Disaster At Last Befalls Capt. Smith. [online resource].

Retrieved 4th

May, 2015 from http://www.encyclopedia-titanica.org/disaster-at-last-befalls-

capt-smith.html

Peterson, D. (1996) “The Management System to Build Culture” in Analysing Safety System

Effectiveness – 3rd

Edition. Van Nostrand Reinhold, New York. (pp.65-88)

Reason, James. (1997). Managing the Risks of Organisational Accidents. Aldershot: Ashgate

Publishing.

Reason, James. (2000). “Human Error: Models and Management” in BMJ: British Medical

Journal. Volume 320, Issue 7237. (Pp.768-770)

Simmon, David A. (April/June 1989). “Model Airline Safety Program” in Airliner

Magazine. Pp. 13-16.

http://www.encyclopedia-titanica.org/disaster-at-last-befalls-capt-smith.html

http://www.encyclopedia-titanica.org/disaster-at-last-befalls-capt-smith.html


Appendix A – Example of a Safety Policy Statement (ICAO, 2013, Figure 5.1)


Appendix B – Example of key safety personnel placement within an organisation.


Appendix 3 – Risk Management Process and Risk Analysis Matrix (ICAO, 2013, Figures 5.2 and 5.5)

Documents

Griffith Aviation Assignment: 3515NSC Safety …michellekshiels.weebly.com/.../safety_management_report.pdfMichelle Shiels S2942509 3515NSC Safety Management Written Assignment Page