Safety management systems

Certification, production approval, maintenance programs and directives are all forms of compliance: meet the rule, and the aircraft is safe. Experience has shown that compliance alone is not enough. Accidents happen to organizations that meet every rule, because rules cannot anticipate every hazard and because organizations drift, a little at a time, from the way they intended to work. A safety management system (SMS) is a structured way for an organization to find its own hazards, assess the risks, control them and check that the controls work. This lesson explains the international framework, the rules in each country and how Kivalliq Air Link and Borealis Aerospace apply it to the Petrel 19.

The international framework

ICAO Annex 19, Safety Management, consolidated safety management requirements from several annexes and became applicable in 2013; a second edition followed in 2016. It requires each state to have a state safety program, through which the authority manages safety across the aviation system, and requires service providers such as operators, maintenance organizations, design and manufacturing organizations, training organizations and air navigation service providers to implement an SMS acceptable to the state. The ICAO Safety Management Manual, Document 9859, gives detailed guidance.

Annex 19 describes an SMS in four components, often called pillars. Each has several elements, but the four are the essential structure.

The rules in each country

In Canada, SMS requirements are set out in CAR 107 and in the operating parts of the CARs. They apply to airlines operating under Subpart 705, to approved maintenance organizations that maintain aircraft for those airlines, and to certain other certificate holders, while TCCA continues to work on extending them more widely. Kivalliq Air Link operates under Subpart 704, where an SMS is not yet required for all commuter operators, but its board decided to implement one when it ordered the Petrel 19: a new aircraft type, with a new kind of powertrain, on demanding routes, is exactly the kind of change an SMS is designed to manage. Borealis Aerospace has also adopted an SMS for its design and production organization, following the ICAO model and anticipating future requirements.

An SMS does not replace compliance. The rules still apply. What the SMS adds is an obligation to look beyond them: to identify hazards specific to the organization's operations, assess them and decide what to do. A regulator overseeing an organization with an SMS looks not only at whether rules are met, but at whether the organization's own processes find and control risk effectively.

Safety policy and accountability

Every SMS starts with an accountable executive: a single, identifiable person who has authority over the organization's resources and is accountable for its safety performance. For Kivalliq Air Link this is the president. The accountable executive signs the safety policy, which commits the organization to safety objectives, to non-punitive reporting and to providing the resources needed. Below the executive, a safety manager runs the system day to day, but cannot be the only person responsible for safety; each line manager is accountable for the risks in their own area.

The safety policy must include the conditions under which disciplinary action would be considered. This is the core of a just culture. People who report errors and hazards in good faith are protected; people who act with gross negligence, wilful violation or deliberate harm are not. Without this distinction, nobody reports their mistakes, and the organization loses its best source of information. With it, reporting becomes a normal part of work. Kivalliq Air Link's policy states the line clearly and gives examples.

Safety risk management

Hazards are identified from many sources: mandatory and voluntary reports, audits, investigations, flight data monitoring, maintenance findings, changes to the operation and the experience of other operators. Each hazard is then assessed for the severity of its worst credible outcome and the likelihood of that outcome. A risk matrix combines the two into a level that tells the organization whether the risk is acceptable, tolerable with mitigation or intolerable.

At the first safety review board meeting after the Petrel 19 enters service, the safety manager presents four hazards from the first months of operation. The code below scores them on Kivalliq Air Link's five-by-five matrix and tracks a safety performance indicator, unstable approach reports per thousand sectors.

# SMS risk matrix and a safety performance indicator for the operator.
sev = {'negligible': 1, 'minor': 2, 'major': 3, 'hazardous': 4, 'catastrophic': 5}
lik = {'extremely improbable': 1, 'improbable': 2, 'remote': 3, 'occasional': 4, 'frequent': 5}
def risk(s, l):
    r = sev[s] * lik[l]
    return r, ('intolerable' if r >= 15 else 'tolerable with mitigation' if r >= 6 else 'acceptable')
hazards = [('gravel damage to propeller', 'major', 'occasional'),
           ('battery overtemperature on ground charge', 'hazardous', 'remote'),
           ('wrong fuel load sheet', 'major', 'remote'),
           ('runway excursion on icy gravel', 'catastrophic', 'remote')]
for h, s, l in hazards:
    r, cat = risk(s, l); print(f"{h:42s} {r:2d}  {cat}")
reports = [14, 11, 17, 9, 12, 15]; sectors = [3100, 2900, 3300, 2800, 3000, 3200]
spi = [1000 * r / s for r, s in zip(reports, sectors)]
print("unstable approach reports per 1000 sectors:", ', '.join(f"{x:.1f}" for x in spi))
print(f"six-month average {sum(spi)/len(spi):.2f}; target below 4.0")

gravel damage to propeller                 12  tolerable with mitigation
battery overtemperature on ground charge   12  tolerable with mitigation
wrong fuel load sheet                       9  tolerable with mitigation
runway excursion on icy gravel             15  intolerable
unstable approach reports per 1000 sectors: 4.5, 3.8, 5.2, 3.2, 4.0, 4.7
six-month average 4.23; target below 4.0

Three hazards score in the tolerable band. Gravel damage to propellers, a major outcome on an occasional basis, scores 12, as does battery overtemperature during ground charging, a hazardous outcome assessed as remote. A wrong fuel load sheet scores 9. These need mitigation and monitoring but are not a reason to stop operations. A runway excursion on an icy gravel runway, catastrophic and remote, scores 15 and is intolerable: the operator must reduce the risk before continuing the operation as it stands. The board responds by introducing a runway condition assessment before every landing at gravel strips in freezing conditions, with landing weight limits tied to the reported braking action, and by asking Borealis Aerospace for performance data on contaminated gravel that the original flight manual did not include.

A risk matrix is a communication tool, not a calculation. The numbers are ordinal labels, and multiplying them is a convention rather than a measurement. Two hazards with the same score may deserve very different responses, and judgment must be applied. Its value is that it forces an explicit, recorded decision about each hazard, by someone with the authority to act.

Safety assurance

Safety assurance checks whether the risk controls work and whether the organization's safety performance is improving. It uses safety performance indicators, measured regularly and compared with targets. The unstable approach indicator in the code averages 4.23 reports per thousand sectors over six months, against a target of below 4.0. The monthly values range from 3.2 to 5.2, so a single month says little, but the average is above target, and the safety manager opens a review. It finds that most unstable approaches occur at two airports with steep approach paths, where the Petrel 19's regenerative descent mode, which recovers energy into the battery, behaves differently from the crews' previous aircraft. The response combines a training module and a change to the recommended descent profile.

Management of change is the second key element of assurance. Any significant change, such as a new aircraft type, a new route, a new maintenance contractor or a reorganization, must be assessed for hazards before it is made. The Petrel 19's introduction was itself a change assessed this way: the operator listed every difference from its previous fleet, from high-voltage ground handling to battery charging in cold weather, and assigned a risk owner for each.

Internal audits and evaluations complete the picture. They check not only compliance but whether the SMS processes are working: are reports investigated, are actions completed, do managers review indicators? An SMS that produces reports but no actions is an SMS in name only.

Data and reporting programs

An SMS runs on information, and the organization's internal reporting system is only one source. Kivalliq Air Link also runs a flight data monitoring program, downloading data from each Petrel 19 and screening it for exceedances such as high descent rates, late configuration or hard landings. The data are de-identified, and the agreement with the pilots' representatives states that they will be used for safety, not discipline. Outside the company, the Transportation Safety Board's confidential reporting program, SECURITAS, lets anyone report a safety concern without being identified, and TCCA's own reporting channels receive concerns about regulatory compliance. The safety manager reads both the internal reports and the published service difficulty data for the type each month.

The value of these programs depends on trust. If a single report is used against its author, reporting falls immediately and recovers slowly. Data programs also need analysis capacity: a small operator can collect far more data than it can study. Kivalliq Air Link shares de-identified flight data with Borealis Aerospace, which has the engineers to look for patterns across operators, and in return receives analysis of its own fleet compared with the average. This is how the regenerative descent issue was confirmed as a type characteristic rather than a local training problem.

Safety promotion

An SMS depends on people. Staff need training appropriate to their roles, from a short awareness module for everyone to detailed training for safety investigators. The organization must communicate: why a change was made, what was learned from a report, what the indicators show. Reporters need to hear what happened to their reports. When a ramp agent reports a battery charging cable left across a walkway and then sees a new cable management procedure a month later, the next report comes more easily.

SMS in design and manufacturing

For Borealis Aerospace, an SMS adds something new to the design and production processes covered in Lessons 3 to 5. The certification process already analyses the design's hazards, but an SMS asks the organization to examine its own processes as sources of risk: how design changes are reviewed, how service data reach the engineers, how production problems are escalated, how supplier changes are detected. It also links the company's design safety assessment with the operators' hazard data. When Kivalliq Air Link's SMS identified gravel damage to propellers, the information came to Borealis Aerospace's in-service engineering team as a hazard report, not just as a parts order, and led to an evaluation of propeller blade leading-edge protection.

Rachel Oduya sees the design organization SMS as a complement to the delegation system from Lesson 2. Both depend on the organization being honest with itself. A delegate who feels pressure to make a finding and a manager who hears about a production problem and decides not to escalate it are the same kind of failure, and an SMS gives both a channel and a protection to speak up.