Periodically, the National Transportation Safety Board will reiterate its recommendation that the Federal Aviation Administration mandate safety management systems (SMS) for Part 135 aviation operators. That includes most commercial operators apart from Part 121 commercial airlines, for which SMS is already required.
The NTSB did so again recently in the context of the helicopter crash in Calabasas, California, that killed nine people including Kobe Bryant. That’s curious on the face of it, because the operator of the accident helicopter, Island Express, actually had an SMS.
“Ah, but!” the NTSB essentially said. “Island Express did not have a fully implemented SMS.”
This is almost always the response anytime an operator with a safety management system has an accident. For me, it invariably calls to mind the “appeal to purity” logical fallacy, also known as “No True Scotsman.” In its most famous example (thanks, Wikipedia!) it goes something like this:
Person A: “No Scotsman puts sugar on his porridge.”
Person B: “But my uncle Angus is a Scotsman and he puts sugar on his porridge.”
Person A: “But no true Scotsman puts sugar on his porridge.”
See what I’m driving at?
Person A: “No operator with an SMS will have a preventable accident.”
Person B: “But this operator has an SMS, and they just had a preventable accident.”
Person A: “But no operator with a fully implemented SMS will have a preventable accident.”
Now this is not totally fair — almost no one maintains that a safety management system will prevent every accident, because such a claim would be foolhardy. But however you want to define the value of an SMS, you can plug it into this formula just the same.
I am not against safety management systems. I think they can be a wonderful tool, because they’re based on a simple but powerful premise — that a formal, structured approach to searching for and documenting hazards can help companies recognize and address problems before they turn into accidents. The larger the organization, the more complex this process will necessarily be, and the type of detailed, prescriptive SMS described at length in the FAA’s advisory circular for Part 121 air carriers might well be appropriate for an operator the size of Delta Air Lines.
The problem is that an entire industry has now sprung up to force this prescriptive framework on small operators, too, even when it is not obviously appropriate. Sure, this “SMS Industrial Complex” may tell you that safety management systems must be tailored to the size of the operator, but good luck convincing a regulator or independent auditor that you’re meeting the spirit of an SMS if you can’t point to the management titles and documentation they’re familiar with.
As Bill Voss observed in a 2012 column in AeroSafety World, much of what passes for SMS consulting is simply a regurgitation of International Civil Aviation Organization (ICAO) guidance material: “The ICAO guidance was built around the ‘four pillars,’ so now everybody has an SMS with four pillars. And of course, now every regulator has a checklist that counts the pillars.” (Naturally, Island Express’s SMS had those same four pillars.)
From what I’ve seen in the helicopter industry, small operators aren’t deriving much benefit from this framework established for much larger organizations. I shared my frustrations with Andy Evans, director of the aviation consultancy Aerossurance, who agreed, “There is little evidence the standard SMS concepts in regulators’ guidance and parroted as gospel by many readily work in smaller operators, where flying rates are low, personnel turnover is often relatively high, and operations highly varied. Often the refrain is, ‘an SMS doesn’t have to be complicated,’ but normally the SMS simplification sacrifices valuable actionable insight for just documenting busy but delusionally fruitless activity.”
To be sure, absence of evidence is not evidence of absence, and it is difficult to conclusively demonstrate the value of any safety approach in an industry like aviation, where adverse events have high consequences but happen relatively rarely. What we can say confidently is that a “partially implemented” SMS — the sort of half-hearted program adopted by Island Express — is not effective in preventing accidents.
NTSB investigators found numerous deficiencies with Island Express’s SMS, as had previous customer audits. An October 2019 audit by Chevron, their fifth audit of Island Express since June 2011, found that the safety manager had no formal safety training and the company was not using its SMS to conduct any proactive hazard analysis — which, of course, is the entire point of an SMS.
Perhaps the clearest evidence that Island Express’s SMS was nothing more than a fruitless paperwork exercise can be found in its flight risk analysis form, which pilots were required to complete before every flight. Aerossurance’s Evans points out these are “a very U.S.-centric feature of SMS concepts. Rather than be genuinely proactive, they are a last-minute bureaucratic burden on frontline pilots that have almost always predicted a low-risk flight when they feature in NTSB accident reports.” According to one former Island Express pilot, the form was written in such a way that flights would never be scored as high risk. “To get to the red [high risk] it would have to be an apocalyptic type scenario to get to that level,” he told investigators.
The consequences of this were evident on the accident flight. The weather was bad enough that morning that other operators were grounded, yet the accident pilot concluded his trip had a risk score of 12 — on a scale where 45 was the threshold for “elevated risk.” He ended up flying into a cloud and succumbing to spatial disorientation.
Incentivizing safety
Every proponent of SMS will tell you that “buy-in” and leadership by senior management is critical to making a safety management system work. That leadership was clearly missing at Island Express, yet the NTSB is adamant that Island Express is not “uniquely unsafe.” To my mind, that’s because many small helicopter operators have safety management systems that are equally worthless (which perhaps explains why Chevron continued to use Island Express even after documenting its audit findings). As SMS has become a more common contract requirement, Part 135 operators have rushed to buy pre-packaged solutions that “tick the box” but make no meaningful contribution to safety.
If leadership from the top is so essential to the success of SMS, is there even a way to achieve that through regulation? Actually, I think there probably is, but it’s not by making safety management systems mandatory. No, you can’t regulate that business owners suddenly start caring about safety above all else — but you can create incentives that make them act like they do.
Consider Part 121 air carriers, which have an exceptional safety record. That is not because they have safety management systems; it is because they have extraordinarily compelling financial incentives to maximize safety, and the volume of flight operations necessary to justify large investments in standardization and training. Airline crashes are high profile in a way that Part 135 crashes (unless they have a celebrity onboard) are not, and even minor accidents can shake the confidence of their enormous customer base. That acts as a safety carrot, but there’s also a stick in the form of stringent oversight by the FAA, likewise driven by the high-profile nature of the industry. For airlines, SMS is an efficient tool to help them actually achieve this desired high level of safety, and not an end in itself.
What’s different about the Part 135 sector? Besides the factors mentioned by Evans, there’s also a more permissive regulatory environment, much less oversight by the FAA, and consumers who are generally naïve to those facts. Accustomed to the robust safety protections of the airlines, many passengers might happily assume that their on-demand helicopter charter represents the same high level of safety. They would, of course, be wrong.
These differences could point the way to regulations that would create a compelling business case for increasing the safety of Part 135 operations, which doesn’t really exist in today’s competitive, low-volume operating climate. What might those regulations be? I’m not sure, but I think this is a more profitable line of inquiry than simply calling for mandatory SMS. If Part 135 operators have a reason to prioritize safety, then they’ll also have a reason to embrace the tools that enable it.
The NTSB contends that making safety management systems mandatory for Part 135 operators would introduce an oversight component that would make them more effective. Yet as the NTSB’s own investigations have shown time and time again, the FAA isn’t doing a great job of surveilling Part 135 operators to begin with. It would be absurd to assign a helicopter pilot with no Part 121 airline experience as a principal operations inspector for Delta, yet many POIs assigned to Part 135 operators have no relevant experience with the aircraft or operations they’re tasked with overseeing. That makes them blind to many safety issues that would be readily apparent to professionals with deeper knowledge of these operations.
And there’s no reason to believe that saddling these inspectors with additional paperwork would improve their perceptiveness. In 2014, I contacted the air medical operator Air Methods to ask about an incident in Texas involving one of their Airbus AS350 helicopters, which had caused the manufacturer to issue a safety notice warning of the possibility of taking off without hydraulic assistance to the tail rotor. Air Methods declined to comment. Eleven months later, the company suffered a fatal crash in Frisco, Colorado, which the NTSB ultimately attributed to the same aircraft system discussed in the safety notice.
By the time of the accident, Air Methods had already attained the highest level of the FAA’s safety management system voluntary implementation program. In other words, it had the most “fully implemented” SMS the FAA was then prepared to recognize. Yet as I learned through the NTSB’s docket, Air Methods’ senior managers were only vaguely aware of the incident in Texas that had prompted the manufacturer’s safety notice, and the company had no reliable system for receiving and disseminating such notices.
When interviewed by NTSB investigators a few months after the fatal crash, the FAA’s principal operations inspector for Air Methods said he was aware of the incident in Texas, but was not part of the investigation into it, or aware of any concerns that were brought out during the investigation. He was not aware of the safety notice until after the Colorado crash. What was he doing instead of monitoring the investigations and outcomes of Air Methods’ serious incidents? Why, managing its transition to a new SMS format, of course.
“There’s a lot of work there,” he explained to investigators. “One of our main focuses right now is trying to keep that process on track.”
