SMS.ID

A safety management system is mandatory for an operator. In practice its data is often spread across several tools: occurrences kept in one system, the risk register in spreadsheets, indicators prepared separately for each meeting.

The links between occurrences, risks, measures and indicators are then maintained by hand.

The hardest question is whether a measure worked. To tell whether a change in an indicator relates to the measure, seasonality, exposure and shifts in the structure of operations all have to be taken into account.

An occurrence log performs no such calculation.

SMS.ID brings the main safety management processes into one working loop: from filing a report and first-line handling through investigation, risk management, meetings of the collegial body, quarterly reviews, change management and external reporting.

The system carries 29 working routes for 21 roles. Alongside them it supports assessment of personnel actions under a just-culture algorithm, inspections, mandatory reports, technical reliability, personnel training and crisis readiness.

Each role’s home screen answers a practical question: which actions are required, by when, and what follows if the deadline passes.

A working route ends with a change in the state of an object. Viewing information without acting counts as no route of its own.

The analytical part is served by a separate calculation core.

• Eight indicators with a passport recording the provenance and the calculation rules behind every value.
• Control charts with automatic detection of runs and episodes, and version control over the charts.
• Seasonality estimated from the data; divergence from the seasonal version is recorded separately.
• Effectiveness of a measure: the observed change, its decomposition into contributions, and the required volume of observations obtained by simulation.
• A compliance matrix mapping the twelve SMS elements onto working routes, with a completeness check in the reverse direction.

The system receives personnel reports, flight data events, investigation material, risks and barriers, measures, supplier data, external material, inspection results and mandatory reports.

The operator’s name, registration thresholds, indicator passports, the ERC matrix, control chart parameters, the scale of conclusions and the lists of outcomes are all held as configuration values with a start date.

The unit of review is the approach attempt. Where five firings are recorded within one attempt, it remains a single attempt.

The system derives the boundaries of an attempt from completion marks itself.

The regulatory basis covers Annex 19 and Doc 9859 fourth edition, Annex 6 Part I for the flight data analysis programme, Annex 13, Doc 10159 on the protection of safety information, the ADREP taxonomy, the ARMS approach to risk assessment and the high-risk categories of the Global Aviation Safety Plan.

Compliance with the manuals is checked through a matrix: every SMS element has to have working routes mapped to it. A role without a route, or a route without an executor, counts as a configuration error.

The calculation core uses control charts with automatic run detection, a Poisson estimate of seasonality with shrinkage over a Wald interval, decomposition of a change into contributions, and iteratively reweighted least squares with a robust covariance estimate.

The required volume of observations is determined by simulation.

A refusal to compute is a result in its own right. Each ground for refusal carries either a computed date on which the data will suffice, or the state «no date is set».

A probabilistic form of words is never used to stand in for missing grounds.

De-identification is a property of storage. The link between pseudonym and employee is held separately, and disclosure requires two independent consents.

Assessment of personnel actions follows a just-culture algorithm, and the final decision is taken by a person.

The system assigns no blame and computes no summary indicator for a unit or an employee.