Implementing SMS: NAV CANADA’s Experience


by Heather Henderson, Corporate Manager, Safety Planning, Performance and Promotion, NAV CANADA

In January 2008, Canadian Aviation Regulations (CARs) came into effect requiring NAV CANADA to implement a Safety Management System (SMS). However, the company certainly wasn’t new to the world of SMS.

In the mid 1990s the aviation industry began to recognize that a new approach was necessary if safety performance was going to continue to be enhanced. The new approach being recommended was SMS. Transport Canada had laid a strong safety foundation with respect to the provision of Air Navigation Services in Canada. NAV CANADA realized shortly after privatization in 1996 that if we were going to build on that foundation and continue to improve safety performance, an SMS needed to be established.

We undertook significant research into the application of safety management, the elements that make a strong and effective SMS, and the best approach for implementing one. Efforts began with reviewing current thinking and identifying best practices in safety management. Just some of the many questions that had to be answered included:

  • “What is the philosophy upon which safety management in our organization will be based?”
  • “What constitutes a robust and effective safety management system?”
  • “How do we implement safety management in a very dynamic environment with many stakeholders, multiple and sometimes conflicting priorities, and finite resources?”
  • “How do we do all of this in an organization that is undergoing significant change?”

Those efforts were followed with significant amounts of training for management to introduce the concepts and approaches for SMS and the benefits that a formal program would bring.

Ironically, one of the biggest challenges faced during the initial phases of implementing SMS was the fact that aviation is an environment in which significant amounts of knowledge, skill and effort are already spent to assure safety, and there is already a strong safety culture and an excellent safety record. This resulted in a belief that the existing way of doing things was just fine.

In some respects, this was correct. There were already a number of SMS elements in place, but these tended to focus on service delivery. Missing was a systematic, comprehensive and explicit system that integrated safety management across the company and addressed organizational factors.

We also undertook a detailed gap analysis to identify which elements were already established, which needed tweaking and what was missing. For example, a strong process for investigating aviation occurrences was in place, but it required updating to incorporate new understanding around the role of Human Factors in incidents and accidents. Additionally, while both the Transportation Safety Board of Canada and Transport Canada had processes in place for the confidential submission of safety concerns, NAV CANADA recognized the importance of having an internal process in order to react quickly and effectively to employees’ safety concerns. In 1998 the company established ARGUS, a company-wide confidential safety reporting program.

One of the other important steps we took at that point was to establish a formal program for managing risk associated with change. The amount of change that was happening— organizational changes, equipment and facility changes, maintenance changes and so on—was substantial. A formal risk management approach was applied to these changes to ensure risks would not unknowingly be introduced into the air navigation system. This formal risk management approach evolved into what is known today as the Hazard Identification and Risk Assessment (HIRA) process.

A set of safety policies and procedures were approved in 2000 that covered off the key elements of our SMS across the company, extending the reach of SMS activities beyond our operational areas.

Effective integration is critical and not always easy to achieve. One action that was taken early on was to establish a working group to manage the integration of NAV CANADA’s safety management activities and the associated resources required. Membership of the working group includes managers from all NAV CANADA groups.

Not only must safety management activities be integrated within the company, they must also be integrated with external stakeholders. It was necessary therefore to look at our industry working groups and formal and informal channels of communication and how we work with our industry partners 6 Pre-Flight ASL 1/2013 and stakeholders on an ongoing basis. The objective is twofold: to identify and address safety issues of common concern; and to assess and, where required, enhance how our external communication activities integrated with our SMS.

Between 2000 and 2005 we continued to enhance and improve our SMS, focussing on both the policies and the process and our management of them. When the SMS regulation came into effect in 2008 one of the first questions we faced was whether to take a phased approach to validation or not. Transport Canada recommended the phased approach given that both organizations were on a learning curve with respect to the process for validating an SMS as it applies to an air navigation service provider (ANSP). We agreed and it certainly proved to be the best way forward.

The first phase involved, among other things, conducting a gap analysis between our existing SMS and the requirements as set out in the CARs. Merging Quality Assurance (QA) into our existing SMS emerged as a key challenge at this phase. There were elements of QA in place across the company but no overall program in some areas. The regulations provided the impetus to strengthen the program in those areas.

Another gap we had to address was the requirement for a corporate-wide SMS Manual. While we had a number of manuals and documents we had not taken the next step to link all of the safety-related activities to the SMS elements and consolidate the information into a single manual. The process of doing so was valuable in that it advanced our understanding of those linkages and an improved awareness of all of the activities that contribute to the success of our safety management system.

During the validation process it became clear that field discussions were critical. Engineers, technologists, flight service specialists, controllers and others understood their role with respect to their responsibilities. However, they were not always clear as to how those responsibilities related to the SMS. For example, flight service specialists and controllers knew they had to report Aviation Occurrences, but there wasn’t necessarily a complete understanding of how occurrence reporting connected to the SMS and provided for safety analysis and lessons learned.

As Transport Canada and NAV CANADA progressed through the validation phases, regular communications and open discussions were critical. The validation of an SMS in an ANSP was a first for both organizations so there was learning on both sides. A positive and cooperative relationship between the Transport Canada and NAV CANADA teams was instrumental to a smooth, timely and effective completion of each of the four phases.

Language was one of those issues that needed to be dealt with early on. If you ask someone in an interview “What are your proactive SMS practices?” you might not get a full answer. So it was important for Transport Canada to further describe what they are looking for and probe intelligently to get the complete picture. And there is no question that Transport Canada was able to do so and do it effectively.

Our SMS will most certainly continue to evolve as we enhance our risk management processes and it will be important to work proactively with Transport Canada as that occurs. While the validation of our SMS over the past couple of years held some challenges and important lessons, it was certainly a valuable process.

Having an industry and regulator that is focussed not just on adhering to standards and regulations, but on potential weaknesses in processes and systems, promises to make a safe system even safer.

Electronic Flight Bags

The following is a short introduction to Advisory Circular (AC) No.700-020 Electronic Flight Bags, and is intended to provide an overview of the issue to our readers. We encourage all to read the complete AC at the link provided above.

The AC on electronic flight bags (EFBs) was issued in recognition of the need for guidelines for the certification, airworthiness and operational approval of both portable and installed EFBs. It was also issued to:

  • specify the principle that all EFBs to be used on an aircraft are to be subjected to a defined evaluation process;
  • minimize the burden on operators, installers, manufacturers, and Transport Canada Civil Aviation (TCCA) by specifying that some EFB evaluations can be delegated;
  • provide specific guidance material for certain EFB applications and approvals and establish certification, airworthiness/installation, and operational approval guidance for EFB systems; and
  • provide checklists to assist operators, installers and TCCA in evaluating EFB implementations.

Here is the definition of EFBs as provided in the AC:

EFB: An electronic display system intended primarily for cockpit or cabin use. EFB devices can display a variety of aviation data or perform calculations such as performance data and fuel calculations. In the past, some of these functions were traditionally accomplished using paper references or were based on data provided to the flight crew by an airline’s “flight dispatch” function. The scope ASL 1/2013 Pre-Flight 7 of the EFB system functionality may also include various other hosted databases and applications. Physical EFB displays may use various technologies, formats, and forms of communication. These devices are sometimes referred to as auxiliary performance computers (APC) or laptop auxiliary performance computers (LAPC).

EFBs perform a variety of functions traditionally accomplished using paper references by electronically storing and retrieving documents required for flight operations, such as the Flight Crew Operations Manual (FCOM) and Minimum Equipment Lists (MEL). EFBs are developed to support functions during all phases of flight operations and may be authorized for use in conjunction with or to replace some of the hard copy material that pilots typically carry in their flight bags.

Before AC 700-020 was issued, TCCA had based the Canadian approval of EFBs on Federal Aviation Administration (FAA) AC 120-76A, which was given as a primary reference in two TCCA documents. These two documents were CBAAC No. 0231, which addressed operations considerations, and Transport Canada Aircraft Certification PL 500-017, which addressed certification considerations. The FAA AC 120-76A was not directly applicable in Canada as the specified approval processes are particular to the FAA organization and much of the approval task is assigned to the FAA Aircraft Evaluation Group (AEG).

In addition, there was a need to combine the two TCCA documents to meet new TCCA document protocols. It was therefore decided that, rather than continuing to reference FAA AC 120-76A with its known applicability issues, it would be preferable to produce a new TCCA AC based as closely as possible on the text of FAA AC 120-76A, but clarifying some aspects of the certification and operational approval processes. Thus, there would be a single document that would apply to Canadian regulations.

Implementation process

The AC describes how the implementation of an EFB into an air operator’s operations will affect the following:

  • EFB installation;
  • EFB certification, where applicable; and
  • operational approval.

The AC discusses these aspects and describes two evaluation processes: one is directed at the evaluation of the EFB installation, and the other is directed at the operational implementation. The operational evaluation is further divided into an evaluation of company procedures and processes and an aircraft evaluation. Depending on the circumstances, the aircraft evaluations may be carried out separately or as a combined exercise. The discussion on the EFB installation aspects evaluation covers both certified and non-certified aspects.

Classification of EFB systems

Hardware classification is based on the type of EFB installed in the aircraft.

  1. Class 1 EFBs:
    1. are portable;
    2. are not connected to an aircraft mounting device;
    3. are considered Portable Electronic Devices (PEDs); and
    4. do not require an aircraft certification approval.
  2. Class 2 EFBs:
    1. are portable;
    2. are connected to an approved aircraft mounting device during normal operations;
    3. are considered PEDs;
    4. require aircraft certification approval for their mounting device, data connectivity and power connections; and
    5. do not require certification approval for their operating system.
  3. Class 3 EFBs are installed equipment that require certification approval of all hardware, mounting and connectivity aspects.

Software applications have three types: A, B and C.

  1. Type A software applications:
    1. may be hosted on any of the hardware classes; and
    2. do not require an aircraft certification approval.
  2. Type B software applications:
    1. may be hosted on any of the hardware classes; and
    2. do not require an aircraft certification approval.
      Examples of Type B software applications are provided in Appendix B of the AC.
  3. Type C software applications:
    1. require an aircraft certification approval.

The overview of the AC concludes here. For complete information on installations and related evaluation requirements, air operator electronic flight bags operational implementation procedures, and to view the appendices and checklists, please refer to the AC. For questions or comments on the document, e-mail us at

Fundamental Rights Bestowed by the Canada Labour Code (CLC)

by Darlene MacLachlan, Civil Aviation Safety Inspector, National Operations, Civil Aviation, Transport Canada

Did you know the Canada Labour Code (CLC) generally applies to industries that fall under federal jurisdiction? Air transportation happens to be one of those industries.

The Aviation Occupational Health and Safety Regulations (AOHSR), are made pursuant to the CLC, Part II, and apply to persons employed on board aircraft while in operation and in respect of persons granted access to those aircraft by the employer. Within Transport Canada Civil Aviation, enforcement of the CLC and the AOHSR fall to Health and Safety Officers (HSO) who are delegated under the Minister of Labour, and who are also delegated under the Minister of Transport as Civil Aviation Safety Inspectors.

The CLC bestows three fundamental rights to employees, of which one is the right to refuse dangerous work (the two others are the right to know and the right to participate). An employee, at work, has the right to refuse dangerous work if he or she has reasonable cause to believe that:

  • a condition exists at work that presents a danger to himself or herself;
  • the use or operation of a machine or thing presents a danger to the employee or a co-worker;
  • the performance of an activity constitutes a danger to the employee or to another employee.

In order for an employee to be protected by the CLC when exercising the right to refuse, the employee must follow the proper procedures. More information on the process can be found by visiting:

Often, in aviation, the refusal concerns equipment or conditions on board the aircraft that the employee considers to be a danger to his or her health. Examples of this include air quality, crew member jump seats, exits and equipment not operating properly, etc.

Although the system or equipment may have met aircraft certification requirements and may be operating as it was designed and certified to do, it doesn’t stop an employee from exercising their right to refuse, if they believe the equipment or condition is dangerous to their health.

This often causes confusion in separating the certification requirements of the Canadian Aviation Regulations (CARs) from the issue of employee safety under the CLC. One example involves a certified crew member seat, operating as it was designed to do, where there were injuries resulting from the occupancy of the seat. As a result of a right to refuse, it was later determined that the seat did constitute a danger to the employees occupying the seat and the employer was directed to take actions to protect employees sitting there.

The investigation is carried out under the auspices of the CLC and not under the CARs. Although a decision may be made that a danger does not exit, it does not stop any future refusals by employees for the same issue nor does it always mean the same decision will be rendered by the HSO.

Upon completion of an investigation into a right to refuse, the HSO decides whether or not danger exists as defined in section 122(1) of the CLC. IPG-062 Definition of Danger provides guidance on this subject. The HSO completes Appendix H, “Assessment of Danger and Points to Consider When Issuing a Direction under 145(2)(a) or 145(2)(a) & (b)” prior to rendering the decision and it forms part of the Investigation Report.

The HSO bases his/her decision in a situation involving a right to refuse on:

  1. the circumstances prevailing at the time of the investigation, and not the situation existing at the time of the refusal (although past events may be relevant in assessing the likelihood of recurrence in the future), e.g. weather has changed or managers performed the task; and,
  2. the circumstances prevailing at the time of the investigation, and not the situation existing at the time of the refusal (although past events may be relevant in assessing the likelihood of recurrence in the future), e.g. weather has changed or managers performed the task; and,

The CLC, Part II, and the AOHSR are concerned with protecting the health and safety of the employee—the CARs are concerned with the safety of the aviation system.

Invest a few minutes into your safe return home... reviewing the VFR weather limits chart in section RAC 2.7.3 of the Transport Canada Aeronautical Information Manual (TC AIM), titled “Figure 2.7 – VFR Weather Minima.”

Date modified: