SAFETY CULTURE MODEL IN MILITARY AVIATION ORGANISATION

The list of organisational factors that may constitute accident premises represents a good analysis instrument, equally preventive, but also retrospective, in investigation situations. Forming an effective safety culture is a vital element of acquiring and maintaining an appropriate level of safety and implicitly limiting aviation events. The safety culture “growth” process starts by successfully choosing the right model for the organisation, evaluating the safety culture with the help of the right tools and capitalising the results by taking improvement measures. Once acquired, the safety culture gives the organisation an increased level of security and confidence, thus: low accident rate, active involvement and responsibility from all members, initiative in operations, safety procedures, direct and effective feedback, careful and constant research of procedures, continuous and intense training, setting performance standards both indoors and outdoors, planning several scenarios to create the required variety, the desire to try new ideas, accepting the risk, the failure.


INTRODUCTION
The essential attribute of an organisation in the safety field is to issue regulations and to monitor and control their compliance. The idea that regulations would be the absolute solution for accident avoidance is widespread. Although they are results of long experiences, some of them are "written with blood"; regulations are not an absolute guarantee of safety. Admittedly, regulations compliance has a big advantage: it represents an absolute parameter before the law. For example: Does that mean I can cross on green, even if I see a car coming, just because the law is on my side?
The fact that almost every accident has a list of violations of the rules is not a justification for the hope that, by absolute compliance with all regulations, the flight would be accidentfree. Arguments: a) Like aeroplanes, regulations are also made by people, so they are not perfect. b) A regulation has a target (the field it is focused at) but also consequences on some adjacent fields. Even the best regulations can have unforeseen negative consequences. (Example: regulating the payment system of the air force staff). c) If the rule does not fit the situation, then it is not good just for the fact that it exists. If we could imagine a fully regulated system, then man would have no role to play within it (it could be replaced by an automatic machine). d) Many regulations respond to the moment's need. After a while, they may no longer be effective. Delay in updating regulations is one of the most dangerous sources of risk in aviation. People have to face a changed situation based on old rules. This causes compromises (in order to make things work) or blockages (not to conflict with the rules). e) There are several levels of regulation, which are not always concordant, and creates confusion and uncertain "improvisations" (the law is above an internal regulation). f) At each hierarchical level, the pressure to comply with the rules is higher from top to bottom than from horizontal and even less from bottom to top. The mismatch between levels leads to normative practice inconsistency, with high risks for operational safety. Failure to follow the rules at a certain hierarchical level, when perceived or only suspected by subordinates, has a devastating effect on the general normative climate. This is, moreover, the essence of the mechanism of "authority dissolution" (understanding by authority a space regulated by norms). g) Finally, it would not be excluded that if someone wanted to comply with maximum rigour to all existing regulations at any given time, no plane could be lifted from the ground.
The sum of all regulations defines an ideal professional space, as it can probably never be found in real life. This is truer in critical situations (in war, in times of economic crisis, transition, etc.). However, the arguments listed above are in no way a rebellion against rules and regulations.
Aviation has been and shall remain a highly normative institution. Most of the regulations are vital to maintaining the efficiency and safety of the system. However, it has no use to fetishise the compliance for norms, as a unique and absolute way of preventing all problems. Sometimes, blind implementation of an inappropriate rule can do more harm than ignoring it. However, we must keep in mind that people are usually inclined to comply with regulations because this gives them confidence and security (only some categories of psychopaths violate the rules in principle just because they exist). Therefore, even when a rule has been violated, there must be an explanation, which as a rule has a much deeper meaning than just finding the violation. When the analysis of an accident ends with the conclusion that certain norms have not been observed, without going further in deciphering the mechanism of this fact, we can say either that the investigation was not professional or that it is trying to hide some deeper truths. Example of "correct violation" of the rules and regulations: In case of loss of power supply on-board, at night, under heavy weather conditions, the regulation provides for "catapulting" of fighter jets equipped with a catapult seat. Yet, this "rule" is usually violated, in all known cases, the pilots succeeding in landing, usually with the damage of the aircraft, but without other consequences. Moreover, the "violation" has always been received positively, being highlighted by the driving factors.
In the end, however, the organisation shall have to resume this process of forming its own safety culture, to determine the impact or better still if the measures taken to improve the safety culture have had the desired impact or if they need to be deepened. In the end, we shall conclude with a statement by James Reason: "If you are convinced that the organisation you belong to has a good/efficient safety culture, you are more than likely wrong ... a good safety culture is something that you can tend to, but it's hard to get. Its value and result lie more in the struggle to obtain it than in effect." 4

SAFETY MANAGEMENT SYSTEM
Although air accidents or catastrophes are rare, less serious events and a whole range of incidents occur frequently. These negative manifestations of safety foresee the imminence of a disaster with a strong impact on the resources of the aeronautical organisation. Ignoring these indicators, with minimal influence on safety only increases unwanted events.
In support of diminishing security vulnerabilities, the International Civil Aeronautical Organization (ICAO), imperatively supports the implementation of a Safety Management System within all aeronautical organisations that sign the convention. Thus, starting from 2006, the Safety Management Manual, a manual that has the main role to outline this concept and not to present in detail the steps to be taken for its implementation was introduced.
SMS (Safety Management System) represents a well-defined process, centred at the level of the entire organisation that generates effective, viable decisions based on the potential risks identified during operations and services provided.
SMS promises lower loss rates, but safety culture is an essential condition for success and the key to achieving future goals.
The main pillar of aeronautical safety is the formation and development of a correct culture and attitude in the aspect of the safety of the activities carried out based on: -knowledge and discipline in compliance with the regulations, operational procedures and the correct exploitation of the technical means provided; -compliance with aeronautical safety rules in carrying out activities; -encouraging free and honest reporting and information of any potential factor or hazard that could affect the level of aviation safety or which has generated events, including by distinguishing between the occurrence of events due to unintentional errors and those causing voluntary violations of normative acts in the field of aviation safety.
Through education, training and action, staff must (re)know, identify and raise awareness of acceptable and unacceptable actions/attitudes in military aeronautical activities. Therefore, at all levels of the organisation, it should be understood that in the case of situations considered unacceptable (indiscipline, as an intentional action outside the limits of the normative acts in force), the commanders can and must establish certain disciplinary or administrative measures, proportional with the situation and the consequences manifested and in accordance with the regulations in force.
The systemic approach that encompasses all the actions carried out to improve the aeronautical safety, as presented in the concept of safety management, brings novelty elements by combining all the key elements that compete in carrying out the activities in good conditions.
The key elements of a Safety Management System are represented by: -the identification of hazardsrecognition method of distinct vulnerabilities of each organisation; -reporting of events that occurred -process of data acquisition and preparation of statistics on safety indicators (incidents, accidents, recurrence of events, etc.), but also voluntary reporting of "minor" incidents with a negative effect on safety; -risk management -standard approach for assessing risks and vulnerabilities for controlling and eliminating them; -measuring performance in terms of meeting the objectives -management tool for analysing the safety objectives imposed within the organisation; -safety quality assurance (auditing) -process based on the quality of managerial principles that support the improvement of the organisation's performance to maintain the required safety standard.

HAZARDS IDENTIFICATION
One of the most important and applied models in the aviation community for determining causes that lead to the occurrence of aviation events is one proposed and developed by Professor James Reason 5 , which can be found in speciality literature as the "Reason Model" or the "Swiss Chees" Model (cheese). This model (Fig. 1) describes the causality of events as a chain of successive failures of the security defence system and the successive activation/manifestation of latent factors that have adverse effects on the performance of the mission (equipment failures, organisational factors, errors, procedural violations, weather phenomena/conditions, deficiencies of regulations, deficiencies in training/evaluation, etc.).
Rarely, a single failure in this defensive chain can lead to the production of an event or its severe effects. The Air Force aeronautical system is based on the generation of defensive elements for any of its components. Interrupting the defensive chain can be prevented by including decision making at different levels of the organisation.
In certain situations, the interruption of the defence may be caused by a combination of active failures or latent conditions that, according to the Reason model, can be chronologically successive until the generation of a dangerous situation or even the production of aviation events with serious effects.
Active failures are actions or inactions that usually have an immediate aggravating effect. This category includes errors and violations of normative acts. These are attributed to the staff who actually carry out aeronautical activities (pilots, crew members, technical-engineering staff, traffic controllers, etc.) and the effect can be severe.

Fig. 1. Causal model of accidents
Latent conditions exist in the system before an event occurs. They have the following particularities: -they do not produce consequences as they are inactive, as a result, they are often difficult to perceive and identify, and risks are rarely associated with them; -there is a long period of time from occurrence to manifestation; -in most cases they are generated by people; -they are highlighted when the defensive means fail in aviation safety (occurrence of events).
These latent conditions can be generated by: -weak aeronautical safety culture; -equipment/material with deficiencies, which have been designed, manufactured or exploited improperly; -conflicting objectives or states in the organisation; -erroneous decisions; -organisation malfunctions.
The Reason model is thus constituted as a model of the "organisational" aviation events, bringing the human factor to the centre of attention of aeronautical events investigation by identifying its interaction: -at the individual level (the role of the person who leads and the one who enforces) and -collectively (the role of the organisation), both by the organisation way and the decision making.
Similarly, the model presents a series of elements regarding both the causality and ways of preventing the events, highlighting the following: -people make mistakes and it is important that these errors are made known, especially by the crews during the flight, and is important that there is time, space, resources and ways to prevent, mitigate or cancel the effects; -the aeronautical system has defensive means that can compensate for the fluctuation of human performance or the quality of decisions; -the system can generate latent conditions that can be activated in certain situations or under the influence of certain factors.
By analysing in detail, the causality of the accidents proposed by this model, we identify a mechanism of correlation with the processes that are carried out at the level of the organisations, which by identifying the process progression during the activities, determine both the logic of the occurrence of the aviation events and the modalities of prevention (the defensive layers of the model) that the aeronautical system can have available in different phases.
A particular path is represented by the generation and then the manifestation of latent conditions. They may be represented, in addition to those deficiencies in design and construction of equipment and incomplete or inadequate standard operating procedures, or deficiencies in staff selection and training. Thus, we can identify two major components that can generate latent conditions: -deficiencies in identifying the dangers/threats as well as ways to reduce the risks associated with them; these threats remain in the system and can be activated by factors or operational conditions in a particular situation; -normalisation of situations considered as an exception to the rule regarding, in particular, the allocation of resources. This situation forces the system to adapt so as to continue the execution of the assigned missions until the critical limit is reached or exceeded (exceptions are established that become rules and this process risks becoming a habit as the resources are continually maintained or reduced).
The latent conditions limit the defence capacity of the aeronautical system against threats/dangers, especially of the crews who carry out missions in flight and increase the risk of producing events by also restricting the possible solutions to prevent and correct errors of any kind: -the level of training, experience and continuity of the training are limited, affecting the maintenance, acquisition or improvement of flying skills; -decision-making and application skills are affected (increases the time, space and resources required, decreases the quality in their application); -the performance, characteristics and operating particularities of aircraft and technical systems remain in line with the requirements for mission execution and offer limited possibilities to prevent dangerous situations or limit their severity; -changes to normative acts, assigning new missions or increasing their complexity are more difficult to control in order to identify specific dangers or safety measures; -the frequent changes of structure or classification, the lack of qualified or experienced staff in the field generated by resources or by bad management of staff lead to difficulties in the sense of identifying specific threats or efficient and effective security measures.
The training and experience in aeronautical activities, the provisions of the normative acts and the technology are means that finally offer the possibilities of error prevention and equally the main tools for the enforcement of the missions in suitable conditions of performance, as well as efficiency and effectiveness.
A second path is represented by the working conditions, as follows: -personal factors: stability at the workplace, qualification and experience, moral and atmosphere within the organisation or within the crew, the attitude of the management, the remuneration; -environmental factors at work: ergonomics, lighting, temperature, cabin pressure, vibration and last but not the least, the associated occupational diseases.
Poor working conditions directly influence human performance during activities, being of major importance to the crews in flight, especially through their contribution to the manifestation of errors and voluntary violation of procedures or regulations. The difference between error and violation of rules is motivational and intentional.
From the viewpoint of prevention, the aeronautical safety activities should allow the intervention on the two paths presented above, thus: -supervises, analyses and evaluates the processes carried out at the level of organisations (internally and hierarchically: respectively of the Air Force base of the General Staff of the Air Force and of the Flight Group and of the squads from the Air Force base level), identifying in real and objective terms, the latent conditions and regenerating/strengthening defensive instruments; -supervises, analyses and evaluates the working conditions for identifying those factors that affect their performance and generates actions that will develop better working conditions and tools for avoiding errors, limiting or correcting their effects; -develops specific risk management processes for identifying security threats as well as identifying and applying risk reduction or elimination measures.

REPORTING EVENTS
The safety management system involves the reactive and proactive identification of the dangers manifested to safety during aeronautical activities. It is fully accepted that accidents or catastrophic investigations are much more detailed and thorough in research compared to investigations on-premises or incidents. Thus, when the safety optimisation measures are taken only following the conclusions of the investigations on accidents and disasters, the scenarios underlying them are limited. This way, wrong conclusions regarding the level of safety can be drawn, and moreover, inadequate corrective actions can be established.
The statistics show that the number of premises and incidents is much higher compared to the number of accidents and disasters (Classification of aviation events in the Romanian Air Force according to Annex no. 13). The causes and contributing factors associated with the premises or incidents can escalate into accidents or disasters. Often, only luck causes a minor event not to turn into a disaster. Unfortunately, these minor events are not always known by those in charge of implementing risk reduction and elimination measures. This may be due to the lack of a reporting system or the lack of motivation of the staff in not reporting the events or dangers discovered.
The lessons learned, the conclusions drawn from the incidents offer important scenarios for analysing and avoiding future events during activities. Therefore, there is a need for a database that provides the nature, cause and remediation of unwanted situations.
Equally valuable, such as information on the production of events, are information on unsafe, dangerous conditions that are yet to cause any incident.
The information on reported incidents facilitates the discovery of the risks associated with them, helps to implement intervention strategies and provides feedback regarding the evaluation of the effectiveness of the intervention. Events with minimal impact on safety also provide a first-hand understanding of the actions taken at the incident site regarding the conditions and actors involved. They can provide important details regarding the relationship between existing stimuli and their actions during the event, reactions that can affect their performance based on multiple factors such as fatigue, interpersonal interactions or distraction. Moreover, the members of the organisation involved in conducting events can offer solutions to increase the level of safety depending on the type of events. Data onpremises and incidents, even accidents, can be used to improve operating procedures, control the design of the technique used, and provide a better perspective on human performance in aircraft operation, air traffic control or technical service of the aerodrome.
Civil aviation regulations 6 propose three types of reporting systems: 1. Mandatory reporting system -requires the persons responsible for reporting the events (or those involved in the event) to report on a hierarchical scale that a particular event has occurred. For this, a regulation that stipulates who shall report, to whom shall report and what should be reported 7 is needed. Although, such regulations may not cover all types of events to be reported given the large number of operational variants, the basic rule in informing about their production should be: "Report if you are unsure about reporting". 2. Voluntary reporting system -involves the reporting on the initiative of any member of the organisation of an event or of any inappropriate behaviour that endangers future activities.
Mandatory reporting involves informing about the events produced with the equipment provided (the hardware part of the organisation), with the need to collect data regarding the technical failures and its implications. To prevent these unwanted events, we propose the introduction of the voluntary reporting system meant to provide more information on the role of the human factor in the production and development of aviation events. A good example of a voluntary reporting system is the US Aviation Safety Action Program (ASAP) 8 . Designed to increase aviation safety by preventing accidents and incidents, this is a system that protects the identity of the person reporting, it was created based on a model used by many airlines. This program, based on the transmission of network information, encourages the voluntary reporting of safety problems during the operation or maintenance of the technique, critical safety information, which might otherwise remain unknown. The program is specially designed to detect the dangers and errors observed by crews, technical staff or air traffic controllers and their dissemination throughout the organisation so that everyone can have access to safety information. It additionally gives the organisation management examples of risk that might otherwise be "invisible" so those risk management decisions can increase the security of operations.
The challenge in implementing this reporting system is represented by the lack of punitive actions against those who subscribe to the information about the security threats. Being a non-punitive system, it will encourage the reporting of this much-needed data in the process of increasing the safety level. 3. Confidential reporting system -aims to protect the identity of the information provider.
Confidential reporting is not stored in a database or recorded. Usually, it is verbal information, mainly about the errors produced by the human factor in the activities of the organisation. This should be initiated without fear of reprisals or embarrassment, the main purpose of the information is to learn from the mistakes of others. It is understandable that man is reluctant to report his own mistakes. Many times, following an aviation event, the commissions of investigation find that many of those present in the organisation were aware and knew the latent conditions of the event production before it happened. The non-reporting of perceived threats can be due to several reasons: embarrassment feeling before the interlocutor, self-accusation (if they were the ones generating the risk conditions), reprisals or sanctions from the hierarchy. For a reporting system to be valid, the organisation must avoid reasons safety issues are not shared. Trust and avoidance of sanctions are the basic principles in promoting a positive safety culture.
Persons reporting incidents, behaviours or errors that impact on the safety of their activities should be convinced that the organisation (management of the organisation) will not use the information received against them in any way or for any reason. Without this certainty, staff will avoid reporting errors or other observed hazards. A positive safety culture within the organisation will generate the level of confidence required in reporting the observed inconsistencies. Specifically, the organisation must have a good tolerance for errors inherent in human activity of any kind, and the reporting system should be perceived as being correct in terms of its handling of errors (unintended errors). One must not misunderstand that in this way deliberate acts of violation of the regulations will remain unpunished. This is an example of just culture, an integral part of the safety culture.
To avoid anonymous reporting, which may leave interpretations in the information transmitted, and may have other purposes other than those related to security, the reporting system must be non-sanctioning, non-punitive and be based on confidentiality.

CONCLUSIONS
Recommendations on aviation safety: -analyse all aviation events that occur in your unit and other units to identify malfunctions that may lead to other aviation incidents or accidents; -approach rationally and functionally, the decision-making process for flight, starting from the interactions between human, technical or environmental factors that can ultimately lead to the occurrence of aviation events; -uniformly distribute effort according to the stage of training objectives and tasks to eliminate overwork at work, inadequate perception of danger or motivational dysfunctions; -identify the social factors that impact on in-flight training: ▪ social problems; ▪ financial problems; ▪ family relationships; ▪ relationships within the group; -eliminate tensions within the system and harmonise the activity of the compartments based on the idea that pilots, technical staff, insurance staff and navigators are the main preventers of aviation events.
During fight missions, mission accomplishment becomes paramount to all other considerations. No state, throughout history, has allowed the resources available for the accomplishment of the mission to be diminished by facts that are not attributed to the actions of the opponent. The accidents, beyond the costs they incur, reduce the operational capacity and, implicitly, the successful accomplishment of the assigned missions and create an image crisis of the Air Force, the most important category of an army.

Aknowledgement
This work was supported by a grant of the Ministry of National Education and Romanian Space Agency, RDI Programe for Space Technology and Advanced Research -STAR, project number 174/20.07.2017.