Speech to Economic Club of Canada
Chair, Transportation Safety Board of Canada
Ottawa, Ontario, 5 February 2015
Check against delivery.
Thank you for that introduction.
And thank you very much for the opportunity to speak to such a diverse audience about the work of the Transportation Safety Board of Canada—and in particular, to share with you what we have learned from our investigations about the challenges of managing safety. I'll also speak about the TSB Watchlist, why it was initiated in 2010, and what progress we have seen since then.
But to start, a bit about our organization: The TSB is an independent federal agency whose only goal is to advance transportation safety. It's been our job, for almost 25 years, to conduct thorough investigations into air, marine, rail and pipeline occurrences. We identify the causes and contributing factors, and then make recommendations to industry or the regulator, so that it doesn't happen again.
Our work has evolved a great deal over the years, as has the way people think about accidents in general. It used to be, for instance, that the focus of accident investigation was on mechanical breakdowns. Then, as technology improved, investigators started looking at the contributions of crew behaviour and human-performance limitations. Nonetheless, people still thought things were “safe” so long as everyone followed standard operating procedures. Don't break any rules or regulations, went the thinking; make sure the equipment isn't going to fail; and above all: pay attention to what you're doing and don't make any “stupid” mistakes.
Even today, in the immediate aftermath of an accident, people on the street and in the media want to know quickly if it was caused by “mechanical failure” or “human error.”
But “human error,” we now know, is not a cause of failure. “Human error” is rather the effect, or symptom, of deeper trouble. It's connected—systematically—to people's tools, to their tasks, and to the environment in which they operate.
And the people who establish the goals and the priorities and assign the resources, those who assign the tasks and determine the rules for the operating environment—are those typically higher up in an organization … meaning management. And their decisions can have a huge impact.
Modern accident causation theory is now based on the concept that most accidents are organizationally based. So accident investigators started to look more closely at organizational factors including safety culture and regulatory oversight.
Let me cite an example, one you've all heard of.
Early on July 6, 2013, a Montreal, Maine and Atlantic Railway train carrying 7.7 million litres of petroleum crude oil derailed in the town of Lac-Mégantic, Quebec, killing 47 people and ripping a hole in the centre of this small, quaint town—a town which, prior to that night, was largely unknown outside of Quebec. A town whose name has since become synonymous with disaster and tragedy.
In the hours, weeks and months that followed, we marshalled significant resources to find out just what caused the worst Canadian rail accident in over a century. And what we found were 18 causes and contributing factors. These include deficiencies in the number of hand brakes and how they were tested, the way the train was left unattended on a descending grade, the way the locomotive was maintained and why it caught fire, and the engine shut-down that allowed the air brakes to leak off. We also cited the volatility of the crude oil, the long-standing, well-known vulnerabilities in the class 111 tank cars, MMA's poor safety culture, and how ineffective management of its safety risks contributed to the tragedy. And then we clearly pointed out inadequacies in Transport Canada's oversight.
The TSB recognizes that, in any transport organization—large or small—operators are required to manage competing goals and multiple priorities. These include safety, customer service, productivity, technological innovation, cost-effectiveness and return on shareholder investment. And while most organizations publically assert, “Safety is our first priority,” there is convincing evidence that for many, it's really about profitability. Still, companies generally recognize and accept that products and services must be “safe” if the company wants to remain in business, if they want to maintain customer and public confidence, avoid accidents and consequent costly litigation, and reduce the potential for overly prescriptive regulations or enforcement action.
It's also important to recognize that safety initiatives cost money—money that isn't always easy to find, especially for a small company with thin margins operating in a competitive environment. And, while it's relatively easy to quantify the cost of implementing new technology, or additional training, or hiring more staff … it's not always easy to quantify the safety benefits. Put another way, a company may be able to calculate the costs avoided by not investing in new safety initiatives, but it's very hard to calculate what that adds in terms of an increased level of risk.
Let me give you an aviation example.
In 1995, the TSB recommended that Transport Canada require the installation of Ground Proximity Warning Systems on certain categories of commuter and airline aircraft capable of carrying 10 or more passengers. These systems give pilots a visual and audio warning when an aircraft is too close to the ground, providing a significant defense against what we call “controlled flight into terrain” (CFIT) accidents. Well, it took until 2003 for the draft regulatory changes to wind their way through Transport Canada's industry-consultation process, and the final regulations weren't published until July 2012. During that last decade, there were 113 CFIT accidents in Canada, or an average of just over 11 per year. One of these happened in August 2011, when First Air flight 6560 crashed in Resolute Bay, killing 12 of the 15 people on board. Yes, there were many human, technical and organizational factors that caused or contributed to this accident, but the absence of a newer generation Ground Proximity Warning System certainlydeprived the flight crew of information that would have enhanced their situational awareness.
Of course not every operator delays implementing new safety technology until regulations require it; some are proactive. But given the costs associated with GPWS, which can easily be 50 or 60 thousand dollars per aircraft, waiting may be a position that may be understandable from a financial perspective, even though it illustrates what I said earlier: that delaying a costly safety initiative means there's an unknown degree of risk to which the operator, and ultimately its customers, is being exposed.
So … with all of the risks that a business must face, with all of the “top priorities” that they must juggle every day, how can companies identify if they are drifting outside the bounds of safe operation, or where they should invest their safety dollars? This question is particularly important when companies are undergoing significant growth or changes in their operations—such as that experienced by Montreal, Maine and Atlantic Railway when it started hauling more and more crude oil, instead of its usual cargo of dry goods.
One way to address this concern is via the implementation of a safety management system—SMS. This is a formalized, systematic way for companies to identify hazards in advance, and then pro-actively mitigate the risks. In other words, an SMS helps companies find trouble before trouble finds them. No, it's not yet required for every transportation company, but in many ways it makes a lot of sense. After all, companies have HR and financial management systems; why not safety management systems?
At the TSB, our investigations routinely look at whether or not a company identified the safety hazards involved in the accident, and what, if any, mitigating measures were taken. SMS comes up a lot because it provides such an excellent framework to manage operational risks, and thus many companies take advantage of it. But other companies don't. They consider safety to be adequate as long as they are in compliance with the regulatory requirements—the bare minimum. Regulations alone, however, cannot possibly foresee all risks. For instance, prior to Lac-Mégantic, nothing in the regulations precluded a company from leaving a crude oil train parked unattended, overnight, on a descending main track. While that may have been considered “compliant,” it certainly wasn't free from risk. Yet no additional measures were put in place to prevent a runaway.
In the aftermath of Lac-Mégantic, we've heard people say, “The accident was caused by someone who did not follow the rules,” as if that were the end of it. Case closed. But it's not that simple. As I said earlier, our investigation identified 18 causes and contributing factors. No accident is ever caused by one person, one factor. And no one wakes up in the morning and says “I think I'll have an accident today”—not ships' masters, not pilots, not locomotive engineers, not company executives. Yet, it's also true that employees don't always carry out procedures exactly as written. That gap—that mismatch between written procedures specifying how work should be performed, and how work actually gets done—exists for a very simple reason: because workers, faced with time pressures and multiple goals, may be tempted to create "locally efficient practices" to get the job done. I'm talking about shortcuts. And if a shortcut works once …
Sidney Dekker— the best-selling author and world-renowned safety expert—wrote that, once a shortcut is successful, that success gets taken “as a guarantee of future safety.” That, in turn, can lead to more shortcuts, perhaps only incremental ones, but as each difference from original rules takes hold, it can establish a new norm. “Departures from the routine,” Dekker says, “become the routine.” And violations “become compliant behavior."
All too often our investigations cite these "employee adaptations" as contributing to an accident. But rather than stopping there, we look deeper, to find out why they made sense at the time.
In the First Air accident, our investigation identified widespread deviations from standard operating procedures in B737 crews at the Yellowknife base. These deviations not only increased the pilots' workload during a critical phase of flight, they were also largely unknown to the company.
We also found employee adaptations in the Lac-Mégantic investigation. For instance, in not setting the minimum required number of handbrakes that night, the locomotive engineer was performing the procedure the same way he always did. And by not conducting the handbrake effectiveness test properly, he was—again—doing it the way he always had. And then we discovered that even if he'd followed company's rules, those rules dictated a number of hand brakes that would have been insufficient to hold a train that size on that grade.
So we turned our focus to company training and supervision. It soon became clear that, even though Montreal, Maine and Atlantic Railway had an SMS on paper, it had not effectively managed the safety risks in its operations. And it had a weak safety culture, in fact, that contributed to the tragedy.
This leads to a question my predecessor asked when releasing our final report: “Who is the guardian of public safety?” And the answer is that, clearly, the regulator has a crucial role to play. Ideally, a government would implement regulations requiring all transportation companies to have formal safety management processes. And ideally, a government would oversee these processes in a balanced way, using a combination of inspections for compliance, and audits for effectiveness. What we found in Lac-Mégantic, however, was that Transport Canada did not provide adequate regulatory oversight to ensure the associated risks were addressed.
Now, as a former owner/operator of small air taxi operation myself, I understand that businesses don't always want more regulations or more government oversight. But regulations can be a very good way to ensure a level playing field in a highly competitive environment, especially because, as I said earlier, safety initiatives cost money. And sometimes a regulation may be the only way to ensure public safety.
And I also understand that small- to medium-sized companies may not have the financial resources to invest in sophisticated technology or more staff. In the case of Montreal, Maine and Atlantic Railway, they dealt with this in part by reducing the operating speed of their trains rather than make costly investments in track repairs. And when, eight months before the accident, they experienced problems with one of their locomotives, they “fixed” it with a non-standard polymer that lacked the necessary strength and durability. But: examples like these are all the more reason to conduct a risk analysis of operations, and then put in place mitigation to reduce the chances, or the consequences, of an accident. That's what managing risk is all about.
There's an old adage: “If you think safety is expensive, try having an accident!” So let's look at the costs of the Lac-Mégantic accident. I can't give you a final tally—I don't think anyone can at this point. But it starts with the loss of 47 lives: you cannot put a price on that. Another 2,000 people were forced from their homes and a recent study has revealed that many of the citizens have faced months of ongoing stress and health issues. Then there's the actual cleanup, including the decontamination from spilling six million litres of volatile crude oil into the centre of town and the adjacent lake. There's also the rebuilding of the town, the loss of revenue to the local businesses … and look at the ripple effect on the rail industry and the significant loss of public confidence in rail safety. As I said earlier, this was the worst Canadian rail accident in over a century. But even much smaller accidents can take a significant financial toll on companies, and some have gone under as a result.
Partly because of what we learned at Lac-Mégantic, the TSB's 2014 Watchlist features several rail-related issues, including the safe transportation of flammable liquids, as well as safety management and regulatory oversight. So far, the Watchlist, which identifies those issues posing the greatest risk to Canada's transportation system, has been an excellent tool, a real “blueprint for change.” In fact, by directing public and media interest this way, we've helped persuade change agents to take concrete action, and thus we've increased the uptake on our recommendations.
The Watchlist, though, isn't our only tool. Recently, the TSB also announced plans to launch an in-depth investigation into the risks that persist in smaller “air taxi” operations across Canada. For instance, these smaller carriers—many of them one- or two-aircraft outfits flying smaller planes in more remote territory—account for a stunning proportion of commercial aviation accidents: almost 60 percent in the past 10 years. And roughly 65% of the fatalities.
Now, the TSB's investigation into air taxi accidents is a long way from complete—we're still setting out the terms of reference, as we speak—but in addition to seeking the reasons behind those headline-worthy numbers, we will definitely be looking at how these smaller companies manage their safety risks.
That's a lot of work for our relatively small organization, but we've grown used to the workload—and, if I may say so, grown good at it. Next month, it will be 25 years since the creation of the TSB. For almost a quarter of a century we've investigated accidents, identified the causes and contributing factors, and then done our best to persuade the people and organizations best placed to effect change that more action needs to be taken.
And I'm here to say that that is what we will continue to do for the next 25: to examine, to identify, to use facts, science, well-reasoned analysis and solid arguments to advance transportation safety along our country's railways, its pipelines and waterways, and in our sky.
Because there's not a single person in this country whose life isn't impacted in some way by transportation, or transportation safety. Our economy, and often people's lives, rely on it. And that makes what we do matter even more.
- Date modified: