Speeches

The Evolution of Transportation Safety Investigation,
a Canadian Perspective

Introduction

Increasingly, countries in all parts of the world are establishing independent government agencies to investigate transportation accidents (and incidents) for the sole purpose of advancing safety. Some deal with only one transportation mode; others are multi-modal. There can be differences in organization structure, nature and scope of mandate, etc.; but a growing number have two things in common: independence and a focus on safety. In this paper, I shall describe the evolution that led to the Transportation Safety Board of Canada (herein referred to as TSB-C) and the philosophy on which it is based. I shall also provide some personal observations from my experience with the previous unimodal (aviation) safety board and the current multi-modal aboard. Finally, I shall discuss the investigation methodology that we use in all four transportation modes within our Board's mandate.

The Evolution of the TSB-C

The investigation of transportation accidents in Canada was, for many years, carried out competently and efficiently by the transportation regulatory agencies. Gradually, the public began to note, particularly in aviation, that the regulator (the Department of Transport) set the safety standards for the industry, operated elements of the system such as airports and air traffic control, licensed the carriers and the crews, and enforced its own regulations. At the same time, it analysed the safety failures in the industry in which it had such a pervasive presence. The public began to doubt the appropriateness of the system and later began to ask for some reforms.

Officials within the Department of Transport protested that they knew the industry better than anyone else and that they were competent and objective, which was generally an accurate view. Understandably, they wanted to keep accident investigation within the Department of Transport's mandate. Meanwhile, people outside the Department developed a strong argument for change, and not just for aviation. They worried that the regulators might not always be objective, particularly when the stakes were high. In the mid 1970s, the Government introduced a draft law to establish the office of an independent Commissioner of Transportation Accident Investigation. His mandate would be to investigate fatal air, marine and rail transportation accidents, and also to investigate some nonfatal accidents of particular interest. At that time, society saw the consequences of the accident, expressed by the number of fatalities, as of paramount importance in justifying an investigation. Generally, attention was on cause. The importance of discovering the underlying safety problems had not yet caught the attention of most of those who were involved or interested.

By that time, investigators and legislation drafters had made some large steps forward in the thinking about accident investigation. It was accepted that the causes of transport accidents often cannot be determined with scientific certainty. However, risks to safety can still be determined. It was also accepted that cause is so often linked to blame that it would be preferable to distance cause determination from the responsibilities of the investigator. Complicating matters a little was continuing public expectation that findings about cause would be included in investigation reports. To accommodate the several views present at the time, the Commissioner was to be directed to make findings on causes. That is, the Commissioner would discuss findings that appeared to be related to cause but not be directed to state the cause or the probable cause as had been the custom. In the government proposal there would also be direction to identify system-wide safety deficiencies. This would move the focus, at least in some investigations, from the circumstances of individual accidents to symptoms of system-wide problems identified in the investigation and, more importantly, to safety problems that need not be related to cause.

That draft legislation died before passage into law because of the adjournment of a Parliament. However, the concept of an independent investigation agency was resurrected a few years later.

In February 1978, there was a major aviation accident in western Canada. A Boeing 737 was landing in reduced visibility at an uncontrolled airport in a mountainous area. Just after touchdown the pilots saw snow clearing equipment ahead of them on the runway. They attempted to do a go-around but, shortly after becoming airborne, the aircraft became uncontrollable and it crashed beside the runway. There were numerous fatalities and serious injuries. Not long into the investigation the investigators were accused of incompetence and of destroying evidence. The public reaction was strong and other aviation safety issues were raised and debated to the point where the government appointed a judge to conduct an inquiry into aviation safety in Canada. The high profile inquiry lasted over two years and the first volume of its report, in late 1981, dealt with aviation accident investigation. The inquiry documented a couple of instances where, at higher levels within the Department of Transport, attempts had been made to influence the work of accident investigators. That was sufficient for the judge to recommend an independent federal agency to investigate aviation accidents and incidents. He felt that the same approach for other modes of transportation should be considered at a later date.

The government was ready and proceeded with the drafting of new legislation. The result was the Canadian Aviation Safety Board (CASB) which began operations in 1984 with an innovative and comprehensive accident investigation and safety mandate. In many respects, the CASB was modelled after the U.S. National Transportation Safety Board (the NTSB). However, there were also some noteworthy differences. For example, there was no reference in the CASB's mandate to the determination of probable cause. Instead the Board was to make findings as to (or about) causes and contributing factors. There was also an explicit mandate "to identify safety deficiencies" as evidenced by aviation accidents and incidents. Canada adopted the good ideas from several countries and adapted them to the current thinking and societal context in Canada.

The uni-modal CASB was replaced by the multi-modal TSB-C in 1990. This change occurred faster than originally planned because of internal conflicts in the CASB. There were differing views among Board Members regarding their role and their interaction with the technical staff of the agency. That philosophical difference deteriorated into a dispute over the investigation of a major aviation accident, and then to the inclusion of a minority, dissenting view in almost every significant investigation report. The Government of the day passed a new law that abolished the Aviation Safety Board and established the Transportation Safety Board of Canada. The new law clarified the mandate and the role of Board Members, and it transferred accident/incident investigation responsibility in the marine, rail and pipeline modes from the regulators to the new independent safety board.

The Current Situation

The TSB-C has a simple mandate. Its only object is to advance transportation safety. It does so by:

  • Conducting independent investigations, and if necessary public inquiries, into selected transportation occurrences
  • Making findings as to causes and contributing factors
  • Identifying safety deficiencies
  • Making recommendations to reduce or eliminate the safety deficiencies
  • Reporting publicly on its investigations and related findings.

The TSB-C has now been operating for just over ten years and it appears to have a high level of credibility both within Canada and internationally. There were some changes made to our legislation in 1998. These can be summarized as increased independence from the regulators and the courts, increased emphasis on the identification of safety deficiencies, and some administrative tidying. There does not seem to be anyone calling for a return to the structure of the 1970s. As one who has personally experienced all three of the Canadian structural models during my public service career, I can say without hesitation that I strongly prefer the current structure, i.e. a fully independent, multi-modal safety board.

A Summary of the Philosophy Behind the TSB-C

In considering whether to establish an independent safety board, it must first be recognized that there are different types of investigations which all have a legitimate value in civilized society. Government regulators need transportation occurrence investigation as one of their tools in achieving regulatory compliance. The courts need accident investigations for both criminal and civil litigation purposes. In all of these, there is a necessary focus on who did something wrong. An agency like the TSB-C has no interest in determining blame or apportioning liability. We want to find out what happened, and why. The sole purpose of that information is so it can be used to reduce risk in the transportation system. That singularity of purpose increases our probability of success.

The probability of success is also enhanced by the independence of the safety investigator. The greater the separation from the regulators and from the courts, the greater the probability that those involved in accidents will speak freely and honestly to the investigators. The Canadian law includes protection against the release of witness statements, and it also contains restrictions against the use of the TSB-C's information or conclusions in legal or disciplinary proceedings.

The tone of the TSB-C's investigation reports is very deliberately non-emotional and non-accusatory. We try to produce convincing argument to persuade others to make safety improvements. The Board's Safety Recommendations are rarely prescriptive in nature; rather the message is: Please take action to resolve this safety deficiency. In fact, the Board is happiest when its investigation reports can describe the safety action that has already been taken, such that there is no need for any recommendation.

Finally, there is the matter of a uni-modal versus a multi-modal board. We believe our citizens have a right to a similar approach to safety in all the modes. We have also found that the same investigation methodology can be applied to all modes, and there are economies-of-scale (ie. cost savings) by being able to share some of our resources across modes.

Investigation Methodology

The TSB-C has developed a methodology that we call ISIM, the Integrated Safety Investigation Methodology. ISIM provides a focus on safety enhancement and it is applicable to all modes. It is not some unique creation. Rather, it incorporates elements used in other countries and in other industries.

ISIM integrates three key elements of the TSB-C's mandate: Investigation, Safety Analysis and Communication. We had originally treated Investigation and Safety Analysis as two separate functions. Investigators would assess the circumstances of individual accidents and incidents. Safety Analysts would use the data from multiple accidents or incidents to assess whether actions were required to reduce risk. We now treat both functions as part of investigations. Safety Analysis starts as soon as there are data to analyse. Similarly, Communication starts as soon as we have something to say; it is not left to the end of the process. We find that if we discuss safety issues, as they arise, with those who can make changes, they will often initiate corrective action. Thus the investigation report can report on Action Taken rather than on Action Required.

The elements of ISIM are as folows:

  • Notification of Accident/Incident
  • Assess Whether to Investigate
    • Main Criterion is the Potential to Advance Safety
    • We May Deploy Investigators Before Deciding
  • Continue Data Collection
  • Create Event Sequence
  • Examine Each Event for Unsafe Acts, Unsafe Conditions
  • Risk Assessment
    • Probability and Magnitude of Adverse Consequences
  • Defence Analysis
  • Safety Deficiency Identification
  • Assess Risk Control Options
  • Communication of Results

The Investigation Process starts with the notification of an occurrence (an accident or incident). The basic data are assessed to determine whether to conduct an investigation. The main criterion is the potential to advance safety. Additional data may be required to complete the assessment. If it is decided to investigate, we continue data collection to identify all the significant events both before and immediately after the accident.

We then begin the Analysis Process. Each event is examined for associated unsafe acts and unsafe conditions. We then search for deeper level underlying factors that facilitate those unsafe acts/conditions. Next, we do a risk assessment to estimate qualitatively the nature and extent of risks to safety. Since risk is the product of the probability of an undesired outcome and the magnitude of the adverse consequences, we look at both elements. The next phase is called defence or (barrier) analysis; however, defence analysis usually starts much earlier in the investigation. Inadequacies in defences or barrier between hazards and vulnerable subjects (people, property, or environment) are found in every accident. Either the defences didn't exist, or they didn't function as intended. There are two categories of defences: physical and administrative. Physical defences include protective guards, signals, alarms, etc. Administrative defences include standards, regulations, operating procedures, supervision, training, etc.

An underlying factor with a level of risk for which there are inadequate defences is considered a safety deficiency. Each identified safety deficiency is assessed for risk control options that could reduce probability or consequence. These options are then assessed for effectiveness, practicability, acceptability, etc.

The results must then be communicated to those who can make changes. In fact, safety communication occurs all through the process so that those who can make or influence change can initiate improvements quickly. Safety Communication for the TSB-C also includes the public release of an investigation report and of any associated safety recommendations.

Conclusion

The Transportation Safety Board of Canada is one of a small but growing number of truly independent agencies set up to investigate transportation accidents and incidents for the sole purpose of advancing safety. The evolution of the TSB-C has been determined by the socio-political environment in Canada.

Other countries who are considering establishing such an agency can benefit from the experiences of those that have preceded them. They need only consider the available examples, assess the underlying principles, adopt a workable model and adapt to their own socio-political environment.