Railway Investigation Report R16H0002

In May 2015, the Transportation Safety Board of Canada launched a Class 4 safety issues investigation (safety study) on the use of locomotive voice and video recorders under the Canadian Transportation Accident Investigation and Safety Board Act. Transport Canada and key rail stakeholders were invited to participate in this study. The safety study identified some best practices, identified and evaluated implementation issues, examined potential safety benefits of the expanded use of on-board recorders, and collected background information for the development of an action plan to implement locomotive voice and video recorders.

The issue of on-board video and voice recorders has been on the Transportation Safety Board of Canada's (TSB's) Watchlist since 2012. Currently, there is no requirement to record crew communications and interactions in locomotive cabs. However, objective data are invaluable in helping investigators understand the sequence of events leading to an accident and in identifying operational and human factors issues, including those that may affect crew performance. When recorders are used proactively, as part of a safety management system, the information collected could also provide significant benefits to help identify and mitigate risks before accidents occur.

In May 2015, the TSB launched a Class 4^{Footnote 1} safety study on the use of locomotive voice and video recorders under the Canadian Transportation Accident Investigation and Safety Board Act. Transport Canada (TC)^{Footnote 2} and key rail stakeholders were invited to participate in this study. The safety study assessed, on a small scale, current technology, legislative and regulatory issues, operational and human factors issues, and potential safety benefits of the expanded use of on-board recorders. There were opportunities for open discussion among key stakeholders regarding how to use of this technology appropriately and how to reconcile differing perspectives on its use through various aspects of implementation.

Key observations for each type of assessment were captured and are summarized as follows:

Technology assessment

Voice and video recorders have been installed in some locomotives operating in Canada on a trial basis. Technology issues relating to the implementation of locomotive voice and video recorders (LVVRs) in these trials were identified. While some of the trial installations had common system characteristics, the results of the assessment show that companies were deploying a wide range of technology to explore the best means to achieve the safety benefits. The lessons learned on the use of recorders in the aviation and marine modes are a starting point for the development of this technology for rail.

Legislative and regulatory assessment

All concerned parties had opinions on the legal matters and employee rights relating to the use of LVVRs. One concern was that the use of on-board recorders could infringe on privacy and rights of company employees under the Canadian Charter of Rights and Freedoms. To prevent this infringement, it was suggested that guidelines and terms for the use of LVVR need to be established and that this could most easily be undertaken within the framework of a “just culture.”^{Footnote 3} Successful implementation of LVVR technology will depend on ensuring the appropriate balance of rights and obligations for the key stakeholders.

Operational and human factors assessment

The extent to which 3 types of recording systems (voice-only, video-only, and voice-and-video) can be used to identify operational and human factors information was examined. Clear examples of both human factors and operational issues were observed, validating the potential for the use of this technology. Specific conclusions for these types of recording systems include the following:

• For voice-only systems, audio data when combined with forward-facing video data provide a meaningful amount of information concerning crew use of many locomotive controls as well as responses to external train control signals and to audible alarms.
• For video-only systems, the quality and coverage (i.e., camera angles, field of view) of the system influence the ability of observers to assess operational and human factors (such as crew interaction). A system that provides the most complete and direct view of crew members is most effective.
• For voice-and-video systems, it is important that the technology is of an appropriate level of quality to provide clear, unambiguous recordings in a reliable manner. This is the most effective option for assessing crew operational and human factors behaviour.

These results indicate that LVVRs, with the right combination of recording technologies, can provide data not only for accident investigations, but also for proactive identification of unsafe conditions that could lead to incidents and accidents.

Safety benefits assessment

As part of the safety study, the following potential uses of LVVR recordings were explored:

• understanding operations in the locomotive cab to identify unsafe conditions and to improve the operating environment;
• shaping behavioural change;
• identifying and rewarding best practices;
• identifying risky behaviours, followed by education, procedures, and training;
• considering progressive discipline; and
• enhancing crew safety and security.

Based on these discussions and the related operational and human factors assessments, it was established that LVVR technology could help enhance safety. However, there are strong disagreements among stakeholders on how to implement this technology in a way that maintains and protects the rights and obligations of all involved. Engagement in designing the implementation, procedures to protect individuals, and use within a just culture were the strongest suggestions for achieving these ends.

The safety study has identified some best practices, identified and evaluated implementation issues, and collected background information for the development of an action plan to implement LVVRs. There is general agreement among railway industry stakeholders on the fundamental value of this type of data. However, there are a number of outstanding differences of opinions on the appropriate use of LVVRs. If these differing perspectives can be reconciled, implementation of this technology could result in considerable safety benefits to the railway industry.

With the completion of this safety study on LVVRs, the following actions will be taken:

• The final report will be circulated to key stakeholders in the 4 transportation modes: Aviation, Marine, Rail and Pipeline.
• The TSB will initiate discussions with TC regarding next steps for the implementation of LVVRs and the expanded use of on-board recorders in all modes.

The issue of on-board video and voice recorders (“on-board recorders”^{Footnote 4}) has been on the Transportation Safety Board of Canada's (TSB's) Watchlist since 2012. Currently, there is no requirement to record crew communications and interactions in locomotive cabs. However, objective data are invaluable in helping investigators understand the sequence of events leading to an accident and in identifying operational and human factors issues, including those that may affect crew performance. In addition to their value in accident investigation, there is also potential safety value for these recorders when they are used in the context of proactive safety management.

The TSB is encouraged that railway industry stakeholders agree on the fundamental value of this type of data. The TSB is hopeful that outstanding differences can be resolved to allow use of on-board voice and video recordings as a reliable source of information for both investigative purposes and proactive safety management. The TSB is committed to working with Transport Canada (TC)^{Footnote 5} and the railway industry to remove legislative barriers to allow such use.

Following the 2012 accident involving a VIA Rail Canada Inc. (VIA) passenger train near Burlington, Ontario,^{Footnote 6} there have been a number of industry initiatives to advance this issue. These include the 2012 study conducted by the Advisory Council on Railway Safety (ACRS) Working Group on Locomotive Voice and Video Recorders.^{Footnote 7} More recently, there have been a number of railway-initiated studies and proposals for trial implementations of locomotive voice and video recorders (LVVRs), including the Canadian National (CN) pilot study in the United States and the VIA pilot study involving voice recorders. There have also been a number of initiatives by the Federal Railroad Administration (FRA) and the Association of American Railroads (AAR) in the U.S. In addition, some equipment manufacturers have moved forward with developing systems and equipment for on-board recorders that are, or can be, interfaced with other locomotive recording devices such as forward-facing cameras and locomotive event recorders (LERs).

This safety study, conducted as a TSB Class 4 investigation under the Canadian Transportation Accident Investigation and Safety Board Act (CTAISB Act), was convened in May 2015 to explore the implementation of LVVRs in Canada. The LVVR safety study was conducted in collaboration with TC and with the participation of a number of key railway stakeholders, including

• the Railway Association of Canada (RAC), representing the overall railway interests, including the specific interests of railway members not involved in the study such as short-line railways;
• CN, Canadian Pacific Railway (CP) and VIA, representing the interests of major railways;
• GO Transit, representing the interests of commuter railways; and
• Teamsters Canada Rail Conference (Teamsters) representing the interests of railway operating employees.

1.1 Scope and objectives of safety study

This safety study provides information on the technology, safety benefits, operational best practices, and legal aspects of LVVR. Specific objectives of the study include

• documenting operational practices used in the current trials to support maximal use of information recorded while maintaining privacy and security of the information;
• identifying key aspects of the technology that would need to be in place to ensure that the equipment is sufficiently robust, provides the information required, and maintains the information in a format readily accessible to all permitted parties;
• examining the results of pilot implementations of variations of the technology, including the identification of safety information that can be obtained using this technology;
• summarizing the legal, regulatory, and privacy aspects of the initiative in order to provide an informed basis for deciding the most appropriate legal framework for implementation; and
• summarizing perspectives on appropriate use.

During scoping of the safety study, the following issues and limitations were incorporated into the plan:

• The pilot studies of the use of LVVRs included the operators that undertook trials within the timeline of the safety study. Some of these trials included operations in the U.S. The technology assessed was limited to the systems that had been implemented by the participating railways. Development of an industry standard was not within the scope of this study.
• The review of the legal context was restricted to identifying and summarizing key themes, rather than analyzing detailed jurisprudence.
• The operational/human factors review was restricted to assessing sample on-board recordings from each railway in order to assess the effectiveness of technology and the type of safety information that can be obtained. See Appendix A for the guiding principles for conducting these assessments.

In summary, the scope of the safety study was established to provide a sound basis for going forward, including identifying potential technology and operational pitfalls and providing opportunities for open discussion of privacy/operational issues by the study participants.

1.2 Data recorders within the transportation industry

1.2.1 Data recorders for safety investigations

In the aviation mode, flight data recorders (FDRs) have been required since the early 1960s,^{Footnote 8} and cockpit voice recorders (CVRs) have been required since 1964. In the marine mode, the use of voyage data recorders (VDRs), which include voice recordings as well as parametric data and images of radar, has been mandated by the International Maritime Organization (IMO) since 2002.^{Footnote 9} The data from these types of recorders have provided essential information about operations leading up to and during an accident. Without these recordings, many safety deficiencies would have been difficult to verify or would not have been identified at all.

In the rail mode, LERs record key parameters relating to train operations and performance. Like FDRs and VDRs, LERs provide information on some operator actions. This information is essential for accident investigation. Currently, no country has required the installation of voice and/or video recorders within the locomotive cab. In the rail industry, as in the aviation and marine industries, interoperability across international boundaries must be considered by companies to ensure consistency in their operations. This often leads to the implementation of similar approaches to regulations and rules.

In the aviation and marine modes, the International Civil Aviation Organization (ICAO) and the IMO provide specific guidance and standards on the technology and use of the information collected. However, for the rail industry, there is no international organization to prescribe or recommend obligations and practices relating to this technology.

Similar to the rail mode, there are no current requirements in aviation to have CVRs. However, there have been a number of safety recommendations regarding such recorders from various accident investigation agencies, including the U.S. National Transportation Safety Board (NTSB).^{Footnote 10} Some aircraft/helicopter manufacturers (or operating companies) have had video recorders installed on a voluntary basis.

1.2.2 Expanded use of on-board recordings

Companies' safety management systems (SMSs) require the collection and analysis of safety data, either reactively, following an occurrence, or proactively, as part of the ongoing identification of hazards or the assessment of whether hazards have been successfully mitigated. Triggers for collecting safety data can include known higher-risk operations, new operations, and locations/activities identified through trend analysis.

For transportation companies, operations monitoring is an important, proactive safety process. Although monitoring is not necessarily restricted to information on the work of employees in safety-critical positions, this is often the key focus because of the clear benefits to safety. Monitoring is a means for a company to assess whether it is meeting its safety targets, to assess whether safety actions are having the expected effect, and to monitor for new hazards. Different perspectives can lead to various uses of the collected data, including compiling safety statistics, identifying the need for system design changes, and understanding how to better ensure compliance with rules. The use of safety data depends on the type of hazard and on the company's approach to safety for that issue.

For railway companies, proactive safety data can include

• voluntary hazard reports from employees;
• radio surveillance;
• track-side and yard observations;
• road trips to conduct performance management or efficiency tests;
• automated monitoring of equipment;
• analysis of LER information; and
• analysis of the results of Railway Employee Qualification Standards for Operating Crew examinations.

These data elements can provide different insights into the operating practices of employees. Each data collection method has its own cost–benefit profile. For instance, road trips to conduct performance management or efficiency tests enable supervisors to observe operating conditions and employee actions first-hand. These performance management reviews and efficiency tests can help to identify the causes of unsafe behaviours. However, this method is relatively expensive, requiring considerable time from the supervisor. In addition, there is the risk that the behaviour observed will not match what normally occurs when employees are not being observed.

If safety information required to support the SMS cannot be efficiently and effectively collected using existing methods, the use of LVVRs may be appropriate. There are other emerging opportunities for collecting safety data, including recording of radio communications and remote monitoring of locomotives. In addition, analysis of existing data sources, including LER data, can provide insights into operator performance.^{Footnote 11} The choice of data collection method depends on efficiency, effectiveness, cost, and considerations of privacy.

Voice and video recording technology is constantly evolving. Its widespread availability and affordability today enable new opportunities in all modes of transportation for those requiring data relating to observation, documentation, and assessment of operator behaviour in work situations. Recently, academic “naturalistic” studies of driving^{Footnote 12Footnote 13} have used video, voice, and vehicle performance recordings to discreetly observe everyday vehicle operations. By assessing real-world operator behaviour, it is possible to better understand the conditions that contribute to unsafe actions and situations.

Recent experience relating to this type of collection of video and voice data suggests the following:

• This approach represents an improvement over historical methods used to observe operator performance, which often relied on trained researchers accompanying study participants or supervisors sitting next to operators, while recording on paper the behaviours observed.
• The historical methods afford the collection of only limited information, which can be vulnerable to limitations, including expectancy or observer bias, in which the participants' behaviour can be influenced by the physical presence of the observer. Another possible limitation is the potential for confirmation bias on the part of the observer, in which behaviour is interpreted subjectively to support previously formed hypotheses.
• Subjective self-reporting of behaviour by vehicle operators is another method used to study operator behaviour. However, the usefulness of self-reporting can be limited, especially if there is a tendency to self-report only those behaviours that are likely to be perceived positively.
• It is anticipated that the implementation of LVVR could allow the benefits seen in academic studies of driver performance to be brought to the rail industry by enabling better understanding of the actual performance of train operators while at work.

1.3 Recent TSB investigations and developments in Canada relating to on-board recorders

In January 1999, a VIA passenger train, travelling at 97 mph, passed a stop signal near Trenton, Ontario. Following an emergency brake application, the train came to a stop. There were no injuries to passengers or crew members. It was determined that the crew members had been engaged in conversations just before the occurrence. This distraction had likely contributed to the incident. Had the controlling locomotive cab been equipped with a voice recorder, it may have been possible to determine more definitively the effectiveness of the crew's communications as they approached the occurrence location.^{Footnote 14} In July 2003, the TSB recommended that

In February 2012, a VIA passenger train entered a crossover near Burlington, Ontario, while travelling at about 67 mph. The crossover had an authorized speed of 15 mph. The locomotive and all 5 passenger coach cars derailed. The operating crew members were fatally injured, and 45 people sustained various injuries. The investigation report stated that, in the absence of voice and video recorders, it was difficult to identify (with certainty) the human factors that contributed to the inappropriate crew response to the signal indications displayed. In addition, the dynamics and interaction between the 3 operating crew members could not be accurately determined.^{Footnote 15} In June 2013, the TSB recommended that

Other TSB investigation reports have reiterated the above recommendations.^{Footnote 16}

The results of these investigations suggest that on-board LVVR is the only objective and reliable method to more definitively determine the causal relationship between a railway occurrence and human factors such as employee communications, distractions, fatigue, and training. When causal links and related safety deficiencies can be confirmed, the resulting recommendations can be better tailored to address the root issues and to maximize rail safety improvements.

In 2012, the issue of on-board voice and video recorders was added to the TSB's Watchlist because of the lack of progress on the implementation of TSB recommendations. Since 2012, efforts among TC, companies, and unions to come to agreement on on-board LVVR have been generally unsuccessful and have stalled voluntary implementation initiatives.

Other recent developments in Canada relating to on-board recorders include the following:

• A 2006 Working Group Report, composed by TC, FRA, industry, and unions concluded that the rationale for the implementation of voice data recorders on aircraft (that is, lower survivability of aviation accidents) did not generally apply to the rail mode.
• A 2007 Railway Safety Act (RSA) Review and 2009 Working Report noted that, based on the TSB's 2003 recommendation, the use of voice data can make an important contribution to the determination of causes of and factors contributing to accidents and incidents by providing insight into the conduct and capacity of the locomotive crew. Recommendation No. 44 in the 2007 RSA Review was crafted to that effect. However, in 2011, the Working Group recommended against further pursuing the issue because of potential privacy concerns, limited identified safety benefits, and attempts to harmonize with the U.S., which had decided not to mandate on-board locomotive voice recorders.
• Following the February 2012 accident near Burlington, Ontario, the Minister of Transport requested further assessment of the issue of on-board LVVR. The ACRS established an LVVR working group. Industry disagreed with the use of LVVR data for TSB only, and requested access to voice and video recorder information for the purposes of monitoring compliance. Unions strongly opposed that request, based on concern that employees could be subject to disciplinary action following compliance monitoring. The ACRS working group determined that outward-facing cameras alone would offer little safety benefit. The working group agreed that installing on-board devices on a voluntary basis was the preferred approach and that the cost–benefit profile could be justified only if railways could use the recordings as part of safety and compliance monitoring. Subsequently, VIA committed, on a voluntary basis, to test and install voice recorders on its 73 locomotives by adding on-board microphones to its existing outward-facing video recording system. Rocky Mountaineer and GO Transit have also installed trial systems on a voluntary basis.
• In November 2013, the Minister of Transport requested that the Standing Committee on Transport, Infrastructure and Communities review and report on the Canadian regime for the safe transportation of dangerous goods and the role of SMSs. The committee recommended that
  • Transport Canada require the use by railways of on-board voice and video recordings as part of a company's safety management system, consistent with the Transportation Safety Board's recommendation.
• In February 2016, the Minister of Transport tabled in Parliament the report of the Canada Transportation Act Review, in which Recommendation 10b calls for “TC to develop a formal strategy for the implementation of in-cab voice and video recorders by 2020.”^{Footnote 17}

1.4 Recent NTSB investigations and developments in the United States relating to on-board recorders

In the U.S., following a number of railroad accidents,^{Footnote 18} the NTSB issued recommendations relating to on-board recorders. In 1997, the NTSB recommended that voice recorders be required for exclusive use in accident investigation. Then, in 2007, the NTSB recommended that the installation of both voice and video recorders be required for investigative purposes.

In September 2008, a Metrolink passenger train collided head-on with a Union Pacific Railroad freight train near Chatsworth, California. The accident resulted in 25 fatalities, including the locomotive engineer of the Metrolink train. The NTSB investigation^{Footnote 19} determined that a red signal was passed when the locomotive engineer of the Metrolink was distracted while using a personal wireless device. The NTSB found that an on-board LVVR would have provided investigators with better knowledge of the crew member's actions before the accident. On-board recordings would have helped to identify the key causal factors and might have facilitated the development of more effective safety recommendations. The NTSB also noted that LVVR technology could help identify design deficiencies or equipment malfunctions. In addition, the NTSB noted that, for accident prevention, LVVR technology should be used by company management in efficiency testing and performance management programs.

In January 2016, the NTSB placed Expand use of recorders to enhance transportation safety on its 2016 Most Wanted List^{Footnote 20} and called for:

For this issue, the NTSB urges the following actions (in part):

While it is concerned about invading individual privacy, the NTSB does not believe that employee privacy should take precedence over public safety, given the many accidents and incidents in all transportation modes. The NTSB has investigated a number of accidents and incidents that involved vehicle operator distraction. Further, the NTSB believes that workers in safety-critical positions in all industries should expect to be observed in the workplace. The NTSB has indicated that complete privacy in settings such as a locomotive cab, where lives of many are entrusted to the care of one, is not persuasive.

Other recent developments in the U.S. relating to on-board recorders include the following:

• In 2014, the Railroad Safety Advisory Committee established the Recording Devices Working Group to develop regulatory recommendations to address the installation and use of recording devices in controlling locomotives. By spring 2015, it was determined that there was no consensus on how to proceed with this issue within the working group.
• In December 2015, President Obama signed into law the Fixing America's Surface Transportation Act. This Act requires the passage of the Passenger Rail Reform and Investment Act of 2015, to promulgate regulations requiring the installation of inward- and outward-facing image recorders in controlling locomotive cabs and in the cab car operating compartments for passenger trains. The Act also includes certain baseline requirements, such as prohibiting the use of recordings by railroad carriers to retaliate against an employee.
• In spring 2016, the FRA announced that it would proceed with a Notice of Proposed Rulemaking. The FRA indicated that
  • This rulemaking would require the installation of inward- and outward-facing locomotive video cameras on controlling locomotives of trains traveling over 30 mph. The recordings would be used to help determine the cause of railroad accidents in order to prevent the occurrence of similar accidents. They would also be used to ensure railroad employee compliance with applicable Federal railroad safety regulations and railroad rules, particularly regulations prohibiting the use of personal electronic devices. This rulemaking would amend 49 CFR parts 217, 218, and 219.
• At May 2016, several U.S. railroads had installed video recorders in locomotive cabs. In the U.S., voice recordings are currently prohibited by law.

2.1 Technology assessment for LVVR

The technology assessment for LVVR was conducted as follows:

1. Assemble information on LVVR experience from the United States
   With respect to LVVR technology, there have been a number of recent initiatives in the U.S., including pilot projects by CN and CP in their U.S. operations. The FRA and AAR have also initiated some work in this area through the Recording Devices Working Group of the Railroad Safety Advisory Committee. Information on the U.S. experience, including manufacturer information, was assembled to ensure that lessons learned were identified and made available for consideration.
2. Assemble information on the TSB experience in the aviation and marine modes
   The TSB has valuable experience handling on-board voice recorders in the aviation and marine modes. Information on the TSB experience was assembled to ensure that lessons learned were identified and made available for consideration.
3. Assemble information on LVVR experience for railways in Canada
   Some railways in Canada had already undertaken technical trials of LVVR equipment. Information from these trials, including manufacturer information, was assembled to ensure that lessons learned were identified and made available for consideration.
4. Analyze the assembled information and group the information by technology issue
5. List key aspects of LVVR technology
   Based on recent experience in Canada and a review of similar initiatives in the U.S. and in other transportation modes, a list of the key aspects of LVVR technology that would need to be addressed to ensure a successful implementation was compiled.

2.2 Legislative and regulatory assessment relating to on-board recorders

The relevant legislation and regulations relating to LVVR and on-board recordings in general were identified. The legislative and regulatory assessment was conducted as follows:

1. Identify the applicable Canadian legislation and regulations across all modes, including rail, aviation, marine, and pipeline;
2. Identify the international rules, regulations, or safety recommendations for Commonwealth and European Union member countries,^{Footnote 21} as well as for international organizations, across all modes;
3. Summarize the legal issues in Canadian jurisprudence with respect to privacy and employment law that involve audio and video recordings in a variety of contexts; and
4. Summarize the legal issues from the Canadian Charter of Rights and Freedoms (Charter)^{Footnote 22} relating to privacy and employment context that may have implications for government and industry.

For each transportation mode, research was conducted to identify the most current domestic legislation or regulations regarding the use of on-board recording technologies. The relevant provisions in the legislation or regulations were noted. Research was also conducted in the international arena. Where applicable, commonalities among different countries in their approach to implementating recording technology and to expanding the focus on safety issues were noted.

2.3 Operational and human factors assessment of on-board recordings

As part of the operational and human factors assessment, the adequacy of 3 types of recording systems—voice-only, video-only, and voice-and-video—was reviewed. Each type of recording system was assessed to determine whether it could provide valid, reliable, operational and human factors information to help identify safety-relevant behaviours. Technical issues relating to data capture, retention/storage, and data file management for the 3 types of recording systems were also identified.

2.3.1 Methodology framework

The approach to operational and human factors assessment involved the development of a methodology framework. This framework allowed for the review and assessment of

• locomotive control inputs,
• safety-relevant human factors issues, and
• operational practices for the capture and handling of on-board recordings.

2.3.1.1 Locomotive control inputs

Safety-relevant issues in train operation / train handling and their related locomotive control inputs were assessed. The relevant locomotive control inputs were identified through a high-level task analysis^{Footnote 23} of typical locomotive crew behaviour and requirements. A subset of locomotive control inputs were selected for review.

Broadly, this assessment was conducted for 2 categories of issues related to capturing (1) locomotive control inputs under normal operating conditions and (2) non-normal situations, such as emergency radio communications and on-board alarms. Deficiencies in these areas have the potential to be mitigated through, for example, the development and design of improved and targeted training programs, the design and implementation of more ergonomically designed locomotive controls and equipment, and/or changes to operating procedures.

2.3.1.2 Safety-relevant human factors issues

A number of human factors issues that are known to affect safety and that can be managed effectively with appropriate defences were selected for review. The following is a brief description of each human factors issue:

1. Crew resource management (CRM) is the effective management and use of all resources, human and technical, available to a locomotive crew to ensure the safe completion of a trip. Possible indications of effective CRM in locomotive crews include assertiveness, operational conversation among crew members, effective problem-solving, appropriate leadership, and adaptability.
2. Stress is a physiological state that, if not maintained at an optimal level, can adversely impact an individual's ability to perceive and evaluate cues from the environment. Stress can result in attentional narrowing.
3. Alertness/fatigue represents a physiological need for sleep. It results when a crew member has obtained an insufficient quantity and/or quality of restorative rest. Observable indicators of fatigue include yawning, momentary closing of eyes, and sleeping.
4. Workload is a function of the number of tasks that must be completed within a given amount of time and the operator's ability to manage those tasks. If the number of tasks that must be completed increases, or if the time available decreases, then workload increases. Research shows that prosodic^{Footnote 24} features of speech, such as word frequency per unit of time, increase as a function of increased mental workload.^{Footnote 25} Shedding of tasks is an additional indicator of high workload.
5. Situational awareness is “the perception of elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future.”^{Footnote 26} The accuracy of a locomotive crew member's situational awareness contributes to effective decision-making by enabling the crew member to make better-informed, more accurate predictions of the consequences of a decision. Indicators of reduced situational awareness include non-operational conversation, gaze directed away from controls or away from the forward view, and inaccurate knowledge of one's location.
6. Distraction refers to the state of an individual when attention is directed toward a secondary, non-critical task. Inattention is the state of an individual when attention is not directed to safe operations, despite the absence of secondary tasks.

Readily observable indications of each of these human factors issues were identified, as means of assessing the presence of an issue in a recording. Ratings were assigned to indicate whether elements/signs of each human factors issue could be identified.

2.3.1.3 Operational practices relating to the capture and handling of on-board recordings

The operational and human factors assessment included a review of some of the technical issues relating to LVVR data capture, retention, and file handling/management, including

• the ability of the recording equipment to adequately capture data (Note: for the systems that recorded video, this meant image clarity and luminance, and the alignment and coverage area of the camera [or cameras]. For the systems that recorded audio data, this meant the microphone's [or microphones'] directionality and sensitivity);
• the size of the recorded files;
• whether LER data were synchronized with the LVVR data;
• whether LVVR data were time-stamped or otherwise provided accurate time and date information; and
• whether there were other means to identify LVVR data independently.

2.3.2 Assessment procedure for reviewing on-board recordings

Four subgroups were formed to assess the LVVR recordings provided by 4 Canadian railways. Participants within each subgroup included a TSB human factors investigator, a TSB rail investigator with operational experience, at least one operations representative from the railway company (railway), Teamsters delegates, and TC railway operations specialists.

Three types of on-board recording systems were evaluated:

1. Voice-only (Railway A subgroup)
2. Video-only (Railway B and Railway C subgroups), and
3. Voice-and-video (Railway D subgroup).

As part of the operational and human factors assessment, a review of representative samples of locomotive voice and video recordings was conducted. A behaviour checklist was developed to guide the review of the on-board recordings and to facilitate discussion within the subgroup. The “voice-and-video” behaviour checklist is provided in Appendix B.

The behaviour checklist comprised a number of elements to be assessed during the review of each on-board recording, including

• information regarding the on-board recording;
• information regarding the crew;
• capturing in-cab crew interactions;
• capturing elements of human performance, including stress, fatigue/alertness, workload, situational awareness, and distraction/inattention;
• capturing locomotive control inputs under normal operating conditions; and
• capturing non-normal situations in the locomotive cab.

Between February 2016 and April 2016, 9 subgroup review sessions (Table 1) were conducted. Each review session lasted from 2 to 6 hours.

Table 1. Number of sessions and recordings reviewed by each subgroup
(Note: all recording systems included external forward-facing video)

Subgroup	Recording type	Number of review sessions	Number of recordings reviewed
Railway A	Voice-only	3	14
Railway B	Video-only	2	5
Railway C	Video-only	1	5
Railways D	Voice-and-video	3	13

As it was not practical to examine all LVVR recordings from the trials in their entirety, a triage assessment was conducted for each on-board recording. Specific scenarios of interest, such as areas of heavy workload for train crew, low light conditions, time of day, shift length, and inclement weather, were identified. The triage assessment produced a number of partial recordings that were further examined by the subgroup.

The procedure for conducting the assessments of the extracted recordings was as follows:

• For each on-board recording, portions of the recording (i.e., typically 2 portions of approximately 10 minutes each) were reviewed by the subgroup.
• During group discussion, responses to the pre-determined questions on the behaviour checklist were documented.
• Data from the review sessions, including any qualitative comments, were documented.
• Differences among the LVVR system types or among environmental or operational conditions were identified.
• Comments from the subgroup members were explored. When appropriate, these comments were documented and grouped according to theme.
• Data for each railway were presented as follows:
  • Environmental/ operational conditions;
  • Ability to identify behaviour associated with safety-relevant operational issues, including normal operations, non-normal or emergency situations, and safety-relevant human factors issues; and
  • Technical issues.

2.4 Safety benefit assessment for on-board recordings

The following activities were conducted for the safety benefit assessment:

• Review benefits from ACRS study—The final report from the 2012 LVVR study conducted by ACRS was reviewed.
• Identify LVVR benefits for investigations—The LVVR benefits for occurrence investigations were reassessed and documented.
• Identify LVVR benefits for SMS—The LVVR benefits within an SMS framework were assessed and documented.
• Identify other LVVR benefits—Other LVVR safety benefits were assessed and documented.
• Explore the appropriate uses of LVVR information—Summarize the perspective of members of the working group on appropriate use of LVVR.

The main point of controversy about the implementation of LVVR technology is what constitutes acceptable use. LVVR recordings have been recognized as invaluable for accident investigations. However, the expanded use of the on-board recordings, beyond accident investigations, has been strongly contested. Central to the debate have been positions about the public's right to safety and the operator's obligation to manage safety versus the employee's right to privacy and the employee's strong concerns about whether the employer will use the on-board recordings in a fair manner. The safety study documented the stakeholders' current perspectives on expanded use and on how the different points of view relating to this use can be reconciled.

Perspectives from participants in the working group were collected through facilitated discussion on the expanded use of on-board recordings. The appropriateness of each potential use was considered, including use of recordings

• to obtain safety-related data, such as for SMS, human performance analysis, recording operational compliance, and hazards identification;
• to identify and reward best practices;
• to shape behavioural change through the perception that operator actions are being monitored;
• to identify risky behaviours, followed by education, procedures, and training improvement; and
• to investigate the need for progressive discipline.

This was followed by an exercise to look for opportunities to reconcile the different perspectives on use. The objective of the exercise was not to reach consensus, but to understand and document the aspects of expanded use that would need to be considered for any successful solution going forward. The working group examined approaches that could be established to support the needs of all stakeholders if expanded use of on-board recordings is permitted, including

• procedures, including retention, de-identification, and chain of custody;
• oversight and enforcement;
• parties involved, including who should be present/invited when reviewing the recordings; and
• ensuring trust, such as through co-development and evolution of use within the company.

Key observations for each type of assessment were captured and summarized.

3.1 Results of technology assessment

The results of the technology assessment consisted of observations for

• on-board recorders for the aviation and marine modes;
• experience in the U.S. with LVVR technology; and
• LVVR technology installed for Canadian pilot trials.

3.1.1 On-board recorders for the aviation and marine modes

The TSB has extensive experience with aviation flight recorders, including FDRs and CVRs. More recently, the TSB acquired experience with marine VDRs.Information on the recorders used in these modes was assembled to ensure that lessons learned were identified and made available to the railway industry for consideration.

3.1.1.1 Summary of observations relating to data recorders in the aviation mode

CVRs provide significant information that is not recorded on FDRs but is essential for fully understanding accidents. CVRs have helped to establish crew actions and interactions with each other and in relation to defined and briefed procedures. CVRs can capture aural warnings and, when synchronized with the FDR, can establish the relationship between warnings and crew actions. CVRs also capture the sound environment, enabling the analysis of machinery such as aural warnings and propeller speed. These recordings can be used to establish who is in the cockpit. In addition, these recordings provide input to human factors analysis of crew dynamics, insights into stress levels, and tone of interactions among crew members.

Some CVRs have been difficult to use when there has been inadequate maintenance, leading to situations where the recordings are not available or not suitable. Poor sound quality due to background noise can sometimes be a problem, particularly if the system does not use “hot microphones.”^{Footnote 27} Various scenarios have led to recording durations that were too short and to relevant events being overwritten. These scenarios include inherent limitations of the memory capacity of older recorders, operational decisions not to secure recordings before they are overwritten, and failure to record key actions because they occurred early in a flight that was of longer duration than the recording.

3.1.1.2 Summary of additional observations specific to marine VDRs

The problem of poor sound quality can be particularly acute when fixed microphones are used on a large bridge, leading to significant distances between the speaker and the microphones. High levels of background noise recorded by the area microphone has been found to limit the clarity of the recording from some of the microphones used as part of VDR systems.

VDRs currently record both audio and other data in a single compressed file. Having only one file has been problematic when returning the data component to the owners, as the audio component, which is privileged, cannot easily be excluded from the media to be returned. The VDR file also contains radar images and can be very large (greater than 100 GB), which can result in difficulties with data handling and data storage.

There is no standard for VDR playback software or documentation relating to the recorded data. This means that playback requires software and cabling that is specific to the manufacturer and/or model. Users of this information must therefore keep current on the wide variety of procedures for data retrieval and maintain many different playback programs. In addition, the lack of common standards for VDRs has led, on occasion, to incorrectly recorded time parameters and difficulties in extracting parameters.

3.1.1.3 Lessons learned from the aviation and marine modes

The lessons learned include the following:

1. Regular maintenance checks are required to ensure recording quality.
2. There is a risk that critical data will be lost if recorder memory does not meet crashworthiness standards.
3. The whole system, not only cameras and memory, must be robust, so that power failures and other equipment failures are immediately identifiable as rendering the system inoperable. It is not uncommon to find that recorder data has not been recorded correctly either due to a lack of an independent power supply or lack of crew knowledge of how to use the recorders in order to preserve the data.^{Footnote 28}
4. The first-generation CVRs recorded 4 audio channels of 30 minutes' duration on magnetic tape. Since 2003, newly manufactured large commercial aircraft have been required by ICAO to be equipped with a CVR capable of recording 2 hours; as of 01 January 2016, the ICAO requires all CVRs to be 2 hours, although this has been a U.S. Federal Aviation Administration requirement since 2012. TC regulations are not yet harmonized with this requirement. In the future, for new aircraft, the recording time for CVRs will be 25 hours, in order to capture long-duration flights (greater than 15 hours) and the pre- and post-flight activities. The intent of the standard is to ensure a duration that is sufficient to prevent overwriting significant events for either an extended journey or significant time powered. (Note: For rail, the duration should be at least the duration of the LER, which is specified as 48 hours in the U.S.^{Footnote 29}) The current performance specification for VDRs is 12 hours, which is often too short to capture all of the events related to an accident.^{Footnote 30}
5. Any problems with the intelligibility of voice recordings significantly impact both usefulness of the recording and the time and resources required to analyze it. The use of hot microphones significantly improves sound quality of recordings and is likely to provide operational benefits by making communication easier in loud operating environments.
6. Separate recording channels for each crew member, as well as an area microphone channel, improves the quality of recordings.
7. Standardization of data retrieval and playback is preferred to minimize problems obtaining and playing data.
8. It should be possible to synchronize all recorded data using a common time source.
9. Clear documentation of timing information and parameters collected is needed in order to support comprehensive, accurate analysis.
10. A system that combines both data and video/audio must provide an easy means to separate protected information before returning the data and device to the owner.
11. Recordings involving video have challenging storage requirements.
12. Each manufacturer's playback system requires unique software and cables. If the memory unit is damaged, a large expense may be incurred to transfer the data and then to recover it from another system.

3.1.2 Experience in the United States with LVVR technology

Following recommendations for on-board recorders from the NTSB,^{Footnote 31} there have been a number of recent initiatives in the U.S. involving LVVR technology, including pilot projects/implementations by CN, CP, Kansas City Southern, Union Pacific Railroad, Metrolink, and New Jersey Transit. The FRA and AAR also initiated some work in this area through the Recording Devices Working Group of the Railroad Safety Advisory Committee. Information on the U.S. experience, including manufacturer information, was assembled to ensure that lessons learned were identified and made available for consideration within the Canadian railway industry. This is provided in detail in Appendix C.

Based on the review of U.S. experience, the following challenges and lessons learned for LVVR were identified:

• Remote downloading of video was not practicable due to large file size and high cost.
• Some hardware was not appropriate in a reduced-lighting environment or high-ambient-noise environment.
• Tampering with cameras occurred.
• A number of U.S. railway operators had not installed on-board microphones.
• Video recordings were not regularly synchronized with other data.

3.1.3 LVVR technology installed for Canadian pilot trials

One of the tasks within the technology assessment for this study was to identify common practices for the existing LVVR in Canada, installed for pilot trials. Technical evaluation of the installed systems was beyond the scope of this study. However, common characteristics of these systems were identified. Each of these systems represents potential recording technologies available at the time of the study.

A detailed description of the characteristics of the technology used in each of the trial installations can be found in Appendix D. Common system characteristics of the 4 operators were identified and are summarized in Table 2. System schematics/layout for the 4 systems are presented in Appendix E.

3.1.3.1 Summary of the review of LVVR technology currently installed on Canadian railways

Cameras

• All installations included at least 2 on-board overhead cameras that captured the locomotive engineer's work area and the conductor's work area. All systems included a forward-viewing camera. One system included a 3rd on-board camera that captured a view of the electrical cabinet area.
• All installations included a camera housing to prevent tampering.
• Some camera housings provided environmental protection to various standards.
• All cameras were colour cameras, with varying resolutions and frame rates. Some cameras included infrared capability for low light conditions.
• Camera and lens specifications varied significantly.

Microphones

• Two of the systems had on-board microphones, one located near the locomotive engineer's position and one located near the conductor's position. Background noise was filtered using various applications.

Recordings

• Recording durations varied depending on the capacity of the hard drive and the recording frame rate. Generally, the duration was at least 72 hours.
• Recording format varied. However, H.264 and MPEG4 were the most common formats.
• All systems used video encryption as a means of security.

System

• All systems were configured to start when the locomotive was powered on and remain on while power was provided. None of the systems used motion detection to start or stop the recording.
• Most installed systems (3 out of 4) used a battery backup to allow proper shutdown in the case of a power interruption. All systems had an automatic restart when power was restored.
• The installed equipment conformed to a variety of standards and environmental conditions. There were no common environmental standard specifications.
• Only one system used a means of crash protection for the recording system that met the FRA crashworthiness standard.^{Footnote 32}

System management

• Video watermarks, including text or image overlay on the video, were not used in any system.
• Some systems required the removal of the hard drive and/or the use of dedicated software in order to retrieve the recorded data.
• All systems synchronized the on-board recordings with the forward-facing camera.
• Some systems synchronized the on-board recordings with LER and global positioning system (GPS) data.
• All operators controlled the access to the system equipment for maintenance and testing purposes.
• All operators had procedures to maintain “chain of custody” of the recordings.
• For all systems, video and audio settings were configured at the time of installation.

Table 2. Summary of system characteristics

Characteristics	Common to all	Common to some	No commonality
Camera installation	2 on-board cameras (engineer and conductor); 1 forward-viewing camera	Third on-board camera (wide view, including electrical cabinet)	None
Camera housing	For tamper protection	Provided environmental protection	None
Camera/lens specifications	Colour cameras	Infrared capability for low light	Various resolutions and frame rates
Auto start/stop	Start when locomotive is powered; do not use motion detection	None	None
Power interruption	Auto restart when power restored	Battery backup to allow shutdown	None
Environmental protection	None	None	Various environmental conditions and standards
On-board microphone installation	None	1 microphone near engineer and 1 near conductor	Audio filtering required owing to background noise
Crash protection	None	None	One system met FRA crashworthiness standard
Recording duration	None	Typically 72 hours	Duration varied owing to hard drive capacity and frame rate
Recording format	None	H.264 and MPEG4	None
Security and data access control	Watermarks not used Video encryption	Require removal of hard drive for data access; dedicated software for playback	None
Synchronization with other data	On-board and forward-viewing	LER and GPS	None
System access for maintenance	Controlled access for maintenance and testing	None	None
User-programmable settings	All settings configured at installation—no user-configurable settings	None	None
Chain of custody for recordings	Processes in place	None	None

3.2 Results of legislative and regulatory assessment

From a legal perspective, the expanded use of LVVR must be considered in a very complex environment. Consideration needs to be given to legislation and regulations concerning transportation, in Canada and cross-border in the U.S.; international standards for on-board recorders; and the complex issues relating to employers' and workers' rights and obligations, including the workers' reasonable expectation of privacy.

This section sets out the main issues in these areas in order to provide a basis for making decisions about future LVVR use. The results of the legislative and regulatory assessment consisted of observations relating to

• Canadian legislation and regulations,
• U.S. legislation and regulations,
• international standards and guidelines,
• challenges to surveillance in the workplace, and
• obligations and rights of an employer in regard to workplace recordings.

3.2.1 Canadian legislation and regulations

This section provides the relevant provisions from Canadian legislation pertaining to on-board recordings, for all modes.

Section 28 of the CTAISB Act speaks to the privileged nature of on-board recordings. It also addresses access to and use of those recordings by the TSB as well as other access and prohibited uses. Subsection 28(2) provides that:

(2) Every on-board recording is privileged and, except as provided by this section, no person, including any person to whom access is provided under this section, shall

       (a) knowingly communicate an on-board recording or permit it to be communicated to any person; or

       (b) be required to produce an on-board recording or give evidence relating to it in any legal, disciplinary or other proceedings.

There is some interpretational concern that these restrictions only exist when an accident or incident has occurred, or when the TSB has grounds to believe that a situation could, if left unattended, induce an accident or incident.

If the use of on-board recordings is expanded in any mode, to maintain consistency and fairness, changes will also need to flow through to the other modes of transportation where such recordings are present. The governing statutory provisions, which encompass the enabling acts as well as any regulations or rules subordinate to them, will therefore need to be reviewed.

As part of the Railway Safety Management System Regulations under the RSA, TC has required federally regulated railway companies to have an SMS in place since 2001. Central to any SMS is the proactive collection of data to ensure that hazards are identified and that mitigations are achieving their intended results. Section 5 of the Railway Safety Management System Regulations, 2015 states:

5   A railway company must develop and implement a safety management system that includes

      (a) a process for accountability;

      (b) a process with respect to a safety policy;

      (c) a process for ensuring compliance with regulations, rules and other instruments;

      (d) a process for managing railway occurrences;

      (e) a process for identifying safety concerns;

      (f) a risk assessment process;

      (g) a process for implementing and evaluating remedial action;

      (h) a process for establishing targets and developing initiatives;

      (i) a process for reporting contraventions and safety hazards;

      (j) a process for managing information;

      (k) a process with respect to scheduling; and

      (l) a process for continual improvement of the safety management system.

The expanded use of LVVR is a potential means of achieving these objectives. But, in order to proceed in this direction, consideration must be given to a wide range of legislation and regulations in Canada.

3.2.1.1 Governing acts and regulations regarding on-board recordings

The CTAISB Act would need amendments, and a number of statutes administered by TC could be affected. Under each statute, there are also numerous regulations or orders that could also be affected. Appendix F of this report provides a preliminary list of statutes that may fall within this category. Other federal statutes not directly related to transportation, such as the Access to Information Act and the Personal Information Protection and Electronic Documents Act (PIPEDA), must also be considered. The discussions on the implementation of LVVR have touched on the topics of privacy, access, and use. A comprehensive assessment is therefore required in order to examine the legal space encompassing labour and employment law, and the rights of both privacy and access to information. A section 8 analysis under the Canadian Charter of Rights and Freedoms may also be necessary if proposed legislation provides railway companies with access to the on-board recordings.

It will also be necessary to review the regulations under any relevant statutes that touch upon the installation, implementation, servicing, protection, and preservation of the recording devices in order to determine all the instances where amendments need to be made or new definitions added.

The following tables provide current legislative provisions that specifically reference “on-board recorder” or “on-board recording” (see section 3.2) for each transportation mode. The information in these tables is not exhaustive and should not be construed as legal opinion.

3.2.1.2 Examples of existing statutes and subordinate legislation referencing on-board recordings

Transportation accident investigation and safety

Enabling statute and purpose	Sections referencing “on-board recorder” or “on-board recording”	Subordinate regulation(s) and purpose	Sections referencing “on-board recorder” or “on-board recording”
Canadian Transportation Accident Investigation and Safety Board Act, SC 1989, c 3 An Act to establish the Canadian Transportation Accident Investigation and Safety Board and to amend certain Acts in consequence thereof	S 28(1) (a), (b); (2)(a), (b); (3); (4); (5); (6)(b), (c); (7)	Transportation Safety Board Regulations, SOR/2014-37 Regulations made with respect to the activities of the TSB	None

Air transportation

Enabling statute and purpose	Sections referencing “on-board recorder” or “on-board recording”	Subordinate regulation(s) and purpose	Sections referencing “on-board recorder” or “on-board recording”
Aeronautics Act, RS 1985, c A-2 An Act to authorize the control of aeronautics	S 22 (1)–(9); S 23 (1) (a), (b) (i), (ii); S 23 (3); (4) (a), (b); (5); (6) (a); & (8)	Civil Aviation Regulations, SOR/96-433 Regulations Respecting Aviation and Activities Relating to Aeronautics	S 605.33(1); (2); S 605.34(1) (b); (2); (3); (4) (a); (5) (b)

Rail transportation

There are currently no audio or video recorders used in the railway industry that are equivalent in purpose and function to the CVR or VDR devices used in the aviation or marine industries.

Under section 3.1 of the RSA, the Minister of Transport is responsible for the development and regulation of matters to which the RSA applies, including safety and security, and for the supervision of all matters connected with railways and, in the discharge of those responsibilities, the Minister of Transport may, among other things, promote railway safety by means that the Minister considers appropriate; undertake, and cooperate with persons undertaking, projects, technical research, study or investigation; inspect, examine and report on activities related to railway matters; and undertake other activities that the Minister considers appropriate.

The authority to make regulations relating to on-board LVVR, including how to manage the information generated, is contained in the RSA, sections 18 and 37. However, depending on the approach taken, mandating LVVR could require legislative change to the Act, as well as new regulations.

Marine transportation

Enabling statute and purpose	Sections referencing “on-board recorder” or “on-board recording”	Subordinate regulation(s) and purpose	Sections referencing “on-board recorder” or “on-board recording”
Canada Shipping Act, 2001, SC 2001 c 26 An Act respecting shipping and navigation and to amend the Shipping Conferences Exemption Act, 1987 and other Acts	None	Voyage Data Recorder Regulations, SOR/2011-203Footnote 33 Regulations Respecting Voyage Data Recorders and Related Activities	None

Pipelines

The pipeline industry currently employs a type of recording device in some operations centres.

Enabling statute and purpose	Sections referencing “on-board recorder” or “on-board recording”	Subordinate regulation(s) and purpose	Sections referencing “on-board recorder” or “on-board recording”
National Energy Board Act, RSC 1985, c N-7 An Act to establish a National Energy Board Canada Oil and Gas Operations Act, RSC 1985, c O-7 An Act to promote, in respect of the exploration for and exploitation of oil and gas, (a) safety, particularly by encouraging persons exploring for and exploiting oil or gas to maintain a prudent regime for achieving safety; (b) the protection of the environment; (b.01) accountability in accordance with the “polluter pays” principle; (b.1) the safety of navigation in navigable waters; (c) the conservation of oil and gas resources; (d) joint production arrangements; and (e) economically efficient infrastructures.	None	National Energy Board Act Part VI (Oil and Gas) Regulations SOR/96-244 Regulations for Carrying Into Effect the Provisions of Division I of Part VI of the National Energy Board Act National Energy Board Onshore Pipeline Regulations	None

3.2.2 United States legislation and regulations

3.2.2.1 National Transportation Safety Board

Under the Freedom of Information Act, the NTSB is exempt from releasing CVR tapes.^{Footnote 34}

3.2.2.2 Rail

The U.S. began implementing LVVR technology voluntarily in several large railways. The recently introduced bill (December 2015) to the 114th Congress of the U.S. Senate, Fixing America's Surface Transportation Act, is an attempt to reconcile various surface-transportation bills (i.e., road, marine, rail) and provide funding to improve or repair infrastructure, improve safety practices, and introduce new systems. This bill also includes the provisions of amendments for new LVVR technology, specific to the installation of in-cab audio and image recording devices in all controlling locomotive cabs and cab car operating compartments in passenger trains.^{Footnote 35} These recording devices will have a minimum 12-hour continuous recording capability; crash and fire protections for any in-cab image recordings that are stored only within a controlling locomotive cab or cab car operating compartment; and recordings accessible for review during an accident or incident investigation. The provisions also allow use of the recordings

• for an operator to verify that train crew actions are in accordance with applicable safety laws and the railroad carrier's operating rules and procedures;
• for assisting in an investigation into the cause of a reportable accident or incident; and
• for documenting a criminal act or monitoring unauthorized occupancy of the controlling locomotive cab or car operating compartment.

An in-cab audio or image recording obtained by a railroad carrier under this section may not be used to retaliate against an employee.

Similar to Canada, railroad operators in the U.S. are required to have LER.

3.2.2.3 Air

As of 2014, FDR and CVR are required only on U.S. aircraft that have 20 or more passenger seats or on aircraft that have 6 or more passenger seats, are turbo-charged, and require 2 pilots.

3.2.2.4 Marine

As in Canada, the IMO International Convention for the Safety of Life at Sea (SOLAS) Chapter V, Annex 10, Regulation 20 for VDRs applies.

3.2.2.5 Pipeline

Under the Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, pipeline operators are required to monitor human factors. However, electronic surveillance is not currently used to monitor personnel working in a control centre. Operational data are recorded using supervisory control and data acquisition (SCADA) systems, which are computer-based tools that provide an integrated summary of remote pipeline sensors and controls.

3.2.3 International standards and recommended practices

In common-law countries, including Australia, New Zealand, and United Kingdom, the legislation and regulations typically are very similar to those in Canada with respect to the handling and protection of on-board recordings. However, in countries where civil-law structures are in place, such as France, Belgium, Italy, and Germany, judicial decision-makers are often the first-line authorities who have precedence with regard to the handling and disposition of on-board recordings. Therefore, on-board recordings tend to be used more frequently for judicial purposes.

In general, countries follow the overarching conventions and regulations set down by five international organizations:

3.2.3.1 International Civil Aviation Organization (ICAO)

ICAO provides the standards and recommendations for the use of CVRs.^{Footnote 36} In addition, the European Organisation for Civil Aviation Equipment (EUROCAE) provides the specifications for CVR performance requirements in its Minimum Operational Performance Specification (MOPS) document. Generic investigation procedures, under ICAO Annex 13, Aircraft Accident and Incident Investigation, provide that “the state conducting the investigation shall not make available^{Footnote 37} specific records, including communications between persons having been involved in the operation of the aircraft, cockpit voice recordings and transcripts from such recordings and cockpit airborne image recordings and any part or transcripts from such recordings.” However, ICAO permits individual countries to file exceptions to its standards, and some countries have done so with respect to on-board recordings.

3.2.3.2 European Aviation Safety Agency (EASA)

Under European Union Commission Regulation No. 965/12012, EASA complies with ICAO standards. This regulation details the mandatory installation of a CVR and the specific requirements associated with its use during flight and post-flight and in the event of an occurrence.

3.2.3.3 European Union Agency for Railways (ERA)

Comprising representatives from each EU member state, the ERA was established to provide member states and the European Commission with technical assistance in the fields of railway safety and interoperability. This involves the development and implementation of technical specifications for interoperability (TSI) and a common approach to questions concerning railway safety. The main task of the ERA is to manage the preparation of these measures by working with the National Investigation Bodies on accident investigation methods, reporting, recommendations, and exchange of good practices.

Although Directive 2008/57/EC of the European Parliament on railway interoperability makes reference to locomotive event recorders in the use of TSIs, as yet there has been no formal approach to the introduction or implementation of LVVR technology.

3.2.3.4 International Maritime Organization (IMO)

In May 2012 the Maritime Safety Committee of the IMO adopted a revised recommendation on performance standards for VDRs, in force since 1 July 2014. Bridge audio is recorded, as well as images, chart(s) used, and settings from the electronic chart display and information system and from both radars.

Passenger ships and ships other than passenger ships of 3000 gross tonnage and upwards constructed on or after 01 July 2002 must carry VDRs to assist in accident investigations, under regulations adopted in 2000, which entered into force on 01 July 2002. The mandatory regulations are contained in chapter V on Safety of Navigation of SOLAS, 1974. Like the black boxes carried on aircraft, VDRs enable accident investigators to review procedures and instructions in the moments before an incident and help to identify the causes of an accident.

International Convention for the Safety of Life at Sea, chapter V, Regulation 20 – Voyage data recorders

Regulation 20 of SOLAS chapter V states that, to assist in casualty investigations, ships on international voyages, which are subject to the provisions of Regulation 1.4, must be fitted with a voyage data recorder (VDR). Ships covered by Regulation 20 include

1.1 passenger ships constructed on or after 1 July 2002;

1.2 ro-ro^{Footnote 38} passenger ships constructed before 1 July 2002, not later than the first survey on or after 1 July 2002;

1.3 passenger ships other than ro-ro passenger ships constructed before 1 July 2002 not later than 1 January 2004; and

1.4 ships, other than passenger ships, of 3,000 gross tonnage and upwards constructed on or after 01 July 2002.

Under IMO, the ship owner, in all circumstances and at all times, owns the VDR and its data, except when an accident occurs. In the event of an accident, the investigation body is responsible for downloading the data and must provide a copy to the vessel owner at an early stage.

3.2.3.5 European Maritime Safety Agency (EMSA)

The European Maritime Safety Agency (EMSA) was established under Regulation (EC) No. 1406/2002 for the purpose of ensuring a high, uniform, and effective level of safety. Among its tasks, the agency has the role of supporting the member states in activities concerning marine accident investigations. The following documents provide the EMSA with IMO requirements (IMO MSC/Circ/1024) for shipborne VDRs and simplified VDRs (S-VDRs):

• Resolution A.861(20) – Performance standards for shipborne voyage data recorders (VDRs)
• Resolution MSC.163(78) – Performance standards for shipborne simplified voyage data recorders (S-VDRs)
• MSC/Circ.1024 – Guidelines on voyage data recorder (VDR) ownership and recovery
• Resolution MSC.214(81) – Adoption of amendments to the performance standards for shipborne voyage data recorders (VDRs) (Resolution A.861(20)) and performance standards for shipborne simplified voyage data recorders (S-VDRs) (Resolution MSC.163(78))
• MSC.1/Circ.1222 – Guidelines on annual testing of voyage data recorders (VDR) and simplified voyage data recorders (S-VDR)

Directive 2002/59/EC requires member states to ensure that data from VDR systems are used in an investigation and are properly analyzed. EMSA complies with IMO requirements.

An examination of a wide range of countries and the international rules and recommendations reveals that there is generally common agreement among nations to promote a high level of safety and security across all transportation modes. Although nation states have their own legislation regarding transportation, the nation states incorporate or, in some cases, completely adopt international standards, where they exist. However, these international standards are simply guidelines by which each nation state is expected to model its own legislation and practices. In general, the aviation industry leads the way in its implementation of on-board recording technologies, followed by the marine industry.

For the rail industry, the European Union Agency for Railways (ERA) is working towards:

• a better perspective on human factors in its Human Factors Project^{Footnote 39} (initiated in 2012); and
• an increased harmonization of investigation processes throughout Europe.

The key to the success of the rail safety initiatives launched by the ERA is cooperation and communication among rail stakeholders and transport ministries across the European Union. This cooperation and communication foster mutual understanding, agreements, and recognition of nationally accepted rules and best practices.

In many of the EU and Commonwealth member countries, the emphasis on improved rail safety has led to the consideration of enhanced recording requirements on trains. Key objectives common to these studies are

• to support systematic safety monitoring as a means of preventing incidents;
• to identify the driver, the train, and the infrastructure performance leading up to an incident; and
• to record information related to the performance of the locomotive and the crew.

As a result of independently conducted safety studies, recommendations are being issued through the respective investigative agencies. These recommendations are directed at improving monitoring systems, including driver activities and on-board communications.

3.2.4.Challenges to surveillance in the workplace

Legal issues can arise from the use of audio and/or video monitoring in the workplace. Some of the issues that should be considered for LVVR implementation include

• challenges under the the Charter;
• the meaning and scope of privacy in the workplace; and
• the employer's management rights (the “reasonableness test”).

3.2.4.1 Canadian Charter of Rights and Freedoms

Section 8 of the Charterprovides that everyone has the right to be secure against unreasonable search or seizure. The purpose of section 8, according to the Supreme Court of Canada, is to protect a reasonable expectation of privacy.

Challenges under section 8 of the Charter are typically brought by individuals alleging a breach of privacy rights by an employer. The Charter is not applicable in cases between private parties. Section 8 does not refer to a “right to privacy,” but rather states that “Everyone has the right to be secure against unreasonable search or seizure.” The key here is reasonableness. If it can be demonstrated that a search was not unreasonable, then the balance must weigh in favour of the public interest. In cases where such a challenge is brought, the Supreme Court of Canada must weigh the interests of the individual against those of the public interest. In doing so, the Supreme Court of Canada relies on the text of section 1 of the Charter,^{Footnote 40} whereby the party alleging the violation has the burden of proof.

There is a general assumption by the courts that an employee's right to privacy is not absolute. Therefore, a test for reasonableness will always be applied, whether under the Charter or pursuant to a common-law precedent.

3.2.4.2 Privacy in the workplace

Sufficient legislation and jurisprudence exists to establish the meaning of workplace privacy rights. In common law, employees have no “right” to privacy, beyond a reasonable expectation. In addition, it must be noted that workplaces are public places where employees' expectations of privacy are limited, subject to certain exceptions. Continuous real-time observation of video images has generally been seen as more intrusive than the review of images in response to incidents that are reported by other means.

For employee challenges to privacy violations, the Federal Court of Canada, as well as the Supreme Court of Canada, has developed a test to determine the reasonableness of employer's actions and to weigh the employees' privacy interests against the employer's safety and security interests.

The legal test for reasonableness

When unions bring court challenges concerning the electronic monitoring of the workplace by the employer, the legal test for reasonableness is triggered. This test was derived from a leading case (Eastmond v Canadian Pacific Railway^{Footnote 41}) in which railway employees filed a grievance against the employer for installing digital video equipment without their consent. Under its obligation to inform employees, the employer had posted prominent notices that video surveillance was in effect. In a 4-part test, the Federal Court determined that the employer's intent was appropriate under the circumstances and that a reasonable person would consider that the intended use of the cameras was appropriate.

The reasonableness test is used routinely by courts and arbitrators to evaluate the legality of surveillance techniques. To determine whether the employer's actions are reasonable, the following 4 questions are asked:

1. Was it demonstrably necessary to meet a specific need?
2. Was it likely to be effective in meeting that need?
3. Was the loss of privacy to the people being filmed proportional to the benefit gained?
4. Was there a way to achieve the same end that would have been less invasive of privacy?

From a number of cases dealing with complaints made to the Office of the Privacy Commissioner, the following issues and lessons learned relating to the use of voluntarily installed video surveillance of employees were highlighted:

• Video surveillance in the workplace must be accompanied by sufficient signage to alert employees that they may be monitored.
• Employees must first be informed by the employer of the purposes for which the information will be used.
• Assuming that there is no sensitive personal information captured in the recordings, implied consent of the employees for the use of the recordings can be assumed to have been obtained when the express purposes of the video surveillance are explained. Employees should then reasonably expect that recordings would be used for these purposes.

Challenges to the use of surveillance equipment

The leading case concerning challenges to management rights regarding installation of surveillance equipment in the workplace is Lenworth Metal Products Ltd. v United Steelworkers of America, Local 3950.^{Footnote 42} The issue was whether the employees' privacy interests outweighed the employer's security and safety interests. Tribunals routinely take the lead from the legal test established by the Federal Court to make a determination by asking

1. Was it reasonable, in all of the circumstances, for management to request video surveillance of the worker?
2. Was the surveillance conducted in a reasonable manner?
3. Were other alternatives open to management to obtain the evidence it sought?

If the employer, in exercising its management rights, can demonstrate that all other options to resolve the issue were exhausted, then the legal balance tips in favour of the employer's security and safety interests.

3.2.5 Obligations and rights of an employer relating to workplace recordings

The use of surveillance cameras in the workplace in Canada is common. Surveillance cameras are often installed to deter theft, vandalism, assault, and sexual harassment. Hidden cameras are also used to secretly record suspected criminal or improper activity. Video surveillance is common in retail stores, financial institutions, manufacturing plants, casinos, and wherever cash or inventory is found. In Canada, surveillance cameras may only be used to record images without sound.

In many cases, employers are now using hidden as well as openly disclosed surveillance cameras to routinely record job activities. Generally, Canadian courts have not looked favourably upon employers who install hidden surveillance cameras or hidden microphones in order to clandestinely observe employees without good reason.

Under specific provisions of the Canada Labour Code (the Code), employers have statutory duties to their employees:

122 - PART II - Occupational Health and Safety (OHS)

      124 Every employer shall ensure that the health and safety at work of every person employed by the employer is protected.

This provision, along with subsequent sections, provides the right of the employer to monitor work areas and activities in order to satisfy the occupational health and safety portions of the Code. “Protection” is used to encompass workplace hazards in the general environment, such as unsafe conditions, unsafe practices, hazardous materials, or machinery as well as protecting employees from harassment, sexual harassment, or workplace violence.

Other obligations and rights of an employer include

• assuring customer safety,
• protecting personal information, and
• giving notice to employees when workplace monitoring is in force.

3.2.5.1 Employee or customer safety

Attacks, robberies, violence, workplace accidents, or other workplace safety issues and the associated liabilities motivate employers to install workplace monitoring systems. Remote monitoring systems are used to monitor employers working alone or in isolation. Such systems can identify emergencies and provide critical guidance for response teams.

Common objectives for using monitoring systems are deterrence, responsiveness, and improvements to the ability to investigate.

3.2.5.2 Personal Information Protection and Electronic Documents Act

Although some individuals have brought claims of privacy violations against employers pursuant to this act, it must be noted that section 5(3) of Personal Information Protection and Electronic Documents Act (PIPEDA) provides organizations with the right to collect, use, or disclose personal information without consent for “purposes that a reasonable person would consider appropriate.”

In addition, section 7(1)(b) of the Act provides that collection of personal information without consent is “reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.” Provincial privacy laws include similar provisions.

3.2.5.3 Employer must give notice

Recording private communications without the consent of those speaking is a criminal offence. Employers wishing to use video surveillance in a general area are obligated to post notices or signs that are readable from a distance to indicate that the area is being monitored. The signs or notices must be in both official languages and should be multilingual in some cases, such as in retail stores, banks, or businesses where other languages are predominantly spoken.

3.3 Results of the operational and human factors assessment

A behaviour checklist was used to assess the operational and human factors information available from on-board recordings. The results of the operational and human factors assessments are summarized in Appendix G.

To assess whether a particular LVVR system or recording mode may be better than another in facilitating the identification of operational and human factors issues, a number of comparisons were made. These comparisons are presented in graphical format below.

To allow for the comparison of LVVR systems, regardless of system recording mode, composite “yes/no” ratings were generated for each recording depending on whether the subgroup had returned a definitive “possible” response, as opposed to merely “somewhat possible” or “not possible,” for at least one cue type (that is, auditory, visual, or physical).

3.3.1 Identification of behaviour associated with safety-relevant operational issues

The percentage of recordings from each LVVR system in which the subgroup assessed that it was definitely possible to identify operators' use of locomotive control inputs was compiled. These results are presented in Figure 1.

Subgroup members evaluated most of the LVVR systems as allowing the assessment of crew use of controls, except in the case of the reset safety control (RSC) and the train information braking system (TIBS)/master control unit (MCU), for which the voice-only system (Railway A) and the video-only system of Railway C were rated as not able to identify use. For some of the LVVR systems that included a video component, the RSC and TIBS displays were positioned outside of the cameras' field of view. The subgroup for the audio-only system could not assess RSC and TIBS/MCU use in any of the recordings because there is minimal auditory content produced by these systems unless an alarm is issued. No alarms were issued in the recordings that were reviewed.

Crew interaction with headlight controls was assessed as being possible only in about half of the recordings, regardless of LVVR system type. Recordings from the video-only system of Railway C did not allow the assessment of crew use of automatic and independent brake systems because the controls were located outside of the camera's field of view. It is noteworthy that subgroup members were able to assess crew use of many of the controls from listening to recordings from the audio-only system.

Four operational items from the behaviour checklist assessed whether it was easy to identify 1) the individual in the role of the locomotive engineer, 2) the individual in the role of conductor, 3) whether train control signals were encountered and responded to, and 4) indications of CRM. These results are presented in Figure 2.

The voice-only system (green bars) was less likely to be rated as allowing the identification of the locomotive engineer and the conductor roles. Review of the qualitative data indicates that role identification was difficult at times for subgroup members, in particular those who were not familiar with the crew members' voices, because of the playback of only one microphone channel at a time. It was noted that reviewing both audio microphone channels concurrently would be expected to address this challenge.

With the forward-facing video, all LVVR systems allowed the observer to identify instances when signals were responded to.

The assessment explored whether the recordings could be used to identify instances of CRM. There were many instances of good CRM practices identified, particularly for those LVVR systems that included an audio component. Examples included effective problem-solving; operational conversation; planning; providing advice, direction, and feedback; and leadership (evident from crew discussions about unexpected situations). Video-only systems were less conducive to assessing for CRM, because speech content could not be determined. The video-only system from Railway C (red bars) was less likely to be rated as allowing the identification of indications of CRM. Review of the qualitative ratings for this system indicates that the limitations of this system were related mainly to the camera view obstruction caused by lowered sun visors and not due to any technical limitations of the system.

3.3.2 Identification of behaviour associated with safety-relevant human factors issues

Depending on the LVVR system, the behaviour checklist queried whether it was possible to assess the presence of a human factors issue using auditory cues (such as speech), visual cues (such as eye-glance behaviour), and physical cues (such as body stance).

Review of the 4 LVVR systems' capacity to allow the identification of safety-relevant human factors issues revealed that it was at least “somewhat possible” in almost all recordings when all cue modes (auditory, visual, and physical) were considered.

The following elements of human factors were assessed when reviewing the various types of on-board recordings:

• stress,
• alertness/fatigue,
• workload,
• situational awareness, and
• distraction/inattention.

3.3.2.1 Identification of elements of stress

The percentage of recordings for each LVVR system that allowed the definitive (that is, those that resulted in a rating of “possible”) identification of elements of crew member stress is presented in Figure 3. Only about half of the recordings were judged as allowing the identification of elements of stress among crew members. This ranged from about 25% for voice recordings, to 40% for video recordings, and to 75% for voice-and-video recordings.

Most of the subgroups noted that, to be able to more reliably assess crew members' level of stress from a recording, a similar period of baseline, “non-stress” behaviour would be needed for comparison.

3.3.2.2 Identification of elements of alertness/fatigue

The percentage of recordings for each LVVR system that allowed the definitive identification of elements of crew members' alertness or fatigue is presented in Figure 4. Across all systems, about 65% of all recordings were judged as allowing the identification of elements of alertness of crew members. Recordings from the voice-only system were less likely to be assessed positively.

Many subgroups noted that visual and physical components related to alertness (such as rate and duration of eyelids closing, head nods, yawns, and stretches) were the most important and telling cues that could be used to assess fatigue. While some auditory cues of fatigue can also be informative (such as yawns, stretches, or statements about being tired), these were not encountered as often during the assessment.

It is noteworthy that subgroups were able to identify several instances of fatigue among crew members when the LVVR systems included on-board video. For example, in 4 recordings, crew members were observed to close their eyes, nod off, and experience a micro-sleep of a few seconds. In 2 recordings, a crew member was observed to fall asleep for a significant period of time.

3.3.2.3 Identification of elements of workload

The percentage of recordings for each LVVR system that allowed the definitive identification of elements of workload is presented in Figure 5. Across all systems, about 43% of recordings were judged as allowing the identification of elements of workload of crew members. Recordings from the video-only system of Railway B were less likely to be assessed in this manner.

Similar to the situation when assessing level of stress, most of the subgroups noted that, to be able to more reliably assess crew members' level of workload from a recording, a comparable period of baseline (that is, “low workload” behaviour) would be needed for comparison.

Identification of the number of tasks being performed at one time was easiest when there was video data as well as voice data. Additional tasks identified in the recordings included engagement in operational and non-operational conversations, writing, reading, using the radio, and operating locomotive controls. The subgroups noted that it is important that video data be of good quality and provide adequate views and coverage of crew members to allow for the accurate assessment of the level of activity and number of tasks being performed.

3.3.2.4 Identification of signs of situational awareness

The percentage of recordings for each LVVR system that allowed the assessment of signs of crew members' situational awareness is presented in Figure 6. Across all systems, only about 25% of recordings were judged as allowing the definitive identifications of signs of situational awareness. None of the recordings from the 2 video-only systems were assessed as allowing the identification of signs of situational awareness.

These results suggest that the evaluation of crew situational awareness can be challenging if it is based solely on video data. The results also suggest that there is likely an auditory component to situational awareness that can be more effectively used for this evaluation. Results of the voice-only system compared withthe voice-and-video system are suggestive of differences in the quality of the audio data collected for these systems. Specifically, the subgroup indicated that there were more limitations in the quality of the audio data for the voice-and-video system than for the voice-only system.

3.3.2.5 Identification of signs of distraction/inattention

The percentage of recordings for each LVVR system that allowed the definitive identification of signs of distraction or inattention is presented in Figure 7. Across all systems, about 50% of recordings were judged as allowing the identification of signs of distraction, with recordings from all systems being assessed positively. Some of the secondary behaviours exhibited by crew members included eating, drinking, dressing, engaging in non-operational conversations, standing, gesturing at other crews, cleaning the work area, looking in bags or backpacks, and chewing tobacco. It was noted that some of the secondary tasks observed were not consistent with company policy. For example, a few recordings showed a crew member smoking, one showed a crew member holding and manipulating a personal cell phone, one showed a crew member smoking an e-cigarette, and 2 recordings showed a crew member sleeping.

3.4 Results of the safety benefits assessment

The ACRS study (Appendix H) confirmed the benefits of this type of LVVR technology for investigations and concluded that the scenario with the greatest cost–benefit profile for industry was one in which the operators could use the recordings to enhance safety through random safety and compliance monitoring.

The results of the operational and human factors assessment provide clear examples of how LVVR can be used to collect information on operational and human factors issues. While the recordings assessed in this study did not include emergency situations, the type of information available from the recordings was representative of what would be required for conducting investigations, including being able to identify underlying factors leading to the actions taken in the locomotive cab.

Section 2.2.2 of this report identifies potential uses of LVVR technology within the context of an SMS. Results of the operational and human factors assessment show that the presence of relevant operational actions and human factors issues can be identified. However, it must be noted that validation of these types of assessments, such as comparing the results against LER data and/or employee interviews, may be required before strong conclusions can be drawn from recordings.

Other uses for LVVR were presented to the working group by operators from the U.S. These uses include protection of locomotive engineers through the deterrence and investigation of criminal activities. Similar points were raised by working group members when discussing the appropriate use of LVVR.

A summary of perspectives from each participating stakeholder organization was assembled relating to the use of LVVR recordings and the reconciliation of the different perspectives of the organizations if broader use of the technology is permitted.

The central themes of discussion on expanded use concerned privacy, trust, and discipline. These were also key items of discussion during the multi-modal round-table discussions at the TSB Transportation Safety Summit on the topic of voice and video recorders.^{Footnote 43} At both the Safety Summit and the working group meeting, it was clear that an individual company's safety culture drove concerns about the expanded use of on-board recorders.

When drawing linkages between these themes and specific comments by working group members, the responses were summarized and de-identified, as necessary. This approach allowed useful synthesis of comments and also avoided unnecessary duplication of comments and the risk of misrepresenting nuances of the position of particular organizations.

The topics in this section represent the perspectives provided by the majority of the members of the working group. One working group participant stated that, while his organization fully supported the use of on-board recorders within the current TSB legislation, he could not comment on any form of expanded use, as it was outside of current regulations and legislation. He did, however, provide the organization's perspective on privacy with respect to these recordings, which has been included in this summary.

3.4.1 Proactive safety management

Expanded use of LVVR is seen by operators in the rail industry as being required. It was expressed that significant advances have been made in rail safety, but in order to make further advances, new tools are required. However, while advances have been made in many aspects of the rail industry, such as the safety of mechanical systems and technology to detect flaws in track infrastructure, the underlying causes of human behaviour are not as well understood.

Some operators are facing significant growth and employee turnover, leading to a need to be aware of the challenges that new staff face. Safety systems must be created to support relatively inexperienced staff. Similarly, as some operators move to new types of business or implement operational changes, there is a need to use new tools to understand and maintain safety in a changing environment.

The operators carrying passengers highlighted the need to apply the best safety tools available because they are carrying the “most precious cargo.” Freight operators also had the same concern for their crew members and the communities that they pass through. Operators see it as unacceptable to not know why accidents or incidents happen. These operators believe that there is a public expectation that LVVR would be used to proactively enhance safety.

Risk reduction is a key component of railway operators' approach to safety. To carry out risk-reduction measures, they need to identify unsafe conditions and the underlying causes of unsafe actions. LVVR was seen as a key component to understanding crew actions. LVVR would also provide insight into the factors in the system that lead to the behaviours, to enable operators to reduce risk. LVVR could provide the means to better understand not only close calls, but also normal operations.

Potential expanded uses of LVVR recordings that were discussed within the working group included

• understanding operations in the locomotive cab;
• shaping behavioural change;
• identifying and rewarding best practices;
• identifying risky behaviours, followed by education, procedures, and training; and
• progressive discipline.

3.4.1.1 Understanding operations in the locomotive cab

Activities in the locomotive cab are seen as a “blind spot”—a serious gap in the opportunities to reduce risk. It was expressed that proactively obtained knowledge of the detail and nuances of operating practices is required in order to make advances in safety. Recordings would provide an opportunity to better understand real-world activities, which would provide greater benefits to improving safety and working environments than simulator studies.

All parties fully supported the use of LVVR for accident investigation under the current legislation.

It was noted that the TSB investigates only a small fraction of rail occurrences per year. Industry would not only like to be more proactive in its approach to identifying hazards but would also like to analyze more situations in order to get a broader understanding of safety. This proactive approach could then reduce the need for reactive investigations.

In terms of being proactive, the perspective was provided that, when an accident occurs, it is unlikely that an unsafe action was being carried out for the first time. Instead, it is more likely that there were previous occasions, described as “habits,” that could have been identified before the occurrence.

All operators stated that the recordings should be running for the duration that the locomotive is powered on, whether the train is moving or stationary. There was no support for using the LVVR system only when travelling through higher-risk locations, such as Cab Red Zone^{Footnote 44} locations.

A variety of trigger scenarios, when it would be useful to analyze recordings, were identified:

• following up on events identified using data from other systems such as WiTronix alerts or emergency braking initiated by the crew;
• random monitoring in order to identify trends, such as potentially risky behaviours; and
• monitoring the effectiveness of change-management activities, such as the degree of change in operating practices to meet newly deployed procedures.

The analysis purposes were generally driven by the need to better understand operations, including interactions within the locomotive cab. Strong statements were also made about the analysis of the recordings being very labour-intensive and requiring large amounts of data storage, so recordings would not be used for total compliance monitoring as a result.

The perspective of the operators was that their trials were still in a pilot phase. The approach to their analysis would likely evolve as the benefits and approaches became better understood.

Operators identified a number of topics that they would like to better understand to help improve safety:

• crew resource management,
• fatigue issues,
• scheduling issues, and
• crew operating environments.

The discussion of these topics was coupled with identification of possible proactive changes to

• address training gaps,
• develop and implement new technology,
• change operational procedures and rules,
• modify crew compliance testing in the field,
• provide coaching,
• create educational bulletins, and
• undertake rules-awareness campaigns.

3.4.1.2 Shaping behavioural change

Several operators provided examples of how the presence of methods of observation, including cameras, speed detectors, and parked police cars, was commonly known to increase rules compliance. It was also seen as a deterrent, similar to the use of cameras to deter shoplifting or not paying a transit fare.

No information was provided at the working group discussion on the durability or parameters of this effect. However, it was noted that no signs of this deterrent effect had been seen in the LVVR trials. It was proposed that over time, as crews become familiar with and aware of these systems and the benefits that they can bring, their behaviour would be less affected by the presence of the recording devices.

It was noted that recording devices are already present in other forms of transport and that these had been seen to have positive effects. For example, these positive effects were noted in a Master's thesis^{Footnote 45} on the effects on safety of the use of event-based video recording in transit buses. In the aviation mode, where CVRs are present, there does not seem to be a strong influence on behaviour due to the “observer effect.” However, this may be because the use of CVR information is currently limited to TSB for accident investigations.

The operators believe that, if crews perceive that they could be monitored at any time, there would be a reduction in unsafe actions, such as using cell phones, failing to call signals, and allowing non-authorized people into the cab.

3.4.1.3 Identifying and rewarding best practices

Several perspectives were provided on the topic of rewarding best practices. It was noted that recordings would help to identify the types of activities undertaken by some crew members to better comply with existing rules and procedures, such as keeping mentally and physically alert. A perspective was expressed that rewarding best practices would enable the company to learn new ways of working, as crew members may have developed a best practice over the years. It was also identified that the recording technologies would enable companies to better understand the cab environment in order to provide a more effective work environment.

It was pointed out that crew members may perceive opportunities for development as having a negative impact. For example, operators may identify processes that have been self-developed by a crew and that could be safer and beneficial to all operating employees. To implement the safer process, other crew members would need to change.

3.4.1.4 Identifying risky behaviours, followed by education, procedures, and training

Identifying risky behaviours was viewed as the opposite of identifying best practices. Some of the discussion focused on identifying “rogue” staff—employees whom the company was unaware of, who were not complying with  rules and procedures (that is, wilful violation). In contrast, the discussion on identifying best practices focused more on the behaviours than on the individual. As an example, Rule 42 violations were flagged by several operators as a risky behaviour.

It was suggested that the follow-up action after identifying risky behaviours could include education, procedures, and training changes. The action taken would depend on what was identified as the root cause of the behaviour and the general approach taken by the company to behavioural change.

3.4.1.5 Progressive discipline

Following up with progressive discipline, if necessary, as a consequence of behaviours observed in recordings was seen as a requirement by all operators. The discussion highlighted that safety culture may affect the extent to which discipline is seen as necessary for behavioural change.

There was a considerable range of strongly held views, reflecting the different safety cultures of the individual stakeholder organizations represented within the working group. Examples of strong statements supporting discipline were that discipline was an absolute requirement and that consequences are part of the fabric of our society. It was said that there should be no difference between holding employees accountable for compliance with the rules and holding them accountable with the presence and use of recorders. One operator stated that it was unjustifiable to tolerate any unsafe behaviour by a crew operating a locomotive or to fail to take appropriate corrective action, including appropriate consequences should wilful negligence be discovered. Wilful neglect and individuals' decisions to place themselves and/or the public at risk were seen as necessitating discipline.

Statements that placed less emphasis on the need for discipline included views that there may be other occasions to address an individual's continued unsafe practice. In these situations, discipline was seen as being part of an SMS (that is, discipline would be applied within the context of a just culture). Such operators wanted to curb inappropriate behaviours but stated that this did not have to be achieved in a punitive fashion. Some operators indicated that, as long as the behaviour changed, curbing inappropriate behaviour could be done “jointly, softly.”

Progressive discipline was the topic where there was the largest variation in operators' comments. The comments were related to their approach to safety—their safety culture—and so were interlinked with ideas about trust between employees and management, the root cause of behaviours, and best methods to achieve change in the long term.

It was not disputed that wilfully covering or damaging an LVVR camera would need to be addressed, as it would reduce the opportunity to learn from an accident.

Another benefit identified is that LVVR recordings would provide a clear factual record that would often be to the employees' benefit, such as in cases where an incident could easily be misinterpreted as a culpable action.

One member of the working group illustrated his or her points with comments made by bus operators in a study of event-based cameras in transit buses.^{Footnote 46} In that study, the member noted, “rolling out DriveCam solely as a training tool without a disciplinary component was probably not the best way to use the system.” This working group member also noted that the study indicated that “a so-called carrot-and-stick approach that balanced any disciplinary measures for unsafe driving behaviour captured by DriveCam with a rewards program for good behaviour saw the greatest changes.”

A working group member observed that voluntary reporting had become very high after on-board recorders had been put in place. Combined with the observer effect due to the presence of recorders, it was considered that this might reduce the occasions when progressive discipline would be considered.

3.4.2 Reconciling perspectives

The statements by the operators and the employees' representatives indicated two different perspectives. While operators see expanded use as necessary to support the case for LVVR installation, the employees' representatives had concerns about the impacts on privacy and about the need for strong protection to ensure that recordings are not used inappropriately. During the working group discussions, the employees' representatives indicated that the means to resolve privacy issues went beyond the scope of this study.

However, it was apparent from the nature of the operators' comments that the views that they expressed concerning means of reconciling perspectives on appropriate use addressed the disparate positions. The nature of many of these statements provided some suggestions on how to help reconcile the differences to permit expanded use of on-board recorders. These comments are summarized under the following themes:

• Technology
• Access to on-board recordings
• Privacy
• Oversight relating to the use of on-board recordings
• Change management and trust

3.4.2.1 Technology

In general, the perspective was that cameras should be active at all times after the engine has started, as it cannot be predicted when an accident may occur and when the recording is essential for an investigation. However, there was also a suggestion that the company should be able to apply criteria for when recordings should be made, according to its safety needs; for instance, criteria could specify recording when the train is above a minimum speed.

With respect to the length of time before the recordings would be overwritten, there were suggestions of between 72 hours and 7 days. In addition, it was suggested that recordings be encrypted to help protect privacy. However, operators did not consider de-identification of employees in the recording appropriate, as their view was that a workplace environment has a lower expectation of privacy.

It was clear to operators that both voice and video allowed comprehensive analysis to be carried out. It was noted that voice recordings would be potentially problematic at the current time when operating into the U.S.

Operators saw great value in a common, minimum standard for technology, to establish the means for effective recordings, such as a standard on infrared lighting to ensure effective video recording at night within the locomotive cab. But it was also said that local variations should be permitted, in order to capture additional operational requirements.

Records consumed large volumes of data storage, which may be problematic in the long term with the current technology.

3.4.2.2 Access to on-board recordings

The topic of access to on-board recordings was related to trust and privacy. There was some discussion of possible approaches to restricting access and to developing protocols and agreements on who would be involved jointly with unions.

During discussion, the following points were raised by operators:

• Viewing of recordings would likely be considered a management, head-office activity, sometimes restricted to the operational safety analysis team.
• An access matrix and approval process that restricted access according to the technology and management position is viewed as a useful tool. For instance, in one company, people in the field do not have access to the forward-facing camera. For analysis, use of LVVR information would be restricted to the SMS group. However, if an investigation was required for disciplinary purposes, the unions would be involved and all affected parties would be informed. Some operators saw wider involvement of unions throughout the analysis process.
• Access restriction should be determined before implementation in order to help to build trust. Depending on the local agreements with unions and contractors and on the nature of a specific incident, access might be granted to both parties.
• A chain-of-custody procedure following initial access could be a useful tool.
• Access procedures would evolve over time, as trust is built. It was expressed that people would want to work for companies that used the technology most effectively and fairly for safety. Procedures would most effectively be developed jointly with the unions in order to build trust.
• Safeguards need to be put in place to ensure that LVVR systems are securely managed by selected company officers for SMS purposes. However, access procedures would need to reflect the specific safety concerns and resources of the companies.
• LVVR information would not be used to target employees, or any race or sex, or used to view locations within the cab that were not related to an operator's work.

3.4.2.3 Privacy

The employees' representatives provided a clear statement on privacy and recorders. They stated that the distinction between public and private places, and the expectations of privacy in the workplace are issues that affect other modes and all Canadians, and are beyond the scope of this safety study. Decisions on this matter would require consultation with the Office of the Privacy Commissioner.

It was expressed that it was unlikely that a single solution could fit all situations because a wide range of safety cultures existed across operators, and the issue of privacy was strongly related to trust in appropriate use of the recordings. It was further expressed that the use of LVVR data within a railway's SMS should be carefully and appropriately safeguarded and circumscribed.

3.4.2.4 Oversight relating to the use of on-board recordings

Most comments relating to oversight were focused on whether regulations were required to mandate LVVR installation and to what extent the regulator would be involved. There was no discussion of joint oversight of LVVR implementation by the union, management, and/or the regulator as a means of building trust for LVVR use.

3.4.2.5 Change management and trust

There are always challenges when new technology is to be implemented, notably acceptance of the technology with respect to trust and privacy concerns. Another challenge is to ensure an appropriate evolution of use based on understanding the pros and cons of the system, which can then lead to new and enhanced developments and use.

Differing perspectives were provided, during and after the working group meetings, on the parallels between the way that LERs have been implemented and the way that LVVR could be used. On one hand, LERs were seen as providing considerable benefits to industry by permitting the analysis of operations as well as occurrences, and it was stated that employees had become used to their presence. On the other hand, it was also expressed that LERs were initially implemented only for post-accident use, but that remote access to LER data was now allowing real-time monitoring and identification of employee compliance. This change had implications for the position-holder's perception of trust in how fair use would evolve over time. Forward-facing cameras are currently viewed as a positive addition to safety by both employees and management.

It is essential to build trust in the use of LVVR. A means to help build trust would be to set up a “sandbox” trial to explore how different circumstances could be handled by all parties involved.

If LVVR is to be used beyond accident investigation, then the way companies manage the change and develop trust and co-operation with employees will be key to the useful integration of LVVR into operations and safety analysis. The means of achieving this integration needs to encompass a range of safety cultures that may exist among companies. The concern of both operators and the union is that a one-size-fits-all approach might not be the most appropriate solution. In some cases, legislative protection would be essential. In other cases, just culture would be the basis for working jointly to advance the implementation and expanded use of LVVR.

4.1 Conclusions related to LVVR technology

This safety study achieved its goal of documenting information from the deployed technology in the current LVVR trials. The study was not intended to provide a system specification standard. The study identified key issues for consideration concerning the implementation of LVVR technology in Canada.

Although some of the trial installations have common characteristics, the results show that companies deployed a wide range of technology to explore the best means to achieve safety benefits.

Some operators noted that there would be value in having a common minimum specification, such as video specifications for handling low-light situations. With a minimum specification, there would be opportunities to add technology, depending on specific company requirements for operations and for the collection of safety data.

The conclusions relating to LVVR technology are divided into 3 main areas:

• existing experience with on-board recordings,
• challenges in data collection related to technology, and
• effects of technology on data analysis.

4.1.1 Existing experience with on-board recordings

The conclusions from a review of existing experience with on-board recordings include the following:

• Regular maintenance checks are required to ensure recording quality.
• There is a risk that critical data will be lost when the system hardware does not meet crashworthiness standards.
• The whole system, not just cameras and memory, must be robust, so that power failures and other equipment failures are immediately identifiable as rendering the system inoperable.
• The recording duration should be sufficient to prevent overwriting significant events for an extended journey, such as 16 or more hours, or when the system is powered but not in motion. The recording duration should be at least that of the LER, which is specified as 48 hours.^{Footnote 47}
• Any problems with the intelligibility of voice recordings would significantly affect both the usefulness of the recording and the time/resources required to analyze it.
• The use of “hot microphones” significantly improves the sound quality of recordings and is likely to provide operational benefits by making communication easier in loud operating environments. For example, multiple microphones may be required to provide complete and clear coverage.
• Separate recording channels for each crew member, as well as an area microphone channel, improves the quality of recordings.
• Standardization of data retrieval and playback is preferred to minimize problems obtaining and reviewing data.
• It should be possible to synchronize all recorded data using a common time source.
• Clear documentation of timing information and parameters collected is required to support comprehensive, accurate analysis.
• A system that combines both data and video/audio must provide an easy means to separate protected information before returning the data/device to the owner.
• Because of their large file size, recordings involving video have challenging storage requirements.
• Technology alone cannot prevent inappropriate use or disclosure.
• While a common download and playback system cannot be mandated across manufacturers, an LVVR specification could include functional requirements to ensure that data are not lost during collection, are easy to collect, and can be played back effectively. Each manufacturer's playback system requires unique software and cables. If the memory unit is damaged, a large expense may be incurred to transfer the data and then recover it from another system.

4.1.2 Challenges in data collection related to technology

The conclusions relating to challenges in data collection for LVVR technology include the following:

• The normal operating environment of the cab includes at times both high ambient noise and low lighting. Some technology that was reviewed was unable to consistently meet these challenging situations.
• Cameras placed too far away, where facial features could not be readily observed, did not provide the data necessary to identify some human factors issues.
• Placement of cameras did not always enable recording of all crew member actions and use of all controls.
• Area microphones were found to be problematic. High ambient noise, particularly when the train was accelerating, made comprehending intra-cab communications difficult, especially when a single recording was played back. It was also difficult to identify which individual made which communications, as the sound of their voices was not isolated to a particular channel.
• In one case, it was possible to obscure cameras with sun visors.
• To most effectively identify behaviours, it is important that the playback of audio and video files be synchronized. A system that does this automatically is preferable to one that requires manual synchronization.
• Unless video- and audio-recording playback is synchronized with other data, such as a forward-facing camera, LER, and/or GPS, the comprehension of the meaning of actions and communications can be difficult.
• Interruptions occurred during data playback on one system, creating difficulties for interpretation. It is not known whether this interruption was due to the recording, the playback software, or the playback computer.

4.1.3 Effects of the technology on data analysis

The conclusions relating to the effects of the technology on data analysis include the following:

• When video alone was used, it was difficult to assess some behaviours that are indicative of safety-relevant human factors issues without having complementary audio data.
• Although operational actions, such as operating the radio or interacting with the locomotive controls, can be identified using video data, a detailed assessment of behaviour is not possible without also having complementary audio information and confirmatory LER information.
• Locomotive control use can be identified using video only; however, it is not always possible to distinguish specific read-outs or positions of controls.
• A recording system that has both audio- and video-recording capabilities is likely to be the most effective option for assessing crew operational and human factors behaviour. However, it is important to note that the technology must be of an adequate level of quality to provide clear, unambiguous recordings in a reliable manner.
• The combination of LVVR data with forward-facing video, and preferably with LER and GPS data, provides a very useful context for interpreting voice and video data. Whenever possible, it is best to review audio and video data with other contextual information.
• Assessment of crew behaviour for issues such as alertness and stress, regardless of recording mode, would be facilitated if the file reviewers had access to other, “baseline” recordings for comparison.
• Limitations in the placement and field of view of cameras in the current trial led to the conclusion that it is not possible to assess those behaviours indicative of human factors issues that have a visual element (such as eyes closing because of fatigue) if camera views do not include crew members' faces, or if cameras are positioned too far away to see the detail of expressions.

4.2 Conclusions for legislative and regulatory assessment

The authority to make regulations relating to on-board LVVR, including how to manage the information generated, can be found under sections 18 and 37 of the RSA.

Section 28 of the CTAISB Act speaks to the privileged nature of on-board recordings. It also addresses access to and use of those recordings by the TSB as well as other access and prohibited uses. Subsection 28(2) provides that

(2) Every on-board recording is privileged and, except as provided by this section, no person, including any person to whom access is provided under this section, shall

        (a) knowingly communicate an on-board recording or permit it to be communicated to any person; or

        (b) be required to produce an on-board recording or give evidence relating to it in any legal, disciplinary or other proceedings.

There is some interpretational concern that these restrictions exist only if an accident or incident has occurred, or when the TSB has grounds to believe that a situation could, if left unattended, induce an accident or incident.

All concerned parties have opinions on the legal matters and employee rights relating to the expanded use of LVVR. For example, there is a concern that a regulatory requirement for on-board LVVR could infringe the Charter rights of company employees. To prevent this infringement and to build the procedures necessary for trust, guidelines and terms for the implementation of expanded use need to be established jointly among the concerned parties. Successful implementation of LVVR technology will depend on ensuring the appropriate balance of rights and obligations for the key stakeholders.

4.3 Conclusions for operational and human factors assessment

The LVVR operational and human factors assessment^{Footnote 48} helped determine the extent to which 3 types of recording system (voice-only, video-only, and voice-and-video) in conjunction with LER data (when reviewed) and forward-facing cameras (where available) can be used to identify valid and reliable operational and human factors information.

The assessment of recordings from 4 different LVVR systems revealed a number of issues, both pertaining to recording modality (voice and/or video) and more system-specific. Collectively, this information can be used to make broad conclusions regarding the effectiveness of LVVR technology.

The following aspects of the data should be considered when assessing the conclusions:

• No emergency or non-normal situations were observed during the recordings selected for review. This report does not provide an assessment of the comprehensive usefulness of the recordings for the purpose of accident investigation. In addition, the data were not examined from a technical perspective for their usefulness in assisting investigations, such as the ease of obtaining the data, the ease of ensuring time synchronization, and the identification of parameters.
• The trials did not use the same type of locomotive. In addition, different microphones were used and different background noise filtering was performed for each system.
• As the voice and video recordings were not synchronized with and assessed against the LER recordings, the findings were not validated against this type of locomotive data. For example, audible indications of the use of a locomotive control input were not checked against the LER data.
• If the LVVR recordings were not already synchronized with the GPS data or the LER data, no further synchronization was performed as part of the assessment activities. Synchronization of these data sets would likely be performed by the companies before a more detailed analysis of a recording.
• The assessments of crew action/behaviours, including those that were identified as being indicative of human factors issues, were not further validated against other data sources, such as interviews with crew members, LER data, or crew schedules.

4.3.1 Assessment of operational and human factors using voice recordings

Based on the review of the on-board voice recordings,^{Footnote 49} the following was determined:

• Whenever possible, it is best to review audio data with other contextual information. This includes video from the LER and forward-facing locomotive camera, GPS information, and personal information (such as identification of recorded voices). Having someone with railway operational knowledge would assist with the assessment.
• The use of voice-only data limits the identification of behaviours to those that have an auditory element.
• Lack of conversation between crew members would make it difficult to assess many of the behaviours that are indicative of human factors issues.
• There appears to be an auditory component to situational awareness that makes it easiest to evaluate using voice data, particularly in conjunction with forward-facing video.
• Background ambient noise, particularly from the locomotive engine, limits the clarity of the recording. The use of technology that automatically limits or filters out background noise would be beneficial.
• The review of data from the on-board audio recordings, when combined with context from forward-facing video data, provides a meaningful amount of information concerning identification of crew use of many locomotive controls, responses to external train control signals, and audible alarms. Additional assistance would be provided by LER and GPS data.
• The recording and playback system, including playback software, should be of sufficient capacity to allow for uninterrupted review of audio and video data.
• For some voice recordings, it was not possible to accurately know which crew members were speaking. It was suggested that the use of headset microphones by crew members, similar to those worn by aircraft pilots, would help ensure additional clarity.

4.3.2 Assessment of operational and human factors using video recordings

Based on the assessment of the on-board video recordings, the following was determined:

• The overhead fish-eye camera configuration allows for the capture of the entire locomotive cab environment.
• Some behaviours that are indicative of safety-relevant human factors issues are difficult to assess without having complementary audio data. This was particularly the case for those issues that comprise an auditory element, such as CRM issues, situational awareness, and certain potentially distracting secondary tasks such as conversation.
• Whenever possible, it is best to review video data with other contextual information. The assessment of behaviours indicative of safety-relevant human factors issues using video recordings was facilitated by the simultaneous viewing of the forward-facing external video. Context regarding crew members and the geography/location of the track area would also assist file reviewers.
• It was difficult to assess crew operational performance without having complementary audio data. This was particularly the case for assessing calls across the cab and reactions to auditory warnings.
• Although aggregate behaviour, such as operating the radio or interacting with the locomotive controls, can be identified using video data, a detailed assessment of behaviour is not possible without also having complementary audio information.
• Locomotive control use can be identified using video only; however, it is not always possible to distinguish specific read-outs or positions of controls.
• Limitations in the placement and field of view of cameras in the current trial led to the conclusion that it is not possible to assess those behaviours indicative of human factors issues that have a visual element (such as eyes closing because of fatigue) if camera views do not include crew members' faces or if cameras are positioned too far away.
• The quality and coverage, including camera angles and field of view, of a video-only system influence the observers' ability to assess behaviours. A system that provides the most complete and direct view of crew members is most effective.
• Video cameras with a high-quality infrared light source that is sensitive to perturbations can record during periods of low and/or inconsistent light.
• Video recording systems need to be of sufficient quality (in terms of recording rate) and resolution to allow assessment.

4.3.3 Assessment of operational and human factors using voice and video recordings

Based on the assessment of the on-board voice and video recordings, the following was determined:

• It is desirable that files be reviewed within the context provided by the forward-facing video.
• All things being equal, a recording system that has both audio and video recording capabilities is likely to be the most effective option for assessing crew operational and human factors behaviour. However, it is important that the technology is of an adequate level of quality to provide clear, unambiguous recordings in a reliable manner.
• Assessment of crew behaviour for issues such as alertness and stress, regardless of recording mode, would be facilitated if the file reviewers had access to other, “baseline” recordings for comparison.
• To most effectively identify behaviours, it is important that the playback of audio and video files is synchronized. A system that does this automatically is preferable to one that requires manual synchronization.

4.4 Conclusions for safety benefits assessment

The range of safety cultures among operators was evident in the type of comments provided concerning the use of LVVR. These comments ranged widely; on one hand, they expressed the value of LVVR in identifying “rogue” crew members, a lack of trust that crews would be compliant when they were not observed, and a need to identify human factors. On the other hand, they expressed views that LVVR is an opportunity to demonstrate commitment to safety and attract good employees, that it allows novel safety practices to be observed and supported, and that it is a means of improving the working environment for crews and of identifying the aspects of the system that lead to errors.

There are two poles of safety management—one of assigning blame and using discipline to stop unsafe behaviour and one of trust, in which it is perceived that employees make mistakes because of the system that they work in. How companies currently navigate these poles depends on their safety culture—the extent to which a just culture has been implemented.

There was no disagreement that LVVR can lead to safety benefits, that privacy rights would need to be considered by the Privacy Commissioner, and that successful deployment of LVVR technology will require limiting it to appropriate, safety-beneficial uses. There was agreement that a minimum technology standard would provide a useful starting point for companies to implement LVVR and to enhance the technology to meet their needs and capabilities. It was also noted that as there is a range of safety cultures across operators, there is a range of needs for legislative protection. Joint development of protocols among the concerned parties, clear limits on access and use, and a just culture as a prerequisite are all approaches that might enable parties to reconcile their different perspectives on the appropriate use of LVVR.

Based on the operational and human factors assessment, the expanded use of LVVR recordings has the potential to effectively enhance safety. Possible uses of the LVVR data include the following:

• TSB investigations: Any information produced by an LVVR system, regardless of modality, will improve the TSB's ability to understand an incident or accident, thereby producing more effective safety recommendations.
• Training: LVVR data could be used effectively in the development and revision of training programs. This includes training targeted to specific employee(s) or to a group or groups of employees, who may have been identified through LVVR review as likely to benefit from additional training. For example, targeted fatigue-management training can be developed and implemented for crew members who are observed to show low levels of alertness while on the job. Information from reviews can be fed back to an organization's training department to improve or augment current training programs. For example, if many instances of fatigued crew members are observed on a given route or subdivision, proactive follow-up training can include tips on how to prevent or to fight fatigue. Similarly, if a new training program on the principles of CRM is introduced, a random review of recordings can be carried out to verify that the principles are being translated into practice.
• Design changes: The identification of operational issues through the use of LVVRs could lead to improvements in the design of technology and equipment. For example, if a number of instances of incorrect use of equipment (that were unrelated to the training) are noted, this information can be fed back to equipment manufacturers. In addition, design changes can include improvements to railway operating policies and procedures, such as those relating to calling, and responding to, train control signals.
• Security of crew: LVVR recordings could provide an element of security for crew members, as a deterrent to physical assaults and other criminal behaviour.
• Identification of risky conditions: The identification of risky behaviours through the use of LVVRs could lead to improvements in education and procedures. The action taken would depend on what was identified as the root cause of the behaviour.

5.0 Next steps

This safety study provides a high-level account of the complexities of expanding the use of LVVR. The study examines a number of important areas, including technology issues, legislative and regulatory issues, safety benefits (accrued through a better understanding of human factors and operations within the locomotive cab), and the appropriate use of LVVR information.

Although all concerned parties had opinions on the legal matters relating to the expanded use of LVVR, the main driver of this study (that is, transportation safety) must be considered throughout decision making. The appropriate use of LVVR technology needs to look beyond the debate of operational efficiency versus employee privacy.

There is general agreement among railway industry stakeholders on the fundamental value of this data. However, there are a number of outstanding differences of opinion on the appropriate use of LVVR. Expanded use will be achieved only by ensuring that the implementation approach appropriately balances the rights and obligations of all parties. If these differing perspectives can be reconciled, implementation of this technology, including expanded use, could result in considerable safety benefits to the railway industry.

With the completion of the LVVR Safety Study, the following additional activities will be initiated:

• The final report will be circulated to key stakeholders in the 4 transportation modes: Aviation, Marine, Rail, and Pipeline.
• The TSB will initiate discussions with TC regarding next steps for the implementation of LVVR and the expanded use of on-board recorders in all modes.

This report concludes the Transportation Safety Board’s safety study. the Board authorized the release of this report on 10 August 2016. It was officially released on 19 September 2016.

Appendix A – Guiding principles for conducting the safety study

Participants in the safety study subgroups had access to and use of on-board recordings for the assessment activities. The assessments were conducted under the following conditions:

1. Recordings from locomotive voice and video recorders (LVVRs) were considered confidential and protected. This safety study was conducted as a Class 4 Investigation under the Transportation Safety Board's (TSB's) Occurrence Classification Policy.
2. Before activating the on-board recorders, the train crews and operations personnel involved were notified (that is, made aware) that recorders had been installed within the locomotive cab and were activated.
3. On-board recordings were made available to the TSB by the railway companies as needed for the LVVR safety study.
4. When on-board recordings were handled or viewed, at least 2 subgroup members from different organizations were present.
5. Documentation was maintained identifying who handled or viewed the on-board recording and when they did so.
6. During the duration of the study, the on-board recordings were handled, viewed, and stored within a secure computer/physical environment.
7. Authorized railway personnel were available to help retrieve the on-board recordings. However, the railway accessed the on-board recording only upon written request (that is, by email) from the subgroup Team Leader or from the LVVR Project Coordinator.
8. During the period of the LVVR safety study, on-board recordings were not used by the railway for any punitive actions against employees. However, if potential safety improvements were identified during the operational and human factors assessment of the on-board recordings, the railway could use de-identified information to take proactive safety actions from a systemic perspective.
9. If the on-board recordings provided any indication of a safety concern or of an offence that may have been committed, the TSB and TC were to be immediately notified. The appropriate course of action to investigate or address the safety concern would then be taken by TC and the TSB. However, the on-board recordings themselves would not be used as evidence in any legal, administrative, or other disciplinary proceeding, except as authorized by law. (No such situations were identified during the study.)
10. Upon completion of the LVVR safety study, all on-board recordings that were made available for the study and in the possession of the TSB or any subgroup were erased or destroyed.
11. Upon completion of the LVVR safety study, the railway had the option of “turning off / disabling” the on-board recorders or leaving them “on.” If the on-board recorders were kept on, the railway notified its employees of this decision. In addition, any further use of the on-board recordings would be conducted in a manner consistent with the Canadian Transportation Accident Investigation and Safety Board Act (CTAISB Act).
12. For the draft and final reports, when referring to observations and results from an on-board recording, any information relating to the specific circumstances within the recording was de-identified.
13. In case of a reportable occurrence under the CTAISB Act or its Regulations, the TSB's investigation requirements were to take precedence over any other uses. If requested by the TSB, the original on-board recordings would have been turned over to the TSB as soon as practicable, and no other downloads or copies would have been made by the railway. Should the TSB have decided to investigate the railway occurrence, the relevant LVVR recordings would have been used exclusively for the TSB investigation in accordance with section 28 of the CTAISB Act. If the TSB did not investigate the railway occurrence, the TSB would then have made the on-board recordings available to the subgroup for use in the safety study. (No such situations were identified during the study.)

Appendix B – Operational and human factors: assessment checklist for on-board recordings

Form B1. Information regarding the on-board recording

On-board recording information	Input/comments
General information to identify the recording (e.g., date, route, train)
File start time (HH:MM:SS)
File duration (HH:MM:SS)
Duration – train in motion (HH:MM:SS)
Percentage of file duration with train in motion (e.g., > 0 km/h) (HH:MM:SS)
Total number of stops
Weather (clear; rain; snow; overcast)
Lighting level (day; night; dusk; dawn; unknown)
Track environment / method of train control (rural; urban; mixed; single-track; multi-track)
Are there synchronized LER data? (yes/no/unknown)
Any issues with visibility of recording? (yes/no. If yes, what?)
Any issues with audio? (yes/no. If yes, what?)
Any other issues?

Form B2. Information regarding crew

Crew information	Input/comments
Number of people in cab
Role (engineer) identified? (yes/no)
Role (conductor) identified (yes/no)
Role (other crew members) identified (yes/no)
Other information?

Form B3. Capturing in-cab crew interactions

In-cab crew interactions	Input/comments
Did you observe any indication(s) that signals are being encountered and being responded to by the crew members? (Yes/no/unsure/N/A) (default = yes)
Did you observe any indication(s) that calls across the cab between crew members are occurring when signals are encountered? (Yes/no/unsure/N/A) (default = yes)
Did you observe any indications of crew resource management (CRM)? (Yes/no/unsure) (default = yes) What indications of CRM did you observe? assertiveness nature of conversation / communication consultation between crew members problem solving leadership adaptability decision-making skill other

Form B4. Capturing elements of human performance: stress

Level of crew members' stress	Input/comments
Are you able to rate the crew's level of stress using auditory cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include speech pattern word use tone pitch rate of speech expressions used / swearing
Are you able to rate the crew's level of stress using visual cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include focus location of gaze fixation visual scanning
Are you able to rate the crew's level of stress using physical cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include activities stance / position

Form B5. Capturing elements of human performance: fatigue / level of alertness

Level of crew members' fatigue/alertness	Input/comments
Are you able to rate the crew's level of fatigue/alertness using auditory cues?  (Yes/no/unsure) (default = no) Why / why not? Possible indicators include rate of speech word use pitch statements regarding fatigue/sleepiness
Are you able to rate the crew's level of fatigue/alertness using visual cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include focus location of gaze fixation visual scanning eyelid closure rate
Are you able to rate the crew's level of fatigue/alertness using physical cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include activities stance/position head position metrics – nodding off, yawning/stretching

Form B6. Capturing elements of human performance: workload

Level of crew members' workload	Input/comments
Are you able to determine the number of tasks being performed by a crew member at one time? (Yes/no/unsure) (default = no) Why / why not? estimated % of time locomotive engineer was performing >1 task at a time estimated % of time conductor was performing >1 task at a time estimated % of time other was performing >1 task at a time
Are you able to rate the crew's level of workload using auditory cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include rate of speech pitch statements regarding workload
Are you able to rate the crew's level of workload using visual cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include location of eye fixations duration of eye fixations
Are you able to rate the crew's level of workload using physical cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include activities stance/position

Form B7. Capturing elements of human performance: situational awareness

Crew members' situational awareness	Input/comments
Are you able to rate the crew's level of situational awareness using auditory cues?  (Yes/no/unsure) (default = no) Why / why not? Possible indicators include speech content
Are you able to rate the crew's level of situational awareness using visual cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include areas of focus location of gaze fixation visual scanning

Form B8. Capturing elements of human performance: work or non–work-related distraction or inattention

Level of crew members' distraction/inattention	Input/comments
Are you able to observe the crew engaging in competing secondary activity(ies)? (Yes/no/unsure) (default = no) Why / why not? If ‘yes,' what activity did you observe? Who was performing it? (engineer/conductor/other)
Are you able to rate the crew's level of distraction/inattention using auditory cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include speech content
Are you able to rate the crew's level of distraction/inattention using visual cues? (Yes/no/unsure) (default = no) Why / why not? Possible indicators include area of focus location of eye fixations visual scanning
Are you able to rate the crew's level of distraction/inattention using physical cues?  (Yes/no/unsure) (default = no) Why / why not? Possible indicators include interaction with equipment/technology stance/position

Forms B9. Capturing locomotive control inputs under normal operating conditions

Form B9.1. Is the coverage area provided by the video adequate to observe the crew's use of the following locomotive control inputs?

Is the coverage area provided by the video adequate to observe the crew's use of the following locomotive control inputs?	Input/comments (yes/no/unsure) (default = no)
Throttle
Dynamic brake
Automatic brake
Independent brake
Bell and whistle controls
Reset safety control (RSC)
Train information braking system (TIBS) / master control unit (MCU)
Radio communications
Headlight switches

Form B9.2. Are the numerical readouts/position visible for the following locomotive control inputs?

Are the numerical readouts/position visible for the following locomotive control inputs?	Input/comments (yes/no/unsure) (default = no)
Throttle
Speedometer
Dynamic brake
Automatic brake
Independent brake
Bell and whistle controls
Reset safety control (RSC)
Train information braking system (TIBS) / master control unit (MCU)
Radio communications
Headlight switches

Form B9.3. Are you able to observe crew members interacting with the following locomotive control inputs?

Are you able to observe crew members interacting with the following locomotive control inputs?	Input/comments (yes/no/unsure) (default = no)
Throttle
Dynamic brake
Automatic brake
Independent brake
Bell and whistle controls
Reset safety control (RSC)
Train information braking system (TIBS) / master control unit (MCU)
Radio communications
Headlight switches

Form B9.4. Are there indication(s) that crew members responded to auditory alarm(s) or warning(s) generated by these control inputs?

Are there indication(s) that crew members responded to auditory alarm(s) or warning(s) generated by	Input/comments (yes/no/unsure) (default = no)
Throttle
Dynamic brake
Automatic brake
Independent brake
Bell and whistle controls
Reset safety control (RSC)
Train information braking system (TIBS) / master control unit (MCU)
Radio communications
Headlight switches

Form B9.5. Are there indication(s) that crew members responded to visual alarm(s) or warning(s) generated by these control inputs?

Are there indication(s) that crew members responded to visual alarm(s) or warning(s) generated by	Input/Comments (yes/no/unsure) (default = ‘no')
Throttle
Dynamic brake
Automatic brake
Independent brake
Bell and whistle controls
Reset safety control (RSC)
Train information braking system (TIBS) / master control unit (MCU)
Radio communications
Headlight switches

Form B10. Capturing non-normal situations in the locomotive cab

In-cab crew interactions	Input/comments
Did you observe any indication(s) that crew members reacted to external detectors / wayside detection messages? (Yes/no/unsure/N/A) (default = yes)
Did you observe any indication(s) that crew members reacted to on-board alarms (e.g., wheel slip)? (Yes/no/unsure/N/A) (default = yes)
Did you observe any indications that crew members reacted to emergency/non-standard radio communications? (Yes/no/unsure) (default = yes)

Form B11. Other notes regarding the data file

Notes

Appendix C – Technology: locomotive voice and video recorder technology experience in the United States

Information compiled and summarized at 31 December 2015.

Railroad/Organization	Status
Canadian National (CN, U.S.)	CN implemented a pilot study in 2014 involving an inward-facing locomotive camera. The location selected was the  Duluth, Missabe and Iron Range Railway (DMIR) / Bessemer & Lake Erie Railroad Company (BLE). The pilot study involved the installation of this equipment on 8 locomotives (6 locomotives for DMIR and 2 locomotives for BLE). Some of the challenges and lessons learned from the pilot study include the following: Remote downloading of video was not practicable (because of the large files and the high cost to download these files). Some hardware was not appropriate in a reduced-lighting environment (for example, certain types of cameras are not designed for night visibility). Tampering with cameras involving employees has occurred.
Canadian Pacific Railway (CP, U.S.)	Four locomotives are equipped with  locomotive voice and video recorder (LVVR) technology. A pilot study had been implemented on CP track in the U.S. The LVVR equipment on two of the locomotives has since been disabled (but the locomotives are still equipped), as these locomotives are currently operating in Canada. The video cameras are from Railhead. The Railhead system is connected to the Wi-Tronix system, which synchronizes the time based on the Wi-Tronix global positioning system (GPS) clock. As Wi-Tronix is also connected to the locomotive event recorder (LER), the Railhead data can be synchronized with the LER data.
Kansas City Southern (KCS)	Although KCS still has some GE and Wabtec equipment, it has selected Railhead as its preferred equipment. KSC currently has over 150 units installed (with plans to install an additional 100 units). The video recordings from the inward-facing cameras (2) and outward-facing cameras (2) are synchronized and stored on the same hard drive. The 2 outside microphones are synchronized with the video recording from the outward-facing cameras. (Note: There are no on-board microphones installed.) For some of the KCS locomotives, the LVVR technology had been integrated and synchronized with the LER. For these locomotives, a viewing dashboard is available to search and select locations on a map to see the events.
Union Pacific Railroad (UP)	UP is using Wabtec for its outward-facing video cameras. For inward-facing video cameras, Welldex equipment is being used. As of May 2015, UP had installed this equipment on over 850 locomotives. The equipment is not integrated (or automatically synchronized) with the LER.
Metrolink	At Metrolink, the cab car and locomotive digital video recorders (LDVRs) that have been installed are Railhead equipment. As of May 2015, this equipment had been installed on 60 locomotives. Some Metrolink locomotives have been equipped with Model RVS-LDVR4-500G, 4-channel LDVR GEN 3. Because of some recent problems, the GEN 3 equipment is being replaced with Railhead's next-generation equipment (Model RVS-LDVRH4-500G GEN 4). The inward-facing cameras (2) and the forward-facing camera  (1) are not integrated (or automatically synchronized) with the LERs. Metrolink is considering an upgrade to the forward-facing camera to provide a higher-performance camera.
New Jersey Transit	As of May 2015, inward-facing video cameras have been installed on 75 locomotives.
Federal Railroad Administration (FRA)	The Recording Devices Working Group (RDWG) of the Railroad Safety Advisory Committee (RSAC) met on 28 May 2015 to discuss the installation of video recorders on locomotives. The specific task assigned to RDWG was to develop regulatory recommendations addressing the installation and use of inward- and outward-facing image recorders in controlling locomotive cabs. Any recommendations from RDWG were to address the following: installation requirements and timelines, technical controls, recording retention periods, retrieval of recordings, controlled custody of recordings, crashworthiness standards (that is, at least equivalent to those for LER), use of recordings for purposes of accident investigation and railroad safety studies, and use of recordings in conducting operational tests. The RDWG proposed the following positions to the FRA: mandate outward- and inward-facing image recording devices; allow, but do not mandate, audio recording; and allow operational testing using image-recording devices with established random selection requirements for inward-facing recording devices. Recommendations from RDWG to RSAC were originally due on 01 April 2015. In the absence of consensus recommendations from RDWG and RSAC, it was determined that the FRA would proceed with a Notice of Proposed Rulemaking through the traditional rulemaking process.
National Transportation Safety Board (NTSB)	NTSB recommendations relating to audio and image recorders in locomotives include the following: Require the installation, in all controlling locomotive cabs and cab car operating compartments, of crash- and fire-protected inward- and outward-facing audio and image recorders capable of providing recordings to verify that train crew actions are in accordance with rules and procedures that are essential to safety, as well as train operating conditions. The devices should have a minimum 12-hour continuous recording capability with recordings that are easily accessible for review, with appropriate limitations on public release, for the investigation of accidents or for use by management in carrying out efficiency testing and system-wide performance monitoring programs. (R-10-1) Require that railroads regularly review and use in-cab audio and image recordings (with appropriate limitations on public release), in conjunction with other performance data, to verify that train crew actions are in accordance with rules and procedures that are essential to safety. (R-10-2)

Appendix D – Technology: summary of technology issues

Table D1. System-design considerations for video cameras: installation

Installation	Railway A (Voice-only)	Railway B (Video-only)	Railway C (Video-only)	Railway D (Voice-and-video)
Number of inward-facing locomotive cameras in each locomotive	None	2	3	3
Location/ placement of inward-facing locomotive cameras	N/A	On ceiling. One camera was located at the front right (if one is facing toward the front) corner of the locomotive, aimed downwards and to the rear, toward the LE seat. The other camera was located near the middle of the cab, and was aimed downwards and to the side toward the conductor seat	Two cameras on ceiling, just above the front sun visors, and aimed rearward toward the LE and conductor seating positions. One fish-eye lens camera in middle of ceiling.	On ceiling at the rear of the cab. One camera was directed toward the back of the conductor seat, and the other toward the back of the LE seat. The third camera was installed at the front of the locomotive on the dashboard and facing rearward.
Cameras' field of view	N/A	Front view of LE and conductor seats	Front view of LE and conductor seats; 360-degree, fish-eye view of entire cab.	Back view of LE and conductor seats, view of rear wall and equipment display.
Cameras' angle of view	N/A	Downward from ceiling.	Downward from ceiling.	Downward from ceiling, and rearward from dashboard.

Table D2. System-design considerations for video cameras: environmental protection

Environmental protection	Railway A (Voice-only)*	Railway B (Video-only)	Railway C (Video-only)	Railway D (Voice-and-Video)
Camera housing and accessories	N/A	Polycarbonate housing/covering to protect from tampering	Camera housing needs to be designed to prevent tampering	Camera housing and the camera are provided by Axis Communication. The camera housing consists of an aluminum and polycarbonate casing. Camera screws are tamper-resistant, with associated software designed to activate if the camera is tampered with.
National Electrical Manufacturer Association (NEMA) environmental rating	NEMA rating IP66 (dust- and tamper-proofed)	Not specified	Not specified	The cameras are compliant with the EN50155 standard, which means that they are vibration-, shock-, and temperature-tested to railway standards. Other related standards included EN55022 class B, EN55024, EN50581, and EN61000-6-1.

* Information about video cameras for Railway A refers to forward-facing cameras rather than in-cab cameras.

Table D3. System-design considerations for video cameras: recording specifications

Recording specifications	Railway A (Voice-only)*	Railway B (Video-only)	Railway C (Video-only)	Railway D (Voice-and-Video)
Resolution	4 common intermediate format (CIF) (704 × 480)	240 images per second (ips) at CIF resolution (352 × 240) 120-ips at 2-CIF resolution (704 × 240) 60-ips at 4-CIF resolution (704 × 480)	High-definition (HD) resolutions are acceptable (aspect ratio varies, no preference). Cameras that output multiple resolutions simultaneously are preferred.	1280 × 720 to 160 × 90
Frame recording rate	15 frames per second (FPS)	N/A	Configurable frame rate is required (at least 15/30 FPS)	1080P – HD at 30 FPS
Colour versus black and white	Colour	Colour, infrared for night vision (automatic as light levels change)	Colour is a requirement (except in low-light infrared mode)	Colour recording with automatic correction for low light and flare conditions
Aspect ratio	1.5	N/A	N/A	N/A
Automatic start and stop	The camera is operational at all times. The camera does not start or stop on motion detection.	Cameras record when locomotive is powered, regardless of movement.	IP cameras start automatically when powered by power over Ethernet.	System automatically starts when the locomotive is powered up.

* Information about video cameras for Railway A refers to forward-facing cameras rather than in-cab cameras.

Table D4. System-design considerations for video cameras: camera/lens specification

Camera/lens specification	Railway A (Voice-only)*	Railway B (Video-only)	Railway C (Video-only)	Railway D (Voice-and-Video)
Optical characteristics (depth of field, field of view, f-stop)	High resolution, colour National Television System Committee (NTSC) format, 6 mm fixed lens Field of view: horizontal (42°), vertical (32° F2.0), 1.0 lux	Autoelectric f-stop from 1/60 to 1/10,000	N/A	0.2 lux (minimum illumination) 102° horizontal viewing angle and 47° vertical viewing angle with ± 30° pan, 15 to 90° tilt and ± 175° rotation.
Exposure control (lighting and sensitivity)	N/A	Infrared for night vision (automatic as light levels change)	Limited testing has shown exposure control features are key to good performance in changing light conditions (such as wide dynamic range).	Progressive scan RGB (red-green-blue) CMOS image sensor M12-mount fixed iris, megapixel resolution
Minimizing the effects of power interruptions to the video camera (automatic restart, automatic recover, battery backup)	At power down, the internal battery allows the locomotive digital video recorder (LDVR) to stop recording and close all processes to minimize the risk of software or image corruption. At power up, the LDVR comes back online automatically. Automatic restart: Yes Automatic recover: Yes Battery backup: Yes	Battery backup	Battery is required to continue recording for several minutes if the system is disconnected. System should resume recording when powered (applies more to recording system than to camera).	Automatic restart and recover after the locomotive is powered up. Camera focus is adjusted manually during implementation and set in the parameters.
Minimize effects of other environmental conditions (vibration, shock, light levels, temperature, magnetic effects, radio frequency (RF) susceptibility, dust, moisture)	Vibration: Random: 1.5 Grms, 10–200 Hz, 4 hours/axis, 3 axes Sinusoidal: 7.6 mm p-p 5–10 Hz, 1.5 g p at 10–300 Hz, 4 hours/axis, 3 axes Shock: 20 g, 11 ms, terminal peak 3 shocks in each direction/axis, 3 axes shock Light levels: 1.0 lux Temperature: −25 °C to +60 °C RF susceptibility: not specified Dust-proofed Moisture: 95% relative humidity at 40 ± 5 °C	Operation temperature range −10 °C to 50 °C	Needs to meet locomotive standards in all of these areas Have not had issues with environmental factors so far in testing	Camera auto-adjusts to light conditions. Shock and vibration are controlled internally. Cameras are tested to EN50155 standard, which ensures that they can be operated in −20 °C to +40 °C weather. Shock and vibration tested to EN50155. Cameras were audited during prototyping to ensure they work to an acceptable level (that is, visibility of objects should be clear). Since the cameras are internal to the locomotive, there have been no issues with dust, moisture, or other environmental effects.

* Information about video cameras for Railway A refers to forward-facing cameras rather than in-cab cameras.

Table D5. System-design considerations for audio recorders

Audio recorder	Railway A (Voice-only)	Railway B (Video-only)	Railway C (Video-only)	Railway D (Voice-and-Video)
Automatic starting and stopping of audio recorder (if different from video system): synchronization of audio and video recordings	Audio recording is in sync with video	N/A	N/A	Audio recordings are fed through the cameras to the network video recorder (NVR). Automatic start and stop are controlled by the locomotive being powered up or not. Audio is synchronized to the video files by the software.
Access to audio recorder for maintenance and testing purposes	The audio recorder is accessible to maintenance employees through a software application on a portable computer.	Video and audio are part of the same unit.	Physical access on locomotive system integration (LSI) rack, also requires remote access via external cell modem	Audio recordings and the internal video recordings can be viewed only during implementation/testing per the privacy policy. Screen indicates whether the unit is recording. Audio is synchronized to the video, but can be displayed or accessed separately (if needed).
Minimizing the effects of power interruptions to audio recorder: automatic restart automatic recover battery backup	Automatic restart: Yes Automatic recover: Yes Battery backup: Yes	Reboot upon closing and locking unit door Battery backup	Battery is required to continue recording for several minutes if the system is disconnected. System should resume recording when powered.	Automatic restart/recover when used with the cameras The microphones are powered by the cameras.
Minimizing the effects of other environmental conditions: vibration shock	Vibration: Random: 1.5 Grms, 10–200 Hz, 4 hours/axis, 3 axes Sinusoidal: 7.6 mm p-p 5–10 Hz, 1.5 g p at 10–300 Hz, 4 hours/axis, 3 axes Shock: 20 g, 11 ms, terminal peak 3 shocks in each direction/axis, 3 axes shock.	N/A	System needs to stand up to standard locomotive shock and vibration.	Isolation pads are used for the microphones at their mounting points, which minimize the effects of vibration and shock.
Quality of audio recordings: background noise location of microphones	Audio: H264 compression algorithm for video The cab microphones' background noise is reduced by using a pre-set frequency equalizer (filter). Locomotives EPA-42A (2 microphones inside the cabin): project in prototype stage 1 microphone installed on the right wall of the console locomotive engineer side 1 microphone installed on the console at the right side of the integrated function display screen (left side of the locomotive cab) GPA40H (3 microphones): 1 microphone installed under the cabin's floor on all locomotives 2 microphones inside the cabin project in prototype stage The microphones are ceiling-mounted above the locomotive control stand, one on either side of the locomotive.	Microphone located on underside of locomotive cab / external recordings only	Requires a single microphone in the air-brake cabinet	Initial prototypes with in-service vehicles provided audio that could be understood during acceleration, coasting, and deceleration. The microphones are located above the engineer's head and the conductor's head. Background noise is mechanically filtered out and captures sound only within the frequency range of the human voice.

Table D7. Other system-design considerations

Other considerations	Railway A	Railway B	Railway C	Railway D
Cabling from recording devices to recording system	Shielded cable	Possible, but does not employ this method owing to security concerns	Ethernet	Similar to past digital video recorder
Hardware for mounting recording devices	Steel brackets	Specially fabricated depending on model	Prefer LSI mount	Device mounting and hardware provided and designed by Railway D
Retention of recordings	Hard drive is removed after an incident and is stored by the railway's legal department.	Varies based on event type	Need at least 3 days	“First in, first out” memory. Recordings are kept on the system and erased after 72 hours. If required, the NVR can be disconnected and kept for the legal department and/or the TSB.
Audit trail / chain of custody for recordings	Yes: chain-of-custody process is in place.	Yes: both hard copies and remote downloads are tracked.	Very important to have solid audit trail and chain-of-custody solution for on-board downloads as well as remote downloads (over wireless)	Internal closed-circuit television policy dictates how information is taken off and released. Chain-of-custody records are maintained if a universal serial bus (USB) stick is used to share the recordings.
User-programmable settings for the video recordings (for example, recording resolution, frame rate, etc.)	Available, as provided by the manufacturer	Configuration set at installation	Requires configurable resolution, frame rate, colour depth, and encoding quality	Requires some knowledge of the system and is done during implementation
User-programmable settings for the audio recordings	Available, as provided by the manufacturer	No	Requires configurable microphone gain	Audio settings are manually adjusted for sensitivity on the microphone. Otherwise, there is no setting.

Appendix E – System schematics and layout for on-board recorders

All recording systems assessed by the 4 subgroups included a forward-facing outside video camera. While all systems supported the synchronization of the on-board recordings with video from this forward-facing camera, only some systems supported the synchronization of the on-board recordings with locomotive event recorders (LERs) and global positioning system (GPS) data and, during this trial, these systems were not synchronized for analysis.

The following is an overview of the unique features of each recording system used by the 4 railways. More detailed information regarding technical specifications of each system is contained in Appendix D – Technology: summary of technology issues.

Railway A (voice-only)

Recordings from 9 locomotives from Railway A were assessed. Locomotives were equipped with 1 of 2 configurations of locomotive voice recording system (8 locomotives were equipped with one primary system, and 1 locomotive was equipped with another system that was still in the prototype phase of evaluation by the railway). Each system comprised 2 on-board microphones; the prototype system also included background noise reduction at the time of recording using a pre-set frequency equalizer filter.

The primary voice recording system configuration had 1 microphone positioned near the right wall (if 1 is facing toward the front of the locomotive) next to the locomotive engineer (LE) console, and the other microphone on the console at the right side of the integrated function display (IFD) screen (Figure E1) directed toward the conductor side. The other, prototype, configuration had the microphones mounted on the locomotive ceiling: 1 above the control stand and the other above the conductor's seat (Figure E2).

Railway B (video-only)

Recordings from 5 locomotives equipped with an inward-facing video-only recording system from Railway B were assessed. Systems included infrared light sources to allow recording under low light conditions. Inward-facing cameras were set to record at a rate of 7 to 8 FPS.

Two on-board cameras were installed on the ceiling of the locomotive. One camera was located at the front right (if one is facing toward the front) corner of the locomotive, aimed downwards and to the rear toward the LE seat. The other camera was located near the middle of the cab, and was aimed downwards and to the side toward the conductor seat (Figure E3).

Railway C (video-only)

Recordings from 2 locomotives equipped with a video-only recording system from Railway C were assessed. Locomotives were fitted with 2 inward-facing locomotive cab cameras and included infrared (IR) light sources to increase visibility under low light conditions.

There were 2 camera configurations used by Railway C, depending on the locomotive cab layout. For both configurations, inward-facing cameras were set to record at a resolution of 1280 × 1024 pixels and at a frame rate of 30 frames per second (FPS). Each of Railway C's video-recording systems included 2 cameras installed on the ceiling of the locomotive, just above the front sun visors, and aimed rearward toward the LE and conductor seating positions (Figure E4).

Locomotives from Railway C were also equipped with a centrally mounted camera that used a fish-eye lens. This camera also included an IR light source to allow recording under low light levels. Video from this camera captured a full 360° view of the locomotive cab interior. Playback software for the fish-eye camera includes a tool that “unwarps” the fish-eye image, allowing observers to pan around the inside of the locomotive as if they were moving the camera. Still images from the fish-eye lens camera are shown in Figure E5.

Railway D (voice-and-video)

Recordings from 3 locomotives equipped with inward-facing video and voice recording systems were assessed for Railway D.

A schematic showing the system set-up is presented in Figure E6. Microphones were omnidirectional, connected to the video cameras, and positioned above the LE's and conductor's heads (red stars in Figure E6). Background noise was reduced at the time of recording using a pre-set frequency equalizer filter.

Two inward-facing video cameras (facing forward) were installed on the ceiling at the rear of the cab. One camera was directed toward the back of the conductor seat (Figure E7), and the other toward the back of the LE seat (Figure E8). There was a third camera installed at the front of the locomotive on the dashboard and facing rearward, which included a view of the rear wall and equipment display. The camera set-up did not include separate IR illumination; however, the cameras were designed to record under very low minimum illumination conditions (0.3 lux).

Appendix F – Partial list of acts administered by or through Transport Canada that could be affected

Air

• Aeronautics Act, RSC 1985, c A-2.
• Canada Labour Code, RSC 1985, c L-2.
• Canada Transportation Act, SC 1996, c 10.
• Department of Transport Act, RSC 1985, c T-18.

Marine

• Canada Labour Code, RSC 1985, c L-2.
• Canada Marine Act, SC 1998, c 10.
• Canada Shipping Act, 2001, SC 2001, c 26.
• Canada Transportation Act, SC 1996, c 10.
• Department of Transport Act, RSC 1985, c T-18.

Rail

• Canada Labour Code, RSC 1985, c L-2.
• Canada Transportation Act, SC 1996, c 10.
• Department of Transport Act, RSC 1985, c T-18.
• Railway Safety Act, SC 1985, c 32 (4th Supp).

Appendix G – Operational and human factors: results of assessments

Railway A (voice-only)

Fourteen 60-minute voice recordings from 9 locomotives were reviewed over 3 sessions by the Railway A subgroup. Recordings from 1 (of 2) available microphones were reviewed in conjunction with the forward-facing outside locomotive video. None of the recordings were synchronized with locomotive event recorder (LER) data, but all could be manually synchronized, if desired. All of the recordings were made on regular routes in February and March of 2016.

Two recordings that had been downloaded from a locomotive equipped with the prototype system configuration were of poor quality because of excessive background noise that could not be easily filtered out. As a result, the subgroup could not assess the audio data from these 2 recordings, and they were excluded from the analysis. Results are based on the 12 remaining recordings.

Environmental / operational conditions

Eight of the 12 recordings were made under daylight conditions, 1 was made at dawn, and 3 were made at night. Weather conditions at the time of 11 recordings were either clear or overcast; in one case, it was snowing. Trains were in motion between 80% and 100% of the time during the portion of the files viewed, on both single- and multi-track, and in both urban and rural environments.^{Footnote 50}

The number of crew members in the locomotive cab was assessed by subgroup members to be at least 2, and up to 3, in all recordings. It was not always possible to determine conclusively how many people were in the cab by listening to the audio recordings, especially when reviewers were unfamiliar with the route and with individual crew members' voices. In 5 (42%) of the 12 recordings, it was not possible for the subgroup to identify which voice was the locomotive engineer's (LE's) and which was the conductor's. Some of the reasons for this difficulty included the following:

• Listening to a recording made from only 1 microphone made it difficult in some cases to know who was seated/positioned where. Reviewing both microphones at once would make it easier to determine who is seated where from the loudness of the voices during playback. It would also help if an observer was familiar with the voices of the people who were working and their roles.
• Radio chatter from other trains in the vicinity made it difficult, at times, to identify crew roles.

There were no issues noted regarding the audibility of the recordings for 6 (50%) of the 12 files. For the remaining 6 files (50%), issues with the audio recording were noted, and these issues were related to the following:

• Locomotive speed appeared to have an impact on the in-cab noise level, which affected the audibility of recordings, with slower speeds affording better audibility than faster speeds.
• Having data from only 1 (of 2) available microphones made it difficult, at times, to hear both crew members' conversation.
• Some radio transmissions may have gone undetected as a result of possible interference from radio transmissions from other locomotives using the same channel.
• Review of the 1 recording made under snowy weather conditions suggested that snow may dampen the audibility of external (to locomotive) recorded sounds.

Technical issues relating to limitations of the quality of the forward-facing outside video camera (which recorded at a frame rate of 15 frames per second [FPS]) were noted, including frequent difficulty discerning the train control signal colour.

Ability to identify behaviour associated with safety-relevant operational issues

A. Normal operations

The subgroup assessed each of the 12 recordings for its capacity to identify crew use of locomotive control inputs and displays, as well as any indication(s) that crew members responded to auditory alarm(s) or warning(s) generated by these systems. The results of this assessment are presented in the following table.

Table G1. Percentage of recordings* identifying crew's interaction with locomotive control inputs (Railway A)

Locomotive control input	Recordings* identifying** crew use of control input	Recordings* in which crew responded to auditory warning(s)
Throttle	100%	No warnings
Brake Dynamic Automatic Independent	92% 100% 92%	No warnings No warnings No warnings
Bell and whistle controls	100%	No warnings
Reset safety control (RSC)	8.3%	No warnings
Train information braking system (TIBS) / master control unit (MCU)	Not applicable	Not applicable
Radio communications	92%	No warnings
Headlight switches	42%	No warnings

* Total of 12 recordings

** Recording was rated by subgroup as either “possible” or “somewhat possible”

It was noted that the ability to use audio recordings to identify locomotive control inputs was facilitated greatly by observing the accompanying forward-facing external video because it provided context for identifying the sounds in the recordings.

A.1 Encountering and responding to signals

Subgroup members agreed that they could identify locomotive crew members' detection and response to (external) train control signals in all of the recordings that afforded good-quality audibility.

A.2 Making calls across the cab

Within the 10-minute segments reviewed, calls across the cab were heard in 10 of recordings (83%).

B. Non-normal or emergency situations

Crew reactions to external detectors or wayside detection messages were identified by the subgroup for 3 good-quality recordings (25%). These all related to messages issued by hot-box detectors. There were no alarms issued in any of the recordings that were reviewed; consequently, the subgroup was unable to assess reactions to on-board audible alarms (for example, wheel slip), or reactions to emergency radio communications. The subgroup considered that the audio recordings have the capacity to detect these, if issued.

C. Ability to identify behaviour associated with safety-relevant human factors issues

C.1 Crew resource management

For 9 recordings (75%), the subgroup assessed that it was possible to identify elements of effective crew resource management (CRM), including effective problem solving, operational nature of the conversation, planning, providing advice and direction to a trainee, confirmation of directions, provision of performance feedback, and leadership.

The subgroup noted that the evaluation of in-cab CRM using audio recordings was facilitated by simultaneous viewing of the forward-facing external video, as well as by having context regarding crew members and the geography of the track area.

C.2 Stress

For 10 recordings (83%), the subgroup assessed that it was possible to identify elements/indicators of a crew member's level of stress using auditory cues. In 7 recordings (58%), the ability to evaluate the level of stress using auditory cues was assessed as only “somewhat possible” because of 1) limitations in fully understanding the context of a situation without video data, and 2) the lack of a baseline “stress-free” comparison period with which to compare a recording. For 1 recording, it was not possible to assess the level of stress because there was too little conversation heard. This highlights the importance of having an adequate length/duration of recording to assess.

C.3 Alertness/fatigue

For 9 recordings (75%), the subgroup assessed that it was possible to identify elements/indicators of a crew member's level of alertness or fatigue using auditory cues. In 8 recordings (67%), the ability to evaluate the level of alertness/fatigue was assessed as only “somewhat possible” because of 1) limitations in fully understanding the context of a situation without video data or other operational information, 2) hearing too little conversation to make an assessment, and 3) the lack of a baseline “fully alert” comparison period with which to compare a recording.

C.4 Workload

Of the 12 recordings, the subgroup assessed that it was possible to determine the number of tasks being performed by a crew member at one time in 11 cases (92%), although for 10 recordings (83%) the ability to determine the number of tasks was assessed as only “somewhat possible” because it was reasoned that only those tasks comprising an auditory component would be possible to identify.

The subgroup assessed that it would be possible to identify elements/indicators of a crew member's level of workload using auditory cues in 11 of the recordings (92%). This was assessed as only “somewhat possible” for 7 recordings (58%). Some subgroup members thought that workload could be assessed using speech content, but not by using speech characteristics such as pitch and rate of speech.

The subgroup noted the importance of reviewing audio recordings with the benefit of forward-facing external video data; the subgroup would have further benefited from having synchronized LER data available. The importance of having a baseline low-workload comparison was also noted. The lack of speech on some recordings, or during some segments of recordings, would also be expected to make it difficult to evaluate workload, as the subgroup noted that the absence of speech or conversation does not necessarily indicate the absence of workload.

C.5 Situational awareness

Of the 12 recordings, the subgroup assessed that it was possible to identify the level of situational awareness of crew members in 10 recordings (83%). For 2 of these recordings, the subgroup judged identification as only “somewhat possible” because it would not be possible to determine level of situational awareness when the crew members were not speaking. It was noted that having other information providing context, such as forward-facing external video, synchronized LER data, and inward-facing video, would assist in this regard. Regardless, instances demonstrating effective situational awareness—for example, crew members calling and reacting to slow orders, maintaining proper speed, and reacting to level crossing requirements—were noted by the subgroup.

C.6 Distraction/inattention

The subgroup agreed that they could identify crew members engaging in some work- or non–work-related secondary activities, such as operational and non-operational conversations, in 10 (83%) of 12 recordings. However, it was noted that using auditory data would limit the identification of secondary activities to only those that comprise an auditory element. It was challenging at times to identify secondary activities; for example, if there was no conversation among the crew members at a particular time.

Similarly, for 9 recordings (75%), the subgroup determined that it would be “possible” (5 recordings) or “somewhat possible” (4 recordings) to identify elements/indicators of a crew's level of distraction or inattention using audio cues such as speech content. It was noted that having video data to complement the voice data would greatly improve an observer's ability to identify secondary activities being performed in the locomotive cab.

Technical issues

Several technical issues with the audio recordings were identified by the Railway A subgroup. First, it was noted that 2 separate audio files are recorded by the primary system: 1 from the 2 on-board microphones combined together through a separate audio mixer, and 1 from the forward-facing external camera. Global positioning system (GPS) and LER data are also recorded. However, although audio, forward-facing video, and GPS data are synchronized automatically with each other during recording playback, the LER data are not synchronized with them. Consequently, it was not always possible to accurately determine 1) the time that the data were collected, and 2) which crew member (position in the cab) was talking. According to the supplier, the locomotive digital video recorder (LDVR) time is synchronized on the locomotive to the LER time by means of a proprietary application; however, the synchronization after data collection is not automated.

It should be noted that Railway A's LDVR, LER, and telemetry systems were installed in locomotives at different times, and are not part of an integrated solution from a single supplier. The railway has noted that the lack of automation of the synchronization following data collection leads to significant effort to perform the synchronization and is therefore a topic for future consideration.

When reviewing the voice-only recordings, some subgroup members noted another issue related to an aspect common to all area microphones. It was possible, at times, to detect radio transmissions from other trains in the area of the equipped locomotive very clearly. This is because the radio speaker shares the same space as the crew (that is, the locomotive cab), and thus it is normal for radio transmissions to be recorded. It was considered that, when files were being reviewed by individuals with limited operational and/or contextual information, it could be difficult to determine which crew is broadcasting at one time. This would not be an issue when the individuals reviewing the recordings had sufficient contextual information.

Railway B (video-only)

Five 60-minute video recordings, from 5 locomotives, were reviewed over 2 sessions by the Railway B subgroup.

Recordings from on-board cameras were reviewed in conjunction with the forward-facing outside locomotive video. None of the recordings were synchronized with LER data, but all files could be manually synchronized, if desired. All recordings were made during regular runs between April and August 2015.

Environmental/operational conditions

Three of the 5 video recordings assessed by the subgroup were made under daylight conditions; the other 2 were made at night. Weather conditions at the time of 4 recordings were either clear or overcast; in 1 case, it was raining. Trains were observed to be in motion between 40% and 100% of the time. Track environment was mostly single-track (in 4 of 5 recordings), and all were operating in rural environments.

There were 2 crew members observed to be present in all recordings, and the roles of the LE and the conductor were assessed by the subgroup as being easily identified.

There were issues noted regarding the visibility of the recordings in all of the 5 files. These included the following:

• The playback of video from the on-board cameras in all 5 recordings appeared choppy. This was likely a result of the low frame recording rate of these cameras (between 6 and 8 FPS) compared with the forward-facing camera, which recorded at a rate of 15 FPS, and produced video that appeared smoother.
• Both on-board cameras were positioned on the right side (if facing toward the front) of the locomotive cab. This meant that some recordings did not capture all of the conductor's behaviour because the view from the camera was obstructed by the LE console or by the conductor's body.
• Because the on-board cameras were installed on the ceiling of the locomotive, providing a downward view of the crew, in several cases it was not possible to observe crew members' eyes because the camera view was obstructed by sunglasses or by hat brims. This was more likely to be noted when the downward viewing angle of the cameras was particularly steep.
• There were issues noted with the forward-facing video in several recordings, relating mainly to the limited resolution of the video. During periods of low light levels, the video would appear grainy or blurry. Colours of (outside) train control signals captured by the forward-facing video were not always possible to discriminate.
• The video playback from the 3 cameras was not synchronized automatically. As a result, when watching the playback of some recordings, subgroup members had difficulty following both crew members' actions.
• There was an issue noted with regard to the infrared light source that was co-located in the on-board cameras. In low light conditions, when a crew member would turn on a light source, such as a desk lamp, the infrared light would deactivate. Then, when the desk lamp was turned off, it would take a significant amount of time (approximately 40 seconds) for the infrared light source to switch back on. This meant that the recording from that camera during that period was entirely black.
• In one recording, the on-board cameras were misaligned so that they did not capture important safety-relevant information, such as the LE's controls and the conductor's workstation.

Ability to observe behaviour associated with safety-relevant operational issues

A. Normal operations

The subgroup assessed each of 5 recordings for its capacity to identify crew use of locomotive control inputs and displays, as well as any indication(s) that crew members responded to visual alarm(s) or warning(s) generated by these systems. The results of this assessment are presented in the following table.

Table G2. Percentage of recordings* showing crew's interaction with locomotive control inputs (Railway B)

Locomotive control inputs	Recordings* in which camera angles were adequate to capture** crew use of control inputs	Recordings* in which crew was observed to interact with control inputs	Recordings* in which numerical readout/ display was visible for control inputs	Recordings* in which crew responded to visual warning(s)
Throttle/(speedometer)	80%	100%/ (100%)	80% / (0%)	No warnings
Brake Dynamic Automatic Independent	100% 80% 80%	100% 80% 80%	20% 40% 60%	No warnings No warnings No warnings
Bell and whistle controls	100%	100%	20%	No warnings
RSC	80%	60%	40%	30%
TIBS/MCU	100%	80%	20%	No warnings
Radio communications	80%	80%	20%	No warnings
Headlight switches	60%	60%	20%	No warnings

* Total of 5 recordings

** Recording rated by subgroup as either “possible” or “somewhat possible”

It was noted that the resolution of the on-board video from Railway B was too low for the subgroup to be able to reliably discern which radio channel was being used or which position some of the other controls were in, even if they fell within a camera view. Subgroup members commented that, while it was possible to tell whether a crew member was interacting with a control, it was often not possible to tell the specific position of the control.

A.1 Encountering and responding to signals

Subgroup members agreed that they could identify locomotive crew members' detection of (external) train control signals in 4 of 5 recordings (80%).

A.2 Making calls across the cab

It was not possible to determine whether crew members were making calls across the cab in any of the recordings. It was noted that the ability to assess calls across the cab would be improved if there were accompanying on-board audio data available.

B. Non-normal or emergency situations

There were no external messages (such as those from detectors) or on-board alarms present in any of the recordings; consequently, the subgroup was unable to assess crew reactions to external detectors or wayside detection messages observed by the subgroup for any of the recordings or on-board alarms (such as wheel slip).

C. Ability to observe behaviour associated with safety-relevant human factors issues

C.1 Crew resource management

For 4 recordings (80%), the subgroup assessed that it was possible to observe elements of effective CRM. Because there were no on-board audio data available, the only available visual cues on which to base an estimate of a crew's level of CRM were 1) whether there appeared to be conversation between crew members, 2) their facial expressions (smiling versus unsmiling, laughing), and 3) their body language or movement (whether crew members were facing each other, whether they were looking toward each other, whether they were seated or standing, and where they were positioned within the locomotive cab).

It was also noted that it was very difficult to assess CRM using video data without accompanying audio data when the crew members appeared quiet or when they were not interacting. Just because crew members are not interacting does not necessarily mean that good CRM was not present. It was noted that, by adding context, having audio data would make the assessment of CRM issues much easier and more accurate.

Finally, the subgroup noted that the evaluation of CRM using video recordings only was facilitated by the simultaneous viewing of the forward-facing external video. It would also be made easier by having context regarding crew members and the geography/location of the track area.

C.2 Stress

For 4 recordings (80%), the subgroup assessed that it was “somewhat possible” to identify elements/indicators of a crew member's level of stress using visual cues, such as gaze fixations and visual scanning behaviour. Similarly, it was deemed “possible” (2 recordings) or “somewhat possible” (3 recordings) to assess the level of stress using physical cues, such as the nature of activities, body position, and stance. Reasons for the decision to assess these items as only “somewhat possible” included the following:

1. Some subgroup members thought that it would be preferable to have a baseline, “no stress,” measure of a crew member's level of stress with which to compare observed performance.
2. Crew members' sunglasses limited the subgroup's ability to observe visual behaviour.
3. The low resolution of the video data made it difficult to assess visual behaviour.
4. All subgroup members thought that it was simply not possible to accurately assess level of stress without the availability of audio data.

C.3 Alertness/fatigue

For 4 recordings (80%), the subgroup assessed that it was only “somewhat possible” to identify elements/indicators of a crew member's level of alertness or fatigue using visual cues, such as eyelid closure rate and visual scanning, because 1) the camera angles allowed a view of the crew members' eyes only at some times, but not others; 2) the resolution of the video was not high enough to reliably determine eyelid closure rate and other eye metrics; and 3) crew members' sunglasses obstructed the view of the eyes.

For 4 recordings (80%)  it was “possible” (and only “somewhat possible” for 1 recording) to assess a crew member's level of alertness using physical cues, such as yawns and stretches. The subgroup found that the low resolution of the video, in that single case, limited the subgroup's ability to effectively identify and use physical cues to estimate alertness.

C.4 Workload

The subgroup assessed that it was possible to determine the number of tasks being performed by a crew member at one time in all 5 cases (100%); although for 4 recordings (80%), the ability to determine the number of tasks was assessed as only “somewhat possible” because of the lack of audio information available. The subgroup determined that, although aggregate behaviour, such as operating the radio or interacting with the locomotive controls, can be identified using video data, a detailed assessment of behaviour is not possible without also having complementary audio information.

The subgroup assessed that it would be “somewhat possible” to identify elements/indicators of a crew member's level of workload using visual cues in 2 of the recordings (40%). The difficulty observing crew members' eyes owing to the poor quality or low resolution of the video data was cited by subgroup members as the reason for these ratings.

For rating crew members' workload using physical cues, such as activity level and physical stance, the subgroup assessed that it would be possible for all 5 recordings (100%). However, in 4 recordings (80%), it was assessed as being only “somewhat possible” because of limitations in video quality or low resolution.

C.5 Situational awareness

The subgroup assessed that it was “somewhat possible” to identify elements/indicators of the crew's level of situational awareness using visual cues in all 5 recordings (100%). It was noted that crew members' sunglasses would, at times, block the view of the eyes, and, in some recordings, the camera angles did not include the eyes of both crew members. It was noted that having complementary audio data available to provide context would greatly improve the ability to accurately assess crew situational awareness in cases where crew members' eyes were not visible.

Further, it was noted that a combination of visual and physical cues, such as activities the crew were engaged in, were used by the subgroup members to assess the level of situational awareness. It was also noted that assessing the on-board video recordings was facilitated by viewing the forward-facing video simultaneously.

C.6 Distraction/inattention

For 5 recordings (100%), the subgroup agreed that they could observe crew members engaging in work- or non–work-related secondary activities. It was noted that it was challenging, at times, to identify some secondary tasks without the use of audio data.

Similarly, for 3 (60%) recordings, the subgroup assessed that it would be “somewhat possible” to identify elements/indicators of a crew's level of distraction or inattention using visual cues such as direction of gaze and visual scanning behaviour. For 5 recordings (100%), the subgroup thought that it would be “possible” (1 recording) or “somewhat possible” (4 recordings) to assess a crew's level of distraction or inattention using physical cues such as interaction with devices/equipment. The subgroup noted that, although it was possible to identify the tasks in which crew were engaged, the low frame rate (6 to 8 FPS) of the on-board cameras limited the ability to define the level of distraction. The subgroup further noted that having audio information to supplement the video data would greatly improve an observer's ability to identify secondary activities being performed in the locomotive cab.

Technical issues

Two main technical issues with Railway B's system were identified by the subgroup members. These included the time lag in the infrared lighting system—when a desk lamp was turned on, the infrared light source switched off and took a significant amount of time to re-engage once the desk lamp was turned off. This resulted in the camera not collecting any data during that re-adjustment period.

A second technical issue noted was that the data from the cameras were not synchronized with LER data, GPS data, or data from the other cameras. This made it challenging, at times, to accurately assess what was happening in the locomotive cab as events changed over time.

Railway C (video-only)

Five video recordings of between 20 and 300 minutes in duration, taken from 2 locomotives, were reviewed in 1 session by the Railway C subgroup.

Recordings from on-board cameras were reviewed in conjunction with the forward-facing outside locomotive video. None of the recordings were synchronized with LER data, but all files could be manually synchronized, if desired. It was noted that Railway C planned to have all video channels automatically synchronized in future. All recordings were made during regular runs between March and April 2016.

Environmental / operational conditions

One of 5 video recordings assessed by the subgroup was made under daylight conditions; the other 4 were made at night. Weather conditions at the time of 4 recordings were clear; in 1 recording, there was low-lying fog present. Trains were observed to be in motion between 70% and 100% of the time. Track environment was mostly single-track (in 4 of 5 recordings) and in rural environments (4 of 5 recordings).

There were 2 crew members observed to be present in all recordings, and the roles of the LE and the conductor were assessed by the subgroup as being easily identified.

The quality of the on-board video taken from locomotives of Railway C was noteworthy in terms of its clarity, definition, and visibility under all lighting conditions, including complete darkness. This was likely due to the quality of the recording system's technical components and the recording rate of the system. The recording rate for both on-board (15 FPS) and forward-facing external (30 FPS) cameras meant that image playback did not appear choppy.

The subgroup noted that the fish-eye lens on the overhead on-board camera provided an excellent-quality view of the entire interior of the locomotive cab environment.

There were issues noted regarding the visibility of the recordings in 4 (80%) of the 5 files, although none regarding the technical specifications of the equipment. The issues included the following:

• Cameras were installed in positions in which it was possible for sun visors for both seating positions to be lowered in a way that obstructed views of both crew members from the on-board cameras. This made it difficult for the subgroup to fully assess conditions and behaviour, at times.
• The sun visors, when lowered, would block the infrared light source within the cameras. For recordings made at night, this made it more difficult for the subgroup to accurately assess crew behaviour recorded by the other (unobstructed) camera.

Ability to observe behaviour associated with safety-relevant operational issues

A. Normal operations

The subgroup assessed each of the 5 recordings for its capacity to identify crew use of locomotive control inputs and displays, as well as any indication(s) that crew members responded to visual alarm(s) or warning(s) generated by these systems. The results of this assessment are presented in the following table.

Table G3. Percentage of recordings* showing crew's interaction with locomotive control inputs (Railway C)

Locomotive control inputs	Recordings* in which camera angles were adequate to capture** crew use of control inputs	Recordings* in which crew was observed to interact with control inputs	Recordings* in which numerical readout/display was visible for control inputs	Recordings* in which crew responded to visual warning(s)
Throttle/(speedometer)	100%	100%	40% / (20%)	No warnings
Brake Dynamic Automatic Independent	80% 80% 80%	20% 20% 20%	40% 40% 40%	No warnings No warnings No warnings
Bell and whistle controls	100%	100%	20%	No warnings
RSC	100%	80%	60%	20%
TIBS/MCU	20%	0%	20%	No warnings
Radio communications	100%	100%	20%	No warnings
Headlight switches	80%	60%	20%	No warnings

* Total of 5 recordings

** Recording rated by subgroup as either “possible” or “somewhat possible”

Although the fish-eye lens used on the overhead camera in Railway C's recordings provided a full field of view, the limited resolution of the video did not always allow detailed assessment of, for example, the numerical read-out from the radio. The subgroup also noted that it was not possible to assess crew interaction with controls when the sun visor(s) blocked the on-board cameras, although reviewing the video from the fish-eye lens was considered helpful in those cases. The fish-eye lens had the advantage over other camera locations in that it could not be blocked, although it was as susceptible to any other camera to being scratched or otherwise occluded with tape or another substance.

A.1 Encountering and responding to signals

Subgroup members agreed that they could identify locomotive crew members' detection of (external) train control signals in 4 of 5 recordings (80%).

A.2 Making calls across the cab

It was not possible to determine whether crew members were making calls across the cab in any of the recordings. It was noted that the ability to assess calls across the cab would be improved if accompanying on-board audio data were available.

B. Non-normal or emergency situations

The subgroup identified no external warnings or alarms during the recordings examined, so it was not relevant to assess crew reactions to external detectors or wayside detection messages or to on-board alarms (such as wheel slip).

C. Ability to observe behaviour associated with safety-relevant human factors issues

C.1 Crew resource management

For only 1 recording (20%), the subgroup assessed that it was possible to observe elements of effective CRM. Because there were no on-board audio data available, the only available visual cues on which to base an estimate a crew's level of CRM were 1) whether there appeared to be conversation between crew members, 2) their facial expressions (smiling versus unsmiling, laughing), and 3) their body language or movement (whether crew members were facing each other, whether they were looking toward each other, whether they were seated or standing, and where they were positioned within the locomotive cab). In the 4 recordings in which the subgroup assessed that they did not know whether they could observe elements of CRM, the crew members appeared to interact very little or not at all. This situation can be difficult to assess, because the lack of apparent interaction does not necessarily mean that good CRM was not present. The subgroup remarked that, by adding context, audio data would make the assessment of CRM issues much easier and more accurate.

Finally, the subgroup noted that the evaluation of CRM using video recordings only was facilitated by simultaneous viewing of the forward-facing external video. It would also be made easier by having context regarding crew members and the geography/location of the track area.

C.2 Stress

For 3 recordings (60%), the subgroup assessed that it was “possible” (in 1 case, ”somewhat possible”) to identify elements/indicators of a crew member's level of stress using visual cues, such as gaze fixations and visual scanning behaviour. Similarly, it was deemed possible to assess level of stress using physical cues, such as the nature of activities, body position, and stance, in all 5 recordings. Some issues were noted: 1) crew members' sunglasses, as well as clear safety glasses, limited the subgroup's ability to observe visual behaviour, at times; and 2) the sun visors, when lowered, obstructed the view toward the crew's eyes regardless of whether they were wearing glasses.

C.3 Alertness / fatigue

For 2 recordings (40%), the subgroup assessed that it was possible to identify elements/indicators of a crew member's level of alertness or fatigue using visual cues, such as eyelid closure rate and visual scanning, and for 5 (100%) recordings it was possible to do so using physical cues, such as yawns and stretches. In 3 recordings (60%), the ability to assess level of alertness/fatigue using visual cues was assessed as only “somewhat possible” because of the following: 1) the sun visors, when lowered, obstructed the view of the crew members' eyes; and 2) sunglasses or safety glasses made it difficult to assess eye position.

C.4 Workload

The subgroup assessed that it was only “somewhat possible” to determine the number of tasks being performed by a crew member at one time in all 5 cases (100%). The subgroup noted that, although aggregate behaviour, such as operating the radio or interacting with the locomotive controls, can be identified using video data, a detailed assessment of behaviour is not possible without also having complementary audio information. Obstruction of camera views by sun visors also limited the subgroup's ability to assess the number of tasks.

The subgroup assessed that it would be “somewhat possible” to identify elements/indicators of a crew member's level of workload using visual cues in all 5 recordings (100%). The presence of sunglasses limited the ability to assess visual cues in the 1 file recorded during the day, as did obstructed views caused by lowered sun visors during day and night videos. Limited infrared lighting, caused by lowered sun visors in conditions of low light, also made it difficult for the subgroup to identify visual cues.

For rating workload using physical cues, such as activity level and physical stance, the subgroup assessed that it would be possible for 3 recordings (60%) and only “somewhat possible” for 2 recordings (40%) because of partial or full obstruction of the on-board cameras by lowered sun visors.

C.5 Situational awareness

The subgroup assessed that it was “somewhat possible” to identify elements/indicators of the crew's level of situational awareness using visual cues in all 5 recordings (100%). It was noted that the subgroup members used a combination of visual and physical cues, such as activities the crew were engaged in, to assess the level of situational awareness. It was not always possible to see crew members' eyes, either because they were wearing sunglasses or because the view from the camera to the eyes was obstructed by sun visors. It was noted that having complementary audio data available to provide context would greatly improve the ability to accurately assess crew situational awareness.

C.6 Distraction/inattention

For 5 recordings (100%), the subgroup agreed that they could observe crew members engaging in work- or non–work-related secondary activities. Similarly, for 5 recordings (100%), the subgroup assessed that it would be “possible” (1 recording) or “somewhat possible” (4 recordings) to identify elements/indicators of a crew's level of distraction or inattention using visual cues such as direction of gaze and visual scanning behaviour. For 5 recordings (100%), the subgroup thought that it would be “possible” (3 recordings) or “somewhat possible” (2 recordings) to assess a crew's level of distraction or inattention using physical cues such as interaction with devices/equipment. The only limiting factors in rating level of crew distraction or inattention related to view obstruction either by sun visors or by crew members' glasses.

The subgroup further noted that having audio information to supplement the video data would improve an observer's ability to identify secondary activities being performed in the locomotive cab.

Technical issues

Camera data were not synchronized with LER data, GPS data, or data from the forward-facing camera. This made it challenging, at times, to accurately assess what was happening in the locomotive cab as events changed over time.

In addition, it was possible for each sun visor to be moved into a position where it could block the camera's field of view.

Railway D (voice-and-video)

Thirteen voice-and-video recordings of approximately 30 minutes each from 3 locomotives were reviewed over 3 sessions by the Railway D subgroup. Recordings were reviewed in conjunction with the forward-facing outside locomotive video. All of the recordings were synchronized with LER data and were played back together, using specialized software. All of the recordings were made on regular routes between January and March of 2016.

Environmental/operational conditions

Six of the 13 recordings were made under daylight conditions; 3 were made at dawn; 1 was made at dusk; and 3 were made at night. Weather conditions at the time of 11 recordings were either clear or overcast. In 1 case, it was snowing, while in another it was raining. Trains were in motion between 20% and 100% of the time during the portion of the files viewed, on both single- and multi-track, and in both urban and rural environments. One recording was made while the locomotive was in a yard environment.

There were 3 crew members observed to be present in most (8 of 13) of the recordings. In 3 recordings, there were only 2 crew members observed, and in 1 recording, only 1. In 1 recording, there was no crew present—apparently, the crew members were operating from the other end of the locomotive, which was not equipped with recording equipment. It was noted that there are plans to equip both ends of the locomotives in the future. This recording was excluded from the rest of the analysis, leaving 12.

The roles of the LE, the conductor, and the “other” individual among the crew were assessed as being easily identified in all but 1 recording. In that recording, there were 3 individual crew members; however, the subgroup was not sure who was the trainee conductor and who was the conductor.

There were issues noted regarding the visibility of the recordings in 10 (83%) of the 12 files. These included the following:

• For several recordings, because of the position of the LE in his or her seat, there was only 1 camera view that captured the LE's seating position. This camera view was directed toward the back of the LE's seat, and there was no camera to record the LE's face.
• In several recordings, the rearward-facing camera that was installed at the front of the locomotive did not capture either operator's face, or was aimed too high, making it difficult for the subgroup to assess crew behaviour. Some subgroup members noted that the camera had likely become misaligned.
• The video image from the on-board cameras was, at times, blurry. This was likely due to the relatively low resolution of the video. Increasing light levels seemed to make the videos appear less grainy. At station stops, where light levels tended to increase, video quality was often good.
• Although the on-board cameras were designed to record under low light levels, they were unable to capture image details under low light conditions. Recording under low light levels was noted to be adequate when a secondary light source was activated within the cab; for example, when a desk lamp was turned on.
• In several files, video playback from the forward-facing external camera would occasionally have a tendency to freeze. The cause of this problem is not known.
• It was difficult, at times, to distinguish the train control signal colours from the forward-facing camera image.
• In some cases, when a locomotive would enter a temporary low-light area—for example, a tunnel—the infrared elements of the video recording system were unable to calibrate in time, and the video would appear black.

There were issues noted regarding the audibility of the recordings in all 12 files (100%). The audio data sounded garbled in many of the files, making it difficult for the subgroup to assess what was being said. This may have been due to the sound being played using an external speaker so that all subgroup members could listen. It is possible that using a headset would improve the audibility of the recordings, but this issue was not investigated further. Train acceleration also appeared to have an impact on the audibility of recordings, with the subgroup noting better audibility when locomotives were stationary or not accelerating.

Other factors that affected the audibility included the following:

• In all 12 recordings, the audio playback repeatedly, yet briefly, cut out.
• In many files, it appeared that not all crew members' voices could be heard on the audio track. It was eventually determined that the reason for this was that the audio playback was not synchronized with the video, in some cases up to 11 seconds' offset.^{Footnote 51}
• In some cases, it was not always possible to hear the train horn on the audio file. However, subgroup members could determine when it was activated because of other visual stimuli; for example, the ditch lights were observed to flash on the forward-facing video.
• It was difficult to determine the source of audio data in some files. Some subgroup members suggested that it would not be possible to accurately know which crew members were speaking at which time unless headset microphones (similar to those worn by aircraft pilots) were worn by crew members.

Ability to observe behaviour associated with safety-relevant operational issues

A. Normal operations

The subgroup assessed each of the 12 recordings for its capacity to identify crew use of locomotive control inputs and displays, as well as any indication(s) that crew members responded to auditory and visual alarm(s) or warning(s) generated by these systems. The results of this assessment are presented in the following table.

Table G4. Percentage of recordings* showing crew's interaction with locomotive control inputs (Railway D)

Locomotive control inputs	Recordings* in which camera angles were adequate to capture** crew use of control inputs	Recordings* in which crew was observed to interact with control inputs	Recordings* in which numerical readout/ display was visible for control inputs	Recordings* in which crew responded to auditory warning(s)	Recordings* in which crew responded to visual warning(s)
Throttle/ (speedometer)	83%	75%	42% / (83%)	No warnings	No warnings
Brake Dynamic Automatic Independent	Not applicable 75% 92%	Not applicable 83% 83%	Not applicable 50% 50%	Not applicable No warnings No warnings	Not applicable No warnings No warnings
Bell and whistle controls	92%	50%	50%	No warnings	No warnings
RSC	75%	67%	8.3%	No warnings	42%
TIBS/MCU	25%	25%	17%	No warnings	No warnings
Radio communications	83%	83%	33%	8.3%	No warnings
Headlight switches	75%	67%	75%	No warnings	No warnings

* Total of 12 recordings

** Recording rated by subgroup as either “possible” or ”somewhat possible”

In several of the recordings, it was noted that crew members' bodies blocked the camera view to the locomotive controls. This was because the cameras were positioned to the rear of the seating positions. In 1 file, the lighting level inside the locomotive cab was too low to determine whether the coverage area provided by the cameras was adequate to capture the locomotive controls.

It was further noted that it was not possible to view the numerical readouts of some displays because the lighting levels within the locomotive cabs were too low, especially when the trains were in motion. Visibility often became better when the train came into station stops. Conversely, it tended to be easier for the subgroup to read the locomotive speedometer display (which used light) when surrounding lighting level was low. It was also noted that it was easier for those subgroup members who were familiar with the locomotive configuration to read the numerical readouts and displays than it was for those subgroup members who were not familiar.

A.1 Encountering and responding to signals

Subgroup members agreed that they could identify locomotive crew members' detection of (external) train control signals in 8 of 12 recordings (67%).

A.2 Making calls across the cab

Calls across the cab were observed in 6 recordings (50%).

B. Non-normal or emergency situations

There were no crew reactions to external detectors or wayside detection messages observed by the subgroup for any of the recordings. Similarly, there were no reactions of the crew to on-board alarms (such as wheel slip) observed, nor were there any reactions to emergency radio communications. (It should be noted that there were no alarms heard or seen.)

C. Ability to identify behaviour associated with safety-relevant human factors issues

C.1 Crew resource management

For 6 of 12 recordings (50%), the subgroup assessed that it was possible to observe elements of effective CRM, such as leadership. Although there were on-board audio data available that could, theoretically, make it easier to estimate the level of CRM, the subgroup found that the inconsistent quality of the audio made it difficult, at times, to hear and understand what crew members were saying, especially when, for example, calls across the cab were being made and responded to very quickly, or when there was a high level of background noise such as when the train was travelling at high speed. The inconsistent quality of the audio made it difficult, therefore, to estimate or assess the level of CRM present in the cab.

C.2 Stress

For 8 recordings (67%), the subgroup determined that it was possible to identify elements/indicators of a crew member's level of stress using auditory cues. In 3 recordings (25%), the ability to evaluate level of stress using auditory cues was assessed as only “somewhat possible” because of 1) difficulties in understanding crew conversation owing to the limited quality and garbled nature of the audio data, at times, which made it difficult to identify specific behaviours (although it was noted that it was possible to detect changes in vocal pitch and overall tone of speech); and 2) the lack of a baseline “stress-free” comparison period with which to compare a recording.

For 7 of 12 recordings (58%), the subgroup assessed that it was “possible” (or, in 6 cases, “somewhat possible”) to identify elements/indicators of a crew member's level of stress using visual cues, such as eye fixations and visual scanning behaviour. It was deemed possible to assess level of stress using physical cues more often than visual cues, with 10 of 12 recordings being assessed as “possible”; although for 3 recordings, consensus was that it was only “somewhat possible.” Reasons for the decision to assess these items as only “somewhat possible” included the following:

1. The angle of the ceiling-installed on-board cameras, which were directed toward the backs of the crew members (and toward the front of the locomotive) allowed the sightlines to, for example, locomotive controls, to be partially or fully obstructed by the crew members' bodies. This would make it difficult to define behaviour conclusively, at times.
2. Some of the on-board cameras were not properly aligned, which meant that 1 or all crew members could not be seen in the video file (although having the complementary audio recording assisted the subgroup in understanding context even when cameras were misaligned).
3. Many of the recordings did not capture the view toward crew members' eyes, making it difficult to assess eye-position metrics.
4. For some recordings that were collected at night or during periods of low light, it was noted that the infrared capacity of the cameras provided insufficient light levels to adequately see the crew's behaviour.
5. The poor image quality (graininess) observed in some files made it difficult to adequately assess eye-position metrics.

C.3 Alertness/fatigue

For 7 of 12 recordings (58%), the subgroup assessed that it was possible to identify elements/indicators of a crew member's level of alertness or fatigue using auditory cues. In 3 recordings (25%), the ability to evaluate level of alertness/fatigue was assessed as only “somewhat possible.” In those cases when the subgroup assessed that it was not possible to assess level of alertness, this was primarily because the quality of the audio data was too poor to understand what was being said (although, in some recordings, yawns could be heard). It was noted that the audio recordings were helpful, at times, in filling in gaps in the video data; for example, when a crew member disappeared from the view of the cameras. However, it was also noted that the limited quality of the audio may not allow conclusive evaluations of level of alertness to be made.

For 7 recordings (58%), the subgroup assessed that it was possible to identify elements/indicators of a crew member's level of alertness or fatigue using visual cues, such as eyelid closure rate and visual scanning, and for 10 recordings (83%) it was “possible” (or, in 3 cases, “somewhat possible”) to do so using physical cues, such as yawns and stretches. In 5 recordings (42%), the ability to evaluate level of alertness/fatigue using visual cues was assessed as only “somewhat possible” because of the following: 1) the alignment of 2 of the on-board cameras at the back of the locomotive, facing forward, meant that, at times, views toward some crew members were not captured; 2) for recordings that were collected at night or during periods of low light, the infrared capacity of the cameras provided insufficient light levels to adequately view the crew's behaviour and eyes; and 3) the on-board cameras did not capture crew members' faces or did not capture faces in sufficient detail, limiting the ability to see and assess crew members' eye-movement metrics.

C.4 Workload

Of the 12 recordings, the subgroup assessed that it was possible to determine the number of tasks being performed by a crew member at one time in 11 cases (92%). In 1 case (8.3%), the ability to determine the number of tasks was assessed as only “somewhat possible” because there were no tasks (other than operating the locomotive) identified. The subgroup was unable to determine the number of tasks in 1 recording because it was too dark.

The subgroup determined that it would be possible to identify elements/indicators of a crew member's level of workload using auditory cues in 9 recordings (75%). This was assessed as only “somewhat possible” for 8 recordings (75%). Reasons included the following:

1. The subgroup noted that, in some cases, it was not possible to hear crew members when they were speaking on the radio. (It was later determined by the subgroup that the playback of the audio and video files was not synchronized, which better explains why the crew members' speech was not heard at times, although they appeared to be speaking.)
2. Although it was possible to detect crew members talking, the limited quality of the audio data limited the subgroup's ability to understand what was being said. (It was noted that listening to file playback using headphones might improve the audibility of the recordings.)
3.  “Congestion” from audio data sources (for example, crew's use of radio, transmissions from other trains in the area) made it difficult to understand the crew's speech, at times.

The subgroup assessed that it would be “somewhat possible” to identify elements/indicators of a crew member's level of workload using visual cues in 6 recordings (50%). Reasons noted were the following: 1) it was not possible to use visual cues to assess workload when the camera angles did not capture crew members' faces; and 2) when crew members' eyes were contained within the frame of a camera angle, it was difficult to observe the eyes due to the poor quality or low resolution of the video, especially under low light levels.

For rating workload using physical cues, such as activity level and physical stance, the subgroup assessed that it would be “possible” to do so in 11 recordings (92%). In 4 recordings (25%), it was assessed as being only “somewhat possible” because of the following: 1) there were limitations in video quality (that were more pronounced under low light conditions); 2) the angles of the on-board cameras did not always capture all cab occupants; and 3) the limitations in the quality of audio data made it more difficult to determine, specifically, the visual and physical behaviour(s) being observed. The subgroup was unable to determine the level of workload using physical cues in 1 recording because it was too dark.

The subgroup noted that having context for viewing a file made it easier to assess level of workload using visual and physical cues. For example, it was of definite assistance if file reviewers were familiar with the crew members being observed and/or with the geographical area where the recording was made.

C.5 Situational awareness

Of the 12 recordings, the subgroup assessed that it was “possible” to identify the level of situational awareness of crew members using auditory cues in 6 recordings (50%). For 4 of these recordings, the subgroup judged this as only “somewhat possible” because the quality of the audio was poor, and because, in 1 case, crew members were not speaking. The limited quality of the audio was the reason why many files were assessed as not allowing the identification of situational awareness using auditory cues.

The subgroup assessed that it was “somewhat possible” to identify elements/indicators of the crew's level of situational awareness using visual cues in 6 recordings (50%). It was noted that 1) it was not always possible to see crew members' eyes because of the angle and position of the on-board cameras, some of which were misaligned, and some of which were aimed at the backs of the crew; 2) having the audio and video data more accurately synchronized would assist with the assessment of situational awareness; 3) it was not possible to use visual cues in cases where the in-cab lighting level was too low (and the infrared light sources were insufficient to adequately brighten the cab to an adequate level); and 4) in those cases when the camera angle captured the crew's eyes, it was not always possible to see (and know) where the eyes were directed.

C.6 Distraction/inattention

For 11 recordings (92%), the subgroup agreed that they could identify crew members engaging in some work- or non–work-related secondary activities. The subgroup was unable to determine activities being performed in 1 recording because it was too dark.

For 6 recordings (50%), the subgroup assessed that it would be “possible” (3 recordings) or ”somewhat possible” (3 recordings) to assess a crew's level of distraction or inattention using audio cues such as speech content. The poor quality of the audio data was cited as the most common reason why it was challenging to determine the level of distraction/inattention using audio cues alone.

For 6 recordings (50%), the subgroup determined that it would be “somewhat possible” to assess a crew's level of distraction or inattention using visual cues such as direction of gaze and visual scanning behaviour. For 11 (92%) recordings, the subgroup thought that it would be “possible” (9 recordings) or “somewhat possible” (2 recordings) to assess a crew's level of distraction or inattention using physical cues such as interaction with devices/equipment. Reasons provided included the following: 1) the camera angles did not always capture the crew members fully, making it difficult know which activities were being undertaken (although the use of audio data to supplement video would help to determine behaviour in cases where the view to an occupant was partially or completely obstructed); 2) it was difficult to see crew members' eye position because the camera installed at the front of the locomotive (facing rearward) was too far away and the video quality too grainy, particularly when light levels were low; and 3) camera angles generally allowed observers to assess what crew members were doing, but the limited resolution of the video did not enable an observer to view activities in enough detail to know conclusively what was taking place.

Technical issues

Most of the technical issues noted with Railway D's voice-and-video recording system related to the playback of the recorded files. For example, for many files, during playback, one or more camera channels would freeze, requiring a restart. As well, in all recordings, the audio playback would regularly stop and start.

In many files, it appeared that not all crew members' voices could be heard on the audio track. It was determined that the reason for this was that the audio playback was not synchronized with the video, in some cases up to 11 seconds' offset. Having the audio and video channels automatically synchronized would likely address this issue.

The quality of the audio data was limited in many of the files, making the sound garbled and, at times, difficult for the subgroup to assess what was being said. At times, the quality of the video data was limited (insufficient resolution) making it difficult to observe and detect detailed crew behaviour.

Appendix H – 2012 locomotive voice and video recorder study conducted by the Advisory Council on Railway Safety

A working group under the Minister of Transport's Advisory Council on Rail Safety (ACRS) was formed in 2012 to review a Transportation Safety Board of Canada (TSB) recommendation regarding the installation of locomotive voice recording in locomotive cabs. The working group included representatives from the railway industry, unions, and Transport Canada. The TSB did not participate in this working group and does not necessarily agree with its analysis and findings. However, elements of its final report are included below in order to provide a more comprehensive picture.

Among the issues reviewed by the working group was an analysis of the costs and benefits associated with such recordings.

Early in its deliberations, the working group concluded that under the current scenario, with only TSB having access to the recorded information, there would be minimal, if any, safety benefit. A more detailed analysis was carried out, however, to better estimate the likely cost–benefit ratio of various scenarios.

The analysis used data from Canadian National (CN) and Canadian Pacific Railway (CP) and looked at 3 scenarios. The review was based on having both voice and video recording, as this was deemed to be of the most value for any of the scenarios. Scenarios involved voice and video data being

• limited to TSB investigations, with no ability for railways to use data for compliance monitoring or discipline purposes;
• used by the railway but only for post-accident/incident purposes; or
• used by the railway on a daily basis as part of random safety and compliance monitoring.

Cost

Based on an installation cost of $10,000 per locomotive, it was estimated that equipping the entire fleet of 2200 CN and CP high-horsepower locomotives would cost approximately $22 million. Maintenance costs were estimated to be in the order of $250–$500 per year for each locomotive, for a total annual cost of $550,000 to $1.1 million. It should be noted that the cost of installation was based on non–crash-hardened systems. One supplier estimated that a crash-hardened system would cost approximately 20% more.

Benefits

Benefits were assumed to be associated with a reduction in rule violations and ultimately in accidents and incidents in which crew inattention may have played a role. A review of 5 years of historical data (2007–2012) determined that, combining CN and CP, there was an average of 146 such occurrences per year. The cost of these occurrences (damage and injury) was estimated to be approximately $6 million per year.

Analysis also indicated that the TSB had investigated only 7 of the occurrences over the 5 years, which represents an average of 1.4 per year or 1% of occurrences.

The working group estimated the potential effectiveness of the 3 scenarios in preventing these occurrences. This was based on best-guess estimates of how often crew inattention was a likely factor, the chance of being observed/discovered, and whether the scenario includes the ability for the railway to use the information for disciplinary purposes. Results were

• Scenario 1 – used for TSB investigations only – 3% effectiveness
• Scenario 2 – used by railway for post-accident/incident purposes – 15% effectiveness
• Scenario 3 – used by railway for random safety and compliance monitoring – 33% effectiveness

Based on this, the accident/injury avoidance savings and overall payback were estimated as follows:

• Scenario 1 – used for TSB investigations only – benefit of $180,000 per year, and payback in 122 years
• Scenario 2 – used by railway for post-accident/incident purposes – benefit of $900,000 per year, and payback in 24.4 years
• Scenario 3 – used by the railway for random safety and compliance monitoring – benefit of $2 million per year, and payback in 11 years

Based on these payback numbers, at the time, the railway representatives on the working group indicated that they could justify the costs of installation only under Scenario 3.

Appendix I – Glossary

ACRS

Advisory Council on Railway Safety

AAR

Association of American Railroads

BLE

Bessemer & Lake Erie Railroad Company

Charter

Canadian Charter of Rights and Freedoms

CIF

common intermediate format

CN

Canadian National

Code

Canada Labour Code

CP

Canadian Pacific Railway

CRM

crew resource management

CTAISB Act

Canadian Transportation Accident Investigation and Safety Board Act

CVR

cockpit voice recorder

DMIR

Duluth, Missabe and Iron Range Railway

EASA

European Aviation Safety Agency

EMSA

European Maritime Safety Agency

ERA

European Union Agency for Railways

EUROCAE

European Organization for Civil Aviation Equipment

FDR

flight data recorder

FPS

frames per second

FRA

Federal Railroad Administration

GPS

global positioning system

HD

high definition

ICAO

International Civil Aviation Organization

IF

infrared

IFD

integrated function display

IMO

International Maritime Organization

ips

images per second

KCS

Kansas City Southern

LDVR

locomotive digital video recorder

LE

locomotive engineer

LED

light-emitting diode

LER

locomotive event recorder

LSI

locomotive system integration

LVVR

locomotive voice and video recorder

MCU

master control unit

MOPS

Minimum Operational Performance Specification

NEMA

National Electrical Manufacturers Association

NTSB

National Transportation Safety Board

NTSC

National Television System Committee

NVR

network video recorder

PIPEDA

Personal Information Protection and Electronic Documents Act

RAC

Railway Association of Canada

RDWG

Recording Devices Working Group

RF

radio frequency

ro-ro or RORO

roll-on/roll-off

RSA

Railway Safety Act

RSAC

Railroad Safety Advisory Committee

RSC

reset safety control

SCADA

supervisory control and data acquisition

SMS

safety management system

SOLAS

International Convention for the Safety of Life at Sea

S-VDR

simplified voyage data recorder

TC

Transport Canada

Teamsters

Teamsters Canada Rail Conference

TIBS

train information braking system

TSB

Transportation Safety Board of Canada

TSI

technical specifications for interoperability

UP

Union Pacific Railroad

U.S.

United States

USB

universal serial bus

VDR

voyage data recorder

VIA

VIA Rail Canada Inc.