Kym Bills B.A. (Hons), B.Ec., B.Litt., M.Sc., M. Min., FCILT, FAIM, FAICD, FRGS, FRAI, MSIA
Executive Director ATSB, 28 October 2005, Keynote speech 10:15 am
[slide 1 ATSB logo]
Chairman (Group Capt Noddy Sawade), Executive Chairman Peter Lloyd, distinguished guests and colleagues
[slide 2 title page]
I was delighted that the Safeskies Conference Board proposed the title for my talk of 'The role of the ATSB in the Systemic Management of Aviation Safety' because there appears to be a persistent level of ignorance, confusion and challenge to the role of the ATSB and like bodies around the world. I believe that there is nothing new in this - it is yet another past lesson that has to be re-learned and re-argued for our contemporary circumstances if we are to make the best possible contribution to future safety.
[slide 3 with modal accident pictures]
As most of you know, the Australian Transport Safety Bureau is Australia's independent no-blame investigation body for the purposes of the Chicago Convention and its Annex 13. The ATSB also has marine and rail investigation responsibilities and a national road safety research, statistics and coordination role.
[slide 4 TSI Act]
The Transport Safety Investigation Act gives the ATSB investigative primacy as necessary after the emergency response. In aviation safety, the ATSB receives about 6000 mandatory reports of accidents and incidents annually. It investigates about 100 of these in some depth - fatal accidents and any accidents involving foreign carriers first, and then other accidents, serious incidents and incidents of the greatest likely safety value, especially those involving fare-paying passengers.
[slide 5 aviation cartoon]
As we all know, aviation safety is a serious business, but with RPT accidents sometimes black humour helps as Gary Larson illustrates
- his caption reads 'Oh great, Now there goes my hat!'
The ATSB also undertakes around 10 aviation safety research projects each year, normally based on occurrence trend data and perceived safety concerns. This research role links to chapter 8 of Annex 13 and reflects the increasing emphasis given to using past data to prevent future accidents.
[slide 6 re safety system]
As you all know, the ATSB's independent investigation and research role is only one part of the total aviation safety system. As the Chicago Convention and other ICAO documentation makes clear, there are also major roles for designers, manufacturers, regulators, aerodrome managers, air traffic controllers, operators, flight crew and maintainers. Systemic management of aviation safety in an environment where discretionary resources are scarce for all players, means all players need to work in partnership and to focus on areas of comparative strength and expertise, and to seek to ensure there are no gaps in the system, and total resources are used to best advantage.
That is one meaning of systemic safety management.
[slide 7 re Reason et al]
Another is the well-known methodology used by the ATSB and sister bodies in investigations that is based on the work of Professor James Reason. This was applied by the ATSB's predecessors from the early 1990s, in particular under the then BASI's leadership by Dr Rob Lee and was mentioned by Deputy Prime Minister Mark Vaile yesterday.
[slide 8 Reason's Swiss cheese]
Here the ATSB's role in larger and more complex investigations is to get behind the surface issues such as unsafe acts and active failures, to also look at latent conditions such as local workplace factors and deeper organisational factors.
[slide 9 Reason's systemic model]
The whole system that may have contributed to the accident or serious incident is investigated and reviewed for safety lessons.
[slide 10 Reason's swamp]
Reason's colourful swamp and mosquito analogy suggests that we may need to drain the swamp to stop mosquitoes breeding that lead to safety weaknesses, as well as bolstering defences. Of course, this is only one of the models used by investigators, and the ATSB is currently refining a preferred new in-house model.
The persistent challenge to the role of no-blame investigation bodies around the world can be traced to several sources. Like many things, most are based on human nature, power and money. To address them, we need to harness the countervailing forces of good ideas and clear reasoning.
It is perhaps self-evident that a systemic investigation that uncovers a government policy decision that was a significant factor in an investigation is unlikely to be welcomed. Noise regulations, airspace change and promotion of commercial factors at the expense of safety are possible areas where this could emerge. Many of you will recall better than me the US experience in removing the FAA's 'dual mandate' after the 1996 Valujet DC9 accident because FAA promotion of low cost operators with outsourced maintenance was perceived to have been at the expense of safety. While good safety often makes good commercial sense, there can be trade-offs.
Similarly, an investigation that finds that a regulator didn't do its job properly in promulgating an important safety rule or ensuring that an operator had a robust maintenance system in place, is unlikely to be welcomed by those responsible. Around the world, regulators are usually much larger and have more bureaucratic clout than investigators and often resent having their apparent failings made public.
Or if an operator is cutting safety corners on training to maintain profitability and this is found to lead to an accident, again this is not likely to make the investigator popular.
No-blame investigation reports do seek to explain what went wrong, how and why so that lessons can be learned, and crew or air traffic controllers who make human errors that appear stupid in hindsight, naturally feel embarrassed.
Over time, all this can lead to pressure to reduce the independence of the investigator, to curb its powers, to mute its reports, or to reduce its budget.
Other sources of challenge sometimes come from the insurance industry, the legal system, grieving families and friends, and from the media. This normally takes two main forms: the desire to blame, prosecute, punish and seek compensation for the death of loved ones; and the belief that only an adversarial legal system can improve safety outcomes.
[slide 11 no blame inquiry]
Of course, investigators argue that future safety, through seeking to make sure an accident doesn't happen again, is even more important for the public good than adversarial legal systems, but in a 'just culture' both systems should operate. The ATSB focus is on the perhaps 90 per cent of occurrences that don't involve culpability. The other 10 per cent may involve separate parallel investigations or in extreme cases of clear criminality such as terrorism, the ATSB may not investigate at all because the event isn't an accident.
[slide 12 Australia's safety record]
Australia has an excellent aviation safety record which is, overall, among the world's best and particularly good with respect to high-capacity jet aircraft. A March 2004 speech by Stuart Matthews, President of the Flight Safety Foundation, with an associated diagram, underlined this point.
[slide 13 FSF map]
I believe this is the result of both good luck and good safety management throughout the system. Certainly there is no room for complacency.
World-wide, the spate of fatal passenger jet accidents this year is likely to be discussed at a special meeting of Directors-General of Civil Aviation at ICAO in Montreal from 20-22 March 2006. I hope that investigator colleagues are invited to provide their insights for future safety.
What then is the role of the safety investigator under international ICAO rules, what has Australia done to implement these rules, and what ATSB enhancements are planned for the future?
Key ICAO provisions include Annex 13 paragraph 3.1 'The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability'; and paragraph 5.4 'The accident investigation authority shall have independence in the conduct of the investigation and have unrestricted authority over its conduct ...'.
Paragraph 5.12 expresses that 'The State conducting the investigation of an accident or incident, shall not make the following records available for purposes other than accident or incident investigation ... all statements taken from persons ... all communications between persons having been involved in the operation of the aircraft; medical or private information ... cockpit voice recordings and transcripts from such recordings; and opinions expressed in the analysis of information ...'. Paragraph 5.12.1 then maintains that 'parts of the records not relevant to the analysis shall not be disclosed'.
ICAO guidance is also provided in Part 1 of the Manual of Aircraft Accident and Incident Investigation which states that: 'The accident investigation authority must be strictly objective and totally impartial and must also be perceived to be so. It should be established in such a way that it can withstand political or other interference or pressure. Many States have achieved this objective by setting up their accident investigation authority as an independent statutory authority or by establishing an accident investigation organization that is separate from the civil aviation administration. In these States, the accident investigation authority reports direct to Congress, Parliament or a ministerial level of government. ... national legislation should specify the procedures to be followed in order to keep the technical investigation separate from judicial or administrative proceedings.'
After almost three years of stakeholder consultation, the Australian Government passed comprehensive new legislation though Parliament, enacting the Transport Safety Investigation Act 2003 and accompanying Regulations. This covers aviation, marine and rail safety investigation as well as mandatory occurrence reporting and pro-active research investigations with a link to past occurrences.
[slide 14 TSI Act key provisions]
As you know, unlike North America, and similar to the United Kingdom, Australia already has separate legal entities regulating aviation safety - CASA - and providing air traffic and other services - Airservices Australia.
The balance struck in Australia's investigation legislation was to make the appointment of the ATSB Executive Director the prerogative of the Secretary of the Department within which the ATSB is based and which reports to the Australian Government and Parliament through its Ministers. All other powers in the 'TSI Act', as it is known, reside in the Executive Director who delegates them to appropriately trained professional investigators.
The one other exception is that the Minister can require in writing that the ED investigates a 'transport safety matter' if the ATSB is not already doing so. The TSI Act otherwise provides that quote 'the Executive Director is not subject to directions from the Minister or the Secretary in respect of the exercise of the Executive Director's powers'. The TSI Act also explicitly provides that 'powers are exercised in a manner that is consistent with Australia's obligations under international agreements' including Annex 13. The Act also places a high premium on cooperation.
But because we need to be able to withstand pressures associated with a major civilian jet disaster, and to enable Annex 13 requirements including the roles of international accredited representatives and advisers, the powers in the TSI Act can seem quite extraordinary.
[slide 15 difficult site control]
They include the ability to: secure an accident site and impose protection orders; enter premises; require written and electronic evidence; require a person to attend before the ED and answer questions; appoint special investigators; and to seek penalties against those who hinder an investigation. All of these powers are to ensure the investigation can be thorough and establish the safety lessons from the 'past' to enhance future safety including through encouraging safety action and, if necessary, making safety recommendations.
The quid pro quo for these powers, is that there are very tight restrictions on the release of evidence gathered by an ATSB investigation. ATSB draft reports cannot be used by any court and ATSB final reports can only be used in Coronial inquests. There are strict prohibitions on the release of CVR and 'restricted information' such as ATC data unrelated to the occurrence, and witness statements. While this addresses the use of investigator reports in the criminalisation of safety problem that Ken Smart raised yesterday, it can sometimes make the ATSB subject to criticism that it is 'secretive', or is 'frustrating legal processes', or is 'a law unto itself'.
These charges are often difficult to rebut and, of course, the ATSB can make mistakes like any other body. So, what is our response?
[slide 16 TSI Diploma]
The main 'systemic' response mechanisms are to ensure that well qualified and well suited investigators are recruited, that they are given sound training and mentoring, that investigation processes are robust, that the ATSB has a culture of learning and openness to change, and that if significant new evidence arises, the ATSB swallows its collective pride and releases a revised report.
Recruitment is a real art and is also subject to market forces. We rely heavily on experts seeking second (lower paid) careers. As regards investigator training and mentoring, I think the ATSB exemplifies best practice with its competency-based Diploma of Transport Safety Investigation and dedicated training manager.
Like other investigators, our processes typically involve multi-disciplinary teams and both peer and hierarchical review of draft reports. Draft reports are provided externally to 'directly involved parties' for review and comment and a further round of internal review and checking occurs before reports are published on the ATSB website where they have full industry and public scrutiny.
The ATSB also answers questions posed by its Minister and Departmental Executive and appears before Senate Committees several times a year as well as ad hoc other audit, Parliamentary, and Ombudsman inquiries. In the event of a Commonwealth Royal Commission, the ATSB would be required to assist and provide evidence.
A further layer of overview for fatal accidents arises in the course of Coronial inquests and this can lead to a lot of legal scrutiny of the ATSB.
[slide 17 legal cartoon picture]
This can be either fair or involve 'fishing' and 'positioning' for the benefit of clients' future legal processes. After my somewhat negative remarks at Safeskies 2003, I am very pleased to note that the ATSB's relationship with Coroners around the country is very sound. We have an excellent working relationship in which we each respect the independence and role of the other. The ATSB takes the lead on the technical investigation while the Coroner supervises the pathology testing. In many cases the ATSB report is simply adopted by Coroners but, where appropriate, an inquest is held.
Another check of ATSB processes occurs through the ICAO universal safety audit program which now includes Annex 13. Based on Ken Smart's AAIB example, I sought an audit of the ATSB's compliance with Annex 13. ICAO's October 2004 report on the results of the audit are posted in full on the ATSB website.
I should also mention the importance of ASASI and ISASI for our aviation investigators together with the Flight Safety Foundation and other bodies who contribute so much to enhancing and disseminating best practice.
[slide 18 ITSA 2004 picture]
I have found sharing experience at a management level through ITSA, the International Transportation Safety Association, to be of great benefit and will be honoured to take over as chair of ITSA from the Chairman of the NTSB next March and to host the next ITSA meeting in Canberra from 14 to 17 March.
Of course, I would be delighted to take you through some of the ATSB's major investigation and research reports since Safeskies 2003, which demonstrate how we undertake our systemic safety role and seek to draw future lessons from individual past events and occurrence trends.
But I have been asked to, as far as possible, deliver new material that is not available on the internet - and you know that all ATSB reports are available at www.atsb.gov.au
I know many of you would like to know our pending conclusions on the tragic Benalla, Lockhart River and Mount Hotham fatal accidents which together led to 24 fatalities, with the 15 deaths at Lockhart River in a Metroliner last May our worst civil aviation accident since 1968.
[slide 19 Lockhart River picture]
While the TSI Act inhibits such comment, the three accidents share a common feature of crews reporting commencing or conducting Global Navigation Satellite System approaches, often termed GPS (Global Positioning System) and the ATSB is examining GNSS/GPS instrument approaches as part of these investigations.
But to date, there is no evidence to suggest that the circumstances that contributed to these accidents are linked. Our preliminary factual report on Mt Hotham clearly points to other causal factors. In addition to the accident investigations, the ATSB has commenced a research study to examine pilot perceptions about GNSS approaches and will be surveying selected IFR rated Australian pilots quite soon. Irrespective of the final accident investigation findings, I fear that safety issues involving GPS units are likely to grow in importance. The ATSB is also seeking to follow the French BEA's lead and improve its capabilities in recovering data from damaged GPS and other chips.
[slide 20 research investigation]
Regarding research, those of you with an interest in GA, may wish to consult the ATSB's research paper which reviewed 10 years of data on what is killing GA pilots. As expected, exposure weighted risks were higher for younger, less experienced pilots and some of you may have expected the jump in risk for pilots from age 65. However, the relatively high risk in the 45-54 age group that we found appears to be linked to weekend flying including professionals like doctors and lawyers flying fatigued at the end of a long week. About 30 per cent of the 215 fatal GA accidents involved controlled flight into terrain (CFIT).
A good summary of all of the ATSB's recent and current safety publications is provided in the ATSB Annual Review 2005 which is being released today and will be available to you all at morning tea time or when you have a moment to visit the ATSB display.
[slide 21 ATSB Annual Review 2005]
What of the future?
First, I wish to thank the Executive Chairman of Safeskies, Peter Lloyd, for his tremendous support for the ATSB over the years. Among his closing remarks at the end of Safeskies 2003 was a plea for better funding for the ATSB and the hope that it would therefore be possible to reinstitute a confidential reporting system to supplement mandatory reporting. I didn't put him up to either comment!
I want to acknowledge that the ATSB's budget was boosted by the Australian Government's decision in the May 2004 Federal Budget to provide substantial additional funding for investigations and to replace our ailing decade-old aviation occurrence database.
This funding has enabled an additional 40 smaller investigations to be initiated each year to the total of about 100. The new database and investigation tool to be called 'SIIMS' (Safety Investigation Information Management System) should be up and running by the end of 2006. It is a massive project that has involved widespread collaboration, including with Canada's Transportation Safety Board, and should provide further rigour in risk assessment and documentation for all investigations.
Our Minister has also agreed to a new legal framework to establish a confidential reporting system to complement mandatory reporting and the Government's Aviation Self-Reporting Scheme (ASRS). I hope that draft 'REPCON' - short for Report Confidentially - regulations will be able to be finalised by the end of this year.
A consultation draft is available on the ATSB website. The generic REPCON name was chosen to allow for future multi-modal application. We were also pleased to receive Ministerial approval to fine-tune our TSI Act and Regulations and are seeking drafting priority. This includes the possibility of a public hearing mechanism.
The ATSB has had a research team working to apply the 'HFACS' (Human Factors Analysis and Classification System) methodology to historical Australian aviation occurrence data in order to compare safety trends, issues (and lessons) with those in North America. I am hopeful that this will provide outputs that can reinforce safety lessons as well as providing a helpful check for the structure of SIIMS. We have also been supportive of an ASFA project to review safety lessons from insurance data.
In June this year, then Minister Anderson announced a grant of $250,000 to the Guild of Air Pilots and Air Navigators (GAPAN) in Australia to promulgate to pilots around Australia the lessons from Line Operations Safety Audit (LOSA) threat and error management. The funds would otherwise have been unspent for aviation safety purposes and I hope will not only improve safety education but also facilitate the ATSB's access to the de-identified world-wide LOSA database. Senior GAPAN representatives involved include Stephen Ingham, Patrick Murray and Mick Toller.
As you would know, LOSA is supported by ICAO, IATA and IFALPA and involves experienced commercial pilot-auditors observing actual performance in the cockpit and noting particularly what is done well, in addition to what is done poorly. I see LOSA data on threats and errors as potentially complementing investigation reports that consider the whole system. If an error is common internationally on a particular aircraft type and the same error is involved in an Australian occurrence, this data could reinforce that it was not just a mistake by an individual. Conversely, better practice on an aircraft type identified through LOSA could be drawn upon in assessing desirable safety action after an occurrence that may not involve an expensive technical 'fix'.
In conclusion, let me commend the Safeskies 2005 organisers on an excellent program and for providing me with the opportunity to remind colleagues of the importance of safety investigation and research in learning lessons for future safety.
[slide 22 repetitive accidents]
Despite the many safety improvements that have been made, I know we are all frustrated by the number of repeat occurrences such as approach and landing accidents including CFIT, VFR flights into IFR weather conditions, runway incursions, helicopters hitting powerlines, and fuel exhaustion and starvation, especially where these lead to fatalities and serious injuries.
It is not sufficient to just keep doing the same old things. Increasingly, collaboration, partnerships, education and better publicity will be crucial to further gains to complement improved technology, risk management, analysis, and safety culture.
In this, a holistic and systemic management approach to aviation safety is crucial. I would argue, and am confident that it would be strongly supported by my colleagues, that in this holistic system a central player should continue to be a properly-resourced, independent and professional no-blame investigator like the ATSB.
So, let me return to my Safeskies title, 'The role of the ATSB in the Systemic Management of Aviation Safety'. I have particularly highlighted that the ATSB is one key part of the safety management system itself; and that the ATSB uses a systemic methodology and management approach for its more complex investigations and research and must do so in order to produce robust outcomes.
In both roles we need to remember and draw upon past lessons to advance future safety.
[slide 23 with modal pictures]
Thank you for your courteous attention.
[slide 24 final slide ATSB logo]