Click for next page ( 93


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 92
APPENDIX C Safety Reporting Systems Review of safety reporting systems from other transportation modes and other industries pro- vides models for the development of a safety reporting system for the public transportation industry. This chapter describes the following safety reporting systems: Aviation Safety Reporting System (ASRS) Aviation Safety Action Program (ASAP) Air Traffic Safety Action Program (ATSAP) Confidential Close Call Reporting System (C3RS) Confidential Incident and Analysis Reporting System (CIRAS) Firefighter Near-Miss Reporting System NYCT Near-Miss Reporting System Publicly available documents and interviews with developers and administrators for these systems provided information on the various systems. In addition, the research team reviewed accident/incident reporting forms that provide a means for transit employees to report a near-miss. Aviation Reporting Systems Three different safety reporting systems exist in the aviation industry: ASRS, ASAP, and ATSAP. Each provides a reporting mechanism for a different group of stakeholders or employees. Table 22 summarizes the characteristics of each system. The subsections below describe each one. Aviation Safety Reporting System The need for a safety reporting system in aviation operations was recognized by the military and industry during World War II. However, it was the crash of TWA flight 514 on December 1, 1974, that prompted the creation of ASRS. TWA 514 was en route to Washington National Airport but was redirected to Dulles International due to turbulence and rapidly deteriorating weather conditions. As with all accidents, many factors led to the crash, including confusion regarding instrument approach procedures and poor cockpit communication. As a result, the captain piloted the aircraft below the minimum vectoring altitude and collided with the west slope of Mount Weather, Virginia. Seven crew members and 85 passengers died in the crash. There were no survivors. A similar incident had occurred almost six weeks prior involving a United Airlines flight. The accident and near-miss highlighted the need for an aviation safety reporting system so that problems with the National Airspace System (NAS) could be identified to prevent future accidents. ASRS was begun in 1976, funded by the FAA, and administered by the National Aeronautics and Space Administration (NASA). At the time, this was an innovative program, because it introduced 92

OCR for page 92
Safety Reporting Systems 93 Table 22. Aviation safety reporting systems. Reporting System Aviation Safety Aviation Safety Air Traffic Safety Reporting System Action Program Action Program Feature (ASRS) (ASAP) (ATSAP) Managing organization National Aeronautics FAA, Office of FAA Safety Services and Space Voluntary Safety AJS-1 and CSSI, Administration Reporting, AFS-230 Inc., a private third- (NASA) and the party company Federal Aviation Administration (FAA) Year initiated 1976 1997 2008 Coverage All individuals Airline employees Air traffic control working within the with a Memorandum specialists, both non- National Airspace of Understanding bargaining unit (NAS) involved with (MOU) with the employees and safety-critical FAA bargaining unit operations employees contingent upon a MOU with FAA Annual cost Approximately $3M, Salary cost for 8 Information not of which $2.4 M FAA employees, 5 available comes from FAA and contract personnel the remaining from and office computer NASA costs Staffing Staffing services 8 FAA personnel, 5 FAA oversight provided by Battelle Contract personnel. personnel, CSSI Memorial Institute and Individual Airline personnel and the includes highly Employees regional ERCs experienced pilots, air traffic controllers, mechanics, and human factors analysts. Annual number of Received 45,000 reports Information not reports approximately 49,000 generated in 2008 available in 2009 Report submission Online and written Online, mostly Online paper submission via through WBAT. US Post Option to send copy of report to NASA's ASRS Time limit on 10 days Variable by airline Within 24 hours of submission the incident Implementation issues None discussed Confidentiality, NATCA reported no liability, trust, major issues and protection from commented that the discipline/certificate program was "put action. together well." Air traffic control culture was militaristic and punitive. Program oversight NASA Program FAA Program FAA Program Manager Manager Manager

OCR for page 92
94 Improving Safety-Related Rules Compliance in the Public Transportation Industry a confidential, voluntary safety reporting system for pilots, air traffic controllers, and any other per- sonnel working in safety-critical operations within the NAS. Additionally, it featured what was then referred to as limited immunity from the FAA's disciplinary system of potential fines and certifi- cate action, with certain caveats. The objective of the program was to gather data on violations or flight incidents that may never have surfaced. As this data was reported, general trends and poten- tial safety deficiencies could be uncovered. ASRS has evolved into a highly successful program gen- erating nearly 49,000 safety reports during calendar year 2009. Staffing for the system is made up of highly skilled pilots, air traffic controllers, mechanics, and psychologists knowledgeable in the field of human factors. These employees serve as ana- lysts that review each report as it enters the system. An analyst conducts an initial review, screen- ing the reports for actionable items. If a hazardous situation is identified, a resultant safety alert is issued. The analyst then identifies multiple reports of the same incident and cross-references the related reports. Then the analyst codes the event using the ASRS coding taxonomy. The tax- onomy has a minimal number of error and causal categories. When asked why the ASRS team does not use a more comprehensive taxonomy, the director replied that information may become obscured by an overabundance of categories. The incident narrative, although de-identified, serves to provide additional information when the initial taxonomic categories do not provide sufficient information. After coding an incident, an analyst will clarify (if necessary) any information with the reporter during a callback. After this, the report is de-identified, submitted to a quality check, and entered into the system. All original documentation is destroyed. De-identification is an important part of the process that is more than just removing the names of individuals and locations referenced in the reports. This process requires a trained professional to be able to identify potential con- textual cues in the report that may identify the reporter. As such, de-identification requires intense scrutiny by individuals who can spot potentially identifying information that an untrained indi- vidual might not recognize. The information gleaned from ASRS can be accessed via many different sources. The data are available for public download online as well as through specific search requests submitted to ASRS staff. Many safety researchers use the information from ASRS to conduct archival analyses of safety issues in the NAS. In addition, ASRS staff conducts quick response analyses for govern- ment agencies such as the FAA, NTSB, NASA, and Congress. CALLBACK, a monthly newsletter, provides valuable safety information to pilots and air traffic controllers. Aviation Safety Action Program The next iteration in the development of voluntary safety reporting systems came with the Alti- tude Awareness Program. Prior to this, a group of senior executives from all facets of aviation and the FAA formed the beginnings of what is now the Commercial Aviation Safety Team (CAST), a group that examines all aspects of flight safety from a comprehensive viewpoint. At the time, the most common flight safety issue was altitude deviations. In order to gather more data to deter- mine the causes of these deviations, from a pilot and air traffic control perspective, a program was developed that would gather altitude deviation data from voluntary reporting. Again, limited immunity was given in order to increase the reporting level and data collection. The program became highly successful, generating a large amount of data. In addition, the program also began to take the factual data and from that examine why the deviations were occurring. This reporting program was very successful in reducing altitude violations, because with the data from the confidential voluntary reports, not only what happened but also the ability to see why these deviations happened became possible. In addition, data that ordinarily would never have surfaced with the current inspection systems was collected in great detail. Again, the basic

OCR for page 92
Safety Reporting Systems 95 elements that made the data gathering successful were the voluntary and confidential aspects of the CAST reporting system and the limited immunity from the standard FAA enforcement pro- cedures. Based on the success of the Altitude Awareness Program, the CAST group began to dis- cuss some kind of similar voluntary reporting system that would cover all aviation events. The CAST group envisioned a total reporting system that would include any safety incident or con- cern. The complexity of this, however, would dictate a more formal system for the future. These initial discussions are what eventually led to ASAP. Establishing a formal safety reporting system required a pilot implementation. In the mid- 1990s, the FAA, American Airlines, and the Allied Pilots Association were enthusiastic with the initial intent of the program, especially in light of the successful Altitude Awareness Program. Nonetheless, each party had its own individual concerns with the new system (see Table 23). The pilots' union was concerned with the confidentiality of the reports, as well as protection from discipline by the FAA and airline management. Management voiced concerns regarding liabil- ity for any of the reported incidents, as well as any possible tarnish to their public image. The FAA had concerns regarding how to deal with violations of the FAR, as well as the perception that any immunity from prosecution would be perceived as excessive leniency, since this immu- nity was often referred to as a get out of jail free card. The key concern that affected all of the stakeholders involved trust between each of the three parties. This program was a distinct departure from the punitive system involving any breach of the airline or FAA regulations. As a result, this involved a substantial change in these relation- ships, and was difficult for many of the participants to overcome. In addition, labor found it dif- ficult to believe that the FAA and airline management would really operate differently in this new environment, considering it was such a radical change. Trust among all the parties thus became the overriding concern as the program moved into the test phase. The test phase employed the services of the University of Texas, which had been involved with the design of the program. A pilot implementation with American Airlines led to changes and improvements were made. All parties considered the test phase successful. However, there were still issues to be resolved. Some of the senior FAA personnel and some of its line inspectors were not fully accepting of the program. Senior FAA personnel were not happy with the concept of foregoing enforcement action and particularly the term immunity. Some FAA inspectors, as well as airline pilot management, believed that the program usurped some of their authority. All of these concerns had to be worked out over time, and some elements of them still exist, although today these concerns are pretty well isolated. In terms of administration, a Memorandum of Understanding (MOU) was developed between the FAA and the airline, detailing how the pro- Table 23. ASAP stakeholders concerns. Stakeholder Concerns Labor Confidentiality of the information Protection from discipline by the FAA (fines/certificate action) Protection from discipline by the airline management Airline Management Liability for any reported incidents Public image Federal Aviation Handling an incident that involves a FAR Administration violation Sole source versus non-sole source Appearance of leniency

OCR for page 92
96 Improving Safety-Related Rules Compliance in the Public Transportation Industry gram would be operated. This document was to become the guiding directive on the operation of the program, and is a requirement today for any operational ASAP system. The first ASAP system went into effect in 1997, and over the years the program has continued to experience some changes. The current operation of the system is based on the template MOU that has been worked out over time. In the beginning of the program, the FAA agreed to a tailored MOU to encourage more airlines to participate in the program. As the program expanded and matured, the use of the tailored MOU became unwieldy, especially as the program became more standardized. Today, the FAA insists on the use of the template MOU. Previously, some of these changes were the result of labor's effort to put more immunity into the program. Now the FAA prefers that airlines accept the template MOU and make any changes between the airline and its employees, assuming those changes do not alter the fundamental objectives of the program. As mentioned, the senior level of the FAA was concerned about the term immunity, believing this nomenclature gave the implication of some kind of leniency. The new concept of voluntary reporting, however, was a significant departure from the standard inspection and violation process that was inherent in the original system. To satisfy the FAA, a formal procedure was established within the ASAP system that would categorize how each incident or violation would be handled. Further, the phrase "regulatory incentive" replaced the older term "immunity," and this newer phrase is now found in the current MOU. Also, there is delineation between reports that are considered sole source versus non-sole source. If an incident or violation is sole source, it means that it only surfaced because it was reported voluntarily. If the incident or violation comes to the attention of the FAA or the airline management from another avenue, it is then considered non-sole source and is handled somewhat differently. Each airline's ASAP has an Event Review Committee (ERC), composed of representatives from the FAA, airline management, and airline labor. These committees review all ASAP reports. When a person submits a report, (s)he also has the option to submit a companion report to ASRS. After the ERC receives a voluntary report, the first step is to determine whether or not the report qualifies for the program. While more than 95% of the reports are accepted by the com- mittee, there are five exclusions. These are (1) criminal activity, (2) substance abuse, (3) con- trolled substances, (4) alcohol, and (5) intentional falsification. If the ERC determines that the report does not qualify, the incident or violation in question can then be handled by the FAA and airline management in a disciplinary manner. However, most reports are accepted into the program, and they are then examined in terms of an actual violation or an incident/safety con- cern. The ERC decides action based on consensus, not unanimity. That is, all three parties must agree that the final decision and/or action is something each of them can live with. Historically, violations have made up only about 20% of the reports, so most of the reports do not involve the regulatory incentive part of the program. For those reports that involve an actual violation of the FAR, there is no penalty or discipline given for a sole source report. For a non- sole source report, as long as the report was filed prior to the second source information, the FAA will impose an administrative penalty, such as a letter of admonishment, rather than the stan- dard fine or certificate action. The result of processing the report generates two actions. The first establishes any corrective action or training that may be required. Smaller issues can be completed in approximately 30 days. If the report is determined to be a systemic issue, the period for corrective action could be much longer. The second action involves categorizing the violation/input in accordance with the established taxonomy, and submitting the data to a computerized database for later retrieval. Today, most airlines use the Web-based Access Tool (WBAT) for their ASAP system. Keeping track of self-reported safety incidents allows airlines to compare report frequency and type of report before and after remedial actions, thereby giving them a means to track the

OCR for page 92
Safety Reporting Systems 97 effectiveness of their remediation efforts. This latter approach solves a long-standing problem with reporting systems like ASRS. While ASRS is a valuable data source, it has traditionally been a challenge to take the information from these reports and feed it back into the system with the goal of improving operations. By having each airline responsible for its reporting system, the information source (i.e., safety reports) was closer to operations and could easily be fed back up the operation chain to improve safety. By any measure ASAP is a success story. The FAA estimates that 90 to 95% of the reports are sole source. This is data that would never have surfaced without a voluntary reporting system. With the categorization and analysis of this data, potential incidents as well as systemic problems can be detected before they become an issue. In general, all of the stakeholders, FAA, airline man- agements, and labor groups fully support this voluntary reporting system. Moreover, the shar- ing of this data through the Aviation Safety Information Analysis and Sharing System (ASIAS), the FAA's large-scale data compilation effort, is another step forward in the effort to solve prob- lem areas before they become accidents. In summary, this program is a transition to a prognos- tic and diagnostic safety program, and is a valuable addition to the existing FAA line inspection program that will continue to exist. Today, virtually all pilot groups in the United States have an ASAP program. Additionally, many of the other labor groups, such as airline dispatchers, airline maintenance personnel, and flight attendants have ASAP systems as well. The program works especially well with any labor group that is licensed or subject to the FAR. Air Traffic Safety Action Program In August 2007, the FAA released a call to action to reduce runway incursions. One of the action items that came about involved a renewed interest in developing a reporting system specif- ically for air traffic controllers. While controllers were able to file confidential reports to NASA's ASRS, they were not afforded the same protective provision incentives (i.e., immunity) that pilots benefited from. Because of this, there were significantly fewer reports from controllers in ASRS that could be used to help identify the root causes of operational errors resulting in run- way incursions. Given the success of the ASAP program for airlines and the impetus to reduce runway incursions, the FAA began development efforts for ATSAP. ATSAP began as a demonstration program in March 2008 and underwent review in August 2009 at which time it was judged to be successful and designated a continuing program. As with ASAP, the FAA and labor negotiated an MOU. There were obstacles to implementing ATSAP including the reactive culture of air traffic management. A culture of blame existed in air traffic operations with the mindset that managers must identify those committing errors and punish them without necessarily trying to understand why a controller committed the error in the first place. For this reason, the program was phased in at centers over time due to acceptance issues. The program was fully implemented system-wide in the fall of 2010. The staged implementation included a required 4-hour training program that labor and man- agement had to attend in order to be able to participate in the program. Training was onsite and in-person with both labor and middle management. The training involved explaining the impor- tance of safety culture and the concept of a just culture. The program is modeled after ASAP. However, the immunity portion of the program has wider latitude than that of the ASAP program. Only in the case of egregious violations (e.g., ille- gal acts, acts of sabotage) do protective provision incentives not apply. This is in stark contrast to the way things were prior to the implementation of the program. ATSAP has gone a long way to changing the reporting culture of air traffic in a relatively short period of time.

OCR for page 92
98 Improving Safety-Related Rules Compliance in the Public Transportation Industry As with ASAP, a controller will electronically submit a report in which he or she was directly involved within 24 hours of the incident. A phone message to a hotline can be made to request up to 3 additional days, if additional time is needed. ATSAP interfaces with NASA's ASRS the same way ASAP does, that is, controllers are given the option of checking a box to enable an elec- tronic copy of that report to be submitted to ASRS. The major benefit to this interface is the increase in the number of controller ASRS reports filed to the national database. Prior to adding this option to ATSAP, the percentage of ASRS reports from controllers was about 1%. Post ATSAP, the percentage is now close to 12%. Reporters also have the option to file a report regard- ing general safety concerns (i.e., issues that do not specifically result in an incident but are worth reporting). An analyst reviews the report and then follows up with the reporter to complete any missing information or clarify any vagaries. An ERC is composed of three representatives from the FAA Air Traffic Organization (ATO), the FAA Air Traffic Safety Oversight Service (AOV), and NATCA and they meet weekly to review reports and come to a consensus regarding the best response to the incident based on the root cause. Complete de-identification of the reports is particularly important for this step in the process to ensure that members of the ERC remain objective regarding the review of and response to incident reports. Potential solutions are implemented and tracked to determine their effectiveness. Three ERCs are in operation, one to represent each service area. While every reporter will receive follow-up from the ERC regarding his or her own at-risk behavior, this effort does not disseminate important information to the larger ATC community that might benefit from learning about the information contained in these reports. The ATSAP team releases a weekly briefing sheet and a monthly briefing report describing recent trends in the reporting data. However, data dissemination continues to be an inherent problem in the system. The program guarantees complete confidentiality; therefore, it becomes a challenge to get the word out about particular system problems or even successful solutions to problems. Data dis- semination is an on-going work-in-progress for ATSAP. Trust in a transformational system such as ATSAP is difficult to obtain particularly in a reac- tive and punitive environment such as ATC. Given this limiting factor, the change in reporting culture has been very positive. ERC members and analysts have reported that they are amazed at the amount of information contained in the reports and how useful the reports are. Like the airlines after the implementation of ASAP, air traffic management commented that they cannot imagine a time when this data was not available. NATCA and the FAA plan follow-up visits to facilities to gauge the long-term acceptance of the program. Advice for Transit Industry Regarding Reporting Systems Interviews were conducted with various sized airlines, their labor unions, industry organiza- tions, and the FAA. During these interviews, the parties were asked what they would recommend to a transit agency that would want to initiate a voluntary safety program. The following is a sum- mary of the comments that were offered: The key and overriding issue in the establishment of any voluntary safety reporting system is the establishment of trust among all of the participants. Without mutual trust, a satisfactory reporting system will simply not work. All safety systems need to be supported by the highest levels of management, and re-emphasized at each organizational level. Any voluntary safety reporting system will collapse if employees feel that there is no real commitment to the program from the executive levels, and they will per- ceive that the program is simply a faade or window dressing. Before any voluntary safety reporting system is put into effect, a complete understanding and support for the new system must come from each element that will be involved. All employees

OCR for page 92
Safety Reporting Systems 99 that will come under the new system need to fully understand the program. In addition, employees who are not participants in the new program must feel that the new system is not a threat to them. Proper training is the key to a successful system. Make sure any voluntary reporting system is used only for the purpose that it was intended. Attempts to use the system for other reasons will cause a lack of trust among the employees. Make sure that all the employees who serve on the program oversight committee are thor- oughly trained and support the philosophy of voluntary safety reporting programs. There must be a basic understanding of system hazards from frontline employees. This can be accomplished through a safety reporting system. The industry must have a genuine desire to improve safety and this mindset must be adopted by the organization's safety manager. There has to be an emphasis placed on adopting incentives to be proactive about safety. While sub- jective data, such as that obtained from safety reporting systems, is invaluable, you must look to a variety of subjective as well as objective data (e.g., on board recorders) to tell the whole story. Confidential Close Call Reporting System Table 24 summarizes the features of C3RS, a pilot reporting system for railroad employees. This pilot system is currently under evaluation with four railroads. Background In 2000, FRA's Office of Research and Development (R&D) realized that improvements in safety in the railroad industry would only happen if the safety culture in the industry could improve. R&D sought a way to get both labor and management to talk about the railroad indus- try's safety culture. Exploring the feasibility of a close call or near-miss reporting system was a way to foster the discussion. FRA, working closely with the Volpe Center, invited key represen- Table 24. Confidential Close Call Reporting System. Feature Description Managing organization Federal Railroad Administration, Office of R&D Year initiated 2005 Coverage Employees at selected pilot sites Annual cost $1.6M for implementation and evaluation (Volpe) plus $130K per month for processing reports Staffing Information not available Annual number of reports 1 calls per day with three pilot sites Report submission Paper copy submitted by mail Time limit on submission File within 3 days of event to receive protection from discipline Implementation issues Confidentiality, liability, trust, protection from discipline Program oversight Steering Committee

OCR for page 92
100 Improving Safety-Related Rules Compliance in the Public Transportation Industry tatives from both railroad labor and management to participate on a Planning Committee to explore the feasibility of a voluntary safety reporting system for the railroad industry. The Planning Committee held its first meeting in April 2002. Initially the committee mem- bers were skeptical about the concept of a close call reporting system. They sought a definition for "close call." Volpe Center staff prepared a white paper to meet this need. Ultimately there was total buy-in and the committee took ownership and planned a workshop to bring the issue before the entire industry. An FRA-sponsored workshop on Improving Railroad Safety Through Understanding Close Calls took place on April 2324, 2004, in Baltimore. The purpose of the workshop was to inform the railroad industry of the benefits of understanding close call events and the challenges to implementation and success of a close call reporting system. A close call was defined as "an opportunity to improve safety practices in a situation or incident that has a potential for more serious consequences." The workshop focused on experiences in the U.S. airline industry and the Confidential Incident and Analysis Reporting System (CIRAS) for UK railroads. The out- come of the workshop was that there was unanimous support from both railroad management and labor to proceed with planning a pilot confidential reporting system as a demonstration for U.S. railroads. Designing the System After the workshop, the Planning Committee focused on designing C3RS. Each stakeholder had concerns to be considered (see Table 25). For labor, confidentiality was the top concern. It was also concerned about whether or not an employee who reported a close call incident could later be penalized if data in the locomotive recorder indicated failure to obey an operating rule. Railroad management had liability concerns while the FRA saw a potential conflict with agency regulations. As the group members built trust amongst themselves, they were able to work through all of these concerns. In designing C3RS, staff from the Volpe Center benchmarked other confidential safety report- ing systems then worked with the Planning Committee to create a workable system for the rail- road industry. Volpe considered the CIRAS system in use with UK railroad operators and the ASRS operated by NASA for the aviation industry. CIRAS is funded by the rail operators while a government agency, FAA, pays for ASRS. Confidentiality was such a key concern that FRA and the committee determined that a third party had to collect and protect the data. FRA initially chose to use the Bureau of Transportation Table 25. C3RS stakeholder concerns. Stakeholder Concerns Labor Confidentiality of the information Protection from punishment if employee voluntarily reported incident and locomotive data recorder indicates a rule violation Must all crew members report an incident or does one report cover all present? Railroad Management Federal Employers Liability Act (FELA) liability for consequences of any reported incidents Public image FRA Handling an incident that involves a violation of FRA regulations

OCR for page 92
Safety Reporting Systems 101 Statistics (BTS) for this important role. BTS protects data under the provisions of Confidential Information Protection and Statistical Efficiency Act (CIPSEA). FRA proposed a 5-year pilot implementation of the system at four railroads to validate the concept and to evaluate its effectiveness and function. The Planning Committee worked to develop a model MOU that would be signed by all participating stakeholders at a location that wanted to participate in the C3RS pilot. By March 2005, the model MOU was signed by all stake- holder groups. The model MOU describes the provision of the C3RS Demonstration Project and explains the rights, roles, and responsibility of the participants under the project. Ultimately each site would have to make changes to meet the specific needs of the stakeholders at the specific location. System Operation The first step in initiating C3RS at a railroad is negotiation of an Implementing MOU (IMOU). This can take considerable time as the stakeholders work through their concerns and establish trust that the system will work. After railroad management, the relevant labor union, and FRA negotiate and sign an IMOU, a Peer Review Team (PRT) must be established. The PRT is a local joint labor/management/FRA problem-solving group that will review all the de-identified reports and ultimately recommend corrective action to railroad management. For the pilot implemen- tation, Volpe Center staff have been responsible for training the PRT on team building and root cause problem solving designed for C3RS. The Volpe Center is also responsible for evaluation of the pilot demonstration project. Its eval- uation has several aspects. One is to determine the costs and benefits associated with the project. Another is to document the implementation experiences at each site. Finally, Volpe is monitor- ing the ongoing experiences at each site so as to detect problems and issues before they lead to failure of the project. Employees who see or experience unsafe conditions may submit a written report to BTS. In order to be immune to disciplinary action, the report must be postmarked within 48 hours of the event. If the employee is unable to do this, the employee may notify BTS by phone within 48 hours of the event and have the written report postmarked within 3 calendar days of the call. BTS removes all identifying information, follows up with all employees who submit a report within 2 weeks, and forwards reports back to the PRT of the railroad involved once a month. The PRT meets, usually monthly, to review the reports, establish the root causes, and recommend corrective actions to management. As C3RS moved from the design stage into an operational pilot, the Planning Committee became a Steering Committee that meets periodically via face-to-face meetings and phone con- ferences to review progress. Experience to Date The Union Pacific Railroad's North Platte Service Unit (UP) was the first to become a pilot site. In February 2006, UP initiated a series of activities to build confidence in C3RS among its employees. UP, with guidance from Volpe Center staff, undertook a series of teambuilding activ- ities for its PRT where the group discussed confidentiality of the data, methods for root cause analysis, and other issues. Posters in the crew reporting points announced the system and for a 72-hour period, labor and management representatives went to the crew reporting points to talk about C3RS. Press releases from the Association of the American Railroads (AAR), the Brother- hood of Locomotive Engineers and Trainmen (BLET), and United Transportation Union (UTU) announced the formal rollout of the system in February 2007. There was an immediate response

OCR for page 92
102 Improving Safety-Related Rules Compliance in the Public Transportation Industry from covered UP employees. Employees began submitting reports of incidents as soon as the sys- tem was available. The Canadian Pacific Railroad's Chicago Area Service Unit (CP) was the next to become a pilot participant. It came onboard about a year after UP and in November 2009, New Jersey Transit (NJT) initiated its participation. Amtrak joined in the latter part of 2010. Based on experience to date, FRA reports the following potential impacts of C3RS: Corrective action is being taken on close call events that can have a pronounced impact on safety. The PRT identified processes that merited corrective action, some of which were not identi- fied as key problems prior to implementation of the reporting system. The process of analyzing close call reports identified classes of close calls whose existence were known in a general way and highlighted their importance as systemic issues. C3RS created a new process for communicating about safety-critical information across the railroad. Safety culture may be shifting into a more collaborative mode (FRA 2008). A union representative reported that the program has been very successful to date resulting in a reduction in accidents and injuries, a reduction in discipline, and an improvement in employee/ employer relationships. FRA has decided to explore an alternative model for handling the incident reports to deter- mine if access to the data is easier and if this is a more cost-effective arrangement. This alterna- tive model involves having NASA as the repository for reports from Amtrak. (NASA currently manages ASRS and served as a model for the Firefighter Near-Miss Reporting System.) FRA plans to support each pilot site for 5 years. The source of funding for C3RS after the four pilot sites complete their respective test periods remains to be determined. It is likely that C3RS will migrate to FRA's Risk Reduction Program at that time. Advice to Transit Industry Representatives from FRA and the Volpe Center who have been involved with the design and implementation of the C3RS pilot offered the following advice to the transit industry with regard to establishing a similar system for transit: Put together a committee of leaders from the stakeholder groups in government, labor, and railroad management to design the system. Use this group to assess the feasibility of the pro- posed system with stakeholders. Trust among the stakeholders is critical to implementing the system. Once the system is active, employees need to hear the "lessons learned" from the system. Firefighter Near-Miss Reporting System Table 26 provides a summary of the features of the Firefighter Near-Miss Reporting System. Background In 2000, the former Executive Director of the International Association of Fire Chiefs (IAFC) saw the need for a near-miss reporting system for firefighters involved in structural firefighting. The purpose of the system would be to improve firefighter safety through sharing of experiences. At that time, firefighters involved in wildland fire safety already had SAFENET, a safety reporting

OCR for page 92
Safety Reporting Systems 103 Table 26. Firefighter Near-Miss Reporting System. Feature Description Managing organization International Association of Fire Chiefs (IAFC) Year initiated 2005 Coverage Primarily structural firefighters but some reports from specialty fields such as wildland firefighting, EMS, hazmat, etc. Annual cost $1M (grant from DHS) Fireman's Fund Insurance Company provided matching funds for 20042005 Staffing 1 project manager, 1 administrative support, 8 part- time report reviewers Annual number of reports ~600 1,058 in 2009, probably due to outreach at fire academies Report submission Online but have option to fax or mail Time limit on submission None Implementation issues Confidentiality Program oversight Advisory Board system for wildland fire operations. (SAFENET provides a means for reporting any safety con- cern of wildland firefighters, not just near-misses.) The aftermath of 9/11 delayed progress on the near-miss initiative until 2004 when the Department of Homeland Security (DHS) awarded IAFC a grant under its Assistance to Firefighters Grant Program to develop the near-miss report- ing system. IAFC assembled an informal committee, including representation from the firefighters union, to design and test the new safety reporting system. It became clear early in the process that the system could not be punitive and that ensuring confidentiality was the key to a viable system. IAFC used the SAFENET system and the ASRS as examples of how the reporting system might be designed. Focus groups with firefighters across the country provided a means to gather feed- back on proposed system features and the form that would be used for reporting near-miss inci- dents. The system design drew heavily on NASA's experience with ASRS. A 6-month pilot test at 38 fire departments demonstrated that the system would work. Prior to initial launch of the reporting system website in August 2005, IAFC promoted it through trade publications, a direct mail campaign to 30,000 fire departments, press releases, and a news con- ference at a trade show. The direct mail campaign included a program kit sent to each fire depart- ment following an initial postcard. System Operation Any firefighter may submit a report of a near-miss incident. There is no time limit for submit- ting a report following an incident. Most reports are submitted online but the system offers the option to submit the report via fax or mail. The reporting form asks for a description of the event as well as lessons learned as a result of the incident.

OCR for page 92
104 Improving Safety-Related Rules Compliance in the Public Transportation Industry Every report is reviewed by two independent reviewers to de-identify the information. There are eight reviewers who are active duty firefighters from various locations across the country. The goal is to review each report within 72 hours of submission. Since the reviewer may contact the person who submitted the report, the review process sometimes takes longer. Feedback from firefighters indicates that the personal connection with the reviewer assures the person submit- ting the report that his or her information is important. Additional datapoints are collected on the administrative side of the database during the reviewing process. After the reviewers have ensured that the report contains no identifying information and a reviewer has followed up with the firefighter who submitted the report, it is entered in the database on the National Firefighter Near-Miss Reporting System's web page. Experience to Date Since initiation of the National Firefighter Near-Miss Reporting System in 2005, there have been over 3,900 reports submitted. In 2009, two reviewers trained instructors at selected state fire academies. As a result, the number of reports for 2009 was over 1,000. The case histories are in a searchable database that facilitates searching by topic or situation. State fire academies have used cases from the database to enhance training programs. At the local level, cases have been used for drills. Each week the reviewers select one case as the Report of the Week to feature on the web page and to email to a list of 13,000 individuals. The Report of the Week includes, in addition to the circumstances of the incident, a set of discussion questions so that the case may be used for discussion or training. The IAFC has not yet used the information in the reports to identify trends or underlying problems. There is, however, an ongoing project to identify risks or hazards in the firefighter environment. Confidential Incident Reporting and Analysis System Table 27 describes the features of CIRAS, a safety reporting system for the UK rail industry. Table 27. Confidential Incident Reporting and Analysis System. Feature Description Managing organization Rail Safety and Standards Board Year initiated 1999 Coverage All UK railroad workers, including contractors Annual cost Not available Staffing Not available Annual number of reports 550 Report submission Submit report on form via mail, telephone or text message to CIRAS Time limit on submission None Implementation issues Confidentiality Program oversight Executive Committee

OCR for page 92
Safety Reporting Systems 105 Background After a serious rail accident in November 1999, the UK Rail Industry made a decision to develop a national reporting system for safety-related concerns. The rail regulator mandated that all rail operators make the system available to their employees and that they pay an enrollment fee to participate. An Implementation Group representing all industry stakeholder groups devel- oped the system. As with other reporting systems of this nature, confidentiality of the data was a critical issue. System Operation All UK railway employees as well as infrastructure contractors and subcontractors may report a safety concern to CIRAS. The reporting and follow-up process has four steps: 1. Employee contacts CIRAS by phone or text message, or mails a written statement to CIRAS. 2. A trained CIRAS staff person contacts the employee to discuss the concern. The CIRAS staff person writes a report that will not contain any identifying information. 3. CIRAS sends the report to the relevant company. 4. Company responds to CIRAS and CIRAS sends the response to the employee who reported the concern. CIRAS publishes a bi-monthly newsletter as well as quarterly reports that summarize the reports and responses that were processed that quarter. The newsletter includes selected reports along with the response from the railway operator or contractor. In addition, CIRAS regularly analyzes the reports that it receives to identify possible trends and themes that may be occurring. When such themes are identified, the CIRAS team will thoroughly research the issues and report these back to the industry. For example, in 2006, CIRAS examined precursor conditions that led to signals passed at danger (failure to stop for a red signal). Experience to Date From April 2009 through March 2010, CIRAS received over 550 reports. Of these, 43% led to an investigation or actual change in practices. CIRAS reports that the majority of the companies that it contacts welcome the opportunity to examine the issues that are brought to their atten- tion. These companies recognize that CIRAS can be a vital tool that supports their existing safety management systems. CIRAS provides the means to identify problems before there is an acci- dent or incident and as such supports a proactive safety culture where both managers and their staff feel comfortable reporting what appears to be an unsafe condition. Based on the reports produced to date, it appears that CIRAS is achieving its intended purpose. Sacramento Regional Transit District Table 28 describes the features of the Near Miss Incident Review Program implemented at Sacramento Regional Transit District. Background In July 2008, a Sacramento Regional Transit District (SRTD) light rail train struck and killed a wayside maintenance worker. Investigation of this accident revealed that there were safety risks inherent in the SRTD operating practices. Workers were aware of these risks but were unwilling to report them to management because of concerns related to discipline for reporting a near-

OCR for page 92
106 Improving Safety-Related Rules Compliance in the Public Transportation Industry Table 28. Sacramento Regional Transit Near Miss Incident Review Program. Feature Description Managing organization Sacramento Regional Transit District Year initiated 2010 Coverage Employees or contractors working along ROW with trains or maintenance equipment Annual cost Information not available Staffing Information not available Annual number of reports >20 in first 7 months Report submission Paper copy Time limit on submission None Implementation issues Protection from discipline Program oversight None miss incident. SRTD management believed that knowing about these near-misses was more important that punishing employees so it was willing to establish a near-miss incident reporting system as a non-disciplinary program. SRTD's Near Miss Incident Review Program officially began in March 2010 following a brief pilot test. System Operation SRTD has a simple straight-forward near-miss program. The Departmental Operating Proce- dure states "It is the responsibility of every Light Rail (LR) employee to report areas of concern that occur along the ROW to their immediate supervisor." The supervisor records information about the incident on a 1-page form and forwards it to either the wayside or transportation superintendent. If video data or other vehicle download data is available, the supervisor requests that it be captured for analysis of the incident. LR operations runs the program but the SRTD safety director is consulted on solutions to spe- cific issues. The LR and/or Wayside Superintendent(s) investigate all reported incidents and pro- vide a response to the person who reported the incident. The reports and investigations are reviewed at the monthly Hazard Resolution and Fire/Life Safety Committee meeting along with results of efficiency checks and unusual occurrence reports. In addition, the Chief Operating Officer discusses near-miss reports at the weekly meeting of supervisors. De-identified reports of completed investigations are available to all LR employees so that everyone can learn from the experiences. While a single report will not result in discipline, multiple occurrences by the same individ- ual(s) may result in additional training and/or counseling. Experience to Date As soon as SRTD management initiated the system, employees began to submit reports. Employees have submitted over 20 reports from initiation of the program through October 2010, a period of 7 months. The system was initially designed to report near-miss incidents but employees have also reported concerns with rules. Through this system, management became aware of inconsistencies between practices and the rules. As a result, some rules are being changed. In one

OCR for page 92
Safety Reporting Systems 107 case, an employee concern was due to a lack of understanding of a rule so this became an oppor- tunity for training. A key factor in the success of the SRTD Near-Miss Incident Review program has been man- agement's willingness to abandon the belief that near-misses require discipline. In addition, the process for reporting a concern is straightforward. The continuous filing of reports is an indica- tion that the employees trust the system. The challenge for management will be to maintain employee interest so that concerns continue to be reported. If employees continue to see that there is management response to the reports, this should not be a problem. NYCT Near-Miss Reporting System NYCT has an agency system for reporting near-misses. NYCT defines near-misses as An incident that involves train and/or right of way operations, which did not involve personal injury or dam- age to equipment or property, but could have resulted in death or serious injury. Prior to 2003, there was a process for handling near-miss incident reports at the divisional level, while NYCT's Office of System Safety (OSS) tracked the incidents for the purposes of trend analysis. At that time, it was somewhat of a fledgling system. The operating departments were responsible to investigate near-misses. As part of negotiations with TWU in 2003, labor requested that a formal structured near-miss investigation process be instituted. In 2004, the cur- rent system was put into place. In 2007, after two fatalities within weeks of each other in the track department, OSS began to conduct investigations of significant near-miss incidents and issued its own reports for incidents where employee contact was an issue (e.g., employee could have come in contact with a train or other on-track equipment). As defined in a 2004 NYCT Memorandum, any employee involved in or witnessing a near- miss incident must immediately report it to his/her supervisor. The supervisor of the involved employees must verbally report the incident to the Rapid Transit Operations (RTO) Control Center, the Divisional Chief Officer, and the Office of System Safety. A March 2008 RTO Bul- letin requires that "any employee who witnesses or becomes aware of a near-miss incident must immediately report it to the Rail Control Center." There are posters throughout the transit sys- tem reminding employees of their responsibility to report near-misses. The supervisor in the operating department must initiate an investigation within 24 hours of the incident in order to determine the causative factors related to the incident. Separately, the OSS will investigate those incidents where employee contact issues were involved. Within 30 days of the incident, the supervisor must issue an incident report to the relevant Divisional Chief Officer and also submit a copy to OSS. OSS will issue a separate report on its findings for the cases investigated. Support of the transit agency's executive management, in terms of both budget and safety as a core value, has been key to making this reporting system successful. The number of near-miss reports that involved potential employee contact has dropped from a high of 24 in 2008 to 15 in 2009, 15 in 2010 and for the first two months of 2011, there were two. Other Transit Near-Miss Reporting Mechanisms Many transit agencies provide mechanisms for their employees to report near-misses and unsafe conditions. These mechanisms are typically part of the transit agency's accident/incident reporting system. One large transit agency has a form for reporting "Unsafe Condition or Hazard/ Near-Miss." This form may be submitted anonymously. Another large transit agency has an "Unusual Occurrence" form for its rail operation but the categories on the form do not include

OCR for page 92
108 Improving Safety-Related Rules Compliance in the Public Transportation Industry "near-miss." One large bus transit agency has a form for reporting an occupational illness, injury, or near-miss that could have caused an injury or illness. These latter two forms must be submit- ted to the employee's supervisor so they are not confidential or anonymous. A multimodal tran- sit agency has a very detailed accident report form that includes "near-miss" as an option under "Type of Accident." While many transit agencies do provide a way for employees to report infor- mation about near-miss incidents, the interview process did not identify any agency, other than NYCT and Sacramento Regional Transit District, which has a separate process to identify and investigate near-misses.