Railway Investigation Report R10V0038

• Table of contents

  1. Factual information
  2. Analysis
  3. Findings
  4. Safety action
  5. Appendices

Summary

On 03 March 2010 at about 1410 Pacific Standard Time, Canadian Pacific Railway Train 300-02 operating eastward on the north track of the Mountain Subdivision approaching KC Junction, British Columbia, side collided with westward Canadian Pacific Railway Train 671-037 that was departing Golden from the north track through the crossovers onto the south track. As a result of the collision, 3 locomotives and 26 cars derailed. The crew on Train 300-02 were transported to hospital for observation. The locomotive engineer was later air-lifted to a Calgary hospital in serious condition.

Ce rapport est également disponible en français.

Factual information

The accident

On 03 March 2010, eastward Canadian Pacific Railway (CP) train 300-02 (train 300) was comprised of 2 head-end locomotives hauling 112 empty hopper cars. The train weighed 3475 tons and was 6756 feet in length. Westward train 671-037 (train 671) comprised 2 head-end locomotives, a mid-train locomotive and a tail-end locomotive hauling 142 loaded cars of potash. The train weighed 20 287 tons and was 6967 feet in length.

At about 1410,^{Footnote 1} train 300 was lined to controlled block signal^{Footnote 2} 370N at KC Junction (Mile 37) on the north main track of the Mountain Subdivision (see Figure 1). The Centralized Traffic Control (CTC) system had set signal 370N to display a "Stop" indication. Westward train 671 had just finished fuelling on the north main track at Golden (Mile 36) and was departing through the crossover to the south main track. Train 300 was scheduled to stop for fuel at Golden after train 671 cleared the north main track. At this location, it was common practice to fuel locomotives from the north main track. The crew on train 300 did not have a train line-up^{Footnote 3} and were not aware that train 671 had fuelled in Golden and was crossing over at KC Junction to continue westward on the south main track.

As train 300 passed the hot box detector (HBD) at Mile 44.9, the signal maintainer monitoring the recently installed detector indicated to the crew that it was not yet in service. The signal maintainer instructed the crew to disregard the HBD transmission given at that location. It had not yet been determined when the new HBD would be placed into service so there was no general bulletin order (GBO) issued to crews concerning its use.

Shortly thereafter, the signal maintainer contacted train 300 again and advised the crew that there was a report of hot wheels on their train. During this discussion, the crew correctly identified the advanced signal to KC Junction (signal 386N), a "Clear to Stop" indication (Canadian Rail Operating Rules [CROR] Rule 411). Also during this discussion, train 300 passed the in-service HBD at Mile 39.3 and received an audible message indicating that there were no alarms. During that transmission, train 300 also passed the advance signal to KC Junction.

Locomotive event recorder (LER) information indicates that train speed was maintained at 45 mph when passing the advance and intermediate signals and approaching the "Stop" indication at signal 370N. There was an unobstructed view of signal 370N of about 3900 feet. The conductor did not question the locomotive engineer's train handling in response to signal 386N. The crew observed the Stop signal and noted that train 671 was operating through the crossovers from the north track to the south track. An operator-initiated emergency brake application was made at 1409:26, when the train was about 422 feet west of the stop signal. Train 300 continued past signal 370N at "Stop" and, while travelling at about 27 mph, collided into the side of train 671 (see Figure 2). Train 671 was travelling at 29 mph when it was struck. Train 300's crew broadcasted the emergency after the collision.

Train 300's lead locomotive and second locomotive (8874 and 8579) along with 3 empty hopper cars derailed. Train 671's mid-train locomotive (8628) and 23 loaded potash cars derailed (see Photo 1). Six additional loaded potash cars from train 671 were damaged but did not derail. A punctured 4500 litre propane tank used to fuel a switch heater at the crossover caused a fire resulting in a nearby tool/storage shed being destroyed. The propane tank was situated within 15 feet of the track. The railway right-of-way at that location was about 100 feet wide. Several nearby residences and businesses were evacuated.

There was no diesel fuel released from locomotive 8874. However, approximately 3260 gallons of diesel fuel were released from locomotive 8579, of which about 260 gallons were recovered. About 22 gallons of diesel fuel were released from locomotive 8628, none of which was recovered.

Approximately 85 tonnes of soil impacted with hydrocarbons were excavated from the south side right-of-way and transported to a local landfill for disposal. Reclamation activities on the north side right-of-way continued into spring 2011 to remove the hydrocarbon-impacted soil.

Two thousand six hundred ten tonnes of potash spilled; 1970 tonnes were recovered and 1457 tonnes of soil/potash were disposed of.

The crew on train 300 were taken to a hospital in Golden, BC for observation. After arriving at hospital, the locomotive engineer lost consciousness. He was transported to hospital in Calgary, Alberta by air ambulance and released 2 days later.

Weather information

At the time of the occurrence, the weather was clear. Winds were from the south at 7 km/h and the temperature was 4°C.

Crew information

The crew of train 300, a locomotive engineer and a conductor, commenced duty at 1000 on 03 March 2010 at Revelstoke, BC, Mile 125.7 of the Mountain Subdivision. The crew of train 671, a locomotive engineer and a conductor, commenced duty at 1030 on 03 March 2010, at Field, BC, Mile 0.0 of the Mountain Subdivision.

All crew members were qualified for their respective positions and met company and regulatory fitness and rest standards.

Recorded Information

The lead locomotive of train 300 had been equipped with a LocoCAM.^{Footnote 4} A review of the video footage from this camera confirmed the following sequence of signal indications (see Figure 3):

• An Advance Clear to Stop indication at signal 404N (i.e., the intermediate signal preceding the advance signal to KC Junction).
• A Clear to Stop indication at signal 386N (i.e., the advance^{Footnote 5} signal to KC Junction).
• A Stop indication was displayed on signal 370N, (i.e., the controlled signal governing eastbound movements on the north track, at KC Junction).

The lead locomotive of train 671 was also equipped with a LocoCAM. A review of the video footage from this camera confirmed the following signal indication (see Figure 3):

• Medium to Medium Signal indication at signal 367N (i.e., the controlled signal governing westward movements through the controlled location^{Footnote 6} at KC Junction).

A review of the railway signal logs confirmed that there was a proper progression of signals and that there were no discrepancies with the functioning of the signal system.

Railway and regulatory requirements at signals

The CROR indicate:

CROR Rule 415 – Advance Clear to Stop Signal specifies the following:

Proceed, next signal is displaying Clear to Stop, be prepared to stop at second signal.

CROR Rule 411- Clear to Stop Signal specifies the following:

Proceed, preparing to stop at the next signal.

CROR Rule 439 - Stop Signal specifies the following:

Stop.

CROR Rule 424 – Medium to Medium Signal, specifies the following:

Proceed, Medium speed passing signal and through turnouts, approaching next signal at Medium speed. *Medium speed is a speed not exceeding 30 mph.

CROR Rule 34 – Fixed Signal Recognition and Compliance, paragraph (a) specifies (in part):

The crew on the controlling engine of any movement and snow plow foreman must know the indication of each fixed signal… before passing it.

CROR Rule 34 – Fixed Signal Recognition and Compliance, paragraph (b) specifies (in part):

Crew members within physical hearing range must communicate to each other, in a clear and audible manner, the indication by name, of each fixed signal they are required to identify. Each signal affecting their movement must be called out as soon as it is positively identified, but crew members must watch for and promptly communicate and act on any change of indication which may occur.

CP's BC Interior Service Area Revelstoke Summary Bulletin No. RSB: 04-09 states (in part):

On Shuswap and Mountain Subdivisions, all controlled block signals and their advance signals must be voiced over the standby radio channel. The broadcast must include: the train designation and the name of the advance signal to the controlled location; and the train designation and the name of the signal at each controlled location.

Crew response to signals

The indication of the signal 404N and the advance signal to KC Junction (signal 386N) were communicated by train 300's crew within the locomotive cab and over the radio. The crew identified them appropriately as Advance Clear to Stop and Clear to Stop. The indication of the controlled block signal at KC Junction signal 370N, was a Stop signal. This signal was not called in the cab or over the radio.

The indication of the controlled signal at KC Junction for westward train 671 on the south track (from signal 367N) was a Medium to Medium indication. It was communicated by trainn 671's crew within the locomotive cab and was broadcasted over the standby channel using the handheld portable radio. Train 300's crew did not hear this transmission. Subdivision and Track Information

The Mountain Subdivision is comprised of single and double main track that extends between Field and Revelstoke. Train movements are governed by the Centralized Traffic Control (CTC) method of train control, as authorized by CROR, and are supervised by a Rail Traffic Controller (RTC) located in Calgary, Alberta.

In the vicinity of Golden, the subdivision consisted of double main track oriented in an east-west direction, descending 0.3% to the east. Both tracks were classified as Class 3 track according to the Railway Track Safety Rules (TSR). The maximum authorized timetable speed was 50 mph for freight trains. The rail was 136 pound continuous welded rail and the ballast consisted of crushed rock to an average depth of 8 inches. The cribs were full and the shoulders extended approximately 18 inches beyond the tie ends. No significant track defects were noted in the last inspection conducted on 03 March 2010. The track was considered to be in good condition.

Centralized traffic control

CTC employs interconnected track circuits and signals in the field to control movements. Computer displays and controls are installed in the RTC office. Signals are actuated by the presence of a movement. Signal indications convey information to train crews that indicate the speed at which they may operate and how far they are permitted to travel. In addition, signal indications provide protection against certain conditions, including if the block^{Footnote 7} ahead is occupied, a rail is broken, or a switch is left open.

Crews must be familiar with the signal indications specified in CROR, and are required to control their trains in accordance with these rules. CTC does not provide automatic enforcement to slow or stop a train before it passes a Stop signal or other point of restriction.

In the RTC office, track occupancy is displayed on the RTC's computer screen. Track occupancy normally indicates the presence of a train, but can also be an indication of an interrupted track circuit (e.g., a broken rail or a switch left open). The RTC can control certain signals (controlled signals) and either set them to a Stop indication or request that they display permissive indications. When an RTC requests signals for trains, the signal system determines how permissive the signals will be based on the presence of other track occupancies and how many consecutive signals have been requested. On the day of the accident, the RTC authorized train 300 on the north track up to signal 370N at KC Junction. Train 671 was lined westward at signal 367N to depart KC Junction through the crossovers from the north to the south main track.

Cab-signalling systems

Cab-signalling is a railway safety system that communicates signal indications to a display device mounted inside the cab of a locomotive (see Photo 2). The simplest systems display the wayside signal indication while more advanced systems also display maximum permissible speeds. These systems can be combined with a train protection system to warn of proximity to points of restriction and to initiate enforcement action to slow or stop a train.^{Footnote 8} Cab signals can reduce the risk of signal recognition errors.

In 1922, the United States (US) Interstate Commerce Commission made a ruling that required US railroads to install some form of automatic train control in one full passenger division by 1925. In response to this ruling, the first cab-signalling systems were developed and put into use in the US.^{Footnote 9}

Cab-signalling systems have evolved and can now be combined with train protection systems. These systems remain in use in some US passenger train corridors. In Canada, there are currently no cab-signalling systems in use by freight or passenger railways.

Positive train control

Positive Train Control (PTC) refers to a developing train control technology that can prevent some types of train collisions by positively enforcing points of restrictions. For example, train crews would be alerted to potentially dangerous situations such as approaching a Stop signal too quickly. If an adequate response is not initiated by the crew, PTC will automatically slow or stop the train.

On 12 September 2008, there was a collision between a Metrolink passenger train and a Union Pacific freight train in California, resulting in 25 fatalities and more than 135 serious injuries. This accident prompted the passage of the Rail Safety Improvement Act of 2008 which mandates that PTC be installed by 2015 on all railroad corridors on which passengers or hazardous materials are transported in that country.

The TSB has noted the potential value of positive enforcement associated with PTC in a number of recent investigations including R07E0129, R08W0058, R09W0118, R09V0230.

In Canada, subsequent to the 1996 collision on Quebec North Shore and Labrador Railway (TSB Report R96Q0050), a proximity detection device (PDD) was developed and put into use. The PDD can trigger penalty braking^{Footnote 10} for a movement when a train crew or track unit operator does not acknowledge the alert warning status when approaching a predetermined distance from other movements. However, no similar systems, except for limited trials, have been implemented on other Canadian railways.

Other Relevant Occurrences

During the investigation into a train collision involving two CP trains near Notch Hill, BC (TSB File No. R98V0148), the Board determined that backup safety defences for signal indications were inadequate and distraction due to noise significantly impacted the communication of safety-critical information between crew members in the locomotive cab. The Board recommended that:

Between 2007 and February 2010, there were four other occurrences in CTC territory^{Footnote 11} in which signal identification and response were determined to be contributing elements in the accident (see Appendix A).

Situational Awareness and Mental Models during Train Operations

Situational awareness (SA) in relation to operational matters refers to the operator knowing what is happening in the immediate environment. There are 3 levels of SA.^{Footnote 12}

• Perception refers to the recognition that new cues exist. Some cues are clear; others are ambiguous.
• Comprehension refers to understanding the order of importance of the new cues.
• Projection refers to the ability to forecast future events based on information given.

A train crew's SA may come from various information sources. These can include radio transmissions (e.g., crew-to-crew conversations and messages received from wayside inspection systems). Other information sources can include:

• signal indications;
• RTC radio transmitted instructions;
• in-cab displays;
• observation of the track;
• environmental conditions;
• sounds from the environment (e.g., noise from other trains); and
• written information (e.g., operating authorities, bulletins, rules, GOI ).

When operating a train, decisions and actions greatly depend on the crew's assessment and understanding of train operations and its ability to select the appropriate course of action based on SA. The overall understanding of a situation is based on experience and knowledge of how something works, resulting in a mental model. If cues are not clear, more effort is required to accurately assess a situation.

It is difficult to alter a mental model once developed, particularly in a short period of time. To change one's thinking, the existing model must be superseded by another model, with the new information being sufficiently compelling:

Good SA is highly dependent on switching attention between different information sources. Unfortunately, people often can get trapped in a phenomenon called attention narrowing or tunnelling. When succumbing to tunnelling, they lock in on certain aspects or features of the environment they are trying to process, and will either intentionally or inadvertently drop their scanning behaviour. In this case, their SA may be very good on the part to the environment they are concentrating on, but will quickly become outdated on the aspects they have stopped attending to.

In many cases, people will believe that this limited focus is sufficient, because the aspect of the situation they are attending to is most important in their minds. In other cases, they simply fixate on certain information and forget to reinstate their information scan. Either situation can result in a critical loss of SA. The reality is that keeping at least a high-level understanding of what is happening across the board is a prerequisite to being able to know that certain factors are indeed still more important than others. Otherwise it is often the neglected aspects of the situation that prove to be the fatal factors in loss of SA.^{Footnote 13}

Hot box detector information

Typical HBD information provided by an automated broadcast on the appropriate train standby channel includes:

• mileage and subdivision of the detector;
• ambient temperature;
• total axles on the train; and
• whether or not there are any alarms.

The broadcast is then repeated and the transmission ends with "message complete, detector out." The two broadcasts combined typically take about 36 seconds. CP typically locates HBD systems close to designated sidings where yard or other tracks are also identified as HBD setoff points. Damaged or defective rolling stock identified through HBD inspections can then be set out at these locations for repair. Designated sidings are frequently used for meeting or passing trains.

On the day of the accident, a new HBD system at Mile 44.9 was being monitored by a signal maintainer. CP's Standard Practice Circular (SPC) Signals and Communications (S&C) No. 2 states (in part):

…calibration and testing of an HBD is required to be conducted prior to placing it in service.

Additionally, CP's unwritten protocol requires that a GBO be issued advising train crews that a new HBD is in service and to abide by alarms received. On the day of the accident, the new HBD was not yet in service.

During the investigation into the collision involving two CP trains at Redgrave, BC on 30 October 2009 (TSB File No. R09V0230), the Board made the following finding:

When hot box detector (HBD) broadcasts are received, they require crew attention at locations in which distraction can potentially lead to the misidentification of signals or can preclude crews from announcing signals. As a result, there is some risk that signal recognition errors will occur and go uncorrected, leading to unauthorized movements.

Use of personal electronic devices during train operations

The crew on train 300 conducted numerous cellular telephone communications (voice and text) in the 3 hour period prior to the accident. While engaged in these communications, the crew operated the train and performed various safety-critical tasks (e.g., negotiating public crossings, passing slide detectors, complying with temporary and permanent slow orders, analyzing hot box detector broadcasts, identifying and responding to wayside signals). The last communication prior to the accident was completed about 1 minute before receiving the first radio transmission from the signal maintainer concerning the status of the new HBD at Mile 44.9.

CROR General Rule A states (in part):

Every employee in any service connected with movements, handling of main track switches, all switches equipped with a lock and protection of track work and track units shall:

11. While on duty, not engage in non-railway activities which may in anyway distract their attention from the full performance of their duties.
12. The use of communication devices must be restricted to matters pertaining to railway operations. Cellular telephones must not be used when normal railway radio communications are available. When cellular telephones are used in lieu of radio all applicable radio rules must be complied with.

Effective November 2008, revised System Special Instructions (SSI) to CROR General Rule A (xii) stated:

Personal electronic or electrical devices.

Except as provided for below, employees are prohibited from using all such devices; they must be turned off and any ear pieces removed. (Not applicable to medical devices such as hearing aids, etc.).

Railway provided electronic devices.

Note: The terms electronic or electrical devices do not apply to devices used for, and directly relating to, safe railway operations; e.g.: railway radios, remote switches etc.

1. The employee controlling the engine or track unit is prohibited from using such devices:
   1. when in motion or
   2. when any employee is on the equipment or track unit, outside the cab, or on the ground for related work activities.
2. Other employees may use such devices when:
   1. inside the cab while in motion, only after all crew members or operator of the track unit, agree it is safe to do so;
   2. outside the cab only if:
      • the employee is not foul of a track;
      • the employee is not engaged in physical work-related activities; and
      • all crew members or operator of the track unit, confirm that operation will remain suspended until advised otherwise.

In all cases stated above, cellular telephones (personal or railway provided) may be used during emergencies or in lieu of radio during radio failure.

On 13 June 2003, with the release of its findings into an accident near Clarendon, Texas on 28 May 2002, the US National Transportation Safety Board issued Safety Recommendation R-03-1 urging the US Federal Railroad Administration (FRA) to promulgate regulations that would control the use of cellular telephones and similar wireless communication devices by railroad operating employees while on duty so that such use does not affect operational safety.

Subsequent to the 12 September 2008 collision between a Metrolink passenger train and a Union Pacific freight train in California that claimed the lives of 25 people, the FRA took regulatory action to impose restrictions on the use of cellular telephones and other distracting electronic and electrical devices by on-duty railroad operating employees.

Apart from what is listed in CROR General Rule A, there have been no similar restrictions on the use of personal electronic devices by Transport Canada.

Cellular phone use by vehicle drivers

Research on the effects of the use of hand held devices on vehicle driver performance determined that:

• Use of cell phones (voice communication) while driving increases reaction times, causes failures to detect hazards, and to have more variability in lane position. A driver's use of cell phones up to 10 minutes before a crash, or at the time of a collision, was found to be associated with a fourfold increased likelihood of being involved in a crash.^{Footnote 14}
• Text messaging has similar effects on driving performance. Text messaging caused a 400% increase in time looking away from the road as compared to driving without text messaging.^{Footnote 15}

Drug and alcohol testing

During the accident, both crew members of train 300 sustained minor injuries, but were able to exit the locomotive unaided. At 1650, the crew members were transported to Golden Hospital for observation. At approximately 2040, after being released from the hospital, the conductor provided a sample for alcohol and drug testing. No trace of alcohol or controlled substances was detected.

The locomotive engineer was very concerned that traces of marijuana may be found in his urine. From the time of the accident until he was admitted to the hospital in Golden, he consumed approximately 10 litres of water in an effort the flush any traces of marijuana from his system. This caused hyponetremia (i.e., water intoxication) and at approximately 1950, the locomotive engineer lost consciousness and was immediately air-lifted to Calgary Foothills Hospital for further care and observation. At approximately 0130 the following day, the locomotive engineer was tested for drugs. The results for the urine cannabinoid screen were "Below Cut Off" at 50 ng/ml, but these results were unconfirmed.

CP (Canada)'s Fitness to Work Medical Policy for Safety Critical and Safety Sensitive Positions dated January 2005 states (in part):

…train crews are considered safety critical positions, and impaired performance could result in a significant incident affecting the health and safety of employees, customers, customers' employees, the public, property or the environment.

There is no Canadian regulation requiring employees to submit to toxicological testing. However, railway companies may require such testing as a condition of employment. In the United States, all railroad employees directly involved in an accident must provide blood and urine samples for testing, as required by regulations.

CP uses a third party company under contract to perform drug and alcohol testing. This company follows the regulations provided by the U.S. Department of Transportation. Rule 49, CFR Part 40 procedures require that testing for alcohol be conducted within 8 hours and testing for drugs be conducted within 32 hours of an accident.

In Canada, testing for drugs and alcohol on the railway is obtained through urine, breath or oral fluid samples. In the United States, blood and urine samples are taken. Analysis of blood samples can note the presence of alcohol and drugs and indicate current levels that allow interpretation of degree of impairment. Analysis of urine samples can identify traces of drugs that remain longer in the urine than in the blood.

Emergency response

On the day of the accident, the area was immediately protected by RCMP as the first responders until CP Police arrived on the scene. CP Police remained at the scene for the entire wrecking process and track reconstruction. The public was kept away, and local newspaper reporters were escorted on site to allow for some pictures to be taken. The site had only one point of entry access, and RCMP and CP Police were positioned at this location.

The fire department was blocked at the Anderson Road Crossing and was neither able to immediately access the site to conduct the initial hazard assessment, nor able to attend to the burning tool shed south of the track. After a delay of approximately 13 minutes, they took control of the site and began coordinating the response.

Approximately 90 minutes after the accident, railway managers arrived on scene and took over control of the site from the fire department. Subsequently a Workplace Health and Safety Committee Representative was appointed by Local Management to act as the first point of contact and to conduct safety briefings with employees and contractors.

To respond to emergencies, CP has established 3 levels of emergency response (see Appendix B). Level one is considered the least severe situation, while Level three is considered the most severe. At the time of the occurrence, no emergency response level was assigned. Consequently, there was no command centre established and no safety briefings were conducted prior to work commencing.

Analysis

There were no equipment or track defects that were considered causal in this occurrence. The analysis will focus on train operations in the vicinity of KC Junction, safety defences in Centralized Traffic Control, train crew situational awareness, drug and alcohol testing and emergency response.

The accident

The collision occurred when train 300 was operated past the Stop signal at KC Junction and into the side of train 671 which was crossing over from the north main track to the south main track.

At about the same time that train 300's crew observed the Clear to Stop signal at the advance to KC Junction, the signal maintainer, who was testing the new HBD at Mile 44.9, notified the crew that they had hot wheels, even though moments earlier the signal maintainer had advised the crew to disregard the message from the new detector. At about the same time, train 300 received a radio transmission from the active HBD at Mile 39.3, indicating no alarms. While processing the conflicting information from the signal maintainer and from the active hot box detector, the crew's attention was momentarily diverted from the primary task of stopping their train.

To maintain situational awareness, it is often necessary to switch attention between different information sources. Train 300's crew was presented with information from a number of different sources (i.e., the signal indications, the signal maintainer, the new HBD at Mile 44.9 and the existing HBD at Mile 39.3). The crew was presented with new and conflicting information as they were approaching the controlled signal at KC Junction. When confronted with these types of situations, people often can get trapped in a phenomenon called attention narrowing or tunnelling. When succumbing to tunnelling, they tend to lock in on certain aspects or features of the environment they are trying to process and may either intentionally or inadvertently drop their scanning behaviour. In this case, the crew's situational awareness was likely focussed on resolving the HBD issue related to the reported hot wheels and not on the impending requirement to stop the train.

Both crew members are responsible for the safe operation of the train. Some crew responsibilities are clearly delineated and in other cases there is an assumed division of responsibilities. The train is the conductor's overall responsibility. When an HBD alarm message is received, the conductor typically consults the train consist to locate the suspect cars. The locomotive engineer is responsible to safely operate the train. Regarding signal indications, the locomotive engineer and the conductor are jointly expected to identify and remind each other of the indication of signals.

On this track, railway operating instructions require that crews announce the indication of controlled block signals over the standby radio channel. This requirement represents a backup safety defence that can help correct errors in signal recognition. For an eastward train approaching KC Junction, there was an unobstructed view of signal 370N for about 3900 feet. Train 300's crew did not positively identify and announce the "Stop" indication at signal 370N over the radio, thereby missing an opportunity to update their situational awareness and bring their train to a safe stop.

Safety defences in CTC

There are a number of safety defences in place on the Mountain Subdivision that are designed to prevent accidents of this type. Some of these defences are associated with the train control system (i.e., CTC), and some are associated with CROR and the railway's general operating instructions (GOI) (i.e., administrative defences). Wayside signals include a physical signal installation combined with an administrative requirement to follow the signal indication. This defence relies on the crew to observe the signal, to recognize the intent of the signal, and then to take appropriate action. Operating rules and company GOI require that all signals be identified and announced within the cab of the locomotive and that others be announced over the railway radio system. These defences, while useful, do not always prevent the type of signal recognition errors that have led to a number of recent collisions and derailments in CTC territory.

In contrast to the CTC physical installations and administrative defences, cab-signalling systems could enhance CTC by providing a continuous display of signals within the locomotive cab. If signal indications are not observed during train operation, audible alerts and emergency train stop protection would activate. Cab-signalling was developed in the US about 85 years ago. Since then, it has evolved to its current form in which train protection systems are overlayed. CTC, enhanced with a modern cab signalling system, could reduce the risk of collisions and derailments from signal recognition errors and loss of situational awareness such as those experienced by train 300's crew.

PTC, a system under development, offers additional defences in some circumstances. If a crew does not respond appropriately to a signal or other restriction, PTC has the ability to alert the crew to the fact that they are not reacting as expected, and as a last resort, the system can intervene to slow or stop the train by applying the brakes.

In the absence of enhanced protection against signal recognition errors, such as that provided by cab signalling systems or PTC, CTC and its current defences do not adequately ensure that the requirements of signals will always be followed.

Distraction Through the use of Personal Electronic Devices

Distraction from the use of personal electronic devices (such as cellular telephones) at times when attention to safety critical tasks is required leads to decreased situational awareness. Such distraction led to the loss of 25 lives in the 12 September 2008 collision between a Metrolink passenger train and a Union Pacific freight train in California.

In this occurrence, while operating their train, the crew on train 300 conducted numerous personal electronic communications, the last of which concluded about 1 minute prior to their discussions with the signal maintainer. Railway rules and company policy establish strict protocols for the use of personal electronic devices by employees in safety sensitive positions while on duty. Despite the existence of rules and protocols regarding the use of personal electronic devices, not all railway employees working in safety sensitive and safety critical positions understand and accept the risks associated with such distractions, increasing the risk of unsafe train operations.

The detection of drug and alcohol use

After the accident, both crew members of train 300 sustained minor injuries, but were able to exit the locomotive unaided. They were transported to Golden hospital for observation. The conductor was tested for alcohol and drugs approximately 6.5 hours after the accident. However, the locomotive engineer lost consciousness and was air-lifted to Calgary Foothills Hospital. At approximately 0130 the following day (i.e., 11 hours 20 minutes after the accident), he was tested for drugs and alcohol.

It was later determined that the locomotive engineer had been exposed to marijuana, sometime prior to the accident. In an attempt to mask this exposure, he drank approximately 10 litres of water shortly after the accident, which resulted in hyponotremia (i.e., water intoxication). The ingestion of water and the delay in alcohol and drug testing likely affected the usefulness of the tests. Without a requirement to conduct timely post accident testing for drug and alcohol use (when warranted), there is an increased risk of inconclusive test results.

Location of switch heater propane tank

In the event of a derailment, propane tanks and piping used to fuel switch heaters become hazardous conditions that can result in a fire and explosion. Derailed rolling stock generally pile up immediately adjacent to the track. In this occurrence, the switch heater propane tank was installed within 15 feet of the track and was struck by a derailed car, resulting in tank rupture and fire. When a switch heater propane tank is installed immediately adjacent to the track, there is an increased risk that the tank will be struck by rolling stock during a derailment, leading to tank rupture, explosion and fire.

Emergency response

When the first CP manager arrived on site, a substantial fire was burning along the right-of-way. The crossing was blocked by train 671 for an extended period of time, and the emergency responders were unable to perform an immediate hazard assessment or take control of the site. Even though CP has well established emergency response plans with levels that correspond to the magnitude of the risks, at the time of the occurrence, no plan or response level was assigned to this accident. Consequently, railway workers entered the accident site before a command centre was established and before a hazard assessment was conducted. When work begins on a railway accident site before a hazard assessment has been made and the results communicated to all concerned, employees and the public may be subject to unnecessary risks.

Findings

Findings as to causes and contributing factors

1. The collision occurred when train 300 was operated past the Stop signal at KC Junction and into the side of train 671 which was crossing over from the north main track to the south main track.
2. While processing conflicting information from the signal maintainer and from the active hot box detector (HBD), the crew's attention was momentarily diverted from the primary task of stopping their train.
3. The crew's situational awareness was likely focussed on resolving the HBD issue related to the reported hot wheels and not on the impending requirement to stop the train.
4. Train 300's crew did not positively identify and announce the "Stop" indication at signal 370N over the radio, thereby missing an opportunity to update their situational awareness and bring their train to a safe stop.

Finding as to risk

1. Without a requirement to conduct timely post accident testing for drug and alcohol use (when warranted), there is an increased risk of inconclusive test results.
2. When work begins on a railway accident site before a hazard assessment has been made and the results communicated to all concerned, employees and the public may be subject to unnecessary risks.
3. When a switch heater propane tank is installed immediately adjacent to the track, there is an increased risk that the tank will be struck by rolling stock during a derailment, leading to tank rupture, explosion and fire.
4. In the absence of enhanced protection against signal recognition errors, such as that provided by cab signalling systems or Positive Train Control (PTC), Centralized Traffic Control (CTC) and its current defences do not always adequately ensure that the requirements of signals are followed.
5. Despite the existence of rules and protocols regarding the use of personal electronic devices, not all railway employees working in safety sensitive and safety critical positions understand and accept the risks associated with such distractions, increasing the risk of unsafe train operations.

Safety action taken

On 1 July 2010, in response to 10 recent collisions involving movements exceeding limits of operating authority, CP developed and delivered a Crew Resource Management (CRM) program, including training materials to all train crew members. Revisions were communicated via summary bulletins. The initial CRM focus was on reducing in-cab distraction, enhancing communication and focusing on critical tasks. The following revisions were included in the manual:

• Personal electronic devices: Employees are prohibited from using such devices. They must be turned off, with any ear pieces removed, and stored out of sight in a location not on their person. (Not applicable to medical devices such as hearing aids, etc.) Exception: Employees may use personal cellular telephones:
  • During a recognized break or meal period; or
  • For minimal voice communications when the movement/track unit/work activities are stopped, the employee is not foul of any track and a job briefing with all involved employees confirms such use will not interfere with any safety related duty.
• Radio Broadcast Requirements: The Conductor is now by Rule required to perform the radio broadcasts required by Rules 315 and 578.
• CROR Rule 121 Positive Identification: The person initiating a radio communication and the responding party must establish positive identification. The initial call must commence with the railway company initials of the person being called. When the initial call is to a movement, the conductor must respond when conditions permit.
• System Special Instruction to CROR Rule 34(b): Crew members within physical hearing range must communicate to each other, in a clear and audible manner, the indication by name, of each fixed signal they are required to identify. Each signal affecting their movement must be called out by the conductor and acknowledged by the person responsible for controlling the locomotive as soon as it is positively identified, but crew members must watch for and promptly communicate and act on any change of indication that may occur.
• System Special Instruction to Rule 34(b): In CTC (or at any other signal to a signal in CTC), except as otherwise indicated in special instructions, when passing more than two controlled locations the conductor must complete the applicable portions of the CTC Signal Record form immediately after the leading end of the movement has passed each signal subject to Rule 578.

Management monitoring (proficiency testing) and peer to peer reinforcement of correct behaviour has been established as CP's approach to deal with compliance of personal electronic devices.

CP is targeting January 2012 for the implementation of Oral Fluid Testing (OFT), in addition to the current Breath Alcohol Concentration (BAC) and Urine Drug testing for Reasonable Cause (RC) and Post Incident/Accident (Pl/A) Testing.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 23 June 2011.

Appendices

Appendix A – Other relevant occurrences

R07E0129

On 27 October s2007 at 0505 mountain daylight time, the crew on Canadian National (CN) train A41751-26 (Train 417) operating westward on the main track of the Edson Subdivision initiated an emergency brake application approximately 475 feet from a stop signal at the west end of Peers, Alberta. The train was unable to stop prior to passing the signal and collided with eastbound CN train M34251-26 (Train 342) that was entering the siding. As a result of the collision, Train 417's locomotives and 22 cars derailed. Ten other cars sustained damage but were not derailed. Five cars on Train 342 derailed and four other cars sustained damage but did not derail. There were no serious injuries and no release of dangerous goods.

R09W0118

On 28 June 2009 at 0631 Central Daylight Time, while proceeding westward on the Redditt Subdivision, Canadian National train Q10131-27 (Train 101) collided with the tail end of Canadian National train M30131-27 (Train 301), which was stopped on the main track at Mile 105.70. As a result of the collision, the four tail-end intermodal cars (six platforms in total) from Train 301 and the three head-end locomotives from Train 101 derailed. The locomotive engineer from Train 101 was transported to hospital with minor injuries.

R09V0230

On 30 October 2009 at about 2225 Pacific Daylight Time, Canadian Pacific Railway Train 355-429 operating westward on the signalled siding track at Redgrave, British Columbia, on the Mountain Subdivision, side-collided with eastbound Canadian Pacific Railway Train 110-30 that was stopped on the main track. As a result of the collision, two locomotives and six cars derailed. There were no serious injuries. Approximately 3000 gallons of diesel fuel spilled.

R10Q0011

On 25 February 2010, westward train VIA 15 derailed 2 locomotives and 6 of 7 coaches at Mile 100.7 of the CN Montmagny subdivision. Leading locomotive VIA 6400 came to rest on its side. One hundred fifteen passengers, 8 on board services employees and 2 locomotive engineers for a total of 125 persons were on board. Some minor injuries were reported. The Train was evacuated and passengers were bussed to Montreal for connection to destination. Seven persons (the two locomotive engineers and five passengers) were taken to hospital in Levis, QC by ambulance. All were treated and released the same day. Approximately 3000 litres of diesel fuel leaked from the lead locomotive. Two houses, a garage, and six motor vehicles were severely damaged or destroyed. The lead locomotive was destroyed. There was substantial equipment and track damage.

Appendix B – CPR Service Area, Terminal, or Facility Name Emergency Response Plan

4.2 Definition of an Emergency and Emergency Levels

4.2.1 General

An emergency is defined as any event that creates or has the potential to create a hazard to the safety of CPR personnel, safety of the public, significant business disruption, and/or threatens to damage the environment. This includes events that cannot be controlled or eliminated by the use of railway operating procedures and thus will be treated as an emergency.

For the purpose of emergency planning, CPR has established three levels of emergency: Level 1 is the least serious type of emergency and Level 3 is the most serious type of emergency. The Level of emergency can be escalated or scaled down depending on circumstances.

4.2.2 Level 1:

An event that is limited to a localized area of CPR Operations. There is risk of:

• Minor damage to CPR Property;
• Minor damage to public or private property;
• Minor damage to the environment;
• Minor injuries to company personnel or to the public;
• Little or no media attention to the incident;
• Little or no involvement by government regulatory agencies; and
• No political attention to the incident.

The incident can be handled by Field Emergency Response Team. Minimal assistance from local emergency services and contract resources may be required.

4.2.3 Level 2:

A medium-sized event that affects a larger area of CPR Operations. There is risk of:

• Serious injuries to company personnel or members of the public;
• Small evacuation of surrounding area;
• A single fatality;
• Danger to a large area or more than one area;
• Moderate damage to the environment;
• Minor media attention to the incident;
• Low level involvement by government regulatory agencies;
• Local (municipal, county) political attention to the incident;
• Moderate damage to public and private property.

The incident cannot be handled by Field Emergency Response Team without assistance from local emergency services and contract resources. A Site Command Post may be mobilized at the discretion of the On Scene Response Coordinator.

4.2.4 Level 3:

A serious event with extensive impact on several areas of CPR Operations.

There is risk of:

• Multiple serious injuries or fatalities to company personnel or members of the public;
• Major evacuation;
• Significant damage to company property;
• Significant damage to public and private property;
• Serious damage to the environment;
• High level of involvement by government regulatory agencies;
• High level of political (provincial/state, federal) attention to the incident;
• A requirement to mobilize the Site Command Post, Incident Command Centre, and the Corporate Crisis Centre.