Railway Investigation Report R95S0021

On 16 February 1995, at 0349 eastern standard time (EST), a Canadian National (CN) freight train, travelling eastward on tangent main track at Mile 4.2 of the Strathroy Subdivision in London, Ontario, collided with the rear of a stationary freight train. The force of the collision propelled the stationary train eastward where it collided with another stationary freight train. Two employees sustained serious injuries.

The Board determined that the locomotive engineer of the moving train probably experienced a sleep episode, and not only missed a critical restrictive signal indication, but was unable to intervene as the train approached and struck the stationary cars. The conductor was not attentive to train operation and did not provide the requisite backup to the locomotive engineer.

1.1 The Accident

When Canadian National (CN) freight train No. 386-15 (train 386), en route eastward from Windsor, Ontario, to Toronto, Ontario, arrived at London, Ontario, Mile 0.0 of the Strathroy Subdivision, it was necessary for the crew members to perform switching on the front of the train. To avoid blocking public crossings within London, the train was positioned on the south main track with the last car in the vicinity of Signal 04S (Mile 0.4) (see Appendix A).

CN freight train No. 223-15 (train 223), also travelling eastward from Windsor to Toronto, following signal indications, was stopped behind train 386. The rear of train 223 was approximately 2,000 feet west of Signal 26 (Mile 2.6).

Eastward CN freight train No. 308-15 (train 308), travelling from Sarnia, Ontario, to Toronto, also following signal indications, was stopped behind train 223. The last car of train 308 was about 1,100 feet east of Signal 44 (Mile 4.4).

Eastward CN freight train No. 272-15 (train 272), travelling from Pontiac, Michigan, to Toronto, left Komoka, Ontario (Mile 9.01), at approximately 0337^{Footnote 1} after having obtained authority to operate, without restrictions, on the south main track, between Komoka and Ridout (Mile 0.4). At approximately 0349, after passing Signals 64 (Mile 6.4) and 44 and while travelling at about 29 mph, train 272 collided with the last car of train 308. The force of the collision pushed train 308 into the last car of train 223. Train 223 did not derail.

The locomotive engineer and conductor of train 308 were knocked about their locomotive cab, but quickly recovered and initiated an emergency radio broadcast and then alerted the rail traffic controller (RTC) to their situation. They requested emergency assistance. The conductor detrained and proceeded to the rear of his train where he found derailed cars and locomotives. The seriously injured crew of train 272 responded to the conductor's calls. The conductor climbed into their derailed locomotive to render assistance. He used his portable radio to alert his locomotive engineer, who had remained in their locomotive, to the situation, and the locomotive engineer in turn advised the RTC, using the locomotive radio. The conductor of train 308 remained in the derailed locomotive, shining his flashlight toward the nearby highway overpass to guide emergency response personnel. The locomotive engineer of train 308 proceeded to the highway with a flagging kit to provide additional guidance to first responders if required.

1.2 Injuries

The locomotive engineer and the conductor on train 272 sustained serious injuries.

1.3 Damage to Equipment

Two cars were damaged beyond repair, two locomotives and three cars were extensively damaged, and three cars sustained minor damage.

1.4 Other Damage

Three hundred feet of the south main track and one hundred feet of an adjacent storage track were extensively damaged.

1.5 Personnel Information

1.5.1 General

The crew on all four trains included a locomotive engineer and a conductor. All crew members on all four trains were qualified for their respective positions and met fitness and rest standards established to ensure the safe operation of trains.

1.5.2 Crew of Train 272

The crew members of train 272 worked out of the London Terminal. Each had arrived in Pontiac on 15 February 1995, after having been called for duty at 0335 to crew a train to that point from London. The conductor had booked off duty at 1315, and the locomotive engineer had booked off at 1015. Train crews are taxied to and from the terminal in Pontiac to a hotel and assigned individual rooms. The accommodations are considered conducive to rest and both crew members described themselves as rested when reporting for duty on 15 February 1995. The conductor was called for train 272 at 2115 and the locomotive engineer, for 2145. The conductor had not worked on 14 February 1995, and the locomotive engineer had completed a similar turnaround, booking off in London in the early morning of 14 February 1995.

1.6 Train Information

1.6.1 Train 272

Train 272 consisted of 2 locomotives, 28 loaded cars and 13 empty cars. It was approximately 3,900 feet in length and weighed about 2,800 tons.

1.6.2 Train 308

Train 308 consisted of 2 locomotives, 8 loaded cars, including 3 cars carrying dangerous goods, and 4 empty cars. It was approximately 870 feet in length and weighed about 1,000 tons.

1.6.3 Train 223

Train 223 consisted of 2 locomotives, 73 loaded cars and 1 empty car. It was approximately 6,900 feet in length and weighed about 5,500 tons.

1.6.4 Train 386

Train 386 consisted of 2 locomotives and 110 cars.

1.7 Method of Train Control

At the occurrence site, rail traffic is governed by the Occupancy Control System (OCS) authorized by the Canadian Rail Operating Rules (CROR) and supervised by a RTC located in Toronto.

An Automatic Block Signal (ABS) system is also in effect. This signal system enhances the safety of the OCS by providing advance warning to train crews by displaying the appropriate signal when the track ahead is occupied by another train, or when a track condition such as an open switch or a broken rail is present.

The authorized speed between Mile 0.2 and Mile 9.8 is 60 mph for freight trains.

1.8 Weather

The temperature was zero °C, and the wind was calm. The visibility was good.

1.9 Recorded Information

1.9.1 Event Recorder Data

Event recorder data from the two heavily struck trains (train 272 and train 308) were reviewed.

1.9.1.1 Train 272

Event recorder data obtained from train 272 indicated that the train resumed forward motion at Komoka at a recorded time of 0337:21 and recorded distance of 146.0. At a recorded distance of 149.5, calculated to be just past Signal 64, the train was travelling at 43 mph in throttle position No. 5 with a 10-pound per square inch (psi) brake application. At a recorded distance of 151.0, calculated to be approximately 2,000 feet before Signal 44, recorded speed decreased to 10 mph and the brakes were released. At a recorded distance of 151.3, approximately 500 feet before Signal 44, a manual reset of the vigilance feature was shown. At a recorded distance of 151.4, estimated to be at Signal 44, the recorded speed increased to 25 mph and the throttle was still in position No. 5. At a recorded distance of 151.6, 29 seconds after passing Signal 44, while travelling at a recorded speed of 29 mph, the train emergency brakes were applied by the train operator. Two seconds after the emergency brake application, while the train was still travelling at 29 mph, forward motion began to decelerate and ceased within the next five seconds.

1.9.1.2 Train 308

Event recorder data obtained from train 308 indicated that the train had been held stationary by a full service brake application with the locomotive throttle in idle for slightly over one hour. At a recorded time of 0349:54, an acceleration to 12 mph in three seconds was depicted and brake pipe pressure was lost. The recorded train speed then quickly registered 0 mph.

1.9.2 Rail Traffic Controller

Voice recordings from the RTC's office indicated that instructions had been given to the crew members on train 386 to leave the last 66 cars of their train west of Signal 04S at Mile 0.4, to avoid blocking public crossings in London while they were switching. The recording also indicated that clearances had been issued to trains 386, 223, 308 and 272 to operate on the south main track between Komoka and Ridout without restrictions.

1.9.3 Vigilance Feature

Each locomotive is equipped with a timed vigilance feature reset either through operator adjustment to locomotive controls and features or through a manual reset in reaction to visual and/or auditory indicators. The timing period is dependent on the speed of the locomotive, varying from 127 seconds at 10 mph to 104 seconds at 20 mph and 88 seconds at 30 mph. At second 0 (end of timing period), the visual indicators start flashing; at second 5, the visual indicators continue and an audible alarm is activated. The audible alarm increases in intensity to a maximum level at second 20. If the feature is not reset, a service brake application is triggered at second 23. The visual indicators (flashing lights) are located forward of the locomotive engineer's position, slightly above eye level.

The button controlling the manual reset feature is usually mounted on the locomotive console within easy reach of the locomotive engineer.

1.10 Occurrence Site Information

1.10.1 General

The Strathroy Subdivision extends between Port Huron (Mile 61.7) and London (Mile 0.0). It consists of two main tracks between Mile 55.6 and Mile 0.0. At Komoka (Mile 9.8), there is a junction with the Chatham Subdivision. The Chatham Subdivision extends between Komoka and Windsor.

The two main tracks are tangent from just east of Signal 64 to London. Travelling west to east, the two tracks descend on a 0.2 per cent grade from Mile 5.0 to Mile 4.2 and on a 0.41 per cent grade from Mile 4.2 to Mile 2.5.

1.10.2 The Accident Scene

The lead locomotive of train 272, CN 2105, came to rest facing westward south of the south main track. The second locomotive, marshalled with the long hood leading, had travelled past the lead locomotive, coming to rest derailed approximately 50 feet past the rear of CN 2105. The first two cars of train 272 were derailed but remained coupled to the train. The last four cars of train 308 (three boxcars and one hopper car) were derailed. The last car of train 308 was south of the south main track alongside CN 2105, the third and fourth cars were to the north of the south main track, contacting the second locomotive, and the fourth car remained coupled to the train but derailed. Three of these cars were extensively damaged and spilled their lading. The fifth, sixth and seventh cars from the rear of train 308, loads of propane, were not damaged.

Severed air hose pieces, broken components from the end-of-train communications device from train 308 and pieces of the crossover steps from CN 2105 were located between the rails of the south track, approximately 1,100 feet east of Signal 44.

One fuel tank from CN 2105 was punctured, releasing approximately 500 litres (110 gallons) of diesel fuel, most of which was recovered.

1.11 The Signal System

The ABS signal system consists of a series of blocks employing a coloured light signal system to govern train and engine movements. The signals are activated by the approach of a train or engine. A block is a length of track of defined limits. When the second block ahead of a train is occupied, the signal governing movement into the first block will display a "Clear to Stop" indication (indicating to the train crew to proceed, preparing to stop at next signal) and the signal at the entrance to the second block ahead will display a "Stop and Proceed" indication (indicating to the train crew to stop, then proceed at restricted speed). Restricted speed is defined as "a speed that will permit stopping within one-half the range of vision of equipment, also prepared to stop short of a switch not lined appropriately and in no case exceeding slow speed." Slow speed is a speed not exceeding 15 mph.

A recent innovation to this signal system has seen the posting of a yellow sign with a large "R" on the signal mast. Such a signal now indicates that the train need not stop but must proceed through that block at restricted speed. Signal 64 was so equipped, Signal 44 was not.

The ABS signal system in the area of the collision was functioning as designed at the time of the occurrence. A number of reported signal failures (Signals 64, 44 and 25) in the previous several months before the occurrence were responded to by signal personnel with the following results:

1. a burned bulb had to be replaced;
2. a train had been re-routed against the current of traffic, causing crew members to mistakenly assume that the signal being displayed was incorrect;
3. snow covering the lens on a signal partially covered the aspect that was being displayed; and
4. foliage had grown on overhead signal wires; however, the wires are insulated which prevents improper signals from being displayed.

1.12 Fatigue

1.12.1 General

Fatigue is often used as a catch-all term for a variety of different experiences, such as physical discomfort from overworking a group of muscles, difficulty concentrating, difficulty appreciating potentially important signals, and problems staying awake.^{Footnote 2}

1.12.2 Microsleeps

The most extreme symptom of fatigue is uncontrollable sleep. An uncontrollable sleep period can be a microsleep, a nap, or a long sleep episode. A microsleep is a very short period of sleep lasting from a fraction of a second to two or three seconds. Although the existence of microsleeps can be confirmed by electroencephalogram (EEG) recordings, people are not generally aware of them, which makes the phenomenon particularly dangerous. Microsleeps have been shown in tests to correlate with periods of low performance and they occur most frequently during conditions of fatigue. While asleep, people are "perceptually isolated", and do not know what is going on around them.

1.12.3 Biological Clock

Over time, the daily cycle of light and dark has become hard-wired into our brains in the form of a biological clock. This biological clock controls various chemical and neurological systems. The overall result is that we have a daily cycle which can be measured in several ways. The most important effect is that people are programmed to be awake during the day and asleep at night. We do adjust to new schedules, but slowly.

Humans have two periods of maximal sleepiness in each 24-hour period. Although there are individual variations, the primary sleepiness period generally occurs between 0300 and 0500. A secondary sleepiness period occurs between 1500 and 1700. Each of these is preceded by a period of maximal wakefulness. Regardless of the motivation and situation, people can have difficulty remaining awake during maximum sleepiness periods. Conversely, obtaining sleep during the periods of maximum wakefulness is difficult, and often the sleep obtained is not restorative.

1.12.4 The Current Regulatory Approach to Fatigue

Railways under federal jurisdiction in Canada operate within regulatory requirements specifying both maximum hours of service and mandatory time off duty for train crews. Both of these requirements came about through the actions of the regulator in response to safety concerns. Mandatory time off duty requirements were imposed upon the railways subsequent to the Hinton train collision in 1986. The regulator imposed maximum hours of service requirements upon the railways after it became known that operating employees were remaining on duty for excessive amounts of time.

Mandatory time off duty requirements apply only to employees who are called from an employee pool and do not otherwise have a regularly scheduled assignment or to employees who are called into pool service from other classes of train service. Employees covered by these requirements who have been on duty in excess of 10 hours will not be required to go on duty in pool service for at least 8 hours.

Maximum hours of service requirements are applicable to railway operating employees in any class of train service. These requirements specify that no employee shall be on duty in excess of 18 hours in a 24-hour period; the maximum time on duty in a single tour of duty is 12 hours, and 16 hours in case of work train service or in case of emergency.

1.12.5 Multiple Lines of Safety Defence

When the risk associated with a potential hazard cannot be eliminated in a complex system such as railway operations, the system should be made more tolerant to the hazard by one of the following interventions, listed in order of preference:^{Footnote 3} the installation of safety devices, the provision of warning devices, and the development of procedures and training. The sole use of administrative interventions, such as procedures and training, may not provide an effective hazard control method in certain circumstances, especially when the level of risk is very high. Rather, the use of administrative interventions in conjunction with engineering interventions may be more appropriate.^{Footnote 4} The use of multiple interventions is in keeping with the "depth in defence" philosophy^{Footnote 5} for complex systems, where multiple and diverse lines of defence are employed to mitigate risks.

1.13 Other Information

1.13.1 Train 386

The implementation of a new train/car computerized information system in Windsor created a severe traffic backlog which restricted the ability to switch the freight cars properly and resulted in congestion in the yard. Marshalling of cars into blocks destined for the same location had not been accomplished. The conductor stated that their train was poorly marshalled when they left Windsor, necessitating additional switching at London.

The conductor also said that neither he nor the locomotive engineer communicated by radio with crew members on the three trains following them as they approached London nor did they hear any radio communications between crew members on any of the other trains involved in the occurrence.

The conductor indicated that they had no trouble with the signals between Komoka and London and that he had never experienced any problem with the signals in the area.

1.13.2 Train 223

The conductor and locomotive engineer were not aware of the collision between the two trains behind them nor did they feel the impact when train 308 was pushed into the rear of their train. They stated that an emergency brake application had occurred while they were standing waiting for train 386 to proceed ahead of them, but they did not know what had caused the brake application.

The crew members of train 223 had not communicated by radio with the crew members on train 308 or train 272 behind them. Both stated that they had never experienced any problem with the signals between Komoka and London.

1.13.3 Train 308

Both the locomotive engineer and conductor heard the crew members on train 272 behind them talking to the operator at Komoka. Both also heard the radio communications of the crew members on train 386 while they were switching in London Yard. The only other radio communications were initiated by themselves to the RTC and then when they made the emergency radio broadcast to warn other trains in the area that the rear of their train had been struck by train 272.

The conductor stated that he had never encountered problems with the signals between Komoka and London. The locomotive engineer stated that he had experienced a signal malfunction in the area previously; however, it was because of a broken bond wire that was later repaired. They stated that they had both observed the "Stop and Proceed" signal indication displayed on Signal 44. The locomotive engineer commented about a bent hood over the top signal aspect on Signal 44, but this did not obscure his view of the signal.

1.13.4 Train 272

1.13.4.1 Conductor

The conductor stated several times that Signal 64 was displaying a "Clear to Stop" indication, and initially said that Signal 44 was displaying a "Clear to Stop" indication. He then stated that he could not recall the indication being displayed on Signal 44. However, he does remember seeing a "Stop and Proceed" indication on Signal 26. He had been aware of train 386 and train 223, having followed them from Windsor. He did not know that train 308 had moved between his train and train 223.

The conductor was unsure whether Signal 64 was properly communicated between him and the locomotive engineer.

The conductor stated that neither he nor the locomotive engineer had any radio communications with crew members on trains 308 or 223 and could not recall hearing any other radio communications by other crew members in the area. He stated that he had been doing some paperwork relating to their assignment while travelling between Signals 64 and 44 and had been communicating with the locomotive engineer concerning this work.

He did not remember seeing the marker on the last car of train 308 until it was too late. He also said that he could not recall ever having problems with signals in this area but had heard that others had experienced problems.

1.13.4.2 Locomotive Engineer

The locomotive engineer has no recollection of seeing Signals 64 or 44, nor communicating with the conductor or any crew members on other trains after departing Komoka. He could not recall seeing the rear car of train 308 and did not remember the collision. He had never experienced any problem with signals in this area in the past. He believed that he was following train 386 and train 223 and had not been aware of train 308.

1.13.5 London Yardmaster

The yardmaster did not communicate by radio with any of the four trains. He was, however, aware that the crew members of train 386 had to perform switching on the front of their train in London. Due to the length of the train, he had advised the RTC to inform the crew members to leave the trailing portion of their train west of Signal 04S to avoid blocking public crossings in London.

1.13.6 Rail Traffic Controllers

Two RTCs who had communicated several times with the crew members on train 272 between Windsor and Komoka before the collision stated that both crew members seemed to be alert and no sign of fatigue was detected in their voices.

Neither RTC was aware of any recurring signal problem between Komoka and London.

1.13.7 Signal Malfunctions

The CROR state that any signal that displays an indication other than an authorized indication is to be interpreted as the most restrictive indication that can be displayed.

1.13.8 Dangerous Goods

Dangerous goods were ordinarily marshalled at the rear of train 308, which originated in Sarnia. At the time of the occurrence, three cars other than dangerous goods cars were marshalled on the rear of the train.

1.13.9 End-of-Train Information System

All trains operated without a caboose are required to be equipped with an End-of-Train Information System (ETIS). One of the components of an ETIS is the Sense and Brake Unit (SBU) which is affixed to the end coupler of the last car to indicate the rear of a train. The SBU is required to display a red marker, lighted or reflectorized on the rear of the train. The reflectorized area is approximately 3 1/2 inches by 5 1/2 inches with red and white striped hatch marks, approximately 1 inch wide, positioned diagonally across its surface.

The reflectorized SBU affixed to the last car of train 308 was destroyed on impact. The SBU on the last car of train 223 was chipped and dirty, and was starting to peel at the four corners.

Subsequent to the occurrence, five SBUs were inspected at the CN London Yard and found to be in the same deteriorated condition as that observed on the last car of train 223.

1.13.10 Collision on 28 October 1994

At approximately 0440 eastern daylight time, 28 October 1994, an eastward CN freight train collided with the rear of a stationary freight train at Mile 5.8 of the Halton Subdivision. No one was injured, but property damage was extensive (TSB Report No. R94T0334).

Although the TSB investigation determined that the operation of the train had been far in excess of the prescribed maximum speed, the efficacy of the reflectorized marker on the rear of the stationary train was called into question. It was determined that, from a distance of 600 feet, with the headlight on bright and the ditch lights illuminated, the car body of the last car was seen before the reflectorized marker was seen. While it was appreciated that adherence to railway operating rules and procedures would avert such collisions, it was concluded that such markers provided a very limited safety advantage.

The Board noted that the issue of rear train markers was not new. In its 14 December 1987 Order (No. R-41300), the Railway Transport Committee of the Canadian Transport Commission granted permission for CN and Canadian Pacific Railway (CP) to operate trains without cabooses with several conditions. Clause 1.1 of that order stated:

A train may be operated without a caboose and with the rear crew located in the cabs of the lead locomotive consist provided the train is equipped with a Digitair II end-of-train-information system with a rear train emergency braking feature and a red flashing marker light operated by an automatic light sensitive cell ....

This order was based on long and complex hearings and a number of field tests which, in part, involved the testing of the reliability of rear marker lights. Both CN and CP reported, at that time, that the results were excellent.

On 05 November 1990, Transport Canada (TC) revoked clause 1.1, in response to applications by CN and CP, and replaced it with a clause that did not require a marker light on the rear car of cabooseless trains, concluding that the changes were in the public interest and not likely to threaten safe train operations. On 11 August 1995, TC revoked the complete TC-revised Order No. R-41300 on the grounds that the order was being addressed effectively by other means and that the revocation of the order was in the public interest and would not likely threaten safe railway operations.

The risk of rear-end train collisions has not so much to do with the frequency of such occurrences (indeed, they are rare), but also with the potential consequences. Given that tank cars carrying loads of explosive or toxic dangerous goods are permitted to be marshalled at and close to the end of non-illuminated cabooseless trains, the consequences of a rear-end collision could be catastrophic for the operating crew of the following train and the public in proximity to the track. Measures to reduce the risk of rear-end collisions are therefore all the more important. The Board therefore recommended that:

The Department of Transport re-assess the risk associated with operating cabooseless trains without an illuminated rear marker.

(R96-12, issued July 1996)

On 23 October 1996, TC responded that the accident which had prompted the recommendation would not have occurred had the crew complied with speed requirements. It was further indicated that, since the lack of a marker was not identified as causative, TC did not see the necessity to further review the issue of lighted rear markers. TC also advised that rear markers are intended to define the tail end of a train for the purposes of a number of CROR rules applications, and not to prevent rear-end collisions.

2.1 Introduction

Trains 386, 223 and 308 were stationary on the main track in compliance with railway procedures and government safety standards. Train 272 ran into the rear of train 308 at a speed of about 29 mph. The force of the collision did not fatally injure the train crew; however, the circumstances were such that the potential existed for multiple fatalities, much more extensive property damage and a safety risk to first responders and others living or moving about the area.

The analysis will explore the most likely reason for the accident and discuss areas of safety concern uncovered by the circumstances preceding and following impact.

2.2 The Collision

2.2.1 Train Crew

In light of the confirmation of proper signal function by the crew of train 308 and successful post-accident testing, it is concluded that the ABS system functioned as designed. Signals 64 and 44 had displayed the correct signal indications as they were approached and passed by train 272.

Based on event recorder data, it is apparent that the locomotive engineer of train 272 complied with the aspect displayed at Signal 64 ("Clear to Stop"). The train brakes were applied and the throttle position was maintained to keep the train stretched in anticipation of a further train speed modulation. Once train speed decreased to 10 mph, the train brakes were released seemingly to maintain speed to the next ABS signal (Signal 44) which was approximately 2,000 feet away and probably seen to be displaying a restricting indication, i.e. stop and proceed at restricted speed.

At this point, no further train control modulation is evident until just before impact. Due to the gradient and locomotive throttle position, train speed gradually increased. The train passed Signal 44 at 25 mph, striking train 308 at 29 mph, 29 seconds later. It is probable that, during this period, the locomotive engineer succumbed to fatigue and slipped into an uncontrollable sleep period. It is noted that the accident occurred in one of the two periods of each day, 0300-0500, in which maximum sleepiness typically occurs.

The conductor, engaged in bookkeeping matters, was inattentive to train operation during this same period, and not, therefore, in a position to offer the requisite backup to the locomotive engineer.

When any train enters an occupied block, the safety of its movement hinges upon the crew's compliance with the requirements of the operating rule for restrictive speed and attentiveness. The ability of crew members to comply with these requirements is heavily dependent upon their alertness and judgement, both of which can be negatively affected by fatigue. Based on their performance, it is likely that the crew members of train 272 were not attentive, and the utility of the rule as a safety defence was compromised. With the lines of defence in place limited in number and diversity to the administrative interventions of procedures reinforced by training and teamwork, the system was already less tolerant to hazards and susceptible to breakdown. In this occurrence, once the final safety defence associated with the rule compliance in effect was disabled by the crew's inattention, the train movement within the block was extremely vulnerable to a collision.

The vigilance feature, although shown by event recorder data to have been reset approximately 500 feet before Signal 44, apparently did not evoke the expected attention response from the locomotive engineer. It is probable that he activated the reset feature as a simple reflex response to the system's audible alarm feature without awakening. The timing of the feature is such that the next requirement to reset the device would have occurred beyond the point of impact.

The traffic control system does not allow for intervention to stop a train or control train speed in the event that it becomes necessary to do so. A train control system capable of intervening to stop a train or of providing a passive warning to crews in advance of areas of restriction might have prevented this collision.

Had the locomotive cab been equipped with a voice recorder, it may have been possible to determine more definitively the crew's alertness and attentiveness to train operation as they approached the accident location.

2.2.2 Rest Considerations

The hours of work described in this report facilitate the railway company's ability to move trains within the confines of the hours of work regulations and the various collective agreements. However, the work schedules entail layovers at away-from-home terminals, often during daylight hours when humans are used to being awake, and restorative rest is most difficult. They are therefore conducive to crew fatigue. People are poor judges of their own fatigue level, and it would not be unexpected that crew members would feel, and report to be, rested when in fact they are not.

2.2.3 End-of-Train Markers

It is noted that the track eastward from Signal 64 to London is tangent and the view down the track is without obstruction. The view of the rear of train 308, situated over 11,000 feet ahead, would not have been obstructed. Although the reflectorized marker could not have been seen at such a distance, it is possible that a highly visible lit marker or a strobe would have alerted the locomotive engineer to the location of the rear of train 308 at some point before the collision. This would not only have intensified his attention on the operation of his train, but prompted him to start to bring his train to a stop.

2.2.4 Increased Risk Considerations

The loss of fuel from the damaged locomotive fuel tank is also of concern. Spilled fuel presents a risk of fire and conflagration and increases the risk to the well-being of railway employees, first responders, and the general public.

The Association of American Railroads (AAR) has established improved fuel tank standards for new freight locomotives. Included in this recommended practice is a design specification for puncture resistance stating:

The minimum thickness of the sides, bottom sheet and end plates of the fuel tank shall be equivalent to 5/16 inch steel plate at 25,000 psi yield strength (where the thickness varies inversely with the square root of yield strength). The lower one third of the end plates shall have the equivalent penetration resistance by the above method of 3/4 inch steel plate at 25,000 psi yield strength. This may be accomplished by any combination of materials or other mechanical protection.

The AAR fuel tank design improvements apply only to newly constructed locomotives (after 01 July 1995) and do not apply, through retrofitting, to locomotives currently in service. In Canada, there are over 3,000 locomotives in service with CN, CP and VIA Rail Canada Inc. (VIA). The average age of the locomotive fleet is in excess of 18 years and the life of locomotives can exceed 35 years. At present, there are about 180 to 185 locomotives either ordered in the last year or that have just been delivered that comply with the new AAR fuel tank standard. If no retrofitting of fuel tanks occurs, improvement to the environmental and safety risk associated with locomotive fuel tanks will be dependent on the future rate of locomotive replacement. Therefore, in view of the above, significant improvement in that risk will take more than a decade.

1. Trains 386, 223 and 308 were positioned in accordance with company procedures and government safety standards.
2. The Automatic Block Signal (ABS) system functioned as designed.
3. The operation of train 272 did not comply with the governing signal.
4. Train 272 was operated into the rear of train 308 without any apparent reaction of the crew in response to the requirement to stop at Signal 44.
5. It is probable that the locomotive engineer of train 272 succumbed to fatigue and experienced a sleep episode as his train was approaching Signal 44.
6. A lit marker at the rear of train 308 may have provided the crew of train 272 with advance warning of its location.
7. Safe train movement in an occupied block, dependent on crew attentiveness and compliance with restricted speed, is less tolerant to hazards and susceptible to breakdown.
8. The vigilance feature did not evoke the anticipated attention response from the locomotive engineer.
9. There is currently no means of intervention associated with train control that is capable of stopping or slowing a train. Furthermore, there is no passive warning system that would alert crew members to their proximity to areas of restriction or rolling stock.
10. Association of American Railroads (AAR) freight locomotive design improvements are in place for new locomotives. However, they will not improve the environmental and safety risks associated with many locomotives currently in service in Canada.

3.2 Cause

The locomotive engineer of the moving train probably experienced a sleep episode, and not only missed a critical restrictive signal indication, but was unable to intervene as the train approached and struck the stationary cars. The conductor was not attentive to train operation and did not provide the requisite backup to the locomotive engineer.

4.1 Action Taken

4.1.1 Work Hours/Fatigue Initiatives

In 1995, Canadian Pacific Railway (CP), Canadian National (CN), VIA Rail Canada Inc. (VIA), the Brotherhood of Locomotive Engineers and Circadian Technologies Inc. co-operated on a program which developed, implemented and tested an Alertness Assurance Process entitled CANALERT '95 . The goals of the CANALERT '95 program were:

• to develop a set of fatigue countermeasures to be used to enhance alertness levels among a group of locomotive engineers without adversely affecting operations;
• to validate the effectiveness of these countermeasures;
• to determine the relative alertness and mental workload stress levels of locomotive engineers operating high-speed passenger trains as compared to engineers operating trains in freight service; and
• to perform an analysis of the schedule-induced fatigue level which might exist in passenger operations.

A general analysis of alertness, sleep and mental workload characteristics was conducted to address the issues of fatigue or "impaired alertness" in the Canadian railway system. Specific fatigue countermeasures were developed for railway freight operations. These measures included circadian time pools for establishing a more regular and predictable work-rest pattern, napping practices both on and off duty, improved sleeping accommodations, headsets with music and intercom, and a railway lifestyle training program. Based on the experience gained in the implementation of these fatigue countermeasures and the results obtained from the general analysis, recommendations in May 1996 included:

• scheduling systems be adopted to provide regular and predictable duty periods for crews;
• a significant period of time be available for rest after outbound night runs and prior to overnight return runs;
• strategies be developed to permit both en route and terminal napping as an alertness recovery program;
• bunkhouse rooms be modified for improved daytime sleep;
• locomotive cab audio systems be installed;
• a lifestyle training program be conducted and extended;
• rail traffic controllers (RTC) be trained and crew caller-in strategies be developed; and
• problem schedules be investigated and rectified at VIA.

Transport Canada has provided exemptions to both CN and CP to permit testing of the new alertness initiatives. CP has ratified, with the operating unions, a new contract which contains a letter of understanding to develop an implementation timetable of the CANALERT initiatives. CP established a pilot project using a time pool arrangement with train crews operating out of Calgary. Furthermore, the Railway Association of Canada has started the process of drafting a new rule under the Railway Safety Act to address alertness issues.

4.1.2 Locomotive Fuel Tank Design

Transport Canada has approved the new Railway Locomotive Inspection and Safety Rules (effective 18 March 1998) that require all new locomotives to have fuel tanks to new AAR standards.

4.1.3 End-of-Train Markers

Although Transport Canada has revoked Canadian Transport Commission Order No. R-41300 and does not see the necessity to review the issue of lighted markers, the Board acknowledges there is a move within the industry to begin replacing Sense and Brake Units (SBUs) presently in use with the next generation of SBUs which are equipped with marker lights. CN has confirmed plans to replace only the trans-border runs with the next generation SBUs, while CP is currently phasing in SBUs equipped with marker lights for all runs.

4.1.4 Proximity Detection Systems

Transport Canada has been supportive of the operation of a Proximity Detection System on the Quebec North Shore and Labrador (QNS&L) Railway and has granted authority for this system to be tested on CN and CP.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson Benoît Bouchard, and members Maurice Harquail, Charles Simpson and W. A. Tadros, authorized the release of this report on 25 February 1998.

Appendix A - Relative Position of the Trains Before Impact