Railway Investigation Report R96C0172

On the evening of Monday, 12 August 1996, all three occupants in the operating cab of the lead locomotive of Canadian National (CN) westward freight train No. 117 were fatally injured when their train, which was travelling at about 54 mph, collided head-on with a cut of 20 runaway cars moving eastward at about 30 mph, some six miles east of Edson, Alberta.

The runaway cars had been left on a track in Edson Yard by a crew who had applied hand brakes to two Government grain covered hopper cars. The crew had received little supervision to ensure that the company's car securement procedures were being correctly applied. The performance of the hand brakes on this type of car was found to be highly variable, and this variability was not commonly known. Also, components from the hand brakes were missing from the two cars on which hand brakes had been set. Although the crew thought the cars had been secured, the resultant brake shoe force on the two cars was insufficient to prevent movement. Thus, the cut of 20 cars slowly moved east and accelerated toward the main track.

A derail to prevent uncontrolled movements from entering the main track from Edson Yard had been removed around 1990. This created an unsafe situation that was not detected for over five years. The runaway cars therefore entered the main track unobstructed. As the cars moved toward Yates, track circuitry caused bar lights on the Rail Traffic Controller's (RTC) panel in Edmonton to illuminate. However, the RTC did not see all these lights and he had not been trained, or given specific instructions, to consider these bar light indications as being consistent with a runaway. There was no alarm to assist the RTC in identifying the presence of a runaway.

Consequently, the crew of train 117 was not warned that runaway cars were heading toward them and they were unable to avert the head-on collision.

Cars or equipment running uncontrolled onto main track pose significant risks to train operating personnel, vehicle occupants at unprotected crossings, as well as to persons, property and the environment adjacent to any resultant collision or derailment. The Board had previously investigated several occurrences involving runaway cars and had made recommendations to reduce the risks of runaways, but the problem of runaways has persisted. For the years 1991 to 1996, 190 runaways were reported to the TSB; 17 of these resulted in main track collisions and 5 resulted in main track derailments. This collision near Edson, arising from inadequately secured cars, warranted a TSB investigation with wide scope and depth.

In the course of its investigation into this occurrence, the Board identified six broad areas of safety concern, putting the rail transportation system at risk. The Board questions:

The effectiveness of standard railway operating procedures and practices for securing equipment from the perspective of determining how many hand brakes to apply, the training and supervision of operating personnel, and any special considerations that may pertain at particular locations.

The adequacy of the rail traffic control system for detecting runaways from the perspective of the ergonomics of workstation displays and warnings, and the policies, procedures and training for controllers.

The variability of braking effectiveness on Government grain covered hopper cars with respect to the design of the hand brakes and their maintenance and the apparent lack of knowledge among railway employees of that variability.

The adequacy of rail safety regulatory overview with respect to the capability to evaluate the rail industry's compliance with national safety standards.

The effectiveness of company safety management programs from the perspective of ensuring that safety-related information is effectively communicated.

The extent to which the railways rely on strict rules compliance, often as the only defence against human error.

The Board notes that several measures have already been taken by Canadian National and Transport Canada, and others are planned to reduce the probability of such runaway risks in these areas. These measures, if implemented in full, should reduce the probability of such runaway occurrences. Notwithstanding the considerable efforts taken to date, further action is required to reduce or eliminate the remaining risks.

To this end, the Board has issued two recommendations: one aimed at improving employee understanding of the wide variability in hand brake effectiveness (particularly on Government grain covered hopper cars) and one aimed at improving the regulator's ability to effectively evaluate the railways' ability to maintain national safety standards.

In addition, in its future investigations of rail occurrences, the Board will continue to assess both the effectiveness of the railways' supervisory policies, procedures and practices, and the degree to which the railways are able to balance the role of rules compliance with the need for a safety system which is resistant to human error.

Ce rapport est également disponible en français.

1.1 The Occurrence

Westbound Train No. 117

On 12 August 1996 at about 2330 mountain daylight time (MDT), Canadian National (CN) freight train No. 117 (train 117), westbound from Edmonton, Alberta, was moving at approximately 54 mph on the CN Edson Subdivision approaching Yates, Alberta. The 4,850-foot-long train (total gross weight of about 5,370 tons) was comprised of three locomotive units leading 73 mixed loads.

The locomotive engineer was accompanied by a conductor and a passenger, who had accepted an offer to ride with the crew. All three men were in the cab of the lead locomotive. The passenger had not been authorized by the railway company to ride on train 117.

Eastbound Runaway Cars

Approximately one half-hour earlier, the outbound crew for train 404 was arranging 20 cars on track 4 in CN's Edson Yard, Alberta. The crew consisted of a locomotive engineer, a conductor and an assistant conductor. The cars were to be later placed on the front of train 404 that the crew was to take to Edmonton. The cut of 20 cars included 14 loads and 6 empties (approximate length 1,170 feet and weight 1,950 tons).

Track 4 had an eastward and downward grade of about 0.3 per cent. This necessitated the application of hand brakes to ensure that the cars remained stationary. When the crew left these cars, they were under the impression that the cars were secure and not moving. The locomotive was then secured on track 13, and the crew went back to Edson Station to await the arrival of train 404. There was no indication that anyone else was working in the yard and no unauthorized person was seen by the crew. The 20 cars slowly moved east on track 4 and accelerated through the east lead switch toward the south main track.

At 2312:43, a traffic monitor display bar light (bar light) on the Edson East rail traffic controller's (RTC) panel turned yellow. That bar light was a result of the runaway cars first entering the annunciator circuit and was the first potential indication that something was wrong. A series of bar light indications occurred as the runaway cars travelled down the south main track to Yates. None of these were observed by the RTC until, at a time between 2317:25 and 2321, when he was discussing the issuance of a new Track Occupancy Permit for a track foreman who was on a siding near Yates^{Footnote 1}. He attributed the bar light that he saw to a signal or track malfunction, and acted in accordance with company instructions by phoning a signal maintainer.

After the RTC called for a signal maintainer to check the problem, he returned to other work. He did not notice the continuing illumination of the bar lights that identified a set of 20 runaway cars moving toward Yates until it was pointed out by another RTC. The other RTC similarly did not conclude that the bar lights indicated a runaway.

The 20 cars had rolled away through the east lead switch on track 4 and down the eastward grade toward the main track. A derail to prevent runaway cars from moving onto the main track from Edson Yard had been removed sometime around 1990. The uncontrolled cars entered the extension of the south track at Edson East, and travelled eastward on the south main track toward Yates.

Collision

At approximately 2331, train 117 and the 20 runaway cars from Edson Yard collided head-on at Mile 122.9 of the CN Edson Subdivision at Yates (about six miles east of the town of Edson). Recorded data show that train 117 was travelling at about 54 mph just prior to impact and that the train's crew applied the emergency brake seconds before the collision. This would indicate that the train crew either saw the runaway cars or the red signal aspect at Yates occasioned by the entrance of the cars into the circuit just before Yates. The runaway cars had accelerated to slightly more than 30 mph prior to colliding with train 117.

The first two runaway cars were split in half and the next three cars were derailed and severely damaged. The first two locomotives were destroyed and the third locomotive was later repaired and returned to service. Thirty-one of the articulated freight car platforms in the train were derailed, with 18 damaged beyond repair. The fuel tanks of the first two locomotives ruptured and the fuel ignited about the crushed body of the lead locomotive. Both crew members and the passenger were killed in the collision.

Later, the RTC office in Edmonton received a telephone call from the Royal Canadian Mounted Police (RCMP) in Edson providing notification of a loud noise near Yates and a fire on the tracks. The RTC thought there had been a derailment. The crew at Edson Yard also thought that there had been a derailment when they overheard an emergency broadcast on the locomotive radio.

1.2 Chronological Order of Activities

Appendix 1 provides a chronological sequencing of activities leading up to and shortly after the collision for the occurrence at Mile 122.9 on the Edson Subdivision.

Information sources are as follows:

• Edson Yard switching times are from the event recorder on the controlling locomotive (CN4009)
• times for train 117 approaching Yates are from the recorder on the second locomotive (CN9575)
• movement times of the runaway cars from Edson East to Yates and of train 117 were from the RTC computer clock, and
• the activities and communications of the RTC were established from RTC voice tapes.

All event recorder times identified in this report have been converted from Coordinated Universal Time (UTC) to mountain daylight time. All CN locomotive event recorder internal clocks are set to UTC so that the locomotives can travel from one time zone to another without the event recorder clocks being adjusted. When the event recorder is downloaded, the times indicated by the download computer clock and the event recorder clock are both recorded and printed. Adjustments to event recorder time can be made by comparing the two times.

The clocks used by the RTC voice recorders and the RTC computer clocks are also regularly adjusted to the respective time zone (daily when the tapes are changed). This provides a reliable time reference to make comparisons of RTC voice activities, control panel activities and the train activities (train activities are taken from the locomotive event recorders). The RTC voice recorder clocks and computer clocks are reset when they indicate a discrepancy of plus or minus 10 seconds.

1.3 Railway Infrastructure

1.3.1 Track Layout

The schematic in Figure 2 depicts the trackage most directly related to this occurrence. Using this diagram, the route of the runaway cars can be traced from track 4 in Edson Yard to the point of impact (POI) at Mile 122.9 on the Edson Subdivision. The route followed by train 117 from Walker Yard in Edmonton west to the POI near Yates is also described.

1.3.2 Edson Yard

Edson Yard is roughly 130 miles west of Edmonton, located between Edmonton and Jasper. It covers an area about 7,500 by 1,200 feet and is oriented east-west. It is also adjacent to and south of the main road thoroughfare in the town of Edson.

Until 1995, Edson was a regular crew change-off point. Today, Edmonton and Jasper crews operate most trains through Edson. Crews headquartered at Edson essentially serve the coal and cement operations south-west on the Foothills and Mountain Park subdivisions.

Figure 4 provides a schematic of the track layout at Edson Yard.

1.3.3 Approaches to Site

Yard tracks exit Edson Yard to the east with a down grade ranging from approximately 0.3 per cent to 0.4 per cent and enter into two main tracks (north and south) which are governed by a system of train control known as Centralized Traffic Control System (CTC).

The runaway cars moved on track 4 through the track 4 east lead switch, on the lead track into the annunciator circuit, and through the switch to the extension of the main track. The cars then moved onto the south main track, through the controlled location at Edson East between signals at Mile 128.6 and Mile 128.5, past the signals at Mile 126.4, over a crossing at Mile 125.9 and to a one-degree curve at Mile 123.0, then to a No. 20 equilateral turnout and signal at Mile 122.9 at Yates. At that latter location, the south and north tracks converge to a single main track east to Edmonton. The track comprised 136-pound continuous welded rail (CWR). It was observed to be in good condition.

Train 117 approached the POI from the east on the Edson Subdivision main track from Edmonton. West of Wolf Creek Siding (Mile 119.72 to Mile 121.03), there is a one-degree, right-hand curve between Mile 121.12 and Mile 121.46. There is an unrestricted view of the switch at Yates from approximately Mile 121.3. The track comprises 136-pound CWR. It was observed to be in good condition. The grade, in the direction of travel of train 117, is about 0.5 per cent ascending from the west switch at Wolf Creek (Mile 121.03) to Mile 122.0 and then level over two bridges at Mile 122.24 and Mile 122.69. From that location to the POI, the grade is 0.4 per cent ascending. The maximum permissible regular freight train speed on this track is 50 mph. The maximum permissible speed for an express or "speed" train (such as train 117) is 55 mph.

1.3.4 Rail Traffic

Train movements on the Edson Subdivision are governed by CTC. Movements are supervised by the RTC located in the Walker Yard Rail Traffic Control office in Edmonton.

There are normally 10 to 20 trains per day each way on the Edson Subdivision, including three passenger trains each way weekly. On the day of the occurrence, there was light to normal traffic of about 10 to 15 trains each way.

1.3.5 Track Circuitry and Signals

The track circuits east of Edson Yard to Yates on the south main track comprised, in sequence: a 227-foot-long annunciator circuit; a 650-foot-long circuit for the controlled location which consisted of two crossover tracks between the north and south main tracks and four dual control switches; an 11,167- and 17,944-foot-long track circuit; and a 440-foot-long equilateral switch at the controlled location at Yates. Approaching from the east to the POI, the single main track had signals and a similar type of track circuitry. These track circuits are connected to the RTC office panel, where track circuit occupancy is signified by bar lights that display yellow to indicate track occupancy. Before the collision, the track signal circuitry functioned as designed. Figure 7 depicts the track circuits and signals between Edson Yard and Wolf Creek Siding.

1.3.6 Derails

At the time of the occurrence, there was no derail in place along the route followed by the runaway cars from track 4 in Edson Yard. However, there were remnants of a derail (including two long switch ties and a vertical metal post which certainly could have served as a derail sign post when the derail was in use) approximately 2,400 feet east of the track 4 east lead switch at Edson Yard. This derail had been installed to prevent runaway cars from Edson Yard moving onto the main track, but it was removed sometime around 1990.

The removal of this derail eliminated a secondary safety device for protecting main track train operations on the Edson Subdivision at Edson Yard from unsecured cars. This situation had existed for over five years before the occurrence.

Figure 8 is a photograph of the location of the old derail (note: the two long switch ties). The view is looking west.

1.4 Rail Operations

1.4.1 Train 351: Edmonton to Edson

After a good night of sleep (ending between 0700 and 0800) and a normal day's activities, the locomotive engineer, conductor and assistant conductor were called to duty at about 1445 on 12 August 1996 to take train 351 west to Edson Yard. They departed Edmonton between 1630 and 1640. The crew arrived at Edson Yard about four hours later (at 2040). The train met three trains and the crew performed no switching en route. On arrival at Edson, the crew made a "change-off" at Edson Station (adjacent to Edson Yard), transferring responsibility for westbound train 351 to another crew. At this point, the incoming crew from Edmonton had been awake for some 13.5 to 14.5 hours.

This crew was to perform car switching at Edson Yard and take train 404 to Edmonton. The crew reviewed a switching list, phoned the Chief RTC and obtained permission to come back on duty at 2145 to start their pre-departure switching. Yard locomotives were available at Edson Yard and the arrival of train 404 was not anticipated for two hours. The crew had gone off-duty at about 2130, and returned to work around 2145 and did not operate a train or equipment from 2100 to 2215.

1.4.2 Edson Yard Switching

The assistant conductor recalled that he expected to perform some switching before the arrival of train 404 at Edson Yard and that he and the other crew members were prepared for that. The locomotive engineer had been informed, before departing Edmonton, that train 404 was scheduled to depart Edson Yard at about 2345. The assistant conductor had estimated that it would take about one to one-and-a-half hours to perform the switching duties.

The assistant conductor further remembered that the crew had received permission from the Chief RTC to set out a crane and idler car rather than take them back to Edmonton. The crew was pleased with this because, had they been required to return with the crane, train 404 would have been speed-restricted to 25 mph. The return trip would have been much longer and may have required a relief crew to take over to avoid exceeding the hours of work limitations.

The switching duties were performed before the arrival of train 404 to minimize delay to its departure from Edson Yard. An elaboration on the pre-occurrence switching by the crew at Edson Yard is provided in Appendix 2.

As part of their switching responsibilities at Edson Yard, the crew were to switch a cut of 20 cars from cars that had previously been left on track 8. Then, these cars were to be marshalled on track 4 in consist order for train 404. This cut of cars would later roll uncontrolled through the east lead switch on track 4 and onto the main track to Edmonton.

The basic plan was to switch this equipment from the east end as follows: move the crane and idler car, along with two box cars, from track 8 to track 6; return the 2 box cars to track 8; and then move the 2 box cars, 6 gondola cars and 12 grain covered hopper cars from track 8 to the lead track. From there, these 20 cars were to be moved onto track 4. The order of cars from west to east was: 6 gondola cars, 2 box cars, and 12 grain covered hopper cars.

The 20-car cut was shoved further westward and stopped at 2305:55, with the east idling locomotive located one unit-and-a-half's length west of the east lead switch on track 4. The most easterly car was about 160 feet from the east lead switch.

1.4.3 Edson Yard: Car Securement

At 2300 on 12 August 1996, the weather at Edson Yard was as follows: temperature of 12 degrees Celsius with a west-north-west 6 km/h wind. There were scattered clouds, but many stars were visible. There was a quarter moon. Visibility was good. The conductor at Edson Yard recalled seeing stars in the sky and feeling a slight breeze when the cars were being secured.

1.4.3.1 Recall of the Assistant Conductor

The assistant conductor recalled that he initially climbed up and applied the hand brake on the second car in the 20-car cut. The hand brake wheel was located on the "B" end of this car and he thought that the "B" end was facing east. However, this recollection of the facts is not supported by the information from CN's automatic equipment identification (AEI) scanner.

The AEI scanner reports the location and time of the passing of railway equipment to the railway's car tracing computer system. It is capable of reporting car orientation at a given time. On 10 August 1996, car CNWX 109380 was identified by the AEI scanner at Yates on a westbound train as having its "B" end facing west. As well, the damage incurred to this car during the collision suggests that the "B" end was facing west, since the "A" end damage was more extensive than the "B" end damage.

The assistant conductor remembered that the hand brake on the second car went on "fairly quickly" and, when applied, it was "tight." He also recalled that he tied on the hand brake on this car while the cut of cars was moving westward. Then, he applied the hand brake on the next car (the first car, which was oriented "B" end east and immediately west of the most westerly locomotive unit) when the movement stopped.

The assistant conductor recalled that, when the locomotive stopped, the cut of cars was "stretched" to the west and that the "slack" on the stretched cut of cars "ran in" as he was standing on the platform and was applying the hand brake on the first car beside the locomotive. The "slack run in" made it unnecessary for the locomotive to be moved west to facilitate uncoupling the locomotives from the standing cars (using the operating lever on the left side of the "B" end of the car).

The assistant conductor also recalled that the hand brake on the most easterly car had a "long chain" (i.e., it appeared to take more revolutions of the hand brake wheel than normal to apply the brake). He recalled that there was nothing else unusual about the hand brake as compared to any other he had operated.He remembered that, at one point in this process, he went in between the two cars.

The assistant conductor recalled that, when the locomotives were uncoupled, he shone his switch lamp on the south front wheel (likely the left wheel on the "B" end) of the most easterly car to verify that it was not moving. Although he did not look at the brake shoes on any wheel, he remembered being convinced that the wheel he looked at did not move. He also estimated that it took three to four minutes to pull the two locomotives east, clear of the lead for the track 4 switch to be reversed and then move west on the lead to clear the switch.

1.4.3.2 Recall of the Conductor

The conductor did not apply any hand brakes to the 20-car cut, nor did he assist with their application. The conductor recalled that he heard the ratchet sound of one hand brake being applied while he stood at the east lead switch on track 4 close to the idling locomotive. He did not recall the length of time of the ratchet sound.

The conductor recalled seeing the assistant conductor's shadowy figure and lamp move beside the cars. He stated that the assistant conductor had walked the length of the most easterly car.

1.4.3.3 Recall of the Locomotive Engineer

The locomotive engineer recalled that the locomotives were standing on track 4 for about one-and-a-half to two minutes. This, in his mind, was sufficient time to put on two hand brakes. The best information available to the TSB indicates that the locomotives were stopped for 38 seconds (recorded time).

1.4.3.4 Subsequent Activities and Observations

The brake shoes were not observed nor were the locomotives moved to ensure that the hand brake was applying a retarding force on the 20 cars on track 4. Although the crew members were aware of the company requirement to look at the brake shoes, they claimed that they were not fully conversant with the company requirement (issued with the 28 April 1996 Time Table No. 4) to move the cars slightly to ensure that the hand brake was applying a retarding force. Procedural changes to operating rules, such as Canadian Rail Operating Rules (CROR) No. 112, appeared in bulletins at the time of the issuance of Time Table No. 4 to employees.

After the locomotives were uncoupled, they were moved eastward on track 4, over the east lead switch on track 4, clearing it by about half a locomotive's length. The conductor reversed the east lead switch to permit the locomotives to be returned to track 13 via the lead track. The assistant conductor was on the south-westerly end of locomotive CN4019. The conductor was on the north-westerly end of the locomotive. Both the conductor and assistant conductor said that they shone a switch lamp on the standing cars as they passed by them. No movement of the cars was apparent to these two employees at that time. The crew started to move to the track where the locomotives were to be left at a recorded time of 2307.

The assistant conductor recalled how positive he was that the cars were secured. He reasoned that, if they were not secure, they would have rolled into the locomotives as the locomotives moved away toward and over the east lead switch on track 4.

The locomotives were returned to track 13 at about 10 mph. After the locomotives were secured, shortly after 2310, the crew returned to Edson Station. The locomotive engineer called for take-out food at about 2320. At about 2335, he returned to the Edson Station. A short time later, the crew made a change-off with the incoming crew of train 404 which had just arrived at Edson Station. Train 404 was then moved to the signal at Edson East on track 1 where it was stopped. The locomotive engineer contacted the RTC to obtain a switching signal to make the lift from track 4.

The locomotive engineer recalled that the RTC sounded excited, and that he said he could not give the requested signal. He recalled that the RTC said that train 117 took the signal at Yates, that too much time had elapsed, and that he did not know what was occurring. At about the same time, the signal maintainer broadcast a radio message that he observed a fire at Yates.

The crew members at Edson Yard saw or heard no one in or about the yard as they were performing their switching duties or returning the locomotives. They did mention that, in the past they had seen transients and unidentified trespassers in the area. There was no fact found to suggest vandalism, sabotage or motives why anyone would intentionally choose to release a hand brake. The chronology of events suggests that the available time for a vandal to act was less than one minute.

The crew who placed the cars on track 4 attended the accident scene at Yates, helped search for the crew, assisted the first responders and remained at the general area of the scene for several hours.

1.4.3.5 Hours of Work

Train crew members said that they arose between 0700 and 0800 on 12 August 1996. When called to duty at 1445, they were tasked to take train 351 to Edson, and then bring train 404 to Edmonton. There was expected to be a break of about three hours between tasks.

Given that the trip back to Edmonton was expected to take about four hours, the Chief RTC would have anticipated the crew to have completed the task at around 0400. The crew would then have been awake for about 20 to 21 hours.

However, to expedite their departure, the crew chose to use the break between assignments to switch the cars (rather than doing the task after the arrival of train 404 at Edson). The 20-car cut on track 4 was secured shortly after 2300. At this time, crew members had been awake for about 15 to 16 hours. Given the four-hour trip back, the crew would have arrived at Edmonton at 0300, having been awake for some 19 to 20 hours.

1.4.4 Rail Traffic Control

1.4.4.1 Lead-Up

The Edson East RTC reported for duty at 2200 on 12 August 1996 and immediately had to deal with a 10 mph temporary slow order between Wabamun and Gainford. He recalled that he did not like the way the trains were set up and he prioritized the trains to better manage the traffic. He started to change things to clear up what he considered to be congestion. He altered a General Bulletin Order (GBO) on a train leaving Edmonton because it had no dimensional loads. He remembered that, because other RTCs were busy, he left his station to talk with them to get authorization for his planned changes. One of the RTCs was a new employee, a new employee on the GBO desk (often used as part of on-the-job training and not on a controlling assignment), and the Edson East RTC had to show him how to make the changes he wanted. He recalled that he was busy with duties that, by necessity, took him away from his desk and required him to deal with several matters at the same time.

The outgoing crew for train 404 at Edson stated that, at about 2245, they asked the RTC for a switch signal by radio and did not get an answer.

At about 2250, the RTC received a radio call from the crew of a train located at Leaman concerning a defective crossing, and difficulties were incurred in terms of the RTC clearly understanding what was wrong with the crossing and where it was located. Shortly thereafter, the Edson crew started placing the cars that were later to run away on track 4.

At about 2254, a foreman called the RTC requesting a Track Occupancy Permit (TOP) to operate on the Edson Subdivision from Edson East to Wolf Creek Siding. The TOP was given to the foreman so that the foreman would have main track authority to operate a track unit and perform track work in the specified area. Signals governing train movements into the proposed limits were "blocked at stop" and the TOP was made complete.

1.4.4.2 After Placement of Runaway Cars

The RTC discussed a defective crossing problem with the Signals and Communications Group at Walker Yard. At about 2307, a train was reported to the RTC to be in emergency on the south main track near the Sundance Spur. The RTC arranged protection against other train movements and notified trains of the emergency situation. This took until 2315 to complete.

As the RTC was taking care of these matters, the runaway cars had very slowly moved east on track 4, then accelerated through the east lead switch on track 4 and activated the annunciator circuit west of Mile 128.6 at Edson East. At 2312:43, a single bar light turned yellow on the RTC panel. This was as a result of the runaway cars entering the annunciator circuit. The RTC, however, did not observe this bar light when it turned yellow. This was the first time that the RTC could have assessed a possible runaway situation, recognizing that the presence of a single bar light could also mean that a track circuitry malfunction or other events had occurred.

While the RTC was still resolving the problem at Sundance Spur, the runaway cars entered the south main track at the controlled location at Edson East at Mile 128.6 at about 2313:04. At that time, three bar lights were illuminated yellow, signifying the occupancy of the annunciator and the crossover controlled location circuits. At 2313:49, four bar lights were lit, signifying that the runaway cars had entered the block that started at Mile 128.5 and were also occupying the annunciator and the crossover controlled location circuits. The RTC recalled that he did not see these indications. The RTC had not been trained or given specific instructions by CN to consider this situation as one consistent with a runaway.

At 2314:23, the bar light for the annunciator circuit went out, signifying that the most westerly car of the runaway cars had passed the annunciator circuit, leaving three bar lights lit. Then, at 2315:08, two more bar lights extinguished, indicating that the runaway cars had left the controlled location circuit. One bar light was left lit at that time. The RTC did not see these changes to the bar lights. Such bar light illumination/extinguishment sequences indicate a movement of equipment on the track.

1.4.4.3 Potential Problem First Noticed

At about 2317:25, the foreman arrived at Wolf Creek Siding, was in the clear and radioed the RTC to cancel his existing TOP and obtain a new TOP. During that conversation, the RTC first noted that a bar light on his panel was yellow. The RTC correctly interpreted that it was the bar light to signify occupancy of the block immediately east of the controlled location at Edson East at Mile 128.5. According to the RTC, there had previously been a lot of false alarms, triggering the yellow bar lights, in the Edson area.

The RTC said that the first yellow bar light he saw was just another "block down" and he explained that blocks go down for a multitude of reasons including low voltage, broken rail and track electrical shortages. Similar indications are also known to be attributed to snowmobiles crossing the tracks, trespassers putting a metal bar across the tracks, and storms. The RTC pointed out that, if three bar lights had gone down, that would have indicated to him an uncontrolled movement of cars. The RTC indicated, however, that he did not have a complete knowledge of the detailed technical aspects of the signal system.

At about the same time, the RTC asked the foreman at Wolf Creek Siding if there was anyone else behind him on the south track. The RTC recalled that he did not want to cancel the foreman's TOP, if that was the case. The foreman explained to the RTC that there was no one else working in the area. That conversation ended at about 2321, at which time the RTC phoned the Signals and Communications Group for a signal maintainer because of the "block down" on his panel. This call was made about 10 minutes before the collision and approximately 15 to 16 minutes after the runaway cars had been left standing at Edson Yard on track 4.

A conversation between the RTC and a Signals and Communications employee ensued concerning the single bar light indication and the possible location of the problem. It was agreed that a signal maintainer would look into the problem (which was said to be at about Mile 128).

At about 2323, the RTC responded to another call for location clarification, presumably from the Signals and Communications Group, and explained that the problematic block was the first block east of the controlled location at Edson East on the south track. At about the same time (2323:31), the runaway cars entered the block between Mile 126.4 and Mile 123.0. Two additional bar lights had illuminated, signifying that occupancy, which was not observed by the RTC.

The track panel display is equipped with a total of three bar lights between the controlled location at Edson East and the controlled location at Yates on the south track. One bar light is assigned to the first track circuit east of the controlled location at Edson East and the other two are assigned to the next track circuit east. Even while the RTC was discussing the location of the problem, the bar light status changed and that change, again, signified motion. The sequence of bar light changes was not observed by the RTC.

When the most westerly runaway car passed Mile 126.4 at about 2324:05, only the two bar lights for the block for Mile 126.4 to Mile 123.0 were recorded as being yellow. This change in warning status was not observed by the RTC.

1.4.4.4 After Train 117 Passed Wolf Creek

The leading locomotive of train 117 passed the east switch at Wolf Creek about three-and-a-half minutes before the collision. The two bar lights turning yellow at 2327:49 on the RTC panel indicated that train 117 was passing by the Wolf Creek Siding. At 2329:08, the RTC panel recorded and indicated that the lead locomotive of train 117 had just passed the west switch of Wolf Creek Siding, and the bar lights also indicated that the block from that switch to Mile 122.9 was occupied. The RTC did not see these bar lights.

At 2330:01, about one minute before the collision, the RTC received a radio call from the foreman at Wolf Creek Siding. The foreman was requesting another TOP to re-enter the main track from the west end of Wolf Creek and work between the siding switches at Wolf Creek. The RTC issued the TOP but did not make it complete. He told the foreman that the foreman would have to wait until the tail end of train 117 cleared at Yates (which would be about 30 seconds) before the RTC could complete a TOP to permit the foreman to re-enter the main track at the west switch of Wolf Creek Siding. At about this time, the RTC noticed that two bar lights were yellow on his panel for the next block east of where he had first reported the block down and that the bar light for the block he reported down was now extinguished. The RTC did not attribute this change to runaway cars.

1.4.4.5 Observations of the Edson West Rail Traffic Controller

The Edson West RTC came over to the Edson East RTC's desk at about 2324 to check on the progress of train 117 as it would soon move onto his territory. He observed the single bar light for the track circuit immediately east of the controlled location at Edson East and then observed the two bar lights for the next track circuit illuminate yellow and the previous bar light extinguish. The Edson West RTC did not recognize that the sequence of these events indicated an unauthorized block occupancy with movement. Instead, he made a comment to the Edson East RTC to the effect that vandals were somehow shorting out the signal system. This comment served to reinforce the Edson East RTC's original assessment that the lights were associated with a track or signals problem.

1.4.4.6 After the Collision

At about 2334, three minutes after the collision, the RTC said to the foreman at Wolf Creek that train 117 was a little slow. The foreman then asked if the RTC had solved his problem on the south track; the RTC responded that there was still a problem.

Between 2335 and 2336, the RTC commented to the foreman that the train appeared to have stopped and that he did not know what the problem was. The RTC said that it looked as though he had lost his CTC at Yates and he could not confirm that the train had passed by.

The RTC computer had lost communication with the field at Yates (the panel was "in monitor"). This was consistent with the signal bungalow at Yates being destroyed in the aftermath of the collision.

An RCMP officer in Edson phoned the Manager, Corridor Operations (MCO) at the rail traffic control office shortly thereafter to say that she had received three phone calls saying that a train and a "bang" had been heard in the Edson area. The MCO talked with the RTC and the RTC radioed train 117 but got no answer. The RTC said that he thought there had been a derailment. The RCMP officer phoned back later and confirmed that there was a fire and an accident.

After a number of unanswered radio calls to train 117, the RTC called the foreman at Wolf Creek Siding at 2341 and explained that he thought there had been a derailment at Yates.

At 2342, a signal maintainer called the RTC to get permission to go on the track at Mile 126 to check the previously identified "block problem." At 2346, the signal maintainer agreed to look into the possibility of an accident at Yates.

At 2350, the Edson crew that had set off the 20 cars on track 4 asked for a switch signal at Edson Yard. The RTC explained that there was a problem at Yates and asked them to stay where they were.

At about 2352, the signal maintainer called the RTC to inform him that there was a fire at Yates and that the signal bungalow had been taken out.

At about 0002, on 13 August 1996, the RTC communicated to the district engineer that he thought some cars had run out of Edson on the south track and hit a train at Yates, as the signal maintainer could see gondola cars on the south track west of the fire at Yates.

Later, at 0024, in discussion with the signal maintainer, the RTC said that "when I first phoned signals [Signals and Communications] to call you out, the first block east of Edson East on the south track was down, all of a sudden it dropped and then after I talked to signals and you were called out, the second block picks up like the next block down the line ...." The signal maintainer replied, "... just like a train." In retrospect, the RTC said that he had come to realize that the panel's yellow bar light indications were consistent with cars rolling out of Edson Yard.

The Edson East RTC explained his understanding of the bar lights. He said that, normally, when a train leaves Edson Yard and heads east, three bars lights illuminate on his panel simultaneously. This time, the first indication he saw was a single bar light. The RTC recalled that he did not know that there was switching activity in Edson Yard on the night of the occurrence nor did he know that the derail had been removed. In this latter respect, the RTC had worked at Edson Yard well prior to the removal of the derail. The Edson East RTC is not normally aware of switching activities at Edson Yard unless those activities require the use of the controlled location at Edson East.

The RTC remained at his post for the balance of his shift assisting as required.

1.4.5 Train 117

At approximately 2306, train 117 was operating through Niton, 23 miles east of Yates. At about 2310, the train was between Niton and Peers, travelling at a speed of 54 mph with the throttle in position No. 8. At approximately 2312, train 117 reduced speed to comply with a slow order at Mile 105.4. The train accelerated back to 55 mph at 2317 as it travelled through Peers, Mile 109.8.

Approaching Wolf Creek, at 2325, the train was about five miles from Yates. At about 2329, it was travelling by Wolf Creek at a speed of 55 mph in throttle position No. 8. At 2331:08, train 117 was travelling at 54 mph in throttle position No. 8 when an emergency brake application occurred. The locomotive event recorder on the second locomotive (CN9575) indicated that the movement stopped at 2331:18, about 25 minutes after the 20 cars were left standing on track 4 at Edson Yard.

1.4.6 Unauthorized Passenger

An acquaintance of the conductor on train 117 was invited to ride in the cab of the lead locomotive. The company was not made aware of this arrangement nor did it authorize this individual to ride on train 117.

1.5 Damage

The collision site comprised an area about Yates that was approximately 700 feet long by 200 feet wide and bordered to the north and south by spruce forest. Some 200 yards to the east is a railway bridge over the McLeod River.

1.5.1 Train 117

The first two locomotives (CN9627 and CN9575) at the front end of train 117 were destroyed and the third locomotive (CN9508) was repaired and returned to service. The event recorder on the first locomotive was destroyed in the collision and fire. The event recorders on the second and third locomotives were successfully recovered and downloaded. There was no indication of pre-occurrence malfunction for either of these two locomotives.

On impact with the "B" end of the first runaway car, leading locomotive CN9627 had its front folded into the cab. It landed on its right side with the cab near the ruptured fuel tank. The resulting fire burned the crushed lead locomotive body. Locomotive CN9627 became separated from its trucks, diesel engine and fuel tank as it was propelled southward. Locomotive CN9575 derailed to the north as it collided with the second runaway car which derailed to the north.

On impact, both long hood ends of the first two locomotives separated and the second locomotive went under the lead locomotive. The second runaway car struck the second locomotive as the locomotive fell onto its side.

The third locomotive, stopped suddenly by the impact, remained upright and was forced downward into the roadbed on its leading long hood end.

Diesel fuel leaked from punctures in the fuel tanks of the first two locomotives. Apart from feeding the fire, the fuel contaminated the ground in the immediate impact area. Contaminated soil was later excavated and removed from the site.

There were 31 articulated car platforms derailed immediately behind the locomotives on train 117. Figure 11 is a photograph indicating the degree of damage these cars sustained. There was no indication of pre-occurrence malfunction of these cars.

1.5.2 Runaway Cars

The leading 5 of the 20 runaway cars were derailed and severely damaged. The leading two cars were critical to this investigation for they were the cars on which the hand brakes had reportedly been applied. The hand brake gearing mechanisms from the first two cars, as determined by matching damage marks, soil samples and witness statements, were recovered and forwarded to the TSB Engineering Branch. Along with the two hand brakes mechanisms, five wheel sets from the first two cars, as determined by matching wheel numbers to repairs records, comparing wheel and axle bearing numbers and witness marks, were also recovered and forwarded to the TSB Engineering Branch.

These two cars essentially were split in half by the impact and their wreckage was strewn over an area comprising 20,000 to 30,000 square feet.

Figures 12 and 13 depict the remnants of the lead and second runaway cars respectively (CNWX 109099 and CNWX 109380).

These cars measure 59 feet long, have a tare weight of approximately 62,000 pounds and a loaded weight of about 263,000 pounds. This type of car was jointly designed by the railways for carriage of Canadian grain and constructed by three Canadian rail car manufacturers: National Steel Car, Hamilton, Ontario; Marine Industries, Sorel, Quebec; and Hawker Siddeley, Trenton, Nova Scotia. Although these cars have been manufactured by three companies, the basic design does not differ from one manufacturer to another.

These cars were first introduced in the early 1970s and presently number about 19,000. They currently have an average age of about 17 years, the vast majority ranging from 7 to 24 years old. There are more than 250,000 covered hopper cars of all varieties in North America. In 1994, 83 additional Government grain covered hopper cars were purchased.

These cars are owned by the federal Government and are designated for use by both CN and CP. The car designation numbers signify to whom they are assigned. Those in service on CN are designated series CNWX 100000 to CNWX 112999 and series CNWX 395000 to CNWX 396999.

1.5.3 Track

Approximately 430 feet of track was damaged at Yates, on the equilateral turnout, and the single main track to the east, where the cars from train 117 piled up. A 1,000 gallon-capacity propane tank for the dual control switch heater, located immediately north of the switch, sustained minimal damage and did not release any product. The switch points and ties under the equilateral turnout at Mile 122.9 had to be replaced. There was no indication of any pre-occurrence deficiency in the rails, roadbed, ballast or other aspects of the track.

1.5.4 Track Circuitry and Signals

The CTC signal mast and bungalow at Yates were damaged beyond repair. The AEI scanner was destroyed.

1.6 Key Employees -- Experience, Qualifications and Fitness

1.6.1 Assistant Conductor (Edson)

The assistant conductor at Edson Yard commenced service with the railway on 06 June 1984 as a trainman/yardman. On 12 January 1987, he was promoted to conductor/foreman, and on 24 August 1992, he qualified as a locomotive engineer. The assistant conductor had passed his last medical examination on 22 December 1995 and was declared fit for duty.

On 09 August 1996, the assistant conductor worked a train to Wainwright and returned to Edmonton on another train; he went offduty at 0240 on 10 August. After a normal night of sleep, he spent the day with his family and did not go back to work until 11 August, when he worked a train to Edson, returned to Edmonton by taxi and was offduty at 1415. After a normal night of sleep, the assistant conductor was called at about 1445 on 12 August to work train 351 to Edson.

1.6.2 Conductor (Edson)

The conductor at Edson Yard commenced service with the railway on 04 July 1977 as a trainman/yardman and he was promoted to conductor/foreman on 31 July 1979. In August 1982, he qualified as a locomotive engineer.

On 17 July 1996, the CN Medical Department declared that he was fit for normal duty.

The conductor, after several weeks' vacation, returned to work on 10 August 1996, after which he spent time around his home and waited for a call to go to work. He went to bed at about 2200 and was called on 11 August for 0645 to taxi to Wainwright and work on a train to Edmonton, arriving in Walker Yard and going offduty at 1630. He went to bed early on 11 August and said that he awoke refreshed on 12 August. He was called to go to work on train 351 at about 1445 on 12 August.

1.6.3 Locomotive Engineer (Edson)

The locomotive engineer at Edson Yard entered service with the railway on 22 May 1975 as an agent/operator at various locations in Saskatchewan and Manitoba. On 07 July 1978, he was hired as a trainman/yardman and worked at various locations in western Canada until July 1982 when he moved to Prince Rupert, British Columbia. On 08 April 1982, he qualified as a locomotive engineer and he worked as such in Alberta and British Columbia. During April 1987, he completed the Operations Trainee Program and was appointed as a master mechanic at Prince George, British Columbia. In April 1988, he transferred to Edmonton in the same position. On 31 December 1991, he was appointed Manager, Train and Engine Service, and remained in that position until 02 October 1993, when he returned to the scheduled ranks as a locomotive engineer working out of Edmonton.

On 27 September 1994, the locomotive engineer passed his medical examination and was declared fit for duty.

The locomotive engineer had not worked the weekend before being called for train 351 at about 1445 on 12 August 1996. He had a normal night of sleep on 11 August 1996.

1.6.4 Rail Traffic Controller (RTC) (Edson East)

The Edson East RTC commenced service with the railway on 23 May 1980 as a yard clerk at Jasper and worked at various positions. Until 02 May 1988, he worked as an operator at Jasper and other locations around Alberta until his position was abolished in 1990. He then worked as a train movement clerk at Biggar and Edmonton and, on 06 January 1991, he became a student RTC at Edmonton. Upon completion of his training period on 15 June 1992, he qualified as a RTC in the Edmonton RTC office.

The RTC passed his last medical examination on 14 November 1995 and was found fit for duty.

The RTC worked the Edson East Subdivision desk from 2300 to 0700 from 02 August to 12 August. On Monday, 12 August, he slept from 1100 to 2000. He ate a meal at about 2100 and reported for duty at 2200 (one hour early to repay another RTC further to a previous mutual agreement).

1.7 Medical Testing

CN tested the Edson Yard conductor, assistant conductor and locomotive engineer for drugs eight days after the occurrence on 20 August 1996. The Edson East RTC was drug-tested 10 days after the occurrence, on 22 August. The urine tests were carried out under the direction of CN's Chief Medical Officer, who screened for the presence of cocaine, opiates, cannabis, amphetamines and PCPs. The results of all four drug tests were negative.

1.8 Safety and Supervision

1.8.1 Safety Responsibilities

Section 8.0, CN Operations Safety Rules, of CN's General Operating Instructions (GOI) outlines the safety responsibilities of company management, supervisors and employees. A key statement therein follows:

All managers, supervisors and employees of CN share the responsibility for developing and maintaining a safe and healthy work environment.

Management's responsibilities include the following:

Provide the necessary information, instruction and training to employees; and ensure supervision required to maintain the safety and health of those employees under their control .... Ensure the ... equipment ... used by employees under their control meet the prescribed safety standards and are safe under all conditions of intended use .... Appoint competent and qualified personnel to supervise other employees.

Supervisors' responsibilities include the following:

Ensure that safe work methods, standards and procedures are followed by all employees working under their supervision and that specific safety instruction is given as required .... Under no circumstances shall safety be compromised for speed .... Have adequate knowledge of the regulations and policies concerned with safety within their area of control ....

An employee's responsibilities include the following:

Carry out the required tasks, as instructed or directed, following approved practices and procedures .... Understand and comply with the rules .... Work in such a manner as to ensure that they do not: create a hazard to themselves or others; injure themselves or others; damage property ....

1.8.2 Supervision

1.8.2.1 Reporting Relationships

During 1990, there were two train masters located at Edson for the supervision of the operating crews in Edson Yard, and on the Edson, Foothills and Mountain Park subdivisions. At that time, yard supervision at Edson was provided by yard coordinators and train clerks. At the time of the occurrence, there was only one yard coordinator left at Edson Yard, working five days per week on day shift. Supervisory responsibility had been relocated to Jasper in 1990.

There was no direct supervision of the train crew at Edson Yard at the time of the occurrence. Under the provisions of CROR Rule 106 d), the conductor and the locomotive engineer are responsible for the safe operation of the train or equipment in their charge and for the observance of the rules. Edson was being operated primarily as a run-through point. Train crews in the area were under the supervision of a Manager of Train Services located in Jasper (104 miles away). The organizational charts for CN Transportation for BC South and Alberta Districts are presented in Appendix 3. Reporting relationships for both 1990 and 1996 are provided.

Edson Yard was maintained by a Maintenance-of-Way Foreman and crew who reported to a Track Supervisor in Edson. The organizational chart for CN Engineering for BC South District is found in Appendix 4, with reporting relationships for both 1990 and 1996.

1.8.2.2 Rail Traffic Control Office

The Edson East RTC reported to the Chief RTC, who in turn reported to the MCO in Edmonton. The MCO at Edmonton was responsible for 24 RTC desks. The RTC and Chief RTC are both located in Edmonton.

1.8.2.3 Canadian National

With respect to training on hand brake application techniques, CN managers interviewed by the TSB were of the opinion that no recurrent training was required for an employee after initial qualification. Although it was agreed that a large volume of rules and instructions was presented during this phase of training, it was generally felt that the practical on-the-job training (coupled with the initial theory training) would produce fully trained employees.

Operational employees were supposed to be supervised by "supervision rides." However, according to District Supervisors, there was no formal plan to ensure that every crew member was occasionally monitored or to specify the required frequency of these "rides." According to railway system management, there was a formal plan in existence at the time of the occurrence. The last supervised ride (en route train inspection) that involved the assistant conductor at Edson Yard was on 27 April 1994 (28 months before the collision).

For several years, CN has had in place an Assistant Vice-President of Safety and Regulatory Affairs. At the time of the occurrence, this position, which reported to the Senior Vice-President of Operations, headed up safety for all of CN. Other responsibilities of the position include regulatory affairs, transportation of dangerous goods and occupational health services.

With the removal of the derail at the east end of Edson Yard, supervisors were relying solely on the knowledge and ability of employees and their appropriate application of CROR Rule 112 and associated special instructions to secure cars at this location. A new employee to this area was expected to seek the advice of senior employees to provide guidance on the securement of cars at Edson. Neither additional training sessions nor formal information exchange meetings were held to assist employees in effectively securing cars at this location.

The MCO explained that, when an unauthorized occupancy appears on the control console, the company policy was for the RTC to immediately contact the signal maintainer to further diagnose the problem. This approach does not provide "fail-safe" protection from runaway cars.

The crew involved in securing cars at Edson Yard stated that there was very limited supervisory presence in recent years. They stated that, even when the supervisor did accompany a crew, instructions were never given about the proper securement of cars at Edson.

There was no formal supervisory program setting requirements for the methodology and frequency of supervisory activities to be carried out on train crews on the territory encompassing Edson. Supervisors were encouraged to engage in proactive supervisory activities, but basically as they saw fit. CN advised that recurrent training concerning car securement included rules re-qualification discussions and corrective action taken during supervisory observations, but did not incorporate a regular formalized hands-on training regimen.

1.8.3 Transport Canada

The railway safety regulator is Transport Canada (TC). TC's formal mission is to "... develop and administer policies, regulations and services for the best possible transportation system."

TC is responsible for administering and enforcing the provisions of the Railway Safety Act, which has, as an underlying philosophy, the following definitions of role for regulation and for railway management:

• railway management must be responsible, and accountable, for the safety of operations;
• the regulator must have the power to protect public and employee safety.

TC conducts its role through a combination of monitoring, auditing and inspection efforts. However, it is TC's view that it is the railways who are responsible for the safety of operations.

1.9 Hand Brakes

1.9.1 Function

The hand brake on the Canadian Government grain covered hopper car basically functions the same as the hand brakes on most other railway cars. It is a mechanical system that operates independently from the air brake system.

A hand brake applies brake shoe force to the wheel treads to prevent or retard motion. For Government grain covered cars, the rigging is offset from the centre line axis of the car. Testing showed that when the hand brakes are applied, there is an asymmetrical loading of the brake shoes, with much more brake shoe force on one side versus the other, and on one end of the car versus the other.

Appendix 5 provides additional information on the design and function of the hand brake. The working relationship between the components of the mechanism and performance criteria are elaborated on.

1.9.2 Operating Rules and Practices

1.9.2.1 Pre-Occurrence

Before this occurrence, CN employees responsible for securing cars had been provided with rules and instructions intended to ensure that hand brake applications were sufficient to keep cars stationary. These instructions included CROR Rule 112 and related special instructions. Rules were formally communicated to employees during initial training sessions and through the recurrent rules re-qualification. Special instructions were disseminated via periodic bulletins to employees.

CROR Rule 112 reads in part:

Unless otherwise directed by special instructions, a sufficient number of hand brakes must be applied on equipment left at any point to prevent it from moving. (emphasis added by TSB)

On page 7 of the Regional Data Section of the CN Operating Manual, items 26 and 27 were brought into effect on 28 April 1996, three months before the occurrence, stating:

26) Rule 112 - Special Instruction Securing Equipment
In the application of Rule 112. At all locations, unless indicated by special instructions, such as those found in terminal operating manuals, time table footnotes or bulletins that cover situations with respect to hand brake applications, equipment left standing must have a sufficient number of hand brakes applied to prevent them from moving. The minimum number of hand brakes is defined as at least one. (emphasis added by TSB)

27) Rule 112 - Special Instructions Securing Equipment
Before relying on the retarding force of the hand brake, whether leaving equipment or riding equipment to rest, the effectiveness of the hand brake must be tested. After applying the hand brake, check to see that the brake shoe has moved against the wheel tread and move the car slightly to ensure the hand brake is applying a retarding force

The TSB questioned 49 CN locomotive engineers across the country as to the likelihood of their being able to determine a retarding force from the slight movement of varying cuts of cars after the application of hand brakes and the likelihood of determining if the applied hand brakes were sufficient to secure the cars. Test results show that, within the sample, there is a wide variation in the locomotive engineers' opinion on their ability to ensure a sufficient hand brake has been generated by shoving stationary cars. The results from this survey are in Appendix 15.

Section 8.0, CN Operations Safety Rules, subsection 17 of CN's GOI outlined the company's requirements in terms of operating hand brakes. However, these pertain mainly to minimizing employee injury during application.

Subsection 17.3 is of relevance to this occurrence:

Visual check of hand brake components including brake wheel, lever, pawl, ratchet and chain, to be carried out before operating hand brake, and any defects found reported immediately to supervisor.

T he pawl and ratchet and parts of the gearing mechanism of the hand brake components on the grain covered hopper cars are enclosed within the mechanism housing. As such, some problems with these components of this hand brake are difficult to detect.

When derails were removed from Jasper Yard, local instructions were issued that required a minimum of six hand brakes to be applied to all trains yarded at Jasper when the locomotives were removed from the train. Similar instructions were not issued at Edson Yard when the derail was removed. Both yards had similar grades and were supervised by the Assistant Superintendent in Jasper.

1.9.2.2 Post-Occurrence

After the occurrence, CN issued a number of new special instructions, as follows:

1. A "Minimum Handbrake Application Chart" outlining the minimum number of hand brakes that must be fully applied to secure equipment:
   • 1 car: 1 hand brake
   • 2 to 19 cars: 2 hand brakes
   • 20 to 29 cars: 3 hand brakes
   • 30 to 39 cars: 4 hand brakes
   • 40 to 49 cars: 5 hand brakes
   • 50 to 59 cars: 6 hand brakes
   • 60 to 69 cars: 7 hand brakes
   • 70 to 79 cars: 8 hand brakes
   • 80 to 89 cars: 9 hand brakes
   • 90 + cars:    10 hand brakes
2. On 18 October 1996, the Great Plains District was issued a series of locations with additional instructions specific to car securement practices.
3. CN also provided a series of "Guideline Points" for the above special instructions geared toward CROR Rule 112. They include the following:
   1. Hand brakes must be left on unattended equipment as per the "Minimum Handbrake Application Chart."
   2. If physical conditions at specified locations dictate that additional hand brakes need to be applied, such information will be indicated in Special Instructions, Terminal Manuals or Subdivision Footnotes.
   3. If physical conditions at specified locations dictate that no hand brakes need to be applied, such information will be indicated in Special Instructions, Terminal Manuals or Subdivision Footnotes.
   4. Hand brakes must not be applied when equipment is being pulled or pushed by an engine.
   5. When cars are moving under their own momentum, hand brakes may be applied. When such movement comes to rest, check to see the brake shoe is applying a retarding force.
   6. Hand brakes must not be applied when the brake piston is extended. Hand brakes must be applied when the brake piston is "in", either from bleeding the car off or when the air brake system has fully released the brakes.
   7. If known, hand brakes should be applied at the low end of the track.
   8. Rule 112 is written in terms of "equipment left" and in this regard a train operating in pick up service or when a train is setting out cars, is not defined as "equipment left." To this end, if a train stops to pick up or set out cars, the train need not be secured by hand brakes when the requirements of GOI 7.2 (k) have been complied with. However, in saying this, such is not the case when the train left standing on the main track is not viewed by the crew as such eliminates the ability to generate an emergency application of the air brakes from the IDU (the Information and Display Unit).
   9. When switching is such that a track is being built, each cut of cars must be secured, however, as such is still being attended, full application of the hand brake chart need not be complied with until the entire track is made up. When made up, the full hand brake application as per the chart must then be complied with.

1.9.3 Training

In respect of the CROR and related special instructions, and other subjects mandated by TC's Minimum Qualification Standards Regulations, crews have a mandatory requirement to re-qualify every three years. Only during initial trainman/yardman training are new employees formally instructed in the practical aspects of the application and release of hand brakes. As part of the initial training, candidates are required to work under the supervision of experienced employees. This on-the-job training is heavily relied upon for the teaching of practical skills such as hand brake application and release, and the determination of what constitutes a "sufficient" number of hand brakes to ensure car securement.

The initial training of the crew members at Edson was 12 to 19 years before the occurrence. Their last rules class was one to two years before the occurrence. TC's regulation 10(1) states: "A railway company shall, at intervals of not more than three years, have each employee in an occupational category re-examined on the required subjects."

To the assistant conductor's recall, his initial hand brake application training involved students climbing the ladder on a freight car, assuming the correct position and applying and releasing the hand brake. His training did not include determining what would constitute "sufficient" hand brakes in all circumstances.

There were never any recurrent practical training programs, aside from rules re-qualification and information dissemination sessions. There did exist, with respect to most aspects of work, an informal system of training which involved experienced employees passing on their knowledge and skills, including the way to secure cars.

The focus of the CN Operating Practices Department is set in accordance with trends that emerge from a perusal of TC monitoring/auditing reports and from random feedback from front-line supervisors. Training is currently contracted out to CANAC (CN's consulting services subsidiary). Trends are communicated to the contractor so that training programs can be altered accordingly. In addition, CN evaluates accident data, performs trend analysis and conducts detailed root cause analyses of accidents often leading to training recommendations. Consultation with other railways occurs on operating rules and training issues through membership in the Railway Association of Canada (RAC) and the Association of American Railroads (AAR) Operating Practices Sub-committees.

In terms of effecting change to operating practices, CN participates as a member of the RAC and is represented on the operating rules committee of the RAC. Any changes to operating rules are submitted to the Minister of Transport in accordance with the provisions of the Railway Safety Act. The railway company can also issue special instructions to make an approved operating rule more restrictive without obtaining TC's approval.

1.9.4 Testing and Observations

Prior to this accident, railway and government experts alike focused their analysis of increases in reported runaways on adherence to CROR Rule 112 and, to a lesser extent, on the training and supervision of train crews. As a result of this accident, CN and the TSB undertook extensive testing of the performance of hand brakes on Canadian grain covered hopper cars. These tests produced significant new information about how hand brakes perform under varying circumstances. Information garnered from testing is presented in Appendices 6 to 12.

Appendix 6 summarizes test results for hand brake performance on CNWX cars. Testing related to brake shoe force variations, the relationship between wheel torque and brake shoe force, tapping effects, performance reliability, mechanism workings, lubrication and ratchet sounds. This test established the significant variations that can exist in brake shoe force from wheel to wheel on the same CNWX car (when the same chain tension is achieved). Also, it found that the total brake force could vary considerably from car to car with the same chain tension.

The results of a hand brake application survey of random standing cars across Canada are found in Appendix 7. A total of 64 cars were tested. The measured torque varied from 20 to 180 foot-pounds, with a mean of 78 foot-pounds and a median of 65 foot-pounds.

Appendix 8 presents results for the Main Vertical Lever Roller Condition Survey on Government grain covered hopper cars. None of the 521 cars tested had defective or missing rollers. However, some cars had markings on the shear plate which indicated that the main lever was reaching, or was close to reaching, the end of the slot when the hand brake was applied.

Based solely on the wheel examination, it was not possible to readily determine if the brakes on the first or second car had or had not been applied at Edson Yard or to what degree. (Reference: Appendix 9.)

Appendix 10 provides information on the examinations of the hand brake assemblies of the first and second runaway cars. On the first car's brake assembly, witness marks left by crush damage and from the jammed position of the chain drum pin were consistent with original torque being applied to the hand brake. There was no indication that the hand brake on the second car had or had not been applied, based on the examination of its condition after the collision.

Testing results on the braking requirements for a similar 20-car cut on track 4 at Edson Yard and simulation modelling are presented in Appendix 11. In all, 14 simulation tests were conducted employing different hand brake applications on the two most easterly cars. It was determined from the speed and hand brake simulations that:

for one hand brake on, the chain tension probably was between 3,560 and 4,340 pounds (and the average wheel torque was estimated to be about 64 to 78 pounds), and

for two hand brakes on, the chain tensions, brake shoe forces and hand brake wheel torques probably totalled the equivalent braking resistance of one car with a chain tension of 3,560 to 4,340 pounds.

Appendix 12 provides additional information on CNWX design approval, and maintenance requirements and compliance.

1.9.5 Transport Canada

TC's standards for the design of hand brakes and rigging are consistent with those of the AAR. After the Edson occurrence, TC regulatory staff brought forward that the hand brakes on the grain covered hopper cars were asymmetrical in design and had other peculiarities. However, they observed that the design did comply with the standard.

TC officials tested approximately 1,000 hand brakes on Government grain covered hopper cars after the Edson collision to determine whether they functioned. All functioned to the extent that the hand brake caused the brake shoes to apply against some wheel treads. No brake shoe forces were measured, hence the tests did not determine the degree of braking force occasioned by hand brake application.

1.9.6 Transportation Safety Board

In 1992, following several occurrences involving runaway cars, the TSB was concerned that the railways' education and awareness programs were insufficient, and questioned the effectiveness of supervision to ensure that the correct procedure was being followed to secure standing cars. Consequently, although there was no problem with the prescribed operating procedures for securing standing cars identified at the time, the TSB recommended that the Department of Transport conduct a field assessment of the adequacy of training and supervision by Canadian railways to ensure that personnel are correctly applying standard operating procedures when securing standing cars (R92-14, issued September 1992).

TC responded to this recommendation by agreeing with the TSB that training and supervision were possibly linked to non-compliance with the existing rules and regulations associated with securing railway equipment. TC more recently advised that it had taken actions directed at CROR Rule 112 violations well before the Edson occurrence. In December 1995, TC produced a report entitled Report on Railway Supervision and Training, ASR 095-02, which was noted by CN and served as input to the CN "revitalized" safety programs.

1.10 Rail Traffic Control

1.10.1 Functions

A RTC is responsible for controlling train movements, track unit movements and track work activities on assigned subdivisions. This includes providing protection for track maintenance activities, reporting all known defects or unsafe track conditions, and planning and prioritizing such activity. A RTC has to receive and issue additions to Tabular General Bulletin Orders (TGBOs), and receive and issue GBOs regarding track condition restrictions and other information which affects the safety of train movements. Functions also include issuing and cancelling clearances, responding to requests for TOPs, and responding to field communications from any train crews on the RTC territory.

From time to time, this work requires a high level of vigilance to maintain safe operations. Recognizing the normal planning and support tools the railway has in effect, the RTC has to optimize productivity through minimum delay to trains while ensuring maximum track time for maintenance activities. Achieving this goal requires an ability to engage in several parallel activities, without compromising concentration and accuracy. Administrative functions, as well as central communication responsibilities and planning, demand that a RTC be strategic and analytical in the performance of tasks at hand.

1.10.2 Centralized Traffic Control System

The CTC is an independent train control system designed for high traffic density territory such as the Edson Subdivision. Train movements are governed by signal indications. Within CTC, there are controlled locations at which the RTC can control switches and set controlled block signals at stop, or request that they display a permissive signal indication.

The RTC does not normally know the exact permissive indication that results. Signals between controlled locations are not controlled by the RTC but are actuated automatically by the rolling stock that approaches them. The signal indications displayed are also dependent upon the condition of the blocks into which the signal governs movements. Track unit and track work activities are controlled through the issuance of authorities or flag protection. The RTC must establish signal blocking protection before issuing authorization to a foreman.

The RTC office controls for the CTC system in use on the Edson Subdivision are located on a 180-degree curved panel that encircles the forward view of the RTC from his seat. The traffic monitoring display panel includes a basic diagram depicting the controlled locations with spaces between. In the spaces between controlled locations, straight horizontal lines depict the tracks. Grade and curvature are not depicted and the diagram is not to scale. Bar lights are illuminated to indicate track occupancy or signal or track malfunctions. The bar lights are not directly within the RTC's normal line of vision.

In CTC, the office controls are connected to the field electronically. When a RTC executes a control function such as reversing a switch, the command is sent immediately. The field location that receives the command sends confirmation back to the office control to confirm to the RTC that the command has been implemented. The system polls the field locations at intervals of about 11 seconds. Therefore, the changes to the status of field locations are not registered at the RTC office immediately.

1.10.3 Edson RTC Workstation

The control consoles for the Edson Subdivision were constructed in 1980. They are designed in a half circle. Built into the table top, below the console, are three computer monitors a communications terminal, a process control system (PCS) computer terminal, and a TGBO computer monitor. The PCS computer terminal is used to issue TOPs for the protection of track units and track work. The TGBO computer is used to issue train movement authorization, and restrictions and instructions to trains. The design of the station was not intended for continuous monitoring of traffic monitoring displays and track occupancy bar lights nor was the panel conceived as a runaway detection system.

A printer and a telephone are on the left-hand side. The train sheet and crew computer and monitor are on the right-hand side.

The workstation for the Edson East RTC is capable of handling rail traffic control on both the Wainwright and Edson subdivisions. It was configured with the Wainwright Subdivision displays on top and the Edson Subdivision displays on the bottom in both the traffic monitor display and the push-button display section of the console. The dual capability of the console requires it to be wider and higher than if designed for only one subdivision. From the right-hand side, the lower level displays include the push-button display and the traffic monitor display panels beginning from Edmonton's Procyk Station, Mile 4.1, and continuing to Jasper Yard, Mile 235.7, on the left-hand side. The Edson East RTC controlled the section of track from Procyk to Edson. Edson, Mile 129.6, is roughly in the middle of the console. Operation of this type of CTC system requires observation within about 180 degrees of the RTC's lateral range of vision and approximately 45 degrees of the RTC's vertical range of vision.

According to contemporary practices for human engineering, the preferred viewing area for such control panels is a cone of 15 degrees up, down, to the left and right of the normal working line of sight. The normal working line of sight for a sitting operator is approximately 15 degrees down from the straight-ahead eye plane. There is a secondary viewing area that is anything outside of the preferred viewing area. Where a display surface is required in the secondary viewing area, it should be used only for displays which are used infrequently, or are related to operationally non-critical functions. An operator engaged in a task involving a display surface in the preferred viewing area would not likely see information displayed on a panel in the secondary viewing area without a specific reason or alert to do so. Where panels are configured in the preferred and the secondary viewing areas, sensory warning devices (e.g. lights or tones) should be used to ensure that the operator becomes aware of critical information or information changes on the panel in the secondary viewing area.

At the Edson East console, the computer displays and the keyboards fall within the preferred viewing area, if body movement in the horizontal plane is made to view all devices. The traffic monitor displays, including the track occupancy bar lights, are well above the preferred viewing angle when the operator is looking at his desk, the keyboards or the computer monitors.

Figure 14 is a photograph of the occupied workstation of the Edson East RTC.

1.10.4 429 Alarm

An alarm known as a "429 alarm" was designed to activate if a registered (i.e. tagged in the system) train passed a Stop Signal (CROR Rule 429). It is important to note that, in this case, the "429 alarm" would not have activated because the movement was runaway equipment, not a registered train.

A "429 alarm" is designed to provide both visual and audible ("sonalert") signals. A light flashes on the traffic monitor display at the control location, and a menu appears on the PCS computer terminal with the name of the location flashing to alert the RTC of a problem in the field.

An audible "sonalert" alarm that emitted a distinctive beep was considered by some to be "annoying". It was present but not working on three RTC desks in the Edmonton office. On five RTC desks, including the Edson East desk, the "sonalert" alarm was missing. It could not be determined who had removed or disabled these alarms.

1.10.5 Unexplained Block Occupancy Instructions

1.10.5.1 Pre-Occurrence

An instruction issued to RTCs on 10 May 1996, three months before the occurrence, specified how RTCs were to deal with an "unexplained block occupancy." It stated, in part:

When the Rail Traffic Controller has an unexplained block occupancy:

1. The RTC will call the S&C [Signals and Communications] call desk and advise location of occupancy and time occurred.
2. Once the S&C call desk has been advised, the appropriate S&C Maintainer and in addition, when Winter Conditions (defined below) dictate, the appropriate Track Supervisor or delegate will also be called.
3. Once on site, the S&C maintainer and/or the Track Supervisor or delegate will be issued immediate authority, with priority over trains, to occupy the track to effect repairs.
4. When Winter Conditions exist no more than one (1) CROR Rule 564 authority may be given for train movements to pass through the affected block prior to the inspection of the block by Engineering forces. Due consideration must be given for the type and tonnage of train to be moved through the affected block.

This instruction did not suggest that a runaway could be the reason for an unexplained block occupancy. It indicated that an unexplained block occupancy should be dealt with as a malfunction requiring a signal maintainer to effect repairs. It did not address a situation where a sequence of unexplained block occupancies existed.

1.10.5.2 Post-Occurrence

On 30 August 1996, 18 days after the occurrence, CN issued an instruction for inclusion into the Rail Traffic Controllers' Manual entitled "Unauthorized Block Occupancy." This instruction states, in part:

When a single unauthorized main track occupancy occurs, the RTC will continue to advise Signals and Communications as presently being done.

When a sequential set of blocks drop where no blocking is in effect which may lead the RTC to believe there is a presence of an unauthorized movement, the RTC must take immediate action to protect other movements that may be affected. When signal blocking or Rule 42 is in effect in the affected block, and the RTC has not been previously advised by the foreman that the nature of their work will interfere with the signal system, then the RTC must immediately contact the foreman advising of the signal sequence of events to determine the cause.

1. The RTC must immediately initiate an emergency broadcast on Channel 1 for the affected area.
2. The RTC must contact and ensure the safety of all potentially affected movements and foreman in the vicinity and advise them of the situation.
3. The RTC must advise the CRTC/MCO [Chief Rail Traffic Controller/Manager, Corridor Operations] of the situation who will notify the MCO/Sr. MCO and the operating officer in charge of the territory, as soon as possible.
4. From his/her knowledge of the territory, the RTC must determine if the unauthorized movement is a "runaway equipment" or unauthorized on-track maintenance equipment, i.e. is there a spur/yard in the vicinity of where the sequence occurred.

This post-occurrence instruction clearly recognizes that an unanticipated and uncontrolled movement is a possibility when a bar light sequence is seen by the RTC and explains what to do in that circumstance.

1.10.6 Training

The CN RTC training program included two phases:

• theory, and
• practical.

The theory phase (which took some eight weeks) was presented at the CN training facility in Gimli, Manitoba. Student RTCs are evaluated in precision, rules appreciation, stress factors and reaction, planning, flexibility, adaptability and personality. The students also receive a general evaluation of their performance. The Edson East RTC on duty at the time of the occurrence had received training in Gimli from 19 February 1991 to 29 March 1991. He had gained satisfactory ratings in all aspects of RTC duties on his final assessment.

The practical phase of the RTC training is conducted in the home terminal where each RTC is observed and evaluated performing RTC duties. The Edson East RTC completed the practical phase of his training in Edmonton and received a satisfactory rating. He was appraised on his performance by instructors at the Edmonton terminal throughout the practical phase.

The Edson East RTC discussed his supervision and training as they related to this occurrence. He revealed that he did not completely understand the detailed technical reasons why the bar lights illuminated on his panel when he was controlling trains. But he did say he knew that an untagged train occupying the block could illuminate the bar lights. He advised that the recognition of unidentified track occupancies was never included in his initial training as a RTC. He did not recall ever having received any training to assess and deal with runaway car movements.

The RTC was taught and supervised to contact the signal maintainer to address the problem when there was an unexpected and unauthorized occupancy indication on his control console. This is consistent with the 10 May 1996 instructions provided by CN management (referred to above). The RTC was not directed by instructions to identify the source of unanticipated track occupancies.

1.11 Derails

1.11.1 Function

A derail is a strategically located safety device that is designed to provide secondary protection against uncontrolled movements of train equipment onto the main track. The protection offered by a derail is secondary to the protection provided by the sufficient application of brakes on railway cars.

The CROR specify that a "... sufficient number of hand brakes must be applied on equipment left at any point to prevent it from moving ...." "Sufficient," in this context, would have to mean sufficiently applied brake shoe force to offset the force of gravity:

• less the natural retarding forces of cars without hand brakes applied,
• plus any other force that may cause the cars to move down grade (such as wind or an impact from the run-in of slack on other equipment).

It is a widely held position by railways that the primary defence on securing cars is the CROR Rule 112 and associated special instructions. If the sufficient level of hand brake application is not achieved, a properly designed and maintained derail, if set, will provide the secondary defence by derailing the uncontrolled movement to the clear before the movement enters the main track.

There are currently three types of derails approved for use on CN trackage: hinge derails, sliding derails, and switch point derails. The vast majority of CN's 6,000 or so derails are manually controlled. All are permanent installations attached to the track.

The CROR (Rule 104.5 and any associated special instructions) require that derails be equipped with a lock and kept set and secured in the derailing position, except when the track is being used. These instructions were in force at the time of the Edson collision.

1.11.2 Removal

Sometime around 1990, the derail was removed from the east end of Edson Yard. The TSB was unable to obtain from the railway any definitive information chronicling why, and under whose authority, the derail was removed. Section 2, paragraph (a) of the Standard Practice Circular (SPC 3603) requires that the District Engineer's approval be received before a derail can be removed and that the proper transportation officer be advised in advance. Some CN supervisory personnel said that derails had been removed without the District Engineer being notified. The District Engineer in 1990 could not recall being notified of the decision to remove the derail.

A 1990 letter from the Calder Occupational Safety and Health (OSH) Committee to the Jasper and Edson OSH committees protested the "recent" removal of this derail. The local manager's response was that the derail had been rendered obsolete because the tie-up track would protect against unattended locomotives and, if CROR Rule 112 was complied with, there would be no runaways. The OSH Committee accepted the local manager's explanation and did not transmit its concerns about the removal of the derail to the next level of management.

TC issued the Railway Track Safety Rules (TP 11373) on 03 September 1992. The Track Safety Rules prescribe the minimum requirements for railway tracks that are part of the general railway system of transportation. Subpart E, subsection II of the Track Safety Rules, pertaining to the minimum requirements for derails, states that:

Derails must be installed when there is any possibility of equipment that has been left standing on tracks other than main tracks or sidings being moved by gravity so as to obstruct a main track or siding.

At the time of the occurrence, these rules were applicable to the tracks in and about the Edson Yard. CN provides a specific standard for derails in SPC 3603. This circular details the type of derail to be installed under certain conditions, the identification of locations that require derail protection, and the personnel that must be notified of the installation of a derail.

There are two plausible explanations for why the derail was removed.

The first theory, endorsed by several employees and one supervisor with knowledge about Edson Yard operations and layout, is that the derail had been removed about 1990 when derails were installed at both ends of the locomotive tie-down tracks. A directive with respect to derail installation on tie-down tracks was not in TC records nor, according to TC, would such a directive normally have been kept on TC files. The TSB and CN could not find such a directive. It was reasoned that the presence of the derails on the tie-down tracks negated the requirement for derails elsewhere at Edson Yard (as CROR was applicable for rail car securement).

The second theory advanced in the investigation was that the derail was removed after the introduction of cabooseless train operations (authorized in December 1987). Cabooseless trains operate with the crew at the head end. Once a train clears a derail, a crew member has to reset the device. With no crew member at the rear of the train, the crew member must then walk back up the train before the train can proceed. It was posited that derails such as the one at Edson East were removed in an attempt to decrease this time-consuming procedure.

1.11.3 Transportation Safety Board

As a result of an investigation into a runaway on Canadian Pacific (CP) trackage and an analysis of the frequency of runaways in Canada, the TSB became concerned about the potential absence of derails at locations where an uncontrolled movement of rail cars could foul the main track (TSB Report No. R93M0001). Citing CP's SPC (Track) and CN's Manual of Standard Practice Circulars in respect of the companies' own requirements to install derails when there is a possibility of equipment left standing on tracks, other than main tracks or sidings, being moved by wind or gravity so as to obstruct a main track or siding, the TSB recommended that: "in order to ensure adequate protection against runaway rail cars:

1.11.4 Transport Canada

On 03 September 1992, the TC Track Safety Rules came into effect, providing standards for railway infrastructure. TC's approach to monitoring the safety of a railway's infrastructure is to review or audit the records of the railway's own compliance monitoring program and then examine the end result by site inspections to focus on safety systems and patterns of compliance and to determine systemic safety problems. The resources devoted to the infrastructure program have remained relatively constant since before the coming into force of the Railway Safety Act. Special activities to focus on compliance for derail installation commenced prior to the Edson accident. Inspectors may typically be in the field 50 to 75 per cent of their time. In regions, typically 75 to 80 per cent of infrastructure budgets are devoted to field inspections. TC does not maintain an infrastructure inventory nor are the results of the railway's audits always validated to ensure accuracy. Records are not kept to ensure that previously identified deficiencies are corrected.

In the event of non-compliance, safety officers from TC's Rail Safety Directorate first seek voluntary compliance. This is followed by a series of letters if non-compliance persists. If railway inaction continues, TC may then invoke the provisions of Section 31 of the Railway Safety Act and issue a notice or notice and order. Section 31 may also be used if there is an immediate threat to safe railway operations. If non-compliance persists, TC may prosecute.

The then Minister of Transport responded to Recommendation R94-06 on 17 August 1994 by stating that:

The incident took place as a result of the failure of yard crews to properly secure the cars, as required by Rule 112 of the Canadian Rail Operating Rules. As indicated in a letter to the Board on September 30, 1993, the railway disciplined the responsible crew and has carried out extensive information sessions with operating employees to reinforce the need for correct securement of standing equipment. This interim action satisfied the department at that time.

With respect to the Recommendation, I am informed that CP has installed a derail at the location in question bringing it into compliance with the Track Safety Rules.

Furthermore, of the 3500 turnouts checked during our 1993 infrastructure monitoring program, some 15 locations failed to comply to the requirement for installation of a derail. In these cases, immediate action was taken by my department to ensure compliance with the Track Safety Rules. Surface Group Regional Offices are aware of this situation and Regional Safety Officers will continue to pay particular attention to this aspect of the program during the 1994 infrastructure monitoring program. In addition, a copy of this letter, along with the report, is being forwarded to the Railway Association of Canada for them to alert member railway companies of the action being taken by my department.

In this context, TC was not aware that the derail at Edson had been removed until the TSB investigation, nor was it aware that there had previously been a derail installed at that location. TC officers believed that, with the issuance of the TC Track Safety Rules, the railways would have responded appropriately and installed derails at the appropriate locations. TC does not maintain an infrastructure inventory of derails, identifying locations where derails are installed and are required.

TC informs that, since recommendation R94-06, it has paid special attention to derails and has identified any obvious locations were they were missing (65 between 1993 and 1996). Regional infrastructure officers have inspected every derail they saw in the portions of the subdivisions being sampled and/or inspected. They have identified a number of derail defects in the past four years. The following numbers are taken from TC's engineering monitoring systems:

Figure 15: Derail Defects Reported by Type and Year

TC was concerned about the issue of derails quite a long time before recommendation R94-06. In 1992, TC convinced the RAC to have an item related to derails added to the Track Safety Rules. In the U.S., the Federal Railroad Administration (FRA) does not define the locations where derails are to be placed.

Following the incident involving runaway cars at mile 5.42 of CP's McAdam subdivision in 1993, TC's regional infrastructure officers focused on derails to ensure that any violation to this rule was reported and corrective action taken by the railways. Since then, the issue of derails has been frequently discussed with railway management at both national and regional levels. TC's first formal meetings with railways to discuss TSB recommendation R94-06 were in Montreal with CN on 07 December 1994 and with CP on 08 December 1994.

In 1997, both CN and CP submitted to the TC regional offices lists of locations where new derails had been installed or where they proposed to install them. Field verifications have been carried out at spot locations where derails have been installed and at locations railways have said derails are not necessary. During this blitz, a sample of 231 derails were verified and a number of defects were identified. All identified defects have been corrected.

1.11.5 Canadian National

Following the Edson occurrence, CN indicated that, in 1994, it had evaluated the situation and concluded that there was no need for the installation of additional derails because the CROR Rule 112 requirements to apply hand brakes would protect against the unsecured movement of cars.

1.12 Runaways

1.12.1 History and Frequency

There were 190 runaways reported to the TSB between 01 January 1991 and 31 December 1996. In 22 of these occurrences, there was a resulting main track collision (17) or main track derailment (5) involving rolling stock and/or trains (i.e. 12 per cent of the time). Apart from these 22 and an accident at a crossing and one involving a track unit, there were 29 main track runaway incidents where there was no damage.

Runaway activity was rising for some time before the occurrence. There was an increasing trend in both runaway accidents and incidents (after 1992).

Of the 17 runaway occurrences involving Government grain covered hopper cars between 1991 and 1996 inclusive, four occurred on the main track and two of those resulted in a collision.

A review of runaway activity on CN subdivisions for the period 1991 to 1996 revealed that 26 per cent of the runaways took place on only 4 subdivisions, most happening in and about yards. These subdivisions are identified below:

Figure 16: Runaways by Subdivision (1991 to 1996^{Footnote 2}, partial list)

1.12.2 Transportation Safety Board

Past TSB investigations on rail car runaways have centred mainly on occurrences where cars initially were left standing secured by air brake application or where cars were ineffectively coupled. Those reported runaway occurrences involving cars that were initially left standing without air brakes and where hand brake application was required were rarely investigated on the premise that the brakes were likely not sufficiently applied. Hand brake functioning was examined in a cursory fashion. The TSB investigation activity resulted in recommendations (in 1992 and 1994) aimed at minimizing the risk of runaways moving onto main tracks.

1.13 Canadian National Response

1.13.1 Rail Sciences Inc. Report

CN engaged the services of Rail Sciences Inc. (RSI) of Atlanta, Georgia, U.S., to investigate the Edson occurrence for CN. RSI completed its report in October 1996.

RSI's report identified two primary causes for the Edson occurrence:

1. Insufficient hand brake pressure on the string of cars in Edson Yard.
2. Failure by the yard crew to perform a mandatory test of those brakes.

In addition, RSI identified three contributing factors with accompanying recommendations:

1. The lack of a derail at the east end of Edson Yard. RSI recommendation: A derail be installed at Edson.
2. The lack of an alarm at the Edmonton rail traffic control office. The signalling circuits at the east end of Edson Yard are not designed to alert RTCs to the kind of uncontrolled car movement that took place on 12 August 1996. RSI recommendation: Signals be redesigned to give an alarm for that kind of movement and that the alarm be audible.
3. The RTC on duty the night of the accident did not conclude from the unexplained track occupancy signals that an uncontrolled movement of cars was in progress. RSI recommendation: CN instruct RTCs on recognizing track occupancy indications that could be caused by an uncontrolled movement, and on the procedures to follow in case of an uncontrolled movement.

1.13.2 Observations and Initiatives

CN took the position that the primary cause of the occurrence was the failure of the Edson crew to sufficiently secure the cars (in accordance with applicable rules and instructions) and said it would do everything it could to prevent runaways in the future.

CN advised that it would install a derail at Edson East, and, as a result of a system review, 600 additional derails were installed and 200 were relocated. CN also undertook to examine the benefits of modifying the Edson East RTC panel to have an "unknown movement alarm," and to instruct RTCs in recognizing track occupancy by uncontrolled movement of cars.

1.13.3 Special Instructions

Subsequent to the Edson collision, CN distributed an information package of special instructions associated with CROR Rule 112. An extract from these Special Instructions is provided in Section 1.10.5.2.

1.14 Canadian Pacific Initiatives

CP informed the TSB that it had taken a number of safety initiatives as a result of the lessons learned from the collision on CN's Edson Subdivision. These initiatives pertained to alerts, the safety action plan, the securement of equipment by railway employees, and derails. Appendix 14 identifies CP's safety initiatives.

Traditionally, Canadian railways have maintained a system of safety defences, rules and special instructions to protect against isolated acts of errant behaviour and other failures in operations. There is a growing recognition, however, that accidents often do not result from a single error or breakdown, but rather from a series of interrelated factors. The nature of the Edson collision and why it happened reflect this truth.

The TSB's primary criterion for initiating an investigation is whether the analysis of the occurrence will lead to the reduction of risk to persons, property and the environment. The Board identifies and makes findings as to the causes and contributing factors of occurrences, identifies safety deficiencies and makes recommendations for remedial action.

Unsafe conditions can exist for years in a latent state if not diligently monitored by the company and the regulator. Yet such weaknesses can become exposed when other safety measures, equipment or devices fail to perform as anticipated. Such was the situation leading up to this occurrence.

The Board takes the broadest perspective to determine why an occurrence happened and how preventive action can be taken to reduce risk. The Board did not stop at identifying only the proximate cause(s) and contributing factors, but delved further into the underlying reasons for this accident.

In this regard, the Board's approach contrasted with that of CN and its contracted investigators from RSI. To the extent that RSI identified a lack of sufficient brakes as a primary cause and the lack of a derail at the east end of Edson Yard, the lack of an alarm to identify runaways at the RTC's console, and the lack of RTC instructions pertaining to uncontrolled movements, the Board agrees. However, the Board went further to evaluate the performance of Government grain covered hopper cars and the mechanical condition of the first two runaway cars along with other broader issues such as safety management and regulatory oversight relevant to why the subject cars were not secured or detected when moving toward Yates. As a result, the Board uncovered additional facts that revealed a number of basic safety issues other than simply non-compliance with a rule or special instruction.

2.1 Scope of Analysis

As noted earlier, a total of 190 runaways, including cuts of railway cars, other rail equipment, and trains were reported to the TSB for the years 1991 to 1996, with 17 resulting in main track collisions and 5 resulting in main track derailments.

Given the serious consequences of main track runaway collisions and the growing frequency of runaways, potential runaway risks are considered to be high. The gravity of the collision on 12 August 1996 near Edson and the capacity for definitive action to reduce the risk for future runaways warranted a TSB investigation with wide scope and depth.

This analysis focuses on the most plausible scenario why the 20-car cut on track 4 in Edson Yard began to move and, once moving, why the cars were not identified or prevented from accelerating into the path of an oncoming train with an unsuspecting crew.

The analysis also addresses:

• operational safety measures
• the competency of railway employees
• the details of events leading up to the collision
• the performance of railway equipment
• operating rules and training
• management and supervision, and
• safety regulation and enforcement

2.2 Operational Safety Strategy

2.2.1 Initial Preventive Measure

A 20-car cut from track 4 at Edson Yard moved through the east lead switch and travelled toward the main track. This would not have happened had the force from the hand brakes applied for these cars been sufficient to overcome any car movement.

CN's first line of defence to protect against the runaway cars at Edson was:

• the effective application of hand brakes to ensure car securement (as per the operating rules and special instructions), and
• the effective functioning of the hand brakes (in accordance with performance expectations).

2.2.2 Secondary Preventive Measures

There is a well known recognition within the railway industry of the importance of secondary defences to prevent runaways onto main tracks. Devices such as derails and measures to alert RTCs of unexpected, unauthorized movements can serve as effective secondary defences. Such safety protection had been removed about five years prior to the collision.

The collision at Yates demonstrates that safety cannot simply be premised on operating rules being followed by railway employees. This strategy has proved inadequate. Rather, it is imperative that secondary preventive measures be operational to ensure against repercussions from the failure of primary safety strategies.

2.3 Train Crew at Edson

2.3.1 Competency

The members of the operating crew responsible for placing the 20 cars on track 4 at Edson had the company-required qualifications and experience to perform their assigned duties. Their plan for switching the 20 cars in preparation for their return to Edmonton on train 404 was reasonable. There was no apparent reason for them to be rushed or preoccupied with other matters while performing their switching duties.

All members of the crew were familiar with Edson Yard and were aware of the requirements of CROR Rule 112. In addition, they had signed the bulletin containing special instructions on moving cars to ensure that the hand brakes were applied and the cars secure. They did claim, however, that they were not fully conversant with or trained to comply with these special instructions, but none requested clarification on what the instructions meant (a rule requirement). There was nothing particularly difficult or unusual in their task. The weather did not impede them in any way, although visibility was limited by the darkness of night.

2.3.2 Training

New lessons on the performance expectations of hand brakes were learned in this investigation. This information could be critical to better car securement practices. The curricula for training sessions for train crews and other railway employees do not ensure that trainees have a complete understanding of car securement requirements.

The facts also indicate that operating crews were not trained to fully understand the hand brake system design nor were they trained to understand the variances that could develop in applying hand brakes. Similarly, the RTC training did not include sufficient information on how light bar warning systems operate, and the importance of bar light sequences that could indicate runaway cars or unscheduled car movement.

2.3.3 Teamwork

Safe train operations, switching and car securement require teamwork. There was collaborative work planning among the members of the train crew at Edson. During the switching activities, the crew acted as a team. However, in the application of the hand brakes, the crew members tended to each work independently and relied on the experience of the assistant conductor to ensure that the cars were secure.

Three additional facts are important with regard to car securement at Edson Yard:

• The conductor was considered by CN to be responsible for the overall direction, coordination and supervision of the work (because of his position); however, because the conductor had not been in road service for four years, he took a passive role and the assistant conductor effectively took charge of the car securement. Furthermore, under CROR Rule 106 d), it is not clear that the conductor was solely responsible for the overall direction of the work.
• There was no apparent communication between the crew members about the procedure that would be used to set the hand brakes or to ensure that the cars were secure.
• There was no monitoring by crew members of tasks performed by other crew members (for example, when the conductor only heard the ratchet of one hand brake being applied, he did not question the assistant conductor).

2.4 Car Securement

The actions of the train crew in placing and securing the cars at Edson Yard and the performance of the hand brake mechanism and rigging were critical to the runaway cars moving off track 4. The information available to evaluate these factors includes:

• the recall of the crew
• the download of the switch locomotive event recorder
• equipment damage at the occurrence site, and
• laboratory simulations and tests on the performance of CNWX car hand brake systems.

2.4.1 Operations

The data from the switch locomotive event recorder generally supports the recall of the crew in terms of the sequence of switching activities. However, the recall of crew members of the time associated with these activities is less precise than the information provided by the event recorder. Event recorders identify times for the stopping, starting and movement of locomotives. The recorded data regarding locomotive status is considered more reliable for determining the time frame for specific switching and securement activities.

2.4.1.1 Chronological Sequencing

A chronological sequencing of activities at Edson Yard is provided in Figure 17. This profile is considered the most probable depiction of what actually happened, based on the recall of train crew members and the data lifted from the locomotive event recorder. The recall of the three crew members was not always consistent; however, there was no difference that would conflict with the depiction below.

Figure 17
Edson Yard: Chronological Sequencing of Activities

• Time Activity
• 2227:32 The locomotives moved to track 8
• 2229:59 The locomotives arrived at track 8
• 2236:47 The crane and idler car set to track 6
• 2245:11 The 20 cars moved out of track 8
• 2255:18 The 20 cars were stopped on the lead track and 6 gondola cars and 2 box cars were uncoupled, leaving 12 hopper cars on the lead track secured by the hand brake engaged on the most westerly car
• 2257:03 The 8 uncoupled cars were shoved west onto track 4
• 2258:26 The 8 cars were stopped 20 to 30 feet west of the fouling point on track 4
• 2258:46 The uncoupled locomotives moved east from the 8 cars standing on track 4 after the cars were secured by the hand brake on the most easterly car
• 2259:20 The locomotives reached the remaining 12 hopper cars on the lead track
• 2302:31 The 12 hopper cars were shoved west onto track 4 with the hand brake on the most westerly hopper car having been released
• 2303:24 The 12 hopper cars reached the standing 8 cars on track 4
• 2303:53 After the cars were coupled, the hoses attached, and all hand brakes released by the assistant conductor, the 20 cars were further shoved west onto track 4
• 2305:55 The movement of the 20 cars was stopped with the most easterly hopper car about 160 feet west of the east lead switch on track 4
• 2306:08 Based on slack run-in times, the slack had completely run in at this time
• 2305:55 The movement of the 20 cars was stopped with the most easterly hopper car about 160 feet west of the east lead switch on track 4
• 2306:08 Based on slack run-in times, the slack had completely run in at this time
• 2303:53 to 2306:33 The assistant conductor climbed on the west end of the second-most easterly hopper car as the cars were moving west and applied its hand brake, which was quick to go on.
  He got off that car while the cars were still moving west and walked east to the east end of the most easterly hopper car.
  
  The movement was stopped for 38 seconds, during which the assistant conductor applied the hand brake to the first runaway car (which appeared to him to have a "long chain"), and during which time the slack ran in.
  
  He uncoupled the locomotives and shone his switch lamp on the front wheel of the most easterly car to see if it was moving.
  
  He rode on the south-west corner of the adjacent locomotive as it moved away to the east.
• 2303:53 to 2306:33 The conductor heard only one hand brake ratchet sound and saw the assistant conductor walk along the side of the cars with his switch lamp lit
• 2306:33 The locomotives were moved east after being uncoupled from the most easterly hopper car by the assistant conductor
• 2306:5 The locomotives were stopped clear of the east lead switch on track 4, that switch having been operated by the conductor for the duration of the switching operation on track 4

2.4.1.2 Plausible Scenarios

Questions arise from the information presented to the TSB:

• Why did the cars run away if two hand brakes had been applied?
• What caused the wheels on the first car to move if these wheels did not move shortly after the locomotives moved away?

Several possibilities exist to explain the runaways. These include:

• A vandal or saboteur released one of the applied hand brakes.
• A gusting wind played a role after the cars were left standing.
• No hand brake was applied.
• The hand brake mechanisms and/or rigging did not perform as expected (i.e. a lower than expected brake shoe force resulted for the torque applied).

Proving that one or more of these scenarios is valid is difficult given the available facts. However, sufficient facts do exist to identify which scenario is the most reasonable.

2.4.1.3 Application of Hand Brakes

That the 20 cars at Edson started to move east toward Yates indicates that the brake shoe force was insufficient to secure the cars. This because the cars did, indeed, move. However, the fact that the cars moved, in and of itself, is not proof that sufficient hand brakes had not been applied when the cars were first secured. The facts in this regard are explored in more depth below.

First, it is necessary to determine what would have constituted "sufficient hand brakes" for those cars on that grade with a slight breeze. Tests were conducted and the following was determined, in part:

• A hand brake was applied to a measured chain tension of 5,240 pounds (about 95 foot-pounds of torque for an average car). After the hand brake was applied, the locomotives were uncoupled and moved down grade. The cars crept away down grade and were stopped by the locomotive at which time the chain tension was measured as 4,760 pounds. Exactly when the chain tension reduced is not known. A chain tension of 4,760 pounds (about 85 foot-pounds of hand brake wheel torque for an average car) on one car would not maintain the 20 cars secure on track 4. Test results relating hand brake wheel torque to chain tension showed that about 18 foot-pounds of torque, on average, was required to generate each 1,000 pounds of chain tension and that the relationship between wheel torque and chain tension (or total brake shoe force) was essentially linear. Reference: Appendix 11, Test 2.
• A hand brake applied to a chain tension of 6,780 pounds would maintain the 20 cars secure (about 125 foot-pounds of hand brake wheel torque for an average car). Reference: Appendix11, Test 3.
• A hand brake applied to a chain tension of 6,780 pounds on one car would result in the 20-car cut moving when the chain tension was reduced to 4,050 pounds of chain force (70 to 75 foot-pounds of hand brake wheel torque for an average car). Reference: Appendix 11, Test 4.
• A hand brake applied to a chain tension of 5,690 pounds would maintain the 20 cars secure (100 to 105 foot-pounds of hand brake wheel torque for an average car). Reference: Appendix 11, Test 5.
• A hand brake applied to the second-most down-grade car such that the torque on the hand brake wheel was 65 foot-pounds (about 3,600 pounds of chain tension for an average car) and the chain tension was reduced on the first down-grade car to 480 pounds (about 8 to 9 foot-pounds of hand brake torque for an average car) would result in the 20 cars just starting to move. Reference: Appendix 11, Test 12.

These results do not give a definitive answer as to what constituted a sufficient hand brake application to secure the test cars. The fact that the results of a hand brake being applied up to a certain chain tension cannot be compared with the results of releasing the chain to a lower tension constitutes a problem. Just as the brakes do not necessarily receive the full benefit of a high chain tension when first being applied (because of system frictional resistance), they do not readily release from a high chain tension when the wheel torque is reduced.

Considering those tests where the brakes were being increased to a certain chain tension, a torque application of between 95 and 105 foot-pounds is required for the test hand brakes to secure 20 cars (see bullets 1 and 4 above).

Considering those tests where the brakes were reduced from a higher level of application, it appears that a torque application in excess of between 70 and 75 foot-pounds is required for the test hand brakes to secure 20 cars (see bullets 3 and 5).

Hand brake performance test results indicate that there is a large variation from car to car in resultant braking effort from the same applied torque at the hand brake wheel. For example, a median hand brake application of about 65 foot-pounds of wheel torque (based on measurement of randomly selected secured cars) could generate roughly between 8,000 and 19,000 pounds of brake shoe force.

From another point of view, an operator could apply 90 foot-pounds of torque to one CNWX car and achieve only 10,000 pounds of brake shoe force, which is the average brake shoe force that would be achieved with only 55 to 60 foot-pounds of wheel torque. This degree of variation is so large that great care must be taken when applying test results on certain CNWX cars to determine what was a sufficient hand brake application on the first two runaway cars.

These test results cannot, therefore, be used to accurately determine what should have been a sufficient hand brake application for the first and second runaway cars. The tests do, however, indicate that an application of somewhere between 75 and 95 foot-pounds of torque (the lowest value to retain the cars static and the highest value for when they first moved) would likely have been sufficient to just secure the 20 cars on track 4 (i.e. if the hand brakes of the first and second runaway cars performed similarly to the hand brakes of the test cars).

A TSB computer model was developed to determine the amount of hand brake retarding force necessary to be consistent with the time it took for the runaway cars to move from track 4 to the impact point. Converting that retarding force to the wheel torque required to achieve that retarding force, the model indicated that:

• There was a hand brake torque of between 64 and 78 foot-pounds applied to one car; or,
• there were hand brakes applied on two cars such that the sum of the wheel torque was 64 to 78 foot-pounds.

These results confirm that at least one hand brake had to have been applied at or above the survey-determined "normal" hand brake torque of about 65 foot-pounds. They also indicate that the degree to which the hand brake(s) had been applied was likely less than one would expect to be "sufficient" based on the post-occurrence hand brake tests (64 to 78 foot-pounds versus 75 to 95 foot-pounds of torque).

The TSB examination of the crushed hand brake mechanism from the first car suggested that it had been applied with a wheel torque of about 80 foot-pounds with a chain tension of about 4,750 pounds at the time of impact. This result is within the range of what the field tests indicated was sufficient torque to secure the 20 cars (75 to 95 foot-pounds of torque) and is close to the upper torque limit for the runaway consist derived from the TSB computer model (64 to 78 foot-pounds of torque).

Considering the results of the field tests, the computer model, and tests on the first hand brake mechanism, if 80 foot-pounds of torque was applied to the first runaway car, then the resultant brake shoe force must have been less than would be expected for an average CNWX car with the same torque applied. Field tests indicate that, at a wheel torque of 80 foot-pounds, chain tension can range from about 3,000 pounds to 5,500 pounds and brake shoe force can range from about 10,000 pounds to over 20,000 pounds.

If the banding marks on the left wheels of the first runaway car were created just before the impact, that would further suggest that the hand brake had been applied on the first car. If one of the banded wheels came from the second runaway car (a strong possibility), then, given the widely varying brake shoe force distribution on such cars, that might suggest that at least one brake shoe was applying force to one wheel tread on the second runaway car. Neither of these hypotheses can, however, be proven.

In consideration of all the above, it is concluded that:

• The hand brake application on the first runaway car at the time of impact and at the time the cars first began to move was likely in the order of about 80 foot-pounds.
• The brake shoe force developed by the application of the hand brake on the first car was insufficient to secure the cars and likely generated a brake shoe force equivalent to a wheel torque of 64 to 78 foot-pounds on a car that had average hand brake performance.
• If the hand brake on the second runaway car was applied, it did not result in a significant brake shoe force for some reason.

Several other considerations are relevant to the determination of what most likely happened:

• The first car most probably did not have a pawl spring in place when its hand brake was applied. Tests indicate that such a hand brake mechanism would not have made a ratchet sound that could have been heard by the conductor over the noise of the idling locomotive. Therefore, the fact that the conductor only heard one ratchet sound does not absolutely mean that only one hand brake was applied. Rather, the sound could be consistent with the sound made by a spring-loaded pawl striking the gear teeth as the hand brake wheel on the second runaway car was being turned.
• The slot or shear plate on the second car showed marks that were consistent with a broken or missing roller on the main vertical hand brake lever. Therefore, the hand brake wheel on that car may have been turned tight (i.e. it felt tight to the operator), but the binding of the upper end of that lever was such that insignificant total brake shoe force resulted -- a situation in keeping with the assistant conductor's recall that this hand brake went on quickly. (Reference: Appendix 5, Section 4.)
• The perceived quick application of the hand brake on the second runaway car may have given rise to the operator's perception that the first runaway car hand brake had a "long chain" (i.e. it took more turns of the wheel for the wheel to feel tight).
• Although such was not the case for all employees, the assistant conductor was capable of applying a hand brake in the order of 120 foot-pounds of torque (i.e. a very strong hand brake application), based on the TSB field tests. This test of capability does not indicate how the hand brake was applied on the day of the occurrence.
• The hand brake mechanisms on the first and second car were devoid of any significant amount of lubricant. Tests indicate that this would have made it more difficult for a particular hand brake operator to achieve maximum possible chain force than if the hand brake mechanism bushings had been thoroughly lubricated with grease. (Reference: Appendix 6, Section 6.)
• As the variation in chain tension for fixed torque levels on different cars is of similar magnitude to the variation in brake shoe force, it is logical that the hand brake gearing mechanism is a primary source of variable hand brake performance. This is particularly true for hand brake torque below 80 foot-pounds. (Reference: Appendix 6, Section 5.)

In the light of all of this information, it is probable that the assistant conductor's recall is correct. That is to say, it is likely that two hand brakes had been applied on the 20-car cut. But it is also probable that the expected total brake shoe force did not materialize.

The assistant conductor's recall of events was generally accurate. He probably did what he said he did, but likely with the following consequences:

• He applied the hand brake on the second runaway car such that the hand brake wheel was tight, but an insignificant brake shoe force resulted, with brake shoe force possibly only on one wheel tread. The most likely reason for this happening was that the upper end on the main hand brake lever (which likely had only one roller in place) was binding (see photograph under item 4 of Appendix 5 Second Runaway Car: Main Lever Shear Plate).
• He applied the hand brake on the first car to above normal levels (i.e. above 65 foot-pounds of torque), likely in the order of 80 foot-pounds. However, that action resulted in less than the average attainable brake shoe force for similar wheel torque applied on average CNWX cars.

2.4.2 Human Interference with Brakes

The event recorder on the Edson locomotive indicates that the 20-car cut was left standing at about 2306:33 and that the locomotives started west, away from the cars, at about 2307:15. It is likely that a vandal would have been seen by the crew in this period of time.

All indications are that the cars had to start moving shortly after they were left standing, albeit at a very slow speed. For a vandal to render the hand brake on the second car insufficient to secure the 20 cars, there would need to be a time lag between when the crew left the cars and when the cars started to move. Field tests indicated that, without any hand brakes, the 20 runaway cars would have taken about five minutes to travel over 2,645 feet east of where they were left. With brakes applied so that they were just insufficient to secure the 20 cars, it took about one minute longer to traverse the same distance.

It therefore appears that there was only a very short period of time for a vandal or saboteur to release the brakes on the second runaway car. Although this is a possibility, no one was seen. Furthermore, to perform that act in the time available that person would have to be conversant with the hand brake release mechanism and take the chance of being spotted by the crew.

It is therefore concluded that, although possible, it is highly improbable that a vandal or saboteur released the hand brake on the second runaway car.

2.4.3 Malfunctions

The missing roller on the main vertical lever of the second runaway car suggests that binding of the main lever was possible and could have resulted in a hand brake that did not deliver a significant brake shoe force. The assistant conductor recalled that this hand brake went on quickly and was tightly applied.

The assistant conductor also stated that the hand brake of the first runaway car had an unusually long chain. This might have been a perception relative to the quick hand brake application on the second runaway car, rather than meaning that the chain was longer than a standard chain or that there was some malfunction of the hand brake. It is remotely possible that the hand brake was out of adjustment. This could have caused the main lever to travel to the end of its slot and contact the frame of the car. It could have "bottomed out" (at a wheel torque of about 80 foot-pounds) giving the feel of a strong hand brake application when in fact it was less. For example, one car that was "Jim Shoe tested" in Edmonton (CNWX 109057) was noted to have the lever hitting the end of the slot at an applied torque of 85 foot-pounds, but with only 13,670 pounds of measured brake shoe force. It is also remotely possible that the hand brake on the second runaway car was partially applied before the assistant conductor applied the hand brake, making it appear to apply quickly.

The inspection of the hand brake assemblies (gearing mechanism) provides no reason to suspect that there was a sudden hand brake malfunction on either car. During testing on other cars, however, it was observed that low-level chain forces sometimes reduced on their own after hand brakes had been applied.

It is also possible, but extremely unlikely, that the chain was longer than a standard chain. In such an unlikely case, the torque on the first car might have been less than 80 foot-pounds, but the brake application on the second hand brake must then have been more significant.

Tests have also shown that an unlubricated hand brake without a pawl spring can be applied with the locking gravity pawl either fully or partially disengaged. Therefore, it is possible that the hand brake on the first car was applied without the gravity pawl fully engaged. It is unknown if any influence, such as the first runaway car forcing its way through three switches, would have caused it to partially release. As the cars were already moving at this point, it is evident that the application of the hand brakes was insufficient and, as the velocity increase was not significant through two switches, it is considered likely that the gravity pawl was engaged. There was no mark on the crushed first hand brake to suggest that it was spinning off at the time of impact.

The absence of the spring on the gravity pawl on the hand brake of the first runaway car was considered in the context of the jarring effect of the slack run-in as the brake was being applied. It is probable that any jolting at this time would have only increased the likelihood of the pawl engaging fully. As well, since the brake application process continued after the slack run-in, any contention that an applied brake (held only by friction in the brake gearing mechanism and a partial pawl engagement) was released by the slack run-in is discounted.

The possibility of main vertical lever binding, the lack of lubrication of the rusty and worn hand brake gearing mechanisms, the apparent lack of adjustment of the hand brake rigging, and the variability of performance in terms of translating hand brake torque to brake shoe force from car to car would have tended to make application of a sufficient hand brake more difficult than it would have been on a well-maintained hand brake system. Each of these conditions or combinations thereof could leave the impression with a hand brake operator that sufficient hand brake was applied, when in fact it was not.

2.4.4 Training and Instructions

Railway trainmen and yardmen receive initial training on the practical aspects of applying and using hand brakes. For this, trainees are required to work under the supervision of experienced employees. The railway relies significantly on this method of on-the-job training to ensure that employees can meet the requirements for safely securing standing cars. On-the-job training has many practical merits and can be a valuable teaching tool. Yet this type of training requires a formalized structure to minimize the risk of deficiencies in work practices being passed on to trainees. Improved effectiveness is linked to a corporate-wide framework or strategy that ensures that standard practices are universally recognized and applied. On-the-job training should also include a monitoring function for training sessions. At CN, there was no system-wide training strategy in place to ensure that standardized techniques for car securement were being learned by trainees in a consistent fashion.

The train crews serving Edson Yard were provided with rules and general instructions in respect of securing cars. These rules required employees to ensure that there was a "sufficient" number of hand brakes applied to prevent cars from moving. A "minimum number of hand brakes" was defined as being "at least one." There was also a requirement to test that the brake shoe had moved against the wheel tread by moving the car slightly. There were no local special instructions applying to operations at Edson that would have provided further guidance on how many hand brakes needed to be applied to ensure that stationary cars were secured.

In the absence of special local instructions pursuant to CROR Rule 112, "sufficient" hand brakes would have to mean sufficient to prevent a particular cut of cars from moving, in consideration of their weight, the grade of the track on which they rest, the type of equipment, and actual and possible wind speed and direction.

2.4.5 Rule Compliance

Compliance with the special instructions provides feedback that the brakes have been applied at some unknown brake shoe force, but hand brake operators do not receive any definitive feedback to confirm that sufficient brake shoe force has been attained. Because of this, the employee cannot accurately know that management's expectations have been met every time cars are secured in accordance with CROR Rule 112.

Hand brake systems generate retarding brake shoe force as a result of torque applied by the employee to the hand brake wheel. The more torque, the greater the chain force and the larger the brake shoe force. "Sufficient" hand brakes also means an adequate number of hand brakes applied with hand brake wheel torque so that the cumulative brake shoe resistance force exceeds the force of gravity and wind on the standing cut of cars (also considering the anti-motion resistance force natural to the cars without the hand brake applied).

Given the available guidelines and instructions, determining what is a "sufficient" hand brake application requires more information than the employees had available to them and a better comprehension of the relevant variables and their interrelationships than was provided to them in training. Unless such factors are understood and accounted for, the determination of "sufficient" hand brakes is based primarily on personal and peer group experience of situations where cars did or did not run away.

Before this occurrence, no special local instructions were issued by CN management with respect to the number of hand brakes that had to be set at Edson or specifically in respect of the degree to which they should be set. In contrast, there were local instructions issued at Jasper when the derails were removed in 1990 to the effect that a minimum of six hand brakes should be applied for a train left without motive power.

Standard operating practices do not take into account that hand brakes can be applied in varying degrees by virtue of the torque applied to the hand brake wheel. Yet, individuals vary in the amount of torque that they can physically apply to the wheel. Similarly, the "push-pull" test instructions did not take into account the fact that proof of a brake shoe applied to a wheel tread is not confirmation that the brake shoe force is adequate to resist motion caused by the net forces of gravity and wind on the standing cars. This means that each crew member was left with the decision to determine how many brakes should be applied and to what degree. The employee guidelines did not always ensure that they safely secured standing equipment, even if the hand brakes performed well.

The facts indicate that the sound of the application of a hand brake on the first runaway car would have been significantly different than normal CNWX cars because the pawl spring was missing. GOI Section 8, Sub-section 17.3, requires the hand brake operator to visually inspect hand brake components including the pawl before operation. This instruction pertains to visual checks and it is difficult, and in some cases impossible, to see all the components because of the housing of the hand brake components. The assistant conductor did not recall trying to visually inspect the hand brake components before operating the hand brake; given the design of the hand brake, he could not have seen whether or not the pawl spring was missing. Therefore, strictly speaking, he could not comply with the letter of GOI Section 8 , Sub-section 17.3. However, the sound of the hand brake operation would have been different than the average CNWX car with a pawl spring installed, but the assistant conductor apparently did not recognize this as a defect. When high-powered hand brakes are spun quickly, and while the clutch mechanism is positioning itself, the pawl spring does not make the hand brake produce a normal ratcheting sound. Also, employees are possibly conditioned to hearing hand brakes without pawl springs. Hand brakes found on many box cars are not equipped with pawl springs and therefore do not make the pronounced ratcheting sound. The less-than-normal ratchet sound is not something uncommon and therefore would not necessarily trigger an employee to think that something was wrong. CN nevertheless considers this lack of recognition of the missing pawl spring a violation of the GOI.

Rules, by their very nature, must set clear standards and cannot incorporate variations for every eventuality. However, it is essential that training on the rules and supervision address the practical application of the rule in the field to ensure that the intent (in this case to secure the cars) is met.

The down-grade cars upon which the hand brakes were reportedly applied were CNWX Government grain covered hopper cars. Tests showed that the hand brakes on one car versus another could have significantly different total brake shoe force for applied hand brake wheel torque of the same magnitude. This hand brake characteristic was not generally understood until the performance tests were analyzed.

Observation of hand brake mechanisms from the first and second runaway cars (and others supplied by CN) indicated that there was a lack of lubrication. That makes it more difficult to apply the maximum possible brake shoe force. Furthermore, there is indication that the levers may have been binding because they were hitting the end of the slot, or because a roller was missing. Either of these may have reduced the appropriate functioning of this component. In these circumstances, an employee might think a sufficient hand brake was applied when, in fact, it was not.

The crew reportedly looked at the wheels with a switch lamp to see if they were moving when the locomotives were removed. They did not test the hand brakes by pushing/pulling the cars with the locomotive to ensure that there was a retarding force. Nor did they look at the brake shoes (as required by instruction). As noted earlier, however, these special instructions did not take into account the fact that proof of a brake shoe against a wheel tread is not confirmation that the brake shoe force is "sufficient" to resist motion caused by the net forces of gravity and wind, and that proof of there being a brake shoe force of some unknown magnitude does not prove that the cars are secure.

2.4.6 Supervision and Monitoring

TC's response to TSB recommendation R92-14 indicated intensified monitoring of federally regulated railways to ensure that personnel were correctly applying standard operating procedures when securing standing cars. TC's focus was more on the actual securement of cars as opposed to monitoring the adequacy of the training and supervision aspect of this procedure. With the continuing incidence of runaways onto the main track in particular subdivisions, the TSB's earlier concerns about the adequacy of supervision and training remain valid; however, it is noted that the frequency of runaways has declined in the first part of 1997.

2.5 Railway Traffic Control

2.5.1 Equipment

The Edson East RTC's CTC console was of a design that, in combination with the RTC's other duties (many of which required him to orient his sight to his desk rather than to his train display panel), reduced his ability to monitor the changing status of the bar lights on his train display panel. As the preponderance of the RTC's work involves viewing these locations, the RTC should not be expected to be continuously watching the traffic monitor displays.

From a human engineering point of view, the console was designed so that the bar lights that foretold the impending collision were in a location that was not in the RTC's preferred viewing area. Because the bar lights were in the secondary viewing area, the RTC needed additional stimulus to be immediately aware of the sequence of yellow bar lights that signified an unauthorized equipment movement. An alarm for an unanticipated bar light activation and sequence would alert RTCs to the existence of a runaway.

2.5.2 Training and Instructions

Notwithstanding the console design, the RTC had been trained that the RTC console had a "429 alarm" to identify the presence of a registered or known train movement, but there was no similar alarm to detect unauthorized movements such as runaways.

The Edson East RTC and other RTCs had not been sufficiently trained to identify and deal with runaways. In hindsight, the sequence of bar light illuminations was an indication of an unauthorized movement. However, the RTC's training, experience and the then-applicable RTC instructions all led him to conclude that a bar light illumination and sequence of bar lights meant a system malfunction requiring only the notification of the signal maintainer. His training also supported the approach that, once the Signals and Communications Group was notified of the problem, his responsibilities were concluded and he could proceed with other work rather than monitoring the problem as a priority.

2.6 Derail

2.6.1 Removal

If an existing risk-reducing defence is removed, safety implications should be thoroughly evaluated and compensating actions taken to offset safety reductions. At Edson Yard, however, no CN manager could remember exactly why the derail had been removed or who had decided to remove it. It is apparent that this derail was removed without full consideration of the safety impact. The Calder OSH Committee raised this concern but it was not pursued. No compensating safety device or procedure was implemented.

2.6.2 Internal Controls

CN SPC 3603 (an Engineering Department standard) specified who should direct the installation or removal of derails (the District Engineer in this case) and who should be informed of the installation or removal (the proper Transportation Officer). The district engineer at the time of removal recalled that he did not direct the derail to be removed and he did not recall being informed of the removal. The proper transportation officers (the then Superintendent and Assistant Superintendent) did not recall being informed of the removal of the derail when it was first removed. Therefore, CN SPC 3603 was apparently not followed with respect to the removal of the derail at Edson East. No CN officer was aware of any documentation pertaining to the removal of the derail, suggesting that no record system existed. The Assistant Superintendent was advised of the removal by an OSH Committee by letter complaining that the derail had been removed. His response was that the derail had become obsolete and to the effect that the crews were required to secure equipment according to Rule 112. The Superintendent did not recall knowing about the OSH letter or the Assistant Superintendent's response. CN had no other formal safety system pertaining to the removal or installation of derails. There was no audit trail of installations or removals of derails. This even though the derail is a safety defence against runaway rolling stock entering main track, posing collision hazards to oncoming trains.

2.7 Medical Testing

There was no comprehensive substance testing conducted on the train crew operating at Edson or the RTC within a scientifically reliable time frame. The tests that were performed by CN were limited to screening for illicit drugs and were carried out too long after the accident to provide reliable indications.

Screening by employers and the police for the presence of illicit substances is usually done to determine if there is a basis for disciplinary or law-enforcement action. However, the TSB's interests are different. The Board is interested in knowing whether the presence of any substance in the body of an individual (involved in a transportation occurrence) adversely affected or is likely to have affected the safe performance of that individual. Rather than screening for a legal limit, the TSB's interest is in the smallest amount that may have negatively influenced performance.

2.8 Safety Management

2.8.1 Risk Mitigation

For a railway to minimize accidents, hazards must be identified and risks effectively evaluated and managed. Risk-reducing defences against human error and mechanical aberrations must be employed where appropriate.

Following this occurrence, CN issued new and more explicit rules with respect to the number of hand brakes required in relation to the number of cars to be secured. These rules appear to be a significant improvement over the rule in place at the time of the occurrence. The Board is not aware of any new practical on-the-job training program to complement this rule change to ensure that crews are aware of the variations that can occur in the amount of torque applied by different individuals on different brakes. CN did produce a video, Switching Safely, and required all employees to attend special classroom sessions to view the video and receive instruction on proper car securement practices.

The new minimum hand brake securement chart instructions require that a minimum of three hand brakes be applied if 20 cars are to be held stationary. This requirement appears to be adequate with a considerable safety margin for the average CNWX car and the average physical limitations of employees on a grade similar to that of track 4. It may also be that combinations of the worst performing cars and the weakest employee could result in no safety margin. The new car securement instruction still is not a factor in the influences of severe grade and high wind forces. These factors are presumably accounted for through the use of special local instructions, better training, supervision, and the addition of the secondary defence of derails in critical areas.

CN has now installed about 600 additional derails and relocated 200 others as determined by a system-wide survey subsequent to the Edson occurrence. These new or relocated derails will provide additional or better protection against rolling equipment moving in an uncontrolled manner onto the main track.

CN has indicated that it is considering the addition of unauthorized movement alarms to assist RTCs in recognizing runaways. Whether this will result in a system-wide feature is not yet known.

2.8.2 Crew Scheduling

Fatigue has been acknowledged by the transportation community as a contributor to many occurrences. The Canalert '95 study, designed to develop, implement and test fatigue counter-measures, is a reflection of the rail industry's concern about this issue.

Fatigue research has clearly shown that, after being awake for 18 hours, people demonstrate a loss of up to 30 per cent of their capacity to accomplish certain cognitive and vigilance tests. The crew scheduling practice in effect at the time of the occurrence was such that a crew could be awake in excess of 20 hours, yet still be within normal duty time limits. Given that the schedule required the crew to be available for call-out from the start of the day, it is likely that crew members would have been at a significant risk for committing errors near the latter part of their shift.

Without being able to predict with any accuracy when their services are to be required, crews are not able to maximize their restfulness by managing their sleep or nap patterns appropriately. They may, therefore, be in a situation where they are significantly compromised in their ability to carry out their tasks safely.

2.9 Safety Compliance

The health, safety and well-being of railway employees, the travelling public and the public in proximity to railway tracks can be adversely affected by marginal safety operational practices or by poorly designed or inadequately maintained equipment or infrastructure. Canadian railways have demonstrated their commitment to safety, ensuring that the risks posed by their operations are acceptable to the Canadian public.

The facts surrounding this occurrence, however, raise some concerns, notably in respect of the secondary defences against runaways. Although responsible and relatively quick safety action was taken by CN in the aftermath of the Edson occurrence, the existence of an unsafe condition that lasted for over five years precipitated this occurrence.

The federal Government has traditionally assumed a railway safety regulatory overseer role. The focus has been on setting safety standards, and monitoring and enforcing compliance with rules and standards by means of orders.

Under the Infrastructure Monitoring Program, TC reviews or audits the records of the railways' own compliance monitoring program. Limited first-hand inspection is also performed. TC does not always validate the results of the railways' compliance monitoring nor does it maintain records to ensure that previously noted deficiencies have been corrected.

Under TC's Track Safety Rules (issued on 03 September 1992), a derail was required at the east end of Edson Yard. Given the information available to the TSB, there is no indication that TC officials were aware that the derail at Edson Yard had been removed. TC's regulatory monitoring was ineffective in ensuring compliance with the Track Safety Rules and discovering a long-standing safety deficiency.

The 1992 and 1994 TSB recommendations requested TC to ensure that:

• railway employees were adequately trained and supervised in respect of securing standing cars, and
• there were derails strategically installed at all locations where uncontrolled movements could foul main tracks.

Although the issues addressed in the 1992 recommendation on training and supervision were reported to have been incorporated into CN's revitalized safety programs, these recommendations were not effectively followed up before the Edson occurrence, and the safety deficiencies identified by the TSB persisted.

CN's safety guidelines for its managers and supervisors are comprehensive. Their intent and substance form the theoretical basis of sound and reasonable safety management. If followed, they would have minimized the risk of what happened at Edson.

However, the facts uncovered by the Board point out that these guidelines were not always complied with. Some examples are presented below:

• The instruction, information and training of the Edson train crew was inadequate for them to determine what would definitively constitute a "sufficient" number of hand brakes applied to a "sufficient" degree for the cars to remain stationary in all circumstances.
• The hand brakes on the type of equipment involved in the occurrence (CNWX cars) performed in a highly variable manner -- something that was not well understood by employees, supervisors, managers or specialists until the test results of this investigation were reviewed.
• There was no direct occasional supervision of operating crews at Edson in respect of securing cars.
• The training of the RTC was insufficient to ensure that he understood the significance of the warning lights on his panel -- that is, an indication of a runaway.
• The design of the RTC train control panel makes it difficult to monitor because the bar warning lights are in the overhead section, outside of the operator's preferred viewing area.
• The RTC had no automated warning of an unanticipated movement to assist him in assessing the significance of the changes in the warning lights on his panel.

CN's safety guidelines prescribed for supervisors were sound. However, the facts of this occurrence highlight the importance of these guidelines being followed.

In brief, the corporate safety guidelines were well defined but not always followed by management, supervisors or other employees. In effect, at Edson and at other locations, management was relying on a single line of safety defence which hinged on operating employees accurately evaluating each situation and properly applying hand brakes to ensure car securement. CN management takes the position that it and all operating employees have the right to expect that operating employees will use proper judgement and that they will consistently comply with the required rules and instructions. This, of course, presumes that the stated rules and instructions can be consistently complied with in all circumstances.

After this occurrence, management at the highest level took strong action to improve safety shortcomings. These initiatives will advance safety significantly. From a larger perspective, lessons learned from this occurrence have brought improved safety practices to railway operations as a whole in Canada.

3.1 The Board's Role

In this section, the TSB presents the findings from its investigation as to causes and contributing factors of the rail collision at mile 122.9 on CN's Edson Subdivision. Findings relate to:

• Edson Yard switching and car securement
• car and hand brake testing
• derails
• rail traffic control
• supervision and training
• CN safety practices, and
• regulatory oversight.

These findings are thought to be useful in developing the necessary safety actions which ensue from this occurrence. By learning from what went wrong at Yates on 12 August 1996, the TSB trusts it will aid those with the authority to make the changes to improve rail safety in the future.

3.2 What Went Wrong?

At approximately 2331 MDT on 12 August 1996, westward CN freight train 117 and 20 runaway cars from Edson Yard collided head-on at Mile 122.9 of the CN Edson Subdivision at Yates. The fuel tanks on the first two locomotives of the train ruptured and the spilt fuel ignited, engulfing the crushed lead locomotive in flames. The damage was severe. The three occupants of the lead locomotive died.

The Board determined that the runaway cars moved from Edson Yard down a grade and onto the main track because insufficient brake shoe force was achieved to overcome the force of gravity. With the removal of a derail at the east end of Edson Yard over five years earlier (about 1990), these cars were unobstructed in their movement onto the main track. The Rail Traffic Controller (RTC) at Edmonton did not recognize the unauthorized movement as runaway cars entering the main track and, because of this, did not take remedial action either to avert the collision or warn the crew of the pending collision.

3.3 Findings

Edson Yard Switching and Car Securement

1. Upon completion of the switching, and while the cars were still moving, the assistant conductor probably applied the hand brake on the west end of the second runaway car. The assistant conductor then applied the hand brake on the east end of the first runaway car.
2. Before leaving the equipment, the assistant conductor may have shone his switch lamp on the front wheel of the first runaway car to see if it was moving, but no member of the crew checked the effectiveness of the hand brakes with either a visual check of the application of the brake shoe or by moving the cars (both of which are required by CN's Special Instructions).
3. Operators securing cars with hand brakes do not receive adequate feedback to ensure "sufficient" brake force application as required by CROR Rule 112.
4. Tests demonstrated a wide variability in brake force effectiveness on CNWX cars. Hand brake operators were not aware of the effects this variability can have in determining the application of "sufficient" brake force.
5. It is highly unlikely that someone purposely released the brake on the second runaway car since there was very little time to do so.
   
   

   Car and Hand Brake Testing

6. A detailed examination of the crushed hand brake mechanism from the first runaway car suggested that it had been applied with a greater-than-average wheel torque.
7. Based on the simulation testing, the wheel torque on the first runaway car would have resulted in a brake shoe force which was likely less than what would be expected for an average CNWX car with the same torque applied.
8. There are strong indications that one main lever roller was missing from the brake on the second runaway car at the time the hand brake on this car was applied on track 4. This likely resulted in little or no brake shoe force being applied on the wheel treads.
9. The brake mechanism on both cars did not have any significant lubrication. Lack of lubrication with grease at critical locations would have made it more difficult to achieve maximum brake shoe force. However, oil lubrication of CNWX hand brake mechanisms at industry-specified locations does not improve hand brake performance and the hand brake gears were not designed to be grease-lubricated in the field.
   
   

   Derails

10. The derail at the east end of Edson Yard was removed some time around 1990. The removal of this secondary safety device created an undetected unsafe situation for over five years before the collision. The derail was replaced shortly after the collision.
11. A properly designed, maintained and set derail at the east end of Edson Yard would have prevented the runaway cars from colliding with train 117.
    
    

    Rail Traffic Control

12. Given the assigned duties for the Edson East RTC, the layout of the workstation display was inadequate in that critical safety information was displayed outside the preferred viewing area recommended by human engineers. Also, there was no compensatory signal to alert the RTC of unauthorized runaway equipment.
    
    

    Supervision and Training

13. The non-standard and unsafe work practices identified in the investigation draw into question the training and supervision of operating crews.
14. No special instructions were issued for Edson Yard after the removal of derails. Supervisors at Jasper Yard (with similar grades to Edson) were issued special instructions when derails were removed from that location.
15. Training on the application and use of hand brakes was provided during initial trainman/yardman training where the practical aspects of their use was taught under the supervision of experienced employees. There was no company training strategy in place which ensured that standardized techniques for car securement were being passed on to trainees and other employees in a consistent fashion through occasional supervisory direction, particularly for new special instructions pertaining to CROR Rule 112.
16. Recurrent training included mainly rules re-qualifications and discussions but there was no practical hands-on training on car securement after an employee first entered railway service.
17. Training was inadequate for the RTC to identify the meaning of a sequence of bar light indications as a possible runaway. Further, the RTC training and written instructions fostered the belief that a bar light, not occasioned by a known train, was a physical or electrical defect rather than a possible runaway.
    
    

    CN Safety Practices

18. Although CN's Standard Practice Circular SPC 3603 (an Engineering Department standard) required a derail at Edson East, Engineering Management was not advised that it was removed, and there was no other safety management system to compensate. Over-reliance was thereby placed on the primary defence of CROR Rule 112 and its associated special instructions, and there was little recognition of the possibility of human error or less-than-expected mechanical performance.
19. Although it was not found to be a contributing factor in this occurrence, the company's crew scheduling and call-up practices occasionally require long periods of wakefulness and duty. These practices are conducive to performance degradation which may compromise a crew's ability to carry out their tasks safely. The length of time the Edson crew would have been on duty had they returned train 404 to Edmonton is an example.
20. A visual audio/alarm system (sonalert) used for the monitoring of registered trains was missing at the Edson East RTC desk. It could not be determined how this happened.
    
    

    Regulatory Oversight

21. TC was ineffective in ensuring Track Safety Rules compliance and did not discover the missing derail that could have prevented this accident if set.
22. Follow-up to the TSB's 1992 concern about the adequacy of supervision and training for the securement of standing cars and its 1994 concern about the installation of derails at locations like Edson where the track gradient could contribute to runaways onto the main track has been inadequate. Safety deficiencies in these two areas had not been mitigated before the occurrence. Post-accident runaway trends appear to indicate an improvement in the short term.

4.1 Identified Risks

In the course of the investigation into this occurrence, several issues were uncovered that indicated the existence of risks within the rail transportation system. The Board has concerns in six broad areas, as follows:

The effectiveness of standard railway operating procedures and practices for securing equipment.

The adequacy of the rail traffic control system for detecting runaways.

The variability of braking effectiveness on Government grain covered hopper cars.

The adequacy of rail safety regulatory overview.

The effectiveness of company safety management programs.

The extent to which the railways rely on strict rules compliance, often as the only defence against human error.

4.2 Risk Mitigation

Subsequent to the occurrence, much has been undertaken by the industry and the regulator to mitigate the risks identified in these areas. Notwithstanding the considerable efforts taken to date, further action is required in some areas to reduce or eliminate the remaining risks.

4.2.1 Car Securement Procedures

The Board questions the effectiveness of standard rail operating procedures and practices for securing equipment from the perspective of determining how many hand brakes to apply, the training and supervision of operating personnel, and any special considerations that may pertain at particular locations. The variability of brake force effectiveness on Government grain covered hopper cars confounds the situation further. Inadequacies in instruction and direction to employees can create circumstances conducive to deviations from expected human performance; indeed, the personnel involved in this occurrence did not perform exactly as expected by the company.

The Board notes that there are wide differences in professional opinion regarding such issues as: the practicality of CROR Rule 112 with respect to determining a "sufficient" number of brakes to be applied and the best practices for applying sufficient brake force; the amount and type of supervision and training required for experienced personnel engaged in car securement; and the most effective means for verifying that, once the brakes have been applied, the cars will remain secure. (The TSB's post-accident survey of locomotive engineers confirmed a wide variation of opinion across the country with respect to the adequacy of the prescribed "push-pull" test.)

The large number of variables involved in effective car securement precludes simple solutions. Nevertheless, CN has taken several actions to mitigate the risk of further runaways arising from such anomalies in car securement practices, these include:

development of new instructions detailing the minimum number of hand brakes that are required to be set. Further, CN has conducted a review of its yards to determine the local requirements regarding minimum number of hand brakes, and has issued special site instructions where warranted;

preparation of a video detailing the car securement instructions and switching activities, and the requirement for all operating employees to attend special briefing sessions with their supervisors;

in response to a Transport Canada (TC) report entitled Report on Railway Supervision and Training, a declared intention to improve the nature of the "front-line" supervisory function.

Notwithstanding the actions taken, the Board continues to be concerned with the adequacy of safety supervision of day-to-day rail operations, particularly with respect to safe operating practices in the setting of hand brakes. The Board has observed similar shortcomings in the front-line supervision of day-to-day operations in other occurrence investigations. The Board will continue to assess the effectiveness of the railways' supervisory policies, procedures and practices during future investigations.

4.2.2 Adequacy of the Rail Traffic Control System

The Board questions the adequacy of the rail traffic control system for detecting runaways from the perspective of the ergonomics of workstation displays and warnings, and the policies, procedures and training for Rail Traffic Controllers (RTC). Neither the design nor the training were conducive to the timely identification of runaways.

To reduce the risk of RTCs not detecting runaways, CN has taken the following actions:

made enhancements to existing dispatch systems and initiated plans to replace dispatch systems across the country;

changed the rail traffic control procedures and provided training with respect to display anomalies to require the RTC to consider the possibility of a runaway;

implemented a new "unknown movement detection" algorithm from the West Coast to Biggar, Saskatchewan, and in Northern Ontario with a view to providing an effective warning system for CROR Rule 429 violations and unknown movements; and

implemented new signal and communications procedures to ensure the integrity and functionality of the sonalert, the audible signal that warns of a registered train passing a stop signal.

These actions will increase the probability of a RTC detecting and correctly acting upon runaways or other unknown movements.

In addition, TC has expressed:

intentions to pursue research for devices that will allow for RTC detection of uncontrolled movements;

concern with regards to the removal of any safety device and will follow up on the disconnection of the sonalert devices; and

intentions to examine RTC activities for compliance with the new procedures through an enhanced RTC audit.

4.2.3 Variability in Braking Effectiveness

The investigation established that there was considerable variability in the effectiveness of the hand brake system on Government grain covered hopper cars. The variability was associated with the design, condition and maintenance of the hand brake system, as well as with differences among operators with respect to their physical capabilities and personal technique. Specifically, the torque applied by the operator may not be proportional to the effective brake shoe force actually applied; i.e. a high torque will not necessarily generate a high braking force. As such, there are risks associated with the ability of the operator to determine how many hand brakes are sufficient, and to know when hand brakes are sufficiently applied.

It is recognized that given the number of cars in current use with similar hand brake systems, a large-scale equipment modification program would be extremely costly. However, several measures have been taken to reduce the risk of further runaways; in particular, CN's specific instructions regarding the minimum number of hand brakes to be set should help compensate for the variability in hand brake application. Nevertheless, given the apparent lack of knowledge among railway employees of this variability and its potential impact on determining "sufficient" brakes to be applied, the Board recommends that:

4.2.4 Adequacy of Rail Safety Regulatory Overview

The investigation identified shortcomings associated with the railways' practices for the positioning of derails and the adequacy of the regulatory authority's efforts to ensure compliance with the Track Safety Rules. In particular, a derail had been removed from its required location at Edson around 1990. Notwithstanding a 1994 TSB recommendation regarding the requirement for the installation of derails at locations like Edson, TC had not ensured that the railways had an effective system in place to ensure that derails were installed where they were needed.

In response to the risks of inadequate defences against runaways, CN has:

conducted a system-wide review for the locations where derails were required; and

installed approximately 600 derails across its system and relocated 200 others since the occurrence at Edson. A derail was installed at Edson Yard three weeks after the accident.

In addition, TC has:

carried out a "field blitz" in which 231 derails were inspected. TC provided CN with information on where defective installations were found, and has reported that these installations have been corrected.

The additional derails will undoubtedly reduce the probability of future runaways. However, the Board is concerned that this accident was required to stimulate a system-wide response in this respect.

The railways must be responsible for ensuring day-to-day safe rail operations. Nevertheless, in the public's interest, it is the Board's view that TC's regulatory overview must ensure that the railways have effective systems in place for ensuring the maintenance of safety standards in their day-to-day operations. In view of CN's recognition that a large number of derails were warranted across the country, the Board is not satisfied that adequate regulatory and infrastructure overview had been maintained by TC to ensure that the railways were consistently complying with the requirements of the Track Safety Rules.

Although the principal concern arising from this occurrence in this respect involves regulatory overview of rail infrastructure, systemic shortcomings in compliance with national safety standards may be jeopardizing other aspects of rail safety. The Board has previously observed on potential systemic deficiencies in such areas as car inspection practices and yard operating procedures. In order to ensure compliance with national safety standards, the Board recommends that:

4.2.5 Effectiveness of Company Safety Management Programs

In response to this accident, CN reacted strongly and quickly, as evidenced by its Safety Initiatives Program announced shortly after the occurrence. Nevertheless, the Board believes that the requirement for many of these actions should have been identified before the accident through CN's routine safety management programs.

The Board is concerned about the effectiveness of company safety management programs from the perspective of ensuring that the programs are able to receive and effectively communicate safety-related information. For example, the local occupational safety and health (OSH) committee's safety concerns about the removal of the derail at Edson did not receive appropriate attention (either by the company or the union), and no special instructions were issued following the derail removal. Special instructions regarding the "push-pull" test were disseminated via periodic bulletins to employees, without follow-up training or supervision to ensure that they had been understood or implemented. The TSB's post-accident survey of locomotive engineers confirmed a wide variation of opinion across the country with respect to the efficacy of the prescribed "push-pull" test.

CN has taken several measures which should improve the company's ability to receive and effectively communicate safety-critical information in a timely way; specifically, CN has:

created the position of Vice-President, Risk Management, providing a focal point for presenting safety issues at the highest levels of company management. (The Assistant Vice-President, Safety and Regulatory Affairs, now reports to this position); and

initiated several improvements to the company safety management system, such as establishing an ombudsman, improving lines of communications, and otherwise enhancing its ability to communicate safety-related information.

With these measures coupled with the improved regulatory overview recommended above, the probability of company management overlooking unsafe work practices or conditions will be reduced.

4.2.6 The Role of Strict Rules Compliance

The railways and TC have based their safety philosophy on a cornerstone of strict rules compliance. While the Board believes that rules compliance is necessary for accident prevention in transportation, it does not accept that rules compliance alone is sufficient to maintain safety in a complex transportation system. Organizations that place excessive reliance on strict rules compliance tend to believe that the safety rules they have developed are invulnerable to human error. A "rule-book" culture can produce an attitude which assumes that all accidents are the result of individual failures to follow the rules. Unfortunately, in a complex system such as transportation, even the most rigorous set of rules will not cover every contingency; interpretation by individuals will be required to cover unanticipated situations. Indeed, notwithstanding their knowledge of the rules, even the most motivated employees are subject to the normal slips, lapses and mistakes that characterize human behaviour. The "defence in depth" philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors.

The railway industry has done much that tacitly recognizes the need for such defence in depth. While there has been improvement in this regard, the Board remains concerned that a traditional railway "rule-book" culture will impede the continued development and maintenance of a safe rail transportation system. In its investigations, the Board will continue to assess the degree to which the railways are able to balance the role of rules compliance with the need for a safety system which is resistant to normal human error.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson Benoît Bouchard, and members Maurice Harquail, Charles Simpson and W.A. Tadros, authorized the release of this report on 22 August 1997.

Appendix 1— Chronological Sequencing of Activities

• Time Activity
• 1445 Crew of train 351 called for duty in Edmonton
• 1630 to 1640 Crew of train 351 departed Walker Yard in Edmonton for Edson
• 2040 Crew of train 351 (Edson crew) arrived at Edson Yard
• 2130 Crew at Edson Station went off duty
• 2145 Crew obtained permission from Chief Rail Traffic Controller (RTC) to come back on duty and obtained switching instructions for train 404
• 2200 Edson East RTC reported for duty in Edmonton.
  Edson crew left Edson Station to perform switching in preparation for train 404.
• 2245 Edson crew asked the Edson East RTC for a switching signal at Edson East but did not get an answer.
• 2249 Second unit (4019) at Edson Yard shut down because it ran out of fuel.
• 2250 Edson East RTC received a radio call from crew of a train located at Leaman concerning a defective crossing.
• 2254 A foreman requested a Track Occupancy Permit (TOP) from the Edson East RTC to operate on the Edson Subdivision from Edson East to Wolf Creek Siding.
• 2303:53 to 2306:33 The assistant conductor of the Edson crew set hand brakes on the hopper cars on track 4.
• 2306:33 Locomotives uncoupled from the 20 cars placed onto track 4 at Edson Yard.
• 2306 Train 117 was operating through Niton (23 miles east of Yates).
• 2307 Edson East RTC received a report of a train in emergency on the south track of the Sundance Spur and began to arrange protection against other train movements.
• 2307:15 The Edson crew, having finished switching and moving the locomotives to the lead track, proceeded to return the locomotives to their original location.
• 2310 Train 117 was between Niton and Peers travelling at a speed of 54 mph with the throttle in position 8.
  The Edson crew returned to the Edson Station.
• 2312 Train 117 reduced speed to comply with a slow order at Mile 105.4.
• 2312:43 A single bar light turned yellow on the RTC panel, signifying that the annunciator circuit had just been entered by the runaway cars.
• 2313:04 The runaway cars entered the south main track at the controlled location at Edson East at Mile 128.6 and three bar lights illuminated yellow on the RTC console. This indicated the occupancy of the annunciator and the crossover controlled location circuits.
• 2313:49 Four bar lights illuminated yellow on the RTC console signifying that the runaway cars had entered the block that started at Mile 128.5 and were occupying the annunciator and the crossover controlled location circuits.
• 2314:23 The bar light for the annunciator circuit went out, signifying that the most westerly car of the runaway cars had passed the annunciator circuit, leaving three bar lights lit.
• 2315 Edson East RTC finished arranging protection and notifying other trains of the emergency situation on the Sundance Spur.
• 2315:08 Two more bar lights on the RTC panel extinguished, indicating that the runaway cars had left the controlled location circuit.
• 2317 Train 117 accelerated back to 55 mph as it travelled through Peers at Mile 109.8.
• 2317:25 to 2321 The foreman arrived at Wolf Creek Siding and radioed the Edson East RTC to cancel his existing TOP and to request a new TOP. The Edson East RTC first saw a bar light.
• 2321 The Edson East RTC called the Signals and Communications Group to ask for a signal maintainer because of the block down on his panel.
• 2323 The Edson East RTC spoke to someone from the Signals and Communications Group and specifically explained the problem with the block.
• 2323:31 The runaway cars entered the block between Mile 126.4 and Mile 123.0.
• 2324 The Edson West RTC made a comment to the Edson East RTC to the effect that vandals were somehow shorting out the signal system (when he viewed the bar lights on the train control panel).
• 2325 Train 117 was about 5 miles east of Yates.
• 2327:37 The leading locomotive of train 117 passed the east switch at Wolf Creek.
• 2329 Train 117 was travelling by Wolf Creek at a speed of 55 mph with the throttle in position 8.
• 2330 Westbound CN freight train approached Mile 122.9 Yates Subdivision.
• 2331:01 The Edson East RTC received a radio call from the foreman at Wolf Creek Siding requesting another TOP to re-enter the main track.
• 2331:08 An emergency brake application occurred on train 117.
• 2331:18 Train 117 collided with the runaway cars at Yates.
• 2334 The Edson East RTC made a comment to the foreman regarding train 117 being slow.
• 2335 to 2336 Train 117 appeared stopped and the Edson East RTC noted he lost CTC. The RCMP called concerning a fire.
• 2341 The Edson East RTC called Wolf Creek foreman re: problem at Yates.
• 2342 Signals and Communications (S&C) Maintainer requested TOP to Mile 126 from Edson East RTC.
• 2345 The Edson crew made a change-off with the incoming crew of train 404 at Edson Station.
• 2346 S&C Maintainer agreed to look into a possible accident.
• After 2350 Train 404 requested a signal and was advised by the RTC that he could not give the signal because train 117 had not cleared the signal at Yates.
• 2350:10 Train 404 moved to the signal at Edson East on track 1 and stopped.
• Likely After
• 2350 An emergency was called by the S&C Maintainer.
• 2352 The S&C Maintainer called the RTC to inform him there was a fire at Yates and that the signal bungalow had been destroyed.
• 0002 The RTC commented to the District Engineer that he thought cars may have run out.
• 0024 RTC realized there was a runaway.

Appendix 2— Pre-Occurrence Switching

1. Planning

Upon arrival at Edson Yard, the crew of train 351 reviewed a switching list that had been prepared for them by the Edson train movement coordinator (who was not on duty at the time they arrived). Being aware that there were locomotives at Edson Yard and that the arrival of train 404 was not anticipated for some time, they phoned the Chief RTC and obtained permission to come back on duty at 2145 to start their pre-departure switching.

The assistant conductor recalled that he expected to perform some switching before the arrival of train 404 at Edson Yard and that he and the other crew members were prepared for that. The locomotive engineer had been informed, before departing Edmonton, that train 404 was scheduled to depart Edson Yard at about 2345. The assistant conductor had estimated that it would take about one hour to one-and-a-half hours to perform the switching duties.

The assistant conductor further remembered that the crew had received permission from the Chief RTC to set out a crane and idler car rather than take them back to Edmonton. The crew was pleased with this because, had they been required to return with the crane, train 404 would have been speed-restricted to 25 mph.

The switching duties were performed before the arrival of train 404 to minimize delay to its departure from Edson Yard. Part of the crew's responsibilities at Edson Yard was to switch a cut of 20 cars from the cars that had previously been left on track 8. To do this, the crew utilized two yard locomotives designated CN4009 and CN4019. The locomotive engineer recalled that these locomotives were initially located on track 13. They were parked in the yard near the station as a matter of convenience for the crews and to improve productivity, rather than being kept on the normal tie-up tracks at the wye at the west end of the yard which were protected by derails at both ends. Locomotive CN4009 was leading with cab facing east and locomotive CN4019 was trailing with cab facing west. (Note: One of the main safety concerns when the derail was removed in 1990 was that locomotives should be stored on tracks protected with derails on either side of the locomotives).

On track 8 from the west, there were 12 loaded grain covered hopper cars with one hand brake applied to the most westerly car. Eight car-lengths east of these cars were six empty gondola cars with the air brakes applied and a hand brake applied to the most easterly car. One car-length east of these cars were a crane and idler car which were coupled to two loaded box cars east of the crane. The basic plan was to switch this equipment from the east end as follows: move the crane and idler car (coupled to the two box cars) from track 8 to track 6; return the two box cars to track 8; and then move the two box cars, six gondola cars and 12 grain covered hopper cars from track 8 to the lead track. From there, the plan was to move those 20 cars onto track 4 (order west-to-east: 6 gondola cars, 2 box cars, and 12 grain covered hopper cars).

The locomotive engineer could not recall why the cars were to be moved to track 4 instead of some other track. He recalled that the other two crew members had made that decision. They remembered that they intended to switch the cars into an order which would facilitate placement on the front end of train 404. With this arrangement, those cars that were to be set off en route from Edson to Edmonton would be nearest to the locomotives of that train.

2. Switching Activities

After discussing their switching plan, the crew left Edson Station at about 2200. The conductor walked to track 8 to inspect the cars and prepare them for movement. The locomotive engineer proceeded to track 13, but realized that he had forgotten his keys for the locomotives at the station and had to return for them. At the same time, the assistant conductor walked to the lead track and lined the switches from track 13 to track 8 to facilitate the movement of the two locomotives to track 8.

The conductor inspected the 12 grain covered hopper cars and left the hand brake applied on the most westerly car. The two locomotives were moved to track 8 at a recorded time of 2227:32^{Footnote 3}, reaching track 8 at 2230:53 to commence switching.

The crew had difficulty moving some of the cars from track 8 and the locomotive engineer recalled that they had to release the air brakes on certain cars. The crane and idler car were removed from track 8 and placed on track 6. The 20 cars were finally pulled out of track 8 with the hand brake applied on the trailing hopper car.

The locomotive engineer recalled asking the RTC for a switching signal at Edson East at about 2245, but did not get an answer. After a minute or two, he proceeded in any event because they could accomplish the switch move without using the main tracks and, therefore, did not require RTC permission.

At approximately 2249, the second locomotive (CN4019) shut down. It had run out of fuel. The locomotive engineer left the controlling cab of locomotive CN4009 and turned off the alarm bells by opening the battery switch in the cab of locomotive CN4019. This shut off the headlight on the west end.

The cars to be switched on track 8 and the final runaway consist were as follows:

The following outlines the chronology of events associated with the placement of cars on track 4 based on the locomotive event recorder data and employee recall.

• At 2255:18, the locomotives were stopped with the 20 cars on the lead track just west of the east lead switch on track 4. The east lead switch connects the lead track to track 4. The conductor uncoupled the eighth car from the ninth car. The six gondola cars and two box cars were pulled east and clear of the east lead switch on track 4 at 2255:30, stopping east of the switch at 2256:19. The 12 grain covered hopper cars were secured on the lead by one hand brake on the upgrade or west end of the cut, which had been left on since the cars were on track 8.
• The conductor lined the east lead switch on track 4 and the locomotive started shoving the eight-car cut (six gondola cars leading and two box cars following) into track 4 at 2257:03, stopping at 2258:26 with the most easterly car 20 to 30 feet west of the fouling point (the fouling point was about 140 feet west of the switch point). The assistant conductor rode the car next to the locomotive (the most easterly car) and secured the rolling stock with one hand brake on that car. The locomotives were uncoupled and started moving eastward back toward the east lead switch on track 4 at 2258:46.
• The locomotives cleared the switch and stopped from 2259:07 to 2259:20. The locomotives then returned to the 12 grain covered hopper cars standing on the lead track. The locomotives reached these 12 cars at 2259:57, and the cars were coupled onto the locomotives by the assistant conductor. The locomotives and 12 grain covered hopper cars commenced movement back to the east lead switch on track 4 at 2300:11, clearing the switch and stopping east of the switch at 2301:50. The conductor released the hand brake on the west grain covered hopper car. The switch was lined for track 4 by the conductor, and the 12 grain covered hopper cars were shoved west onto that track at 2302:31. The eight standing cars on track 4 were reached at 2303:24. The two cuts of cars were then coupled, hoses attached, and the hand brake on the east end of the eight-car cut was released by the assistant conductor. At that time, the locomotives were stopped east of the east lead switch on track 4.
• At 2303:53, the 20-car cut was shoved further westward, stopping at 2305:55. The east idling locomotive (CN4009) was located a unit-and-a-half's length west of the east lead switch on track 4 (where the conductor stood). The locomotive cab was facing east. Locomotive CN4019, which had previously stopped operating because of insufficient fuel, was facing west against the cut of cars. The locomotive engineer, on the right side (south side) of the cab of locomotive CN4009, could not see the assistant conductor all the time, but recalled seeing the conductor by the switch most of the time. The most easterly car was about 160 feet from the east lead switch on track 4 at that time.
• After the locomotives were uncoupled by the assistant conductor, they first moved east at 2306:33 (according to the event recorder on controlling locomotive CN4009). They stopped clear of the east lead switch at 2306:59 and, after the switch was reversed by the conductor, the crew commenced moving west with both the conductor and the assistant conductor on the west end of the locomotives at 2307:15.

Appendix 3— CN Transportation Organizational Charts 1990 and 1996

BC SOUTH DISTRICT

ALBERTA DISTRICT

Appendix 4— CN Engineering Organizational Chart 1990 and 1996

BC SOUTH DISTRICT

Appendix 5— CNWX Cars: Hand Brake Design and Function

1. Car History

The railway cars most critical to this occurrence were grain covered hopper cars. These cars measure 59 feet long, and have a tare weight of approximately 62,000 pounds and a loaded weight of about 263,000 pounds. This type of car was jointly designed by the railways for carriage of Canadian grain and constructed by three Canadian rail car manufacturers: National Steel Car, Hamilton, Ontario; Marine Industries, Sorel, Quebec; and Hawker Siddeley, Trenton, Nova Scotia. Although these cars have been manufactured by three companies, the basic design does not differ from one manufacturer to another.

These cars were first introduced in the early 1970s and presently number about 19,000. They currently have an average age of about 17 years, the vast majority ranging from 7 to 24 years old. There are more than 250,000 covered hopper cars of all varieties in North America. In 1994, 83 additional Government grain covered hopper cars were purchased.

These cars are owned by the federal Government and are designated for use by both CN and CP. The car designation numbers signify to whom they are assigned. Those in service on CN are designated series CNWX 100000 to CNWX 112999 and series CNWX 395000 to CNWX 396999.

2. Hand Brake Design and Function

The hand brake on the Canadian Government grain covered hopper car is similar in function to hand brakes on most other railway cars. In essence, it functions as a mechanical system (separate from the operating air brake system) that applies brake shoe force to the wheel treads to retard motion).

Wheel, Gearing, Clutch and Pawl Mechanisms

The basic hand brake design comprises a hand brake wheel affixed to the "B" end of the car, offset to the left side of the car. The wheel connects to a series of gears, the last of which has an integral chain wind-up drum to which the chain is connected.

The gearing mechanism has a clutch system which will permit a gradual rather than rapid release. It has a spring-loaded pawl to stop the gearing mechanism from spinning off once the chain drum is under load as a result of torque being applied to the hand brake wheel.

The hand brake assemblies on the first two runaway cars were Ellcon National Inc. and Peacock Brake Assembly, Model 6500-2, AAR HP (high-power) type. Stamped markings indicate that both assemblies were manufactured in July 1982.

Hand brake assemblies must be AAR-approved and railway companies can only accept cars at interchange from another railway if the cars are equipped with AAR-approved parts.

Brake Rigging

The chain from the hand brake assembly connects to the "brake rigging" after being routed over a sheave wheel. The brake rigging comprises a series of levers, rods and connecting pins. Essentially, tension is applied to the chain by rotating the approximately 22 inch-diameter hand brake wheel clockwise. The tension in the chain is transmitted to the brake shoes through the brake rigging. The braking effect is accomplished through the composite brake shoes being applied with force to the treads of the wheels (see below).

On Government grain covered hopper cars, the brake system is designed to result in the brake shoes being applied to all eight wheels of the car in either air brake or hand brake mode of operation. There are two brake beams positioned between and parallel to the wheel axles on each truck. Each brake beam has a brake shoe on the left and right end. The two brake beams on each truck operate by moving toward the adjacent wheel set to result in pressure being applied on the wheel tread surfaces by the brake shoes.

3. Brake Application

Air Brake

When brakes are operated by air pressure, each brake beam is pushed toward the wheels by a brake cylinder rod which moves out of the brake cylinder in response to changes in brake pipe pressure. There are two brake cylinders per truck, one mounted on each brake beam. Each brake cylinder rod is adjustable to ensure that appropriate brake shoe force is maintained throughout the range of possible piston travel incurred as a result of normal brake shoe and wheel tread wear. As the two brake cylinders are equally offset and apply approximately the same force, the brake beams remain perpendicular to the car axis when brakes are applied, and brake shoes are applied with roughly equal force on all wheel treads when air brakes are activated.

Because Government grain covered hopper cars are equipped with truck mounted direct acting (TMDA) air brakes, most of the brake rigging commonly found on cars with body mounted brakes is not needed for the air brake system. However, as the hand brake functions independently of the air brake system, separate brake rods, levers, and connecting pins are required to deliver the output force from the hand brake assembly to the brake shoes which move against the car's wheel treads.

Hand Brake

When the hand brakes are applied by turning the hand brake wheel, a different process from the air brake system comes into play. The chain from the hand brake wheel and gearing mechanism connects to a vertical main lever, approximately 19 1/4 inches in length, equipped with dual rollers on its upper end. It is suspended on the car body through a slot in the shear plate in the end platform of the car. The rollers facilitate a smooth movement of the upper end of the main vertical lever by rolling on the shear plate about a slot. This lever connects by a rod to a 19 1/4-inch "live lever" on the "B" end brake beam which is also connected to a 19 1/4-inch "dead lever" by an adjustable 37 1/2-inch bottom rod which passes under the truck bolster. The main lever also connects by a rod to a similar system on the "A" end truck. The tension in the chain results in these levers moving so that the rods pull apart the two brake beams on each of the two trucks in a similar fashion to when the air pressure system causes the brake cylinders to push the two brake beams apart. The intended result is the same, that is to cause the eight brake shoes to move toward the eight wheel treads and apply brake shoe pressure on the wheel treads.

4. Hand Brake Restrictions

If one or both of the rollers on the upper end of the vertical main lever are broken or missing, the remaining part of the lever can drag on the surface of the shear plate about the slot in the end platform of the car when the hand brake is operated. In such a circumstance, there can be additional friction that restricts the upper part of the main lever from moving as more chain tension is applied. Binding, which can restrict the extent to which the upper part of the lever can move, is also possible. If so restricted, the application of the hand brake by turning the hand brake wheel can require fewer turns of the wheel before the wheel appears tight than if the rollers were in place and operating as intended. Such a restriction can lead to a situation where the hand brake operator may feel that the brake is on full, but the brake shoe forces on the wheel treads are less than would otherwise be expected. Drag or scrape marks were present about the slot surface of the second runaway car. These were consistent with hand brake operation with one missing main lever roller. Further examination of a photograph of the shear plate and slot of the second runaway car, taken shortly after the collision, confirmed that there was only one main lever roller on this car (see below).

Replacement rollers and a roller pin were provided to the TSB by CN. It was found that the replacement rollers when placed on the newly designed replacement pin resulted in an "interference" fit such that they did not roll freely on the pin or axle. If the rollers do not roll freely, they would slide on the shear plate, creating frictional resistance to the movement of the upper part of the main vertical lever.

Another condition that can result in binding of the hand brake levers occurs when the hand brake is out of adjustment. Should the slack in the system be more than designed, the main vertical lever can travel completely to the end of the slot and come in contact with the car body. Should this occur, any additional brake shoe force may not be transferred through the linkage to the brake shoes, but instead be transferred to the frame of the car. This condition could also mistakenly leave the impression to a hand brake operator that sufficient brake was applied, when in fact it was not. This condition had been noted on two cars during tests and surveys conducted during the course of the investigation.

The connecting rods and levers for other parts of the hand brake linkage are supported by "U"-shaped supports that act only as guides. The guides are attached to the car's under body and only restrict the movement of the levers by virtue of their length. Although it is commonly believed that brake shoe and wheel wear can be compensated for by winding more hand brake wheel chain, this is not always so because the movement of the levers can be restricted by the length of the guides. When this occurs, the tightening of the chain will cause the levers to result in brake shoe force only until they are restricted from moving. However, any further increase in chain tension may not result in commensurate increases in total brake shoe force. There was no indication that this potential problem existed on the first two runaway cars.

5. Hand Brake Rigging Adjustment

Adjustments to the hand brake rigging can be made either at the bottom rods or at the anchor clevis that secures the dead lever rods to the car body. The clevis is a "U"-shaped piece of metal at the end of the beam or a connection in which a bolt holds one part that fits between the forced ends of another.

Both locations have pin connections that can be adjusted in two-inch increments to accommodate brake shoe and wheel tread wear, as well as other wear that may occur in the various parts of the brake linkage. The pins on the first two runaway cars were in the original positions, suggesting that no adjustment had been made to the hand brake rigging of these cars (see brake rigging diagram).

6. Hand Brake Performance Criteria

The design of the mechanical hand brake system is such that the relationship between the torque applied to the wheel and the total brake shoe force achieved (the sum of all brake shoe forces) is intended to be approximately linear. The total brake shoe force increases proportionately to the hand brake wheel torque. On a new car, when about 125 foot-pounds of torque is applied to the wheel, the brake shoe force should be equal to about 10 to 11 per cent of the gross rail load (GRL = 263,000 pounds for CNWX cars). The GRL is the maximum weight of a particular car that is imparted as a force on the rail (ref. AAR Manual of Standards and Recommended Practices, S-401). The 10 to 11 per cent of GRL is a design standard for new or rebuilt cars with composite material brake shoes. The 125 foot-pounds of torque is not the torque contemplated to be applied every time a car is to be secured. Indeed, tests run during this investigation showed that not all reasonably fit people can exert this amount of torque, particularly when the hand brake gearing mechanisms are worn, rusted and devoid of lubricant.

At no time should the wear limits of the car-truck interface result in a degradation of the hand brake force to less than 6.5 per cent of GRL (Section 8.3 of AAR Standard S-401) -- a criterion equivalent to the minimum requirement for the performance of the air brake system on new cars.

7. Hand Brake Symmetry

The Government grain covered hopper cars have centre bottom hopper chutes and are of a stub sill design (i.e. do not have a structural sill member for the full length of the car). Most of the hand brake rigging is located on the left side of the car centre line axis.

When the brakes are applied, there is an asymmetrical loading of the brake shoes with much more brake shoe force delivered to the brake shoes on the left-side wheels.

The nature of the hand brake rigging also results in greater brake shoe force on the shoes on the "B" end truck than on those on the "A" end truck because of the rigging friction and the additional pivots, rods and levers required to transmit the chain tension to the "A" end brake rigging. (See Appendix 6, Brake Shoe Force Distribution.) While investigating the brake shoe force distribution, investigators and railway personnel involved in the tests were surprised that the right brake shoes did not always touch the wheel treads even when reasonably large brake shoe forces existed on the left side of the car. This "asymmetric" brake loading was further studied.

The evolution of the freight car hand brake system from a "B"-end-only arrangement to the dual truck system was largely a matter of economics. The former arrangement involves the braking on only four of the eight wheels on a car; the latter involves braking on all eight wheels. The experience with the "B"-end-only system was that the "B" end wheels would often sustain brake-related defects far sooner than the "A" end wheels which experienced only air brake applications. This required the "B" end wheels to be changed out more frequently than the "A" end wheels. This was costly and, therefore, the desire was to design a system that would more evenly distribute the hand brake forces to all eight wheels. This should result in less tread-related damage from flats and spalls to the "B" end wheels and more even wheel life. The system also provides the added benefit of having a functioning hand brake at both ends of the car; should there be a malfunction at one end, for whatever reason, the car would still have braking forces at the opposite end.

Appendix 6— CNWX Cars: Hand Brake Performance

1. Introduction

CNWX cars were tested to determine the performance of their hand brakes (note: some of the cars used in the tests were lubricated by CN the day before the tests). The brake shoes were replaced with "JIM Shoe" devices made by Inter Swiss Mfg. of Chicago, Illinois, which included a load cell to measure brake shoe force (note: this arrangement gives results as if the brake shoe were new). A strain gauge pin placed into the chain clevis was used to measure tension in the hand brake chain, and measurement of the torque on the hand brake wheel was accomplished with a torque wrench applied to the wheel nut.

2. Brake Shoe Force Variations

The following sample test data typify the average and variations in brake shoe force that can be expected when about 6,800 pounds of chain tension is achieved (note: 6,800 pounds of tension is supposed to generate a 10 to 11 per cent brake effectiveness to meet AAR new and rebuilt standard specifications).

For CNWX cars: a) the brake shoe force on the left-side wheels is significantly higher than on the right side; b) the brake shoe force on the "B" end wheels exceeds that on the "A" end by a considerable margin; c) the brake shoe force at any particular wheel location, for the same chain tension, can vary considerably from car to car; and d) the total brake shoe force can vary considerably from car to car for roughly the same chain tension (20 to 31 kips).

3. Wheel Torque versus Brake Shoe Force

The sample test data below indicate the relationship between the torque of the hand brake wheel and the total brake shoe force and brake effectiveness achieved at a chain tension of about 6,800 pounds.

From the test data: a) there is considerable variation in total brake shoe force for roughly similar applied hand brake torque from car to car (7.6 to 11.8 per cent brake effectiveness); and b) there is considerable variation in the amount of torque necessary to achieve the similar chain tensions from car to car (115 to 170 foot-pounds to achieve a chain tension of about 6,800 pounds). From another point of view, the amount of brake shoe force (pounds) achieved per foot-pound of applied wheel torque varied from about 146 to 245.

The figure below shows the type of brake shoe force distribution that can be expected from a CNWX car and the typical sequence in which brake shoes apply [signified by (1), (2), (3) and (4)]. For a hand brake set at about 125 foot-pounds of torque, roughly 90 per cent of the total brake shoe force can end up on the left-side wheel treads and 66 per cent of the total brake shoe force on the "B" end wheel treads. Also, the total brake shoe force can vary considerably from car to car.

4. Tapping Effects on Brake Shoe Force

The following sample test data reflect the effect of tapping the brake rigging to distribute the tension in its components and the impact on the brake shoe force. The tapping was accomplished by using a four-pound mechanic's hammer used lightly to simulate vibrations that could reduce high static friction at brake rigging pivot points.

The test data indicate that tapping the brake rigging can result in an adjustment of forces in the rigging components such that the total brake shoe force changes: at lower hand brake applications, the brake shoe force decreases, and at higher applications, it increases.

5. Hand Brake Performance Reliability

Test data on the brake shoe forces generated by different levels of hand brake wheel torque on different cars indicate wide variations in the brake effectiveness for similar wheel torque.

The fact that, on average, the relationship between torque and brake shoe force is nearly linear, reaching the AAR standard of 10 to 11 per cent of gross vehicle weight at 125 foot-pounds of hand brake wheel torque, should be noted. However, it is clearly possible to have much higher or much lower brake shoe force on one car versus another at the same degree of hand brake wheel application (based on data for the 27 CNWX cars). The hand brake operator has no warning of this variation because the operator only has the feel of the hand brake wheel and the look of the brake shoes on the wheel treads to gauge the amount of retarding force offered by the brakes. Pushing or pulling the secured cars with a locomotive or locomotives would not likely provide useful feedback to evaluate the degree of this variation.

From this graph, it can be seen that the very approximate variation is as follows:

At 60 to 80 foot-pounds of wheel torque (a reasonable expectation for most employees), the possible brake shoe force that would result can vary by a factor of two to three according to these data.

The torque applied by the employee to the hand brake wheel results in the hand brake gearing mechanism causing tension in the chain that connects to the brake rigging. The figure below shows the variation that can be expected in chain tension for a full range of hand brake wheel torques.

The variation is very large, as was the case for brake shoe force variation shown in the Brake Shoe versus Wheel Torque diagram.

The figure below shows the relationship between chain tension and the resultant brake shoe force for the CNWX cars that were tested.

There is a relatively close relationship, with variation in brake shoe force increasing at higher chain tensions. Considering the three figures above, it can be concluded that the greatest variation in brake shoe force arises from the translation of wheel torque to chain tension through the brake gearing mechanism at lower torques, and a combination of the influences of the gearing mechanism and brake rigging at higher torques.

6. Wheel, Gearing, Clutch and Release Mechanism Tests

Tests on one car and several hand brake mechanisms supplied by CN to the TSB Engineering Branch indicated that the hand brake wheel could be applied with a normal torque of about 65 foot-pounds and that this degree of application would remain even though the gravity pawl was not engaged to hold the gearing mechanism in place. The frictional resistance of the gearing mechanisms, as provided by CN, acted to resist the tendency of the hand brake chain tension to cause the wheel to turn counter-clockwise. These mechanisms did not have any significant amount of lubricant, and the bushings for the gearing mechanism showed signs of wear and deterioration and therefore appeared to be in need of maintenance. Some of the most critical areas were devoid of lubricant. When the chain drum, double gear, and hub shaft bearings and bushings were lubricated with grease, the frictional resistance decreased such that the gearing mechanism, without the pawl, could not hold a significantly applied hand brake wheel torque.

On one 1980 CPWX car, application of torque to the wheel appeared to result in variable operational performance due to excessive play in the rear bushing of the hand brake wheel shaft. The gravity pawl spring was missing from the hand brake mechanism of the first runaway car and there were no recent spring seat wear markings. When the spring seat was cleaned, some wear marks could be seen, indicating that a spring had been present at one time. Theoretical evaluation of the pawl spring being subjected to the inertial forces of an 85 mph collision with a one-foot stop indicated that the spring would not have come loose during the collision.

Tests on one car showed that one individual (weighing 165 pounds), applying a hand brake to a mechanism that was not lubricated, could significantly increase the chain tension and make the application easier when the gearing mechanisms were lubricated with grease. This improvement in hand brake performance was attained solely through lubrication. The rust and wear debris associated with the gearing mechanisms provided by CN were not removed before lubrication. Because of this, more detailed tests were conducted on the significance of lubrication on hand brake performance.

In March 1997, the hand brake performance of five grain covered hopper cars was tested in Montreal. The first test involved measuring chain tension and wheel torque on the "as provided" cars. The "as provided" condition of the hand brake mechanisms was similar to that of the previous car tested (i.e. the chain drum, double gear, and hub shaft bushings and bearings were rusted). The second test repeated the first test with oil lubrication of the hand brake mechanism at industry-specified points. The third test involved a similar set of measurements but with the hand brake mechanism greased at the gear bushings.

The tests indicated that lubrication with oil at the industry- specified points did not have an impact on hand brake performance; however, lubrication of the gear bushings with grease did significantly improve hand brake performance.

7. Ratchet Sound Tests

The TSB decided to test ratchet sounds with and without the pawl spring in place. This was done for the following reasons:

• the pawl spring missing on the first runaway car,
• the conductor at Edson Yard hearing only one hand brake ratchet sound when the assistant conductor recalled two hand brakes being applied, and
• the assistant conductor being adamant that he applied two hand brakes.

The objective was to determine whether the ratchet noise of one or two hand brakes could have been heard in circumstances similar to those of the night of 12 August 1996 at track 4 in Edson Yard.

Two locomotives (like those used in Edson Yard) were placed in a configuration with three CNWX cars, similar to the manner in which the cars were being placed on track 4. The locomotive closest to the cars was shut down and the other was placed in idle. A TSB investigator and railway official positioned themselves about where the conductor at Edson Yard had been positioned. Another TSB investigator did what the assistant conductor said he had done in terms of applying hand brakes on the two cars. Although both hand brakes were applied, only one ratchet sound could be heard. The hand brake mechanism without the pawl spring (although closer to where the conductor was located) could not be heard over the sound of the idling locomotive. Furthermore, it could not be heard with both locomotives shut down. This indicates that the ratchet sound heard by the conductor was most likely the result of the turning of the hand brake wheel on the second runaway car.

Appendix 7— Hand Brake Application Survey

1. Summary

A survey of the torque applied to random standing cars across Canada was conducted by the TSB shortly after the occurrence. Torque wrenches were utilized to measure the degree to which employees had applied the hand brakes.

A total of 64 cars were tested. The measured torque varied from 20 to 180 foot-pounds with a mean of 78 foot-pounds and a median of 65 foot-pounds. Recognizing that the very high torque values were likely because the air brakes had been applied before the hand brake, the resultant average and median is probably high for conditions where the strength and technique of the employee applying the hand brakes are the only criteria. Consideration of the literature pertaining to the range of human ability to push or pull further supports this contention.

2. Edson Yard

The assistant conductor who applied the hand brakes at Edson Yard was tested to determine how he would normally apply hand brakes. He applied the brakes correctly and he could attain a hand brake wheel torque well above normal levels.

While conducting other tests at Edson Yard, an experienced senior railway employee was asked to demonstrate the application of his "normal" hand brake. He was well above average stature. He spun the wheel by placing fingers of his right hand on a spoke of the hand brake wheel until the wheel stopped and then turned it a further quarter turn. This was not an approved method of hand brake application. The torque reading on the wheel was 40 foot-pounds, well below the median value. A second person of smaller stature, using two hands and standing on the ground, turned the wheel further and the torque was measured to be about 100 foot-pounds. This is also considered to be an inappropriate method of hand brake application, but the torque gained was well above the median value.

3. Belleville Yard

Later, similar tests were conducted at the CN Belleville Yard. Two experienced male carmen were asked to apply the hand brake. Two inexperienced persons, one male and one female, were asked to do the same. The measured torque varied from 85 to 125 foot-pounds when application was from the ground and from 65 to 95 foot-pounds when the application was made while on the car. A small sample of torque applied to other cars in the Belleville Yard ranged from 50 to 75 foot-pounds with a mean of 61 foot-pounds.

Appendix 8— Main Vertical Lever Roller Condition Survey

CN supplied four CNWX cars to the TSB for testing. Two of these cars were found by the TSB to be missing main vertical lever rollers.

Because the second runaway car appeared to also have one of these rollers missing, the TSB surveyed 39 CNWX hopper cars in late August 1996. It was found that two of these cars also had a missing roller.

Based on this result, the TSB decided to survey a larger sample of Government grain covered hopper cars across the country in January and February 1997 to determine the fleet condition of these rollers.

Of the 521 cars surveyed:

• none had defective or missing rollers, and
• some had markings on the shear plate to indicate that the main lever was reaching or was close to reaching the end of the slot when the hand brake was applied.

This latter situation may mean that, on such cars, the application of torque beyond a certain level may not completely be transmitted through the rigging to result in additional brake shoe force.

The survey of 521 cars (out of a total population of 19,000 cars) was considered sufficient to allay initial concerns of a wide-ranging problem and indicated that missing rollers were rare. A separate survey conducted by CN supports this observation.

Appendix 9— Runaway CNWX Cars: Hand Brake Settings

Examination of the wreckage indicated that no hand brake was applied to the 18 more westerly runaway cars at the time of impact. Nine wheel sets were examined to determine if they belonged to the first or second runaway car. Four of these exhibited banding marks on the tread of one wheel per axle.

Wheel tread banding on one wheel per axle is usually the result of movement of a car with asymmetric hand brakes applied, and not because of air brake applications. The friction of the brake shoes on the wheel treads produces heat, which causes the surface of the steel wheel to change colour.

The one-sided wheel tread banding was consistent with brakes being applied on one side of the car to a greater degree than the other. Observation of other CNWX cars indicated that similar wheel tread banding marks existed on cars that had not very recently been secured by hand brakes. It is not, therefore, possible to state categorically that the banding on wheels from the accident site was a result of brake shoe force during the runaway.

A review of the first two runaway car history records was conducted by the TSB and compared to the wheel, axle and bearing identification. Based on wheel markings (possible impact marks with the bull gear of one locomotive and bluing arising from hitting switches) and the aforementioned review, three of the four banded wheel sets were identified as most probably coming from the first runaway car. It is also possible that one of the four banded wheels was from the second runaway car.

None of the wheels retrieved had overheating marks on the wheel plate and none had signs of severe overheating. All met and exceeded minimum tread thickness specifications and all associated brake shoes met and exceeded minimum brake shoe thickness.

Based solely on the wheel examination, it was not possible to readily determine if the brakes on the first or second car had or had not been applied or to what degree at the time of impact.

Appendix 10— Hand Brake Assembly Examinations

The Peacock Brake Assembly, Model 6500-2, AAR, high-power-type brake components were found for the first and second runaway cars. Although both were damaged, they were examined to determine to what degree, if any, the hand brakes were applied at the time of impact.

On the hand brake assembly from the first car, the following was noted:

• There were marks to indicate that the pin that attached the chain to the lower gear was at the 11 o'clock position (six o'clock position indicates that the brake is off) at the time the hand brake mechanism was crushed at impact.
• The spring to hold down the gravity pawl was missing and there was no brightness or wear mark on the spring seats to suggest that it had been in place before the runaway (see also last paragraph of this appendix).
• The gravity pawl (which stops the hand brake from self-releasing by jarring) was not engaged when the casing was cut open. However, that did not necessarily mean that it was not engaged at the time of impact or when the hand brake was applied.

Subsequently, a test was run to determine the chain tension and wheel torque that would be consistent with the 11 o'clock position of the chain clevis and the condition of the brake shoes and wheels of the first car. The results, roughly consistent with wear on brake shoes and wheels from the first car (they were in a relatively new condition), indicated that the wheel torque would have been about 80 foot-pounds and the chain tension, about 4,750 pounds--a hand brake in excess of the normal 65 foot-pound median application discussed earlier and a brake effort probably consistent with the wheel banding on the left side. Both the chain tension and the torque were direct measurements.

If the pawl spring was not in place on the first runaway car, the hand brake application at the time of the impact may have been less than the original brake application made when the car was placed on track 4. As noted earlier (in Appendix 6: CNWX Cars: Hand Brake Performance), on a car with a poorly lubricated hand brake mechanism, a significant hand brake application could be accomplished and maintained without the pawl engaged, until the car was jarred. When the first runaway car was secured on track 4, it could have been secured without the pawl engaged and, due to jarring or while in motion before impact, the hand brake gears could have rotated counter-clockwise, releasing chain tension as the pawl lowered to the engaged position. If such was the case, the original torque applied to the hand brake wheel on the first runaway car may have been greater than 80 foot-pounds.

Examination of the hand brake mechanism from the second runaway car did not provide any indication of whether or not it had been applied at the time of impact. Inspection of the second hand brake from the occurrence and three reference hand brake assemblies provided to the TSB Engineering Branch by CN Edmonton revealed that, in each case, the holding pawl spring was present. The reference hand brakes were used by CN and the TSB to conduct brake tests in Edmonton. Video endoscope imagery was taken of the pawl and coil spring in situ in each reference assembly to document their condition and relative movement during normal brake operation. Subsequent disassembly and inspection revealed wear marks made by the spring on the pawl in all three reference hand brakes, as well as in the second brake from the occurrence. The pawl in the crushed brake assembly from the first runaway car did not exhibit similar wear marks. At first glance, the lack of wear marks implies the possibility that: the spring was never present, the spring was initially present and fell out some time ago, the spring was present but was knocked out during the accident sequence and the lack of use or minimal use did not create any wear marks. Further analysis of these marks and lack thereof was required.

Appendix 11‐ Edson Yard: Hand Brake and Speed Simulation Testing

1. Minimum Hand Brake Requirements

On 25 August 1996, simulation tests were conducted on track 4 at Edson Yard to determine the minimum hand brake requirements to secure a cut of cars that was as similar as possible to the actual 20-car runaway consist. All but the first five cars in the original runaway consist were employed and they were placed in the same relative location as they had been originally.

• Original Cars Simulation Cars
• CNWX 109086 CNWX 109416
• CNWX 107521 CNWX 109807
• CNA 385945 CNA 385687
• CNWX 109380 CNWX 109314
• CNWX 109099 teCNWX 109258xt

The original runaway consist weighed 3,910,700 pounds and the simulation cut of cars weighed 3,882,700 pounds.

Test Results

In all, 14 simulation tests were conducted on track 4 employing differently applied hand brakes on the two most easterly hopper cars. The results follow.

Test 1:     No Hand Brake Applied

The 20 cars were held by one locomotive. No hand brake was applied on any car. The slack was allowed to run in and settle. When the locomotive pulled to the east, the cut of cars moved immediately down-grade to the east.

Test 2:     One-Car Application (5,240 pounds of chain tension)

The 20 cars were held as in test 1. The hand brake on the most easterly car was applied until the chain tension was 5,240 pounds (equivalent on average to 95 foot-pounds of hand brake wheel torque). When the locomotive pulled to the east, the cars rolled one car-length and were stopped by the locomotive. When the cars were stopped, the chain tension had reduced to 4,760 pounds (equivalent on average to 85 foot-pounds of hand brake torque).

Test 3:     One-Car Application (6,780 pounds of chain tension)

Test 2 was run again but with an initial chain tension of 6,780 pounds (equivalent on average to 125 foot-pounds of hand brake torque). When the locomotive pulled to the east, the cars moved about three feet, stopped and remained stationary for 10 minutes.

Test 4:     One-Car Application (4,050 pounds of chain tension)

The hand brake on the car in test 3 was released slowly until the cars moved. They moved when the chain tension reached 4,050 pounds (equivalent on average to 75 foot-pounds of hand brake torque).

Test 5:     One-Car Vibration Test (5,690 pounds of chain tension)

Two hand brakes were applied and the hand brake on the second most easterly car was gradually released, leaving a hand brake applied on the most easterly car with a chain tension of 5,690 pounds. Two locomotives were operated on the lead past these cars. The cars did not move but the chain tension reduced to 5,650 pounds.

Test 6:     Two-Car Application (3,860 pounds of chain tension)

Similar hand brake torques were applied to the two most easterly cars. The chain tension on the first car was 3,860 pounds (equivalent on average to 70 foot-pounds of hand brake torque). When the locomotive pulled to the east, the cars moved momentarily then stopped, remaining stationary for five minutes.

Test 7:     Two-Car Vibration Test (3,860 pounds of chain tension)

Test 6 was repeated with the chain tension on the first car measuring 3,790 pounds. Two locomotives were operated past these cars. No movement was observed. The hand brake wheel torques measured 80 and 50 foot-pounds respectively for the first and second cars.

Test 8:     Slack Run-in Test

Three empty BN gondola cars were stretched and the slack was allowed to run in on the locomotive, while being timed. It took 12.48 seconds for the run-in to occur.

Test 9:     One-Car Application Slack Run-In Effect

A hand brake was applied to the most easterly car and the 20-car slack was allowed to run in (it took 12 to 13 seconds). The chain tension was 6,740 pounds before the slack run-in and 6,470 pounds after. The cars rolled one foot and then remained stationary for five minutes.

Test 10:     Two-Car Application Slack Run-In Test

Hand brakes were applied to the two most easterly cars at a respective wheel torque of 75 and 65 foot-pounds. The chain tension on the first car was 4,200 pounds. The slack was allowed to run in (12 to 13 seconds). When the slack ran in, the consist moved about six feet and stopped, remaining stationary for five minutes.

Test 11:     Two-Car Application Vibration Test

With cars as resulting from test 10, a train passed on the north track at 25 mph and no movement was observed.

Test 12:     Two-Car Application to First Movement Test

With hand brakes applied as in test 11, the hand brake on the most easterly car was released slowly until motion was observed. The consist moved when the chain tension was reduced to 480 pounds. The chain tension on the first car had to be increased to 7,280 pounds to stop the consist once it started to move.

Test 13:     Two-Car Application Timing Test

The events of the night of 12 August 1996 were recreated by moving the 20 cars eastward so that the 12 hopper cars were clear on track 4 and re-shoved onto track 4 with an employee entraining the second car, applying a hand brake on the move, detraining and entraining the first car, applying the hand brake and detraining that car. The torque on the second-most easterly car was 70 foot-pounds, and 55 foot-pounds on the first. It took 34 seconds between the time the employee detrained the second car to the time he detrained the first car. The cars moved slightly then settled.

Test 14:     20-Car Roll Test

The 20-car consist was allowed to roll from track 4 to the annunciator circuit at Edson East. It took five minutes, six seconds to complete the movement over the 2,645-foot distance. The cars reached a speed of 12 mph.

2. Speed and Hand Brake Effectiveness Simulations

The TSB Engineering Branch developed a computer model to determine the necessary hand brake retardation that would correlate the movement over the known route from track 4 to the POI (about 33,200 feet) within the known recorded times that it took to traverse this route (a total of just under 25 minutes). The following conclusions were drawn from the computer model:

• The chain tension (if one car had hand brakes on) had to be between 3,560 and 4,340 pounds or an average hand brake wheel torque of about 64 to 78 foot-pounds.
• If two hand brakes were applied, the chain tensions, brake shoe forces and hand brake wheel torques had to add to the equivalent braking resistance on one car with a chain tension of 3,560 to 4,340 pounds.
• The velocity of the runaway cars at the POI was about 30 mph.

Appendix 12— CNWX Cars: Design Approval and Maintenance

1.    Design Approval and Verification

The federal Government purchased the grain covered hopper cars to help defray railway expenses in the handling of grain at the non-compensatory "Crow Rate." CN and CP officials were involved in the design of these hopper cars. Their expertise was used to ensure that the car builders constructed the cars to meet AAR standards.

Neither TC nor the Canadian Transport Commission were directly involved in the design or the approval of the design of these cars.

2.    Hand Brake Maintenance

Requirements

Part III, section 21.1 of TC's Train Brake Rules states that:

All brake equipment shall be maintained in a safe and serviceable condition.

a) car brakes shall be maintained according to AAR requirements and railway company procedures.

Section E, Standard S-475 of the AAR Manual of Standards and Recommended Procedures states that:

Hand Brakes must be lubricated, if necessary, at points shown in Section H-Part III, Rule F Standard S-736 ... and as referenced in Interchange Rule 13.E.5 ...

Section H, Part III, Rule 8.3 of the same states:

Lubricate only at points indicated on the field lubrication chart ...

The Field Lubrication Chart indicates that Ellcon National D-6500-2 type hand brakes require field lubrication at the main drive shaft and release lever shaft with AAR grade "All Year Journal Box Lubricating Oil," or "Automatic Slack Adjuster Grease."

Rule 13(E)5 of the Field Manual of the AAR Interchange Rules states:

Geared hand brake mechanism and connections must be inspected, tested, and lubricated if necessary, when car is on shop or repair track.

CN's Instructions for Hand Brakes during a Repair Track Test state:

Lubricate hand brake and apply, ensuring shoes are firmly against wheel treads. (Check by using a suitable bar).

During sample car tests conducted by a car builder, the hand brake must be checked to ensure that it can apply the necessary brake shoe force throughout the possible range of piston travel. This is accomplished by removing the brake shoes to simulate the long piston travel condition (i.e. maximum wheel and brake shoe wear).

Section E II, Standard S-484 of the AAR Manual of Standards and Recommended Practices contains the information on how to adjust both the piston travel and the hand brake mechanism. It states that hand brakes are to be adjusted when cars are new, after any new or turned wheel replacements, and after truck replacements.

Rule 3 (2) of the Field Manual of the AAR Interchange Rules states:

When car is on shop or repair track, all WABCOPAC and NYCOPAC cars without slack adjusters must be checked to ensure proper piston travel. If piston travel exceeds 3 inches (without brake shoe renewal) adjustment in accordance with AAR Standard S-484, latest revision is required.

If the air brake system is out of adjustment, the performance of the hand brake may be less than ideal.

Compliance

Several of the cars used during the TSB tests were noted to have dry, rusty and stiff hand brake mechanisms. They were in a deteriorated and rusty condition with no significant lubricant present. The lubrication of the points referenced on the Field Lubrication Chart would appear to do little to lubricate the bushings situated on each side of the three gears located within the hand brake housing. There is no grease fitting to lubricate these critical points. Tests showed that lubrication of accessible points with oil, at locations identified in the Field Lubrication Chart, had no impact on hand brake performance.

Nearly all the cars tested had their hand brake linkage in the original pin connection holes. Piston travel was not measured, as most tests on the hand brake system were done without air.

Appendix 13— Canadian National Priority Safety Initiatives

1. Letter from President to all employees.
2. Develop Generic and Specific Work Procedures
   • Includes (with yard specific procedures):
     • Handbrakes
     • Derails
     • Riding the Point
     • LCS
     • Push to Rest
     • Switches
   • Site specific training and operating manuals
   • LCS supervisory training
   • Review of derail locations
3. Personal Contact by Line Managers
   • Improved communication and coaching
   • Process and system to monitor
4. Safety and Health Committee Involvement
   • Meetings with Committees
   • Development of action plans
   • Benchmarking of best Committee
5. 1-800 Number and Ombudsman
6. Trend Analysis
   • Performed quarterly to ensure high-risk areas are identified and addressed
   • Action plans developed
7. Safety Audits
   • Internal and External
8. Monthly Involvement of CEO and Strategic Management Committee on Key Safety Issues
   • Information provided on progress of Safety Initiatives and status of accidents
9. Root Cause Analysis
   • Training on proper techniques
   • Recommendations tracked through computer system
10. Safety Congress on Each District
11. Safety Incentives Program
    • Corporate and Individual Incentives
12. Provide Coaching to Line Management in Effective Safety Communication
13. Winter Operating Plan
    • Winter Plan in place to reduce frequency and severity of derailments
14. CANALERT
    • Alertness Program

Additional Safety Initiatives

1. TSB Statistics Audit
   • External audit of CN's reporting in accordance with FRA's statistical requirements
2. Branch Line Track Maintenance Review
   • Safety trend analysis on a site-specific basis
3. Zero Tolerance
   • Complete and communicate definition of Zero Tolerance to all employees
4. Discipline Policy
   • Cardinal rules, dismissable offenses, and defined penalties for the offenses
   • Major violations/discipline assessments to be reviewed by system-wide conference calls
5. Drugs and Alcohol Policy
6. Safety Training
   • Development of process to capture and enter information relating to training into a data base
7. DNV Audit and Recommendations
   • List of action items which came out of the DNV report and which are not covered in these action plans
8. Running Trades Pay for Safety Meetings
   • Strategy to alter pay system to compensate for participation in safety meetings
9. Senior Union Management Involvement in Safety
10. Special Board Presentation on Safety Issues
11. Executive Committee Updated - Monthly
12. Process for Communicating Transport Canada Directives
13. Access to CN Property Policy and Guidelines
14. Signal Systems/RTC Systems
    • Requirements for new installations and upgrades of existing signal systems
15. Competency Audits - RTC
16. Supervisory Ratio
    • Review of Supervisory/Employee ratio
17. Full-Time District Officer to Manage Training and Testing
18. Event Recorder Downloads Will Be Conducted for All Reportable Mainline Accidents
    • Software to reduce workload
19. Efficiency Specialists/Experts

Appendix 14— Canadian Pacific Safety Initiatives

Alerts

• CP advised employees of the Edson collision and emphasized the need to follow proper procedures.
• It advised employees of the proper procedures to follow when uncoupling from trains.
• It heightened awareness of the effectiveness of hand brakes on certain types of grain cars.

Safety Action Plan

• Investigate causes of possible hand brake failures.
• Inspect derails at CP locations where currently applied.
• Implement improved railroad safety practices.
• Review design and effectiveness of existing derails.
• Increase security awareness at locations where cars are stored.
• Communicate safety bulletin on proper securement to customers.
• Provide a customer training program on proper car securement.

Customer Awareness

• Some 3,475 customers were notified and provided with instruction to ensure proper securement of cars.
• Additional training material and/or personal visits were supplied upon request.

Securement of Equipment by Railway Employees

• All equipment stored for extended periods was inspected.
• The CP police increased monitoring.
• Efficiency testing was again increased.
• Safety meetings and one-on-one briefings featured the securement/derail issue.
• Hand brakes were tested.
• Three new GOIs were developed and implemented:
• A bulletin was issued to revise Section 15, Item 28.1 (Hand Brake Policy) of the GOI.
• Securing Unattended Equipment - Locomotives Attached.
• Leaving a portion of a train standing with emergency brakes applied.
• Conference call meeting with road managers, yard managers, and trainers on securing equipment.

Derails

• The design of derails was reviewed with the supplier and a superior fastening system was implemented to improve derail integrity.
• All derails were inspected to ensure that they were of the right type, in good repair and properly secured. Reinstallation with the new fastening standard has begun.
• A review of all back tracks, spurs and side tracks was done to ensure that derails were installed where required.
• A review of all yards was done to determine if it was practical to install derails in yard or lead tracks to prevent unintended movement of equipment onto the main track.

Appendix 15— Results of a TSB Survey of CN Locomotive Engineers

The likelihood of the slight movement of a cut of cars enabling the locomotive engineer to determine that the hand brake(s) are applying a retarding force.

During switching operations, you bring a cut of cars to a stop, the trainman applies a hand brake or hand brakes. You are then instructed to move the cars slightly backward or forward.

Choose a number between 1 and 5 ("1" being "Not Likely", "5" being "Very Likely"), that represents the degree of likelihood with which you feel moving the cars slightly would enable you to ensure the hand brake(s) was applying a retarding force in the following situations:

Chart 1.1
Securing 20 Cars on Level Track

Chart 1.2
Securing 20 Cars on a Grade

Chart 1.3
Securing 100 Cars on Level Track

Chart 1.4
Securing 100 Cars on a Grade

The likelihood that the locomotive engineer can determine from the slight movement of a cut of cars that a sufficient hand brake has been applied.

If you were able to detect that the hand brake(s) were applying a retarding force, would you know that the retarding force generated would be sufficient to hold the cars stationary after the locomotives were uncoupled in the following situations:

Chart 2.1
Securing 20 Cars on Level Track

Chart 2.2
Securing 20 Cars on a Grade

Chart 2.3
Securing 100 Cars on Level Track

Chart 2.4
Securing 100 Cars on a Grade