Railway Investigation Report R99H0007

On 23 April 1999, at approximately 1200 eastern daylight time, VIA Rail Canada Inc. train No. 74, travelling eastward on the north main track of the Canadian National Chatham Subdivision, at Thamesville, Ontario, encountered a reversed switch, crossed over to the south main track and derailed at Mile 46.7. The derailed train collided with stationary rail cars on an adjacent yard track. The three cars that were struck were loaded with ammonium nitrate. All four passenger cars and the locomotive of the passenger train derailed as well as four of the stationary cars on the adjacent yard track. The two train crew members in the locomotive cab were fatally injured. Seventy-seven of the 186 passengers and crew on board were treated at hospital. Four people were admitted with serious injuries. Numerous others received first aid on site. Approximately 50 m of main track and 100 m of the adjacent yard track were destroyed. The locomotive was damaged beyond repair and the leading two passenger cars sustained substantial damage.

Section 3 of this report contains the Board's findings. The Board has identified safety deficiencies relating to the level of defences associated with the Occupancy Control System method of train control, particularly in "dark territory," where trains are not always provided with sufficient advance warning of reversed main track switches, and to the storage of dangerous goods in rail cars for prolonged periods of time at locations adjacent to main tracks. Section 4 lists the safety action taken by the industry and Transport Canada. The Board has made three recommendations to address the outstanding safety deficiencies. The first two recommendations are with respect to train operations in "dark territory" and the third recommendation is aimed at clarifying the regulations with respect to the ad hoc storage of dangerous goods. In addition, the Board set out its concern about the need to eliminate some passenger safety hazards in a timely fashion.

Ce rapport est également disponible en français.

1.1 The Accident

At approximately 1200 eastern daylight time (EDT)^{Footnote 1} on 23 April 1999, VIA Rail Canada Inc. (VIA) eastward passengertrain No. 74, consisting of one locomotive and four cars, originating at Windsor, Ontario, came upon a reversed^{Footnote 2} main track crossover^{Footnote 3} switch in the north main track at Mile 46.72 of the Canadian National (CN) Chatham Subdivision at Thamesville, Ontario. The train brakes were placed in emergency while the train was travelling at 80 mph, approximately 180 m from the switch. The train entered the crossover at 74 mph, exited the crossover, derailed and struck 3 of 13 stationary cars on an adjacent track. It was travelling at 68 mph when it collided with the stationary cars loaded with ammonium nitrate.

The derailment and subsequent collision resulted in the death of both operating crew members in the cab of the locomotive. Seventy-seven of the 186 passengers and crew members on board were treated at hospital. Four people were admitted with serious injuries^{Footnote 4}. Numerous others received first aid on site. Approximately 300 tons of spilled ammonium nitrate, an oxidizer, presented considerable potential for fire or explosion. The spilled ammonium nitrate was distributed throughout the derailment area but was concentrated primarily on the south side. When ammonium nitrate is mixed with diesel oil, suitably compacted and exposed to a source of ignition, the risk of explosion is greater; however, there was no fire and the integrity of the locomotive fuel tank was not seriously compromised.

First responders arrived on site within four minutes. They immediately assessed the risks associated with the spilled ammonium nitrate and mitigated the risks by stopping a small fuel leak in the locomotive fuel tank, limiting access and preventing post-accident ignition sources. The contents of the locomotive fuel tank, approximately 1,500 gallons (6 800 litres) of diesel oil, were removed. The extent to which diesel fuel mixed with ammonium nitrate was not quantified; however, most of the diesel fuel that was in the fuel tank at the time of impact was recovered. The evacuation of all passengers and crew members from the train was completed within about 20 minutes. All passengers and crew members were evacuated from the site within 45 minutes. Injured persons were transported to the Chatham-Kent Health Alliance Public General Hospital and the Westover Treatment Centre in Thamesville for treatment.

1.2 Train Operations from Windsor

For the particulars of the CN Chatham Subdivision, see Appendix A (Chatham Subdivision Chart).

The crew members on train 74 commenced duty at 1000 on 23 April 1999 to operate train 74 from Windsor to Toronto, Ontario. Train 74 departed Windsor at 1101 with one locomotive and four cars. The crew members obtained an Occupancy Control System (OCS) clearance giving them authority to operate on the main track of the CN Chatham Subdivision from Mile 105 to Kent, Mile 62.4. The Chatham Subdivision consists of a single main track between Windsor and Kent.

1.2.1 Windsor to Northwood

At approximately 1130, the crew members on train 74 were issued a subsequent OCS clearance authorizing them to proceed on the north track from Kent to Glencoe, Mile 27.8. There are two main tracks between Kent and Glencoe. The clearance contained a number of restrictions, including one requiring the crew to obtain permission from a work train, train 319, to operate within their limits, as well as a number of warnings for switches in the reversed position.

Approaching Northwood, Mile 52.5, the crew on train 74 contacted the crew on train 319 and requested permission to operate between Mile 54 and Mile 46 on the north track. Train 74 was given permission by the crew on train 319 to operate within the stated mileages without restriction.

1.2.2 Approaching Thamesville

Approaching Thamesville, Mile 46.7, from the west, the track is tangent. Maximum permissible speed for passenger trains, travelling eastward on the north track, was 80 mph. Highway 21 and County Road 2 intersect the Chatham Subdivision at Mile 46.75 and Mile 46.43 respectively. There was an agricultural co-op facility on the north side of the railway right-of-way and there were a number of tracks immediately adjacent to the main tracks on either side used for switching and storage. On the track south of the south main track, CB40, there were 13 stationary cars. The four cars at the west end of the cut of cars were each loaded with approximately 100 tons of ammonium nitrate. There was a crossover track approximately 100 feet (30 m) east of Highway 21 connecting the north and south main tracks with switches at Mile 46.72 in the north track and Mile 46.68 in the south track. Both of these switches were in the reversed position.

The crew on train 74 placed the train brakes in emergency approximately 600 feet (180 m) before the west crossover switch. Examination of the locomotive indicated that the emergency brake handle on the conductor's side of the locomotive had been pulled. In addition, the engine stop button on the locomotive engineer's side of the locomotive had been depressed, shutting off the diesel engine. An emergency message was transmitted on the train standby channel at about this time to an opposing VIA passenger train, train 71. Train 71 was approaching Thamesville travelling westward on the south track at approximately 75 mph. The message instructed train 71 to stop and was repeated. Although this transmission was not recorded, its origin was determined to be from the operating cab of the locomotive of train 74.

The locomotive crew members on train 71 were preparing to change radio channels to contact the rail traffic controller (RTC) for additional operating authority as they approached Thamesville. Before changing channels, they received the emergency transmission instructing them to stop, and as the locomotive engineer was applying the brakes, they observed what they believed to be dust and smoke ahead. They unsuccessfully attempted to contact train 74 then placed an emergency radio call to the RTC advising that something had happened at Thamesville. Train 71 continued westward to Thamesville and made a controlled stop just east of the derailed train. The crew members advised the RTC that train 74 was derailed and requested emergency assistance. They then detrained and assisted in the evacuation.

1.3 Occurrence Site Information

1.3.1 Characteristics of the Derailment Area

The accident site was on the southern boundary of the town of Thamesville. Thamesville has a population of 1,000. It is located in south-western Ontario, 65 km west of London and 21 km east of Chatham. Local emergency services include a volunteer fire department and a satellite office of the Chatham-Kent Police. Police, ambulance and hospital services are provided from Chatham. The Chatham-Kent Health Alliance provides emergency services and has a 241-bed capacity at 3 separate hospitals. The topography in the area is flat. Highway 21, a two-lane paved highway, intersects the track at Mile 46.75 at approximately 90 degrees and is protected with flashing lights, bell and gates. Further east, at Mile 46.43, County Road 2, also a two-lane paved highway, intersects the track at 35 degrees, and the crossing is also protected by flashing lights, bell and gates. Land use south of the tracks is primarily agricultural. There was an agricultural co-op facility immediately north of the tracks.

1.3.2 Derailment Sequence

The west crossover switch was found lined and locked for the crossover route. The east crossover switch stand was severely damaged but the switch handle was lined and locked for the crossover route. There was no indication that the east crossover switch point rail had been forced open by any wheel flanges, and the connecting rod from the switch points to the switch stand was not bent in the manner typical of a switch being run through.^{Footnote 5} This information indicates that the east crossover switch was also lined for the crossover route. Approximately 24 feet (7 m) east of the east crossover switch, the south rail of the south main track was broken. Severe scrapes along the gauge side of the rail continuing westward for approximately 14 feet (4 m) indicated that an extreme lateral force was applied before the rail broke. Marks on the leading wheel set of the first car behind the locomotive and paint marks on the switch stand ties matching the car paint scheme indicate that the east crossover switch was struck by the first car.

Marks on the top of the rail consistent with a wheel flange and extensive damage to the track ties and roadbed indicate that the locomotive derailed approximately 48 feet (15 m) east of the east crossover switch. The head end of the train, after derailing, moved laterally to the south, striking stationary rolling stock on track CB40. The train continued moving eastward striking additional pieces of stationary rolling stock for a distance of approximately 165 feet (50 m), coming to rest with the locomotive on its right side. The four cars of the train derailed, the first three of which were leaning to the right-hand side at decreasing angles from the first to the third.

1.3.3 Particulars of the Track

The main tracks and crossover at the accident location consisted of 115-pound continuous welded rail, manufactured in 1978. The rail was laid on hardwood ties placed at 60 ties per 100 feet (30 m) on crushed rock ballast and secured with four standard track spikes and four standard rail anchors per tie. Track components were in good condition.

A crossover track connected the two main tracks at Thamesville. The crossover consisted of two No. 12 turnouts, each with a standard radius of curvature of 1,104.63 feet (336.7 m), one to the right and one to the left, and switches at Mile 46.72 in the north track (the west crossover switch) and Mile 46.68 in the south track (the east crossover switch). Maximum authorized speed for train movements through this type of crossover is 15 mph; however, such turnouts are designed to handle train movements at up to 30 mph. The switch stands were of the low type, commonly used in main track installations where clearances will not permit the use of a high stand. This type of switch is operated manually by removing a lock, depressing a foot latch and moving a lever that lies horizontal and parallel with the rail, upward in an arc to the vertical position then downward to the horizontal position again on the other side of the switch mechanism, parallel with the rail once again and back into a foot latch. The lock is then reapplied to the foot latch and locked. Although not a formal railway requirement, common practice for the installation and maintenance of this type of switch is that the hand-throw lever be installed with the handle of the lever oriented away from the switch points when the switch is in the normal position^{Footnote 6}, so that derailed rolling stock or dragging equipment, moving in the facing-point direction (towards the switch points), is less likely to reverse the switch.

Each crossover switch was equipped with two targets displaying red for the reversed position and one target displaying green for the normal position (see Figure 3). Affixed to a square steel mast that ascended straight up out of the centre of the switch mechanism was an oval-shaped target 30.5 cm long by 15 cm high. This target had been painted red and had two rectangular pieces of high-intensity reflective material on its surface, one on each side of the centre line. Both the paint and reflective material were soiled and had experienced considerable surface degradation. The bottom of the oval target was about level with the top of the rail. An additional length of square steel rod extended from the top of the mast fastened by a sleeve and securing bolt. Affixed to this extension were two additional targets at 90 degrees to each other, one round and one square. The round target faced the same way as the oval target and was also painted red. The paint was faded and no additional reflective material had been applied. The square target, facing away from the train movement, was painted green. The round target was 20 cm in diameter and the square target was 20 cm by 20 cm. The bottom of these targets was approximately 27 cm above the top of the rail.

TSB investigators approaching the west crossover switch, travelling eastward on the north main track, could identify the red targets from approximately 1,400 feet (425 m). This was done in clear visibility, both from a static Hi-rail vehicle and a slowly approaching locomotive, while actively attempting to locate the switch.

1.3.4 Rail Traffic Control

Train movements on the CN Chatham Subdivision are governed by the OCS authorized by the Canadian Rail Operating Rules (CROR) and supervised by an RTC located in Toronto. There are typically six freight trains and eight passenger trains per day on the Chatham Subdivision.

1.3.5 Weather

At the time of the accident, the temperature was five degrees Celsius with overcast skies, light rain and light winds, reducing the visibility of the track ahead compared with clear conditions.

1.4 Personnel Information

1.4.1 Locomotive Crew on Train 74

There were two locomotive engineers and a locomotive engineer trainee on the train. The locomotive engineer and locomotive engineer trainee who sustained fatal injuries were in the locomotive cab, and the other locomotive engineer was in the club car behind the locomotive. The locomotive engineer trainee was at the controls of the locomotive. All operating crew members were qualified for their positions and met established rest and fitness requirements.

1.4.2 On-Train Service (OTS) Crew on Train 74

There were five on-train service (OTS) crew members on board train 74. The OTS crew comprised one service manager and four senior service attendants. Two senior service attendants were assigned to the club car, one to coach 3351 and one to coach 3313. The senior service attendants assigned to the coaches also shared the duties for coach 3344. All OTS crew members were qualified for their respective positions.

1.4.3 Crew on Train 319

The crew on train 319 consisted of a locomotive engineer, a conductor and a trainman. They were qualified for their respective positions and met established rest and fitness requirements.

1.5 Train Information

Train 74 was an eastward passenger train that operated Sunday, Monday and Friday between Windsor and Toronto. It consisted of one locomotive and four Light, Rapid, Comfortable (LRC) passenger cars, weighed approximately 350 tons and was about 400 feet (120 m) in length.

1.5.1 The Locomotive

Train 74 was powered by a GM F40PH-2D locomotive, manufactured in July 1987 by General Motors (GM) of Canada. This type of locomotive is configured with the short hood leading. The car body is fully enclosed, providing internal walkways for access to the engine room. It is a four-axle, 3,000-horsepower diesel-electric locomotive intended for passenger service. The main generator of the locomotive converts mechanical energy created by the 16-cylinder turbocharged diesel engine into electrical energy. The electrical energy is distributed to four traction motors, each of which is geared to a pair of wheels.

1.5.2 Light, Rapid, Comfortable (LRC) Passenger Cars

Train 74 comprised four LRC passenger cars designed for high-speed service. There are two series of LRC cars built by Bombardier for VIA:

• LRC-2 cars (numbered 3300 to 3349);
• LRC-3 cars (numbered 3350 to 3375^__coach cars, and numbered 3453-3475^__club cars).

The equipment was marshalled from front to rear as follows:

• Club car (LRC-3) 3468^__vestibule doors forward
• Coach 03 (LRC-3) 3351^__vestibule doors forward
• Coach 04 (LRC-2) 3344^__vestibule doors forward
• Coach 05 (LRC-2) 3313^__vestibule doors forward

The car body is an integral welded aluminum construction, except for mechanical subsystems and truck assemblies. Passengers enter and leave the cars through a vestibule area located at one end of the car. Each side of the vestibule is equipped with an electrically controlled sliding side door and a set of manually retractable stairs. A sliding intermediate door separates the vestibule from the passenger seating area. At each end of the car, a sliding end door provides access to adjacent cars.

The interior arrangement includes a galley, two end baggage compartments and two rows of double seats with enclosed baggage compartments mounted overhead. Most passenger seats have adjustable reclining backs and retractable food-service trays. Two washrooms complete the interior structure of the car.

The club car has a seating capacity of 56 people and the coaches can seat 72 people. Club cars are used to accommodate passengers travelling with first class tickets. It is common practice for the club car to be placed either immediately behind the locomotive or at the rear of the train. Both car types have four emergency exit windows, two on each side of the car, two side entrance doors in the vestibule end, and two end doors, one at each end of the car.

1.6 Recorded Information and Train Brake Effectiveness

1.6.1 Locomotive Event Recorder Data from Train 74

Event	Time (sec)	Brake Pipe Pressure (lb)	Throttle Position	Speed (mph)
	46.3	102	6	80
	47.3	102	6	79
	47.9	102	6	79
	48.1	102	6	79
Brake Pipe Pressure Drops
	48.3	101	6	80
	48.4	91	6	80
	48.5	82	6	80
	48.6	73	6	80
	48.7	65	6	80
	48.8	57	6	80
	48.9	50	6	80
	49.0	44	6	80
Throttle Drops
	49.1	38	1	80
	49.2	33	ID*	80
	49.3	27	ID	80
	49.5	19	ID	80
	49.6	16	ID	80
	49.9	9	ID	80
	50.1	7	ID	80
	50.3	5	ID	79
	50.5	4	ID	79
	50.6	4	ID	79
	50.8	2	ID	79
	50.9	2	ID	79
	51.0	2	ID	79
	51.2	2	ID	79
	51.3	2	ID	78
Brake Pipe Pressure at Minimum
	51.6	1	ID	78
	51.9	1	ID	78
	52.3	1	ID	77
Centre of Victoria Street
	52.9	1	ID	77
	53.0	1	ID	77
	53.3	1	ID	74
Crossover Entrance
	53.9	1	ID	74
	54.3	1	ID	72
	54.9	1	ID	72
	55.3	1	ID	70
	55.9	1	ID	70
	56.3	1	ID	68
Crossover Exit	56.9	1	ID	68
Collision
	57.3	1	ID	57

* ID = Idle

Table 1 illustrates the information retrieved from the locomotive event recorder of train 74 for the period between 1200:46.3 and 1200:57.3. Only the seconds are shown on the table. The following is a summary of the key events:

From Initial Brake Application to Crossover Entry

• The emergency brakes were initially applied sometime between 1200:48.1 and 1200:48.3 when the recorded value for brake pipe pressure started to drop. Between 1200:49.0 and 1200:49.2, the throttle dropped from the No. 6 position to idle, consistent with the power cut-off associated with an emergency brake application.
• Between 1200:50.1 and 1200:50.3, the recorded speed dropped from 80 mph to 79 mph, and one second later, it dropped to 78 mph. With allowances for the imprecision in event recorder data, the elapsed time from emergency brake application to the beginning of the speed reduction was about 2 to 3 seconds.
• Between the time when the brakes were initially applied and just before the locomotive entered the crossover (an elapsed time of about 5 seconds), the train decelerated from 80 mph to 74 mph.

The pneumatic emergency brake application signal travels through the train at the speed of sound, approximately 930 feet (280 m) per second. Given that the train was approximately 400 feet (120 m) in length, the signal commanding emergency braking would have travelled the length of the train in well under a second. However, it would have taken considerably longer for maximum train braking force to be reached due to the time necessary to achieve maximum friction.

• Passing Through the Crossover
  • Between 1200:53.9 and 1200:56.9, the train decelerated from 74 mph to 68 mph.
• During Initial Collision
  • Between 1200:56.9 and 1200:57.3, the train decelerated from 68 mph to 57 mph. It is considered that the collision with the stationary cars occurred at this time.
• From Collision to Final Rest
  • Immediately following the collision, at 1200:57.3, the locomotive event recorder ceased recording data. The train travelled an additional 163 feet and decelerated to 0 mph. It was calculated that this occurred over approximately 4 seconds.

After the emergency brake application was initiated, at between 1200:48.1 and 1200:48.3, until the collision, at between 1200:56.9 and 1200:57.3, the train speed reduced from 80 mph to 68 mph. Approximately 9 seconds elapsed.

1.6.2 Locomotive Event Recorder Information from Train 71

Recorded information indicates that, between 1201:58 and 1204:15, train 71 was slowed from 75 mph to 0 mph. During this period, there was a series of brake pipe pressure reductions and increases indicative of a controlled deceleration of a passenger train with graduated brake capability.

The locomotive event recorders on trains 74 and 71 were not synchronized. Although the comparative record of the elapsed time of any particular event is considered reasonably accurate, the actual initiation of any event may not reflect the exact time.

1.6.3 Train Brake Effectiveness

The TSB compared the initial deceleration of four emergency braking events from similar speeds and trains, using data supplied by VIA. The data reflect emergency brake applications in a variety of track conditions (grade, curvature) and environmental conditions (temperature, precipitation) that are known to result in a wide variability in brake performance. The initial decelerations of these four trains, over the first 5 to 6 seconds after emergency brake application, are summarized in the following table:

Table 2 - Deceleration from Event Recorders

Train	Deceleration (mph per second)Footnote 7
Train 74	1.2 to 1.3
Train A	0.4 to 0.7
Train B	0.4 to 0.7
Train C	1.4 to 1.5
Train D	1.7 to 1.6

The data also indicate that, after the first few seconds, the deceleration rates increased from about 1 mph per second to about 2 mph per second and remained essentially constant.

1.6.4 Calculated Lateral and Longitudinal Forces

TSB engineers examined the dynamics of train 74 throughout its deceleration and its movement through the crossover track at the point of collision and until it came to rest (TSB Engineering Branch report LP 05/99). The following conclusions were made:

• Before the collision:
  • The longitudinal deceleration did not exceed 0.1 g^{Footnote 8}.
  • Passage through the crossover set up lateral forces due to centripetal acceleration and transferred weight to the wheels on the outside of the curves. The train rocked to the left in the first half of the crossover and then to the right in the second half. The magnitude of this lateral force was calculated to be 0.33 g.
• During the collision:
  • The peak longitudinal deceleration was calculated to be 1.25 g which occurred at the initial collision.
• After the collision:
  • The average longitudinal deceleration following the initial collision was approximately 0.67 g and lasted about 4 seconds.

1.7 Main Track Switches

1.7.1 Procedures for the Use of Hand Operated Switches

CROR Rule 104, which applies to all federally regulated railways, specifies the approved procedures for the operation of hand operated switches, including main track switches. The following procedures are pertinent to this occurrence:

1. . . . main track switches must be lined and locked for the main track when not in use. A main track hand operated switch must display a reflectorized target, or light and target, to indicate the following: [green for normal position; red for reversed position]
2. When directed by GBO [General Bulletin Order], clearance or special instructions, and protection has been provided against all affected trains or engines, a main track switch may be left lined and locked in the reversed position. When not so directed, it must not be left in the reversed position unless in charge of a switchtender or a crew member who must be in position to restore the switch to its normal position before it is fouled by a train or engine approaching on the main track.
   [. . .]

4. Except as provided by paragraph (b), the conductor and locomotive engineer must, when practicable, ensure that switches manually operated by their crew members are left in the normal position. Other employees are not relieved of responsibility in properly handling switches.
   [. . .]

6. When a switch has been turned, the points must be examined and the target, reflector or light, if any, observed to ensure that the switch is properly lined.
   [. . .]

14. When a crossover is to be used, the switch in the track on which the train or engine is standing must be reversed first. Both switches must be reversed before a crossover movement is commenced and the movement must be completed before either switch is restored to normal position.

At the time of the occurrence, there were no additional operating procedures requiring specific communication of the position of main track switches among railway employees on CN trackage.

1.7.2 Main Track Switch Targets

In accordance with standard railway operating practices in Canada, main track switch targets are regarded as location indicators used to assist a train crew in pinpointing the exact location of a switch, in addition to indicating the switch position. Unless train crew members have been formally notified that they may encounter a specific switch lined and locked in the reversed position or are instructed to use a specific switch, they are not required to regulate their train speed to be able to stop short of reversed switches. In general, regardless of track curvature or visibility, train crew members are expected to operate their trains as closely as possible to the maximum authorized speed.

1.7.3 Past TSB Safety Action on Main Track Switches

In 1992, the Board issued three recommendations concerning the handling of main track switches subsequent to a hazardous occurrence on the CN Sherbrooke Subdivision in which a VIA passenger train encountered a reversed main track switch near Bromptonville, Quebec (TSB report No. R91D0032).

• Recommendation R92-19: The Department of Transport conduct a field audit of current operating practices to confirm the security of main track switches in non-signalled territory.
• Recommendation R92-20: The Department of Transport assess locations where main track switches are located in non-signalled territory to ensure that, in the event of a misaligned switch, an emergency stop can be effected by passenger trains before reaching the switch.
• Recommendation R92-21: The Department of Transport, in cooperation with the railway industry, sponsor research and development of an electronic method for locomotive crews to ascertain the position of main track switch points sufficiently in advance, so an emergency stop can be made before a misaligned switch.

In 1994, the Department responded that a survey was undertaken of all main track switches in non-signalled subdivisions where passenger trains were scheduled. The results of the survey were addressed with senior officials of CN, Canadian Pacific Railway (CPR) and the Railway Association of Canada (RAC)^{Footnote 9}. As a result of this work, the railways were directed to consider and propose corrective measures with respect to locations where switch target visibility and minimum train braking distances indicated a potential safety risk. This resulted in the removal of some switches and the approach visibility of others being improved. Additionally, Transport Canada (TC) was advised that work was being done to improve the visibility of switch targets in non-signalled territory, with specific attention being given to difficult locations on passenger-carrying tracks.

In August 1993, a VIA passenger train carrying 240 passengers and 18 crew members encountered a reversed main track switch at Mile 58.2 of the CN Sussex Subdivision at approximately 65 mph (TSB report No. R93M0059). The train brakes were placed in emergency approximately 1,000 feet (300 m) before the switch. The train negotiated the switch without derailing at approximately 55 mph. There were no injuries. Subsequently, a TSB Safety Advisory was sent to TC expressing concern that leaving a main track switch lined and locked for a siding and unattended by a switchtender or a member of a train crew creates an unsafe situation. TC responded that CN had been advised to consider improvements to operating rules, training of personnel handling switches, and the visibility of switch targets. CN was also requested to consider the introduction of self-restoring switches^{Footnote 10} in OCS territory and advance warning of the position of switches for train crews. CN has not implemented self-restoring switches in OCS territory on a system-wide basis and no new means of providing advance warning to approaching trains has been established.

In May 1994, the Board noted that, since 1991, there had been at least six occurrences, four of which were in 1994, where trains encountered a switch reversed and the crews were not forewarned of the situation. It was suspected that the occurrence record reflected the improper interpretation and application of new procedures permitting main track switches to be left lined and locked in the reversed position in certain circumstances. In view of the potential for serious collision or derailment, the Board recommended that the Department of Transport examine current field operating practices for the application of Rule 104(b) of the CROR to confirm that adequate protection is being provided against unintentional switching of trains from the main track (Recommendation R94-05).

TC replied that the industry and TC had a number of initiatives underway to ensure compliance with the rule by improving training, supervision and enforcement, and to implement further safeguards to protect trains travelling on non-signalled track. Specifically, TC examined railway operating practices to ensure that train crews handle switches correctly to avoid the problem of trains unexpectedly encountering switches in the reversed position. TC concluded that there was no evidence to support the contention that CROR Rule 104(b) was flawed or unsafe. In addition, TC examined problem sites, "from the engineering perspective," to ensure that train crews have adequate warning should a switch be left in the wrong position. This examination covered non-signalled territory where passenger trains operate at 70 mph and above. TC determined that the larger red target on a high switch stand was visible from a distance of approximately 2,100 feet (640 m), provided it was not obstructed by brush, track curvature, cars in sidings and some weather conditions such as heavy snow or fog. Low stand switches, such as the 36D type used for the crossover switches at Thamesville, were not examined.

In November 1994, TC reported that, on the CN Chatham and Newmarket subdivisions, there was "adequate sighting distances, except at one location. New highly reflectorized material had been placed on all the big switch targets." TC advised that, for another location, CN was developing some type of active signal indicator to give advance warning to train crews that a switch may not be lined for the main track. The device was in the design stage with testing anticipated at a future date; however, at the time of the occurrence, it had not been placed in service. Also, TC indicated that a number of other initiatives were being considered, such as radio procedures, speed restrictions and, for the long term, certain aspects of the Advanced Train Control System (ATCS)^{Footnote 11}.

In March 1997, TC issued a Notice and Order under Section 31 of the Railway Safety Act instructing CN's RTCs not to act on any information received concerning a main track switch restored to the normal position, unless such information is received from the location of the switch.

In 1993, following a number of incidents involving reversed main track switches, CPR amended the communication requirements contained in CROR Rule 90 for application by train crews on its railway to include the following reference to the main track switch position:

Voice communication - additional requirements

1. In addition to the requirements of Rule 90, voice communication must be made at the following times and places:
   [. . .]

5. In OCS, immediately before a train or engine enters or leaves a main track through a hand operated switch, stating:
   switch location
   position, switch is to be left in
   clearance number, when switch is left in reversed position Note: Not applicable when switching.

CROR Rule 90 is titled "Communication between Crew Members." This rule and its supporting railway special instructions set out some of the circumstances under which train crew members are required to communicate with each other and, in the case of cabooseless train operations (including passenger trains), make announcements over the designated standby channel.

In October 1994, maximum passenger train speed was increased from 80 mph to 95 mph on the single track portions of the Chatham Subdivision. ATCS research projects were terminated at CN in March 1995 and, at CPR, in March 1996. There are currently no Canadian railways involved in ATCS-related initiatives in Canada.

TC remains an active participant on the Rail Safety Advisory Council in the United States, participating in a number of working groups and examining the implication of new technologies for potential further action in Canada.

1.7.4 TSB Reported Occurrences of Passenger and Freight Trains Encountering Unanticipated Reversed Main Track Switches

The annual numbers of occurrences reported to the TSB wherein trains encountered reversed main track switches are shown in Table 3. The table includes all such occurrences known to the TSB in which a train unexpectedly encountered a main track hand operated switch in the reversed position.

Other occurrences were reported where unauthorized reversed main track switches not known to the RTC were encountered by track and signal maintenance staff. These occurrences are not included in Table 3.

In Centralized Traffic Control System (CTC) and Occupancy Control System (OCS)/Automatic Block Signal System (ABS), advance warning was available to train crews in the form of block signal indications. Consequently, train speeds were regulated approaching reversed switches in most of these occurrences, enabling the trains to stop before fouling the switch. In some occurrences in OCS, advance warning was available in the form of a warning transmitted to the crew and recorded on OCS clearances, but this warning was unsuccessful in eliciting the desired crew response.

Table 3 - Reported Occurrences of Trains Unexpectedly Encountering Reversed Main Track Hand Operated Switches

Year Footnote 12	Passenger Trains in CTC	Passenger Trains in OCS/ABS	Passenger Trains in OCS outside ABS	Passenger Trains in Yard Limits or Cautionary Limits	Freight Trains in CTC	Freight Trains in OCS/ABS	Freight Trains in OCS outside ABS	Freight Trains in Yard Limits or Cautionary Limits	Total
1993	0	0	1	0	0	2	2	0	5
1994	0	0	0	0	3	2	11	0	16
1995	0	0	1	0	2	2	4	0	9
1996	0	0	1	0	0	2	3	0	6
1997	0	0	0	0	0	1	10	0	11
1998	0	0	0	0	3	0	5	0	8
1999	1	0	1	0	3	2	3	0	10
2000	0	0	4	1	0	2	7	0	14

The table shows considerable variability, ranging from a low of 5 in 1993 to a high of 16 in 1994. The annual average is about 10. Only one occurrence involved a "high-speed"^{Footnote 13} passenger train; however, in other occurrences, the passenger trains were approaching at speeds of up to 70 mph. Passenger trains encounter reversed hand operated switches in non-signalled territory on average about once a year.

1.8 Train 319 Activities

1.8.1 At Windsor, Chatham and Northwood

At 0400, 23 April 1999, a CN train crew was called to operate a work train assignment commencing at 0600 in Windsor. The crew, consisting of a locomotive engineer, a conductor and a trainman, reported for duty at Van der Water Yard in Windsor and then travelled by vehicle to Chatham, departing Windsor at approximately 0630 and arriving Chatham at approximately 0730. Scheduled activities for the day involved working with a track maintenance gang to dump ballast^{Footnote 14} from open top hopper cars on the north main track right-of-way. A crew of four track maintenance employees, including a foreman (ballast gang foreman), was to coordinate with the work train crew to carry out the scheduled activities.

Upon arrival in Chatham, Mile 61.6, the conductor met with the ballast gang foreman to discuss the train movements required. The conductor then briefed the RTC on the anticipated work train movements. Loaded ballast cars located at Thamesville were going to be dumped between Thamesville, Mile 46.7, and Northwood, Mile 52.5. Upon completion, time permitting, the crew would gather the empty ballast cars and take them to London before returning to Chatham. There were 26 empty cars at Chatham. In order to expedite the collection of the empty cars after dumping activities were completed, the conductor arranged to take the empties from Chatham to Northwood, Mile 52.5.

The conductor obtained clearance authority to proceed on the Chatham Subdivision north track from Mile 61 to Mile 54 and a work clearance on the north track between Mile 54 and Mile 46. The conductor rode on the last hopper car between Chatham and Northwood. There was no caboose. The locomotive was in the lead position, but it was facing westward with the long hood leading. There was no pilot^{Footnote 15} on the rear of the locomotive. Railway general operating instructions limit the reverse movement of a locomotive without a pilot at the rear to a maximum speed of 25 mph. The movement reached speeds of 50 mph between Chatham and Northwood.

At 0940, train 319 arrived at Northwood. The crew members planned to set off all cars at Northwood. However, they were only able to set off 17 of the 26 cars because there was a public crossing. The crew members had to avoid placing cars where they would block a motorist's view of approaching trains. They departed Northwood for Thamesville with 9 empty cars at 0955.

1.8.2 At Thamesville

The ballast gang foreman and three track maintenance employees who were to facilitate the dumping of the ballast arrived at Thamesville at approximately 0900. They prepared the loaded cars of ballast for dumping later on. The ballast gang foreman advised the crew on train 319 over the radio that the loaded cars of ballast were on the south side of the south main track on track CB40.

At 1010, train 319 arrived at Thamesville on the north main track and immediately cleared into track CB51, north of the north main track, to allow a track patrol foreman with a Hi-rail vehicle to pass on the north track. Train 319 remained on track CB51 while a passenger train, VIA train 72, passed on the south main track. Subsequently, train 319 obtained an additional work clearance for the south main track between Mile 48 and Mile 45. Train 319 re-entered the north main track and travelled eastward to the main track crossover. The crew then reversed both crossover switches and the train was moved eastward through the crossovers to the south main track. After crossing over, the east crossover switch was restored to the normal position, but the west crossover switch was left in the reversed position. The train continued eastward on the south main track, past the east switch to track CB40, where a crew member reversed the switch and removed the derail. The 9 empty cars were shoved westward into track CB40 and coupled onto 4 loaded cars of ammonium nitrate and 17 loaded cars of ballast which were already on that track. The crew then cut off the locomotive and secured the empty cars. The locomotive was moved eastward back out onto the south main track. The derail was restored and the main track switch at the east end of track CB40 was restored to the normal position.

The locomotive was then moved westward on the south track and stopped clear of the CB40 west main track switch. The switch was reversed, the derail was removed and the locomotive was operated eastward on track CB40 over the Highway 21 crossing and coupled onto the west-end car of the 17 loaded cars of ballast. After the hand brakes were released and the air brakes connected and charged, the locomotive and 17 cars were moved westward back out onto the south main track and stopped clear of the CB40 west switch. When the switch was restored to the normal position and the derail returned to the derailing position, the locomotive and 17 loaded cars of ballast were shoved eastward on the south main track towards the Highway 21 public crossing. The conductor was riding the east-end car and the trainman was on the ground between the two main tracks walking towards the crossing, giving radio instructions to the locomotive engineer concerning vehicle movements in proximity to the crossing and the status of the automatic warning devices^{Footnote 16}.

As the movement approached the crossing, the ballast gang foreman inquired over the radio if a train crew member would be available to drive his truck to Northwood. The ballast gang foreman anticipated dumping all the ballast between Thamesville and Northwood. By having his truck moved to Northwood, he would not require a ride back to Thamesville at the completion of the work. The conductor asked the trainman if he would be willing to drive the truck to Northwood and the trainman agreed. Having not previously travelled between these two locations by road, the trainman indicated that he would require directions. He walked to the ballast gang foreman's truck, which was located on a vacant gravel lot belonging to Orford Co-op, just east of Highway 21 and north of the north main track, to speak to the ballast gang foreman. While the trainman was obtaining directions from the ballast gang foreman, the conductor and locomotive engineer moved the train eastward over the Highway 21 crossing, continuing eastward until their locomotive was clear of the east crossover switch.

The plan was to begin dumping ballast immediately west of the crossing on the north main track. Additional ballast was required on the shoulders of the roadbed on the north main track between the Highway 21 crossing in Thamesville and Northwood. Generally, the process of dumping ballast on the shoulder of the track is accomplished by opening the hopper doors on the ballast cars while moving the train slowly in one direction. Railway track maintenance employees position themselves on either side of the cars to facilitate the opening of the hopper doors. The amount of ballast that accumulates in any given spot is regulated by the movement of the train and the extent to which the hopper doors are opened. This activity requires that the train be operated at a speed at which the employees can safely walk alongside the moving train, on the uneven ground, while opening the hopper doors. Further, to avoid gaps in the coverage of new ballast, the hopper doors are usually opened sequentially, moving backward from the first hopper opened.

Since the west crossover switch was still in the reversed position, it was only necessary to reverse the east crossover switch in preparation for the westward movement back over to the north main track. This task was completed by the conductor who then entrained on the locomotive. The following process, or one very similar to it, would have to have been followed to ensure that the two switches were returned to normal position:

• The trainman, after receiving directions from the ballast gang foreman, would have to walk southward along the east side of Highway 21, cross the tracks and position himself between the south main track and track CB40, adjacent to the east crossover switch.
• The movement would make a brief stop with the locomotive just east of Highway 21, for the ballast gang foreman and track maintenance employees to position themselves on either side of the north track just west of the crossing.
• Dumping was to commence just west of the crossing.
• As the tail-end car moved west of the east crossover switch, the trainman would restore the switch to the normal position. The trainman would restore the west crossover switch immediately after the last car of the train moved west of that switch and the entire train was on the north main track.
• The conductor would request confirmation from the trainman by radio that the crossover switches had been restored to the normal position.

The collective information obtained from the crew members was that they believed that this process had been followed.

Train 319 departed Thamesville at 1056 moving westward at 2 to 3 mph dumping ballast as the ballast gang foreman and track maintenance employees walked alongside. At 1140, the movement was stopped and the ballast gang foreman and his crew boarded the locomotive. Train 319 continued westward to Northwood to clear for trains 74 and 71, arriving at Northwood at 1154 and stopping in the clear at 1156.

The trainman departed Thamesville when the tail end of his train cleared the Highway 21 crossing at approximately 1110. He drove the ballast gang foreman's truck from Thamesville to Kent Bridge where he stopped to check on the progress of his train. He then drove to Northwood where he reversed the east siding switch and removed the derail in order for his train to clear the north main track to allow train 74 to pass.

The locomotive engineer of train 319 gave permission to train 74 to operate on the north main track of the Chatham Subdivision between Mile 54 and Mile 46 without restriction at approximately 1156.

1.9 Vandalism

Between the departure of train 319 from Thamesville and the arrival of train 74 at Thamesville, there was no authorized use of the main track crossover switches. Railway and regional police forces reported no recent acts of vandalism in the Thamesville area. There were no witness accounts of persons in the area of the crossover switches on the day of the accident between the departure of train 319 at approximately 1100 and the arrival of train 74, one hour later.

The crossover switches were secured with high security pad locks. There was no indication that the locks on either of the switches were tampered with. This type of lock gained widespread use in Canada after a VIA passenger train was diverted into a lumber storage track near Ottawa in 1984, colliding with a number of stationary cars after a main track switch had been vandalized. The high security lock was selected because of its rugged design and because the key could not be removed while the lock was open. These features were thought to be more resistant to vandalism. These locks were originally applied to main track switches located in urban areas and close to public road crossings where vandalism most frequently occurs. Their use was subsequently expanded to OCS territory where the provisions of CROR Rule 104(b) were applicable.

1.9.1 Keys for High Security Locks

Keys for high security switch locks were distributed to qualified railway employees. It was determined that, when the locks were originally introduced, the distribution of keys was recorded; however, this practice was not always followed. Although CN and VIA had systems to track which employees had been issued these keys, the issuance of subsequent keys was not consistently recorded.

1.10 Evacuation/Emergency Response

At 1202, an emergency telephone call was made by an employee at the Orford Co-op over the local 911 service. The 911 operator took the initial details of a derailed passenger train and began dispatching emergency services personnel. The train was evacuated in approximately 20 minutes and all passengers were taken off site by approximately 1250.

1.10.1 Passenger and Crew Response

Table 4 represents the train and locomotive consist of train 74 from front to rear and the approximate locations of all passengers and crew.

Table 4 - Passenger and Crew Locations^{Footnote 17}

Position in Train	No.	Rolling Stock Type	Passenger Capacity	No. of Passenger	No. of Crew	Total No. of Passengers and Crew
	6423	Locomotive	N/A	0	2	2
1	3468	Club (LRC)	56	19	3	22
2	3351	Coach (LRC)	72	30	1Footnote 18	31
3	3344	Coach (LRC)	72	64	1	65
4	3313	Coach (LRC)	72	65	1	66
Total			272	178	8	186

1.10.1.1 Club Car

At the time of the accident, three crew members were in club car 3468 immediately behind the locomotive. They included the second locomotive engineer, the service manager and a senior service attendant. The second locomotive engineer was sitting in the last row of passenger seats on the left side of the car. The service manager was standing at the rear of the car, and the senior service attendant was at the front. All three crew members were thrown forward on impact. The senior service attendant suffered a head injury when he was struck by either unsecured carry-on baggage or a metal emergency tool box stored in the passenger seating area of the car; he experienced transient unconsciousness.

Within minutes, two passengers broke open the L1 (left side, forward) emergency exit window. One of the passengers placed the window curtains over the edge of the window sill so people would not be cut as they climbed out. Approximately 15 passengers evacuated through the L1 window. The senior service attendant was one of the first to be evacuated because of his injury. The second locomotive engineer administered first aid to a passenger who had a severe nosebleed and then he broke open the L2 (left side, aft) emergency exit window and began evacuating passengers. Approximately four passengers evacuated from this exit. All occupants of this car were evacuated to the north side of the track. The service manager determined that none of the injuries to passengers and crew on this car appeared life threatening. Using his portable radio, he attempted to contact the locomotive crew but received no response. Using his cellular phone, he attempted to contact the VIA Operations Control Centre in Montreal, Quebec, but was also unsuccessful.

1.10.1.2 Coach 3351

There were no crew members in the interior of car 3351, located second behind the locomotive, at the time of the accident. Passengers seated adjacent to the R2 (right side, aft) emergency exit window, one of whom was a VIA maintenance employee, broke open the exit window. The R1 (right side, forward) emergency exit window was broken by passengers. Seat cushions were placed on the window sill to protect passengers from being cut as they climbed through the exit window. A senior service attendant, who had been between the first and second cars during the accident, entered the car as the passengers were evacuating. He immediately assumed a leadership role, directing and assisting passengers. He was the last person to exit the car. All occupants of this car evacuated to the south side of the track in proximity to the spilled ammonium nitrate.

1.10.1.3 Coach 3344

On impact, the senior service attendant in car 3344, third behind the locomotive, was thrown approximately 15 m, half the length of the car. Although he incurred fractured ribs, he was able to perform his emergency duties. Using the megaphone to issue commands, he evacuated ambulatory passengers by the north side entrance door of the car and directed emergency response personnel to those passengers who were unable to evacuate the train because of their injuries.

1.10.1.4 Coach 3313

The senior service attendant present in car 3313, the fourth car behind the locomotive and last car in the train, was propelled forward on impact and sustained a head injury. He lost consciousness and was unable to perform his emergency duties. The passengers expected a crew member to tell them what to do and their initial response was to locate travelling companions, administer first aid and collect their carry-on baggage. The passengers made no attempt to exit the car until instructed to do so by first responders approximately 10 minutes after the accident. First responders banged on the end door and shouted for passengers to open it and get out. At least one passenger tried to open the sliding end door but could not. The end door was eventually opened from the outside and passengers began exiting. Shortly thereafter, additional first responders entered the car from the forward vestibule and began evacuating passengers to the north side of the track.

1.10.2 Chatham-Kent Police Service

The Chatham-Kent Police Service was notified at 1203. Officers began arriving on site at approximately 1210. The police assumed a command role and participated in various ways, including but not limited to the following:

• evacuating passengers, particularly from the last car on the train;
• marshalling passengers who had evacuated on the south side of the track to the north side;
• directing passengers to a nearby warehouse for shelter;
• securing the accident site;
• notifying other appropriate response organizations/individuals of the derailment, as required;
• conducting a search of the train to ensure everyone had evacuated;
• setting up triage for passengers;
• establishing a manifest of all persons who had been on the train;
• taking statements from railway employees directly or indirectly involved in the accident;
• taking statements from passengers; and
• coordinating response activities with all organizations on site.

After assisting in the evacuation, the primary focus of the police involved assessing the need for a criminal investigation and acting on behalf of the coroner.

1.10.3 Chatham-Kent Fire Services

Chatham-Kent Fire Services were notified at 1203 of a train derailment at Thamesville. Beginning at 1206, 33 fire-fighters/rescue personnel and six fire-rescue vehicles from Thamesville and Bothwell volunteer fire stations started to arrive on site. The local fire chief went directly to the locomotive and observed that fuel was leaking from the fuel tank. Orford Co-op staff advised the fire chief that a large quantity of ammonium nitrate had been spilt during the accident. Given the risk of an explosion, fire-fighters focused on eliminating any potential source of ignition and controlling the spillage of diesel fuel. A local company specializing in transportation and clean-up of hazardous material was summoned to the accident site and arrived shortly thereafter. In addition, fire-fighters immediately began evacuating passengers from the club car and directing them away from the area. At approximately 1224, fire inspectors from the Chatham Fire Station arrived with an additional vehicle equipped with specialized equipment for dangerous goods response.

1.10.4 First Aid and Medical Attention

Emergency first aid was administered to some passengers and crew in a small machine shed on the Orford Co-op property just north of the tracks and at the Westover Centre^{Footnote 19} in Thamesville. Twelve ambulances from a number of local communities responded. Those who required further medical attention were taken by ambulance to the Chatham-Kent Health Alliance Public General Hospital in Chatham. A total of 77 passengers and crew were taken to the hospital. Seventy-three were treated and released and four were admitted.

1.10.5 Injuries

	Crew	Passengers	Others	Total
Fatal	2	-	-	2
Serious	1	3	-	4
Minor/NoneFootnote 20	5	175	-	180
Total	8	178	-	186

Two train crew members suffered fatal injuries when the locomotive collided with the hopper cars. Three passengers and one OTS crew member were admitted to hospital with serious injuries. These injuries included a fractured hip, a fractured tibia, a fractured frontal sinus, multiple lacerations and soft tissue trauma. Seventy-three other passengers and crew were taken to the hospital, received treatment in the emergency department and were later released. Numerous passengers were provided first-aid treatment on site. Others reported that they went to their family physician when they returned home. All of the passenger injuries were incurred when the passengers were thrown from their seats or when they were struck by unrestrained objects.

The majority of injuries sustained by the OTS crew, all of whom were standing at the time of the accident, were incurred when they were propelled forward through the passenger cars. Two OTS crew members were unable to perform their emergency duties as a result of their injuries. It appears that one of the two incapacitated OTS crew members was also struck by unrestrained carry-on baggage and/or a metal tool box stowed in the passenger seating area.

1.11 Passenger Safety

Numerous issues relating to passenger and crew safety were identified during this investigation. Some of these issues were noted in previous occurrences, others are new. Detailed descriptions, including past TSB safety action and related background information, can be found in Appendix B. In the course of the derailment/collision and subsequent evacuation, a number of these issues were encountered by passengers, crew and first responders and are listed below. Other issues discovered by investigators, but not believed to have played a role in the accident, are also listed below.

1.11.1 Passenger Safety Issues Encountered

The following safety-related issues were encountered by passengers, crew and first responders either during the derailment and collision or in the aftermath.

Secondary Impact Injuries

The TSB injury analysis indicated that many passengers were injured either when they were projected from their seats or struck by other unrestrained passengers.

Emergency Signage^__Manual Operation of LRC Side Doors

Emergency personnel responding to the accident indicated that they had difficulty identifying the emergency access panel because the panel and the signage were not sufficiently conspicuous.

Stowage/Securement of Carry-on Baggage

Unsecured carry-on baggage resulted in passenger injury and was an impediment to the evacuation. It is VIA's policy that items of carry-on baggage, weighing up to a maximum of 50 pounds, be stowed in the end baggage compartments at the "B" end of the passenger cars. This policy allows for excess carry-on baggage to be stored unrestrained in the passenger seating area. End baggage compartments have an open bay design, facilitating easy stowage. VIA does not have a system to inform passengers of this policy or to monitor compliance.

Storage of Emergency Tool Kit in Passenger Seating Area

An unsecured tool box, weighing approximately 20 kg, that had been stored in the end baggage compartment was projected into the passenger seating area. Section 10.19 of the On Board Trains Occupational Safety and Health Regulations states, "Where tools, tool boxes or spare parts are carried on rolling stock, they shall be securely stored."

Passenger Seats

During the accident, one bank of passenger seats (seats 25-26, car 3351) detached from the floor at the attachment point. The seat separated because it was not locked into position. Railway procedures for installation of passenger seats do not indicate how much to tighten the centre locking device or how to determine if and when the seat is locked. Forces generated were of sufficient magnitude to pivot seats that were not locked in position creating an obstruction to passengers and first responders.

OTS Crew Emergency Communication

Hand-held communication devices were projected away from the individuals to whom they were assigned.

Distribution of Portable Communication Systems

Some OTS crew members were provided with radio receivers only and could not communicate safety information.

1.11.2 Potential Passenger Safety Hazards

The following passenger safety-related hazards were not encountered by passengers, crew or first responders, but were identified during the investigation.

Emergency Signage

Emergency signage regarding manual operation of side entrance doors from the interior was incomplete. Emergency signage information regarding the location of emergency exits and the location of emergency equipment was inaccurate in coach cars.

Emergency Information Cards

All the emergency information cards in the coach cars were inaccurate as to the location of the emergency exit windows and emergency equipment. Emergency information cards were not readily apparent or accessible to passengers in aft-facing seats.

Passenger Seats^__Configuration at Emergency Exit Windows

Passenger access to emergency exit windows was partially restricted at 6 of 16 such exits due to the passenger seat configuration.

Decorative Artwork in the Club Car

Decorative artwork was potentially injurious due to its weight, framing material and method of securement.

1.11.3 Passenger Safety Improvements

The investigation determined that significant improvements have been made in a number of passenger safety-related areas. General safety briefings had been given to all passengers departing Windsor and specific briefings had been given to those passengers seated near emergency exits. Each car was equipped with readily accessible multi-trauma medical kits and emergency information pamphlets were available at every passenger seat. Legible luminescent emergency signage was posted throughout the train.

1.12 Locomotive Crashworthiness

1.12.1 Current Design Standards

The design standard for locomotive crashworthiness in effect at the time of this occurrence was Association of American Railroads (AAR) standard S-580. A copy of this standard is attached as Appendix C. This version of the standard was adopted in 1989, two years after the occurrence locomotive was manufactured, and applied to all newly manufactured locomotives. The following is a brief comparative description of the requirements of AAR standard S-580 and the previous design standard for the occurrence locomotive.

• Collision Posts - Collision posts are strong structural members located at the front of the locomotive, which extend upwards from the underframe. They are intended to protect the control cabin in the event of a head-on collision. Standard S-580 requires at least two collision posts, designed to withstand longitudinal forces of 500,000 pounds applied at deck level and 200,000 pounds applied 30 inches above deck. The collision posts on the subject locomotive exceeded this requirement; they were designed to withstand a force of 500,000 pounds applied 30 inches above the deck. The collision posts extended all the way from the top of the underframe upward, the entire height of the short hood. The top of the short hood is about 30 inches above the control cabin floor.
• Anti-Climber - An anti-climber is a device intended to counter the tendency, in a head-on collision, for the object being struck to rise above the underframe and strike the control cabin. Standard S-580 requires the anti-climber on the short hood end of the locomotive to withstand a 200,000-pound upwards force. The subject locomotive did not meet this requirement, and was only designed to withstand a 150,000-pound upwards force.
• Short Hood Structure - Standard S-580 requires the skin of the short hood to be a one-half inch steel plate at 25,000 pounds per square inch (psi) yield strength (or equivalent where thickness varies inversely with the square root of the yield strength). The subject locomotive met this design requirement. It was constructed using a one-quarter inch steel plate with a 90,000 psi yield strength which is considered to be equivalent.

1.12.2 Proposed Changes to Current Design Standard

A Railroad Safety Advisory Committee Working Group, comprised of the AAR, the U.S. Federal Railroad Administration (FRA), manufacturers (including GM of Canada), operators, and unions, has been working to revise standard S-580 to enhance the level of crashworthiness protection. Although this work is in the draft stage, amendments are being considered to include stronger collision posts on short hoods and the addition of corner post and window post requirements.

1.12.3 Structural Damage to Locomotive 6423

After the accident, the locomotive was taken to Ottawa where a crashworthiness analysis was conducted.^{Footnote 21} The following is a description of damage to locomotive 6423, specifically relating to its crashworthiness features.

• Collision Posts - The right collision post was forced aft and to the left whereas the left collision post was not significantly displaced. Even though the left collision post was not visibly deformed, the short hood near the top of the post was dented and sheared away. The right collision post was not bent along its length; however, the top of it was pushed aft. The structure which supports it at the bottom of the underframe was fractured. Close examination of the left collision post found similar damage to its underframe support structure, but which had not progressed to the same extent.
• Pilot and Vicinity - The right end of the pilot was pushed aft, while its left side was comparatively undamaged. The left ditch light was not broken. A large number of fine scratches on the surface of the right end of the pilot were consistent with having been caused by contact with the roadbed. The pilot or its surrounding area beneath the underframe did not contain deep gouges or severe structural damage as seen on the upper surfaces of the short hood that were consistent with contact with the hopper cars.
• Anti-Climber - The right end of the anti-climber was bent upwards. One gouge was observed on the underside of the anti-climber consistent with impact with the hopper cars. It is considered that much of this upwards bending likely resulted from damage to the underframe when the right collision post was forced aft.
• Short Hood - The short hood on the right was pushed back along with the right collision post. The short hood on the left was dented and sheared near the top of the left collision post. The left side of the short hood at the base of the collision post did not show any significant impact damage. The right side of the short hood contained numerous deep gouges in the metal where it contacted the loaded covered hopper cars.
• Control Cabin - The roof of the cabin was found separately, and was considered to have been torn away by the collision. The electrical cabinet, located behind the operators, was pushed towards the rear, more on the right than on the left. On the right side, the control console and short hood were pushed back beyond the operator's seat and downwards almost level with the cabin floor. On the left side, the operator's seat pedestal was still securely fastened to the floor, was visibly deformed towards the rear, and was not covered by the short hood or console. No buckling was observed in the cabin floor.
• Fuel Tank - The right side of the fuel tank was dented and punctured but the left side did not show any visible damage. The large number of fine scrapes suggested that the fuel tank was most likely damaged by contact with the roadbed and not with the hopper cars. There was one small puncture observed, less than 1/4 inch (6 mm) in diameter.

A number of other potential locomotive safety features, some of which are under consideration by U.S. regulatory authorities, were examined for their applicability to this particular type of accident. A brief description of each is contained in Appendix D.

1.13 Dangerous Goods at Thamesville

The Orford Co-op at Thamesville operates a fertilizer plant that is the main wholesale distributor of dry fertilizer products for Growmark Corporation in south-western Ontario. The plant handled approximately 29,000 tons of dry product in 1998. It has a storage capacity of approximately 9,000 tons of dry product. Most of the dry fertilizer products received at the plant arrive by rail and include:

• mono-ammonium phosphate
• ammonium nitrate
• di-ammonium phosphate
• potassium chloride
• potassium sulphate
• potassium-magnesium sulphate, refined (langbeinite)
• super-phosphate (acid phosphate, other than ammonium)
• urea, other than liquor or liquid

The plant receives approximately 600 car loads per year. Peak periods for fertilizer shipments are spring and fall. Most of the product is distributed from the warehouse; however, occasionally, product is transshipped directly from rail cars to customer trucks on track CB55. Plant personnel indicated that, although they place their orders to arrive in 3 to 5 car shipments, the railway often brings up to 15 cars of product to Thamesville at a time, storing them on various tracks. The plant also distributed 750 metric tonnes of anhydrous ammonia in 1998. There is an 80,000-gallon (363 680 L) anhydrous ammonia storage tank at the plant located approximately 850 feet (260 m) north of the main tracks. All of the anhydrous ammonia was received by truck. While in the transportation system, the dangerous goods are subject to federal jurisdiction.

At the time of the accident, there were about 500 tons of ammonium nitrate in storage in the warehouse at the plant, north of the north main track. There were four loaded cars south of the south main track on track CB40, on the west end of a cut of 13 cars, awaiting placement at the co-op. These four cars contained approximately 400 tons of ammonium nitrate. They were numbered as follows from west to east:

• NW177434
• NW177257
• NW178169
• SOU88691

Railway records indicate that these cars arrived in Thamesville at 0615 on 17 April 1999 and were placed on track CB58, north of the north main track. At the time of the accident, the cars were located on track CB40, south of the south main track. It was determined that the cars were handled on Norfolk and Southern Railway Company (NS) train 344. Train 344 was authorized by OCS clearance to operate on the south main track through Thamesville on 17 April 1999. This operating authority did not permit the crew on train 344 to set the cars off on track CB58, north of the north main track. Railway records do not show any movement of the cars from track to track at Thamesville between the date they arrived and the date of the accident.

Tracks at Thamesville are used for the switching, storing and off-loading of these products. All tracks at Thamesville are owned by the railway, although the fertilizer plant restricts the use of the portion of track CB58 that goes into its facility. Neither the railway nor TC considers track CB40 to be an ammonium nitrate storage facility. Cars stored on track CB40 are not accessible to Orford Co-op personnel. Orford Co-op did not consider cars stored on track CB40 to be under its care and control.

1.13.1 Risks Associated with Ammonium Nitrate

Ammonium nitrate is a crystalline compound with powerful oxidizing properties. It melts at about 169 degrees Celsius and decomposes considerably at 210 degrees Celsius. At 301 degrees Celsius, the decomposition accelerates considerably and, above 325 degrees Celsius^{Footnote 22}, ammonium nitrate deflagrates^{Footnote 23}. Such deflagration may change to detonation. The velocity of detonation of pure ammonium nitrate is between 1 140 and 2 700 m/sec. However, when ammonium nitrate is mixed with any organic or combustible material such as fuel oil, it explodes much more readily^{Footnote 24}, with a higher velocity of detonation and a more powerful explosion.

Ammonium nitrate is one of four dangerous goods for which it was deemed necessary in Canada to issue regulations pertaining to storage. Originally, Canadian Transport Commission General Order 0-36 was developed to provide regulations respecting the design, location, construction, operation and maintenance of storage facilities for ammonium nitrate and ammonium nitrate mixed fertilizers. Later, this General Order was consolidated as Chapter 1145 of the Handbook of Railway Operating, Engineering and Traffic Regulation. Further information on the risks associated with ammonium nitrate and other commodities handled at Thamesville can be found in Appendix E.

1.13.2 Regulations Pertaining to the Storage of Dangerous Goods

Regulation of dangerous goods in North America dates back to the beginning of the 20^th century. As a result of numerous accidents involving explosives and chemicals in the United States, the AAR established the Bureau of Explosives in 1905. The purpose of the Bureau was to establish and enforce, on all member railroads, standards of safety in the transportation of dangerous materials. In Canada, the Board of Railway Commissioners issued Order No. 7881, entitled Regulations for the Carriage of Explosives, on 27 February 1909. This Order was applicable to explosives in transportation only.

In time, it became evident that not only the transportation, but also the delivery and storage after delivery, of other dangerous goods posed significant risk. On 16 January 1917, the Board of Railway Commissioners adopted additional requirements developed by the AAR and issued General Order No. 100 instructing that explosives not remain on railway property for more than 48 hours after arrival at a destination point. On 31 December of that same year, the General Order was expanded to include all dangerous goods and it stipulated that any such material not be left at any point within the transportation system for more than 48 hours. These requirements were known as the 48-hour rule.

The Board of Railway Commissioners issued special permits exempting the applicants from certain regulatory requirements in situations where it was deemed necessary to hold cars in excess of 48 hours. Whenever special permits were issued, any conditions considered necessary to enhance safety were prescribed.

In 1949, an amendment was issued which excluded weekends and statutory holidays from being included in the 48-hour rule.

The requirements of the 48-hour rule were retained through several periods of restructuring of the railway safety framework in Canada. In 1985, the regulations issued pursuant to the Railway Act, R.S.C. 1985, c. R-3, including the 48-hour rule, were administered for a brief period by the National Transportation Agency^{Footnote 25} (NTA). The administration of these regulations was transferred to TC with the proclamation of the Railway Safety Act, S.C. 1988, c. 40, on 01 January 1989. The following is the text of the 48-hour rule as it existed in the Regulations for the Transportation of Dangerous Commodities by Rail at the time of the proclamation of the Railway Safety Act:

S. 74.582 Movement to be expedited.

(a) Carriers must forward shipments of dangerous commodities promptly and within 48 hours, Saturdays, Sundays, and holidays excluded after acceptance at originating point or receipt at any yard, transfer station, or interchange point, except that where bi-weekly or weekly service only is performed, shipments of dangerous commodities must be forwarded on the first available train.

Additionally, these regulations contained provisions for the issuance of special permits as follows:

S. 71.6 Special Permits; standard requirements and conditions.

(a) The Director of Operation, R.T.C.^{Footnote 26}, may issue special permits to any person or class of persons granting such exemptions from any of these regulations as he determines will not appreciably lower the standards of safety established hereby.

With the proclamation of the Railway Safety Act, consequential amendments and repeals were made to other acts and regulations as a standard procedure to prevent incompatibility. As a part of these amendments and repeals, the Regulations for the Transportation of Dangerous Commodities by Rail were amended by specifically vesting the Minister of Transport with responsibility for the issuance of special permits. In response to the increasing demands of administering outstanding individual special permits and the processing of additional applications, TC, together with the member railways of the RAC, chose to replace individual site-specific permits for storage of dangerous goods with one special permit covering all storage sites in Canada. Further, TC suggests that this change would result in consistent application of common conditions and site selection criteria to all storage site locations across Canada.

In addition to the sites for which applications had been previously issued, approximately 40 sites were pre-selected for the storage of various commodities. These sites were inspected several times each year. The railway companies were encouraged to upgrade access roads and improve the quality of the track. Some sites were required to be lighted and equipped with fire hydrants and a supply of neutralizing agents.

On 11 July 1989, Special Permit 3255 was issued and the (then) 10 member railways of the RAC were named as "Special Permit Holders." The permit allowed storage of dangerous goods anywhere in Canada in excess of 48 hours, provided that the Special Permit Holders complied with 13 different conditions described in the Permit as summarized in Appendix F. This Permit was issued for a duration of nearly two years, with an expiry date of 30 June 1991.

On 30 August 1989, the NTA initiated an inquiry into all matters connected with the storage of dangerous goods on railway property, based on a number of occurrences relating to marshalling and storage activities. The inquiry concluded that there was a lack of compliance with the terms of Special Permit 3255, as well as a lack of effective regulatory overview. In response to the recommendations of the inquiry, TC set up multi-disciplinary inspection teams, each comprising a Dangerous Goods Rail Inspector, a Railway Safety Inspector, a Railway Dangerous Commodities Officer, a Risk Management Officer and representatives of local emergency response organizations (usually fire departments). These teams visited 121 sites which had been designated for storage of dangerous goods under Special Permit 3255. Of the 121 sites proposed by the railways, 60 sites were disqualified by this group. Some locations were disqualified because of their proximity to high-speed passenger train operations, proximity to dwellings, places of public assembly, etc. Many of the remaining 61 sites were found suitable, with restrictions to the type of products to be stored, the use and operations of storage and train operations on adjacent tracks. Thamesville was not identified as a site for storage of dangerous goods; therefore, it was not visited or assessed.

On 27 June 1991, Special Permit 3255 was revised and extended until 30 June 1994. The only safety-oriented change was that, where the original permit required hand brakes to be applied on all stored cars of dangerous goods, hand brakes were required to be applied only on as many cars as necessary to prevent their movement, consistent with the general application of CROR Rule 112, Securing Equipment. No other revisions of the permit were made before its expiry date.

A document entitled Special Permit 3255.1 was issued by TC on 01 March 1995. This document was a modified version of the previous permit that removed a number of the safety conditions. Schedule "B" of this document contained a table of minimum acceptable distances between dangerous goods of different classes and "commercial establishments, residences, places of assembly and sensitive environment areas." The table did not specify quantities of dangerous goods, nor did it distinguish between single residences, hospitals or protected environments. TC intended that the quantity of dangerous goods acceptable for storage be determined by inspectors as part of the process of the site qualifying with the inspectors' minimum acceptable conditions. The expiry of this document was 30 June 1995.

In the fall of 1995, the RAC issued Circular No. DG-1, entitled Recommended Practice for the Safe Handling of Railway Cars Loaded with Dangerous Goods Delayed in Transit on Railway Property, and section 74.582 (48-hour rule) was revoked by TC. In the regulatory impact analysis statement that led to the revocation of the 48-hour rule, it was indicated that the regulatory and industry conclusion was that there was "considerable doubt that a public safety concern is being addressed by these provisions."

There are significant differences between the terms of original Special Permit 3255 and Circular DG-1, although the site selection criteria were derived from the original document. Special Permit 3255 had been issued on terms prescribed by federal regulations and any deviation from the prescribed terms constituted a punishable offence. RAC Circular DG-1 specifies only recommended safe practices from an industry association to its member companies and carries no requirement for compliance or consequence for non-compliance. RAC Circular DG-1 specifies conditions under which TC and the member railways of the RAC believe that safe storage of dangerous goods can take place on railway property. Under this new arrangement, RAC member railways are obliged to respect their own industry practices as set out in the circular. In addition, RAC Circular DG-1 applies to "delayed" cars "in transit." When cars are not delayed, the circular is not considered applicable. Furthermore, when a car has arrived at its destination, it is considered to be no longer in transit. CN considered the four loaded cars of ammonium nitrate on track CB40 at Thamesville to have arrived at destination, and that they were therefore exempt from RAC Circular DG-1.

The following summarizes other safety-related changes to dangerous goods handling and storage under RAC Circular DG-1:

• RAC Circular DG-1 does not require the railways to maintain an accurate record of the railway vehicles containing the dangerous goods, the dangerous goods and the location where the dangerous goods are held, including the mileage, subdivision, track and additional information, as appropriate, nor to make this record readily available to TC upon request.
• RAC Circular DG-1 does not require that the movement of railway vehicles on an adjacent track be made at a speed consistent with safety.
• RAC Circular DG-1 does not require that TC be involved in the selection of holding sites.
• RAC Circular DG-1 lengthens the inspection requirements to every 48 hours after the fifth day cars have been held to ensure that they are not leaking except when the distances specified in the primary selection criteria have not been met. Under these circumstances, a visual walk-around inspection has to be performed every 24 hours after the fifth day a dangerous goods car is held at one location.

1.14 Train Control Systems

Train control systems are used to provide for the safe operation of trains on the main track and to protect track work activities. These systems must provide for the separation of trains travelling in the same direction and the safe passing of trains travelling in opposing directions both in single-track and multi-track applications. There are currently three methods of train control authorized by the CROR, two of which are in widespread use in Canada by both federally and provincially regulated railways: CTC and OCS. The third, Special Control System (SCS), provides rules for the introduction of a new train control system.

1.14.1 Centralized Traffic Control System (CTC)

CTC has been in widespread use in Canada for decades. It has traditionally been the preferred method of train control on territories with higher traffic volumes. In CTC, interconnected track circuits are used to indicate the occupancy of main tracks, signalled sidings and signalled yard tracks. Track occupancy, broken rails and switches in the reversed position are detected by the track circuitry. The system displays activated track circuits to the RTC and signal indications to train crews on wayside signals, which are actuated when the wheels of a train modify an electric circuit. The signals are known as block signals. A block is defined in the CROR as:

A length of track of defined limits, the use of which by a train or engine is governed by block signals....

In CTC, an RTC can control some signals, known as controlled block signals, but only to the extent that they can be requested to display a permissive signal indication instead of the "stop" indication which is their default indication. The actuation of the signals by an approaching train and the status of the blocks ahead dictate the degree of permissiveness that the signals can display. In addition, the RTC has control over some main track switches. These "power"^{Footnote 27} or "dual control"^{Footnote 28} switches are at locations known as controlled locations. Between controlled locations, train movements are governed by intermediate block signals that are not controlled by the RTC. Due to the manner in which track circuits are interconnected, under normal circumstances, the system provides at least two consecutive block signals' advance warning to train crews approaching such conditions as occupied track, broken rails^{Footnote 29}, open hand operated main track switches or controlled block signals set at stop.

1.14.2 Occupancy Control System (OCS)

Before December 1990, federally regulated railways were operated under the Uniform Code of Operating Rules (UCOR). Under the UCOR, there were also three methods of train control: Train Orders, CTC and Manual Block System (MBS). The majority of train operations were under Train Orders or CTC. MBS rules provided for a method of train control that was in limited use on low-traffic density track until the late 1980s. At about this time, CN and CPR introduced separate versions of computer-assisted MBS. Unlike the original MBS which required the RTC to issue and record track authorities on paper, the computer-assisted systems used an electronic database to record this information. A series of procedures was developed for the operation of this system. These procedures were later revised and adopted as the OCS rules under the CROR. Operating software for these systems was designed around the logic of the OCS rules and is intended to prevent the issuance of conflicting track authorities. The OCS rules, as well as other operating rules, promote accurate communication and data entry through requirements to repeat information, make written records, and provide acknowledgement of accuracy.

In OCS, a track authority is normally transmitted by the RTC to crews by two-way radio, although in some instances, authorities are sent electronically to remotely located computers or fax machines. When authorities are received by radio, crews make a written record and repeat this information to the RTC from the prescribed form for verification. There are procedures to ensure that the same information is entered into the OCS computer and copied by the crews.

OCS is applied to territories both with and without ABS. Where OCS is applied alone, it is known in the railway industry as OCS outside ABS, or "dark territory," and there are no supplementary physical defences associated with this method of operation. Traffic density in dark territory is usually lower than in OCS/ABS territory.

ABS is defined in the CROR as follows:

A series of consecutive blocks which are governed by block signals, cab signals, or both, in which ABS rules apply. The signals in ABS are actuated by a train or engine, or by other conditions affecting the use of a block.

In OCS/ABS, conditions such as the occupancy of the main track ahead by rolling stock, broken rails and open main track switches are normally protected through the indications of the block signals. Although the signals do not provide answers as to the reasons for their indications, the requirements attached with these indications restrict the permissible speed of trains when a condition is detected and the rules require crews to be on the lookout for the causes. ABS signals are not controlled by the RTC and their indications are not available for the RTC to view.

1.14.3 Human Error and Train Control Systems Design

Simply defined, a system is an entity that exists to carry out some purpose.^{Footnote 30} A system is composed of humans, machines and other elements (e.g. procedures, software) that interact to accomplish a goal. One of the fundamentals in the design of safety critical systems is understanding how human error will have an impact upon that system. Basic principles of systems design seek to reduce the outcome of human error. Common strategies include decreasing opportunities for operators to produce errors within the system, making errors visible and reversible, and mitigating error consequence.

When it is not practicable to eliminate human error through design, system defences can be put in place. Typically, defences can be either physical or administrative. In the context of a train control system, physical defences could include audible alarms, visual indicators, such as wayside or cab signal indications, or automatic train stop protection. Similarly, administrative defences could include safety regulations, policies, procedures and operating rules.

1.14.4 Past TSB Safety Action

On 06 April 1999, the TSB issued a Rail Safety Advisory to TC concerning the safety defences associated with the OCS method of train control. Three occurrences in early 1999 in which communication errors between train crews and RTCs potentially compromised safety prompted the issuance of the advisory. The TSB did not investigate the occurrences, but it recorded pertinent data from all of them. In each case, the unsafe conditions were detected by railway employees involved, who took immediate action to reduce the potential risk. The operating railway investigated each of the three occurrences. It attributed two of the occurrences to a lack of dedication to normal assigned duties on the part of an employee and the third to confusion resulting from similar sounding station names on the same subdivision. The TSB expressed that, although a number of procedural measures exist to promote accuracy between communicating parties, such as repeats, underscoring and acknowledgments, there are no other physical or administrative means by which the system is able to verify the accuracy of the information ultimately held by either party. In this environment, an error in data entry or a failure in established procedures to correct an inaccuracy is all that is necessary to compromise the integrity of the system.

On 15 September 1999, TC responded to the advisory indicating that it had reviewed the safety measures associated with OCS, specifically those control defences associated with ensuring accurate communication and verification of information, and that it is of the view that the existing control defences are adequate to ensure that OCS is a safe method of train control. TC advised that it had implemented a formal auditing process with respect to providing assurance that railway companies are conducting rail traffic control operation in compliance with approved rules and existing regulations as well as internal railway safety management procedures.

1.14.5 Regulatory Requirements for Control of Passenger Trains at High Speeds

In Canada, regardless of the type of train control or the presence/absence of ABS, there is no federal requirement for the setting of train speed. Maximum allowable speeds for passenger and freight trains are determined by the railway based upon track and roadbed engineering criteria that are governed by the TC-approved Railway Track Safety Rules.

In the United States, an investigation was conducted by the Interstate Commerce Commission (ICC) in the mid 1940s to determine whether it was necessary, in the public interest, to require any railway under its jurisdiction to install a block signal system, interlocking, automatic train stop or train control, cab signals or other similar appliances, methods, and systems intended to promote the safety of railroad operation. The ICC concluded that higher speeds and a greater number of trains had increased hazards and necessitated more and better protection for the travelling public. Subsequent to this investigation, the ICC issued orders that required the installation of block signal systems or manual block systems^{Footnote 31} where passenger trains were to be operated at speeds of 60 mph or more and freight trains were to be operated at speeds of 50 mph or more. Those restrictions remain in effect today in the United States.

2.1 Introduction

From the facts obtained during this investigation, it was readily apparent that the derailment and collision resulted from a misaligned crossover switch. In the terminology of safety investigations, the crew and passengers on VIA train 74 encountered an "unsafe condition"^__the reversed main track crossover switches. An unsafe condition can be described as a situation or condition that has the potential to initiate, exacerbate, or otherwise facilitate ann undesirable event. The TSB's investigation targeted the determination of the circumstances that precipitated the existence of that unsafe condition, the reasons why it remained undetected and uncorrected, and methods of reducing the associated risks of accidents and their consequences.

This section of the report will draw together the factual information presented to identify safety deficiencies and residual risks, including:

• the reversed main track crossover switches at Thamesville;
• OCS system defences;
• the derailment, collision and post-accident response;
• locomotive crashworthiness;
• dangerous goods cars at Thamesville; and
• passenger safety.

2.2 Reversed Main Track Crossover Switches at Thamesville

The investigation did not determine the circumstances surrounding the reversed main track crossover switches with absolute certainty. However, the facts permit consideration of a number of hypotheses and a determination of the only reasonable explanation.

Vandalism

There was no information to suggest that vandalism had occurred. A vandal would have had to act in the relatively short time between the last authorized use of the switches and the approach of train 74 to Thamesville^__approximately one hour. The time of day and physical location of the crossover switches would have necessitated a prospective vandal to act in daylight, within clear view of residences and businesses. Further, both crossover switches were locked in the reversed position with high security locks that showed no indication of tampering. Although CN's tracking of the keys for these locks was found to be inconsistently applied, there was no information to suggest that keys for high security switch locks were readily available to non-railway employees. Railway and municipal police records contained no information supporting a history of vandalism in the area.

Sabotage

It is unlikely that an act of sabotage by railway employees precipitated this accident. The potential consequences would be known to railway employees. All railway employees working in the vicinity of Thamesville on 23 April 1999 were interviewed by the TSB in the conduct of the investigation and all were cooperative and forthright. There was no information to suggest that a disgruntled railway employee or former railway employee had acted out of malice.

Inadvertent Error

The recollection of the work train crew was that the two switches were restored to the normal position and locked. They confirmed that intra-crew communications occurred to verify that the switches were restored. Although this information would suggest that this crew left the switches in the normal position, the absence of any other plausible explanation for the situation encountered less than one hour later by train 74 raises questions about the accuracy of the recall of the work train crew.

In the course of the ballast train positioning process, the trainman walked to the ballast gang foreman's truck to get instructions about driving the truck to Northwood. It is not known if this work interruption affected the actions necessary to the appropriate lining of the switches. However, such departures from regular operational routines increase the risk of error in performing tasks.

It is likely that the trainman's concentration on the task of restoring the crossover switches was reduced by his planning to remain behind to drive the foreman's truck to Northwood. In any case, and regardless of the exact sequence of events, it is most likely that the crossover switches were left reversed by the work train crew and that the actions that resulted in the crossover switches being left reversed were inadvertent.

Train control in areas such as Thamesville is such that, once a work train receives authority to operate in a designated area, it is the crew's task to restore switches to normal and to permit the passing of any through traffic, sometimes with certain restrictions. This system is generally effective, but it depends on human memory, training and procedures. Even with well trained, well rested and motivated employees, there will be slips, lapses, mistakes and adaptations^{Footnote 32} which will occasionally result in accidents.

The scheduled activities of the work train crew on the day of the accident were indicative of normal railway operations. There were, however, a number of decisions made by the crew members throughout the day that were inconsistent with recommended practices. Departing Chatham, the conductor chose to ride on the tail-end car instead of in the locomotive (there was no caboose). En route to Northwood, the movement reached speeds of up to 50 mph (this compromised the conductor's personal safety). The locomotive was not equipped with a pilot on the rear and was consequently restricted by railway general operating instructions to speeds not exceeding 25 mph. At Thamesville, the reported timing of the restoration of the east crossover switch was before the tail-end car of the movement completely cleared the west crossover switch. This action would have been inconsistent with the requirements of the CROR. Collectively, these decisions may be indicative of a general tendency towards conscious adaptation of safety-critical procedures. Individuals often make adaptations when they do not perceive a logical justification for absolute compliance and they do not believe their adaptation will compromise safety. Adaptive behaviour may represent a successful means to an end in some circumstances; however, this can lead to a false sense of security because individuals are not always able to accurately predict the outcome of their adaptations. In some instances in the railway operations domain, there are few lines of defence and absolute compliance is all that stands between safety and an unsafe condition.

2.3 OCS System Defences

2.3.1 Adequacy of OCS System Defences

In the aftermath of this occurrence, the west crossover switch, lined and locked in the reversed position, represented the first unsafe condition encountered by train 74. The reasons this unsafe condition remained undetected and uncorrected are of greater consequence to the advancement of safety than the events that led to the existence of this unsafe condition. A single error leading to catastrophic consequences is one of the most undesirable characteristics of any safety critical system. Given that humans make errors, it is imperative that operations are designed such that a single human error does not result in a catastrophe.^{Footnote 33} There are human reliability analysis techniques to predict the likelihood and consequence of human error for a given task. Similarly, there are system reliability analysis techniques to understand the effects of human interaction on a system. When these techniques are used in the design of safety critical systems, measures can be incorporated within a system to minimize the frequency of human error, reduce the consequence and even correct errors before there are adverse consequences. The facts of this investigation suggest that there were inadequate system defences to detect and correct the single error that led to the unsafe condition of the unauthorized reversed main track crossover switches.

Train 74 approached Thamesville at the maximum authorized speed. When in possession of a valid operating authority and not subject to any speed restrictions, locomotive engineers are expected to operate their trains as close to the maximum speed as safely possible without exceeding it. The crew members had been given permission to operate within the limits of another train's clearance and had been told that they had no restrictions within those limits. The train control system was unable to detect that the main track crossover switches had been lined and locked in the reversed position and provide train 74 with the necessary information to ensure safety.

The OCS method of train control, particularly outside of ABS, has, in the past, presented regular opportunities for errors to lead to potentially catastrophic consequences. Most of these errors are detected by railway employees either through existing administrative defences or through vigilance. This was brought to TC's attention in early April 1999, in the context of several communication errors^{Footnote 34} that occurred earlier in the same year. Although the type of occurrences that prompted this correspondence would appear much different than in the situation at Thamesville, the underlying factor remained the same^__the vulnerability of OCS to human error. In September 1999, TC assessed the system defences associated with ensuring accurate communication and verification of information in OCS and expressed the view that the existing control defences appeared to be adequate to ensure that this was a safe method of train control.

2.3.2 Canadian Rail Operating Rules

CROR Rule 104 applied to the crossover switches at Thamesville and required that they be left lined and locked in the normal position. This rule distributed responsibility to all crew members to ensure that these switches were left in the normal position, but it did not clearly define requirements to communicate the position of main track switches. The work train crew members recalled that, at Thamesville, they communicated the position of the crossover switches on a number of occasions. While this part of Rule 104 leaves its method of application to the discretion of those involved, crews will generally communicate among themselves to ensure compliance. The success of an administrative defence such as this rule is likely to improve when there are clearly defined communication requirements.

Canadian railway culture, with respect to the handling of main track switches in non-signalled territory and railway operations in general, can be accurately categorized as "rules-based." In this context, the term "rules" includes not only the Canadian Rail Operating Rules, but all written railway procedures. In most railway occurrences, there are rules that are not complied with. Usually, the railway investigates and issues discipline to those individuals who have violated the rules. TC may investigate for regulatory safety reasons, including for the purpose of prosecution of either the railway or the individuals who did not comply with the rules. The TSB's mandate requires that it look beyond violations to consider why such occurrences happen and how to reduce the associated risk.

It is a known fact that well meaning and well trained individuals, exhibiting normal human behaviour, will sometimes make errors. Increasing the consequence of non-compliance and increasing training and supervision seem to result in limited improvements in these administrative defences. In the continuing dialogue between the TSB and TC on reversed main track switches, TC continues to endorse initiatives aimed primarily at increasing the effectiveness of existing administrative defences and improving the conspicuity of switch targets. TC has not required the implementation of enhanced physical defences to provide advance warning of main track switch positions to approaching trains in dark territory. The Board is of the view that safety would be advanced if the railways and TC would collectively examine the role of human error and work towards implementing safety critical systems to reduce the consequences thereof.

TSB occurrence data do not suggest an increasing trend in accidents and incidents involving unanticipated reversed main track switches; however, these occurrences represent an unacceptable risk, particularly when passenger trains are involved. Between 1993 and 2000, passenger trains encountered reversed main track switches in OCS outside ABS on average about once a year, while the average for freight trains was about five times a year. This rate can be expected to continue unless improved systems are implemented to allow crews to identify the situation in advance. Given the potential for loss represented by each occurrence, these data present a strong argument for the implementation of an effective advance warning system.

2.3.3 Main Track Switch Targets

The last defence available to train 74 approaching Thamesville was the switch targets. The investigation could not determine whether the crew applied the emergency brakes in response to observing the switch target or the switch points. Given the distance from which the emergency brake application was initiated and the visibility conditions present, it is most likely that the crew responded to the switch target. Main track switch targets are not endorsed by the railways as a primary defence against misaligned switches.

Railway industry interpretation and teaching of the purpose of switch targets are that, in addition to indicating the position of a switch, switch targets provide a visual aid in determining the exact location of switches when the requirement to use a switch is known to a train crew in advance. In response to a TSB recommendation that the Department of Transport ensure that passenger trains can stop before reaching misaligned main track switches, TC indicated that it had directed the railways to consider and propose corrective measures with respect to locations where switch target visibility and minimum train braking distances indicated a potential safety risk.

While the improved conspicuity of switch targets is desirable, because trains are not required to be able to stop short of unauthorized reversed main track switches, targets in general should not be regarded as a primary defence but rather a secondary or tertiary defence. In the circumstances at Thamesville, the switch target was the only defence remaining.

Canadian passenger trains have successfully negotiated similar switches in the 50 mph to 55 mph speed range. The brakes were applied on train 74 about 5 seconds before it arrived at the west crossover switch. In that time, the train slowed from 80 mph to 74 mph. In order for train 74 to have entered the crossover at 55 mph instead of 74 mph, with the rate of deceleration constant at approximately 2 mph per second^{Footnote 35} after the above deceleration, the brakes would have to have been applied in emergency approximately 10 seconds earlier than they actually were. Therefore, about 16 seconds in total would have been required to decelerate to 55 mph at the crossover entrance. In order to have slowed to 30 mph, the maximum design speed for the turnouts of the crossover, the brakes would have to have been placed in emergency about 12 seconds earlier still; i.e., for a total of about 28 seconds.

The existing targets were visible to investigators specifically looking for them from about 1,400 feet (425 m) (about 12 seconds at 80 mph) on a clear day; however, it is unlikely that a more conspicuous target without additional advance warning could have been observed and acted upon by the locomotive crew members on train 74 in time for their train to have negotiated the crossover safely. Further, in the specific circumstances at Thamesville, with a crossover between two main tracks and the opposing train approaching on the adjacent main track, negotiating the crossover safely would not have removed the risk of a head-on collision.

Elsewhere on the national railway system, hundreds of train movements are made daily in the vicinity of main track switches, often at locations where the view of switch targets is obscured by track curvature, weather or other obstructions. In CTC and OCS/ABS, the physical defences afforded by track circuits and wayside signals provide advance information to approaching trains when a switch is reversed. In OCS outside ABS, there is no such warning. Safety is dependent upon absolute observance of operating rule requirements by those railway employees handling main track switches and the probability of an approaching train crew spotting a switch target in time to slow to a safe speed. There is no protection against the possibility that a switch may be inadvertently left reversed or vandalized.

2.3.4 Speed Requirements

In 1946, the U.S. ICC recognized that requiring the installation of signal systems or limiting the speed of trains on territories without them was in the best interest of public safety. No such determination had been made in Canada. The ICC concluded at that time that, while accident hazards were more readily apparent due to higher speeds and a greater number of trains, the need for better protection was generally required throughout the country.

More than 50 years have passed since this U.S. decision that limited the speed of passenger trains in non-signalled territory to a maximum of 59 mph, and these requirements remain in effect today. In recent years, however, passenger train speeds in Canada have been increased to 95 mph on selected subdivisions in non-signalled territory. Preparation to accommodate these speed increases included improved level crossing protection, other infrastructure improvements and public consultation.

The vast majority of Canada's busiest railway subdivisions are equipped with wayside signals. Today's signals represent an evolution of 1940s technology and it is generally accepted that they provide increased safety. It was the ICC's view that an acceptable level of safety could be achieved by either installing signals or reducing train speeds. In comparison, in Canada, at locations like Thamesville, with 80 mph track in dark territory, train speeds have been increased without installing signals. The result was a significant risk of passenger trains encountering switches in the reversed position, while travelling at a high speed, thereby exposing train crews, the travelling public and residents of track-side communities to danger.^{Footnote 36}

2.4 The Derailment, Collision and Post-Accident Response

2.4.1 Actions of the Locomotive Crew on Train 74

The operation of train 74 at maximum authorized speed approaching Thamesville is consistent with standard railway operations. The crew would not have been specifically on the lookout for reversed switches, but would likely have been focussing ahead. A number of visual cues would have been present approaching Thamesville: vehicular traffic at the Highway 21 crossing, the automatic warning devices for the crossing, and stationary rolling stock on both sides of the main tracks. The weather was overcast with light rain causing reduced visibility conditions.

Recorded information indicates that the train brakes were placed in emergency approximately 600 feet (180 m) and approximately 5 seconds before the train arrived at the west crossover switch. It takes time for an individual to identify a visual stimulus, choose a course of action and perform that action. Exactly how much additional time cannot be determined with certainty, but it is known that experience and training can reduce the amount of time necessary.

The decision to put a passenger train into emergency braking from 80 mph is not one that is taken lightly by locomotive engineers. Each time a train is placed in emergency, there is the risk of derailment and wheel damage, and in the case of a passenger train, there is the risk of injuring passengers and crew. Unrestrained persons can be moved about. Injuries can result from unrestrained beverage carts, carry-on baggage and individuals, as well as from spilled hot meals and beverages.

Immediately after recognizing the reversed switch, the locomotive crew members took a number of safety critical actions. Knowing that, whatever the outcome, their train was going to be obstructing the south main track and that an opposing passenger train was approaching Thamesville on that track, they transmitted a radio distress call to that train. As a result, the opposing train was able to make a controlled deceleration and the safety of the passengers and crew on board was not compromised. The activation of the engine stop switch effectively shut down the diesel engine and removed a source of ignition. Although it is unlikely that the crew members were anticipating that their train would come into contact with the ammonium nitrate cars, this action reduced the risk of fire and explosion.

The application of the emergency brakes, the transmission of the emergency distress call and the activation of the engine stop switch, all in a matter of seconds, were indicative of a high level of vigilance and professionalism on the part of the locomotive crew on train 74. In addition, these actions likely reduced the severity of the consequences.

2.4.2 Emergency Response

The emergency response was rapid and professional. The initiation of the 911 emergency call almost immediately after the accident facilitated the timely notification of all emergency services. The fact that the accident occurred within a municipal area resulted in a rapid response. The regional municipality of Chatham-Kent, within which Thamesville is located, was appropriately prepared and had the services necessary to respond effectively.

2.4.3 VIA Train and OTS Crew Response

Although two of the five OTS crew members were injured and unable to fulfill their emergency duties, the remaining OTS crew members and the second locomotive engineer responded quickly in organizing and carrying out the evacuation. Multi-trauma medical kits were present and crew members knew where to access them. One crew member used a megaphone to communicate evacuation instructions. It is likely that the passenger safety briefings delivered by OTS crew members and the availability of seat-back emergency feature cards effectively raised the level of knowledge of some passengers. Indications are that crew members who were able to carry out evacuation duties demonstrated the necessary knowledge to render assistance.

2.5 Locomotive Crashworthiness

The short hood and roof of the locomotive had inadequate energy-absorbing capability to protect the occupants of the cab from an impact of this severity. The rocking motion that occurred as the locomotive negotiated the crossover ultimately led to its colliding in a rightward leaning orientation with the stationary loaded covered hopper cars. Because of this orientation, the locomotive sustained a frontal impact in an area least resistant to damage^__the short hood and roof.

Since the majority of impacts sustained by locomotives occur while they are upright, it is reasonable to say that they are designed to withstand the greatest forces at frame height. In the vast majority of these impacts, the other object is another piece of rolling stock or a vehicle at a public crossing. The pilot and anti-climb features usually keep the object down. If the object should raise above the pilot, then the collision posts in the short hood provide additional protection. In the event that an impact is sustained above the short hood in the window and roof area, either due to an object raising above the pilot and short hood or due to the orientation of the locomotive, there is only limited structural protection for the occupants of the operating cab.

Even though locomotive 6423 was built before crashworthiness standards were adopted by the AAR, it exceeded most of the requirements of those standards. TSB engineers looked at a number of crashworthiness safety features, some of which are under consideration for inclusion in the AAR standard. A number of these features hold potential to improve safety for the occupants of locomotive cabs. They include:

• rollover protection;
• crash energy management;
• shatter-proof windows;
• corner posts; and
• window posts.

Because of the velocity of the train, the orientation of the locomotive and the rigidity and large masses of the two colliding objects (locomotive 6423 and loaded covered hopper cars), it is likely that a much stronger window and roof area would still not have provided enough protection for the occupants of the operating cab.

Two crashworthiness safety features have been considered by U.S. regulatory authorities as having the potential to improve the likelihood of survivability in an impact similar to Thamesville. A crash refuge space located in the floor of the locomotive cab could have proved beneficial, if the occupants could have accessed it in time. Deflection plates, although likely requiring structural changes to a locomotive, might have deflected the locomotive away from the stationary rolling stock.

2.6 Dangerous Goods Cars at Thamesville

The loaded cars of ammonium nitrate stored on a track immediately adjacent to the main tracks of the Chatham Subdivision represented another unsafe condition at Thamesville. When mixed with diesel fuel and subjected to a strong impact, ammonium nitrate can explode. The probability of fire from a collision in which a locomotive sustains major damage is high. Fires of ammonium nitrate alone are known to evolve to an explosion under the right conditions. Although there was no fire or explosion in this occurrence, many of the conditions required for a fire and explosion were present.

At Thamesville, the loaded cars of ammonium nitrate were initially thought to be placed on track CB58, north of the north main track and then relocated to track CB40, south of the south main track. However, the train that brought the cars to Thamesville operated on the south main track and did not have track authority that would have allowed it access to track CB58. There was no other information to suggest that the cars had ever been on track CB58, accessible to the Orford Co-op. The most probable explanation is that the cars were set off on track CB40 on 17 April 1999. The cars remained on that track in excess of six days. The Orford Co-op did not consider the cars to have been delivered because they were not accessible to the company. The railway, on the other hand, considered the cars to be delivered. This resulted in a dangerous good being stored in rail cars, adjacent to main tracks, for an indefinite period of time.

For nearly 90 years, it was considered unsafe and against industry and federal safety requirements to hold dangerous goods at any point within the transportation system in excess of 48 hours, except under special circumstances. Present requirements have created a degree of uncertainty with respect to this type of temporary or ad hoc storage of dangerous goods. There are requirements for storage facilities located on railway property and there are inspection requirements for cars that are delayed in transit. However, there is no prohibition against the temporary storage of dangerous goods at or near destination.

The destruction caused by derailments and collisions is generally concentrated in the immediate area of the main tracks. The risks associated with these occurrences are increased where dangerous goods are stored for extended periods of time in proximity to main tracks. Many railway facilities, including Thamesville, have storage tracks further away from the main tracks that would be out of the immediate path of debris during most derailments and collisions. Storing dangerous goods cars further away from the main tracks would provide additional safety.

The situation that existed in Thamesville, with prolonged storage of dangerous goods immediately adjacent to a main track where passenger trains operated and within a municipal area, is not uncommon. Unnecessary risks created by prolonged storage of dangerous goods in rail cars throughout Canada can be minimized. Historically, awareness of risk peaks immediately after an occurrence and slowly declines as time passes until the next occurrence. It is possible that the history of regulating the storage of dangerous goods in the rail environment has followed this path. The circumstances of this accident offer an opportunity to reassess the risks associated with the storage of dangerous goods.

2.7 Passenger Safety

It was evident that efforts to resolve passenger safety-related issues identified in previous investigations resulted in passenger safety-related improvements in the following areas:

• general safety briefings;
• ready access to multi-trauma medical kits in every LRC passenger car;
• availability of emergency information pamphlets at every passenger seat; and
• luminescent emergency signage.

Although there were improvements, other previously identified passenger safety issues continued to exist at Thamesville. Mitigating action taken by TC and VIA has not adequately addressed these issues.

Of particular concern at Thamesville are several key issues:

• the securement of carry-on baggage;
• accuracy of emergency information;
• crew communication/coordination in an emergency;
• operation of passenger car doors in post-accident situations; and
• injuries sustained by passengers as a result of coming into contact with interior car furnishings or other passengers.

All of these issues have been raised in prior TSB investigations involving VIA passenger trains.

Given the complexity of each transportation occurrence and the unique nature of the events, it should be recognized that a thorough investigation may identify deficiencies not previously known. Each successive occurrence involving a passenger train represents an opportunity to identify hazards, assess the level of risk and address those risks. Effective industry and regulatory inspection, auditing and monitoring can reduce the likelihood of new hazards emerging. When previously identified hazards continue to exist, or re-emerge, the efficacy of industry and regulatory safety programs can come into question. However, it must also be considered that the risks associated with any given hazard may not be considered high enough to warrant mitigating action by industry and regulatory decision makers (see Section 1.11 and Appendix B for details).

3.1 Findings as to Causes and Contributing Factors

1. Train 74 derailed when it encountered crossover switches at Thamesville lined and locked in the reversed position.
2. The only reasonable explanation as to why the main track crossover switches at Thamesville came to be lined and locked in the reversed position is that the last authorized crew members inadvertently left them lined and locked incorrectly.
3. The safety defences associated with the Occupancy Control System (OCS) method of train control were insufficient to provide the crew members on train 74 with adequate advance warning of the reversed main track crossover switches to enable them to slow their train to a safe speed or stop.
4. The cars stored on the track adjacent to the south main track were struck, which increased the severity of the accident.

3.2 Findings as to Risk

1. The prolonged storage of ammonium nitrate, on a track adjacent to a track upon which trains operate at high speeds, creates an unnecessary risk when there are less exposed storage tracks in the area.
2. The industry and the regulator took some safety action in response to past occurrences where trains encountered switches left in the reversed position. However, these actions focussed primarily on increasing the conspicuity of the switch targets and improving compliance with procedural requirements to leave switches properly lined. These actions did not effectively address the absence of adequate advance warning to train crews in OCS dark territory.
3. The existence of some previously identified passenger safety hazards exposed passengers and crew to unnecessary risk.

3.3 Other Findings

1. The initiation of the emergency brake application on train 74 in advance of the train arriving at the reversed main track crossover switches, the activation of the engine stop feature, and the transmission of a distress call to train 71 indicate that the crew was vigilant.
2. The activation of the engine stop feature by the locomotive crew on train 74 shut down the diesel engine, eliminating a potential source of ignition and reducing the risk of fire and/or explosion of the spilled ammonium nitrate.
3. The transmission of a distress call to opposing train 71 by the locomotive crew on train 74 enabled the safe, controlled deceleration of train 71 before its arrival at Thamesville.
4. The VIA Rail Canada Inc. (VIA) employees performed their emergency procedures duties in an effective and efficient manner which contributed to the success of the evacuation.
5. The existence of a thorough, well prepared emergency response capability in the community of Chatham-Kent and the immediate notification, through 911, of emergency services resulted in the timely arrival of first responders on site.
6. Emergency response personnel (fire-fighters, police and ambulance staff) coordinated and facilitated an effective evacuation and mitigated the hazards from the spilled dangerous goods.
7. Although locomotive 6423 was built before crashworthiness standards were adopted by the Association of American Railroads, it exceeded most of the requirements of these standards.
8. The orientation of the locomotive as it struck the stationary loaded covered hopper cars resulted in impact to the area of the locomotive front which is least resistant to damage.
9. The short hood and roof of the locomotive had inadequate energy-absorbing capability to protect the control cab from an impact of this severity.

4.1 Safety Action Taken

4.1.1 Canadian National

Immediately following the accident, Canadian National (CN) announced a number of safety initiatives. In the spring of 2000, CN commenced an upgrade of all remaining Occupancy Control System (OCS) outside Automatic Block Signal System (ABS) (dark territory) to Centralized Traffic Control System (CTC), where passenger trains operate on CN trackage in the Québec-to-Windsor corridor. This program includes the Grimsby Subdivision between Hamilton and Niagara Falls, Ontario. The upgrades were completed by the end of year 2000.

Main track switch targets were upgraded to larger standard size for low stand switches (12 inches (30.5 cm) by 18 inches (45.7 cm) instead of 6 inches (15.2 cm) by 12 inches (30.5 cm)) and 3M "diamond" grade retro-reflective material was applied at 3 700 locations across Canada. Commensurate with this initiative, CN commissioned a switch target recognition study. The conclusions of the study generally indicate improved performance characteristics of targets with retro-reflective material applied and targets of larger size.

In May 1999, CN implemented expanded requirements for railway employees regarding confirmation of the position of main track switches. The information took the form of a Special Instruction to Canadian Rail Operating Rules (CROR) Rule 104 and is applicable to all rules-qualified employees on the CN Great Lakes District. The requirements of the Special Instruction are as follows:

In OCS territory, unless permission is provided to leave a switch in reversed position as per Rule 104(b), the conductor and locomotive engineer must:

1. before leaving a location where a main track switch has been used, confirm with each other that the switch has been left lined and locked in normal position.
2. when granting permission to enter "work limits", have confirmed with each other the position of main track switches used; such information must be included in the written understanding between trains. This does not relieve trains entering work limits from compliance with any Rule 104(b) switch warning contained in their clearance.
3. when cancelling an OCS work clearance, verbally advise the RTC that main track switches used by the crew, except those switches that may be left in reversed position by Rule 104(b) permission on the work clearance, have been left lined and locked in normal position.

In OCS territory, an employee qualified in the "Rules for the Protection of Track Units and Track Work" must:

1. before leaving a location where a main track switch has been used, confirm with another qualified employee (unless no other employee is immediately available i.e. lone worker) that the switch has been lined and locked in normal position.
2. when authorizing a train or engine to enter "work limits", have confirmed with another qualified employee (unless no other employee is immediately available i.e. lone worker) the position of main track switches used; such information must be included in the permission granted.
3. when cancelling an OCS work clearance, verbally advise the RTC identifying those main track switches used within the limits of the clearance and that they have been left lined and locked in normal position.

In November 2000, CN adopted a system-wide Special Instruction to CROR Rule 104. The Special Instruction formally established communication requirements for employees handling hand operated switches in all OCS territory.

All CN transportation and engineering employees who are qualified in the CROR were provided special refresher training on all aspects of CROR Rule 104(b), including the new communication requirements. This training is to be continued on an annual basis.

In October 2000, CN began field-testing of a switch point indicator signal system. The signal was placed into active service on the CN Uxbridge Subdivision in late October 2000. Its purpose is to indicate the status of switch point positions in dark territory. The system uses spread spectrum radio technology to transmit switch position to a signal installed beyond the maximum braking distance of a train, from a switch in the facing-point direction. It is expected that the test will provide information on crew acceptance and system reliability in various weather conditions. The estimated cost of the system per individual site is $25,000. CN is also reviewing alternative technologies that may meet the operational requirements more cost-effectively.

Each region on CN implemented a local database tracking system for high security switch keys. This initiative was completed in the fall of 1999.

CN also indicated that, for maintenance and safety reasons, it has been removing redundant or infrequently used switches for a number of years. The crossover switches at Thamesville were removed when the track was reconstructed after the accident.

4.1.2 Transport Canada

4.1.2.1 Unauthorized Reversed Main Track Switches

Following the occurrence, on 30 April 1999, a Railway Safety Inspector from the Transport Canada (TC) Surface Ontario Region issued a Notice under Section 31 of the Railway Safety Act. The Notice stated that:

. . . there is a threat to safe railway operations on CN Rail's multitrack non block signal (dark) territories in Ontario because a main track hand operated crossover switch that is not properly positioned has the potential to cause a train derailment or collision.

Subsequently, on 17 March 2000, VIA Rail Canada Inc. (VIA) passenger train No. 78, operating on the CN Dundas Subdivision at Ingersoll, Ontario, Mile 58, encountered a main track hand operated switch in the reversed position. The train was being operated at restricted speed due to signal requirements and was able to come to a controlled stop. There were approximately 260 passengers on board. On 21 March 2000, a Railway Safety Inspector from the TC Surface Ontario Region issued a Notice under Section 31 of the Railway Safety Act. The Notice stated in part:

. . . there is a threat to safe railway operations on CN Rail's multitrack non CTC territories in Ontario because a main track hand operated switch not properly positioned has the potential to cause a train derailment or collision.

Immediately after this occurrence, a TC Safety Officer was appointed to conduct an investigation, under Part II of the Canada Labour Code, into the two fatalities and disabling injuries of VIA employees incurred at Thamesville, as per TC's Memorandum of Understanding with Human Resources Development Canada. TC's investigation did not make a conclusive determination of the circumstances surrounding the reversed main track crossover switch in the north main track at Mile 46.72 of the CN Chatham Subdivision. However, TC concluded that either the trainman last known to have used the switch left it lined and locked in the reversed position or the switch was lined and locked in the reversed position in an act of vandalism. The final report was made public in March 2000. The following conclusions and recommendations were made:

Conclusions

• The system of OCS in non-signaled territory is an approved method of train control and recognized as being safe by the CROR. It does, however, rely on the human factor and in so doing can be subject to human error.
• With modern day technology and computerization, and for the purpose of safety and efficiency, locomotive design and capabilities have been improved, as well as track and associated structures. Technology now permits more efficient operations with fewer people. Train crews have been reduced to two-man crews which operate over greater distances than in the past. Rail Traffic Controllers now supervise larger territories. In spite of these advancements, the human factor system of non-signaled territory remains unchanged.
• There are no adequate mechanisms in place to guard against an act of vandalism that results in a misaligned (reversed) switch.

Recommendations

• Canadian National Railway reassess the high security lock system in place on main track switches. An accurate account of keys should be considered, rather than just having a record of the known keys in use.

The Safety Officer also found CN to be in contravention of Section 124 of Part II of the Canada Labour Code, which states:

Every employer shall ensure that the safety and health at work of every person employed by the employer is protected.

It was the Safety Officer's view that "CN Rail did not provide protection to employees operating over its main track in OCS territory by ensuring that main track switches were properly lined and locked for the main track." The Safety Officer directed CN to terminate the contravention. CN exercised the right to appeal this Direction under Part II of the Canada Labour Code. Pursuant to this appeal, the Direction was reviewed and rescinded.

The Safety Officer also received two assurances of voluntary compliance (AVC) from VIA; one concerning the securement of fire extinguishers between the walls of passenger cars and the other concerning the securement of portable tool kits on club cars.

On 17 April 2000, a TC Railway Safety Inspector from the TC Surface Ontario Region observed a main track hand operated switch at Mile 15.01 of the VIA Alexandria Subdivision lined in the reversed position. A CN work train was in possession of a work clearance and had cleared at that location; however, a crew member was not positioned at the switch. On 02 May 2000, the inspector issued a Notice under Section 31 of the Railway Safety Act. The Notice stated in part:

. . . there is a threat to safe railway operations on VIA Rail's Alexandria Subdivision, in Ontario, because a main track hand operated switch not properly positioned has the potential to cause a train derailment or collision.

TC initiated a research of technology scanning survey on 24 May 2000. This survey will focus on technologies currently available or under research and development in North America that alert crews to hand operated switches not properly lined for main track operation in non-signalled territory. TC indicated that technologies outside North America, such as within the European Union and Japan, should be included where appropriate.

On 14 July 2000, subsequent to an occurrence on the Goderich & Exeter Railway's Guelph Subdivision, a Railway Safety Inspector from the TC Surface Ontario Region issued a Notice and Order under Section 31 of the Railway Safety Act. VIA passenger train No. 683, comprising one locomotive and four cars, and carrying 154 passengers and 5 crew members, entered an unauthorized reversed main track switch at Mile 41.37 while travelling at approximately 60 mph (TSB investigation ongoing^__R00T0179). The Notice and Order stated in part:

. . . a continuing problem of main track hand operated switches in non-block signaled territory not being properly positioned in the Province of Ontario. Despite corrective actions by CN in response to three Section 31 Notices in Ontario regarding non-compliances to Canadian Rail Operating Rule (CROR) 104 issued on April 30, 1999, March 21, 2000, and May 2, 2000, incidents continue.

. . . there is an immediate threat to safe railway operations in non-block signaled territory in the Province of Ontario, because CN transportation and engineering employees are not properly positioning main track hand operated switches on their own territory, or on other railways' territories.

Pursuant to Section 31 of the Railway Safety Act, I order that in the Province of Ontario:

1. When CN transportation and engineering employees are using main track hand operated switches in non-block signaled territory, for other than testing purposes, two CROR qualified employees are present at each main track switch and confirm in face-to-face communications that the switch has been properly positioned;
2. CN transportation and engineering employees who use main track hand operated switches in non-block signaled territory receive within 60 days refresher training on the application of CROR 104, unless they have received training within the last six months;
3. CN transportation and engineering employees receive annual refresher training on the application of CROR 104;
4. Each CN CROR qualified supervisor assigned to non-block signaled territory conduct 6 efficiency tests per month to confirm, through discussion with transportation and engineering employees, that they are properly applying clause no. 1 above, and to forward the results to the undersigned.

TC indicated that the Notice and Order would remain in effect until advance indication of main track hand operated switch positions can be adequately conveyed to approaching main track movements.

On 27 and 28 July 2000, TC called a meeting of industry and government stakeholders to discuss the handling of main track switches in non-signalled territory. A formal risk management process was used to determine measures that can be implemented immediately to further mitigate risks associated with the handling of main track switches in non-signalled territory. The facilitators established that absolute compliance with CROR Rule 104 would be the theoretical norm. Breakout groups were utilized to establish causal factors for non-compliance and potential solutions. At the conclusion of the process, TC asked Canadian Pacific Railway (CPR), CN and VIA for their action plans to further mitigate the risks associated with the handling of main track switches in the near term. TC indicated that it would be reviewing current and proposed railway actions, assessing the results of this meeting and making recommendations on other possible mitigation measures.

On 14 November 2000, the Minister of Transport issued an Emergency Directive regarding the use of main track switches in non-signalled territory to VIA, CN, CPR and RailAmerica Inc. pursuant to Section 33 of the Railway Safety Act. Paraphrased below are some of the more salient measures ordered by the Directive:

1. Passenger trains shall not exceed 50 mph when encountering a facing-point switch in non-signalled territory, until the operating crew members can confirm that the switch is properly lined for their intended movement.
2. All other track movements, except for those trains handling special dangerous goods, shall not exceed 45 mph when encountering a facing-point switch in non-signalled territory, until the operating crew members can confirm that the switch is properly lined for their intended movement. Trains handling special dangerous goods are restricted to 40 mph instead of 45 mph.
3. All employees using main track switches in non-signalled or ABS territory must immediately confirm to another employee by personal contact, radio, or other communication, that they have fulfilled the requirements of CROR Rule 104 by announcing that the "switch at insert location and name has been restored for the main track (or other route authorized by Rule 104(b))." Employees must not leave switches unattended until they have been restored for the main track (or other authorized route), and the above-noted confirmation procedure is repeated.
4. In addition to the above-noted items, the referenced railways are required to submit detailed plans of additional measures to be implemented with regard to further mitigation of the risks associated with the use of main track switches in non-signalled territory.
   With respect to items 3 and 4, the referenced railways must report monthly with respect to the progress of implementation of mitigation measures, covering, but not limited to such items as:
   • training and examinations given to employees with respect to the use of switches;
   • proficiency testing conducted with respect to the use of switches, including results; and
   • progress with development and installation of new technologies, procedures and/or methods.

The Emergency Directive is to remain in effect for a period of six months unless the Minister of Transport is satisfied that the risk associated with the use of main track switches has been adequately mitigated. In such a case, the Directive can be rescinded before the six months have elapsed. The Directive may also be renewed for a further specified period of time if the Minister of Transport is not satisfied.

4.1.2.2 Storage of Dangerous Goods

TC advises that it will be addressing existing ambiguities with respect to defining when dangerous goods are considered as in the transportation system in the upcoming clear-language version of the Transportation of Dangerous Goods Regulations.

4.1.3 VIA Rail Canada Inc.

4.1.3.1 Radio Communications

Following this occurrence, VIA and its employees realized that the crew members on opposing train 71 would have missed the distress call from train 74 had they been on the RTC call-in channel obtaining another clearance. VIA amended company radio procedures to ensure constant monitoring of the train standby channel from the locomotive of all passenger trains.

4.1.3.2 Equipment and Baggage Securement

For a number of years, VIA has been studying possible solutions to the problem of unrestrained baggage in the end baggage compartments of its cars. VIA has decided to install a net in front of every shelf. Material for a retrofit of all cars has been delivered to VIA and the retrofit commenced in August 2000. The nets are attached to a bar that slides horizontally to open. When closed, the nets can be buckled up. VIA indicated that, as of October 2000, 60 per cent of the Light, Rapid, Comfortable (LRC) fleet was so equipped and that implementation on HEP2 and HEP1 equipment fleets would commence in early November. VIA's goal is to have this retrofit completed, fleet-wide, within one year.

Regarding the metal tool box in the passenger seating area, VIA advises that the tool boxes will eventually be permanently relocated to the locomotives where they will be installed securely. Since August 2000, VIA has required that the tool boxes be attached to the back of the frame of the seat closest to the bulkhead, using elastic straps.

4.1.3.3 Manual Operation of LRC Side Doors from the Interior

Subsequent to the occurrence at Thamesville, VIA has designed a prototype pull-handle for the manual operation of LRC side doors from the interior. The prototype handle, tested in the summer of 2000, demonstrated that the principle works. The resulting modification consists of the addition of a recessed handle applied on the top portion of the door assembly. In case of emergency, the usual red lever is pulled, unlatching the door, then by pulling the edge of the door or the new recessed handle, the door will open. New decals will be applied showing the opening sequence. VIA is in the process of purchasing this material for its fleet. Implementation commenced in December 2000.

4.1.3.4 Restricted Access to Emergency Exits

Regarding the restriction of access to emergency exit windows by seat configurations, VIA has indicated that it has established a "clear path width" in consultation with TC. For equipment presently in service, clear path width is to imply an unobstructed opening of 18 inches (46 cm) by 24 inches (61 cm) in any direction and any new equipment ordered after 01 January 2001 has to have an unobstructed opening of 26 inches (66 cm) horizontally by 24 inches (61 cm) vertically. These requirements are contained in a proposed revision to the Railway Passenger Car Inspection and Safety Rules, under the heading of "Emergency Window Unobstructed Opening."

4.1.3.5 Securement of Passenger Seat Banks to the Floor of Cars

With respect to the securement of passenger seats to the floor of cars, VIA indicated that the procedures have been reviewed and that it believes that the existing procedures are adequate if followed.

4.1.3.6 Train Control in VIA-Owned Dark Territory

VIA also indicated that it is considering the possible installation of CTC on its Alexandria and Smiths Falls subdivisions. With regards to the VIA-owned section of the Chatham Subdivision, VIA is in the process of removing four main track hand operated switches. However, VIA has not indicated any plans for extension of CTC on its portion of the Chatham Subdivision from Chatham to Windsor.

4.1.3.7 VIA Rail Operations in OCS outside ABS Territory in Canada

Table 5 depicts VIA passenger train operations in OCS outside ABS (dark territory) across Canada as of January 2001. The trains listed are only an approximate indicator of the extent of passenger train operations on each respective territory. The frequency with which each train operates is not shown. The speed column indicates only the highest authorized speed for passenger trains. Many locations on the subdivisions listed require passenger train movements at lower speeds.

Table 5 - VIA Rail Operations in OCS outside ABS Territory in Canada

SUBDIVISION	LOCATION	TRACK OPERATOR	MILES OF TRACK	PASSENGER TRAINS	MAXIMUM SPEED (mph)
Alexandria	Ontario/ Quebec	VIA Rail Canada Inc.	65.2	30/31/32/33/34/35/36/37/ 38/39/630/631/632/634/ 635	80
Assiniboine	Saskatchewan	Canadian National	92.2	692/693	50
Bedford	Nova Scotia	Canadian National	17.4	14/15	55
Brockville	Ontario	Canadian Pacific Railway	27.8	40/41/42/43/44/45/46/47/ 48/49/640/641/642/648	95
Cascapédia	Quebec	Chemin de fer de la Matapédia et du Golfe	98	16/17	50
Chandler Est	Quebec	Chemin de fer Baie de la Gaspésie	56.1	16/17	45
Chandler Ouest	Quebec	Chemin de fer Baie des Chaleurs	48.1	16/17	45
Chatham	Ontario	VIA Rail Canada Inc.	35.3	70/71/72/73/75/76/78/79/ 670	80
Dundas	Ontario	Canadian National	41.4	70/71/72/73/75/76/78/79/ 82/83/670	85
Flin Flon	Manitoba	Hudson Bay Railway	80.8	290/291/990/991	40
Fraser	British Columbia	Canadian National	146.1	15/16	50
Gladstone	Manitoba	Canadian National	121.1	692/693	60
Guelph	Ontario	Goderich & Exeter Railway	89.9	85/86/87/88/682/683/685	70
Herchmer	Manitoba	Hudson Bay Railway	183.7	692/693	30
Joliette	Quebec	Canadian National	86.5	600/601/602/603/604/606	75
Lac-Saint-Jean	Quebec	Canadian National	200.8	600/601/602	50
La Tuque	Quebec	Canadian National	53.8	603/604/606	40
Mont-Joli	Quebec/New Brunswick	Chemin de fer de la Matapédia et du Golfe	188.8	14/15	70
Newcastle	New Brunswick	New Brunswick East Coast Railway	173.2	14/15	75
Smiths Falls	Ontario	VIA Rail Canada Inc.	34.5	40/41/42/43/44/45/46/47/ 48/49/640/641/642/648	95
Springhill	Nova Scotia/ New Brunswick	Canadian National-	15.2	14/15	70
Saint-Hyacinthe	Quebec	Canadian National	20.9	14/15/20/21/22/23/24/25/ 26/27/620	95
Saint-Maurice	Quebec	Canadian National	256.9	603/604/606	50
Sherridon	Manitoba	Hudson Bay Railway	184.8	290/291/990/991	40
Tete Jaune	British Columbia	Canadian National	41.5	15/16	50
Thicket	Manitoba	Hudson Bay Railway	189.7	692/693	40
Turnberry	Saskatchewan/ Manitoba	Canadian National	82.9	692/693	60
Victoria	British Columbia	E&N Railway Company	137.4	198/199	40
Wekusko	British Columbia	Canadian National	136.4	692/693	40
			2906.40 (Total Miles)

4.2 Action Required

The Board notes that, with the implementation of TC's Emergency Directive issued on 14 November 2000, the increased level of risk associated with train operations in dark territory has now been formally recognized. The Board believes that this Directive indicates a general acknowledgement of the need for additional measures to mitigate the risks associated with the use of main track switches in non-signalled territory.

Under the conditions of TC's Emergency Directive, passenger trains operating in OCS outside ABS will no longer approach main track switches in the facing-point direction under the assumption that the switches are properly lined. This represents a fundamental change to the operating philosophy in this type of territory. The intent of this change and the associated speed limitations are to improve safety by reducing the risk of passenger trains diverging through unanticipated reversed main track switches at speeds in excess of their design speed, thus reducing the risks to which train crews, passengers and communities such as Thamesville are exposed. Although the effects of these measures cannot be quantified for some time, the Board anticipates that these initiatives will positively affect safety.

In the 20 months after the accident at Thamesville (to December 2000), there were 14 occurrences reported to the TSB where trains unexpectedly encountered reversed main track switches in OCS dark territory; 4 of those involved passenger trains. The overall occurrence data indicate that, despite the ongoing safety action by the regulator and the industry, in all types of territory, reportable occurrences of this nature have continued to average around 10 annually. Further, some of these occurrences continue to involve passenger trains, where the potential for loss is much greater.

While significant safety action has been taken, and more initiatives appear likely, additional improvements are not a certainty. Also, although the initiatives of TC and the railway industry should result in significant safety improvements, the long-term continuation of some of these improvements is uncertain. For example, the Board notes that the conditions of TC's Emergency Directive may not continue beyond the six-month period dictated in the Directive. The Board believes that a serious situation still exists, with a continuing probability of passenger trains encountering unanticipated reversed main track switches, albeit at lower speeds. Therefore, the Board recommends that:

The investigation determined that, in OCS outside ABS, the existing safeguards were inadequate to prevent the unauthorized reversed main track switches from leading to the occurrence. Further, previous concerns expressed by the TSB with respect to the level of safety afforded by the OCS method of train control have been renewed by this accident. In a number of different contexts, not exclusive to the rail mode of transportation, the Board has identified overreliance on procedural compliance in the operation of safety critical systems as an undesirable situation. Similarly, the Board has been advocating the development of safety strategies, where multiple layers of defences are used to improve error tolerance, where necessary. The Board believes that, when the effect of a single error on a safety critical system can lead to the derailment of a passenger train at high speed, the error tolerance of that system is inadequate.

Unauthorized reversed main track switches are most often the result of inadvertent errors by railway employees. Past safety actions relating to unauthorized reversed main track switches have focussed primarily on eliminating errors through improved procedural compliance. The speed restrictions imposed through TC's Emergency Directive, although temporary, indicate an acknowledgement of the inevitability of some level of human error with respect to the handling of main track switches. This is a necessary first step towards understanding the effects of errors on a safety critical system and towards developing mitigating strategies. Therefore, the Board recommends that:

At Thamesville, the storage of certain dangerous goods in rail cars for prolonged periods of time, adjacent to main tracks where train speed is not restricted and passenger trains also operate, created an unacceptable level of risk for persons, property and the environment. Although it is rare that a derailed train would come into contact with stored dangerous goods, the Board believes that the risks posed, particularly within municipal areas and when passenger trains are involved, are unacceptable. TC's initiative to redefine the term "in transport" in the upcoming clear-language version of the Transportation of Dangerous Goods Regulations, while useful, is unlikely to have an effect on the storage of dangerous goods at places like Thamesville. The proposed new wording does not clarify when a shipment is considered to have been delivered to destination. Therefore, the Board recommends that:

4.3 Safety Concern

The TSB investigation on this occurrence found strong indications that recent improvements in the areas of passenger safety and emergency preparedness had reduced the risks to which passengers were exposed and contributed to a safe and efficient evacuation of the train. However, a number of passenger safety-related hazards, identified and reported on in previous investigations, were also found; i.e., an unsecured metal tool box and unrestrained baggage in end baggage compartments. Although the Board recognizes that legitimate safety priorities of the railway industry and regulator may preclude the prompt mitigation of all known risks, valuable opportunities for passenger safety improvements were delayed when known conditions were not quickly dealt with. The Board is concerned that, in some circumstances, industry and regulatory safety programs have not resulted in the elimination of some passenger safety hazards in a timely fashion.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 13 February 2001.

Appendix A - Chatham Subdivision Chart

NUMBER OF TRACKS	STATION		CROSSOVER TRACKS	MILE
	EAST	WEST
ONE MAIN TRACK	WINDSOR 1.2			105.6
	GEORGE AVENUE 3.4			104.4
	TECUMSEH 25.8			101.0
	JEANNETTES CREEK 11.4			75.2
	BLOOMFIELD 1.4			63.8
TWO MAIN TRACKS	KENT 0.8		X	62.4
	CHATHAM 1.1			61.6
	CHATHAM EAST 8.0		X	60.5
	NORTHWOOD 5.8		X	52.5
	THAMESVILLE 7.3		X	46.7
	BOTHWELL 5.2		X	39.4
	NEWBURY 6.5			34.2
ONE MAIN TRACK	GLENCOE 0.5			27.8
	GLENCOE EAST 9.6			27.3
	LONGWOOD 5.9			17.9
	MOUNT BRYDGES 4.9			12.0
	KOMOKA			7.1

Appendix B - Passenger Safety

Numerous hazards and potential hazards relating to passenger and crew safety were identified during this investigation. Some of these issues were noted in previous occurrences, others are new. A description of each of the hazards and potential hazards, and related background information follows.

1.0 Carry-on Baggage

1.1 VIA's Policy and Regulatory Requirements

VIA Rail Canada Inc.'s (VIA) policy regarding carry-on baggage recommends that passengers limit themselves to two pieces of carry-on baggage. On corridor trains, items of carry-on baggage should not exceed 61 cm by 41 cm by 25 cm (24 inches by 16 inches by 10 inches) in size or weigh more than 23 kg (50 pounds).

However, if no checked-baggage service is available (i.e., if a train consist does not include a baggage car), certain items that are normally prohibited, such as sports equipment and strollers, will be accepted. Trains on the following routes do not have checked-baggage service:

• Montreal-Québec
• Montreal-Ottawa
• Ottawa-Toronto
• Toronto-Montreal (except for train Nos. 57 and 60)
• Toronto-Windsor (except for train Nos. 70, 75, and 670)
• Toronto-Sarnia
• Toronto-Niagara Falls
• Jasper-Prince Rupert
• Victoria-Courtenay

The majority of passenger trains operated on the Québec-Windsor corridor do not have baggage cars. VIA operates more passenger trains on this corridor than on any of its other passenger routes; therefore, the exceptions of VIA's carry-on baggage policy have become the rule.

Passengers travelling in groups may reserve up to six "places" for carry-on baggage where it will be transported unrestrained in the passenger seating area.

Although not specifically stated in its policy, it is VIA's practice to store only "light-weight" items in the overhead baggage compartments. In general, on-train service (OTS) personnel consider items weighing less than 10 pounds (4.5 kg) to be "light-weight." The weight of a specific item of carry-on baggage is based on a subjective assessment by crew members.

VIA's policy regarding carry-on baggage does not address enforcement other than to say:

If weight, size or number of items carried is not respected, advise passenger that a delay may occur unloading carry-on-baggage, and he [she] may have to assist load[ing] or unload[ing] if personnel is insufficient or time is [a] constraint.

There are no regulatory requirements addressing size, weight, number, or potentially injurious characteristics of carry-on baggage on Light, Rapid, Comfortable (LRC) passenger cars. However, Canadian Transport Commission Order No. R-36914, dated 17 July 1984, requires that overhead baggage compartments have a means of restraining the items stowed within. The intent of the order is to prevent carry-on baggage from being projected into the car during an accident, possibly injuring passengers/crew members and/or creating an evacuation impediment. To date, performance standards for such restraining devices have not been developed.

1.2 Securement of Carry-on Baggage Stowed in the End Baggage Compartments

On train 74, large items of carry-on baggage and operational equipment, e.g., metal stepping stools used during boarding/detraining, were stored in the end baggage compartments. In addition, since the train did not have a baggage car, items that are normally prohibited, e.g., a set of golf clubs, were accepted as carry-on baggage for stowage in the end baggage compartments. As on other VIA passenger trains, the end baggage compartments had an open bay design, facilitating easy stowage and retrieval. However, on train 74, two narrow canvas straps had been installed on the top shelves of the end baggage compartments as a means of securement. There was no means of securing baggage stowed on the other shelves of these compartments in any of the passenger cars.

In this accident, unsecured or insufficiently secured carry-on baggage stowed in end baggage compartments was projected into the aisle ways leading to the emergency exits and into the passenger seating areas, exposing passengers and crew to the risk of personal injury and obstructing egress routes. In the club car, two suitcases and a set of golf clubs were projected into passenger seats 1 and 2 located directly across from the end baggage compartment. No passengers were sitting there at the time of the accident.

The potential risks relating to unsecured carry-on baggage identified in this occurrence were realized in a VIA train derailment at Biggar, Saskatchewan, in September 1997 (TSB report No. R97H0009). In October 1997, the TSB issued Recommendation R97-07 requesting that the Minister of Transport require that VIA complete its implementation of the short-term measures (including more secure stowage of, or restrictions on, carry-on baggage) necessary to improve rail passenger safety within 30 days. Subsequently, VIA initiated measures to determine the most effective way to mitigate these risks by testing a number of proposed baggage restraint systems for the end baggage compartments. At the time of the occurrence, a restraint system for end baggage compartments where the largest and heaviest items of carry-on baggage are stored had not been implemented. As a result, passengers and crew members travelling on VIA trains continue to be exposed to these risks.

1.3 Securement of Carry-on Baggage Stowed in the Overhead Baggage Compartments

On train 74, each bin in the overhead baggage compartment had a latched door, designed to secure the items stowed within. It was reported that some of the doors opened on impact and that articles fell out. Three doors detached from the bins at a hinge attachment point:

• Car 3468 (club car)^__the after hinge failed on the door of the last overhead bin at the right side of the train.
• Car 3351 (Coach 03)^__the after hinge failed on the door of the last overhead bin at the right side of the train.
• Car 3344 (Coach 04)^__the hinge failed on the door of the overhead bin.

In this occurrence, it was concluded that passengers did not suffer serious injuries as a result of the restraint system on the overhead bins having failed. It was also concluded that internal debris created by the carry-on baggage that fell from the overhead bins did not significantly hamper the evacuation. Although the overhead bins and the doors generally fulfilled their purpose, the reported failures provide an opportunity to improve their effectiveness.

2.0 Securement of Operational Equipment (Tool Box) Stowed in the Passenger Seating Area

Section 5, Safety and Emergency Information, of VIA's Operating Manual for LRC Cars states that ". . . the emergency tool box is located in the last car. . . " of the train. The sealed metal box containing emergency tools and safety items weighs 47 pounds (21 kg) and measures approximately 34 inches (86 cm) by 11 inches (28 cm) by 7 inches (18 cm).

There were two emergency tool boxes on train 74; one on car 3468 (club car), immediately aft of the locomotive, and one on car 3313, the last car on the train. In both cars, the emergency tool boxes were stowed on the floor between the end baggage compartment bulkhead and the first row of passenger seats. Neither tool box was restrained in any way.

During the accident, the tool box stowed in the club car was projected forward and later found on the floor in front of seats 3 and 4. There were no passengers in those seats at the time of the accident; however, it is suspected that the tool box struck an OTS crew member, rendering him unable to perform his emergency duties. Had the tool box been secured, it is most probable that it would not have become a projectile.

Stowing heavy unsecured items, such as the tool box, in passenger cars exposes passengers and crew to unnecessary risk. Any situation or circumstance that can cause personal injury and/or obstruct egress routes affects an individual's ability to rapidly evacuate. This increases exposure to hazards. In the presence of fire, noxious fumes or impending explosion, increased exposure to hazards lowers the likelihood of survival.

3.0 Unrestrained Passengers

Given the direction and magnitude of the forces^{Footnote 37} generated during the derailment, many passengers, particularly those sitting in forward-facing seats, were projected through the cars striking seats, other passengers and interior furnishings. As a result, a significant number of passengers were injured, some seriously. It was also noted that passengers sitting in rear-facing seats were less susceptible to being thrown from their seats during the longitudinal deceleration; however, some were injured when struck by forward-facing passengers sitting across from them.

This injury mechanism has been identified in past TSB investigations (TSB report No. R97H0009, Biggar, Saskatchewan) and continues to be evident in occurrences currently being investigated (TSB occurrence Nos. R99H0009, Hornepayne, Ontario; R99S0100, Acton, Ontario; R99T0298, Bowmanville, Ontario; and R00M0007, Newcastle, New Brunswick).

There may be a number of occupant protection strategies that would mitigate the risks of unrestrained passengers sustaining injury and/or injuring other passengers. It is likely that the Canadian passenger rail industry possesses the knowledge and experience in these matters to pursue a more effective occupant protection strategy.

4.0 Emergency Information Cards

In 1994, the TSB investigated a VIA passenger train accident that occurred at Brighton, Ontario (TSB report No. R94T0357). The Board determined that passengers were not provided with sufficient advance safety information regarding the location and operation of emergency exits and equipment. As a result, in February 1995, a Rail Safety Advisory was sent to Transport Canada (TC) suggesting that clear, concise emergency information should be readily available to all passengers.

Subsequently, VIA developed an emergency information card illustrating the location/operation of emergency exit doors/windows and the location of emergency equipment found on rail passenger cars. The emergency information card was submitted to TC, and in accordance with VIA's policy, a card was placed in the seat pocket of every passenger seat.

Examination of the emergency information cards on train 74 revealed the following:

• All of the emergency information cards in the coaches were inaccurate as to the location of the emergency exit windows. The emergency information cards depicted the emergency exit windows as being staggered throughout the passenger seating area. In fact, the windows were located exclusively at the first row and last row of passenger seats.
• All of the emergency information cards on the club car were inaccurate as to the location of emergency equipment stored at the "B" end of the car.

Survivability is heavily dependent on passengers being aware of critical safety information such as the location of emergency exits and emergency equipment. Although such information was provided to the passengers on train 74 and was understood, it was not presented accurately. Also, this information was not readily accessible to passengers in aft-facing seats.

5.0 Emergency Signage

5.1 Location of Emergency Exit Windows and Emergency Equipment

Emergency information regarding the number, the location/operation of emergency exits and the location of emergency equipment was posted throughout train 74, on luminescent placards. However, some of the emergency information posted was inaccurate:

• In every coach car, every placard was inaccurate as to the location of the emergency exit windows. Emergency exit windows were depicted as being staggered throughout the passenger seating area. In fact, the windows were located exclusively at the first row and last row of passenger seats.
• In car 3468 (club car), the placards were inaccurate as to the location of the emergency equipment stowed at the "B" end of the car.

5.2 Manual Operation of LRC Side Doors from the Interior

In an emergency situation where neither head-end nor battery-generated electrical power is available, the side doors may be opened manually from inside the car. Luminescent emergency signage posted in the vestibule provides pictorial directions. Two steps are depicted:

1. Pull the emergency opening mechanism (red lever arm) adjacent to the door to be opened in the direction indicated by the arrow on the pictogram. (The door will partially open, 2 inches.)
2. Pull the door in the direction indicated by the arrow on the pictogram to completely open.

Following the steps indicated on the pictogram, TSB investigators attempted but were unable to manually open a side door from inside the train. Before the side door can be pulled longitudinally into the side wall of the car, thereby opening it, the side door must be pulled inward. This step is not indicated on the emergency signage.

Given that OTS crew members are normally responsible for more than one car, it is likely that a passenger may be required to open a side door. Therefore, it is essential that the emergency instructions for the operation of these doors be accurate.

5.3 Manual Operation of LRC Side Doors from the Exterior

Side doors may also be opened manually from outside the car. On the exterior wall of the car, beside the side door, there is a horseshoe-shaped access panel. The car's exterior paint/colour scheme (gold, grey, blue) continues uninterrupted across this access panel. A luminescent pictogram measuring approximately 2 inches (5 cm) by 4 inches (10 cm) is located on the grey portion of the access panel. The background of the pictogram is white, the image is black. The pictogram depicts the profile of a fire-fighter and an extended arm holding an axe. When the access panel is open, a red T-bar and a second pictogram are visible. This pictogram indicates that one must pull down on the T-bar and slide the side door in the appropriate direction to open it.

Emergency personnel who responded to the accident stated that the emergency signage and the access panel were not conspicuous and were difficult to see. Several reasons were cited:

• the pictogram was small;
• the white and black pictogram set on a grey background was not conspicuous;
• the access panel was camouflaged by the uninterrupted paint scheme of the car; and
• dust from the rail bed and, in this specific accident, dust from fertilizer stored by the track reduced the conspicuity and visibility of the pictogram.

In many emergency situations, it is imperative that passengers and crew immediately evacuate the train. Any circumstance or situation that impedes or does not facilitate a rapid evacuation is hazardous in that it creates a potential risk in relation to passenger and crew survivability.

Regarding the operation of the side doors from the exterior, it was determined that the emergency signage and the access panel, both of which identified the location of the exterior operating mechanism, were not sufficiently conspicuous and/or visible to emergency response personnel. Conspicuity and visibility were restricted because of factors relating to size, visual contrast and the camouflaging effect of the paint scheme on the exterior of the car.

6.0 Passenger Seats

6.1 Access to Emergency Exit Windows and Passenger Seat Configuration

On train 74, the configuration of passenger seats adjacent to emergency exit windows was as follows:

• Configuration "A"^__two rows of seats facing each other forming what is referred to as a "four-facing seats arrangement"; or
• Configuration "B"^__standard seat rows facing in the same direction.

There were 10 emergency exits adjacent to passenger seat configuration "A" and 6 adjacent to configuration "B". Access to emergency exit windows is restricted at configuration "B" compared to configuration "A". Access is further restricted at configuration "B" if the passenger seat forward of the emergency exit window is in a reclined position.

At 6 of 16 emergency exit windows, access was restricted to varying degrees because of the configuration of the adjacent passenger seats. Restricted access to an emergency exit may slow the evacuation process, and under certain conditions, such as when there is smoke in the car, it may increase passenger exposure to potentially lethal environments for longer than necessary.

At the time of this occurrence, there were no regulatory requirements addressing passenger seat configuration at emergency exit windows.

6.2 Seats Attachment

During the accident, one bank of passenger seats (seats 25-26, car 3351) detached from the floor at the attachment point. It is not known if passengers were sitting in seats 25 and/or 26 at the time of the accident.

Passenger seats are secured to the floor using a seat-rail type of arrangement. There are four fittings on the bottom of the seat legs which slide into the seat rails. Once the fittings are positioned in the rail, a plunger on each side of the seat leg is screwed down into the seat rail to lock the seat in position. The number of threads visible at the top end of the plunger is indicative of how deeply the plunger is screwed down into the seat rail. The seat is completely unlocked when the plunger is level with the top of the seat rail and approximately six threads are showing. When the plunger first makes contact with the bottom of the seat rail, there are approximately two threads showing. Continued screwing down or tightening the plunger will cause the seat to rise slightly until the attachment fittings make contact with the top of the seat rail. At that point, the seat is considered to be fully locked and there are zero threads showing.

The TSB Engineering Branch examined the seat that separated from train 74 and found no evidence of any fracture or plastic deformation to the attachment fittings or the seat rails. Therefore, it was considered that the seat separated simply because it was not locked into position. A survey taken of another VIA train with the same type of passenger cars and seats found between zero and four threads showing on the group of seats that was examined (TSB Engineering Branch report LP 056/99).

VIA's procedures for installation of passenger seats instruct one to ". . . Tighten centre locking device bolt [plunger] and lock jam-nut on each seat leg. . ."; however, they do not indicate how much to tighten the centre locking device or how to determine if, and when, the seat is locked.

Several potential hazards were created when the passenger seat bank detached from the car floors. They included crushing injuries, entrapment, obstruction of aisles leading to emergency exits, restricted access to emergency exit windows, etc.

6.3 Pivoting of Seats

In addition, a number of passenger seat banks throughout the train were found in a partially pivoted position. For example:

• car 3468 (club car)^__seats 15-16 were pivoted approximately 90 degrees left;
• car 2251 (coach 03)^__seats 61-62 were pivoted approximately 120 degrees left;
• car 3344 (coach 04)^__seats 33-34, 37-38, 41-42, and 45-46 were pivoted several degrees left.

In the TSB passenger safety questionnaire, passengers were asked if their seat remained in position during the derailment/impact. Ten respondents indicated that their seats did not remain in position during the accident. It is not known how many passengers were not aware of any pivoting of their seats. Seats on train 74 not locked in position would have been subject to forces during the derailment that were of sufficient magnitude to pivot them (TSB Engineering Branch report LP 056/99).

Passenger seats are designed to pivot so they can face forward or rearward. The lower part of the seat frame remains stationary on the floor and the upper part of the seat frame pivots. The upper and lower halves of the seat frame are connected by a single large pin at the centre of the seat which allows the pivoting motion. A locking pin at each end of the seat can be engaged to fix the upper and lower halves of the seat firmly together prohibiting the pivoting motion. This locking mechanism is designed so that it will only work when the seat is either fully forward-facing or fully rearward-facing. At any intermediate position, the seat is free to pivot. A foot pedal at one end of the seat must be depressed to unlock the locking mechanism. When the foot pedal is depressed, the locking pin pulls out of its receptacle. Once the seat is unlocked, it is designed so that it can be pivoted by a person of average strength.

Visual examination of the partially pivoted seats on the train did not show any evidence of damage as a result of the accident. A survey taken of a different VIA passenger train with LRC cars found one example of a seat that was not locked in the fully forward position. This seat pivoted easily when pushed. Visual examination of the pivot mechanisms did not find any evidence suggesting worn or broken pivot mechanisms.

VIA's Operating Manual for LRC Cars states that "LRC coach seats must always face in the direction of travel except for those which are set up in four facing seats arrangement, these are immobilized."

Involuntary pivoting of seats can also result in crushing injuries, entrapment, obstruction of aisles leading to emergency exits and restricted access to emergency exit windows.

7.0 Crew Communication^__Equipment Available

Train 74 was equipped with a public address system which allowed the OTS crew to make public announcements throughout the entire train or within individual passenger cars. The system did not include an interphone and therefore did not allow for two-way communication between OTS crew members. Announcements could not be made from the locomotive to the passenger cars, or vice versa.

The service manager was provided with a portable radio for two-way communication with the train crew. However, there was no means for two-way communication between the service manager and the other members of the OTS crew as the latter were provided with radio receivers or monitors only. The service manager was also provided with a cellular phone.

The only two crew members located in the passenger cars who had access to two-way communication lost their portable radios and a cellular phone during the accident. Both the two-way radio and the cellular phone supplied to the service manager were equipped with belt clips. Both belt clips opened, releasing the radio and the phone during the derailment and collision. They were later found in serviceable condition. The second locomotive engineer's portable radio was also equipped with a belt clip. The second locomotive engineer who was sitting in the club car at the time of the accident had removed his radio from his belt and placed it on the arm rest. During the accident, the second locomotive engineer lost his radio when it was projected forward through the car. It was found sometime later by the last passenger evacuating the club car.

Although the second locomotive engineer could not specifically recall why he had unclipped his radio and placed it on the arm rest of his seat, crew members involved in past occurrences have reported that this is not an unusual practice. Some did so because they found it uncomfortable to wear when seated. Others said that it often "popped" off their belt when they sat down and later they would realize that they did not have it. As a result, they decided to remove their radio from their belt before they sat down. They would then simply hold it, or place it nearby, so that they would know where it was if and when they needed it.

Crew coordination is essential in an emergency situation and is directly influenced by a crew's ability to communicate. The communication equipment supplied and the resulting operational procedures and work practices do not ensure effective and efficient communication between crew members in an emergency situation. One-way radio communication from the service manager to the senior service attendants is of limited value because the sender has no way to confirm that the message transmitted has been received, understood and/or acted upon as required. The senior service attendants do not have access to two-way communication with other OTS crew, the service manager, the train crew, or the Operations Control Centre.

8.0 Decorative Artwork

Throughout the train, decorative artwork hung on partitions in the passenger cars. In the coaches, artwork was dry-mounted to a hard backing, contained no glass and was relatively light at approximately 4 pounds (1.8 kg). In the club car, the artwork was similarly dry-mounted to a hard backing but it was also covered by glass and encased in a metal frame, making it considerably heavier at 19 pounds (8.6 kg). The glass covering the prints was determined to be safety glass (TSB Engineering Branch report LP 057/99).

During the derailment, the metal frame on a print hung in the club car separated at a seam and the print fell, landing behind the last row of passenger seats on the left side of the train (seats 53-54). Passenger seats 53-54 are part of a four-seater arrangement including seats 49-50. A collapsable table was set up between the two rows of seats. Often, the service manager, or the senior service attendants assigned to the club car, sit in these seats to complete their trip documentation; however, there were no crew members sitting there at the time of the accident.

Although there were no injuries reported that resulted from passengers or crew coming into contact with unsecured artwork or the sharp metal frame, an alternate approach to mounting these pieces could remove unnecessary hazards.

9.0 Cellular Wall Phones for Public Use

Each passenger car on the train was equipped with a three-watt cellular wall phone located at the "A" end of the cars, on the exterior wall of the women's washroom. The operation of these cellular phones is identical to that of a standard credit card public telephone. The physical design is the same as a standard wall phone. The handset is attached to the main unit by an extendable cord. When not in use, the handset rests, but is not secured, in a receptacle on the wall unit. Under normal operating conditions, the system uses train power. A battery backup is included in the power supply to provide continuous service if train power is lost. The backup emergency power supply lasts for one hour.

In car 3351, the unsecured handset was projected forward during the accident and came to rest on the floor in front of the intermediate sliding door leading from the passenger seating area to the vestibule where the primary emergency exit doors (side doors) are located. It is not known if any passengers or crew were struck by the handset. When the handset came to rest on the floor, the cord was stretched across the opening leading to the vestibule and hence the emergency exit door. Although the passengers from this car evacuated through the emergency exit windows in this particular occurrence, under other circumstances, passengers could have become entangled in the cord, particularly if evacuating in the dark.

10.0 Passenger Count

Before departure, the service manager obtained a computer print-out listing the number of confirmed passengers expected to board at Windsor and each scheduled stop thereafter. After departing Windsor, the service manager collected the tickets, placed them in a specific envelope, adjusted the passenger count on the print-out accordingly and placed all of the documents in his briefcase. The service manager kept his briefcase in the galley of one of the coach cars as was his usual practice. The actual passenger count is not reported to any central office. There is no requirement for the service manager to keep the passenger count documentation in any particular location on the train.

The process of collecting tickets and adjusting the passenger count is routinely completed by service managers every time they depart a station. If it becomes necessary for a service manager to direct his/her attention to other duties, service-related or safety-related, the collection of the passenger tickets and/or the adjustment to the passenger count could be delayed.

VIA was unable to provide an accurate passenger count until several hours after the occurrence at Thamesville. Eleven passengers were unaccounted for. Similar difficulties in establishing accurate passenger counts and the identity of individuals have been identified in previous TSB investigations involving VIA trains dating from 1994 (TSB report Nos. R94T0357 and R97H0009). In addition, a number of investigations involving VIA trains currently underway indicate that the problem persists. Given the conditions of this particular occurrence (daylight, minimal damage to the passenger cars, etc.), rescue efforts were not jeopardized by the inaccurate passenger count. Emergency response personnel were able to walk through the train and easily determine that the 11 missing passengers were not trapped in the cars.

An accurate, readily accessible passenger count, including the number of passengers per car, is vital information to emergency response personnel and ultimately to passenger survivability. Without accurate information, emergency responders may terminate rescue operations prematurely, inadvertently leaving someone trapped in the train. The safety of emergency responders can also be jeopardized during prolonged exposure to dangerous environments searching for individuals who are not there.

Appendix C - AAR Crashworthiness Standard S-580

Association of American Railroads
Technical Services Division^__Mechanical Section
Manual of Standards and Recommended Practices

S-580

---

LOCOMOTIVE CRASHWORTHINESS REQUIREMENTS

Standard
S-580
Adopted: 1989, Revised, 1994

1.0 SCOPE

These specifications for crashworthiness enhancements cover requirements applicable to all new road type locomotives built after August 1, 1990 for use on North American Railroads. The standards, stated in the form of design criteria, may be exceeded depending on the needs of individual users. Effective for new road type locomotives built after August 1, 1990.

2.0 GENERAL

Designs and materials used in providing crashworthiness enhancements stipulated herein shall be such so as to minimize the effect of weight restrictions on the fuel capacity of the locomotive.

3.0 REQUIREMENTS

3.1 ANTICLIMBERS

An anticlimber arrangement will be standard on the short hood end of the locomotive and shall be designed to withstand a minimum of 200,000 pounds without exceeding the ultimate strength of the material, when applied vertically and uniformly between the center sill webs under the anticlimbers of the locomotive. The anticlimber arrangement shall be attached to the underframe end plate in line with the center sill webs.

3.2 COLLISION POSTS

A minimum of two collision posts, located on the underframe longitudinals (center sills) shall be designed to withstand a longitudinal force of 200,000 pounds each at 30 inches above the deck and 500,000 pounds each at the underframe deck without exceeding the ultimate strength of the material.

3.3 SHORT HOOD STRUCTURE

The skin of the short hood end-facing area shall be equivalent to 1/2 inch steel plate at 25,000 psi yield strength (where thickness varies inversely with the square root of yield strength).

This end nose plate assembly shall be securely fastened to the collision posts.

Any personnel doors in the short hood end-facing area shall be suitably reinforced to the equivalent strength of the short hood skin. Any windows must meet FRA [Federal Railroad Administration] standards.

711195
M-117

Appendix D - Other Crashworthiness Safety Features

Rollover Protection

Rollover protection involves structural reinforcements to the sides and roof of the locomotive, intended to make the control cabin less vulnerable to crushing in the event the locomotive rolls during a collision. The current design standards do not have any requirements for rollover protection. In this particular accident, the locomotive did roll onto its side. However, the impact force was principally directed towards the rear as illustrated by the nature of the damage to the locomotive. Rollover protection is intended to react to sideward and vertical loads.

Sill Height

Ensuring uniform sill heights among all railway vehicles has been proposed as a possible method of minimizing damage due to collisions. In this particular case, the locomotive was either tipped or derailed at the time of impact, so the sills would have been in different orientations.

Deflection Plates

The purpose of deflection plates is to laterally deflect any vehicle accidentally struck by a locomotive in order to minimize damage to the control cab. The current design standards do not have any requirements for deflection plates. Studies have found that deflection plates must be slanted back at least 45 degrees in order to overcome the lateral resistance that exists in the track. This results in a requirement to significantly increase the underframe length, making deflection plates impractical. In this accident, since the locomotive had already left the track, deflection plates could have been effective in laterally re-directing the impact force.

Crash Refuge

A crash refuge is intended to be a safe area into which the cabin occupants can position themselves to be protected from impact and crush. Current design standards do not have any requirements for a crash refuge, nor is this currently among the proposed changes. The deformation experienced by locomotive 6423 during the collision pushed the front of the cabin nearly down to floor level; however, neither the cabin floor nor the underframe, where a crash refuge would most likely be located, were buckled.

Fuel Tank Integrity

In this accident, the fuel tank was sufficiently far back and beneath the underframe that it was not directly damaged by the collision with the hopper cars. However, its proximity to the ground resulted in its contact with the roadbed during the derailment. This contact with the ground caused some significant dents and at least one small puncture to the right side of the tank.

Crash Energy Management

This design feature ensures that, during a collision, the unoccupied spaces will deform before the occupied spaces. Structural deformation is beneficial during a collision because it absorbs a great deal of energy, causing the occupied spaces to decelerate more slowly. Due to the orientation of the locomotive at impact, in this occurrence, the "crush distance" available would have been the length of the short hood ahead of the control cabin. From the front tip of the short hood to the beginning of the first occupant seat, there is about 80 inches (203 cm). The short hood and roof had inadequate energy-absorbing capability to protect the control cabin from an impact of this severity. Further, it would be impractical to design a short hood that could absorb sufficient energy to protect the control cabin in such a severe collision.

Shatter-Proof Windows

Shatter-proof windows are intended to protect the cabin occupants from impacts by foreign objects such as small caliber bullets and cinder blocks.

Corner Posts

Corner posts are structural reinforcements located in such a position as to protect the cabin in the event of a corner collision. The current design standards do not have any requirements for corner posts, but this is among the proposed changes. In this accident, the collision was principally at the corner, and it is precisely that type of collision for which corner posts were intended. Corner posts would likely have the same order of magnitude of strength as collision posts. Given the severity of the damage experienced by the right collision post, it is considered that, in this particular accident, an additional corner post would have had a limited benefit.

Window Posts

Window posts are structural reinforcements to the existing vertical frames that separate the cabin front windows to protect the cabin in the event of a collision occurring in that region; i.e. airborne debris flying free from trucks during level crossing collisions. The current design standards do not have any requirements for window posts, but this is among the proposed changes. Although locomotive 6423 sustained impact in the area where window posts would be located, it is not the intention of this design feature to provide protection against collisions of this severity.

Appendix E - Dangerous Goods

Ammonium Nitrate

Ammonium nitrate can decompose in seven different ways. The prevalence of each of these reactions depends on the temperature. For practical purposes, the following three reactions are important:

• NH₄NO₃ = N₂O + 2 H₂O + 13.2 kcal
• 2 NH₄NO₃ = 2 N₂ + O₂ + 4 H₂O + 61 kcal
• 4 NH₄NO₃ = 2 NO₂ + 3 N₂ + 8 H₂O + 29.8 kcal

The first reaction describes the decomposition of ammonium nitrate at relatively low temperatures (180 to 200 degrees Celsius). The product of this decomposition is laughing gas and water. The relatively moderate release of heat tends to sustain the reaction.

The second reaction describes the complete detonation of ammonium nitrate and produces nitrogen, water and oxygen. This reaction develops temperatures of about 1 500 degrees Celsius and a pressure of about 164,640 pounds per square inch (psi).

The third reaction, which represents an incomplete detonation or partial deflagration of ammonium nitrate, does not produce large amounts of energy; however, one of its products, nitrogen dioxide, is highly poisonous. The concentration of nitrogen dioxide which is considered "immediately dangerous to life and health" is 20 parts per million. Decomposition of 400 tons of ammonium nitrate by this reaction would produce close to 100 tons of nitrogen dioxide.

Risks Associated with Urea and Ammonium Nitrate

The intentional or unintentional mixing of ammonium nitrate with organic or combustible materials may result in the creation of powerful explosives. At many fertilizer facilities, Thamesville being one of them, both ammonium nitrate and urea are stored and handled. Urea, when mixed with ammonium nitrate in the right proportion, would be one such explosive. There was once a series of commercial explosives manufactured in Canada which consisted of ammonium nitrate as a principal oxidizer and urea as a principal fuel. In addition, it should be noted that, by carefully fusing equimolar quantities of ammonium nitrate and urea, the product of the reaction is nitroguanidine. Nitroguanidine is a high explosive with power equal to 104 per cent of trinitrotoluene (TNT) by ballistic mortar test and with a velocity of detonation of 7 650 m/sec at a density of 1.5. The overall strength of an explosive is directly proportional to its energy content as well as to the volume of gas it produces.

At any fertilizer storage facility which stores and handles both ammonium nitrate and urea, special precautions need to be taken to prevent their mixing. Chapter 1145 of the Handbook of Railway Operating, Engineering and Traffic Regulation historically exempted storage facilities from acquiring approval of the Canadian Transport Commission in the following circumstances:

23.2 (b) urea, urea compounds and bagged grain or grain products if they are separated from bagged ammonium nitrate or ammonium nitrate mixed fertilizer by a wall with a fire resistance of at least 1 hour or by a distance of not less than 30 feet or by any other method acceptable to the Commission that will prevent mixing of the segregated materials under fire conditions. . . .

At Thamesville, ammonium nitrate and urea are both off-loaded directly from rail cars into highway vehicles at different times but at the same location.

Risks Associated with Anhydrous Ammonia

At the Thamesville Orford Co-op facility, about 750 metric tonnes of anhydrous ammonia are distributed each year. Although the Thamesville facility currently receives all its anhydrous ammonia by truck, most similar facilities in Canada are serviced by rail.

Anhydrous ammonia is described as a corrosive gas by Transport Canada and as a toxic gas by the United Nations. While it is in a tank, it is in the form of liquefied gas under pressure. Under these conditions, a breach in a tank could lead to an immediate change from liquid to vapour and would create a cloud as the gas would occupy a volume several hundred times larger than the volume of the tank. A concentration of 300 parts per million of anhydrous ammonia is categorized as "immediately dangerous to life and health."

Although anhydrous ammonia is much lighter than air, a cloud can travel at ground level for several miles because of its high affinity for water. Anhydrous ammonia combines with moisture in the air, forming ammonium hydroxide.

In addition to being toxic, anhydrous ammonia can form an explosive mixture with air. Although fires and explosions of anhydrous ammonia are not common, there was at least one such fire reported in Canada in 1999 as a result of a derailment with the subsequent puncture of a tank car (TSB investigation ongoing^__R99T0256).

Appendix F - Special Permit 3255 Requirements

1. The stored cars had to be inspected by qualified personnel once during each 24-hour period after the expiration of the initial 48 hours.
2. Written records were to be kept of the inspections carried out in accordance with item No. 1.
3. Local fire and police departments were to be advised of the location and content of the stored cars.
4. Switches leading to the track where the cars were stored were to be secured with private locks.
5. Hand brakes were to be applied to all stored cars.
6. Applicable emergency response forms were to be readily available at the location where the cars were stored.
7. Special Permit Holders were to advise CANUTEC^{Footnote 38} in writing:
   1. of the location, shipping name, product identification number, class, packing group and numbers of cars stored before expiration of the first 24-hour period after the expiration of 48 hours and every 30 days thereafter;
   2. when cars were being held at a location not previously used for storing dangerous goods in excess of 48 hours;
   3. when rail cars were being held at a site where building changes have occurred to the area since the last period in which dangerous goods were held in excess of 48 hours.
8. The movement of trains on adjacent trackage were to be at a speed consistent with safety.
9. Any source of ignition in the immediate area was to be eliminated if rail cars containing flammable gas or liquids were being held.
10. Cars being stored were to be separated according to the separation requirements for marshalling operations.
11. If the location outlined in Item 7 was not acceptable, the permit holders were to advise CANUTEC in writing of alternate arrangements.
12. Accurate records of the number of cars and type of goods held were to be maintained and be readily available.
13. Any incident, accident, or leakage involving cars stored pursuant to the Special Permit were to be reported to CANUTEC.

Appendix G - Glossary

AAR

Association of American Railroads

ABS

Automatic Block Signal System

ATCS

Advanced Train Control System

AVC

assurance of voluntary compliance

CANUTEC

Canadian Transportation Emergency Centre

cm

centimetre

CN

Canadian National

CPR

Canadian Pacific Railway

CROR

Canadian Rail Operating Rules

CTC

Centralized Traffic Control System

EDT

eastern daylight time

FRA

Federal Railroad Administration

g

acceleration due to gravity

GBO

General Bulletin Order

GM

General Motors

H₂0

water

ICC

Interstate Commerce Commission

ID

Idle

kcal

kilocalorie

kg

kilogram

km

kilometre

L

litre

lb

pound

LRC

Light, Rapid, Comfortable

m

metre

MBS

Manual Block System

mm

millimetre

mph

mile per hour

m/sec

metre per second

N₂

molecular nitrogen

N₂O

nitrous oxide

NH₄NO₃

ammonium nitrate

NO₂

nitrogen dioxide

NS

Norfolk and Southern Railway Company

NTA

National Transportation Agency

O₂

oxygen

OCS

Occupancy Control System

OTS

on-train service

psi

pounds per square inch

RAC

Railway Association of Canada

RTC

rail traffic controller

R.T.C.

Railway Transport Committee (Canadian Transport Commission)

SCS

Special Control System

sec

second

TC

Transport Canada

TNT

trinitrotoluene

TSB

Transportation Safety Board of Canada

UCOR

Uniform Code of Operating Rules

U.S.

United States

UTC

Coordinated Universal Time

VIA

VIA Rail Canada Inc.