Railway Investigation Report R00T0179

On 09 July 2000, at approximately 1845 eastern daylight time, VIA Rail Canada Inc. passenger train nº 683, travelling westward on the Goderich-Exeter Railway Guelph Subdivision, was unintentionally diverted into the siding at Mile 41.37 in Rockwood, Ontario. Upon entering the siding, the train collided with unattended track machines used by 360networks Incorporated of Mississauga, Ontario, to install fibre-optic cable in the right-of-way. The collision resulted in the derailment of the locomotive and the following two coaches; however, all train equipment remained upright.

Twelve passengers and two employees sustained minor injuries. Approximately 200 litres of petroleum products from ruptured fuel tanks, hydraulic systems and lubricating reservoirs of some of the stored machines was lost to the environment. Approximately 300 feet of siding track and 100 feet of main track sustained substantial damage. Four machines were destroyed and several were heavily damaged.

Ce rapport est également disponible en français.

VIA Rail Canada Inc. (VIA) passenger train nº 683 (VIA 683), en route from Toronto to Sarnia, Ontario, consisted of one locomotive, three Light, Rapid, Comfortable coaches and one club car. A total of 154 passengers, 2 locomotive engineers and 3 passenger service employees were on board. The operating locomotive engineer approached the area of the east siding switch at below the maximum allowable speed with a service brake applied. He was watching for the switch target because he was aware of the 360networks Incorporated (360networks) project and the potential hazards that such construction could present to train operations. Additionally, he was aware that the track in the area of the east siding switch was rough and might jostle passengers at higher train speeds. The red switch target, showing that the switch was lined in reverse, was partially obscured by shrubs growing on the right-of-way near the Main Street crossing at Mile 41.30 and first became visible at the west end of the Eramosa River bridge (Mile 41.10).

At approximately 1845 eastern daylight time (EDT)^{Footnote 1}, on becoming aware that the switch target was lined for the diverging route, the operating locomotive engineer initiated an emergency brake application and then both locomotive engineers lay down on the floor of the cab to await events at the switch. The locomotive and all four coaches negotiated the switch without overturning, and the locomotive immediately struck the stationary machinery. The 10 pieces of 360networks equipment consisted of tractors with back-hoe attachments, trenching machines, a rail flat car, a motor car and a number of small lorries loaded with fibre-optic cable. The machines were both thrown to the sides of the track and bunched up until the train came to a stop with the front of the locomotive approximately 350 feet into the siding.

After the movement stopped, one of the locomotive engineers made a 911 call by cellular telephone and made immediate contact with emergency services. The Goderich-Exeter Railway (GEXR) rail traffic controller (RTC) in North Bay, Ontario, was then notified. The on-board service manager, located in the second coach, used his cellular telephone to notify the VIA control centre in Montréal, Quebec, and then moved through the train to determine the extent of passenger injury and check on the well-being of the other VIA employees. After having learned that no one had suffered serious injury, he detrained and walked to the locomotive. He was then advised by the locomotive engineers that the track was protected and to have the passengers exit the coaches and walk back to the Main Street crossing. An assistant chief of the local fire department was in the vicinity at the time of the accident and had heard the collision. He responded immediately, arriving at the train as the passengers began to detrain. A nearby recreation centre was used as a gathering point for the passengers. Nine injured passengers and two injured employees were transported to nearby hospitals, treated for minor injuries and released.

The locomotive was dented and covered with spilt fuel. The doors for the first coach that had been orientated next to the locomotive were blocked by the damaged machines. The bellows between the first car and the second car (the club car) were compressed and deformed, affording only a narrow passage between the two and forcing passengers to squeeze through a narrow opening to detrain by the south-facing door at the front of the club car (the north door was blocked externally by a rock face). The south-facing doors of the third and fourth coaches were also opened for the passengers. Unsecured luggage was strewn about the coaches and materials from the galley areas had been jolted from their usual storage areas. At impact, the train power supply from the locomotive became inoperative and the emergency power was automatically activated. The emergency lighting and the public address system on the second and third cars did not function, although the public address system had been working on hotel power up until the time of the accident. However, these two failures did not hamper the emergency evacuation. The locomotive engine continued to run at idle despite attempts to shut it down by use of the external emergency fuel shut-off valve, forcing one of the crew members to enter the engine compartment to shut it down. VIA later determined that the emergency shut-down feature malfunctioned due to an electrical fault, the origin of which might or might not have been attributable to the accident.

Event recorder data indicate that the train approached Mile 41.37 at 63 mph with a service brake applied. Three seconds after the initiation of the emergency brake application, a 13-second reduction in train speed occurred at an approximate rate of 2 mph per second. The speed then dropped from 39 mph to 0 mph in 5 seconds, with the rapid deceleration due to the series of impacts with the machinery. As the first of the machines was just west of the switch, it is evident that the train negotiated the turnout at about 39 mph. Although a number of factors can influence the time it takes to identify, recognize and react to a stimulus like a switch target, it can be assumed that there was about a four-second time frame necessary for the locomotive engineer to identify, recognize and react to the switch target. Considering the time necessary for the emergency brakes to set up (three seconds) and the recorded time before the first of the impacts (13 seconds), it can be calculated that the red switch target was first discerned and recognized when the train was about 1400 feet east of the siding, or at the west end of the bridge. Using the same reasoning with respect to reaction time, the time needed for the emergency braking to take effect and the deceleration rate (2 mph per second), it can be similarly determined that this train would have required about 2300 feet to stop from the point where the locomotive engineers were first able to discern the switch target. Had the train been travelling at 50 mph, it would have required about 1350 feet to stop.

After the accident, the locomotive engineers examined the east siding switch and noted that it was lined in the reverse position and secured with a high-security lock. At the direction of the local police, the locomotive engineers confirmed that it was properly locked and showed no sign of having been vandalized. The locomotive engineers then opened it with one of their keys and determined that the switch and the lock functioned as designed. Keys for high-security locks are closely managed by railway companies and are only issued to Canadian Rail Operating Rules (CROR)-qualified employees who are required to use such keys to carry out their duties.

The source of water supply for the town of Rockwood was located approximately 150 m to the south of the derailment area and there was some concern that the spilled petroleum products might seep towards the intake area. Contaminated soil from the immediate area was removed to mitigate this possibility. Pits, dug to detect below-ground contamination, did not reveal any migration of the spill.

The local police indicated that there had been no recent acts of vandalism in this area. The machinery stored on the siding was usually protected by a security guard; however, on the day of this accident, the guard had been absent.

At the time of the accident, the sky was overcast with a temperature of 22 degrees Celsius. The winds were light and variable, out of the northwest with light rain.

The Guelph Subdivision is a single main track, extending between Georgetown, Ontario, and London, Ontario. Train movements are governed by the Occupancy Control System (OCS) authorized by the CROR and supervised by an RTC located in North Bay. Maximum authorized speed is 70 mph for passenger trains and 55 mph for freight trains. Rail traffic consists of two freight trains and four passenger trains daily.

The OCS method of train control provides that train movements are governed by clearances issued by the RTC. Although clearance generation may be computer-assisted, there are no electronic track features to indicate track occupancy or to confirm track integrity or switch positioning to the RTC or train crews.

CROR Rule 104 specifies that ". . . main track switches must be lined and locked for the main track when not in use." This rule is only excepted under certain specified circumstances; for example, a designated switch (identified in the clearance and to be approached with caution) or when the switch is under the control of a switchtender or crew member.

The turnout at the east end of the Rockwood siding was a nº 12 manually operated switch designed for a maximum train speed of 15 mph. It was equipped with a 48-inch mast with a standard target array with the east-facing (when reversed), red, oblong target also displaying a small weathered yellow reflectorized patch. The switch was located within a 1.3-degree curve with four inches of superelevation. The switch stand was located to the south (low) side of the track with the siding diverging to the north. Lining the switch from the normal position to the reverse position involved movement of the mechanism down the gradient, and lining the switch from the reverse position (routing from the main track onto the siding track) to the normal position involved the movement of the mechanism up the gradient.

The track (and right-of-way) was owned by Canadian National (CN); however, the track was leased to GEXR. 360networks had a contractual arrangement with CN to permit the installation of a fibre-optic cable along the right-of-way and had been installing cable in the vicinity of the siding during the day. The lease between CN and GEXR stipulated that, when fibre-optic cable was being installed, CROR-qualified CN track maintenance foremen (TMF) would protect fibre-optic installers and machines from train movements. Three TMFs were assigned to provide such protection; one senior TMF and two assistant TMFs - one assistant to occupy and operate a Hi-rail vehicle at the east end of the work area and another to do the same for the west end of the work area. The senior TMF would coordinate the activities of the assistant TMFs, make the necessary contact with the GEXR RTC, and respond to approaching trains as required. The switches at each end of the siding were equipped with high-security switch locks, and because only one switch key had been assigned to this project, coordinating measures and key hand-offs were required to open and restore the switches to move the machines and Hi-rail vehicles into and out of the siding. The work arrangement, however, ensured that the construction machines were always located between the two assistant TMFs and were always accounted for.

At 0450 on 09 July 2000, the senior TMF requested and received a Track Occupancy Permit (TOP) for machinery and track units to occupy the main track from Mile 36.0 westward to Mile 44.0. The senior TMF discussed the TOP and the day's work with the two assistant TMFs and other workers before starting construction activity. The immediate work of the day would require that part of the work gang work east of the siding track and that another part, west of the siding track. Construction had started at 0500 and had finished at 1700. The TOP was cancelled at 1712. Two trains had passed through the work limits during the day - eastward VIA 682 at approximately 0915 and westward VIA 685 at 1230.

After the passage of VIA 685, the entire gang worked east of the siding on both sides of the Eramosa River bridge. At approximately 1530, work activity was stopped and the on-track equipment moved westward to enter the Rockwood siding for overnight storage. The west-end assistant TMF reversed the east siding switch, directing all following on-track equipment into the siding. The west-end assistant TMF was accompanied by a CN signal maintenance employee (one of two CROR-qualified CN signal maintenance employees assigned to the work gang to find and prevent damage to already buried track-side cables) and a contractor employee. The west-end assistant TMF then operated the Hi-rail vehicle through the length of the siding, reversed the west siding switch, and re-entered the main track. The Hi-rail was then operated westward to the public crossing at Mile 42.19, where the contractor employee quit the vehicle. The west-end assistant TMF and the CN signal maintenance employee then returned eastward, restored the west siding switch to the normal position, travelled the length of the siding on the main track, and stopped short of the east switch.

A number of machines entering the siding track passed by the stationary vehicle of the west-end assistant TMF. One of the larger machines had been removed at the Main Street crossing and was then re-railed so as to be the last machine into the siding track. The vehicle of the east-end assistant TMF was then removed from the main track at the Main Street crossing.

As the last machine entered the siding, the east-end assistant TMF reminded the west-end assistant TMF by radio to re-line the east siding switch for the main track. Just after the last machine was placed into the siding track, the west-end assistant TMF was observed walking towards the east siding switch. It was at about this time that two additional construction machines (tractors), equipped with both road tires and rail wheels, arrived at the Main Street crossing. These machines had been removed from the main track east of the bridge and travelled to the Main Street crossing by road to avoid having to cross the bridge. The operators of these machines advised the west-end assistant TMF that they would need to travel westward to be placed to the west end of the siding because there was no room for these machines at the east end of the siding. Because of the rock wall on both sides of the track, the Hi-rail vehicle of the west-end assistant TMF was moved westward to enable the two tractors to travel on the ballast to the west end of the siding. After the two tractors were positioned, the Hi-rail vehicle was then again moved eastward and again stopped at the east siding switch.

The CN signal maintenance employee indicated that he then exited the south side of the vehicle (the same side as the switch stand) and lined the east siding switch for the main track. The other CN signal maintenance employee standing at the Main Street crossing observed this action. The CN signal maintenance employee at the switch and the west-end assistant TMF stated that, at this time, the switch was only lined from the reverse position to the normal position. The CN signal maintenance employee at the switch was certain of this because the switch was unusually easy to line and it nearly flopped over by itself, making comment to the west-end assistant TMF as he returned to the vehicle that it should be verified. After the switch had been handled, the Hi-rail vehicle was operated 300 feet eastward to the Main Street crossing and removed from the track. The east-end assistant TMF then communicated to the senior TMF, remote from the track at this time, that all workers and machines were clear of the main track and that all switches were lined "normal" and locked. No one from the group of several workers present at the Main Street crossing recollected looking at the switch target after the vehicle of the west-end assistant TMF had passed the east siding switch or before or after it had been removed from the track at the crossing. At 1712, the senior TMF contacted the RTC and cancelled the TOP. No one associated with the fibre-optic cable installation project was present when VIA 683 was diverted into the siding.

The handling of this switch was re-enacted by the same CN signal maintenance employee approximately 24 hours after his previous switch handling. The CN signal maintenance employee noted that the switch required significantly less force to line from the normal position to the reverse position as compared to the force required to line it from the reverse position to the normal position.

TSB data from 1993 to the present indicate that, on average, passenger trains unexpectedly encounter reversed main-track switches once a year and freight trains, eight times a year. The majority of these occurrences happen in OCS territory, and most involving passenger trains are investigated by the TSB (see Appendix A). In most instances, human error at the point of switch handling was viewed as the single most important causal factor and TSB recommendations have focussed on developing electronic means to monitor the orientation of switches in OCS territory and improving procedural or administrative defences to ensure compliance with CROR Rule 104. The issue of reversed switch target conspicuity and the need to be able to see and identify such a switch target from a distance sufficient to be able to stop a train short of a target have also received attention.

On 20 July 2001, the TSB issued Rail Safety Advisory 05/01 to Transport Canada entitled "Observations of Railway Passenger Safety in Canada." The advisory, after commenting on how Transport Canada and VIA have improved passenger safety by addressing past Board recommendations, provided a brief investigative summary of five accidents occurring between July 1999 and April 2001. The safety deficiencies identified as a result of these five investigations were then discussed in relation to previously issued Board recommendations addressing similar issues. The advisory concluded that, although it was clear that there had been significant improvements in rail passenger safety over the last 11 years, many relatively minor issues were outstanding that, in aggregate, might pose a significant safety problem. In the case of this particular occurrence, a comprehensive passenger safety analysis was not conducted for VIA 683 because the injuries were minor and the evacuation from the lightly damaged upright cars was quickly executed.

The emergency power on the second and third cars was determined to have not functioned properly as a consequence of defective batteries in their respective battery banks. Each car is equipped with two banks of five 12-volt batteries supplying 60 volts of emergency power that is automatically activated when hotel power is discontinued. Their design standard stipulates .that they provide two hours of emergency lighting in an ambient temperature of minus 20 degrees Celsius. The system shuts down when the charge level drops to 55 volts as discharged batteries will freeze.

The state of the batteries is determined through a weekly maintenance procedure that requires that the voltage be confirmed as exceeding 56 volts as indicated by a gauge in each car's electrical panel. Transport Canada's Railway Passenger Handling Safety Rules require that the person in charge of a train or other qualified person ensure that the emergency lighting functions as intended before a train's departure. The on-board service manager was familiar with the pre-departure requirements and had been trained in the testing of the safety systems on VIA equipment. Before the train's departure from Toronto, he had determined that the emergency lighting functioned in each car.

The batteries had been scheduled for replacement as part of a fleet-wide upgrade to a new battery scheme consisting of 30 two-volt "long-life" batteries, but the conversion had not taken place.

The OCS method of train control relies on switch securement, employee adherence to railway rules and company procedures, and well-trained and conscientious employees. However, as this accident has demonstrated, reliance on human behaviour leaves safe train operation vulnerable to compromise. The issue of reversed switches in OCS territory has long been a Board issue as outlined in Appendix A. It would seem that accidents attributable to this type of error, oversight or vandalism will continue until technological safeguards are employed.

VIA 683 approached the area of Mile 41.37 at below the maximum authorized operating speed with a service brake applied and the crew watchful to the orientation of the east switch at Rockwood. The manner of careful train operation and vigilance for potential hazards was key to the timely emergency brake application and subsequent reduction in speed that enabled the train to negotiate the switch without overturning.

As there was no indication that unidentified persons (vandals or persons in possession of a switch key with malicious intent) had reversed the switch, it must be concluded that this switch was inadvertently left lined and locked in the reverse position by railway employees. Since the fibre-optic work gang had only left the area about one hour before the accident and a member of this work gang had handled the switch just before finishing for the day, it is most plausible that the switch was left misaligned at that time.

In spite of the recollection by the CN signal maintenance employee that, when he last handled the switch, it had moved in a manner indicative of being lined from the normal position to the reverse position, the two involved employees were certain that they had left it lined for the main track. The notion that the switch had been left to the normal position may be attributable to years of performing the switch-turning exercise and developing a pattern for the required procedure. During travel on the main track, it is usual that the Hi-rail vehicle be moved into a siding to permit trains to pass by. This involves a two-step operation. The switch must first be reversed to allow the Hi-rail vehicle to enter the siding and then returned to the normal position to allow the train to pass. After the train has passed, two separate switch manipulations are again required to re-enter the main track. It is very likely that the CN employees unconsciously and erroneously made the two-phase switch handling manoeuvre as they would frequently do in their daily routines and inadvertently left the switch in the reverse position.

Although it cannot be conclusively stated that employees from the 360networks work gang left the area of the siding with the switch in the reverse position, it can be said that no one from among the workers at the Main Street crossing noticed or took notice of the easily discernable orientation of the east siding switch as the last Hi-rail vehicle was removed from the tracks. It can also be stated that the east-end assistant TMF did not visually confirm the position of the switch target after the CN maintenance employee last handled the switch and that the west-end assistant TMF, also charged with ensuring the proper orientation of the switch, did not check it either. The senior TMF, remote from the site, cancelled the TOP upon verbal advice from the east-end assistant TMF that the machines had been removed from the track and that both of the siding switches had been returned to normal. A procedural requirement or rule imposing a main-track switch orientation confirmation regime on employees engaged in track work would have enhanced safety.

It is noted that, although switch target recognition does provide a level of defence, the sight-line in this instance (1400 feet) did not provide sufficient safety advantage as this train required about 2300 feet to stop and entered the siding at considerable speed. However, as it was calculated that, had the train been travelling at 50 mph, it could have been stopped in about 1350 feet, the available sight-line would have been sufficient. It is apparent, therefore, that the use of switch targets as a defence against misaligned switches in OCS territory is dependent on available sight-lines and train speed.

The failure of the emergency power source on two of the three cars is of concern. In nighttime emergency conditions, it is critical that the coaches be lit and that the on-board personnel be able to communicate with passengers to facilitate a timely and orderly evacuation. The source of this failure is attributable to defective batteries, and their apparent poor condition was not evident before the accident; in fact, some aspect of impact forces sustained during the derailment may have played a role. It does appear, however, that routine maintenance and pre-departure verification of the batteries are not having the desired effect.

Findings as to causes and contributing factors

1. It is most plausible that the switch was left in the reverse position by persons in the 360networks work gang and very likely that CN employees unconsciously and erroneously made a two-phase switch handling procedure and inadvertently left the switch in the reverse position.

Findings as to risk

1. A procedural requirement or rule imposing a main-track switch orientation confirmation regime on employees engaged in track work would have enhanced safety.

Other findings

1. The manner of careful train operation and vigilance for hazards resulted in a timely emergency brake application and subsequent reduction in train speed that enabled the train to negotiate the switch without overturning.
2. The use of switch targets as a defence against misaligned switches in OCS territory is dependent on available sight-lines and speed.
3. Emergency battery maintenance and pre-departure verification procedures are not having the desired effect.

On 14 July 2000, Transport Canada, concerned that CN employees were not properly handling main-track switches in Ontario, issued a Notice and Order pursuant to the Railway Safety Act outlining procedures to be followed to lessen the possibility that main-track switches in OCS territory would be left in the reverse position. The order required that, in most circumstances, two CROR-qualified employees be present to confirm in face-to-face communications that the main-track switches have been properly positioned after handling and that employees handling these switches be afforded training on the application of CROR Rule 104 within 60 days and annually thereafter. The order also outlined a verification process to be followed to ensure compliance.

At the end of July 2000, Transport Canada called a two-day meeting of government and industry stakeholders to formulate action to resolve this issue. As the resultant industry resolutions designed to mitigate the risk did not appear to offer sufficient remedy, on 14 November 2000, Transport Canada issued an Emergency Directive to VIA, CN, Canadian Pacific Railway (CPR) and GERX directing in part the following:

• passenger trains shall not exceed 50 mph, freight trains shall not exceed 45 mph and freight trains handling special dangerous goods shall not exceed 40 mph when approaching a facing-point switch in non-signalled territory until the crew can confirm that the switch is properly lined.
• employees using main-track switches in such territory must confirm to another employee by personal contact, radio, or other communication, that they have fulfilled the requirements of CROR Rule 104 and outlined a procedural verification requirement.
• the railways must submit detailed plans to further mitigate the risks and report monthly on the progress of mitigation measures.

The Emergency Directive was to remain in effect for six months or until such time as the risk had been sufficiently lessened. On 14 May 2001, Transport Canada, not being satisfied that adequate long-term mitigation measures had or were being developed, extended the Emergency Directive for another six months and ordered the railways to revise CROR Rule 104 and send their proposal to Transport Canada within 150 days.

On 01 December 2001, a revised CROR Rule 104 came into effect. The revision requires that an employee handling main-track switches in non-signalled territory communicate with another rules-qualified employee to confirm the position of such a switch. The receiving employee must repeat the message back to the employee who handled the switch. It is also stipulated that, unless or until such a facing-point switch is seen to be in the normal position in OCS territory and unless governed by a signal indication, a passenger train may not exceed 50 mph from one quarter of a mile from the switch.

In March 2001, Transport Canada commissioned the University of New Brunswick to conduct an independent technical and scientific review of available technologies capable of providing advance information to train crews on the position of hand-operated switches in non-signalled territory. Surveys were directed to universities, research and/or development centres and suppliers/manufacturers of signalling equipment. Input was gathered from railways, Transport Canada, the Railway Association of Canada, the Brotherhood of Locomotive Engineers and selected companies and institutions. The review indicated that cost-effective and reliable systems could be installed, and 10 technologies that appeared to have potential were identified, with 5 having the highest probability of successful application. A preliminary benefit-cost analysis concluded that, while any such initiative would not be justifiable if only savings in property damage, personal injuries and fatalities are considered, it would be economically viable if only 5 or 10 per cent of the value of travel time for passenger and freight operations is considered.

In February 2002, Transport Canada also tendered a contract for a study on human factor issues related to railway operations in non-signalled territory. Design specifications for OSC systems will be reviewed to identify deficiencies that contribute to human error and propose countermeasures. A protocol will be developed for railways to evaluate and correct deficiencies in their systems.

VIA has now completed its fleet-wide emergency power battery replacement program. Transport Canada has reinforced the need to verify the operation of the emergency lighting system function with regional staff.

Safety concerns

While improved procedural requirements respecting the handling of main-track switches in OCS territory will improve safety as will speed reductions when approaching facing-point switches, reliance on human behaviour will continue to leave safe train operation open to compromise. Accidents attributable to error or oversight will continue until technological safeguards are employed to ensure that these switches are not left in the reverse position. It is .noted, however, that TSB data for the first six months of 2002 do not show any instances where a train, operating in non-signalled territory, has encountered an unanticipated reversed main-track switch.

Although the TSB appreciates that the emergency power systems on the VIA fleet have now been upgraded and that Transport Canada will sensitize its regional investigators to the need to ensure the carrier's compliance to established standards, concerns respecting the adequacy of this important safety feature remain. The TSB observes that, often, VIA trains experience emergency situations where locomotive power to passenger cars is lost and the emergency power fails to activate. In such situations, the vestibule doors cannot be opened in the usual manner (an emergency opening mechanism is located in the roof near the door), the in-car public address system will not operate, and if nighttime conditions exist, the cars are in total darkness, compromising safe passenger exit. The presence of banks of batteries containing sulphuric acid that may be damaged in an accident situation and release this dangerous substance in and among passenger cars is also a concern. The TSB will continue to monitor accidents where the emergency power has been required and consider safety action if instances of failure are noted.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 17 July 2002.

Appendix A - Previous TSB investigations involving reversed main-track switches or caution speed

R91D0032

On 02 March 1991 at 2120 eastern standard time, at Mile 54.97 of the Canadian National (CN) Sherbrooke Subdivision, while travelling eastward at 48 mph, VIA Rail Canada Inc. (VIA) passenger train nº 12 was inadvertently switched from the main track onto a private track. The train was stopped by an emergency application of the train brakes. No cars were on the private track at the time. The train did not derail, and there were no injuries to passengers or crew members. The second locomotive was damaged by a broken derail and spilled 900 gallons of diesel fuel. The Board determined that the cause of this occurrence was the misalignment of a main-track switch.

As a result of this accident, the Board made three recommendations regarding operating practices, main-track switch location and passenger train emergency stopping capability, and main-track switch recognition and passenger train emergency stopping capability. It recommended that:

R93M0059

On 10 August 1993, VIA passenger train nº 12 was unintentionally diverted onto a siding at Mile 58.2 of the CN Sussex Subdivision in New Brunswick. The switch at this location had been lined and locked for the siding rather than for the main track. The train crew had expected it to be lined for the main track. There was no standing equipment on the siding at the time. The train did not derail and was stopped in the siding by an emergency brake application. There were no injuries to the 240 passengers or 18 crew members and on-board service personnel. In this investigation, the Board determined that the switch was inadvertently left lined for the siding by a railway employee when it should have been left lined and locked for the main track.

In August 1993, a TSB safety advisory was sent to Transport Canada expressing concern that leaving a main-track switch lined and locked for a siding, unattended by a switchtender or a crew member in non-signalled territory where passenger trains are operated, creates an unsafe situation. Transport Canada responded that CN had been advised to consider improvements to operating rules, training of personnel handling switches, and the visibility of switch targets. CN was also requested to consider the introduction of self-restoring switches in Occupancy Control System (OCS) territory and advance warning of the position of switches for train crews.

In May 1994, the Board noted that, since 1991, there had been at least six occurrences, four of which in 1994, where trains encountered a switch left lined for other than the main track, and the train crew was not forewarned of the situation. Before 1991, switches were required to be lined and locked for the main track when not in use and were not to be left open unless in charge of a crew member or switchtender (Rule 104 of the Uniform Code of Operating Rules [UCOR]). However, in December 1990, the CROR changed UCOR Rule 104, giving more operational flexibility in the procedures for handling main-track switches. The occurrence record suggested that this new procedure was not being applied in a manner that ensured safe railway operations. Because of the occurrences where train movements continued to encounter main-track switches lined for other than the main track, and in view of the potential for serious collisions or derailments, the Board further recommended that:

R96W0171

On 02 July 1996, at 0351 central daylight time, eastward CN freight train nº M-358-51-30 was unintentionally diverted from the main track onto a spur track at Mile 145.4 of the Aberdeen Subdivision at North Battleford, Saskatchewan, and collided head-on with stationary and uncrewed CN freight train nº M-359-41-01. The locomotives of both trains were extensively damaged, and 10 freight cars derailed. One crew member sustained minor injuries.

The Board determined that the main-track switch for the spur track was inadvertently left in the reverse position. Contributing factors to the accident were the excessive permissible maximum train speed and the limited safety defence provided by the recognition distance of switch targets. The reversed roles of the locomotive engineer and conductor without adequate crew resource management discipline created a work environment leading to the main-track switch being left in the reverse position.

As a result of that accident, the Board stated that "removing the previous 15 mph maximum speed limit within cautionary limits improved operating efficiency, but [that it] is concerned that current operating speeds within cautionary limits have significantly reduced the margin of safety."

R98M0020

At 0349:18 eastern daylight time, on 31 July 1998, eastward VIA passenger train nº 14 operating within cautionary limits collided with an empty runaway five-platform articulated container car, rolling westward on the main track, from the then Matapédia Railway Company's Mont-Joli Yard at Mont-Joli, Quebec. The train had slowed from approximately 65 mph to about 40 mph on its approach to the Mont-Joli Station when the crew saw the moving equipment and applied the emergency air brake. At the time of the collision, the train had been slowed to about 30 mph and the runaway articulated car was travelling at approximately 6 mph. The force of the collision derailed the lead locomotive and jolted the passengers, railway employees and crew on board. Three of the 341 passengers were injured. No crew member was injured.

The investigation into that accident concluded that, in the event of unexpected runaways on the main track, operation at caution speed may have contributed to the degree of damage and hazard to passengers, crew and the environment. The Board expressed a safety concern that "the reduced requirements of caution speed, as presently defined in the CROR, may not be providing rail movements, particularly passenger trains, with an adequate safety defence against the increased risks that can exist within cautionary limits."

R99H0007

On 23 April 1999, at approximately 1200 eastern daylight time, VIA passenger train nº 74, travelling eastward on the north track of the CN Chatham Subdivision, at Thamesville, Ontario, encountered a reversed switch, crossed over to the south main track and derailed at Mile 46.7. The derailed train collided with stationary rail cars on an adjacent track. The three cars that were struck were loaded with ammonium nitrate. All four passenger cars and the locomotive of the passenger train derailed as well as four of the stationary cars on the adjacent track. The two train crew members in the locomotive cab were fatally injured. Seventy-seven of the 186 passengers and crew on board were treated at hospital. Four people were admitted with serious injuries. Numerous others received first aid on site. Approximately 50 m of main track and 100 m of the adjacent track were destroyed. The locomotive was damaged beyond repair and the leading two passenger cars sustained substantial damage.

On 14 November 2000, the Minister of Transport issued an Emergency Directive regarding the use of main-track switches in non-signalled territory to VIA, CN, Canadian Pacific Railway (CPR) and RailAmerica Inc. pursuant to Section 33 of the Railway Safety Act.

The Board commented that, with the implementation of this Emergency Directive, the increased level of risk associated with train operations in dark territory had now been formally recognized. The Board also recognized that this Directive indicated a general acknowledgement of the need for additional measures to mitigate the risks associated with the use of main-track switches in non-signalled territory.

Under the conditions of Transport Canada's Emergency Directive, passenger trains operating in OCS outside Automatic Block Signal System (ABS) would no longer approach main-track switches in the facing-point direction under the assumption that the switches were properly lined. This represented a fundamental change to the operating philosophy in this type of territory. Although the effects of these measures cannot yet be quantified, the Board anticipated that these initiatives would positively affect safety.

The Board noted that, while significant safety action had been taken, and more initiatives appeared likely, additional improvements were not a certainty. Also, although the initiatives of Transport Canada and the railway industry should result in significant safety improvements, the long-term continuation of some of these improvements was uncertain. As an example, the Board noted that the conditions of Transport Canada's Emergency Directive may not continue beyond the six-month period dictated in the Directive. The Board believed that a serious situation still existed, with a continuing probability of passenger trains encountering unanticipated reversed main-track switches, albeit at lower speeds. Therefore, the Board recommended that:

The Thamesville investigation determined that, in OCS outside ABS, the existing safeguards were inadequate to prevent the unauthorized reversed main-track switches from leading to the occurrence. Further, previous concerns expressed by the TSB with respect to the level of safety afforded by the OCS method of train control were renewed by this accident. In a number of different contexts, not exclusive to the rail mode of transportation, the Board has identified over-reliance on procedural compliance in the operation of safety-critical systems as an undesirable situation. Similarly, the Board has been advocating the development of safety strategies, where multiple layers of defence are used to improve error tolerance, where necessary. The Board believes that, when the effect of a single error on a safety-critical system can lead to the derailment of a passenger train at high speed, the error tolerance of that system is inadequate.

The investigation also determined that unauthorized reversed main-track switches were most often the result of inadvertent errors by railway employees. Past safety actions related to unauthorized reversed main-track switches have focused primarily on eliminating errors through improved procedural compliance. The speed restrictions imposed through Transport Canada's Emergency Directive, although temporary, indicated an acknowledgement of the inevitability of some level of human error with respect to the handling of main-track switches. This is a necessary first step towards understanding the effects of errors on a safety-critical system and towards developing mitigating strategies. Therefore, the Board recommended that: