Railway Investigation Report R06V0183

On 03 September 2006, at about 1300 Pacific daylight time, northbound White Pass and Yukon Route work train 114, comprising one locomotive and eight loaded ballast cars, ran uncontrolled down a steep grade and derailed the locomotive and the first six ballast cars at Mile 36.5 on the Canadian Subdivision. One person was fatally injured and three others sustained serious injuries. The six derailed ballast cars were destroyed.

Ce rapport est également disponible en français.

1.1 The accident

On 03 September 2006, at approximately 0700 Pacific daylight time,^{Footnote 1} the crew of White Pass and Yukon Route (WP&YR)^{Footnote 2} work train 114 (the train) reported for duty at Skagway, Alaska (see Figure 1), and proceeded by highway to Log Cabin, British Columbia, Mile 33.0 on the Canadian Subdivision. Eight ballast cars were stationed at Log Cabin waiting to be loaded and taken to Bennett, British Columbia, Mile 40.6 on the Canadian Subdivision. The dispatcher,^{Footnote 3} based in Skagway, was not apprised of their operation.

The train crew, consisting of a locomotive engineer and a conductor, arrived at Log Cabin at about 0745 and met with two heavy equipment operators. The crew decided to haul all eight loaded ballast cars to Bennett in a single trip with the one available locomotive (WP&YR locomotive 114). All four employees travelled together on the train.

The eight cars were shoved to the ballast pit and loaded one at a time. After the seventh car was loaded, the locomotive had difficulty pulling all eight cars to place the last for loading. As a result, the crew decided to switch four of the loaded cars to the siding.

At about 1100, the roadmaster, who was on a non-work-related trip, advised the train crew by radio that he would be following the work train in his track motor car.

At approximately 1140, after the last car was loaded, the conductor and two heavy equipment operators entrained, and the four loaded ballast cars on the siding were switched back in. The crew performed a brake test,^{Footnote 4} and the locomotive engineer instructed the conductor on the procedure for setting retainers.^{Footnote 5} He requested that the conductor set one retainer in the high pressure position. The locomotive engineer released the automatic brake^{Footnote 6} and the train departed. The conductor remained on the short-nose platform outside the locomotive because the three seats inside the cab were occupied. The short-nose end of the locomotive was coupled to the ballast cars, that is, the locomotive was to be run with its long hood forward.

At Mile 33.8, while travelling at about 15 mph on the descending 1.5 per cent grade, the locomotive engineer reduced the throttle and made an automatic brake application of 18 pounds per square inch (psi). He brought the train to a controlled stop at Mile 34.2. The locomotive engineer asked that the conductor set the remaining retainers in the high pressure position. The conductor detrained and set the retainers on the remaining two similarly equipped ballast cars.

The locomotive engineer released the independent^{Footnote 7} and automatic brakes and the train departed. At approximately Mile 34.5, where the grade starts to descend at about 1.5 per cent before briefly levelling off at Mile 34.9, the locomotive engineer placed the throttle in the idle position, applied the independent brake and made another 18 psi automatic brake application. The work train then slowed down to less than 10 mph; therefore, the locomotive engineer released the automatic brake to avoid stalling. He then controlled the train with the independent brake.

The train then began descending the 3.3 per cent grade at Mile 35.0, and the speed increased to about 12 mph. The locomotive engineer had waited as long as possible - more than 30 seconds - to recharge the train before making a 20 psi automatic brake application just as the train crested the grade. However, the train's speed continued to increase. The locomotive engineer increased the independent brake effort in an attempt to control the speed. At about Mile 35.3, while the train was travelling at approximately 18 mph, the locomotive engineer increased the automatic brake application to just short of a full service brake application.^{Footnote 8} At that time, smoke was observed coming from the locomotive wheels.

At about Mile 35.5, the train speed was approximately 20 mph and the locomotive engineer, realizing that the train was a runaway, placed the automatic brake into emergency and made an emergency radio broadcast. However, because there was no direct radio link, neither the dispatcher nor the roadmaster heard the call. The train continued to accelerate.

As the train was negotiating the 16-degree, left-hand curve at Mile 36.5, the conductor jumped to the east and landed in a small stream. The train then derailed to the outside of the curve, the east side (see Photo 1). The locomotive engineer and the two heavy equipment operators were trapped inside the cab.

1.2 Post occurrence

One of the two heavy equipment operators was conscious, but the lower part of his body was buried in rock and debris. While digging himself out, he uncovered the locomotive engineer and revived him. He then used a nearby portable radio to inform the roadmaster of the accident. The roadmaster proceeded to the derailment site and found both of the heavy equipment operators and the locomotive engineer trapped in the cab. He then found the conductor incapacitated in a small stream below the right-of-way and pulled him from the water. The dispatcher was called and emergency assistance was requested.

1.3 Emergency response

At approximately 1330, the dispatcher called emergency response personnel, railway company officers, and immediate family members of the employees involved in the derailment to inform them of the accident. Emergency medical services from Tagish, Yukon, and Skagway responded, as well as the Skagway and Whitehorse, Yukon, fire departments, the Carcross, Yukon, ambulance services and the Carcross Royal Canadian Mounted Police (RCMP). The emergency response personnel had assumed that the accident involved passengers and, as a result, the Skagway fire department spent an additional 25 minutes gathering the appropriate resources.

Emergency response personnel arrived at Log Cabin by helicopter and automobile and were transported to the accident site by track motor car, arriving there at approximately 1430. Once a safe landing area was established, helicopters were able to transport the first responders to the site. Because of radio communication difficulties, emergency response personnel had to set up relay stations to communicate with the train dispatcher.

The conductor had sustained serious injuries and was airlifted by helicopter to hospital. After being revived, the locomotive engineer freed himself from the locomotive cab. The heavy equipment operator who placed the radio call to the roadmaster was freed by the first responders at approximately 1800. Both men had sustained serious injuries and were transported to hospital. The second heavy equipment operator had sustained fatal injuries and was extricated from the nose of the locomotive by approximately 2100.

1.4 Site examination

The locomotive and the first six cars derailed to the east side of the track (see Figure 2). The locomotive came to rest on its side, parallel to the track, after sliding about 135 feet along the right-of-way. The conductor's side of the cab and the short hood nose had collapsed and were partially filled with rock and debris, burying the crew members. The interior of the cab had sustained heavy damage.

An examination of the locomotive showed that the wheel rims were blued^{Footnote 9} (see Photo 2), with some showing signs of skidding. The brake shoes were thermally damaged.

The two ballast cars directly behind the locomotive were jackknifed upright into the locomotive. The next four cars were parallel to the track and were either leaning or were on their side. The last two ballast cars remained on the rails coupled to the cars ahead and were not derailed.

An examination of the ballast cars revealed blueing and signs of skidding on some of the wheels, indicative of heavy braking. The brake shoes were in operable condition. The retainers, present on the first, third, and eighth cars from the head end, were set in the slow direct position.^{Footnote 10} The pistons on the last two cars were extended, indicating that the air brakes were applied.

A wheel flange marking was discovered at Mile 36.5 on the running surface of the east rail. The marking extended approximately 36 inches from the gauge side to the field side and was oriented northward, pointing towards the locomotive. Approximately 120 feet of track was damaged.

About 300 gallons of diesel fuel, lubricant and coolant had leaked from the locomotive. Most of the spillage was contained and recovered. There was no lasting environmental impact.

On the day of the derailment, the weather was clear and calm and the temperature was 10°C.

1.5 The White Pass & Yukon Route

WP&YR is an excursion railway that extends 110.5 miles between Skagway and Whitehorse. Approximately 440 000 passengers travelled between April 2006 and the end of September 2006 on WP&YR's trains. Up to 13 passenger trains are operated daily, transporting up to 6000 passengers. In 2006, passenger trains operated only as far north as Bennett. In 2007, service was extended to Carcross. Work trains operated as far north as Carcross between March and October. The track from Carcross to Whitehorse was taken out of service in 1982. There was no regular freight train service.

Passenger train crews consisted of a conductor, a trainman, and a locomotive engineer. Work train crews consisted of a conductor and a locomotive engineer. There were eight passenger train crews and one work train crew. Towards the end of the passenger train operating season, additional work train crews were formed from the passenger train crews. Usually, senior operating employees were assigned to the work train, which would continue operating into October.

WP&YR employs a maximum of 175 people in peak season with 150 in the United States and 25 in Canada. In the off-season, the employment numbers drop to 15 American and 2 Canadian employees.

Because WP&YR is an excursion railway, it is exempt from the Transport Canada (TC)-approved Railway Passenger Car Inspection and Safety Rules. However, it is not exempt from the following TC-approved rules:

• Railway Freight and Passenger Train Brake Rules,
• Railway Freight Car Inspection and Safety Rules,^{Footnote 11} and
• Railway Locomotive Inspection and Safety Rules for locomotives used in other than passenger service.

WP&YR is not a member of the Association of American Railroads (AAR). However, it is subject to the Railway Freight and Passenger Train Brake Rules and, therefore, must ensure that the air brake systems on all cars are maintained in accordance with AAR requirements.

1.6 Track information

WP&YR comprises two subdivisions: the American Subdivision, which begins at Skagway (Mile 0.6) and extends to the American border at White Pass, British Columbia (Mile 20.4), and the Canadian Subdivision, which begins at White Pass and extends to Whitehorse (Mile 110.5). The Canadian Subdivision is classified as Class 2 track according to the Railway Track Safety Rules and has a maximum authorized track speed of 20 mph. It is a narrow-gauge, 36-inch-wide track that has a maximum grade of 3.5 per cent and a maximum horizontal curvature of 18 degrees. Between Log Cabin and Bennett, the track elevation drops 759 feet in about 7 miles.

In the derailment area, the track descends at a 3.3 per cent grade and consists of a single main track in a reverse curve configuration: a 5-degree, right-hand curve (in the direction of travel) followed by a 16-degree, left-hand curve. The right-hand curve was 209 feet long with no superelevation. The left-hand curve was 229 feet long with a superelevation of 1 ¾ inches. The rail was 90-pound jointed Lackawanna 1910 to 1934 rail laid in 1974 and installed on single-shouldered tie plates. It was secured to eight-foot-long softwood ties with two spikes on the low rail and three spikes on the high rail. The rails were connected with four-hole joint bars. Rail anchors were installed on the uphill side of every third tie. Gauge rods were applied in the curves. The ties were installed in 2003. They were spaced 19 ½ inches apart and were in good condition. The ballast was crushed rock. The cribs were full and the shoulders extended 18 inches beyond the ties. The culvert at Mile 36.5 was in good condition. The track was last visually inspected on 28 August 2006 and no defects were found.

1.7 Method of train control

While in Canada, WP&YR trains operate under the Occupancy Control System^{Footnote 12} and are governed by the Canadian Rail Operating Rules (CROR). On 28 August 2006, WP&YR Operating Bulletin 06-16 established "cautionary limits" between the north cautionary limit sign at Fraser and the south cautionary limit sign at Whitehorse. All movements were to be made in accordance with CROR Rule 94, which authorizes employees to operate at caution speed on the main track in areas marked by cautionary limit signs. Caution speed requires the use of speeds that permit stopping within one-half of the range of vision of equipment or track units. There was a permanent speed restriction of 20 mph between Mile 31.0 and Mile 38.9. The dispatcher did not need to be contacted if trains were operating in cautionary limits. However, according to Item 5.9 of WP&YR timetable, there was a requirement to report to the dispatcher upon arrival at, or departure from, or when passing certain control locations. Log Cabin and Bennett were two such locations. On the day of the accident, there was no record that the crew members reported their departure from Log Cabin.

The Canadian Subdivision is controlled by the dispatcher in Skagway. The dispatcher communicates to the field by radio or mobile radiotelephone. At Mile 36.5, communication is available only through the mobile radiotelephone. This form of communication requires the dispatcher to dial the Northwest Telephone mobile operator with an identification number and a call sign. The operator then connects the dispatcher with the field employees. The same process is followed by the crews to communicate with the dispatcher. It is not possible for a crew member to directly contact emergency services.

1.8 Employee information

Both the locomotive engineer and conductor met the company's fitness and rest standards and were qualified for their positions according to the WP&YR standards. They respectively had 29 and 26 years of seasonal railway service with WP&YR. Both had been passenger train locomotive engineers before this assignment on the work train. Most of their operating experience had been on the American Subdivision, with the occasional trip to Fraser or Bennett. The locomotive engineer had been performing work train service for four months before the accident. He had never descended the grade between Log Cabin and Bennett with more than four ballast cars and fewer than two engines before the day of the accident. The conductor had five days of work train service experience in which he predominantly handled trains comprised of air dump cars.^{Footnote 13}

The two heavy equipment operators had four years and eight years of service, respectively, working for the railway. They typically operated front-end loaders and backhoes to fill ballast cars and air dump cars.

1.9 Locomotive 114

Locomotive 114 was manufactured in September 1982 by Montreal Locomotive Works, and purchased by WP&YR before being shipped to Skagway in 1995. It weighed approximately 108 tons and had six traction motors mounted in two three-axle trucks. The locomotive had a rating of 1300 horsepower and a maximum speed of 40 mph.

The locomotive was equipped with a 26L air brake system. The clasp-type brake arrangement, with six frame-mounted brake cylinders per truck, had high friction composition brake shoes. The clasp-type brake arrangement provides greater braking capacity than non-clasp-type brake arrangements and was less prone to heat fade.

Locomotive 114 was equipped with a dynamic brake. Dynamic braking causes traction motors to act like generators. When dynamic braking is used, the locomotive wheels are used to turn the motors and the electrical current generated is dissipated as heat. This is the opposite of the normal situation where the traction motors drive the wheels. The energy required to turn the motors slows the train. A properly functioning dynamic brake is capable of generating more braking effort than the locomotive independent brake when applied at low speeds. At high speeds, the dynamic brake loses effectiveness. For instance, braking effort on locomotive 114 was reduced at speeds greater than 20 mph. The dynamic brake on this locomotive was not equipped with a dynamic braking holding feature. As a result, an emergency application of the automatic brake would have nullified the dynamic brake, had it been in use. Dynamic braking is particularly advantageous when descending mountain grades because, unlike friction brakes, dynamic brakes are not subject to loss of effectiveness from heat fade.

Locomotive 114 had a defective dynamic brake from the date of purchase. When used, only maximum braking effort was available. Numerous attempts to repair the problem were made without success. Safe dynamic brake operation requires a gradual transition from motoring (pulling) to braking. The rapid build-up dynamic brake effort that occurred each time dynamic braking was activated on this locomotive led WP&YR locomotive engineers to avoid its use altogether because it was considered dangerous.

Rule 4.1 of the Railway Locomotive Inspection and Safety Rules states that:

a railway company is responsible for the inspection and repair of all locomotives to ensure safe operation. All components, appurtenances and control apparatuses of all locomotives must be designed and maintained to perform their intended function.

Locomotives must pass a quarterly and a monthly inspection as well as undergo a pre-departure inspection by locomotive engineers before their taking control of the equipment. The last quarterly inspection was performed on 24 July 2006 and the last monthly inspection was performed on 29 August 2006. During the pre-departure inspection on 03 September 2006, the locomotive engineer did not note any exceptions. He was already aware of the defective dynamic brake issue.

Locomotive 114 was not equipped with an event recorder as required by the Railway Locomotive Inspection and Safety Rules,^{Footnote 14} which stated in part:

A controlling locomotive shall not be placed in service other than is designated and/or yard service without an operative event recorder.

Analysis of locomotive event recorder information can assist management when assessing crew performance to ensure safe train handling procedures. In addition, it assists company and investigative bodies in determining the events that occurred before accidents, leading to the enhanced identification of safety deficiencies and the mitigation of risks.

1.10 Ballast cars

The WP&YR ballast cars were built in 1944 and were designed to carry cinder ballast.^{Footnote 15} Each car was 39 feet long and had a tare (unloaded) weight of 20 tons,^{Footnote 16, Footnote 17} and a maximum volumetric capacity of 70 cubic yards.

The braking system of the ballast cars consisted of automatic brake control valves and 10-inch-by-12-inch AB-1 foundation brake cylinders. The cars were not equipped with automatic slack adjusters to maintain brake cylinder piston travel. Cast iron brake shoes were used with 28-inch wheels. The hand brake was a standard AAR type with bell crank.

When WP&YR purchased the ballast cars in 1990, none were equipped with retainers. Rule 88 of the 2006 Field Manual of the AAR Interchange Rules states, in part, that "All cars must be equipped with a pressure retaining valve." A program was put in place to install the valves whenever a car came into the Skagway mechanical shop for maintenance. However, only three of the cars had had valves installed; two with four-position retainers and one with a three-position retainer.

A three-position valve works in the following manner:

• The exhaust position allows the air to completely exhaust from the brake cylinder, releasing the train brake and is achieved by placing the handle straight down.
• The high pressure position retains 20 psi air pressure in the brake cylinder and is achieved by placing the handle in the eight-o'clock position.
• The slow direct position allows the air to completely exhaust in about 1 ½ minutes and is achieved by placing the handle in the 10-o'clock position.

The placement of the retainer handle to achieve the exhaust, high pressure and slow direct positions is the same for both the three - and four-position valves. A four-position valve has an additional position, low pressure, which allows the air to exhaust down to 10 psi air pressure in 60 seconds. Once the automatic brake has been released, the air brake system begins to recharge, while brakes remain applied on those cars with retainers set. The high pressure position is intended for use when descending heavy grades with loaded cars.

1.11 Loading of the ballast cars

Locomotive 114 and four ballast cars were stationed at Log Cabin for work train service. During the week of the derailment, an additional four ballast cars were relocated to Log Cabin from Skagway. For the first time, eight ballast cars were stationed together at Log Cabin. Before this work assignment, four ballast cars had typically been stationed together.

The roadmaster expected the cars to be loaded to the top with ballast in accordance with regular practice (see Photo 3). Accordingly, the heavy equipment operators would typically place between 17 to 21 buckets of ballast in each car. Each bucket had a capacity of 3.0 cubic yards when level and 3.5 cubic yards heaped; all buckets were heaped.

The scaled weight of the ballast was 2840 pounds per cubic yard. The estimated dry weight was 2691 pounds per cubic yard.

On the day of the occurrence, the heavy equipment operator limited the number of buckets to between (a low of) 13 and (more likely) 17 buckets because of concerns about taking all eight cars down the steep grade north of Log Cabin. The 13 buckets weighed approximately 61 tons.

Based on field observations and supported by the photographic evidence (Photo 3), more than 13 buckets of ballast were loaded on each car. The range of possibilities is between 13 and 21 buckets, with a mean of 17.^{Footnote 18}

Information provided by WP&YR indicated that the maximum permissible load capacity of the ballast cars was 25 cubic yards or 35.5 tons of crushed rock ballast.

According to Section B.3.b., Rule 70, Lightweighing and Stencilling, of the 1993 Field Manual of the AAR Interchange Rules (the last year that referenced 5-inch-by-9-inch axle journals), the maximum gross rail load^{Footnote 19} for each car is limited to 71 tons. As the lightweight of each car is 20 tons, the maximum load capacity of each car is 51 tons.

The load capacities were not known to the employees on site. None of the ballast cars were stencilled with their maximum load capacities as is normal industry practice.

1.12 Brake Shoe Force Test (TSB Engineering Laboratory Report LP 091/2006)

On 04 October 2006, TC, Knorr Brake Limited and the TSB performed a brake shoe force test on the two ballast cars (WP&YR 643 and WP&YR 647) that did not derail. The tests revealed the following:

• The air brake systems of the two ballast cars were operational. They passed the leakage and functionality tests. They performed as intended when service and emergency brake applications were made. The retainer worked well.
• Using the most conservative loaded weight of the car on the day of the accident, the braking ratios were a little more than one-half of that required by the (1999) AAR minimum standard (S-401).
• Using the most likely loaded weight of the car on the day of accident, the braking ratios were only about one-third to one-half of that required by the (1999) AAR minimum standard (S-401).
• The net braking ratio for the car, even when properly loaded, was still below the latest applicable (1999) AAR minimum standard (S-401).
• The net braking ratio of one of the two cars was within the 1944 standards for empty cars; however, both were below the latest (1999) AAR minimum standard (S-401).

1.13 Train handling procedures

WP&YR Timetable 178, Item 1.5, for the American Subdivision stated that locomotive engineers are responsible for determining the need for retainers. It also stated that, when used, retainers must be turned down after passing Mile 5.0 on southbound trains. However, there was no indication of exactly what "down" meant. The Canadian Subdivision portion of the timetable did not provide any requirements concerning retainers. In addition, there were no special operating instructions or best practice guides provided to train crews when operating over sections of track with mountain grades.

In past practice, it was typical to handle four loaded ballast cars northward from Log Cabin. In such circumstances, extra cars and locomotives were normally handled, which provided additional braking capacity. No train handling procedures were provided to work crews instructing them on safe train marshalling practices for mountain grade territory.

Other railways have developed recommended train handling procedures to instruct crews on how to operate safely on mountain grades. For example, Canadian Pacific Railway has subdivision footnotes regarding train operation on its Rossland Subdivision where trains routinely descend grades of up to 4.1 per cent. The procedures instruct the operating crews on:

• the maximum number of loads and empties;
• the requirement for retainer valves in high pressure position on all loaded cars;
• conditioning brakes and brake tests;
• speed control instructions;
• independent, dynamic and automatic brake manipulation; and
• the speed at which an emergency brake application must be made.

1.13.1 Cycle braking

In a situation where the train brakes must be re-applied shortly after having been released, locomotive engineers are required to take special precaution to ensure that the brakes actually do apply.^{Footnote 20} Generally speaking, after the air brakes have been released and the brake pipe pressure on the rear car of a train has stopped rising, the train brake system is considered to be fully charged.

However, with very short trains, this is not always the case.^{Footnote 21} If it becomes necessary to re-apply the brakes, railway general operating instructions usually require that any subsequent application involve reducing brake pipe pressure significantly more than the previous application, as measured at the rear of the train.

1.14 TSB Engineering Laboratory report LP 091/2006

In this type of accident, the TSB Engineering Laboratory would normally be tasked to perform a simulation and dynamic analysis. However, this was not possible due to the limitation of the simulator when applied to narrow gauge conditions, the absence of locomotive event recorder records and the lack of track information. A simplified calculation was conducted to help analyze the brake capability at two event moments: the full service brake application and the emergency brake application. The following are some of the relevant points from this analysis:

• Due to overloading, each car had insufficient braking capability.
• Under both simulated event conditions, the actual brake capability could not prevent the train from running away.
• The air brake ratios of the tested cars were below the AAR standard requirements for safe operation, and were insufficient to operate the overloaded train safely on the steep grades in the mountain area of the railway.
• If the cars had been loaded within the capacity limit and the train weight had been limited to 588 tons, a full service brake application may have been able to control the train and prevent the runaway.
• The calculated actual braking force on the train during the emergency braking event was less than the braking force produced during the full service braking event. The possible explanation for this was the lower friction and braking efficiency present during the emergency braking event, due to the higher speed of the wheels and the reduction of brake shoe friction at higher temperatures.
• Properly functioning dynamic brake could have helped reduce the runaway probability through reduction of the effect of high-temperature brake fade.

1.15 Heat fade

Heat fade is a phenomenon commonly associated with the operation of trains in heavy grade^{Footnote 22} territory. When tread brakes are applied, friction between the shoe and tread converts the kinetic energy of wheel motion (rotation) into heat energy, heating the wheel. The greater the force and/or speed of the wheel, the greater the amount of heat generated. As a result of excessive heat build-up, the coefficient of friction between the brake shoe and the wheel is lowered, resulting in a significant loss of braking force. At higher speeds, heat builds up and the resulting loss of braking capacity increases.

1.16 Transport Canada

On 07 June 2005, TC performed an equipment inspection on WP&YR property that revealed a number of mechanical issues with the locomotives and freight cars, including brake head misalignment on Alco and General Electric locomotives. This resulted in the brake shoes overlapping the outer edge of the wheel rim or the brake shoes not contacting the wheel tread concentrically. TC received confirmation that all of the problems identified were corrected by 24 June 2005.

1.17 Safety Management System

TC's Safety Management System Regulations mandate that, as of 31 March 2001, all railway companies operating on federally regulated railways must implement and maintain a safety management system (SMS). TC's Safety Management System Regulations are accompanied by an implementation guide^{Footnote 23} to assist railways in developing their SMS and in meeting the minimum requirements of the regulation. The guide also suggests ways of incorporating other safety-related systems and processes under the SMS umbrella to ensure a comprehensive management approach to safety.

The Safety Management System Regulations require railways to establish a formal framework for integrating safety into day-to-day operations. This includes safety goals and performance targets, risk assessments, responsibilities, authorities, rules, procedures, and monitoring and evaluation processes. TC accepted WP&YR's initial SMS submission in 2002 and determined that it met the requirements of the Safety Management System Regulations.

To ensure compliance with the regulations, TC audits a railway company's SMS. An audit is a two-stage process that involves a pre-audit (document only) followed by a verification audit. In June 2002, TC conducted the pre-audit and identified several findings of significant non-compliance in all aspects of the company's SMS. Work conducted between June and September 2002 brought the SMS plan in compliance with the regulations. In June 2003, TC conducted the verification audit that was general in nature and did not address all of the company's functional procedures. It concluded that WP&YR was in non-compliance with 2 of the 12 mandatory SMS components (Risk Management and Corrective Action Development) and gaps were noted in 9 of the remaining 10 components. A gap is a discrepancy between the process and what is actually occurring. TC concluded that this was a reasonable start but that additional work was required for an effective SMS.

1.18 Training

At the beginning of each season, WP&YR management provided a two-day training course for all operating employees: one day each on the American and Canadian rules. The course concentrated on proper procedures for stopping trains, running around the train^{Footnote 24} with the locomotive, and clearing other trains. The course also stressed the need for proper radio/telephone communications between crews and dispatcher according to the procedures contained in the WP&YR Rule Book. It also covered air brake operation under the American rules. There was no specific training provided for work trains.

For the two years before the accident, the training course had been taught by a senior trainman/conductor. There were no training manuals to follow. Rather, the course relied on the instructor's knowledge and experience. The instruction was based on the WP&YR Rule Book, Safety Manual and Timetable. During the course, safety issues identified during the previous season and any other issues where the employees needed clarification were discussed.

In comparison, other federally regulated railways have significantly more rigorous rules training, selecting rules instructors from experienced senior employees who have demonstrated a thorough understanding of the CROR. Each instructor must use company-supplied study material prepared to address all safety-critical situations. New locomotive engineers receive an intensive course and must pass a series of exams. Locomotive engineers, conductors and trainmen are required to attend a recertification program every three years where they receive instruction on a variety of subjects that have been established by regulation.

A multiple choice exam was given following WP&YR's rules course. There was no set pass mark. Any incorrect answers were discussed with the employee. If employees had too many incorrect answers, they could be removed from service. Employees were also given an opportunity to earn extra marks for additional answers given in one question on the exam. Additionally, there were a number of questions on the exam that had little to do with promoting safety. Very few questions addressed train handling or air brakes. Once employees passed the course, their qualification cards were recertified for the current operating season.

Typically, an experienced operating employee would bid the work train positions and would be mentored by another senior employee who was more familiar with the work train assignment, and would assist in performing the duties of the position.

To ensure that the operating rules and radio communication procedures were being followed, WP&YR management performed unannounced efficiency tests several times a season. When tests were conducted, management typically checked radio communications, crew interaction with passengers, crew procedures at crossings, initial terminal air brake tests, application and release of brakes, knowledge of rules, regulations, instructions, track warrants, and bulletins. Clothing/safety equipment, drug and alcohol use, handling of switches, qualification cards, standard time, coupling/moving of equipment, inspection of trains, burning of fusees (flares), and train speeds were also checked. Any safety concerns were handled during a subsequent meeting with the employees. If a safety concern was identified a second time, a letter would be sent to the employee. No copies of these tests were retained on file.

Other federally regulated railways generally provide more rigorous efficiency tests, including train riding and rules compliance (that is, proper radio procedures, copying, repeating and applying authorities, train speed, air brake tests and adequate train handling techniques). Downloads of locomotive event recorders are obtained and checked for proper braking procedures and train handling. These tests are recorded and filed.

2.1 Introduction

There was no information to suggest that track conditions played a role in the derailment. The investigation revealed that the train became uncontrolled and reached a speed of about 20 mph before being placed into emergency. The presence of wheel flange markings on the running surface of the east (high-side) rail head indicates that the point of derailment was in the sharp left-hand curve at Mile 36.5. The location of the locomotive, on its side on the outside of the curve, and the absence of wheel flange markings on the ties between the rails are indicative of a wheel lift derailment caused by overspeed.

The following factors collectively contributed to the train becoming uncontrolled while descending the mountain:

• the overloading of the ballast cars and the make-up of the train;
• the steepness of the grade;
• the ineffectiveness of the brake systems on the ballast cars;
• the absence of comprehensive operating instructions for the safe descent of this extreme mountain grade;
• the speed of the train and the depleted state of charge of the air brake systems on the cars when the grade was crested;
• the speed that the train was permitted to attain before train brake applications were made, that is, full service (18 mph) and emergency (20 mph); and
• the absence of a functioning dynamic brake on locomotive 114.

Additionally, safety-critical issues including training, communication, emergency response, and the SMS will be discussed.

2.2 The accident

Examination of the locomotive showed that the brake system was fully operational before the derailment and that the brakes had been heavily applied and became very hot. Because of the resultant high temperature of the brake shoes, it is likely that the effective braking force of the locomotive brake system had been diminished by the effects of heat fade. The high temperature attained at the interface between the wheel tread and the brake shoes was due to the high speed at which the brakes were initially applied and the extent and duration of the brake application.

Examination of the cars revealed that all the brakes were operational but that only some of the brake shoes had been heavily applied against the wheels. Although this is consistent with normal rolling stock operation, the brake shoe force test results of the two sister cars were below applicable AAR standards for minimum braking force and, therefore, it is likely that the brake systems on all of the ballast cars were functioning at a diminished capacity.

Because the brake system on the cars were not generating their maximum braking force and because the brake system on the locomotive was experiencing the effects of heat fade, the entire train brake system was not functioning optimally. In addition, only three of the eight cars were equipped with retainers, which were set to an incorrect position and were not providing any retarding force. The overloaded condition of the cars, the number of cars marshalled in the train and the steep mountain grade exacerbated the effect of the already diminished braking capacity of the cars. When the train began descending the grade and the locomotive engineer applied the automatic and then the emergency brake, the braking force generated was insufficient to control the train and it continued to gain speed until it derailed on the sharp curve at Mile 36.5.

2.3 Loading of the ballast cars

As the roadmaster expected the cars to be loaded as full as possible for operational reasons, the cars typically would be completely filled with ballast. Because the load appeared reasonable for the size of the car and because cars had been handled while overloaded north from Log Cabin many times before without incident, WP&YR employees believed that fully loaded cars could be safely handled. However, based on the AAR-recommended maximum gross rail load of 71 tons for cars equipped with 5-inch-by-9-inch axle journals, each car was overloaded as indicated in Figure 3.

Figure 3. Calculations of overload.

This information indicates the following:

• Using the most conservative estimate and the AAR maximum gross load, the cars were overloaded by approximately 10 tons each.
• For the minimum end of the most likely scenario and the AAR maximum gross load, the cars were overloaded by approximately 34 tons each.
• For the maximum end of the most likely scenario and the WP&YR maximum load, the cars were overloaded by approximately 70 tons each.

The load limit in terms of maximum weight was not stencilled on the side of these cars, nor was it required to be. However, most railways stencil this information onto their cars for the ready reference of crews.

No training was provided on load capacities of ballast cars, nor were there any marker lines or indications on the cars indicating a maximum carrying capacity. Additionally, the WP&YR volumetric limit of 25 cubic yards of ballast per car had not been disseminated among the employees. In the absence of training, guidelines, or indicator markings on the cars to inform railway employees as to the maximum safe load capacity of the ballast cars, WP&YR employees were unable to determine a safe maximum load capacity and, consequently, the cars were overloaded.

2.4 Work train equipment handling procedures

The crew received instructions to take the loaded ballast cars to Bennett and placed all eight loaded ballast cars and one engine on the train. Although trains with six loaded ballast cars had been handled from Log Cabin before, there had been additional locomotives and empty cars, marshalled within the train, which increased overall braking capacity. Before the derailment, there was no discussion concerning the need for additional braking capacity to safely descend this grade.

Both the locomotive engineer and the conductor were inexperienced in work train service and unaware of the maximum number of cars that could be handled with one locomotive. Work train marshalling practices were not covered in the company's training program and no operating instructions guiding employees on horsepower/braking requirements were provided. While other railways have developed specific train handling instructions guiding their crews on how to safely descend steep mountain grades, there were no such instructions on the WP&YR to guide crews on the safe make-up and operation of trains in this challenging territory. In the absence of a comprehensive set of guidelines in train make-up, there is a risk that trains will be operated in mountain grade territory without an adequate margin of safety.

While all eight cars on the train were required to have retainers, only three of the cars were so equipped. Although Timetable 178 indicated the locomotive engineer's responsibility to determine the need for retainers, there was no instruction indicating how to set them or what each position meant. Due to the lack of familiarity with retainers, the retainers were set incorrectly in the slow direct position, in which the air brakes bled off in about 1 ½ minutes, exhausting all the air from the brake cylinders. Had they been set in the high pressure position, they would have provided a holding force of 20 psi in the brake cylinders when the locomotive engineer released the train brakes. Without a retainer on each car and without adequate crew knowledge of how to properly set them, a line of defence against a loss of control in mountain grade territory was not available to this crew.

2.5 Train handling procedures

Approaching Mile 35, the locomotive engineer released the automatic brake from an 18 psi application to avoid stalling the train. Consequently, the train crested the hill at about 12 mph with the brakes released. The braking force required to control a train down a grade is proportional to the speed at which the train crests the grade: the faster it crests the grade, the greater the braking force required. Therefore, cresting the grade at a lower speed would have reduced the braking force required to control the train. These train handling decisions resulted in the train beginning the critical part of the descent with the brake system not ready to counteract the steep grade.

After cresting the grade, the train accelerated to 18 mph before any supplementary application of the brakes was made. At about Mile 35.3, the locomotive engineer increased the automatic brake reduction to just short of a full service application (about 28.5 psi assuming brake pipe pressure was set at 90 psi). Although the train continued to accelerate, the brakes were not placed in emergency until the train speed reached about 20 mph. To prevent a complete loss of control, it is critical that an emergency brake application be made at the lowest possible speed, otherwise friction surfaces will reach temperatures at which braking effectiveness will decline. In this instance, the train was allowed to reach a speed, prior to initiation of the emergency brake application, that decreased the likelihood of its stopping.

The locomotive engineer was inexperienced in handling heavy trains down mountain grades and had no company guidance on safe train handling procedures. In the absence of adequate instructions and training, a number of train handling decisions were made that were inconsistent with safe practices for descending mountain grades and contributed to the loss of control.

2.6 Training

There were several instances where the crew members of the work train demonstrated a lack of understanding of safe operating procedures for work trains. They were unaware of the safe loading capacities of the ballast cars, the danger of riding on the outside platform of a locomotive, safe train handling procedures for heavy trains on mountain grades, and the operation of retainers.

In other modes of transportation, there are specific regulations provided by TC requiring licensing and training of employees (for example, Canadian Aviation Regulations for flight crews). As the railway industry is not governed by TC in this manner, larger companies such as Canadian National and Canadian Pacific Railway provide comprehensive training for newly hired employees and recertification courses for experienced employees. These courses make use of extensive training materials and guidelines, and are taught by CROR-qualified instructors drawn from a pool of employees that have been recognized as having an exemplary understanding of the theory and practice of the CROR.

While WP&YR provides rules instruction yearly to employees, this training can be categorized as ad hoc. There was no formally prepared rules instruction course provided that used detailed training material. The training program relied on the experiences of the most senior trainman, who would not necessarily have the requisite knowledge to ensure that WP&YR employees were adequately trained in safe work train operating practices. Without comprehensive training material and well-established policies and procedures, training at WP&YR was not entirely effective.

2.7 Dynamic brake

The locomotive in this accident was equipped with dynamic braking. Dynamic braking does not rely on the friction created by brake shoes to slow the train and does not suffer from the effects of heat fade. A fully functioning dynamic brake can generate significantly more braking effort than the air brakes on a locomotive. Therefore, it can be a useful tool to control the train speed, particularly in mountain grade territory. The dynamic brake on this locomotive was not serviceable because it reacted in an unsafe manner by applying maximum effort each time it was activated rather than allowing a gradual build-up of force. Even though it could have been accessed by the locomotive engineer, its use was not considered for this reason. While the condition of the dynamic brake was known to the railway, it had not been disabled and, in the absence of a formal policy concerning its use, locomotive engineers had deemed it non-operational. Because the dynamic brake was not functioning properly, a valuable line of defence against a loss of control on mountain grades was not available to the locomotive engineer.

2.8 Safety Management System

WP&YR's SMS submission to TC met the minimum requirements. However, information obtained during the investigation indicates that a number of the safety management procedures and practices were deficient, for example:

• training of employees;
• maintenance of ballast cars and locomotives;
• use of locomotive event recorders;
• operating on mountain grades without specific train handling and marshalling instructions;
• loading of ballast cars; and
• communications between the dispatcher and work train operations.

The SMS on the WP&YR did not identify the above safety-deficient practices and therefore was not sufficiently developed to have ensured the progression of safety philosophy through to policies, procedures, and practices. Moreover, the 2003 TC audit of WP&YR's SMS, being a general audit, was not designed to identify safety-deficient practices, and consequently, did not lead to the development of a more comprehensive SMS.

2.9 Communication

The train entered the main track under the authority of cautionary limits and, while the crew members were required to contact the dispatcher after departing Log Cabin, they were unsuccessful at doing so. The dispatcher was therefore unaware that the work train was operating. The dispatcher was frequently unaware of work trains in cautionary limits because trains are self governing, within the parameters of the rule in these limits. When the passenger train season ends, typically at the end of September, there would be no dispatcher on duty. As such, the requirement of a work train to report at prescribed locations would constitute a broadcast to open air, for whomever may be monitoring the radio in the area. As a result, there were times when a work train would operate on WP&YR track when its exact whereabouts was not known to others.

On other Canadian railways under federal jurisdiction, it is common procedure that, even within cautionary limits, the dispatcher is aware of trains operating in that territory. As a result, dispatchers have train information such as train type, number, consist, and crew information. Being unaware of the operation of the work train created a risk that the dispatcher could not provide the most accurate information to accelerate the emergency response.

In order to place an emergency call from the locomotive, a crew member must complete a series of steps by first contacting a third party operator who will, once given the correct account number, transfer the call to the intended party. In high stress situations, such as a runaway, it is difficult for employees to complete these tasks in a timely manner. In this accident, the crew was unsuccessful in placing an emergency call to the dispatcher. In addition, there was no emergency response protocol available between the railway and the third party operator, if the dispatcher was unavailable. When a complex series of steps is required to establish communication, there is an increased risk that, in an emergency, an adequate level of safety may not be immediately provided.

2.10 Emergency response

The emergency responders arrived on scene within a reasonable amount of time, given the rugged terrain and remote location. However, had the dispatcher been notified immediately after the roadmaster first learned of the accident, and had the information in the initial notification been more complete, that is, had they known the accident involved a freight train, not a passenger train, the response time would have been quicker. The rescue took longer than anticipated because of difficulties gaining access to the locomotive cab. The fire department's extrication equipment was not sufficient for cutting open the thick steel. After being revived, the locomotive engineer freed himself from the locomotive cab. The heavy equipment operator who placed the radio call to the roadmaster was freed by the first responders within three and one-half hours of the responders' arrival on site.

3.1 Findings as to causes and contributing factors

1. The overloaded train derailed after it ran away down the steep mountain grade with its degraded brake system unable to control its speed.
2. The effective braking force of the locomotive brake system had been diminished by the effects of heat fade.
3. It is likely that the brake systems on all of the ballast cars were functioning at a diminished capacity.
4. The overloaded condition of the cars, the number of cars marshalled in the train and the steep mountain grade exacerbated the effect of the already diminished braking capacity of the cars.
5. In the absence of training, guidelines, or indicator markings on the cars to inform railway employees as to the maximum safe load capacity of the ballast cars, White Pass and Yukon Route (WP&YR) employees were unable to determine a safe maximum load capacity and, consequently, the cars were overloaded.
6. Without a retainer on each car and without adequate crew knowledge of how to properly set them, a line of defence against a loss of control in mountain grade territory was not available to this crew.
7. A number of train handling decisions were made that were inconsistent with safe practices for descending mountain grades and contributed to the loss of control.
8. Because the dynamic brake was not functioning properly, a valuable line of defence against a loss of control on mountain grades was not available to the locomotive engineer.

3.2 Findings as to risk

1. In the absence of a comprehensive set of guidelines in train make-up, there is a risk that trains will be operated in mountain grade territory without an adequate margin of safety.
2. Without comprehensive training material and well-established policies and procedures, training at WP&YR was not entirely effective.
3. Safety management on the WP&YR was not sufficiently developed to have ensured the progression of safety philosophy through to policies, procedures, and practices.
4. The fact that the dispatcher was unaware of the operation of the work train created a risk that the dispatcher could not provide the most accurate information to accelerate the emergency response.
5. When a complex series of steps is required to establish communication, there is an increased risk that, in an emergency, an adequate level of safety may not be immediately provided.

3.3 Other findings

1. Using the most conservative estimate and the Association of American Railroads (AAR) maximum gross load, the cars were overloaded by approximately 10 tons each. For the minimum end of the most likely scenario, and the AAR maximum gross load the cars were overloaded by approximately 34 tons each. For the maximum end of the most likely scenario, and the WP&YR maximum load, the cars were overloaded by approximately 70 tons each.
2. The emergency responders arrived on scene within a reasonable amount of time, given the rugged terrain, remote location, and the information they received from the railway.

4.1 Action taken

4.1.1 TSB Rail Safety Advisories

On 23 November 2006, the TSB issued to Transport Canada (TC) Rail Safety Advisory (RSA) 07/06, Pressure Retaining Valves on White Pass & Yukon Route Ballast Car, indicating that TC may wish to assess the extent to which White Pass and Yukon Route (WP&YR) management ensures that cars are properly equipped and maintained, and that train crews handling these cars have adequate instruction and training to ensure that sufficient control is exercised on mountain grades.

On 30 November 2006, the TSB issued to TC RSA 08/06, Overloading of White Pass & Yukon Ballast Cars, indicating that TC may wish to assess the loading practices of engineering service cars (ballast and air dump cars) on the WP&YR.

4.1.2 Transport Canada

On 12 December 2006, TC issued a Letter of Non-Compliance and a Notice to WP&YR citing their violation of various TC regulations referenced under the Railway Safety Act concerning hazards/conditions related to the ballast cars and to the operation of ballast trains.

On 05 June 2007, TC issued a Notice and Order to WP&YR requiring that trains not operate between Bennett, Mile 40.6, and Carcross, Mile 67.5, unless they are equipped with a system that ensures positive communication directly with the rail traffic controller and that facilitates emergency calling recognizable by the rail traffic controller.

From 04 June 2007 to 07 June 2007, TC conducted an audit under the Safety Management System Regulations of the WP&YR safety management system (SMS). The audit made a number of findings that were communicated to WP&YR. The following are some of the findings that are relevant to this investigation:

• Risk assessments were not being carried out.
• WP&YR was in non-compliance with the Employee Minimum Qualification Standards.
• There was no documented process describing how the company carries out air brake tests and how it ensures compliance with the Railway Freight and Passenger Train Brake Rules.

On 11 June 2007, TC issued a Notice to WP&YR concerning several hazards/conditions related to the reliance by the railway on employee familiarity to protect against each other on the main track. This reliance may result in an increased likelihood of a collision taking place between a train and maintenance-of-way forces, which may become complacent and/or not be expecting the movement of a train or engine. This risk is greatly magnified by the lack of reliable radio communications between Bennett and Carcross.

On 11 June 2007, TC sent a letter to WP&YR in regards to train operation monitoring activities, which revealed several safety-related deficiencies.

On 31 July 2007, TC sent a letter to WP&YR directing them to conduct a formal risk assessment on the safe operation of rolling stock when descending grades greater than 2 per cent and to then develop written procedures.

On 31 July 2007, a TC Occupational Health and Safety Officer issued a Direction to the WP&YR concerning their contravention of the Part II of the Canada Labour Code regarding the provision of information, training and instructions to operating employees relating to the following:

• the adverse effects of overloaded rolling stock on braking performance;
• the safe operation of rolling stock on grades over 2 per cent; and
• the safe and proper operation of rolling stock including locomotives.

The Direction required WP&YR to take steps to ensure that the contravention does not continue.

TC conducted additional monitored activities on the WP&YR from 27 to 29 May 2008. TC indicates the intention to revise the Railway Locomotive and Inspection Safety Rules as follows:

• Locomotive Design Requirement - all new locomotives shall be equipped with dynamic braking and a dynamic braking holding feature.
• Application of Safety Inspection and Movement Restrictions - all locomotives with dynamic braking or dynamic braking holding feature defect will be listed as a Part III safety defect.
• Pre-Departure Inspection - to include in conditions listed in Appendix I a test of the dynamic braking once en route and any defects reported in accordance with company procedures/work instruction.

4.1.3 White Pass and Yukon Route

On 15 February 2007, WP&YR replied to both of TC's Notices dated 12 December 2006, indicating that:

• It would have retaining valves installed on all rolling stock by the beginning of the 2007 operating season.
• All WP&YR ballast cars would be stencilled with load limit weights.
• All personnel involved in loading WP&YR ballast cars would be instructed on loading procedures and limits by the operating supervisor before the 2007 operating season, which was to be followed up with a memo from the Superintendent of Rail Operations to all equipment operators.

On 30 April 2007, a WP&YR memorandum was issued concerning ballast car loading procedures including: gross weight of ballast car - 140 000 pounds; lightweight of ballast car - 26 000 pounds; load capacity of ballast cars - 108 000 pounds; and load capacity with Lewes Lake ballast - 2442 pounds per cubic yard. It provides front-end loader bucket capacity - 3.5 cubic yards heaped and 3 cubic yards struck - and dictates that a maximum load level is not to exceed 14 level bucket loads.

In May 2007, 24 trainmen, conductors and locomotive engineers attended a two-day course on the air brake system and pressure-retaining valves delivered by an instructor from the British Columbia Institute of Technology.

As of May 2007, Operating Bulletin 07-10 was issued, reinforcing WP&YR's existing policy requiring trainmen and conductors to perform a set-up and release brake test and an inspection before departure. When defects are found, the cars must be set out and a supervisor notified.

Instructions included in a draft form of Air Brake and Train Handling Rules dated 01 June 2008 include instructions on locomotive inspections and instructions on the operation of retainers for maintenance-of-way ballast trains and passenger operations.

A manual on job duties and safety issues for trainmen and conductors was published.

As of May 2008, WP&YR has installed type Q1067E event recorders on 17 out of 20 of its fleet of locomotives. The remaining 3 locomotives are used in a trailing position, within the train consist.

In June 2007, WP&YR acquired three satellite telephones for its trains and for the maintenance-of-way foreman between Bennett and Carcross providing them with the capability of communicating with each other and with the rail traffic controller. The telephone numbers have been distributed to the employees and an emergency number has been set up at the rail traffic control centre. The crews have been advised by operating bulletin that trains travelling north of Bennett must be equipped with a satellite telephone and have it turned on. Cellular telephones are also available to use if the existing portable telephones and recently purchased satellite telephones fail.

On 17 July 2007, Operating Bulletin 07-25 was issued to protect workers and foremen under Canadian Rail Operating Rules Rule 815. It ensures that work is stopped and cleared before a train is cleared through the limits.

In May 2008, WP&YR issued Operating Bulletin 08-19, a draft of rolling stock handling procedures for operating crews to minimize the risks while operating on grades of over 2 per cent.

WP&YR provided TC with its corrective action plan to address the findings in the report from TC's 04 to 07 June 2007 audit.

WP&YR introduced an annual 12-hour course on railway air brake systems. This course was presented by instructors from the British Columbia Institute of Technology and attended by all locomotive engineers, conductors and trainmen.

A three-hour training session on brake testing of car equipment, followed by testing, was given to all railway certified car inspectors.

Load limits and "restricted service equipment" (RSE) has been stencilled on the majority of dump cars.

From 02 to 04 May 2008, locomotive engineer recertification and testing programs were conducted and documentation has been placed on file.

A consultant has been hired to develop safety training and testing requirements.

A full-time safety manager was hired.

All car and locomotive maintenance is now documented and kept on file.

Retainer valves have been installed on all ballast cars.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 25 July 2008.

Appendix A - Glossary

AAR

Association of American Railroads

CROR

Canadian Rail Operating Rules

mph

miles per hour

psi

pounds per square inch

RCMP

Royal Canadian Mounted Police

RSA

Rail Safety Advisory

RSE

restricted service equipment

SMS

safety management system

TC

Transport Canada

TSB

Transportation Safety Board of Canada

WP&YR

White Pass and Yukon Route

°C

degrees Celsius