Railway Investigation Report R16W0059

On 01 March 2016, at approximately 2335 Central Standard Time, the Cando Rail Services 2200 Co-op Refinery Complex assignment was switching tank cars loaded with asphalt at the Co-op Refinery Complex in Regina, Saskatchewan. At 2347, tank car GATX 67963 rolled away uncontrolled. The car travelled about 2.7 miles (4.3 kilometres), reaching a speed of 19 mph. The car traversed 7 public crossings at grade, each protected by automatic warning devices, and 1 railway interlocking (diamond) that crossed the Canadian Pacific Railway's Lanigan Subdivision before coming to rest in the city of Regina. There were no injuries, and no dangerous goods were involved.

Le présent rapport est également disponible en français.

On 01 March 2016, at approximately 2335,^{Footnote 1} the Cando Rail Services (Cando) 2200 Co-op Refinery Complex (CRC) assignment (the assignment) was switching tank cars on CRC asphalt loading tracks RA26 and RA27, located adjacent to Mile 91.10 of the Canadian National Railway Company (CN) Quappelle Subdivision^{Footnote 2} (Figure 1). The assignment was made up of 1 locomotive. The crew consisted of a locomotive engineer (LE) and 2 conductors (conductor 1 and conductor 2). All crew members were fully qualified for their respective positions, met fitness and rest standards, and were familiar with the territory.

Image

The incident

The assignment was tasked with switching out loaded tank cars at the CRC. The assignment arrived at the CRC and the crew removed all derails that protected the loading tracks. The assignment then entered the CRC and commenced switching. The crew pulled 9 cars out of track RA26 and intended to arrange the cars in blocks according to destination using tracks RA26, RA28, and the CN subdivision track (Figure 2). The crew set off non-dangerous tank car GATX 67963 (load of asphalt) on track RA28 and a cut of 5 cars on the adjacent subdivision track. All were secured with emergency air brake applications.

Image

Conductor 1 was on the ground to perform the switching. Conductor 1 did not apply any hand brakes as the cars were placed in emergency and conductor 1 intended to stay with the cars until the assignment returned with the next cut of cars. The assignment, operated by the LE under the control of conductor 2, then proceeded to track RA26 with 3 cars to continue switching, while conductor 1 lined the switch for track RA28.

About this time, conductor 2 suggested a change in the work plan and requested that conductor 1 assist with coupling the cars and connecting the air hoses of the cars on track RA27 before going back to track RA28 and the subdivision track. Conductor 1 agreed and walked over to track RA27 to assist, leaving car GATX 67963 and the cut of 5 cars unattended on track RA28 and the subdivision track, respectively.

Coupling the cars and connecting the air hoses of the cars on track RA27 took approximately 8 minutes. Once this task was completed, the assignment pulled southward out of track RA27, toward the subdivision track. At 2347, the LE noticed tank car GATX 67963 rolling uncontrolled at Mile 91.10 on the subdivision track, converging from the right. The LE initiated an emergency brake application to avoid a collision as car GATX 67963 rolled by the assignment. Subsequently, the LE informed the crew of the situation but did not make an emergency radio broadcast.

Upon being advised of the uncontrolled movement, conductor 1 closed the angle cock between the locomotive and the first car of the cut of cars being pulled, and lifted the operating lever to release the cut of cars from the locomotive. Once the locomotive consist recovered its air (recharged the air brake system), the LE and conductor 1 followed the runaway car and attempted to catch it. Conductor 2 remained at the CRC and applied hand brakes to the cars left standing on track RA27 and on the subdivision track.

The LE observed car GATX 67963 ahead and sounded the locomotive horn as the car approached the Ring Road public automated crossing located at Mile 91.78.

As the tank car occupied the block of the railway interlocking with the Canadian Pacific Railway (CP) Lanigan Subdivision (Mile 91.90), the interlocking signal displayed a stop indication. Since the assignment was unable to catch the runaway car by that time, the assignment stopped at the stop signal. Subsequently, the LE contacted conductor 2 by radio and advised conductor 2 to get the utility vehicle (truck), locate car GATX 67963, and secure it.

The LE then attempted to contact the CN Regina yardmaster by radio and cell phone, but got no response. The LE then called the CN Melville yardmaster and advised of the situation. CN Melville reached CN Regina and advised that the assignment would be calling with an urgent situation. The LE finally was able to contact the CN Regina yardmaster and advised that a single car was rolling uncontrolled toward the CN yard and asked the yardmaster to warn any trains in the vicinity. The CN Regina yardmaster advised that there were no trains in the area.

The LE then contacted the Regina City Police on the non-emergency number, provided a list of all the public crossings the runaway car could traverse, and suggested that officers be stationed at each crossing. The Regina City Police advised that it would do so and requested the LE to call back once the car was located.

A short time later, conductor 2 located car GATX 67963, which had come to a stop at approximately 0007, after travelling up an ascending grade near Quappelle Junction (Mile 93.80). The car had rolled uncontrolled for approximately 2.7 miles and had traversed 7 public roadway crossings and a railway interlocking (Figure 3).

Image

The car did not derail, there were no injuries, and there was no loss of product. Conductor 2 secured the car with a hand brake and then waited for a CN supervisor to arrive. The LE notified the Regina City Police that the car had been located. A CN crew later pulled car GATX 67963 to the CN yard for a mechanical inspection.

At the time of the incident, the sky was clear, there was a 5 km/h wind from the northeast, and the temperature was −8 °C.

Subdivision information

The Quappelle Subdivision runs north/south from Melville, Saskatchewan (Mile 0.0), to Regina (Mile 93.8). The subdivision is controlled by a CN rail traffic controller (RTC) located in Edmonton, Alberta. Between Keats, Saskatchewan (Mile 1.5), and Victoria Plains, Saskatchewan (Mile 88.0), train movements are controlled using occupancy control system (OCS) rules. The CN subdivision track^{Footnote 3} begins at Victoria Plains, where reduced speed^{Footnote 4} is applicable. Cando is allowed to operate only on the subdivision track between Victoria Plains and the interlocking with the CP Lanigan Subdivision (Mile 91.90). In the vicinity of the incident, the subdivision has an average descending southward grade of 0.6% between Mile 91.10 and Mile 93.70, after which it transitions to a 0.2% ascending grade into CN's Regina Yard.

Recorded information

All the public crossings involved in this occurrence were equipped with automatic warning devices (AWD). Of the 7 crossings, 6 were equipped with flashing lights and bells (FLB), and 1 was equipped with flashing lights, bells, and gates (FLBG). Information from the CP interlocking signal, the crossing signal bungalows, and automatic equipment identifier (AEI) car tag reader was recovered for the incident and is summarized in Table 1.

* FLB: flashing lights and bells

** FLBG: flashing lights, bells and gates

Co-op Refinery Complex track switching requirements

Cando is an independent rail services company that is contracted by the CRC to conduct switching operations at its facility. In servicing the CRC, Cando operates 3 shifts of 8 hours, commencing at 0600, 1400, and 2200, respectively, from Monday to Friday, and one 8-hour shift on Saturday, starting at 1400. There are no CRC switching requirements on Sundays. All shifts can be tasked with servicing the asphalt loading tracks, depending on customer requirements.

There is a specific sequence to spotting^{Footnote 5} cars on track RA26 and on track RA27. Normally, 7 cars are spotted on each track for asphalt loading. Another 3 cars are spotted for slurry loading on track RA26, with room for 1 car of cetane improver.^{Footnote 6} Four other cars are spotted on track RA27 for slurry loading. Loaded cars pulled from tracks RA26 and RA27 (located within a fenced compound) are switched for destination using the subdivision track and non-main track RA28 (Photo 1).

Image

All empty cars are brought in at the same time, with the asphalt cars at the north end of the cut. The first 3 asphalt cars are spotted at the loading racks and uncoupled from each other. The 4th, 5th, 6th, and 7th asphalt cars can remain coupled to the 3rd car. The following 3 slurry cars for track RA26 and 4 slurry cars for track RA27 are uncoupled and spotted individually at each rack. When spotting of the empty cars and cuts of cars is complete, Cando crews secure the cars with a hand brake, followed by an emergency air brake application, which occurs as the cars are separated.

Once CRC refinery personnel are finished loading the first 3 north-end cars of asphalt, they use a car puller to gather up and pull the 3 cars to the north. During this process, the 4 remaining cars of asphalt are uncoupled and spotted at each loading station. To complete this move, the hand brakes on each car are released and air brakes are bled off. Once the move is completed, hand brakes are reapplied. However, the air in the car reservoirs is depleted.

Once loading is complete, the tracks are released for switching. Cando crews couple onto the first car at the south end of the track and begin the reverse process of coupling, or "bunching," the cars. Once the cars are coupled and all air hoses are connected, the locomotive then charges the air brake system and lifts the track (picks up the cars). Switching the cars into blocks for various destinations is usually done using track RA28 and the subdivision track adjacent to the CRC or further north at Victoria Plains, depending on service requirements.

Crew briefing and communication

The crew members commenced their shift at 2200 on 01 March 2016 and conducted a crew briefing to plan the work for the shift. Normally, the assignment works with 2 locomotives as a multi-unit consist. In this case, 1 locomotive was undergoing repairs and there was only 1 locomotive available. This meant that the crew would be unable to lift both tracks at the same time, so an alternate plan was developed with all 3 crew members in attendance. It was decided that they would lift and switch 1 track at a time, putting cars destined for CP on the subdivision track and cars destined for CN on track RA28.

As the LE departed to prepare the locomotive for the shift, conductor 1 and conductor 2 stayed in the utility truck and discussed the work further. Upon arriving at the CRC, conductor 2 and the LE left to clear another track, while conductor 1 went to line up switches and prepare track RA26 and track RA27 for pickup. As the assignment approached track RA26 and track RA27, conductor 2 asked conductor 1 which track they were going to start with, and conductor 1 replied that they would start with track RA26.

Once the cars on track RA26 were coupled together and the air hoses connected, conductor 1 and conductor 2 had another short briefing on the ground regarding who was going to make the cuts and who was going to tend the switch. It was decided that conductor 1 would make the cuts and conductor 2 would tend the track RA28 and subdivision track switches. The LE was in the locomotive at that time and was not part of this briefing.

There was no formal briefing with respect to the change in the work plan for track RA27, just a suggestion and agreement between the conductors. Both conductors had experience working in this area and knew what was expected of each other when they went to couple the cars together and connect the air hoses on track RA27. The LE became aware of the change in work plan via the radio communication between the 2 conductors. Neither conductor 2 nor the LE enquired whether hand brakes had been applied to the cars now being left unattended on track RA28 and the subdivision track.

Canadian Rail Operating Rules

To complete rail switching and train operations safely, railways rely on the correct interpretation and application of a series of Canadian Rail Operating Rules (CROR) and company General Operating Instructions (GOI) by train crews when carrying out work tasks. There are generally no physical defences to safeguard against the incorrect application of associated rules. All the safety defences are administrative and rely solely on the operating crew correctly applying the operating rules in each situation they encounter.

Canadian Rail Operating Rules Rule 102 – Emergency Stop Protection

CROR Rule 102, Emergency Stop Protection, states

1. The crew of a movement stopping as a result of an emergency brake application, or other abnormal condition, which may cause an adjacent main track to be obstructed, must:
   1. immediately transmit a radio broadcast on the standby channel in the following manner: "EMERGENCY, EMERGENCY, EMERGENCY, (movement) on (designated track), stopped (stopping) in emergency between mile _______ and mile_______ (subdivision)";
   2. as soon as possible, advise the RTC of the movement's emergency stop location, indicating whether adjacent tracks and tracks of other railways are liable to be obstructed;
   3. repeat the emergency broadcast outlined in (i) at intervals not exceeding 90 seconds until advised by the RTC that all affected movements on other tracks have been secured, stopped or advised of the emergency stop, or it is known that adjacent tracks or tracks of other railways are safe and clear for movements;
   4. if unable to comply with (i), (ii), (iii), the adjacent track must be protected as per Rule 35(b) EMERGENCY PROTECTION.
   5. When tracks of other railways may be obstructed the emergency radio broadcast must be transmitted on their standby channel if practicable.
2. Other movements must;
   1. stop at once if closely approaching the location stated in the emergency broadcast; or
   2. stop prior to reaching the location stated in the emergency broadcast; and
   3. after stop has been made, proceed prepared to stop short of an obstruction until it is known that the track is safe and clear.
3. The RTC must:
   1. immediately secure and advise affected movements on other tracks of the location of the movement in an emergency stop;
   2. by use of a dedicated emergency communication system, alert the RTC controlling adjacent tracks of other railways liable to be obstructed, providing the location of the emergency stop; and
   3. advise the crew of the movement involved in the emergency stop when all other affected movements have been advised of the condition.
4. Rule 102 is applicable to a movement operating on a track that is adjacent to a siding where siding control territory rules (SCT) are applicable.

Canadian Rail Operating Rules Rule 112 – Leaving Unattended Equipment

CROR Rule 112, Leaving Unattended Equipment, states (in part)

In the application of this rule:

1. Equipment is considered unattended when an employee is not in close enough proximity to take effective action to stop the unintentional moving of equipment.
2. Physical securement or mechanical devices are:
   • hand brakes;
   • air brakes;
   • derails;
   • mechanical emergency devices;
   • locomotive equipped with a reset safety control (RSC) with roll-away protection where air pressure is maintained by continuous operation or auto start is provided;
   • bowled terrain; and
   • if in a yard: retarder, stop-block, wheel chocks and skates.

[…]

1. When equipment, including a locomotive without an air source, is left unattended on a main track, subdivision track, siding or high risk location, at least the minimum number of hand brakes as indicated […] must be applied and determined to be sufficient through an effectiveness test described in (e), and at least one additional physical securement or mechanical device must be used [….]
   1. the air brake system must be charged to ensure proper brake application; and
   2. the brake pipe must be fully vented at a service rate or have an emergency application and, on freight equipment, the angle cock left open.
   3. the equipment may only be left unattended for up to a maximum of two hours.

[…]

3. When equipment is left unattended in a yard, at least one physical securement or mechanical device must be utilized.
4. When equipment is left unattended on non-main track, at other than a yard, siding, subdivision track, or high risk location, a sufficient number of hand brakes must be applied and determined sufficient through an effectiveness test described in (e). Special instructions must indicate the minimum hand brake requirements for these locations where equipment is left unattended.
5. When hand brakes are used, an effectiveness test must be performed as follows: release all air brakes and,
   1. allow or cause the slack to adjust. It must be apparent when slack runs in or out, that the hand brakes are sufficient to prevent the equipment from moving; or
   2. apply sufficient tractive effort to determine that the hand brakes provide sufficient force to prevent the equipment from moving when tractive effort is terminated.

[…]

8. Before leaving equipment at any location, the employee securing such equipment must confirm with another employee the manner in which the equipment has been secured.

Canadian Rail Operating Rules Rule 125 – Emergency Communication Procedures

1. An employee will transmit the word "EMERGENCY" three times at the beginning of the transmission to indicate the report of;
   1. an accident involving injury to employees or others;
   2. a condition which may constitute a hazard to employees or others;
   3. a condition which may endanger the passage of movements; or
   4. a derailment which has occurred on, or is fouling, a main track.

[…]

3. An emergency communication has absolute priority over other transmissions.

Canadian National Railway Company General Operating Instructions

Cando follows CN's GOIs. Section 8, paragraph 12.15, Peer to Peer Communication, of CN's GOIs, in effect 15 December 2015, states (in part)

PURPOSE:

To ensure more consistent communication between employees.

[…]

14) NUMBER OF HANDBRAKES APPLIED

Conductor will job brief with other crew members, communication must include number of handbrakes applied as well as the track designation the brakes were applied.

Example of Job Briefing […]

• Crew member: "2641, good test 3 handbrakes on 23 cars in track CC17."
• Locomotive Engineer: "2641, good test 3 handbrakes on 23 cars in track CC17."

Adaptations to operating rules

Operating rules and procedures in the workplace define the envelope of safe work practices in standard and non-standard situations. Normally, the rules and procedures have a built-in safety margin. However, adaptations^{Footnote 7} to the rules and procedures can develop within rule-based work for various reasons. Over time, if there are no adverse outcomes or consequences, strict application of rules or procedures may be relaxed to get the work done. Because of the safety margin built into the rules and procedures, employees may not fully appreciate the risks involved in these adaptations.

Cando supervision

Before the incident, Cando supervision of operating employees was primarily conducted during the day shift. However, although employee observations occurred, feedback was not consistently provided to the employee. There was a heavy reliance on operating employees reading and understanding written instructions and procedures. Written instructions in the form of operating bulletins were left out for employees to read and sign once read. Direct interaction and supervision rarely occurred and was least prevalent on the night shifts and weekend shift unless a serious incident occurred.

Equipment

The locomotive involved in the incident (CCGX 4203) was serviceable and met all inspection and maintenance requirements. Air brake systems and air compressors were functioning as intended.

The rail car involved (GATX 67963) did not show any significant maintenance history that could be related to this incident. The subsequent mechanical inspection and brake test conducted by CN indicated that the hand brake and air brake systems were fully operational. Once the air brake system was fully charged, the air brakes were observed to fully apply when the car was placed in emergency. Post-incident testing revealed that the air brakes on the tank car released after the car was left standing for approximately 13 to 15 minutes. The car was given a single car air brake test on 10 March 2016 and it passed the test.

TSB statistics on occurrences defined as uncontrolled movement

A search of the TSB database indicates that, since 2006, there have been 397 occurrences defined as uncontrolled movement^{Footnote 8} among all railways in Canada (Figure 4).

Image

Uncontrolled movements generally fall into 1 of 3 causal categories:

1. Loss of control: When an LE or a Beltpack operator cannot control a train when using the available air brakes.
2. Switching without air: When a yard movement is switching with only the use of the locomotive air brakes (that is, no air brakes are available on the cars being switched). When an uncontrolled movement occurs, these situations can result in the cars exiting the yard and entering onto the main track.
3. Securement: When a car, a cut of cars, or a train is left unattended and begins to roll away uncontrolled, usually due to
   • no hand brake applied or insufficient number of hand brakes applied;
   • air bleeding off of cars left standing with an emergency air brake application and the train air brakes subsequently release;
   • a car (or cars) equipped with faulty or ineffective hand brakes.

Of the 397 occurrences, 294 (74%) were directly related to insufficient securement.

These occurrences were also categorized by the consequences. Of the 397 occurrences, there were 68 uncontrolled movements (approximately 17%) that had an impact on the main track^{Footnote 9} (Table 2).

*  Some occurrences may result in more than one consequence.

Since 1994, the TSB has investigated 19 occurrences (including this occurrence) involving runaway rolling stock, a number of which resulted in adverse consequences (Appendix A). The most significant of these resulted in the Lac-Mégantic accident.

The Lac-Mégantic accident

On 05 July 2013, at approximately 2250 Eastern Daylight Time, Montreal, Maine & Atlantic Railway (MMA) freight train MMA-002, en route from Montréal, Quebec, to Saint John, New Brunswick, was stopped at Nantes, Quebec (Mile 7.40 of the Sherbrooke Subdivision), the designated MMA crew-change point.^{Footnote 10} The train, consisting of 5 head-end locomotives, 1 VB car (i.e., special-purpose caboose), 1 box car, and 72 Class 111 tank cars carrying flammable liquids (petroleum crude oil, UN 1267, Class 3), was then secured on the main track and left unattended on a descending grade.

Shortly before 0100 on 06 July 2013, the unattended train started to move and gathered speed as it rolled uncontrolled down the descending grade toward the town of Lac-Mégantic, Quebec. After reaching a speed of 65 mph, 63 Class 111 tank cars and a box car derailed near the centre of the town. The derailed cars released approximately 5.98 million litres of product due to tank car damage. The released product ignited almost immediately, resulting in a large pool fire that burned for more than a day.

As a result of the accident, 47 people were fatally injured. Many buildings, vehicles, and the railway tracks were destroyed. About 2000 people were initially evacuated from the surrounding area.

Since 1996, the TSB has pointed out the need for robust defences to prevent runaways (TSB Railway Investigation Report R96C0172), and since then, there have been many runaways in Canada. While equipment runaways are generally considered low frequency, they can also be high-risk events and have extreme consequences, particularly if they involve dangerous goods, as demonstrated by the Lac-Mégantic occurrence. For this reason, the Board recommended that

Response from Transport Canada to TSB Recommendation R14-04 (January 2016)

Transport Canada (TC) issued a ministerial order, pursuant to paragraph 19(1)(a) of the Railway Safety Act, requiring railway companies to formulate rules to address the securement of railway equipment. Following extensive consultations with the industry, the newly revised CROR Rule 112 was approved by the Minister of Transport and came into effect on 15 October 2015. With respect to Rule 112(c),^{Footnote 11} Rail Safety inspectors were asked to note if they see any instances where industry is unclear on this section of the rule. In conjunction with the new rule, railway special instructions will contain additional details for employees regarding these requirements.

Board assessment of Transport Canada's response to TSB Recommendation R14-04 (March 2016)

In March 2016, the Board assessed TC's response to Recommendation R14-04 as follows:

Transport Canada (TC) issued a ministerial order resulting in a new Canadian Railway Operating Rules (CROR) rule relating to the securement of railway equipment, which came into effect on 15 October 2015. TC's Rail Safety Inspectors have been instructed to take note of any instances where industry is unclear on the new rules. The Railway Association of Canada (RAC) submitted a change to the Railway Locomotive Inspection and Safety Rules with regards to the reset safety control (RSC) improvement, and the change was approved by TC.

The recommendation asked TC and industry to put in place additional physical defences to prevent runaway equipment. The Board acknowledges the effort that has gone into revising CROR Rule 112. In addition, as the new rule is sufficiently complex, any instances where a railway is unclear on the new rules will need to be addressed. However, despite these actions, the number of occurrences involving runaway equipment has increased in the past year (i.e., 42 occurrences in 2015 compared to 31 occurrences in 2014 and a five-year average of 39). More needs to be done to ensure that the risk of runaway equipment is reduced and appropriately mitigated.

These physical defences should not rely on air brakes due to their lack of reliability. As air brakes are known to leak and the rate of leakage is generally unpredictable, this defence would not be a sufficient back-up to the hand brakes. Until an assessment of the effectiveness of the new rules is conducted, it will not be known if they are achieving the desired outcome.

Therefore, the Board considers the response to Recommendation R14-04 as being Satisfactory in Part.

No track defects or mechanical conditions were found as contributing to this incident. Post-incident testing revealed that both the occurrence tank car and locomotive brake systems were in serviceable condition. The analysis will focus on switching operations, supervision, Canadian Rail Operating Rules (CROR), and human factors associated with operating rules and procedures.

The incident

The crew set off non-dangerous tank car GATX 67963 (load of asphalt) on track RA28, which was considered as non-main track,^{Footnote 12} and a cut of 5 cars on the adjacent subdivision track^{Footnote 13} secured only with emergency air brakes. Conductor 1 was on the ground and did not apply any hand brakes as the cars were placed in emergency and conductor 1 intended to stay with the cars until the assignment returned with the next cut of cars.

The assignment, operated by the locomotive engineer (LE) under the control of conductor 2, returned to track RA26 with 3 cars to continue switching. The assignment proceeded toward tracks RA26 and RA27 in preparation for the placement of the next car while conductor 1 lined the switch for track RA28. About this time, conductor 2 suggested that conductor 1 assist with coupling the cars and connecting the air hoses of the cars on track RA27 before going back to track RA28 and the subdivision track. Conductor 1 agreed and walked over to track RA27 to assist, leaving car GATX 67963 and the cut of 5 cars unattended on track RA28 and the subdivision track, respectively.

It took conductor 1 about 8 minutes to assist with coupling the cars and connecting the air hoses of the cars on track RA27. Once this task was completed, the assignment pulled southward out of track RA27 and the LE noticed tank car GATX 67963 rolling uncontrolled on the subdivision track toward the assignment. The LE initiated an emergency brake application to avoid a collision as car GATX 67963 rolled past the assignment.

When equipment is left unattended on non-main track, at other than a yard, siding, subdivision track, or high-risk location, hand brakes must be applied and an effectiveness test must be conducted to determine if the hand brakes applied are sufficient to hold the cars. The incident occurred when the crew left tank car GATX 67963 (loaded with asphalt) unattended on non-main track, secured only with an emergency air brake application, with no hand brake applied, and without testing the effectiveness of the hand brake as required by CROR Rule 112(d).

The car's air brakes bled off while conductor 1 was working on track RA27 over the next 8 minutes or so. Once the car's air brakes bled off, the air brakes released and the car rolled away uncontrolled down the approximately 0.6% descending grade toward the city of Regina.

The crew did not make an emergency radio broadcast as required by CROR Rule 125. However, there were no conflicting movements in the area. The crew members subsequently attempted to catch the single car with their locomotive, but were unable to do so without violating the restrictions of their operating limits.

The car travelled about 2.7 miles (4.3 kilometres), reaching a speed of 19 mph, and came to rest in the city of Regina after it reached an ascending grade. The car traversed 7 public crossings at grade, each protected by automatic warning devices, and 1 railway interlocking that crossed the Canadian Pacific Railway (CP) Lanigan Subdivision. The crossing protection functioned as required and protected the roadway traffic.

Peer-to-peer communication

CROR Rule 112(h) requires that "[b]efore leaving equipment at any location, the employee securing such equipment must confirm with another employee the manner in which the equipment has been secured." In addition, section 8, paragraph 12.15, Peer to Peer Communication, of Canadian National Railway Company's (CN) General Operating Instructions (GOIs) states that, to ensure more consistent communication between employees, conductors will job brief with other crew members on the number of hand brakes applied, the track designation and the results of the securement test.

Since tank car GATX 67963 had emergency air brakes applied and the car was attended by conductor 1, a briefing on securement was not initially required. Although the conductors had agreed on a change in work plan between themselves, once the plan changed, a thorough job briefing, including proper securement of equipment, was not conducted and did not include all employees involved.

If there is no effective crew-to-crew communication regarding the number of hand brakes applied, the track designation, and the results of a securement test, a secondary defence is negated, increasing the risk of inadequate securement and potential uncontrolled movements.

Adaptations to operating rules

In non-signalled territory, train operations and train safety are maintained using administrative defences that rely on train crews correctly interpreting and applying all operating rules. Over time, adaptations can occur and become routine. In this occurrence, a number of adaptations occurred after the work plan changed. Specifically, the crew did not

• apply hand brakes to unattended equipment left standing,
• perform a hand brake effectiveness test on the cars left standing,
• conduct a briefing with all crew members, or
• initiate an emergency radio broadcast.

Routine adaptations to rules and operating procedures with an assumption of an equivalent level of safety (that is, not properly securing equipment and not performing required radio broadcasts) are adaptations of operating procedures. By making these adaptations, the crew can normally complete the routine task in less time and with less effort. This choice reflects the natural tendency to accept low-probability risks with potentially severe outcomes. If adaptations are made to operating rules and procedures, the safety margins built into the rules are often reduced, which increases the risk of unsafe operations and accidents.

Cando supervision

At Cando, there was a heavy reliance on operating employees correctly reading and understanding written instructions and procedures. Written instructions in the form of operating bulletins were left out for employees to read and sign once read. The onus was on employees to seek clarification if they did not understand the instructions.

Active supervision is a defence against adaptations becoming routine work practices. However, direct interaction and supervision was inconsistent and was least prevalent on the night shifts and weekend shift unless a serious incident occurred. Rarely was positive or constructive feedback provided following observations, thus negating a learning opportunity. If company supervision is not consistent and does not engage all employees directly, unsafe work practices and adaptations may not be detected and the risk of a serious accident or incident occurring is increased.

TSB statistics on occurrences defined as uncontrolled movement

Between 2006 and 2015 inclusively, 74% (294 out of 397) of all uncontrolled movements in Canada were directly related to securement issues. Approximately 17% (68 out of 397) of the occurrences had an impact on the main track. Since 1994, the TSB has investigated 19 occurrences (including this occurrence) involving runaway rolling stock, a number of which resulted in significant adverse consequences, including fatalities.

The primary defence against uncontrolled movements continues to be an administrative requirement to apply hand brakes on rolling stock to secure equipment. Following the Lac-Mégantic accident, the TSB recommended that Transport Canada require that Canadian railways put in place additional physical defences to prevent runaway equipment. In response, the railways proposed changes to CROR Rule 112. Following extensive consultations with the industry, the revised CROR Rule 112 was approved by the Minister of Transport and came into effect on 15 October 2015. In conjunction with the new rule, railway special instructions should contain additional details for employees regarding these requirements.

While significant effort has gone into revising CROR Rule 112, the number of occurrences involving uncontrolled movements has increased from 31 in 2014 to 42 in 2015, with a 5-year average of 39. This suggests that more still needs to be done to ensure that the risk of such occurrences is reduced and appropriately mitigated.

The revised CROR Rule 112 defines physical securement or mechanical devices as

• hand brakes;
• air brakes;
• derails;
• mechanical emergency devices;
• locomotive equipped with a reset safety control (RSC) with roll-away protection where air pressure is maintained by continuous operation or auto start is provided;
• bowled terrain; and
• if in a yard: retarder, stop-block, wheel chocks and skates.

CROR Rule 112(c) further states that, when equipment is left unattended in a yard, at least 1 physical securement or mechanical device must be utilized.

Although railways have special instructions requiring the use of hand brakes in yards, as written, the revised CROR Rule 112 appears to permit the use of air brakes alone to secure rolling stock in yards. Freight car air brakes are known to leak, and the rate of leakage is generally unpredictable. In this occurrence, the car's air brakes bled off and released, leaving the car unsecured; it then rolled away uncontrolled. This demonstrates that the use of air brakes alone is not an acceptable method of securement to back up or replace the use of hand brakes or other physical or mechanical devices. If rules or instructions permit the use of air brakes alone to secure rolling stock left standing in a yard, there is an increased risk of rolling stock running away uncontrolled.

Findings as to causes and contributing factors

1. The incident occurred when the crew left tank car GATX 67963 (loaded with asphalt) unattended, secured only with an emergency air brake application, with no hand brake applied, and without testing the effectiveness of the hand brake as required by Canadian Rail Operating Rules (CROR) Rule 112(d).
2. The car's air brakes bled off while conductor 1 was working on track RA27 over the next 8 minutes or so.
3. Once the car's air brakes bled off, the air brakes released and the car rolled away uncontrolled down the approximately 0.6% descending grade toward the city of Regina, Saskatchewan.
4. Although the conductors had agreed on a change in work plan between themselves, once the plan changed, a thorough job briefing, including proper securement of equipment, was not conducted and did not include all employees involved.

Findings as to risk

1. If there is no effective crew-to-crew communication regarding the number of hand brakes applied, the track designation, and the results of a securement test, a secondary defence is negated, increasing the risk of inadequate securement and potential uncontrolled movements.
2. If adaptations are made to operating rules and procedures, the safety margins built into the rules are often reduced, which increases the risk of unsafe operations and accidents.
3. If company supervision is not consistent and does not engage all employees directly, unsafe work practices and adaptations may not be detected and the risk of a serious accident or incident occurring is increased.
4. If rules or instructions permit the use of air brakes alone to secure rolling stock left standing in a yard, there is an increased risk of rolling stock running away uncontrolled.

Other findings

1. The crew did not make an emergency radio broadcast as required by Canadian Rail Operating Rules (CROR) Rule 125. However, there were no conflicting movements in the area.
2. The crew members subsequently attempted to catch the runaway car with their locomotive, but were unable to do so without violating the restrictions of their operating limits.
3. The runaway car travelled about 2.7 miles (4.3 kilometres), reaching a speed of 19 mph, and came to rest in the city of Regina, Saskatchewan, after it reached an ascending grade.
4. The car traversed 7 public crossings at grade, each protected by automatic warning devices, and 1 railway interlocking that crossed the Canadian Pacific Railway Lanigan Subdivision.
5. The crossing protection functioned as required and protected the roadway traffic.

Safety action taken

Transport Canada

On 24 March 2016, Transport Canada (TC) issued 2 administrative monetary penalties to Cando Rail Services (Cando) for violating the Railway Safety Act and the Canadian Rail Operating Rules (CROR).

TC also conducted follow-up inspections of Cando's operations in Regina, Saskatchewan, in April, July, and September 2016, with no non-compliances observed.

Cando Rail Services

Following the occurrence, Cando initiated the following safety action:

• A review was conducted with all operating employees with respect to the requirements of CROR Rule 112, Leaving Equipment Unattended.
• An incident review document was developed and reviewed with all employees, indicating the specifics of the incident. The review stressed the remedial actions implemented and the need for adherence to these actions and all other applicable rules and regulations.
• A review of the efficiency testing procedures was conducted. Following the review, the procedures were revised to ensure consistency with respect to the CROR and to all work procedures. The revised procedures will also help ensure consistent quality of the testing process with enhanced reporting requirements.
• A system-wide bulletin was issued to enhance the administrative requirements of CROR Rule 112. Specifically, a special instruction was added that requires all equipment to have the minimum number of hand brakes applied, "even if attended by an employee."
• Emergency response procedures were reviewed system-wide to ensure that the requirements of emergency response services, customers, regulatory bodies, and municipalities were met.
• In June 2016, a safety culture assessment study was initiated involving the Railway Association of Canada and St. Mary's University. This study included questionnaires to all employees with respect to the company's safety culture. Upon completion of the study, it is planned to implement proactive measures to strengthen the safety culture.

This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 04 January 2017. It was officially released on 21 March 2017.

Appendix A – TSB investigations involving uncontrolled movements