Rail transportation safety investigation report R20H0130

• Table of contents

  1. Factual information
  2. Analysis
  3. Findings
  4. Safety action
  5. Appendices

Summary

On 28 November 2020, at approximately 1125 Eastern Standard Time, Canadian National Railway Company freight train G87441-25 was proceeding eastward at about 32 mph on the Caramat Subdivision when it collided with a stationary hi-rail vehicle at the Jackfish turnout switch at Mile 3.2. The signal maintainer, who was performing testing on the switch, was not in the vehicle. The train did not derail and no one was injured. The hi-rail vehicle was destroyed, while the lead locomotive sustained minor damage.

1.0 Factual information

On 28 November 2020 at about 0215, ^{Footnote 1} eastbound Canadian National Railway Company (CN) freight train G87441-25 (the train) departed on the Caramat Subdivision ^{Footnote 2} from Armstrong, ^{Footnote 3} Ontario, located at Mile 243.8, and proceeded en route to Hornepayne, located at Mile 0.0 (Figure 1).

The train comprised 2 head-end locomotives and 1 tail-end distributed power remote locomotive hauling 96 loaded cars. It weighed 13 717 tons and was 5878 feet long. The train crew consisted of a locomotive engineer and a conductor, both of whom were qualified for their positions, met fitness and rest requirements, and were familiar with the territory.

1.1 The accident

At about 1040, the train was waiting in the Leigh siding (Mile 25.2) for a meet with a westbound train. In preparation for the train’s movement to Hornepayne, the rail traffic controller (RTC) lined the route for the train from the siding, onto the main track, through the turnout switch at Jackfish (Mile 3.2), and onto the south main track to the station at Hornepayne.

Shortly thereafter, the RTC was contacted by a CN signal maintainer (SM1), who was requesting a track occupancy permit (TOP)^{Footnote 4} to perform testing at the turnout switch at Jackfish. SM1 requested a TOP for track between Signal 19N (Mile 1.9) and Signal 32 (Mile 3.2). The RTC did not clearly hear the limits that were requested and asked if SM1 wanted to work on the north track, to which SM1 replied that he did. These limits would have permitted SM1 to operate the company hi-rail vehicle, otherwise known as a track unit,^{Footnote 5} on the north track and the main track up to Signal 32 in order to perform the required testing (Figure 2).

Since the RTC had just lined the route of the train through the turnout switch at Jackfish and onto the south track, the RTC provided SM1 with the limits that were available on the north track, from Signal 19N to Signal 31N (Mile 3.1). SM1 wrote down the limits of Signal 19N to Signal 31N on his TOP form and repeated the limits back to the RTC. The RTC then provided his initials and the complete time, which activated the TOP.

At 1054:40, with the TOP in hand, SM1 departed Hornepayne Station and then accessed the north track in a hi-rail vehicle and proceeded westward.

At about 1102, he arrived at Jackfish on the north main track and parked the hi-rail vehicle on the main track turnout switch, between Signal 31N and Signal 32, adjacent to the signal bungalow and foul of the train’s route. He exited the vehicle and began testing. The vehicle’s headlights, fog lights, and strobe lights were on, in accordance with CN requirements,^{Footnote 6} and its engine was running.

At about 1125, the train approached Hornepayne at 32 mph on a Limited to Clear signal,^{Footnote 7} which indicated that it could proceed through the No. 20 turnout^{Footnote 8} (switch) at Jackfish onto the south main track en route to the station. The train crew noticed a hi-rail vehicle on the track near the switch, but did not realize it was foul of their route. The locomotive engineer sounded the horn and continued.

At about the same time, SM1 observed the approaching train and sought cover behind the signal bungalow. When it became apparent to the train crew that the hi-rail vehicle was foul of the train’s route (Figure 3), the locomotive engineer initiated a train emergency air brake application, but could not stop the train and struck the hi-rail vehicle.

The hi-rail vehicle was destroyed and came to rest at the base of the north embankment (Figure 4). The locomotive sustained minor damage but the train did not derail. There were no injuries.

Following the accident, the train crew notified the RTC of the collision. During a subsequent radio conversation, SM1 insisted that his authority extended to Signal 32, as he had requested. The TOP form completed by SM1 was collected from the hi-rail vehicle; it contained the authorized limits to Signal 31N, and all the information received from the RTC.

At the time of the accident, the temperature was 0 °C, with 12 km/h winds from the west. The skies were clear and visibility was good.

1.2 Subdivision information

The Caramat Subdivision extends westward from Hornepayne (Mile 0.0) to Armstrong (Mile 243.8). The subdivision consists of a double main track from Hornepayne to Jackfish, where it transitions to a single main track. Train movements on the Caramat Subdivision are governed by the centralized traffic control (CTC) method of train control, as authorized by Transport Canada’s (TC) Canadian Rail Operating Rules (CROR), and are dispatched by an RTC located in Edmonton, Alberta.

In the vicinity of the occurrence, the maximum permissible train speed between Hornepayne Station and Mile 1.9 is 25 mph. From Mile 1.9 to Mile 12.3, the maximum permitted speed for freight trains is 55 mph.

1.3 Recorded information

The hi-rail vehicle was equipped with a global positioning system (GPS) that monitored the vehicle’s movements. A download from this system provided information regarding the vehicle’s operation (Table 1).

1.4 Rail traffic controller

The RTC was qualified on 18 June 2020 after completing a 5-month initial training program that consisted of a combination of classroom instruction and on-the-job training. The curriculum included training on the CROR as well as CN instructions and procedures.

In addition to initial training, RTCs must qualify for each territory individually before they can carry out dispatching duties on these subdivisions. At the time of the accident, the RTC was qualified on 6 desks and worked the spare board, filling vacancies on those desks when needed. Prior to the accident, the RTC had previously dispatched on the Caramat Subdivision 5 times.

On the day of the occurrence, in addition to traffic on the Caramat Subdivision, the RTC was dispatching traffic on the Allanwater Subdivision. The traffic on both subdivisions was relatively light.

1.5 Signal maintainer 1

SM1 was hired by CN in June 2017 and commenced with initial orientation and rules training. In February 2018, he began CN’s 4-level Canada Signal Apprentice training program. The program included in-class theory and lab work as well as hands-on skill development in the field. Each level of the apprenticeship program concluded with tests that had to be passed in order to progress to the next level.

During the field work portions of the apprentice program, SM1 worked between Toronto and Hamilton on a joint CN/Metrolinx project installing signals. He continued to work on this project until he started his new position in Hornepayne. During this time, SM1 worked under the supervision of a foreman and alongside qualified signal maintainers, who monitored his progress. During his time as an apprentice, SM1 rarely had the opportunity to request a TOP. SM1 successfully completed the apprenticeship program in September 2019.

In the railway industry, a signal maintainer is a unionized position and, as such, signal maintainer appointments are made on the basis of seniority, without consideration for professional experience. Signal maintainer apprentices are subject to promotion to signal maintainer only when a position becomes available. Until promoted, they conduct signal-related duties, including bonding rail, testing signal plants, and wiring equipment.

The signal maintainer position in Hornepayne is responsible for 26 miles of track that extend from about Mile 295.4 on the Ruel Subdivision to about Mile 24 on the Caramat Subdivision. The territory, which passes through Hornepayne Station, consists of 2 crossings equipped with automatic warning devices, 2 sidings (Tondern and Lennon), and 2 controlled locations. At Jackfish, the single main track diverts to double track approaching Hornepayne Station.

In October 2020, SM1 was awarded the position of signal maintainer in Hornepayne, following a bidding process. Up until that time, SM1’s work experience did not include participating in the planning or organizing of daily tasks, nor did it include being directly responsible for requesting TOPs.

In November 2020, SM1 completed the engineering rules recertification program, including sections on the CROR and the protection of track units and track work.

Before assuming the position later in November, SM1 was given 9 days of familiarization training with the signal maintainer who was leaving the position in Hornepayne (SM2). Following the familiarization training, SM1 commenced working alone as the signal maintainer in Hornepayne.

The day of the accident (28 November 2020) was SM1’s first shift working alone on this subdivision. In the week before the accident, SM1 had worked regular daytime hours starting at 0700 and ending at 1600.

1.5.1 Signal maintainer 1 proficiency testing

Before accepting the position in Hornepayne, SM1 was subjected to proficiency testing on 20 occasions in 2020; he received 18 compliant observations and 2 non-compliant observations. The 2 observations of non-compliance were regarding Section 8 (Safe Work Procedures) of the General Operating Instructions: namely the provisions regarding personal protective equipment and preventing injuries related to slips, trips, and falls.

Of the compliant observations, 4 were regarding job briefings and 7 related to track unit or track work protection.

1.6 Canadian National Railway Company Policy to Prevent Workplace Alcohol and Drug Problems

To prevent workplace alcohol and drug problems, CN has a variety of programs and initiatives pertaining to alcohol and drug use by employees, particularly those in safety-critical positions. The CN Policy to Prevent Workplace Alcohol and Drug Problems consolidates the various programs; it defines to whom the policy applies as well as the standards expected and consequences of any violation.

This policy supplements, but does not modify or reduce the requirements of, the CROR General Safety Rule 1.1, Rule G.^{Footnote 9}

CN’s Policy to Prevent Workplace Alcohol and Drug Problems states the following:

[…]

All employees are required to report and remain fit for duty, free of the negative effects of alcohol, cannabis and other drugs. It is strictly prohibited to be on duty or to be in control of a CN vehicle or equipment while under the influence of alcohol or other drugs, including the after-effects of such use.^{Footnote 10}

[…]

Possession, distribution, or sale of alcoholic beverages or cannabis and the consumption of any form of alcohol or cannabis is prohibited while on duty (including during breaks), on or off company premises, in company vehicles and equipment, or while on company business.^{Footnote 11}

[…]

The policy notes that CN also encourages

[…]

employees who feel they may have a problem to seek help right away and get assistance with any alcohol or drug problem through our Employee and Family Assistance Program (EFAP) which is there to support employees and help them address their issues. This confidential program is designed to help before drug or alcohol use becomes a workplace or personal problem.^{Footnote 12}

[…]

Following an accident, incident, or when there is cause to suspect impairment, the employees involved are required to take a drug test. They first receive a point-of-contact test, which consists of a breathalyzer test and a urine test.

The breathalyzer test is used to detect the presence of alcohol. The policy specifies that any employee whose breath alcohol concentration is over 0.04 is in violation of the policy.

The urine test is used to identify the presence of cannabis or other illicit drugs. When a urine test result is non-negative (traces found in sample), an oral swab (saliva) test is then performed. The swab test is used to determine impairment while on duty. When a swab test result is negative and a urine test result is non-negative, the result of the non-negative urine sample is forwarded to CN’s occupational health team for review. Such a review could result in education, counselling, or treatment to promote health and prevent substance use and impairment while on duty.

The policy states that any employee who fails a breathalyzer test, or whose oral fluids test positive for legal or illegal drugs (without medical justification), or who demonstrates impairment, will be considered to be in violation of the policy.^{Footnote 13} Any policy violation by an employee will result in corrective action up to and including dismissal.

However, due to the remote nature of some railway operations, it may take several hours, sometimes more than 4 hours, to administer a urine test and an oral swab test, which has a time limit to detect recency of use.

1.7 Drug policies and testing in North America

1.7.1 Transport Canada Civil Aviation General Operating and Flight Rules – Cannabis Legalization Policy

On 17 October 2018, it became legal in Canada for adults to possess small amounts of cannabis.^{Footnote 14} TC subsequently undertook an extensive policy review and consultation to determine the most effective means of ensuring aviation safety with regard to impairment overall, including cannabis. Effective 23 July 2019, TC implemented a policy prohibiting flight crews and air traffic controllers from consuming cannabis for at least 28 days before being on duty.^{Footnote 15}

TC’s website announcing the policy states that, even though cannabis is legal for medical and recreational use, it can still be a safety hazard in aviation. The 28-day policy is intended to protect aviation and public safety by providing an additional layer of safety to the existing approach to substance use.^{Footnote 16}

The Canadian Aviation Regulations require fitness for duty and state that no person shall act as a crew member of an aircraft, air traffic controller, or flight service specialist while using or under the influence of any drug that impairs the person’s faculties to the extent that aviation safety is affected. TC’s website announcing the policy states that the change is aligned with the best available science and is consistent with the approach of other government departments and agencies, such as the Department of National Defence and the Royal Canadian Mounted Police, to the legalization of cannabis. The policy does not prevent Canada’s air operators from implementing more stringent prohibitions for their employees.^{Footnote 17}

TC Rail Safety has no similar policy for railway operating employees. Furthermore, TC currently has no requirement for mandatory random drug and alcohol testing for safety-critical positions in any of the transportation modes (air, marine, or rail) that it regulates.

1.7.2 Random drug testing in the United States and Canada

The United States (U.S.) Department of Transportation has made it mandatory in federally regulated modes of transport for operators to conduct drug and alcohol tests at a specified rate. The Federal Railroad Administration regulations on the control of alcohol and drug use are intended to prevent accidents and casualties in railroad operations that result from impairment of employees by alcohol or drugs. As part of these regulations, the purpose of mandatory random alcohol and drug testing is to promote safety by deterring regulated employees from misusing drugs and alcohol. From 2016 to 2020, random drug testing violation rates have remained below 1%.^{Footnote 18},^{Footnote 19},^{Footnote 20} Random drug testing is intended to reduce the risk of impairment at work.

In Canada, testing for alcohol and drug use in federally regulated workplaces is currently guided by a body of decisions from labour arbitrators, human rights tribunals and courts. The jurisprudence from these decisions balances preserving individuals’ human and privacy rights with ensuring safety for employees and the public. While decisions are case-by-case, under existing jurisprudence, an employer testing employees for drug and/or alcohol use in “safety-sensitive” positions is generally permissible in specific situations where the employer is able to show that there is a demonstrated alcohol or drug use problem among employees in the workplace and testing is a proportionate response, and when the employer still meets its duty to accommodate employees who test positive.^{Footnote 21}

1.8 Drug testing

The TSB consulted a toxicologist with expertise in drug testing. The toxicologist provided the following information:

• Both the urine and the saliva tests can indicate whether cannabis has been consumed. However, neither test actually measures impairment levels.
• Traces of cannabis can be found in urine 28 to 30 days after consumption.
• A non-negative saliva test indicates that cannabis was consumed within the past 4 to 6 hours.
• Impairment from cannabis depends on various factors, such as how recently and how often it is used, how much is consumed, and the mode of consumption.

Recency of use is one of the strongest factors that correlates with impairment. A temporal association can be made between a non-negative drug screening test result for tetrahydrocannabinol (THC) and impairment. The impairment period will begin almost immediately after the drug has been used and generally resolve within 4 to 6 hours following last use. However, the impairment period may begin later and last longer for frequent high-dose users, and for those who ingest cannabis, the impairment period can be longer.^{Footnote 22}

Short-term effects include impaired ability to remember, pay attention, and react quickly. There is evidence that daily or near-daily use of cannabis can harm cognitive abilities beyond 4 hours after consumption. For example, Health Canada notes that long-term effects from daily to near-daily cannabis use can over time harm memory, concentration, intelligence, and the ability to think and make decisions.^{Footnote 23}

1.8.1 Signal maintainer 1

About 4 hours after the occurrence, SM1 submitted to a urine test, which indicated THC metabolite at a level of 82 ng/mL. A saliva test taken 15 minutes later showed a negative result. The toxicologist consulted by the TSB indicated that these test results cannot be used to conclude that SM1 was impaired at the time of the occurrence.

1.9 Radio communications

RTCs transmit vital information to train crews and workers, and any misunderstandings or misinterpretations of the information can have negative safety implications. As such, TC and railways have many rules to ensure that all radio communications are transmitted and received accurately. The rules relevant to this occurrence are listed in Appendix A.

SM1 requested the TOP by calling the RTC over the radio. During the communication, SM1 and the RTC were brief and to the point, using the radio terms “over” and “out” when required. SM1 stated his name, movement designation, location, required limits, track, and time. This prompted the RTC to ask for clarification about the requested limits. The RTC did not ask SM1 to repeat the limits requested, but asked if he wanted to work on the north track. When SM1 confirmed that he did want to work on the north track, the RTC understood that the requested limits were for the north track only, from Signal 19N to Signal 31N, and provided a TOP for these limits, repeating each digit separately. SM1 then wrote the TOP limits on the form and repeated them back to the RTC, stating each digit separately and correctly.

When issuing TOPs by voice communication, if an error is detected in the recording, and before it has been completed to any employee, the RTC must direct that all copies of the TOP be immediately destroyed. The record must be marked void, and if the TOPs are re-issued, those that require numbering must be given a new number.

1.9.1 Characteristics of effective communication

Communication can be defined as “the verbal interchange of a thought or idea.”^{Footnote 24} Communication serves 2 purposes: 1) developing and sending messages, and 2) creating a shared meaning. ^{Footnote 25} To achieve a shared meaning, or a shared understanding, communication needs to be effective. The theory of the 7 Cs for an effective communication describes the fundamental characteristics of an effective message as follows: ^{Footnote 26}

• Completeness: The message should contain all relevant information. When the information is complex, additional explanations should be provided.
• Conciseness: The message should be short, simple, and consistent. Repetitions should be avoided.
• Consideration: The message should be adjusted for the recipient’s knowledge, background, and abilities.
• Clarity: The message should include clear and plain language, avoiding complex words, jargon, and regionalisms.
• Concreteness: The message should be precise and in a format that can be understood univocally (i.e., having only one possible meaning). The words and syntax should be clear and not leave room for interpretation.
• Courtesy: The message should use respectful, non-discriminatory language.
• Correctness: The message should use proper grammar and wording.

1.10 Centralized traffic control system

The CTC system controls train traffic using signal indications.

At the rail traffic control centre, software and computer displays enable RTCs to monitor their territory on computer screens from their consoles. The CTC screen displays the entire subdivision, including sidings, signals, train limits, and TOP limits.

The presence of a train in a block or at a controlled location^{Footnote 27} activates an indication on the computer screen, showing the location of the train as it passes these locations. If a train passes a controlled location that is outside its limits of authority, an audible and visual warning is activated on the CTC screen. However, most track units, such as the hi-rail vehicle in this occurrence, do not activate the signal system and, therefore, the location of a track unit is not available for display on the RTC’s console. Based only on the RTC screen, there is no way to know if a track unit is operating outside its limits of authority (see section 1.17.3).

1.11 Track occupancy permits

A TOP is an “[a]uthority issued for the protection of track units and track work”^{Footnote 28} in order to occupy the main track or a signalled siding to perform work. In CTC territory, TOPs are protected by signal indications. An employee in possession of a TOP in CTC territory must therefore clear the track and cancel the TOP before trains can be given authority to proceed.

A train crew’s tabular general bulletin orders^{Footnote 29} do not contain information regarding TOPs. Similarly, maintenance-of-way (MOW) employees will not typically be aware of the frequency and location of trains unless this is communicated by the RTC or viewed on suitably equipped laptops when cellular coverage is available.

The TOP process is designed to limit the likelihood that hi-rail vehicles and MOW employees will proceed outside a protected area. The success of the TOP system depends not only on employees knowing the TOP process more generally but also, for each TOP, rigorously following all applicable rules and regulations.

1.11.1 Enforcement of limits of authority

Conflicts between trains and track units are a high-risk yet low probability event. To minimize and prevent these conflicts in CTC territory, a number of rules have been established in the CROR to enforce limits of authority, including:

• Rule 34 (Fixed Signal Recognition and Compliance)
• Rule 42 (Planned Protection)
• Rule 44 (Unusual Track Signal Conditions)
• Rule 80 (Main Track Authorization)
• Rule 119 (Continuous Monitoring)
• Rule 131 (Recording)
• Rule 136 (Copying, Repeating, Completing and Cancelling)
• Rule 567.1 (Protect Against a Foreman)
• Rule 567.2 (Optional: Entering Foreman’s Limits)
• Rule 803 (Track Unit and Track Work Authorization)
• Rule 816 (Foreman Requirements – Identifying Arrival and/or Departure of Movements)
• Rule 842 (Planned Protection – Rule 42)
• Rule 854 (One Track Unit – Foreman Requirements)
• Rule 856 (Communication Between Employees and Foremen)

1.11.2 Electronic track occupancy permits

In May 2012, in response to occurrences where track units were operated outside their limits of authority, CN implemented a system for electronic track occupancy permits (ETOPs). The system is used by RTCs and rules-qualified MOW employees. To enable work in the field, track foremen and signal maintainers are provided with a company laptop equipped with CN’s ETOP program and a display of the CTC screen.

When track occupancy is required, the request can be initiated on the screen by blocking the applicable section of track. If the RTC approves the ETOP, the RTC acknowledges the authority, and the section of track covered in the TOP is indicated on the CTC screen. The CTC screen also displays other TOPs as well as trains and their intended paths.

Within the track unit, the CTC screen is displayed in near real-time, as the system will refresh the screen every 7 seconds. The information is stored on the laptop for 72 hours before being uploaded to a central database.

However, there are some limitations to the ETOP program. For example, because it requires cellular coverage, the system is not suitable for some remote areas on the rail network, such as northern Ontario. In addition, the system does not monitor or intervene if incorrect information is entered, such as the wrong track (multi-track territory) or a mileage outside the limits of the TOP. ETOPs were not designed to provide warnings to MOW workers as they approach the end of their TOP limits.

Since ETOPs do not require direct communication with the RTC and can allow employees to view the RTC screen, they are the preferred method for track authority and, thus, employees will normally use the ETOP program when within cellular coverage. While most of the Caramat Subdivision does not have cellular coverage, cellular service is available in Hornepayne.

At the time of the occurrence, SM1 had received a laptop from CN; however, it was not a model that could operate the ETOP program, nor was it equipped with the program that allows for the monitoring of the CTC screen. A new laptop had been requested by the local supervisor for SM1 and was expected to arrive in the coming weeks.

1.12 Canadian National Railway Company General Engineering Instructions

CN MOW employees engaged in inspection, maintenance, or the construction of track and its structures are governed by CN’s General Engineering Instructions (GEI).

1.12.1 Track unit operation

Section 11 of the GEI pertains to track unit operations. Prior to operating a hi-rail vehicle, MOW employees must ensure the vehicle is safe to operate. The GEI require that the following hi-rail vehicle tests be performed and the information recorded prior to the vehicle’s use:

[…]

11.2 Initial brake test – Immediately after setting the unit in motion the brakes must be tested to ensure they are operating properly. […]

11.3 Distance to stop test – The operator must conduct a “distance to stop” test when the track unit reaches the operating speed. […]

11.4 Immediately after performing a “distance to stop test” and while still stopped, the following information must be recorded:

• Time the test was performed,
• Location where the test was performed,
• Operating speed at the start of the test,
• Braking distance.

The recorded information must be retained and available for inspection for the duration of the shift.^{Footnote 30}

A review of the downloaded information from the hi-rail vehicle’s GPS indicates that neither the initial brake test nor the distance-to-stop test was performed, nor were there any records of a distance-to-stop test.

1.12.2 Verification of track occupancy permit limits

CN’s GEI require that MOW employees regularly verify their limits of authority. Section 10.10 states, in part:

b) […]

Prior to passing a controlled signal or identifiable location, the occupants of the track unit must:

• Review the permit or authority to verify the controlled signal (signalled territory) or identifiable location (non-signalled territory) being approached is included in the current protection, and
• Record the time and the signal number/name (signalled territory) or identifiable location (non-signalled territory) being passed when the permit/authority is verified.
• For the purpose of this instruction identifiable locations are station name signs, siding switches, and/or mileage posts) […] ^{Footnote 31}

To comply with the instructions, a lone operator, as in this occurrence, must bring the track unit to a complete stop, before recording the information, and then put the track unit back into motion.

The GPS information downloaded shows that the hi-rail vehicle did not stop at either Signal 19N or Signal 31N, and there were no records in the vehicle to indicate the time and signal numbers that were passed.

1.12.3 Radio broadcasting and continuous radio monitoring

Radio broadcasting and continuous radio monitoring rules and instructions help ensure that train crews and MOW employees can be made aware of each other’s presence.

With respect to radio broadcasting, section 10.10 of CN’s GEI states, in part:

e) The operator of the track unit or another designated occupant in the track unit must make the following broadcast upon departing each signal or identifiable location. The radio broadcast must include the;

• Identity of the track unit or the identity of the operator, and
• Present location and direction of travel. ^{Footnote 32}

In this occurrence, before passing signals 19N and 31N, SM1 indicated that he had made a radio broadcast on the train standby channel with the details of his TOP. This was not heard by the crew of train G87441-25, which was about 14 miles away.

To assist in the monitoring of the radio, hi-rail vehicles are equipped with an external speaker that can be used by MOW employees when working outside the cab of the hi-rail.

1.12.3.1 Rule 119 of the Canadian Rail Operating Rules

In addition to the CN GEI, CROR Rule 119 requires that track unit operators continuously monitor the appropriate radio standby channel:

119. CONTINUOUS MONITORING

(a) When not being used to transmit or receive a communication, receivers must be set to the appropriate standby channel and at a volume which will ensure continuous monitoring. When required to use another channel to perform other duties, at least one radio, when practicable, should be set to the designated standby channel to receive emergency communications.

(b) The volume of a radio receiver should be kept at a level that will avoid annoyance to the public in passenger cars and station facilities.

(c) Foremen named in Form Y GBO [general bulletin order], TOP or clearance must set their radio to “scan mode” when [it is] not being used to communicate with another employee and must otherwise have their radio set to monitor the applicable designated standby channel.^{Footnote 33}

In this occurrence, it could not be confirmed if SM1’s radio was set to scan the standby channel. Although the approaching train crew broadcasted the train’s approach to Jackfish when it was about 1 mile from the switch, SM1 was not aware of the train’s imminent arrival.

1.12.4 Traversing a highway/roadway grade crossing with a track unit

Section 14.0 of the CN GEI sets forth the requirements for a track unit to safely traverse a highway/roadway grade crossing:

[…]

14.2 Any track unit or hi-rail must be operated with caution when approaching highway/roadway grade crossings. This includes giving roadway traffic preference and:

1. Approaching grade crossing under complete control, being prepared to stop if necessary.
2. A track unit must not obstruct a highway/roadway grade crossing until the way is seen to be clear by the operator of the track unit.
3. A track unit must be brought to a full stop before proceeding over a highway/roadway grade crossing when the view of the approach is obstructed or when traffic is heavy.
4. If required due to traffic volumes, sightlines, or other special conditions, the operator of the track unit must only proceed over the highway/roadway grade crossing after stopping under the protection of a flag-person, except a track unit being operated by one person alone may after stopping, proceed with extreme caution.^{Footnote 34} […]

1.13 Job readiness

Job readiness refers to possessing the skills, knowledge, and abilities required to perform a job or a task.^{Footnote 35} Training received in school can provide excellent knowledge, but does not necessarily provide the exposure and practice required for full job readiness.^{Footnote 36} Job readiness is often acquired through on-the-job training and practical experience.

1.13.1 Best practices in developing competence

The Rail Safety and Standards Board in the United Kingdom published a guidance document entitled Good Practice Guide on Competence Development. The guide, developed in consultation with the railway industry, was intended to provide best practices with respect to developing comprehensive systems to manage competence rather than simply ensuring compliance with regulations.^{Footnote 37}

Competence refers to the overall ability to function effectively in a position and results from a combination of functional, technical, and non-technical skills. According to the guide, non-technical skills include the ability to maintain situational awareness, make decisions, and manage workload, all of which have been shown to play a key role in incidents and accidents.^{Footnote 38}

When learning a role, competence will develop along a continuum from novice, to not yet competent, to proficient and expert.^{Footnote 39} In moving along this continuum, learners proceed through a series of predictable stages. When a minimal level of competence is attained, learners can be described as being “consciously competent” or at a stage where tasks may be performed effectively but require a significant level of attentional resources. As learners become proficient or expert, tasks become more automatic and require fewer attentional resources.^{Footnote 40}

1.14 Signal maintainer job readiness

1.14.1 Apprenticeship

Signal maintainers are responsible for the installation, repair, maintenance, testing, and inspection of railway signalling systems and highway grade-crossing protections.

At CN, signal maintainer candidates must participate in a 1-year apprenticeship training program. This program is divided into 4 levels and comprises in-class theory and lab work as well as hands-on skill development in the field alongside qualified signal maintainers. The in-class portion of the training program consists of 2 sessions that are approximately 3 weeks long, and applicants are required to pass a series of periodic tests related to duties, responsibilities, and operating rules.

1.14.2 Job familiarization

When qualified employees change jobs, either due to a promotion or transfer to a new location, CN requires them to undergo job familiarization.

Unlike on-the-job training, where new staff are paired with experienced employees for training, coaching, and mentoring, job familiarization does not include a training portion. This is because the incoming employee is considered already qualified, so it is expected that only location-specific information will need to be shared with them. Also, unlike on-the-job training, there is no evaluation of the employee’s performance.

There are no preset criteria as to how long familiarization should take; it is mostly determined by the experience of the new worker and the availability of the departing employee.

In Hornepayne, the local supervisor usually tried to ensure that an employee received 1 to 2 weeks of familiarization when starting a new position.

Since SM1 was relatively inexperienced, and the departing SM2 was not scheduled to begin his new position for 2 weeks, the local supervisor arranged for a 9-day job familiarization period. The familiarization consisted of unstructured ride-along trips during which SM1 shadowed SM2 while SM2 conducted his daily work. This enabled SM1 to familiarize himself with the territory, key locations, and specifics of the tasks.

During this familiarization period, SM2 obtained most of his TOPs from his company-provided laptop using the ETOP program, while SM1 was tasked with observing SM2 perform his regular duties and operate the hi-rail vehicle. SM1 rarely performed the task of requesting and completing either TOPs or ETOPs.

Before beginning to work on his own, SM1 was not evaluated to determine if he was ready, nor was he required to be. SM1 and the local supervisor did talk twice over the phone, and SM1 did not indicate any challenges. The local supervisor also met with SM1 once in person where they discussed his laptop issues, as his current laptop could not operate the ETOP program. The local supervisor requested a new ETOP program-equipped company laptop for SM1. However, it would not be available for several weeks.

1.15 Decision making and situational awareness

To facilitate effective decision making, individuals need to have an accurate understanding of their goals, decisions, and information requirements. In addition, effective decision making depends on the accuracy of one’s situational awareness (i.e., perception of elements in the environment, comprehension of what these elements mean, and projection of what their status will be in the future).^{Footnote 41} Accurate situational awareness enables informed, accurate predictions of the potential consequences of one’s decisions. When people receive the information they expect to receive, they tend to react quickly and with no errors. However, when they receive information that is contrary to their expectations, their performance tends to be slow or inappropriate.^{Footnote 42}

In this occurrence, SM1 arrived at the Hornepayne Station and began to plan his day, which included obtaining the authorities that would be required. From the radio in the station, SM1 could hear an eastbound train and decided to wait until that train departed before contacting the RTC for a TOP from Signal 19N to Signal 32. He was not aware of any other approaching trains and believed that the required TOP limits were available.

1.16 Memory and mental models

A mental model is a conceptual representation of a system constructed by an individual that is based on their knowledge and understanding of that system.^{Footnote 43} A mental model may include descriptive as well as spatial information. Although spatial information can be included in a verbal description, seeing pictures and maps provides more accurate information, which leads to a stronger mental model. An accurate mental model, i.e., one that conforms closely to the real world, supports better decision making and better overall performance of tasks.^{Footnote 44} The accuracy of a mental model is facilitated through multiple processes, including repetition of the information. Mental models are resistant to change unless significant cues to the contrary are perceived.

Typically, experts can perform routine tasks extremely effectively by using schemas and applying task-specific strategies that reduce the amount of cognitive resources required for a specific task.^{Footnote 45} A mental model constructed by an expert will typically be more accurate and more complex than one created by a novice.^{Footnote 46}

1.17 Technologies that can provide track unit protection

1.17.1 Positive train control in the United States

Positive train control (PTC) is train control technology that is designed to prevent train-to-train collisions, overspeed derailments, incursions into work zone limits, and movement of a train through a switch left in the wrong position.

In the U.S., following several fatal rail accidents between 2002 and 2008, including the September 2008 collision between a Metrolink passenger train and a Union Pacific freight train in Chatsworth, California, the Rail Safety Improvement Act of 2008 was passed. The Act included the implementation of PTC by 31 December 2018. Due to a number of technical challenges, the deadline for implementing PTC was extended several times, and PTC was finally fully implemented in December 2020.

PTC systems include functions to

• alert train crews to pending authority and speed limit violations, including passing a Stop signal,
• stop trains before they exceed authority and speed limits, including Stop signals,
• integrate upcoming wayside signals and switches on a train route into the system, and
• protect work zone limits by enforcing train compliance with work zone restrictions.

Within a PTC or similar system, to protect MOW vehicles and require them to stop before a collision happens, a method to detect track units on the track is required. Examples of technology to protect track units from a collision include

• radio-based technology to communicate between trains and track units;
• ETOPs, which would result in the locking out of sections of track where work authorities exist;
• shunting of on-track MOW equipment; and
• GPS locating devices.

1.17.2 Enhanced train control in Canada

In Canada, no PTC systems are currently in use by freight or passenger railways; however, both Canadian Pacific (CP) and CN have fully implemented PTC requirements for their U.S. operations. To address several recommendations made by the TSB, a joint TC–industry working group on train control produced a report in 2016 entitled Train Control Working Group Final Report. The report concluded that a targeted, risk-based, corridor-specific implementation of train control technologies would be the best option for Canada.

On 05 February 2022, TC published a notice of intent in the Canada Gazette, Part I communicating its current policy direction and describing a path forward on implementing enhanced train control (ETC)^{Footnote 47} technologies in Canada. The notice describes an approach to implementing ETC in Canada that is based on extensive work conducted with railways and labour representatives. This approach focuses on having railway companies tailor investments according to the level of safety risk posed by individual railway corridors. The notice encourages feedback and future collaboration on the implementation of ETC systems in Canada.

1.17.3 Shunting of on-track railway equipment

Electric current (i.e., a track circuit) runs through the rails from a power source to determine track occupancy. Shunting occurs when electricity flows between the rails, such as when a rail car’s non-insulated wheels and axles permit the current to pass from one rail to another.

Tracks are divided into blocks of varying lengths and each block is separated from adjacent blocks by insulated joints. In CTC territory, at the entrance of each block, railway signals are in place to govern train movements and to ensure proper train separation. When a train approaches a block that is free of traffic, the signal will display a permissive indication. However, if another train or another vehicle that shunts the rail (i.e., shorts the circuit) is occupying a block ahead, or if the electrical continuity of the rails is interrupted due to a broken rail or an open switch, the system generates a sequence of signals informing the crew to stop the train prior to entering the block, or to reduce its speed enough for it to be able to stop within half the range of vision (figures 5 and 6).

In Canada, the wheels of most track units are insulated so they do not shunt the rails. Consequently, most track units do not activate railway signals ^{Footnote 48} and cannot be tracked by RTCs on their control screens.

Because most track units do not shunt the rail, they also do not activate the grade crossing warning system (GCWS) at actively protected level crossings. In Canada, between 2012 and 2021, there were 26 collisions between track units and road vehicles at a crossing equipped with a GCWS (i.e., flashing lights and bell, or flashing lights, bell, and gates) where the GCWS was not operating at the time of the occurrence (Appendix B).

On 01 March 2016, the TSB sent Rail Safety Information Letter 04/16 to TC following a collision between a road vehicle and CP snow-removal equipment (track unit) at the Dennison Road public crossing (Mile 105.19) on the Winchester Subdivision, near Bedell, Ontario (TSB occurrence R16H0017). The GCWS was not operating when the collision occurred. The letter stated (in part):

Since automatic warning device crossing protection is installed at crossings where the road traffic volume warrants additional defences, road vehicle drivers expect that sufficient warning will be provided to allow them to stop in advance of the crossing. Therefore, the activation of automatic warning device crossing protection prior to a track unit entering the crossing would be consistent with road vehicle driver expectation.

In the U.S., some railways require that shunting devices be used while work crews are working on the track (Figure 7).^{Footnote 49}

Shunting devices are typically installed by hand and are used to protect work crews. This track protection system ensures that stop signals will be displayed to trains when approaching blocks occupied by workers. Since these shunting devices must be installed by hand on the track and removed once the work is complete, they do not protect MOW employees travelling on the rails within a block.

The Union Pacific Railroad requires hi-rail vehicles, which includes track units, to be shunted so they activate signals and crossing GCWSs. However, this requirement does not apply to Union Pacific Railroad hi-rail vehicles used by signal employees when testing of signals, similar to the circumstances of this occurrence.

There are limitations to the shunting by track units. For example, in situations when the wheels of the track unit do not establish effective contact with the rail (e.g., rusty rail surfaces or wheel lift that occurs over deposits of material, such as snow, sand, dirt, or leaves), shunting may not occur consistently. In such circumstances, track occupancies can be intermittent or not show at all on RTC screens or activate signal indications in the field.

Also, in general, signal maintainers perform testing that requires the track to not be shunted (i.e., if the track is shunted, they cannot complete their tests), including testing and maintenance of signals and crossing warning devices.

1.17.3.1 U.S. National Transportation Safety Board recommendation regarding shunting of maintenance-of-way equipment

On 29 January 1988, a northbound Amtrak train struck MOW equipment in Chester, Pennsylvania. The locomotive engineer on the train was seriously injured. Eight train crew members and 15 passengers sustained minor injuries. As a result of its investigation into this occurrence, the U.S. National Transportation Safety Board (NTSB) issued the following recommendation to the American Railway Engineering Association (AREA):

Determine methods to provide for positive shunting of signal circuitry by on-track, maintenance-of-way machinery, and include these methods in the manual of recommended practices.

NTSB Recommendation R-89-005^{Footnote 50}

On 14 June 1989, in response to the recommendation, the AREA stated (in part):

[T]he decision as to whether [to] use insulated or non-insulated equipment is a decision best left up to the individual railroads depending on details of their safety rules and maintenance procedures, as determined by the operating departments, signal departments, and MOFW [maintenance of way] departments of each railroad. The primary safety mechanism needs to be written orders which prohibit the unanticipated simultaneous operation of train and maintenance of way equipment on the same track. For the above reasons, the AREA does not feel that it is appropriate for it to recommend practices in accordance with the NTSB suggestions. We believe the best interest of safety involves the AREA taking no action on the matters mentioned by NTSB in its safety recommendation R-89-5.

On 15 November 1989, the NTSB assessed the response from the AREA as unacceptable. The NTSB stated (in part):

The Safety Board continues to believe, as discussed in its report of the Amtrak accident in Chester, Pennsylvania that prompted this recommendation, that the protection provided by the automatic block signal system is essential to the prevention of human error-induced accidents. […] Until such a time that a reliable level of protection against out-of-service track intrusions can be ensured through the use of non-insulated equipment and positive shunting devices, the protection will depend solely on procedural rules. The Safety Board believes that Amtrak’s operating rules, and instructions for protection of on-track maintenance equipment should always be considered as the primary safety measure and to the extent possible, the procedures should be designed so that there is minimum chance of human error.^{Footnote 51}

1.17.4 Use of GPS technology to detect on-track equipment

Some railway companies use GPS technology to locate and monitor on-track equipment. In the future, this technology could also be used within a collision-avoidance system.

Following a 1996 collision involving 2 trains near Sept-Îles, Quebec (TSB Railway Investigation Report R96Q0050), a GPS-based collision-avoidance system was developed by the Quebec North Shore and Labrador Railway. This proximity detection device was implemented on its rail network in July 1997. The proximity detection device uses GPS technology to locate all on-track locomotives and track units. It provides audible and visual warnings to equipment operators of other equipment within specified distances and triggers penalty braking if train crews do not take action. Except for limited trials, no similar systems have been implemented by other Canadian railways.

In the U.S., in the early 2000s, Burlington Northern Santa Fe (BNSF) Railway implemented a collision prevention system (HyRail Limits Compliance System) to add an additional layer of safety to the operation of hi-rail vehicles on active main tracks through the use of GPS technology. The system monitors the location of hi-rail vehicles by comparing authorization limits issued to a vehicle against its physical location. When a vehicle approaches its limits of authority, the MOW employees are alerted. If the vehicle exceeds its limits of authority, it receives a continuous alarm and the system alerts the dispatcher.

In 2004, BNSF Railway began testing the Electronic Train Management System (ETMS), a collision-avoidance technology to keep trains within their authorized limits and at or under their authorized speed limit, using GPS data and software to determine train location. These 2 systems developed for BNSF Railway are based on similar technologies. ETMS is an approved PTC system and formed the blueprint for the Interoperable ETMS (I-ETMS), which is also an approved PTC system that is being adopted by most freight railways in the U.S., including CP and CN on their U.S.-based rail lines.

At CN, GPS devices have been installed on most of its track units. GPS information is collected by CN in real-time and is used primarily for fleet management. At the time of the occurrence, GPS information was not being used for on-rail vehicle tracking by the RTC, by the operating crews, or by the MOW employees.

1.18 TSB statistics for track unit movements that exceed limits of authority on main track

A review of TSB’s Rail Occurrence Database System (RODS) was conducted for the 10-year period between 2012 and 2021 to identify similar occurrences where MOW employees operated track units on a track without authority, either by operating outside their authorized TOP limits or after their authorized limits had expired (i.e., Rule 42). Such events are considered to be leading indicators for the potential for a collision to occur. A total of 281 of these occurrences were identified (Table 2).

The following observations were made:

• CN reported 12 such occurrences involving track units in 2021 compared with 26 in 2020. The 12 occurrences reported in 2021 are also in line with the 10-year CN average of 12.3.
• CP reported 10 such occurrences involving track units in 2021, which was the same as 2020 and slightly below the 10-year CP average of 11.3.
• For all other railways, the 2021 total of 5 was slightly above the 10-year “other railway” average of 4.5.

Table 3 presents the main-track collisions between trains and track units. Such collisions are considered to be low probability, high-risk events that can result in serious injuries (Appendix C).

In 2020, CN reported 3 main-track collisions, of which the TSB investigated 2 (this accident and R20D0088). All 3 of these accidents occurred when track units went undetected when they exceeded their limits of authority and were struck by a train. Although serious injury was averted in these cases, each of the hi-rail vehicles was destroyed.

1.19 Previous TSB investigations involving track units exceeding their limits of authority and colliding with trains

Since 2012, the TSB has investigated 3 other railway accidents where track units exceeded their limits of authority undetected and collided with a train.

• TSB Railway Investigation Report R12V0008 – Mile 14.5, Clearwater Subdivision, Messiter, British Columbia (BC): On 14 January 2012, at approximately 0413 Pacific Standard Time, CN freight train A41651-13, proceeding eastward from Kamloops, BC, to Edmonton, Alberta, struck a stationary track unit at Mile 14.5 of CN’s Clearwater Subdivision. There were no injuries and there was no derailment. The track unit was destroyed. The lead locomotive of the train was undamaged.
• TSB Railway Investigation Report R16H0024 – Mile 118.36, Nemegos Subdivision, Nemegos, Ontario: On 06 March 2016, at about 1540, CP freight train 100-03 was proceeding eastward at about 35 mph when it collided with a stationary hi-rail vehicle at Mile 118.36. The foreman and machine operator had exited the hi-rail vehicle just before the collision. There were no injuries and there was no derailment. The hi-rail vehicle was destroyed. The lead locomotive of train 100-03 sustained minor damage.
• TSB Rail Transportation Safety Investigation Report R20D0088 – Mile 30.5, CN Kingston Subdivision, Les Cèdres, Quebec: On 06 December 2020, at about 2132, VIA Rail Canada Inc. (VIA) passenger train VIA 68 was travelling east at the authorized speed (95 mph) on the north main track of the Kingston Subdivision. As the train approached Mile 31, the 2 VIA locomotive engineers noticed a bright light in the distance. When the operating locomotive engineer realized that the light appeared to be coming from rolling stock on the same track as the train, he immediately initiated a full-service air brake application and sounded the locomotive horn and bell. A few seconds later, the train, still travelling at nearly 83 mph, struck a stationary hi-rail track unit at Mile 30.5 in the municipality of Les Cèdres, Quebec. Although there were no injuries, the hi-rail vehicle was destroyed.

2.0 Analysis

Neither the condition of the track nor the manner in which freight train G87441-25 (the train) was operated contributed to the occurrence. The analysis will focus on radio communications when obtaining track occupancy permits (TOPs), administrative defences for maintenance-of-way (MOW) employees, job readiness, and technologies for track unit protection.

2.1 The accident

The rail traffic controller (RTC) lined the train for its arrival at Hornepayne. Shortly after, the RTC was contacted by the Canadian National Railway Company (CN) signal maintainer (SM1), who was working his first shift alone on this subdivision. SM1 requested a TOP from Signal 19N to Signal 32 in order to perform testing at the turnout switch at Jackfish.

Since the RTC had just provided authority to the train that included Signal 32, he provided the limits that were available on the north track, from Signal 19N to Signal 31N. SM1 copied and repeated the TOP limits provided by the RTC. The RTC then provided his initials and the complete time, which activated the TOP.

SM1 passed Signal 31N, thereby exceeding the limits of his TOP authority, and parked the hi-rail vehicle on the turnout switch at Jackfish, between Signal 31N and Signal 32, adjacent to the signal bungalow. SM1 then exited the hi-rail vehicle and began testing.

As the train approached at 32 mph, the crew members noticed a hi-rail vehicle on the track near the switch, but did not immediately realize that it was foul of their route; the locomotive engineer sounded the horn and continued. At about the same time, SM1 observed the approaching train and sought cover behind the signal bungalow. When it became apparent to the train crew that the hi-rail vehicle was foul of the train’s route, the locomotive engineer applied the brakes in emergency but could not stop the train before colliding with the vehicle.

2.2 Radio communications

SM1 was trained in radio communications but he had limited experience in requesting TOPs. When SM1 requested the TOP, he did not clearly identify the track or tracks to be used, as required by the Canadian Rail Operating Rules (CROR), which resulted in the communication not being understood and prompted the RTC to ask for clarification.

CN rules do not contain any specific procedures to follow when communicated information is not clearly understood. The RTC was not specific in requesting a clarification and, instead, asked a general question that did not result in the RTC realizing that SM1 had requested limits that he could not provide, so alternative limits were not discussed.

In addition, MOW equipment radios are required by Rule 119 of the CROR to be set to scan mode so that broadcasts by nearby movements can be heard. It could not be confirmed if SM1’s radio was set to scan the standby channel; however, SM1 was unaware of the approaching train until he saw it approaching just before impact.

2.3 Mental model

When SM1 arrived at the Hornepayne Station, he planned his day and was waiting for the departure of an earlier eastbound train before contacting the RTC for a TOP from Signal 19N to Signal 32. SM1 was unaware of a second eastbound train and had assumed that, with the departure of the first eastbound train, there were no other trains nearby and he would be able to receive the required limits for his TOP to perform testing at the Jackfish turnout switch.

The RTC provided verbal TOP authority from Signal 19N to Signal 31N, not Signal 32, and pronounced in full and then repeated the authority, stating each digit separately. SM1 then correctly repeated back the TOP information as provided by the RTC.

There were several factors that may have influenced the formation of SM1’s incorrect mental model:

• SM1 may have expected the RTC to inform him if the limits requested could not be provided. When the RTC did not discuss alternative limits, SM1 may have assumed he was getting the limits that he had requested.
• When the RTC asked if SM1 wanted to work on the north track and then provided the limits, this may have reinforced SM1’s mental model that he had obtained the limits he requested.
• When requesting the TOP, SM1 may have been preoccupied, as he wanted to reach the signal bungalow to undertake his first tasks of the day while operating alone for the first time on this subdivision.
• SM1’s attention was likely divided between the task of the moment (requesting the TOP) and the upcoming maintenance task.
• SM1 was relatively inexperienced with regard to requesting a TOP.

Overall, the communications between the RTC and SM1 were not conducive to a clear, shared understanding of each one’s needs and restrictions. Good communication needs to be clear, concise, complete, and correct.

2.4 Job readiness

Job readiness refers to the technical and non-technical skills required to perform a job. The evaluation of job readiness requires the confirmation of formal education and work experience as well as on-the-job observation of competencies.

SM1 had the required qualifications for his position, which included spending 19 months in the CN signal maintainer apprenticeship program. Throughout his apprenticeship and subsequent 14 months of work experience, SM1 worked under the authority of a supervisor who planned and organized all the work and requested most of the TOPs. Consequently, SM1 had very little experience in requesting TOPs. Moreover, the day of the accident was his first shift working alone on the subdivision, meaning that his processes for planning and requesting TOPs were not yet routine, and that additional cognitive resources were required to accomplish those tasks. Therefore, he had limited cognitive resources left over for other processes such as adjusting mental models and memorizing.

2.4.1 Training versus familiarization

Before he began his new position, SM1 had a 9-day ride-along with the departing signal maintainer (SM2) to familiarize himself with the territory and the specifics of the position. During the 9 days, SM1 only spoke to his new supervisor twice by telephone. CN has no requirement for supervisors to assess the skills of newly appointed employees in order to determine whether additional training is needed. In this case, the non-technical skills required by SM1 for the position were not assessed during this familiarization period.

During the 9-day ride-along, SM2 provided location-specific information for the territory in which SM1 was going to work. Because SM1 was qualified for the position, there was no requirement for SM2 to provide any type of training, coaching, or mentoring. The familiarization training was unstructured and informal. Other than familiarization training, there was no company process in place nor any requirement for SM2 to assess the job readiness of SM1, nor was SM2 required to report on SM1’s progress to the supervisor.

2.5 Administrative defences

To minimize and prevent conflicts in CTC, a number of rules have been established in the CROR and CN’s General Engineering Instructions to ensure compliance with track authority limits.

On the day of the occurrence, SM1 did not follow a number of instructions and rules intended to ensure that the track units are operated within the TOP limits, including

• broadcasting the TOP limits over the radio when entering the main track;
• stopping, reviewing the TOP, recording signal numbers, and broadcasting TOP limits over the radio before passing signals 19N and 31N; and
• monitoring the standby radio channel.

These non-compliances resulted in SM1 missing opportunities to correct his mental model with the information that the TOP limits provided travel only up to Signal 31N, not Signal 32.

2.6 Electronic track occupancy permits

CN introduced electronic track occupancy permits (ETOPs) to reduce the number of occurrences of track units being operated outside their authorized limits. ETOPs are requested on a laptop that displays the RTC screen so that the person obtaining the TOP can see other authorizations on the track. Once the limits are entered, a TOP is issued only if the track is available. If a request is made for a limit on part of a track through which a train has already been lined, the ETOP program rejects the request, forcing another request to be made for track limits that are available.

While cellular coverage is not available on most of the Caramat Subdivision, SM1’s territory, which included Hornepayne, did have cellular coverage that would support a connection to the ETOP program, which was the preferred method of obtaining a TOP during his familiarization. However, SM1 was waiting for a new laptop to arrive; the laptop he had been assigned could not run the ETOP program.

2.7 Track unit protection

In Canada, most track units are not shunted. Therefore, they do not display on the rail traffic control screen, nor do they activate signals or grade crossing warning systems (GCWS) when they occupy the main track. Consequently, if track units are operating outside their limits of authority in signalled territory, RTCs and the crews of trains or other movements may not be aware of their presence, which can lead to collisions.

In this occurrence, after passing Signal 31N, the track unit occupied the main track outside its limits of authority and could not be detected on the rail traffic control screen and by the crew of the approaching train. Moreover, SM1 was performing testing that could not be completed if the track had been shunted.

2.7.1 Technologies that provide track unit protection

There are technologies available that can provide advance warning of a track unit that is operating beyond its limits of authority.

Global positioning system (GPS) technology may provide a reliable means for RTCs, train crews, and MOW crews to detect on-track equipment. For example, the proximity detection device developed and implemented by Quebec North Shore and Labrador Railway uses this technology. There are also shunting devices that can be installed by hand to protect work crews. However, the devices must be removed from the rails once the work is complete, so they do not protect employees operating track units while travelling on the rail.

In the U.S., the National Transportation Safety Board recommended that the American Railway Engineering Association “determine methods to provide for positive shunting of signal circuitry by on-track, MOW machinery, and include these methods in the manual of recommended practices.” Although the response to the recommendation was deemed unacceptable, at least 1 railway in the U.S. operates some non-insulated track units, which shunt the rail, resulting in the signals being activated and making them visible to other trains and to the RTC. If shunted track units are integrated with a positive train control system, it could potentially protect track units that operate outside their limits of authority and are at risk of colliding with a train.

2.8 Risk of collision with a track unit

A review of TSB’s Rail Occurrence Database System (RODS) was conducted for the 10-year period between 2012 and 2021. The review identified a total of 281 occurrences where MOW employees operated track units on a track without authority, either by operating outside their authorized TOP limits or after their authorized limits had expired. This is concerning because such events are leading indicators that highlight the potential for a collision involving a track unit to occur on a main track.

Since 2012, there have been 15 collisions with trains on main track when track units were not detected after exceeding their limits of authority. Although serious employee injuries were averted, the hi-rail vehicles were often destroyed, which highlights the potential risks involved with these types of accidents.

Most track units in Canada are not shunted and do not activate signals or GCWSs. Since GCWSs are installed at crossings where the road traffic volume warrants additional defences, road vehicle drivers expect that the GCWS will be functioning and that sufficient warning will be provided to allow them to stop in advance of the crossing. The activation of GCWS protection prior to a track unit entering the crossing would be consistent with the expectations of road vehicle drivers. When this does not occur, there is a risk of a road vehicle driver not fully understanding the situation, which creates the potential for a collision between a track unit and roadway vehicle to occur.

There are company and industry rules and instructions that provide guidance to assist track unit operators to safely traverse a grade crossing. Despite these provisions, between 2012 and 2021, there were 26 collisions between track units and road vehicles at a crossing equipped with a GCWS (i.e., flashing lights and bell, or flashing lights, bell, and gates) where the GCWS was not operating at the time of the occurrence.

2.9 Drug use

CN’s Policy to Prevent Workplace Alcohol and Drug Problems states that employees are responsible for being fit for duty, free of the negative effects of alcohol, cannabis, and other drugs. It goes on to emphasize that employees are strictly prohibited from operating a CN vehicle or equipment while under the influence of alcohol or other drugs, including the after-effects of such use. This includes signal maintainers, who are required to operate a hi-rail vehicle when working alone. Any violation of the policy will result in some corrective action up to and including dismissal of the employee.

The policy further mandates drug and alcohol testing for employees involved in an accident. This testing consists of a breathalyzer test and a urine test:

• The breathalyzer test is used to detect the presence of alcohol; any employee whose breath alcohol concentration is over 0.04 is in violation of the policy.
• The urine test is used to identify the presence of cannabis or other illicit drugs. When a urine test result is non-negative, an oral swab (saliva) test is used to determine impairment while on duty.
• When a swab test result is negative and a urine test result is non-negative, the result of the non-negative urine sample is forwarded to CN’s occupational health team to review and could result in education, counselling, or treatment in order to assist the employee.

Drug testing of SM1 took place about 4 hours after the collision. A urine test produced a positive result for tetrahydrocannabinol (THC), and a saliva test produced a negative result. From the saliva test results, it could not be concluded if there was impairment while SM1 was on duty.

Following the legalization of cannabis in Canada, Transport Canada (TC) undertook an extensive policy review and consultation to determine the most effective means of ensuring aviation safety with regard to impairment overall, including cannabis. Subsequently, effective 23 July 2019, TC implemented a policy prohibiting flight crews and air traffic controllers from consuming cannabis for at least 28 days before being on duty. This policy does not prevent Canada’s air operators from implementing more stringent prohibitions for their employees. However, TC has no similar policy for railway operators, and currently has no requirement for mandatory random drug and alcohol testing for safety-critical positions in any of the transportation modes (air, marine, or rail) that it regulates.

There is an association between a non-negative drug screening test result for THC and impairment, with recency of use being one of the strongest factors. The impairment period will begin almost immediately after the drug has been used and generally resolve within 4 to 6 hours following last use. However, the impairment period may begin later and last longer for frequent high-dose users, and for those who ingest cannabis, the impairment period can be longer.

In accordance with CN’s drug testing policy, testing for cannabis is reactive, as it is only performed after an accident, incident, or when there is cause to suspect impairment. However, using the current test protocol, it is sometimes difficult to determine if an employee was impaired at the time of the accident because of cannabis use. Cannabis in Canada is legal and its consumption is common. However, current defences to prevent impairment are administrative defences, which may not always be effective. In the absence of any proactive, random drug testing program, some railway employees may operate equipment while under the influence of cannabis.

3.0 Findings

3.1 Findings as to causes and contributing factors

These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence.

1. The collision occurred when the train struck the hi-rail vehicle that had been parked on the main track foul of the train’s route and outside the limits of authority specified in the track occupancy permit issued to the signal maintainer.
2. Although the signal maintainer wrote down and repeated the limits of Signal 19N to Signal 31N on his track occupancy permit form, he had formed the mental model that the track occupancy permit limit was up to the location of the maintenance task, near Signal 32.
3. The miscommunication and misunderstanding between the rail traffic controller and the signal maintainer likely contributed to the formation of the signal maintainer’s inaccurate mental model.
4. Although the signal maintainer was qualified for the position, he had limited experience in requesting track occupancy permits, and the occurrence shift was the first time he had performed the duties of a signal maintainer alone on this subdivision. The additional cognitive resources required to perform these duties left him limited cognitive resources for other processes such as adjusting mental models and memorizing, which contributed to his inaccurate mental model.
5. While operating on the main track, the signal maintainer did not follow several instructions and rules intended to confirm track occupancy permit limits, which reinforced his inaccurate mental model of the limits.
6. Because track units in Canada do not activate signals, the presence of the hi-rail vehicle beyond its limits of authority was undetected by the rail traffic controller and unknown to the crew of the approaching freight train; as a result, neither could take action to avoid the collision.

3.2 Findings as to risk

These are conditions, unsafe acts or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences.

1. If standard procedures and wording for radio communications are not used in coordinating a track occupancy permit, critical information can be omitted or misunderstood, increasing the risk of accidents.
2. Even though employees may be fully qualified, if they are new to a position and their job readiness, including any need for additional training, is not assessed during familiarization training, they may not be ready to assume their responsibilities unless they receive additional targeted training, which increases the risk of accidents.
3. If rules and company procedures relating to track unit operation are not consistently followed, administrative defences to identify errors and enhance situational awareness may be nullified, which increases the risk of collisions between trains and track units.
4. Despite company and industry rules and instructions governing the operation of track units on a main track, accident history shows that if track units are not shunted, there is an ongoing risk of collision between track units and trains on a main track, as well as between track units and road vehicles at crossings equipped with active grade crossing warning systems.
5. In the absence of random drug and alcohol testing, employees in railway safety-critical positions operating equipment while under the influence of drugs or alcohol may not be proactively detected, which increases the risk of an accident occurring as a result of impairment.

3.3 Other findings

These items could enhance safety, resolve an issue of controversy, or provide a data point for future safety studies.

1. Electronic track occupancy permits prevent track occupancy permits from being issued on an occupied track and provide an additional defence against errors made in manually issued track occupancy permits.

4.0 Safety action

4.1 Safety action taken

4.1.1 Transport Canada

Following the occurrence, Transport Canada’s (TC) Regional Enforcement Unit conducted a regulatory investigation. The TC investigation determined that the Canadian National Railway Company (CN) employee’s actions were not in accordance with the Canadian Rail Operating Rules (CROR) Rule 803, which governs track unit and track work authorization. Subsequently, TC issued an Administrative Monetary Penalty to CN for the CROR Rule 803 contravention.

4.1.2 Canadian National Railway Company

Since the occurrence, CN has developed a software application (Electronic Track Authority Verification [ETAV]) for maintenance-of-way (MOW) employees that uses the track unit’s GPS location to provide audible alerts within the cab of the track unit as it approaches its limits of authority. The ETAV application obtains the limits of authority either by interacting with the electronic track occupancy permit program or by having the MOW employees manually input them. As of May 2022, CN has equipped 68% of a total of 1896 track units with the hardware necessary to support ETAV. The GPS locations that are used to delineate limits of authority have been mapped for ETAV use on 100% of CN’s main east-west corridor subdivisions, including the Caramat Subdivision, and on 44% of CN’s secondary corridor subdivisions.

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 19 October 2022. It was officially released on 13 December 2022.

Appendices

Appendix A – Rules governing radio communications

The Canadian Rail Operating Rules (CROR) provide several rules regarding radio communications. The following rules apply to the issuance of a track occupancy permit:

121. POSITIVE IDENTIFICATION

(a) The person initiating a radio communication and the responding party must establish positive identification. The initial call must commence with the railway company initials of the person being called. In addition, when a non-railway company person is calling on a company’s channels, they must use their company’s name to identify themselves within the initial transmission.

(b) The person initiating the radio communication must end the initial call with the spoken word “OVER.”

(c) Each party to a radio communication must end their final transmission with the spoken word “OUT.”

(d) When an authority is requested from the RTC or signalman, communication must include the information required for the issuance of the authority. E.g. name, location, movement designation, required limits, signal number and/or track(s) to be used or entered.

[…]

123. VERIFICATION PROCEDURES

(a) When necessary, a repetition, acknowledgement or other response required from a crew member may be checked and confirmed to the RTC by another crew member.

(b) When GBO [general bulletin orders], clearances, other authorities or instructions, required to be in writing, are received by radio, they must be verified by the procedures prescribed by their specific rules.

(c) Except when transmitted by an automated device, or as otherwise provided, when verbal instructions or information affecting the safety of a movement are received by radio, such information must be repeated to the sender.

[…]

131. RECORDING

(a) The RTC must maintain indelibly in a book provided for the purpose, or a computer assisted system, a complete record of each GBO, clearance, TOP, authority, instruction and other information that is required to be in writing. The record must be made prior to or during the transmission and never from memory or memoranda, and if required to be sent again, it will be transmitted from the original record. Such records must include original date of issue and acknowledgement(s), when applicable.

(b) When issuing by voice communication, if an error is detected in the record of a GBO, clearance, TOP, or other authority, and before it has been completed to any employee, the RTC must direct that all copies be immediately destroyed. The record must be marked void. If re-issued, those which require numbering must be given a new number.

(c) In copying and recording, the spelling of each station name must be exactly as shown in the time table. The RTC, when recording addresses, may use standard station identity letters. Underscoring will be recorded except when verified by a computer assisted system.

(d) Where a computer assisted system is not in use, all movements authorized by a clearance and all TOP limits must be recorded on a train sheet.

[…]

132. BREVITY, CLARITY, PRONUNCIATION AND RETENTION

(a) A GBO, clearance, TOP, authority, instruction and its record shall contain only essential information. It must be brief, but clear in its meaning, in the prescribed form when applicable, and without erasure or any condition which may render it difficult to read or understand.

(b) In transmitting and repeating by voice communication, all words and numbers must be clearly pronounced. When the communication is required to be in writing, numbers will be pronounced in full, then repeated stating each digit separately. Numbers represented by a single digit must be pronounced, then spelled.

(c) The employee transmitting or repeating communications required to be in writing must regulate the speed of transmission to allow compliance with this rule.

(d) When an accident or incident occurs, all authorities, GBO or written instructions must be retained until relieved of this requirement by a supervisor.

(e) When a clearance, TOP or other written instruction or authority is fulfilled, cancelled or superseded;

(i)   where applicable, other employees must be advised; and

(ii) except when displayed electronically:

• an “X” must be immediately drawn across it to avoid further use; or
• when contained within a book, must be marked with a single diagonal line drawn across the page to indicate that it is no longer active and a second diagonal line forming an “X” will be drawn across the page when there are no preceding active items.

[…]

136. COPYING, REPEATING, COMPLETING AND CANCELLING

(a) The employee copying a GBO, clearance, TOP or other authority from the RTC or the cancellation of same, must copy as it is transmitted and repeat from the copy received all applicable written and pre-printed portions. The spelling of each station name must be exactly as shown in the time table.

(b) GBO, authorities or instructions must not be copied by the employee operating moving equipment or track units, if it will interfere with the safe operation of such equipment or track unit.

(c) The RTC must verify each written word and digit each time it is repeated. If correct, the RTC will respond “complete” and the initials of the RTC, which will be recorded and acknowledged by the employee copying. The employee copying must acknowledge by repeating “complete” and the initials of the RTC to the RTC.

(d) When transmitted by voice communication direct to the crew of a movement, it must not be completed until each crew member copying has correctly repeated it.^{Footnote 52}

Rule 4002 of CN’s Rail Traffic Controller Manual states the following regarding the application of CROR Rule 849, Issuing a TOP (in part):

Prior to issuing a TOP the RTC must:

• Confirm the name and location of the Foreman, and the limits and tracks to be used, (not applicable for ETOP)
• Ensure there are no conflicting movements within or authorized to enter the requested limits by checking track diagram for movement ID and/or block occupancy;
• If an unknown track occupancy is present, ascertain the exact location of all movements in the vicinity of the proposed TOP by radio communication;
• Verify from the track line display, that all blocking has been applied correctly;
• In instances of communication failure, if an ETOP is issued by an RTC but not received by the foreman in the field, the RTC must transmit verbally to the foreman who will copy and repeat it. The RTC will verify by highlighting text with the mouse during the repeat, in lieu of underscoring. The original complete time on the form will be used.

During the issuance of a TOP, the RTC must:

• Include a call before time or location unless the RTC and the Foreman can come to an understanding of how and when the foreman will clear.^{Footnote 53}

Appendix B – Collisions from 2012 to 2021 between track units and road vehicles at crossings equipped with a grade crossing warning system that was not operating

Appendix C – Collisions where track units were operating on the main track without authority and were struck by trains