Rail transportation safety investigation report R23H0006

On 13 April 2023 at about 1451 Eastern Daylight Time, Canadian National Railway Company mixed freight train M 37231-13 was proceeding eastward on the south track of the Kingston Subdivision at about 43.2 mph when it passed signal 694S displaying a Stop indication at Wesco (Mile 69.4). At the same time, VIA Rail Canada Inc. passenger train P 06721-13 was travelling at approximately 45 mph westward on the south track of the Kingston Subdivision, approaching Wesco, where it was lined to cross over to the north track. Both trains stopped about 1100 feet apart. There were no injuries to either crew or to the passengers.

On 13 April 2023, a Canadian National Railway Company (Canadian National or CN) train crew was ordered for 0815All times are Eastern Daylight Time. in BellevilleAll locations are in the province of Ontario, unless otherwise indicated. to operate mixed freight train M 37231-13 (CN 372) from Belleville to Montréal, Quebec, via the CN Kingston Subdivision. CN 372 consisted of 2 locomotives in a distributed power configuration, with 1 locomotive at the head end and 1 about mid-train; it was hauling 113 loaded cars and 23 empty cars. The train included 16 cars loaded with dangerous goods and 17 residue cars last containing dangerous goods. It measured 9937 feet and weighed 12 592 tons. The train crew consisted of a locomotive engineer (LE) and a conductor. Both crew members were qualified for their respective positions, met fitness and rest requirements, and were familiar with the territory on which they operated.

That same morning, a VIA Rail Canada Inc. (VIA) train crew was ordered for 1123 in Montréal to operate passenger train P 06721-13 (VIA 67) from Montréal to Toronto, travelling on the CN Kingston Subdivision. VIA 67 consisted of 1 locomotive and 4 coach cars with 167 passengers on board. It weighed 332 tons and measured 398 feet. The train operating crew consisted of 2 LEs. Both crew members were qualified for their respective positions, met fitness and rest requirements, and were familiar with the territory on which they operated.

1.1 The occurrence

Under section 28 of the Canadian Transportation Accident Investigation and Safety Board Act, every on-board recording is privileged. However, the TSB may make use of any on-board recording where it is necessary in the interests of transportation safety. For this reason, while the Board may refer to an on-board recording where required to support a finding and identify a substantive safety deficiency, other parties may not access or use privileged on-board recordings.

The reason for protecting on-board recordings lies in the premise that these protections will respect the privacy of operating personnel whose words and actions are captured on the recording and will also help ensure that this essential material is available for the benefit of the TSB’s safety investigations.

This report references content from a locomotive voice and video recorder (LVVR), which is a form of on-board recording in the rail sector. For each of these references, the TSB is using the LVVR recording to substantiate some of its findings and to identify certain substantive safety deficiencies. In each case, the material has been carefully examined to ensure that the extracts used are necessary to identify causes or contributing factors of this accident or to identify safety deficiencies.

CN 372 departed Belleville at 0850. At about 1313, the train stopped due to an air hose separation, and temporary repairs were made to car HESX 52 (position 38). CN management made the decision that the car should be set off the train at the next suitable location (Regis, Mile 65.4). The crew then discussed the suitability of the set-off location for the train length and the set-off procedure.

At about 1410, CN 372 resumed its journey eastward on the south track of the Kingston Subdivision. The crew consulted with the rail traffic controller (RTC) via radio about the car set-off and, on several occasions, they spent time accessing information on their company-issued tablets to prepare for the set-off at Regis. During this time, they also evaluated the suitability of an alternate set-off location, Coteau, Mile 37.8, to accommodate the train length.

At about 1448, CN 372 approached signal 716S (Mile 71.6), which was displaying a Clear to Stop indication.A Clear to Stop indication is used to inform train crews to proceed, preparing to stop at the next signal. The crew members were discussing the upcoming car set-off on the radio with the RTC and did not identify the signal indication and/or communicate it to each other. When the train was approximately 2650 feet from signal 716S, the call with the RTC ended. The crew members were still in conversation as the head end of their train passed the signal at approximately 52 mph.

At about 1449, the RTC contacted the crew on CN 372 again to further discuss the upcoming car set-off. The conversation lasted about 50 seconds.

At about 1450, while travelling at 49 mph, CN 372 approached the next signal, signal 694S, at Wesco near Cornwall (Mile 68.0) (Figure 1). Approximately 1400 feet from the signal, the crew observed the signal and questioned whether it was a Stop signal.The last signal that the crew identified before missing signal 716S was signal 740S, which displayed a Clear indication permitting the train to proceed. The LE then made a minimum brake application. About 13 seconds later, the conductor identified and communicated the Stop signal and placed the train in emergency. The train went past the Stop signal at 43.2 mph. The conductor made an emergency broadcast over the radio to communicate the situation as required by the Canadian Rail Operating Rules (CROR). At 1452:08, CN 372 came to a stop at approximately Mile 69.1, 1786 feet past the Stop signal.

Image

The same day, VIA 67 had departed Montréal at 1323, travelling westward on the Kingston Subdivision. It received a Clear to Limited indicationA Clear to Limited indication allows a train to proceed; however, the train must approach the next signal at limited speed. Limited speed is defined as a speed not exceeding 45 mph. [Canadian National Railway Company, Canadian Rail Operating Rules (effective 28 October 2021), Rule 406: Clear to Limited, p. 78, and Definitions (Speeds), p. 15.] at signal 667S on the south track. At about 1450, while travelling at 45 mph, VIA 67 approached Wesco, where it was to cross over to the north track. At about 1451, upon hearing the emergency radio broadcast from the crew of CN 372, the LE at the controls of VIA 67 brought his train to a controlled stop. VIA 67 came to rest with the head end at approximately Mile 68.9, 1100 feet east of the head end of CN 372 (Figure 2). There were no injuries to either crew or to the passengers.

Image

Figure 3 shows the location of the relevant signals, and the relative position of the stopped trains in relation to these signals and to each other.

Image

At the time of the occurrence, the temperature was 27 °C and the sky was clear; visibility was good.

1.2 Subdivision and track information

The CN Kingston Subdivision consists of 2 to 4 main tracks that extend from Dorval East in Montréal (Mile 10.3) to Toronto (Mile 333.8).

The subdivision is a major high-speed rail traffic corridor in Canada. An average of 18 CN freight trains and 12 VIA passenger trains operate on the subdivision daily.

Train movements are governed by the centralized traffic control system (CTC) as authorized by the CROR and are dispatched by a CN RTC located in Edmonton, Alberta.

The track in the vicinity of the occurrence consists of 2 main tracks (north and south). It is designated as a Class 5 track according to the Rules Respecting Track Safety. The maximum authorized speed is 100 mph for passenger trains and 65 mph for freight trains; however, on the day of the occurrence, the following speed restrictions were in effect:

• A slow track protection restricted passenger trains to a maximum of 80 mph and freight trains to a maximum of 60 mph at Mile 69.4 on the south track.Canadian National Railway Company, Tabular General Bulletin Order No. 4079 (13 April 2023).
• A timetable speed restriction required that eastward freight trains handling 80 or more tons per operative brakesTons per operative brake is the total weight of the train (including locomotives) divided by the total number of operative brake control valves on the train. Depending on the infrastructure and operational constraints, railways may apply speed restrictions on certain areas when the tons per operative brake on a train reach a specified threshold (in this occurrence, greater than 80 tons per operative brake). not exceed 60 mph approaching signals 716S (south track) and 716N (north track) at Mile 71.6.Canadian National Railway Company, Eastern Canada Region – Champlain Division TimeTable 86 (effective 01 February 2023).,CN 372 had a ratio of 92.6 tons per operative brakes and was therefore required to comply with this speed restriction.

1.3 Recorded information

The lead locomotive on CN 372 was equipped with a locomotive event recorder and a forward-facing video camera. A review of the data from these devices shows the following:

• At 1448:45, the lead locomotive, travelling at 52 mph, passed signal 716S (Clear to Stop) at Mile 71.6.
• At 1449:23, the lead locomotive, travelling at 51.6 mph, passed Mile 71.0 (1.6 miles from the Stop signal at Wesco).
• At 1450:34, the lead locomotive, travelling at 49 mph, passed Mile 70.0 (3199 feet from the Stop signal at Wesco).
• At 1451:06, the LE initiated a minimum brake application.
• At 1451:13, while the train was travelling at 46.5 mph with the dynamic brake in position 8, an emergency brake application was registered while the lead locomotive was at Mile 69.3 (467 feet before the Stop signal at Wesco).
• At 1451:20, the lead locomotive, travelling at 43.2 mph, passed signal 694S (Stop signal) at Mile 69.4.
• At 1452:08, the lead locomotive came to a stop at Mile 69.1 after travelling roughly 2300 feet with an emergency brake application.

While playing back the data from the forward-facing video camera, the TSB observed that a windshield wiper was obstructing the view from the camera (Figure 4). During daylight operations, the signal views from the camera are limited by the camera resolution, which results in a limited opportunity to identify the signal indication. In this occurrence, this did not impede the crew’s ability to positively identify the signal.

CN requires that crews ensure the view from forward-facing cameras remains unobstructed at all times.Canadian National Railway Company, Locomotive Engineer Operating Manual (01 May 2016), section A1.18: Locomotive Camera – Unobstructed View, p. 6.

Image

The TSB has encountered this situation in 3 other occurrences since 2023, on recordings provided by CN and other railways.

Finding: Other

A forward-facing video camera is a useful tool in an accident investigation; however, in this occurrence, the view from train CN 372’s locomotive camera was partially obstructed by a windshield wiper, resulting in a limited opportunity to identify the signal indication.

1.3.1 Locomotive voice and video recorder on the lead locomotive of CN 372

As part of its investigation, the TSB requested locomotive voice and video recorder (LVVR) data from the lead locomotive on CN 372.

While reviewing the data from CN 372, the TSB observed that the first 35 minutes of the recording did not contain in-cab audio. Canadian regulations require that both the in-cab video and audio must be recorded on trains operating in Canada.“A company must ensure that an LVVR system […] continuously records voice and video data from the time the controlling locomotive engine is turned on until is it turned off.” (Source: Transport Canada, Locomotive Voice and Video Recorder Regulations, SOR/2020-178 [last amended 02 September 2022 ], Technical Requirements, subsection 5(b))

This is the 3rd occurrence investigated by the TSB in which in-cab voice recording was not available. As part of its investigations into occurrences R22D0106 and R22V0238, the TSB sent Rail Transportation Safety Information Letter 01/23, “Missing audio channel in locomotive voice and video recorder (LVVR) data,” to Transport Canada (TC) on 23 February 2023. The letter indicated that, to ensure compliance with the Locomotive Voice and Video Recorder Regulations (LVVR Regulations), TC may wish to verify the functionality of LVVR systems operated by railway companies and confirm that all the parameters required under the LVVR Regulations are being correctly captured and recorded.Transportation Safety Board of Canada, Rail Transportation Safety Information Letter 01/23, “Missing audio channel in locomotive voice and video recorder (LVVR) data,” available at https://www.tsb.gc.ca/eng/securite-safety/rail/2023/r22d0106/r22d0106-01-23.html (last accessed 04 October 2024).

In all 3 of these occurrences, the trains were operating near the border with the United States (U.S.). In one instance, occurrence R22D0106, the LVVR began recording in-cab audio only once the train was 9 miles from the border.

It was determined that the LVVR system uses a geofence algorithm that cuts out the in-cab voice recording when the locomotive is operating in the U.S. to comply with the regulatory requirements of that country. TC responded that it would work with railway companies to identify ways to test equipment within the existing regulatory framework to ensure compliance with the technical requirements in the LVVR Regulations.

Finding: Other

Because 35 minutes of voice data from train CN 372’s LVVR system were not available, the TSB was unable to determine the verbal communications between the crew members for a portion of the trip, hindering the investigation’s ability to analyze crew performance.

1.4 Signal indications

1.4.1 Centralized traffic control system

Train control systems provide for safety during the operation of trains, and during track work, on one or more main tracks. In particular, CTC uses track circuits interconnected with signals displayed in the field to control train movements.

Signal indications are used to control train movements within blocks of track by visually conveying advance information to train crews about the status of the track ahead, speed restrictions, and the immediate limits within which the train may operate, i.e., usually 1 or 2 consecutive blocks in the direction of travel.

Signal indications also identify if the block ahead is occupied by another movement and provide protection against some conditions, such as a broken rail or a switch left open. Signal indications are progressive: the preceding signal indicates what the next signal will potentially display.

The signals in CTC territory are governed by the CROR. Train crews must be familiar with all signal indications and are required to control their trains in accordance with these rules.

1.4.2 Signal indications and associated rules in this occurrence

Rules 405 to 439 of the CROR govern the signals used in CTC territory.

In this occurrence, eastbound train CN 372 encountered a progression of 3 signal indications that governed the approach to Wesco:

• The 1st signal, 740S at Bergin, displayed a Clear indication (CROR Rule 405), which identified that the train could proceed.
• The 2nd signal, 716S, displayed a Clear to Stop indication (CROR Rule 411), which identified that the train could proceed but that it must be prepared to stop at the next signal.
• The 3rd signal, 694S, displayed a Stop indication (CROR Rule 439). Rule 439 states in part that, when encountering a Stop signal, “[u]nless required to clear a switch, crossing, controlled location, or spotting passenger equipment on station platforms, a movement […] must stop at least 300 feet in advance of the STOP signal.”Canadian National Railway Company, Canadian Rail Operating Rules (effective 28 October 2021), Rule 439: Stop, p. 87.

The approach to signal 716S is on a slight downhill grade that is on tangent track for approximately 3.5 miles. The approach to signal 694S is on an undulating grade with a slight downhill grade for 0.5 mile before the signal, which is on tangent track. Sightlines for all 3 signals allow for indications to be perceived at a distance from the locomotive cab to allow the crew to take the appropriate actions.

1.4.3 Signal recognition and compliance

Signal recognition and compliance is governed in part by CROR Rule 34 (Fixed Signal Recognition and Compliance), which states, in part:

(b) Crew members within physical hearing range must communicate to each other, in a clear and audible manner, the indication by name, of each fixed signal they are required to identify. Each signal affecting their movement must be called out as soon as it is positively identified, but crew members must watch for and promptly communicate and act on any change of indication which may occur.

The following signals/operating signs must be communicated:

(i) Block and interlocking signals;

(ii) Rule 42 and 43 signals;

[…]

(v) Stop sign;

[…]Ibid., Rule 34: Fixed Signal Recognition and Compliance, p. 29.

There is also a requirement for trains operating on single track to initiate a radio broadcast stating the name of the signal displayed on the advance signalAn advance signal is “a fixed signal used in connection with one or more signals to govern the approach of a movement to such signal.” (Source: Ibid., Definitions, p. 10) to the next controlled location, controlled point, or interlocking signal (CROR Rule 578).Ibid., Rule 578: Radio Broadcast Requirements, p. 94. However, the occurrence train was operating in multi-track territory, and it was not required to comply with this rule at the time.

In this occurrence, between Mile 82.1 and Mile 69.4, the train passed 5 block signalsA block signal is “a fixed signal at the entrance to a block [i.e., a length of track of defined limits] to govern a movement entering or using that block”). (Source: Ibid., Definitions, p. 15) displaying signal indications and 3 signals for slow track protection (Rule 43 signals).Rule 43 of the Canadian Rail Operating Rules (CROR) indicates that, when slow track protection (i.e., a temporary speed restriction) has been provided under a general bulletin order, yellow and green flags must be placed to the right of the track to indicate the presence of such protection and its limits. (Source: Ibid., Rule 43: Slow Track Protection, p. 33) The crew did not call the signals within the cab of the locomotive as required by Rule 34 of the CROR,Rule 34 of the CROR requires “crew members within physical hearing range [to] communicate to each other, in a clear and audible manner, the indication by name, of each fixed signal they are required to identify,” including block signals and Rule 43 signals. (Source: Ibid., Rule 34: Fixed signal recognition and compliance, p. 29) except for a Clear signal indication at the controlled location at Mile 74.0 (2 signals before signal 694S).

Train crew awareness of signal indications displayed in the field relies on visual detection and perception. Accurate and timely perception of signals is essential for compliance. Signal perception with clear visibility can be accomplished rapidly from relatively long distances. However, a crew’s fitness for duty, distractions, mental models, and expectations can affect perception and reaction time. To minimize the risk of distractions, in August 2022, CN implemented an additional administrative defence—the critical focus zones (CFZs).

1.4.4 Critical focus zones for train crews

On 23 August 2022, CN issued System Operating Bulletin 007, which introduced a new special instruction under CROR Rule 34 for the implementation of CFZs. The full text of the bulletin is provided in Appendix A.

CFZs refer to special procedures to be applied at times when crew concentration is most important. For instance, when a CFZ is in effect, employees in the cab of a controlling locomotive must cease any communication or other duties unrelated to the train’s immediate operation. If train crew members are contacted by other employees concerning a matter unrelated to the safe operation of their movement, they must respond by indicating that they are in a CFZ and tell the other employee to stand by.

A CFZ begins 3 miles from a Stop signal or the moment that the advance signal is observed (if it is within 3 miles) and remains in effect until the movement has stopped for the Stop signal or the next signal has been identified to be permissive. While a CFZ is in effect, all crew members in the cab must confirm approaching restrictions such as Stop signal indications.

In this occurrence, when CN 372 approached signal 716S (Mile 71.6), which was displaying a Clear to Stop indication, instructions related to CFZs would have applied. However, the crew was discussing the car set-off with the RTC and did not realize and therefore indicate to the RTC that they were in a CFZ.

1.4.5 Positive train control in the United States

The absence of physical fail-safe defences capable of intervening by slowing or stopping a train when operating in CTC territory and the absence of a passive warning system to alert train crews when they approach their limits of authority have been raised by the TSB in its investigation reports since 1995.TSB Railway Investigation Report R95V0174. Inadequate defences against misapplied or misinterpreted signal indications have been cited as a cause or contributing factor in numerous investigations conducted by the TSB,TSB rail transportation safety investigation reports R19W0002, R18D0096, R16T0162, R16E0051, R15D0118, R15V0183, R14T0294, R13C0049, R12T0038, R11E0063, R10Q0011, R10V0038, R09V0230, R07E0129, R99T0017, R98V0148, and R95V0174. and this issue has been on the TSB Watchlist since 2012.TSB Watchlist, “Following railway signal indications”, at https://www.tsb.gc.ca/eng/surveillance-watchlist/rail/2022/rail-01.html (last accessed on 04 October 2024).

After a head-on collision in 2008 between a freight train and a passenger train in Chatsworth, California, that resulted in mass casualties, United States lawmakers mandated the development and implementation of physical fail-safe train controls (i.e., positive train control or PTC). Since 29 December 2020, PTC technology has been in operation on all 57 536 required freight and passenger railroad route miles in the United States.U.S. Department of Transportation, Federal Railroad Administration, Information Guide on Positive Train Control in 49 CFR Part 236, Subpart I (12 December 2022), at https://railroads.dot.gov/sites/fra.dot.gov/files/2022-12/2022_12%20PTC%20FAQs_final.pdf [last accessed on 04 October 2024.

PTC is designed to prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movement of a train through a switch left in the wrong position.

PTC addresses the risk of crews going past a Stop signal. Stopping distance is automatically calculated based on actual train speed and braking force algorithms. If a train has proceeded beyond the calculated stopping distance and no action or insufficient action has been taken, the system initiates a penalty brake applicationOn a PTC-equipped locomotive, when a penalty brake application is automatically triggered, the electronic air brake system will reduce brake pipe pressure to between 55 to 62 psi; this allows brake pipe pressure to be further reduced to 0 psi in the event of an emergency brake application. to bring the train to a controlled stop before the point of restriction. The train’s penalty brake stop distance is monitored and, if calculated to be insufficient to stop short of the point of restriction, then an emergency brake application is initiated.

While physical fail-safe train controls in the form of PTC have been implemented in the U.S., the infrastructure required to support PTC does not exist within Canada, nor is it required under the Railway Safety Act.

1.4.6 Active TSB recommendation related to physical fail-safe defences

Following an occurrence on 03 January 2019, in which 2 CN trains collided after one of the trains went past a controlled signal that displayed a Stop indication,TSB Rail Transportation Safety Investigation Report R19W0002. the Board stated that, if TC and the railway industry do not take action to implement physical fail-safe defences to reduce the consequences of inevitable human errors, the risk of collisions and derailments will persist, with a commensurate increase in risk on key routes in Canada. The Board therefore recommended that

the Department of Transport require major Canadian railways to expedite the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and on all key routes.

TSB Recommendation R22-04

In its December 2023 response, TC indicated that, following the publication of a Notice of Intent in February 2022,The Notice of Intent identified that the highest risk corridors in Canada must be equipped with fail-safe, automatic train protection (i.e., enhanced train control or ETC) by 2030. it developed a risk methodology to guide the implementation of enhanced train control (ETC) in Canada. TC shared the methodology with the railway industry in May 2023, leading to bi-weekly discussions throughout the summer of 2023. In addition, the Canadian Standards Association has finalized and published a set of guidelines for interoperability of ETC applications. TC also indicated that it continues to engage with stakeholders to inform drafting of a future ETC regulation.

In its February 2024 assessment of TC’s response, the Board acknowledged that the development and deployment of ETC is a complex and capital-intensive undertaking. However, the Board noted that TC and the railway industry have been discussing the framework needed to address the safety issue of “Following railway signal indications” since 2013 and, while TC has taken positive steps toward identifying a solution for physical fail-safe defences in the form of ETC, the pace of development is slow.

At the time of the Board’s assessment, there were 3 active TSB investigations, including this one, related to occurrences in which trains were operating on key routes and passed Stop signals.TSB rail transportation occurrences R23E0079, R23H0006, and R23V0205. While the preliminary investigation into these occurrences indicated that each of the trains involved received appropriate advance warning of the requirement to stop, the existing administrative defences were inadequate to ensure that these trains respected their limits of authority.

Despite the calls from the TSB for additional physical fail-safe defences in signalled territory since 2000 and the implementation of such a solution in the U.S. since 2020 (i.e., PTC), the Canadian railway system continues to rely on administrative defences centred on compliance with rules by train crews.

The Board was encouraged that TC developed a corridor risk methodology and that the Canadian Standards Association published a set of guidelines for interoperability of ETC applications. This action is a positive step toward the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and on all key routes by 2030. However, given the risks to train crews and the travelling public, the Board urged TC and the railway industry to accelerate the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and all key routes in Canada. The Board considered the response to Recommendation R22-04 to show Satisfactory Intent.TSB Recommendation R22-04: Enhanced train control for key routes (issued 24 August 2022), at https://www.bst-tsb.gc.ca/eng/recommandations-recommendations/rail/2022/rec-r2204.html (last accessed on 04 October 2024).

1.5 Company-issued electronic devices

It is well known that the use of electronic devices can lead to distractions. This is especially a concern in safety-critical operations. The inherent propensity to access information on electronic devices, combined with the cognitive, visual, and manual demands imposed by these devices, can lead to reduced attention, delayed reaction times, and an increased risk of accidents.

In August 2019, CN began providing its train crews with tablets, which they can use to view electronic versions of rule books, the company’s General Operating Instructions, timetables, bulletins, notices, and other relevant information. Previously, this documentation was carried by each crew member in paper format in an operating manual. Further enhancements were later introduced that allowed train crews to enter real-time reporting of work and switching conducted while en route and to enter required trip details.

At the time of this occurrence, the tablets were capable of also displaying an overview of the CTC territory, which indicates the locations of trains on the subdivision and signalling. They have cellular data capabilities so that they can be updated in real time as needed with new bulletins or notices and updates to rules and operating procedures.

CN conducted risk assessments related to tablet use, both before and after the tablets were introduced. Distraction during operations was identified as a potential hazard. To mitigate the risk, and to clarify expectations around the use of these electronic devices, CN issued several bulletins and made an addition to its CROR, which states, in part:

A Railroad Supplied Electronic Device may be used by employees while on duty to send and receive information. The use of the device is restricted to railway operations. Its use must not impede the crewmembers focus on their surroundings, any existing or upcoming restrictions or emergencies or their ability to safely control the movement.Canadian National Railway Company, Canadian Rail Operating Rules (effective 28 October 2021), General Rule A(xii), p. 18.

Operating crews were also required to take mandatory e-learning courses on the tablets. This training included strategies to prevent the use of tablets from becoming a distraction.

CN also issued System Operating Bulletin No. 014, which specified the following addition to its General Operating Instructions:

10. CN Railroad Supplied Electronic Device Information

Situational awareness:

The use of an electronic device has potential to reduce situational awareness. Manage the elements that could be a distraction before using the CN Railroad Supplied Electronic Device. If you are distracted, you may miss a potential hazard. Do not use the CN Railroad Supplied Electronic Device when it may distract you from working safely.Canadian National Railway Company, System Operating Bulletin No. 014 (16 August 2019).

The investigation into this occurrence determined that, in the hour before the crew on CN 372 applied the brakes in emergency, they accessed their respective tablets on multiple occasions, including at the same time. The tablet use occurred for various lengths of time, sometimes for several consecutive minutes. However, on the approach to both signals 716S and 694S, the crew members were not accessing their tablets.

Finding: Other

Although the use of the company-issued tablets did not play a role in this occurrence, mitigation measures to reduce the risk of distraction need to take into consideration the potential for operating crews to simultaneously refer to operational information on electronic devices.

1.6 Situational awareness and mental models

Situational awareness is the perception of the elements in the environment, the comprehension of their meaning, and the projection of their status in the future.M. R. Endsley, “Design and Evaluation for Situation Awareness Enhancement” in the Proceedings of the Human Factors Society: 32nd Annual Meeting (Santa Monica, CA: 1988), pp. 97 to 101. In a dynamic environment, situational awareness requires individuals to continuously extract information from the environment, integrate this information with relevant internal knowledge to create a coherent mental model of the current situation, and use this model to anticipate future events. Problems can occur in any of the 3 steps of situational awareness where critical elements are not detected, their importance is not perceived, or their consequences are not anticipated. Communications are critical for a team to establish a shared situational awareness.

A mental model is an internal structure that enables people to describe, explain, and predict events and situations in their environment.E. Salas, F. Jentsch and D. Maurino, Human Factors in Aviation, 2nd Edition (Academic Press, 2010), p. 66. When a mental model is adopted, it is resistant to change. New convincing information must be assimilated to change the mental model. An inaccurate mental model will interfere with situational awareness, notably in the perception of critical elements or the comprehension of their importance.M. R. Endsley, “Situation Awareness in Aviation Systems,” in J. A. Wise, V. D. Hopkin and D. J. Garland, Handbook of Aviation Human Factors, 2nd Edition (Boca Raton, FL: CRC Press, 2010), Part II: Human Capabilities and Performance, Chapter 12, p. 12.

1.7 Attention and human performance

Attention is a state in which cognitive resources of a person are concentrated on certain aspects of the working environment instead of others. Divided attention is when a person’s attention is simultaneously on 2 or more information channels to attend to 2 or more tasks.American Psychological Association, APA Dictionary of Psychology, “Attention,” at https://dictionary.apa.org/attention (last accessed on 04 October 2024). The U.S. Federal Railroad Administration describes attention as a person’s behaviour to concentrate on the critical information inside and outside the cab.

People have limited attention resources; therefore, attention on information that is not critical at a given time becomes a distraction. For a train crew, this means the need to concentrate on critical aspects of the work environment at a given time. People can be selective where they direct their attention on what they deem to be more important. However, people dividing their attention on 2 or more aspects of the working environment can result in a reduction of performance, which can then lead to an incident or accident.Federal Railroad Administration, “Attention: Definition and Examples,” at https://railroads.dot.gov/human-factors/elearning-attention/attention-definition-and-examples (last accessed 04 October 2024).

1.8 Human reaction time

Reaction time is the interval between the time something is perceived and the time it takes to respond to it. This interval can range from less than a second to many seconds.

The reaction time to a stimulus is influenced by situational awareness in that it depends on the perception of the stimulus, its comprehension, and its projection into the future. Operators’ reaction times increase considerably as a function of a situation’s complexity and unexpected stimuli.American Association of State Highway and Transportation Officials, A Policy on Geometric Design of Highways and Streets, 6th Edition (2011).

1.9 Adaptation

Adaptations are intentional deviations of rules and procedures. Routine adaptations are deviations that are frequently repeated. Those deviations can arise because the rule or procedure can be perceived as redundant and not necessary. When adaptations occur without negative consequences, they can persist and become usual practice. These practices become normalized and erode the safety margins that the rules and procedures were intended to provide.

1.10 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer.

Following signal indications—when train crews do not observe or react to a signal indication, resulting in the signal not being followed and a train exceeding its limits of authority—is a Watchlist 2022 issue. This issue has been on the Watchlist since 2012. Although the probability of a missed signal leading to a train collision or derailment may be low, the consequences of such an accident could be catastrophic for people, property, and the environment.

ACTION REQUIRED The issue of following railway signal indications will remain on the Watchlist until TC requires that railways implement additional physical safety defences to ensure that signal indications governing operating speed and operating limits are consistently recognized and followed.

The analysis will focus on the divided attention of the crew on Canadian National Railway Company (CN) freight train M 37231-13 (CN 372) on its approach to signal 716S, which was displaying a Clear to Stop indication, and the crew’s situational awareness and mental model when it approached the following signal, signal 694S, which was displaying a Stop indication.

The analysis will also discuss the failure of the existing administrative defences during this occurrence and the absence of physical fail-safe defences in Canada capable of intervening by slowing or stopping a train.

2.1 The occurrence

Eastbound freight train CN 372 was travelling at 43.2 mph on the south main track of the CN Kingston Subdivision when it passed signal 694S displaying a Stop indication at Wesco. When the CN conductor realized that the train was about to pass the Stop signal, he immediately applied the train’s air brakes in emergency and made an emergency radio broadcast as required. Westbound VIA Rail Canada Inc. (VIA) passenger train P 06721-13 (VIA 67) was operating in accordance with signal indications and was approaching Wesco on the south main track at about 45 mph in preparation for crossing over to the north track. Upon hearing the emergency radio broadcast from the crew of CN 372, the locomotive engineer (LE) at the controls of VIA 67 brought his train to a controlled stop. Both trains stopped about 1100 feet apart.

CN 372 had encountered a progression of 3 signals that governed the approach to Wesco (i.e., signals 740S, 716S, and 694S). The 1st signal, 740S at Bergin, displayed a Clear indication, allowing the train to proceed. This signal was the last signal identified and communicated by the crew within the cab of the locomotive, as required by Rule 34 of the Canadian Rail Operating Rules. Having neither identified nor called the Clear to Stop indication within the cab at signal 716S, the crew of CN 372 had an inaccurate awareness of how the train was to be operated on that section of track as well as an incorrect mental model of the indication that would be displayed at the next signal (signal 694S). Consequently, they were not expecting a Stop indication.

When the train was about 1400 feet from signal 694S, the LE made a minimum brake application to slow the train speed. However, it was not until 13 seconds later, when the train was about 500 feet from the signal, that the conductor positively identified that the signal was displaying a Stop indication. The conductor subsequently made an emergency application of the train brakes in an effort to stop the train. However, the train came to a stop at approximately Mile 69.1, 1786 feet past the Stop signal.

The crew’s inaccurate mental model resulted in a delayed reaction and decision to apply braking.

2.2 Divided attention of the train crew on CN 372 on approaching signal 716S

In August 2022, CN issued a System Operating Bulletin introducing critical focus zones (CFZs). When a CFZ is in effect, crews in the cab of a controlling locomotive must cease any communication or other duties unrelated to the train’s immediate operation. If contacted by other employees, such as a rail traffic controller (RTC) concerning a matter unrelated to the safe operation of their movement, they must respond by indicating that they are in a CFZ and tell the other employee to stand by. CFZs are intended to reduce or eliminate crew distractions when they are focusing on controlling the speed of the movement while approaching upcoming signals and restrictions.

A CFZ begins 3 miles from a Stop signal or the moment that the advance signal is observed and remains in effect until the movement has stopped for the Stop signal or the next signal has been identified to be permissive. While a CFZ is in effect, all crew members in the cab must communicate with each other approaching restrictions such as Stop signal indications.

When approaching signal 716S from the west, the track is tangent. On the day of the occurrence, the sightlines and visibility were clear, and hence the signal was unobstructed. As soon as the Clear to Stop indication on signal 716S became identifiable from within the locomotive cab, CN 372 was operating within a CFZ, which required focused attention on controlling the speed of the train while approaching the upcoming signal, and positive identification of the signal. However, after the conversation with the RTC ended, the crew’s attention was divided as they were discussing the upcoming task of setting off car HESX 52 (position 38). As a result, they did not see the Clear to Stop indication at signal 716S and did not realize that they were in a CFZ. They also did not identify or communicate the signal within the cab.

2.3 Signal recognition and compliance

In this occurrence, from Mile 82.1 until the crew on CN 372 made an emergency application of the train brakes approximately 500 feet before signal 694S at Mile 69.4, the train passed 5 block signals and 3 Rule 43 signals. Of these, the crew identified and vocalized only 1 signal (740S), suggesting an adaptation to Rule 34 of the Canadian Rail Operating Rules, which requires that train crews within physical hearing range identify and communicate to each other in a clear and audible manner (vocalize) each signal affecting their movements, such as block and interlocking signals, and Rule 43 signals (i.e., track-side flags). This rule is an administrative defence that is intended to reduce the risk that signals will be missed, misperceived, or misinterpreted, which could lead to reduced situational awareness and inaccurate mental models.

Given the crew's divided attention, the investigation could not conclusively determine whether the crew’s adaptation of not consistently calling signals played a role in the occurrence.

2.4 Physical fail-safe defences to ensure signal indications are consistently recognized and followed

The basic design of centralized traffic control (CTC) signalling systems in Canada has been well established for some time. Although newer signal circuitry has been integrated into the CTC system over the years, the safety of railway operations still relies predominantly on administrative defences. Administrative defences, if not supplemented by physical fail-safe defences, place an over-reliance on employees to follow rules and procedures that often do not consider the human factors that affect behaviour.

However, administrative defences have not proven to be fully effective in ensuring that signal indications are consistently recognized and followed and the issue of not following signal indications has been on the TSB Watchlist since 2012. The absence of physical fail-safe defences capable of intervening by slowing or stopping a train when operating in CTC territory and the absence of a passive warning system to alert a crew when they approach their limits of authority has been raised by the TSB in its investigation reports since 1995.

In this occurrence, there was a requirement for the train crew on CN 372 to comply with the signal indications, yet this administrative defence did not prevent the movement from going beyond a Stop signal. CN also introduced an additional administrative defence in the form of the CFZ that requires the operating crew to focus on controlling the speed of the movement while approaching upcoming restrictions to reduce or eliminate distractions. Despite CN having added this additional administrative defence, because the crew did not see the Clear to Stop indication at signal 716S, they were unaware that they were now in a CFZ and hence did not implement the CFZ procedure.

Physical fail-safe defences in the form of positive train control (PTC) technology have been implemented in the United States on all high-hazard routes, a total of 57 535.7 miles, or about 41% of the nearly 140 000 route-miles of the United States rail network since 29 December 2020. PTC is designed to automatically intervene to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. In February 2022, Transport Canada published a Notice of Intent, identifying its intention to require that the highest risk corridors in Canada be equipped with fail-safe, automatic train protection (referred to as enhanced train control or ETC) by 2030. In its January 2024 response to Recommendation R22-04, Transport Canada stated that it had taken steps in conjunction with industry partners to advance the implementation of ETC. However, details regarding which specific routes would require ETC and what the final solution for ETC would entail have not been determined. No interim measures to provide physical backup safety defences have been implemented to address the ongoing risk.

3.1 Findings as to causes and contributing factors

1. Eastbound freight train CN 372 passed signal 694S displaying a Stop indication at a speed of 43.2 mph on the south main track of the Canadian National Railway Company Kingston Subdivision as westbound VIA 67 was approaching on the same track at about 45 mph, resulting in a risk of collision.
2. The missed Clear to Stop indication at signal 716S resulted in the crew on CN 372 forming an inaccurate mental model of what to expect at the next signal. As a result, the crew was not prepared to stop at signal 694S (Wesco).
3. When the conductor on CN 372 reacted to the Stop indication at signal 694S by making an emergency application of the train brakes when the train was approximately 500 feet from the signal, there was insufficient distance for the train to stop before the signal. CN 372 and VIA 67 stopped 1100 feet apart.
4. The crew members on CN 372 were focused on preparing for a future task not related to the train’s immediate operation, which divided their attention from the primary task of safely operating the train in accordance with the signal indications. Consequently, they missed the Clear to Stop indication at signal 716S.

3.2 Findings as to risk

1. When adaptations are made to rules or procedures, safety margins built into these rules or procedures are often reduced, increasing the risk of unsafe operations and accidents.
2. In the absence of physical fail-safe defences to intervene when administrative defences fail, the risk of collisions and derailments is increased.

3.3 Other findings

1. A forward-facing video camera is a useful tool in an accident investigation; however, in this occurrence, the view from train CN 372’s locomotive camera was partially obstructed by a windshield wiper, resulting in a limited opportunity to identify the signal indication.
2. Because 35 minutes of voice data from train CN 372’s locomotive voice and video recorder system were not available, the TSB was unable to determine the verbal communications between the crew members for a portion of the trip, hindering the investigation’s ability to analyze crew performance.
3. Although the use of the company-issued tablets did not play a role in this occurrence, mitigation measures to reduce the risk of distraction need to take into consideration the potential for operating crews to simultaneously refer to operational information on electronic devices.
4. After the train went past signal 694S, which displayed a Stop indication, the timely emergency radio broadcast from the crew on CN 372 alerted the crew on VIA 67, which allowed them to stop their train in time to avert the collision.

4.1 Safety action taken

4.1.1 Transportation Safety Board of Canada

As a result of this occurrence and 2 other ongoing investigations,TSB investigations R23E0079 and R23V0205. on 17 April 2024, the TSB sent a letter to the Minister of Transport concerning the absence of physical fail-safe defences for trains operating in Canada. The letter stated that, despite the calls from the TSB for additional physical fail-safe defences in signalled territory since 2000 and the implementation of such a solution in the form of positive train control in the United States since 2020, the safety of the Canadian railway system continues to rely on administrative defences centred on compliance with rules by train crews. However, human factors science shows, and the TSB has demonstrated in multiple investigation reports, that even well-trained, well-meaning train crews will occasionally misinterpret or misapply signals and that administrative defences alone are not effective to prevent adverse outcomes. Furthermore, the letter stated that, since 2013, Transport Canada and the railway industry have been discussing the framework needed to address the issue and, while Transport Canada has taken positive steps toward identifying a solution for physical fail-safe defences in the form of enhanced train control, the pace of development is slow. Without physical fail-safe defences to protect train crews and the travelling public, there is a significant risk of collisions and a potential mass casualty event on Canadian railways. Given the risk to train crews and the travelling public, the TSB strongly urged the Department of Transport and the railway industry to accelerate the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and all key routes in Canada.

4.1.2 Canadian National Railway Company

On 15 April 2023, Canadian National Railway Company distributed Operating Bulletin No. 026 to all operating employees governed by the Canadian Rail Operating Rules. The operating bulletin introduced a special instruction to modify Canadian Rail Operating Rules Rule 578 so that the requirement to broadcast indications displayed on an advance signal is applicable not only in single-track territory, but in multi-track territory as well.

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 14 August 2024. It was officially released on 16 October 2024.   

Appendix A – Canadian National Railway Company System Operating Bulletin No. 007 introducing critical focus zones

The content of Canadian National Railway Company (CN) System Operating Bulletin No. 007, which introduces critical focus zones, is reproduced below.