Railway Investigation Report R95W0291

On 05 November 1995, at approximately 0240 Central standard time, a remotely controlled hump yard assignment shoving 85 cars towards the hump in the Canadian National Symington Yard in Winnipeg experienced an undetected train separation attributable to a broken yoke which ultimately led to the derailment of one locomotive and twelve cars on the north pull-back track. The derailed cars fouled the adjacent south pull-back track and were struck by another remote-controlled hump yard assignment, derailing two locomotives, two booster units and sixcars from that assignment. There were no injuries.

The Board determined that, in both accidents, the remote control operating system did not provide the operators with safeguards and technology sufficient to ensure the safe operation of their respective assignments.

Ce rapport est également disponible en français.

1.1 The Accident

1.1.1 Background

1.1.1.1 Symington Yard

The Canadian National (CN) Symington Yard, located in east Winnipeg at Mile 145.2 of the Sprague Subdivision, is a major humping facility and has been operating with radio control Locomotive Control System (LCS) technology since 1989. The dual hump and associated trackage is situated in the south-east quadrant of Symington Yard. The crest of the hump is oriented such that cars are humped westward from the north and south pull-back tracks over the hump and into the classification tracks. The pull-back tracks are both approximately 8,300 feet in length and are parallelled by adjacent tracks which are connected by a series of crossover tracks and switches. Overhead lighting illuminating the pull-back tracks extends to the four-lane Trans-Canada Highway overpass over the eastern portion of the yard approximately 2,000 feet east of the hump crest. The highway overpass restricts LCS operators' ability to see the eastern portion of the pull-back tracks while standing at the hump crest.

1.1.1.2 Locomotive Control System

LCS is a method of controlling a locomotive from a remote location. The three major components of LCS are:

1. Locomotive-based Equipment
   A standard locomotive is equipped to operate by remote control. Control commands are received by radio equipment on the locomotive and processed by an on-board computer to initiate the appropriate locomotive responses. Locomotive status reports are transmitted to a beltpack controller operator.
2. The Beltpack Controller The beltpack controller transmits the operator's commands to the locomotive consist. LCS includes an electronic talker that will, when activated by the operator, audibly indicate the condition or faults of the locomotive at any given time. Safety features include a tilt-detection device to apply the train brakes. Should the beltpack be tilted off vertical more than 45 ° for more than one second, a high-pitched alarm sounds for three seconds. If the beltpack is not righted within three seconds, the computer initiates an emergency brake application. (The time limit can be extended to 60 seconds by the operator to facilitate between-car coupling work.) A reset safety device will also apply the locomotive brakes should the beltpack controls be unmanipulated for a period of 60 seconds (an audible alarm is first sounded, to which an operator must respond by pushing a reset button or initiating a control change).
3. Ground-based Equipment
   1. Pull-back Stopping Protection
      • This system will override operator speed commands and either slow the movement or bring it to a stop. It consists of three subsystems: transponder, tether tone and track circuit.
        1. Transponder Subsystem
           Transponders are imbedded in the ties along the pull-back tracks. They taper the speed of the movement along the track to ensure that it will stop before the end of the pull-back tracks. Each transponder is read by an interrogator mounted on the locomotive. As the locomotive passes, the information is transmitted to the computer on the locomotive, which adjusts the speed if necessary.
        2. Tether Tone Subsystem
           This subsystem consists of a transmission line, which is installed along the pull-back tracks, and a receiver in the locomotive. The transmission broadcasts a pair of specific tones that must be received by the locomotive when it is moving in either direction on the pull-back tracks. If the locomotive exceeds the boundaries of the transmission line, an emergency brake application will occur.
        3. Track Circuit Subsystem
           These circuits monitor exclusive occupancy of the track and speed of the movement. This subsystem will shut down the locomotives if the track is otherwise occupied or if an unsafe speed is sensed.
   2. Radio Repeater Station A strategically located transceiver receives and retransmits messages between the locomotive and the beltpack. The transceiver has a range of 2.5 miles. Under certain conditions, i.e., proximity with the locomotive or transceiver malfunction, the system can be adjusted to work without the transceiver, but at greatly reduced range (1 mile).
   3. Dragging Equipment Detectors
      Dragging equipment detectors (DED) are designated and located as follows:
      • 1 East - approximately 5 cars east of the crest on the south pull-back track;
        1 West - approximately 5 cars east of the crest on the north pull-back track;
        2 East - immediately east of the overpass on the south pull-back track;
        3 East - approximately 10 cars east of the overpass on the south pull-back track;
        3 West - approximately 10 cars east of the overpass on the north pull-back track;
        4 East - approximately 1,400 feet east of the overpass on the south pull-back track;
        4 West - approximately 1,400 feet east of the overpass on the north pull-back track; and
        RX3 - immediately east of connection on the run-through lead to RX3 on RX3.

1.1.2 Operators' Experience

On 04 November 1995, the operator (Operator A) assigned to the LCS-controlled 2300 hump yard assignment (Assignment A) began switching operations just after 2300^{Footnote 1}. Operator A successfully pulled cars from west receiving track No. 08 onto the north pull-back track, in preparation for humping. While standing on the crest of the hump, Operator A pushed cars westward towards the hump. The cars moved towards him as expected, until approximately 0230, when the cars appeared to slow and stop despite several speed setting adjustments. After the movement had stopped and he had made numerous additional attempts at speed modulation, he requested a status report and recalled hearing a talker message "recover from beltpack." He executed the recovery process and, after receiving an automatic talker that this had been done successfully, initiated commands to continue shoving. The cars did not then move westward as expected and he made numerous speed setting changes before placing the speed setting in "stop" and requesting another status report which verified that the operation was normal. He then attempted to move the cars and, after several attempts, noticed westward movement and humped about 20 cars without any apparent difficulty. Shortly after 0300, movement up the hump stopped and Operator A initiated a series of commands over the next 45 minutes to regain control of his assignment. At approximately 0345, the yardmaster notified him that there had been a derailment in the pull-back track area and further humping attempts ceased.

The LCS-controlled 2355 hump yard assignment (Assignment B) began humping operations at approximately 2355. At approximately 0250, the operator of Assignment B (Operator B) was standing on the north side of the south pull-back track in an area adjacent to the south pull-back crossover switch, approximately 2,000 feet east of the hump crest, pulling cars onto the south pull-back track from the west receiving yard when movement stopped. Operator B made a status request and the talker message advised that his movement was stopped due to a communications interrupt. Operator B then recovered the emergency from beltpack as instructed and, before moving, called the tower and requested an inspection. Within approximately 4-6 minutes, the tower advised that the inspection had revealed nothing unusual, and Assignment B was cleared to proceed. Operator B was unaware that the yardmaster had received a DED alarm. Operator B made several unsuccessful attempts to move the train and again called the yardmaster to request that another inspection be done. It was then that Operator B became aware of the derailment.

At approximately 0250, the hump tower received a DED alarm for the 4 East location and the yardmaster stopped hump operation on the south pull-back track as required. He then notified the Equipment Department, which dispatched a carman to inspect the assignment on the south pull-back track. The carman drove to the south side of the south pull-back track and began to walk eastward from the hump area to the area of the highway overpass. He observed nothing unusual (e.g., marking on the roadbed or snow) and radioed the Equipment Department with this information. He returned to his truck and proceeded to the north side of the track, where he discovered the pile-up of cars.

1.1.3 Accident Site Information

1.1.3.1 The Derailment Area

Marks were observed on the ties and in the ballast of the north pull-back track approximately 5,300 feet from the crest of the hump. Truck springs and other truck components were lying between the rails and on the south-side ballast just west of the marks. The ballast south of the north pull-back track was then heavily marked from this point to a wheel set lying on the ballast approximately 5,100 feet east of the hump crest. A truck determined to have originated from flat car OTTX 93318, the 9th car from the locomotives of Assignment A, was located on the south side of the north pull-back track, approximately 4,700 feet east of the hump crest.

The main pile-up of cars from both assignments, covering both the north and south pull-back tracks and two adjacent tracks, was located approximately 3,500 feet from the crest of the hump or 1,500 feet east of the Trans-Canada Highway overpass. Four flat cars from Assignment A had been shoved alongside the first non-derailed car on the westerly portion of the assignment, CGTX 65064, a load of propane, UN 1978, a liquefied petroleum gas. Two other flat cars had been shoved onto car CGTX 65064. Car CGTX 65064 had only suffered denting to the jacket and it was quickly determined that there was no threat of a dangerous good release. The most westerly portion of the pile-up came to rest approximately 100 feet east of the most easterly DED on the north pull-back track.

It was noted that car CGTX 65064 was the first of six loaded liquefied petroleum gas tank cars marshalled in a block in this area of the assignment.

The lead locomotive from Assignment B had been derailed upright and southward. The leading truck had marked the ballast south of the south pull-back track for approximately 200 feet from an area approximately adjacent to the pile of cars from Assignment A. The other locomotive and two booster units were derailed and upright but tight to the rails as were the first two derailed cars. The following four cars were lying on their sides, south of the south pull-back track.

1.1.3.2 Damage to Car OTTX 90999

An examination of the derailed equipment revealed that the west end of car OTTX 90999 (the 11th car from the locomotive consist of Assignment A) had a broken yoke and was missing the coupler mechanism. The yoke is located in the underframe of the car and is enclosed within the car's centre sill. Further examination revealed that approximately 50 per cent of the fracture surfaces on the top strap of the yoke were covered with rust and the mating surfaces were smooth in appearance. The bottom strap had no rust, and the mating surfaces appeared rough.

Car OTTX 90999 had received a routine car inspection on 04 November 1995 at Symington Yard. No defects were noted during this inspection. Most of the yoke is hidden from view and the area of the break would not have been visible to the car inspector.

1.2 Injuries

There were no injuries as a result of this accident.

1.3 Damage to Equipment

Twelve cars were destroyed, and one locomotive and one car received minor damage in Assignment A.

One car was damaged beyond repair, and two locomotives, two booster units, and five cars received minor damage in Assignment B.

1.4 Other Damage

Approximately 200 feet of the north pull-back track and about 400 feet of the south pull-back track sustained minor damage.

1.5 Personnel Information

Operator A was a yard service employee who had qualified as a trainman in 1989 and qualified in LCS operations in 1993. Since his LCS qualification, he had worked at least 50 shifts on a relief basis using LCS. At the end of October 1995, he obtained a regular scheduled assignment involving regular LCS operations. He began this assigned shift three days before the occurrence.

Operator B was a yard service employee who had qualified as a trainman in 1980 and qualified in LCS operations in 1988. Since his LCS qualification, he had worked at least 500 shifts. He had worked a scheduled LCS assignment since 1992.

1.6 Train Information

Assignment A, powered by 2 locomotives and 2 booster units, was shoving 64 loaded cars and 21 empty cars and included 10 loaded and 4 residue dangerous goods tank cars. The assignment was about 5,550 feet long and weighed approximately 8,150 tons.

Assignment B consisted of 2 locomotives and 2 booster units and was pulling 41 loaded cars and 39 empty cars. The assignment was about 5,600 feet long and weighed approximately 6,950 tons.

1.7 Weather

The temperature was minus nine °C, with light winds.

1.8 Recorded Information

The computerized LCS memory on each controlling locomotive was downloaded. The following charts depict key recorded events leading up to and following this occurrence.

Assignment A - Locomotive CN 7530

Assignment B - Locomotive CN 7522

1.9 Other Information

1.9.1 Recent Experiences with LCS Technology

From 23 October 1995 to 05 November 1995, there had been eight occasions in Symington Yard where hump assignments experienced communication failure. Corrective measures included battery and antennae change-outs, receivers tuned or changed-out, and transmitters replaced. On 04 November 1995, there had been intermittent communication problems on three hump assignments between the hours of 0900 and 2240 that interfered with normal humping activity. The emergency brake applications from these failures often required equipment inspections to be performed. Employees' experiences with these inspections were that the failures were technical problems within the LCS equipment, and not problems with the rolling stock being handled.

1.9.2 Manitoba District Notice

On 26 August 1994, a District Notice (MD 4066/94) was issued to all CN employees concerning LCS:

• When LCS movements experience an emergency application of brakes (i.e. loss of communication) and a speed of four miles per hour or more is selected on the beltpack, the movement must be inspected to ensure there is no damage to equipment or lading before resuming movement.

1.9.3 Dragging Equipment Detection

The Winnipeg Terminal Operating Manual outlines instructions with respect to Dragging Equipment Detection and LCS operation:

• Dragging equipment detectors are located east of the hump crest on "RX-3", "NP" [north pull-back track] and "SP" [south pull-back track]. When tripped, HPCS [hump process control system] will stop humping, the hump and cab signals will display "STOP" indications with audible warning and indication on the crest display boards and Yardmaster's Video Display Monitor. Location of dragging equipment will be displayed on the Yardmaster's Video Display Monitor. Yardmaster will reset the DED and advise Car Foreman. The Car Foreman will then arrange for inspection of equipment. After equipment has been inspected, Car Foreman will release track to Yardmaster who will resume humping.
• When the humping operation is stopped by dragging equipment, humping must not resume until authorized by Yardmaster "C" Tower.

1.9.4 LCS Operations Oversight

There are no government safety requirements specific to LCS operations, nor industry-wide operating practices and equipment standards; however, the Canadian Rail Operating Rules and company operating bulletins and instructions apply to LCS operations.

1.9.5 Decision Making

People performing a complex job, such as controlling a train through the use of LCS, require an adequate level of situational awareness when implementing plans and making decisions to effect safe train movements. Situational awareness can simply be defined as knowing what is happening around you. The attainment and maintenance of situational awareness is dependent upon the following steps:^{Footnote 2}

1. The perception of the situational elements from various sources, such as the LCS visual and auditory displays, and the movement of the train itself.
2. The integration of this information based on the individual's experiences and knowledge.
3. The projection of this information into the future to make and modify plans as necessary.

Often, decisions are not based on optimal decision-making strategies; i.e., forming choices, considering alternative choices, assessing the possible outcomes of each choice and evaluating the relative utility of each outcome.^{Footnote 3} Rather, the decision maker, based on prior experiences, may recognize the situation as familiar, and choose a course of action that has been used in the past. The more frequently a course of action has been successful, the more likely it will be chosen again. This method of decision making can become problematic when the assessment of the situation is inaccurate and results in the selection of a course of action that is ineffective or incorrect.

2.1 Introduction

This accident demonstrates that the carefully considered and electronically safeguarded remote-controlled hump assignment operation is not without safety risk. It is believed that the manner of the derailment, in that motive power was unknowingly used to push cars into a pile, presented considerable risk to dangerous good car breach and as such presented a safety and environmental hazard. The analysis will explore both the proximate cause of the accident and the system weaknesses that permitted events to unfold as they did.

2.2 Consideration of the Facts

2.2.1 Operator Proficiency

Both operators were qualified for LCS operation and had significant experience in LCS duty. A lack of familiarity with the system methodology or equipment is not considered to be a factor.

2.2.2 The Initial Derailment

At a time recorded as 0229:48 on the LCS hump download archive, the locomotive emergency brakes on Assignment A, moving westward at 9.6 mph, were automatically applied when communication between the radio repeater and the locomotive was disrupted. The partially fractured yoke on the 11th car completely failed under the stresses imposed by the heavy locomotive braking effort in an emergency brake application. This should have been a minor incident; the locomotives and 11 cars stopped relatively quickly while the remaining cars slowly rolled to a stop. However, the beltpack operator was initially unaware of the emergency brake application and had no inkling that a train separation had occurred. He carried out a series of manoeuvres with his beltpack, established that there had been a communication interrupt and emergency brake application, and recovered beltpack control. At a recorded time of 0235:24, he instituted westward movement but the cars in his sight did not move. After carrying out another series of beltpack manoeuvres, including a stop and talker verification that the system was working as intended, he instituted commands to resume humping. At a recorded time of 0239:09, as indicated by a recorded velocity change event, he heavily struck the separated portion of his assignment standing with the most easterly car (12th) 5,300 feet from the crest of the hump, derailing a truck from either the 11th or 12th car. The derailed assignment was then shoved westward, with the 9th car becoming derailed a further 200 feet to the west. Operator A continued shoving until a recorded time of 0301:10, during which time westward movement had continued for another 400 feet and cars had begun to leave the track and be pushed into a pile.

2.2.3 The Second Derailment

At a time of 0253:00, as recorded by the LCS hump archive download, Assignment B experienced a wheel slip while moving at a recorded speed of 11.3 mph. The wheel slip event was immediately followed by an emergency brake application and a loss of radio communication. These events represent Assignment B sideswiping cars from Assignment A and derailing. These cars would have been partially blocking the south pull-back track. At the time, Operator B was positioned approximately 1,500 feet from the derailment location and had no way of discerning the pile-up of cars in the dark pull-back track area as he guided his assignment into the south pull-back track. Operator B continued to manipulate his beltpack controls until a recorded time of 0315:23 or 22 minutes and 23 seconds after he lost control of his assignment due to the derailment.

2.2.4 Situational Awareness

The continued westward movement of the westward end of Assignment A (after the emergency brake application caused by the communication interrupt) was out of the experience or expectation of Operator A. Train separations are a rare event and most often occur while pulling. During the time that the separated portion of the movement rolled to a stop, Operator A carried out a series of speed adjustments. Although he had set the speed control to 15 mph, the possibility that the emergency brake application had occurred at a time when the speed setting was at or over 4 mph (requiring that the movement be inspected) did not come to mind. The decision to attempt to continue the movement seemed to be a reasonable course of action, as his current circumstances matched those of the recent events involving loss of communication with the locomotives due to repeater malfunctions. Such previous events involved no unsafe conditions.

2.2.5 Safety Features

Despite the safety features built into the track structure and the apparent fail-safe nature of LCS hump operation, two LCS hump assignments were involved in a collision and derailment. An examination of both systems is warranted.

2.2.5.1 Track Safety Features

Although the eastern portion of the pull-back track was without lighting and partially obscured from the hump area even in daylight, the track safety features included systems to protect LCS equipment from entering onto a track already occupied, from pulling beyond the limits of the pull-back track, from unsafe speeds, and from exceeding the boundaries of the LCS operation, and provided warning if dragging equipment was present. The design of the system appeared to have anticipated every potentially unsafe situation possible in routine hump operation and seemed to protect the visually unmonitored and largely unobservable east pull-back track from all eventualities.

The DEDs were strategically located for exposure to cars being moved over the crossovers to the pull-back tracks, as cars are sometimes derailed at these locations. Although the most easterly DED on the south pull-back track was activated, most probably by the last few derailing cars of Assignment B, which had rolled onto their sides west of the pile-up of cars in the area of the DED, the eastern extremities of the pull-back tracks had no DEDs and offered no electronic means of detecting a derailment. A system to electronically detect derailed equipment on the eastern portion of these tracks would improve safety.

The derailed cars from Assignment A fouled the south pull-back track and may or may not have contacted the rails. In any event, they did not activate the track circuit subsystem, which requires that equipment contact both rails. There was no ground-based system to detect the presence of an obstacle partially fouling the track, nor a device on the locomotives to sense that the way was obstructed.

It is noted that an electronic system on the classification tracks provides warning of train separation to ensure coupling after humping. This system helps to ensure efficient hump operation and, when viewed in the context of the subject accident, has apparent safety benefits.

2.2.5.2 LCS Safety Features

It could be argued that Operator A did not comply with the requirement to inspect this movement after experiencing an emergency brake application with the beltpack controller set at a speed of 4 mph or higher, and that such an inspection would have led to the discovery of the train separation and averted the accident. In this instance, however, several minutes elapsed between the time that Operator A initiated the movement and the time that it had unexpectedly stopped. During this interval, he had selected several speeds, gradually raising the speed setting in an effort to increase the speed of the slowing movement. (As the latter speed settings were requested after the emergency brake application, and therefore were unrecognized by the LCS, they are not directly relevant to the problem at hand.) It seems that this accident has revealed a weakness in instructions governing operator behaviour when unintended emergency brake applications occur.

The communication interrupt-induced emergency brake application evokes neither an audible alarm nor a visual indication on the beltpack. Although such an event (emergency brake application) is obvious, as the movement quickly stops, this accident, where the observable portion of the movement continued on, has demonstrated that a warning feature is desirable. Indeed, an alarm indicating an emergency brake application at a time when continued movement was evident could immediately alert an operator to a train separation.

The hump archival download indicates that Operator A continued to manipulate his LCS controls, achieving limited recorded locomotive movement, until 0343:19. Assignment B had stopped and was unresponsive to radio commands at 0257:13, but the recorded data indicate that Operator B continued to manipulate his beltpack, in an effort to gain control, until 0315:56.

Of concern is the extent of beltpack manipulation after the movement of both assignments had ceased. Lacking feedback (i.e., the movement of their respective assignments in reaction to their requests), both operators made repeated attempts to establish control, over a protracted period. It is apparent that the operators, having become accustomed to communication interruptions, and to solving such problems on their own, tended to treat locomotives' apparent inability to respond as a radio issue. In assuming that this lack of response was a radio communication problem, each attempted to overcome the problem through manipulation techniques. It would seem that such an activity is inappropriate and, under the circumstances experienced by Assignment A, could be a safety concern and a training issue.

2.2.6 Visibility

Hump assignment operators cannot fully observe the eastern portions of their movements. In daylight conditions, their range of vision is restricted by the Trans-Canada Highway overpass, and the area is unlit, further restricting visibility at night. In all likelihood, both the train separation and the original derailment would have been visible to Operator A had the pull-back tracks been lit to their eastern extremities. Had the area been lit, Operator B would likely have noticed the derailed cars from Assignment A, and so stopped his movement; the car inspector dispatched to inspect the south pull-back track would have seen the derailment; and the whole event would have been visible from the hump tower. Lighting, coupled with a form of video surveillance, would enhance safety.

2.2.7 Government Safety Standards

LCS is used in both hump operation and flat switching by CN and Canadian Pacific Railway. It has allowed companies to reduce individual yard crews by one person, in both flat switching (three to two) and in hump operation (two to one). The crew member eliminated is the locomotive engineer. LCS operation is currently restricted to intermediate and major yards but will no doubt see expanded use. It also sees limited service on main tracks for local switching, and this application is also expected to increase.

As this accident and others (TSB reports R96T0080 and R96W0246) have demonstrated, LCS operation involves safety risks unique to this method of control. Some type of regulatory oversight or the development of industry-wide operating and equipment standards may be warranted.

1. Assignment A experienced an undetected train separation attributable to a broken yoke on the eleventh car from the locomotive consist.
2. Operator A struck the separated portion of his assignment, derailing one car.
3. The derailed assignment was shoved for approximately 600 feet before a general pile-up of cars occurred.
4. Locomotive power was inadvertently used to derail and push cars into a pile.
5. Assignment B derailed when it struck derailed cars from Assignment A.
6. LCS methodology, safeguards and technology were not sufficiently developed to prevent collisions and derailments in every circumstance.
7. There is no LCS regulatory oversight nor related industry-wide operating and equipment standards.

3.1 Cause

In both accidents, the remote control operating system did not provide the operators with safeguards and technology sufficient to ensure the safe operation of their respective assignments.

4.1 Action Taken

In October 1996, the TSB forwarded a Rail Safety Advisory to Transport Canada (TC), with copies to Canadian National, Canadian Pacific Railway and the Railway Association of Canada, addressing safety issues associated with the use of Locomotive Control Systems (LCS). These issues were all present in this occurrence: the reduced monitoring of movement operations under single-person LCS use; the possibility of "communication failure" status masking other problems with the movement; and the use of remote "brake recovery" without having done a physical/visual inspection to confirm the status of the movement subsequent to an emergency brake application. The TSB suggested that TC, in conjunction with the railways, may wish to review LCS procedures, with a view to ensuring the adequacy of the monitoring of movements under LCS control.

In response, TC indicated that there are no specific federal regulations or rules that govern the recovery method or any other aspect of LCS. The only requirement is that, while operating LCS equipment, the employees have to comply with all applicable Canadian Rail Operating Rules and other federal regulations.

Canadian National has reported that communication failures have been reduced 95 per cent since this accident occurred, through the introduction of improved equipment.

Furthermore, the system has been modified and it now automatically initiates a controlled stop of the locomotive in the event of a communication failure between the locomotive and the control device.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson Benoît Bouchard, and members Maurice Harquail, Charles Simpson and W.A. Tadros, authorized the release of this report on 26 August 1998.