Railway Investigation Report R03Q0003

On 20 January 2003 at 0928 eastern standard time, eastbound Canadian National freight train Q-148-91-18 collided with the Hi-rail vehicle of a track maintenance crew working at Mile 97.60 of the Montmagny Subdivision, near Saint-Charles, Quebec. The Hi-rail vehicle was destroyed and the lead locomotive was slightly damaged. There were no injuries.

Ce rapport est également disponible en français.

On 20 January 2003 at 0810 eastern standard time (EST),^{Footnote 1} the foreman of a Canadian National (CN) track welding crew received track occupancy permit (TOP) 16 from the rail traffic controller (RTC), authorizing him to occupy the main track of the Montmagny Subdivision between Signal 1007, Mile 100.70, at Saint-Charles, Quebec, and Signal 906, Mile 90.60, at Saint-Vallier, Quebec.

The foreman placed his Hi-rail vehicle on the main track at a public level crossing at Saint-Charles, then proceeded to the bridge over the Boyer River at Mile 97.60 (see Figure 1) to weld some rail joints. The foreman switched on his portable radio and the Hi-rail vehicle radio to the designated monitoring frequency, and switched on the exterior loudspeaker.

Image

Express train Q-148-91-18 (train 148) departed Joffre around 0910. It went through the signal at Saint-Charles east at 0925, which showed a normal speed signal since 0909. The members of the train crew called out the signal to each other as required by the Canadian Rail Operating Rules(CROR). Around 0928, the crew of train 148 saw the Hi-rail vehicle on the Boyer River bridge. With the train travelling at 64 mph, the locomotive engineer made an emergency brake application and sounded the locomotive whistle. The welding crew foreman saw the train coming from the west, and told his crew member to clear the track quickly to avoid the imminent impact. The Hi-rail vehicle was left standing on the bridge and the train struck it at a speed of approximately 60 mph. There were no injuries among the train crew or welding crew. The Hi-rail vehicle was a total loss and the locomotive was slightly damaged.

Train 148 consisted of 3 locomotives and 15 loaded multi-platform container cars. It was 3172 feet long and weighed 2027 tons. The train crew consisted of a locomotive engineer and a conductor, both of whom were in the lead locomotive. They both knew the route well, were fully qualified for their respective positions, and met rest and fitness requirements.

The welding foreman began his career with CN in 1967. He knew the area well, was qualified as a track maintenance foreman since 1972, and had work experience in areas governed by the Centralized Traffic Control System (CTC).

Traffic control

The CTC is a control system in which train traffic is controlled by signal indications. The CTC has controlled points where the RTC can throw switches to determine where the trains go. The RTC monitors the territory on a number of screens covering all the subdivisions managed from his console. Maintenance vehicle movements and track maintenance activities are protected by TOPs or by flag protection (CROR Rule 42).

In the CTC, the presence of a train in a block or at a controlled point activates an indication on the monitoring screen. Trains can be identified on the screen by the RTC using an identification tag. The arrival of a train at a controlled point sets off an audible warning in addition to the block or controlled point indicator. The RTC has no real-time indication as to the speed or exact location of the train within the territory (except when a train passes a controlled point). Most maintenance vehicles do not set off the signal systems; therefore, there is no indication that a maintenance vehicle is on the track. The only way that the RTC will know that maintenance vehicles may be on the track is if there is a TOP that the RTC himself created in the system or if there is flag protection.

RTCs control train traffic and the use of tracks by track maintenance vehicles through computerized traffic management systems and radio and telephone communication systems. RTCs use standard computer tools such as a keyboard, mouse and trackball to make entries in the various computers.

The section of track between Saint-Charles and Saint-Vallier is governed by CTC rules pursuant to the CROR under the supervision of the RTC at console No. 1 in Montréal, Quebec. The RTC at console No. 1 is responsible for the Pelletier Subdivision, between Mile 68.4 (Pelletier) and Mile 86.9 (Saint-André Jonction), the Montmagny, Lévis and Bridge subdivisions, and part of the Drummondville Subdivision between Mile 4.4 (Saint-Romuald) and Mile 11.2 (Saint-Nicolas). The territory also includes the main track, the by-pass track for the Joffre Yard, and the various spurs and branch lines.

The Joffre Yard is a relief terminal for train crews and is the base of operations for a large part of the track maintenance personnel in eastern Quebec.

All the subdivisions on console No. 1 are in the CTC, except for the Lévis Subdivision and some branch lines in the Occupancy Control System (OCS) territory. In the Montmagny Subdivision, the maximum authorized speed is 80 mph for passenger trains and 60 mph for freight trains. Express trains can exceed by 5 mph the speed authorized for freight trains.

Approximately 10 passenger trains and 20 freight trains travel in this territory each day. Consequently, many TOPs are issued to track foremen to allow Hi-rail vehicles and other equipment to use the tracks. During the day shift, the typical workload can consist of issuing 50 to 80 TOPs and controlling the movements of 15 to 30 trains.

Sequence of events

The RTC is qualified for his position and has been working for CN for 19 years. For the last six years, he has been working as a substitute RTC and is qualified on all consoles and territories, including console No. 1. On 20 January 2003, he came on duty at 0728; he felt rested when he started his shift, having taken two days off and slept about eight hours the night before the occurrence.

Between the start of the RTC's shift and the time of the accident, two passenger trains and six freight trains travelled through his territory. The RTC issued 9 TOPs and cancelled 11. He had about 70 telephone and radio calls.

At 0820, train 402 was eastbound on the Montmagny Subdivision and passed Cap-Saint-Ignace, Quebec (Mile 70.50).

At 0824, the RTC issued TOP 19 to a track foreman on the Montmagny Subdivision between La Pocatière, Quebec (Mile 42.60), and Kamouraska, Quebec (Mile 29.00).

At 0835, train 402 arrived at La Pocatière. At the same time, the foreman who held TOP 19 called the RTC on the radio, from La Pocatière, to cancel his TOP. The RTC selected TOP 16, instead of TOP 19, on the active TOP summary screen, then stated the number of TOP 19 and the name of the foreman who held it, but the RTC stated the limits of TOP 16, which was displayed on the monitoring screens. The foreman read back 19 as the TOP number and the limits of TOP 19. The foreman did not indicate to the RTC that he had not correctly read out the limits, nor was the foreman expressly required to do so under the CROR (see Appendix A). The RTC cancelled TOP 16, which he had on his screen, at 0836:02.

The RTC noticed that TOP 19 was still shown as active on the TOP summary screen. Thinking that the system had not captured the cancellation of TOP 19, the RTC called it back on the screen and cancelled it at 0836:45. The RTC did not notice that TOP 16 had disappeared from the system. There was no communication between the RTC and the foreman who held TOP 16.

At 0837, the RTC selected the itinerary of train 402, which was displayed on the monitoring screens, to allow the train to continue its route without delay.

Computerized rail traffic management systems

At CN, the computerized rail traffic management systems were put in place in the early 1990s. The first installation was done at Winnipeg, Manitoba, followed by Edmonton, Alberta, Kamloops, British Columbia, Prince George, British Columbia, Toronto, Ontario, and Montréal. The systems in use come from three different manufacturers. The ergonomic aspects of the RTC workstations are slightly different at each location.

The systems work the same for issuing a TOP, but differently for cancelling a TOP. Cancelling a TOP on the active screen in Toronto and part of the systems in Edmonton requires that the selection be confirmed by typing the selected TOP number before the system displays the cancellation screen in a dialog box, because these systems operate by keyboard character selection. Underscoring each box in the form on the screen is required on all systems, including the limits of the TOP and the name of the foreman. In Montréal and the other part of Edmonton, the computer system does not ask for confirmation of the selection by typing the number selected, since the selection is made on a graphic screen from a list of active TOPs.

In the summer of 2002, CN placed an order with Siemens AG for the design and installation of modern fully integrated systems to replace the various existing systems. Work is to be spread over three years.

Communication errors

Studies^{Footnote 2} by the Federal Aviation Administration (FAA) in the United States on communications between air traffic controllers and flight crews have shown that communication errors occurred in about 1 per cent of all communications. Further analysis of the cases in which these errors occurred showed that the flight crew incorrectly read back their instructions on flight clearance and that the controllers did not correct the errors in 47 per cent of the cases analyzed; there was no read-back by the crew in 25 per cent of the cases; and the controller did not recognize his or her error when the crew read back or did not correct the erroneous information in 18 per cent of the cases.

Further to these studies, the U.S. Federal Railroad Administration launched a project to establish a training program for RTCs to reduce errors in the reception and read-back of communications.

Occurrences involving maintenance vehicles

The TSB rail occurrence database was examined for the period 1995 to 2002 to determine the causes and contributing factors in occurrences involving maintenance vehicles on the tracks. During this period, there were 289 reported occurrences involving maintenance vehicles, including 98 collisions and 11 derailments.

Most occurrences had multiple causes and contributing factors. Examination of all reported occurrences revealed that human factors played a role in 164 occurrences. Lack of authorization was cited as a cause or contributing factor in 146 cases, followed by operating speed (37 occurrences), and communications (18 occurrences). With regard to collisions, operating speed was cited in 36 cases, lack of authorization in 19 cases, communication errors in 13 cases, environmental factors in 6 cases, and authorizations cancelled by mistake in 3 cases.

Managing risks of collision

Automatic systems for vehicle identification and separation have existed in the aviation and marine sectors for several years. Now, similar systems are starting to be introduced in railway organizations. For example, the Regional Transport Authority in Denver, Colorado, U.S., now has such a system, as do the Quebec North Shore and Labrador Railway (QNS&L) and Burlington Northern and Santa Fe Railway Company (BNSF).

QNS&L has been using positive identification and separation for vehicles and trains since 1997. All locomotives and maintenance vehicles using the main track have been fitted with proximity detectors. A proximity detector is a system that uses the global positioning system (GPS) to locate all vehicles on the track. The system reduces the risks of collision by activating an alarm at pre-set distances, and applies the train brakes if the crew does not take action.

Very recently, BNSF adopted a collision prevention system for its Hi-rail maintenance vehicles following a number of accidents involving these units. Also based on GPS technology, the BNSF system is integrated into the computerized traffic operation system and allows the RTC to locate Hi-rail vehicles within his or her area of responsibility. The system also allows Hi-rail vehicle crews to locate other Hi-rail vehicles in the same area.

Train 148 was being operated in accordance with existing regulations and operating rules. Therefore, the analysis will focus on the cancellation of TOP 16, the limitations of the computerized rail traffic management system used to manage TOPs, communications, and management of risks of collision.

Cancellation of TOP 16

RTCs are often required to perform several tasks simultaneously. It is common practice for an RTC to use the tools on the console to create protection in the operating system while talking on the telephone or radio with the requesting party. For example, from the start of his shift to the time of the accident, the RTC at console No. 1 was in communication with train crews or maintenance crews approximately every two minutes; during the same time period, he issued or cancelled 20 TOPs and controlled the movement of 8 trains.

The attention requirements when using communication systems like the radio and telephone and responding to calls are very high.^{Footnote 3} During peak periods, RTCs develop work strategies to be able to dispense with onerous memory tasks, to anticipate and plan ahead, and to put off until later certain lower-priority tasks that they must perform.

While speaking with the foreman at La Pocatière concerning the request to cancel TOP 19, which resulted in the inadvertent cancellation of TOP 16, the RTC, in addition to initiating the cancellation process for TOP 19 and talking to the foreman at La Pocatière, had to monitor the progress of train 402 that was arriving at La Pocatière. Since the itinerary of train 402 could not be selected as long as TOP 19 was still active, the RTC had to quickly cancel TOP 19 so as not to delay train 402. In order to do this, the RTC had to perform these tasks within a very short period while remaining in communication with the foreman and watching several different screens. In this situation, the RTC inadvertently selected TOP 16 on the summary screen instead of TOP 19.

It is generally acknowledged that humans have a limited capacity for processing information, and that, if they perform several tasks at the same time, they sometimes exceed this capacity especially when they are required to perform tasks requiring vigilance within a short period of time. The RTC issued TOP 19 within a very short period of time, because train 402 was approaching the limits of the TOP. This decision reduced the RTC's flexibility and put him in a situation of racing against the clock to avoid delaying train 402 when the cancellation request was made. Even though the RTC had only two tasks to do, performing them within a short period of time increased the risks of error and decreased the RTC's ability to perform his duties properly in order to ensure rail safety.

Computerized management system

Studies on the use of cursors^{Footnote 4} show that on-screen selection errors happen 9 per cent of the time on computer systems using pointers to select elements on a screen, irrespective of the device used, the operating system or the operator's experience. The RTC's selection of TOP 16 instead of TOP 19 on the summary screen was typical of this kind of selection error.

Due to such a high level of potential error, the design principles for computerized operating systems^{Footnote 5} commonly used to manage critical tasks incorporate error management as a basic function for detecting and correcting input and selection errors by users. The systems in Toronto and Edmonton have selection and underscoring confirmation features that perform this error filter function, but the system in Montréal does not have it. The lack of these functions in the management system in Montréal increased the risk of a selection error on the TOP screen.

Communications

The protective barrier in the CROR requiring read-back and identification of the TOP limits did not work as intended. After the RTC selected POV 16 by mistake, he read out its limits but did not react when the foreman at La Pocatière mentioned TOP 19 and stated its limits. The regulatory requirement to repeat all data relating to a TOP when it is issued or cancelled is the primary safeguard against errors by the RTC or the foreman. The existing regulations require that the RTC read out the data contained in the TOP form on the screen when a TOP is issued or cancelled, but there is no specific requirement for the foreman to repeat that information on a cancellation or to correct the RTC if the RTC makes a mistake.

According to the TSB database, the number of communication errors in the railway industry is relatively low, which indicates that the communication procedures put in place by the railways already minimize the risk of error. Studies by the FAA have shown that these types of errors were not frequent in aviation either; however, in 18 per cent of cases, errors were not detected despite read-back. Consequently, further progress could be made if all parties involved in a communication were required not only to read back the information received but to correct errors made by the other party.

Managing risks of collision

Although RTCs, through the traffic management system, are the link between trains and maintenance vehicles, they do not have a system for accurately identifying the relative positions of trains and maintenance vehicles. As a result, an RTC is unable to prevent collisions in cases where an error creates an authorization overlap, as in this occurrence. On Canadian railways, real-time identification and location of trains and maintenance vehicles is practically non-existent, making the RTC's task more difficult. Elsewhere in the industry and in other modes of transportation, traffic management and operational safety have been greatly improved by the use of vehicle identification systems whose information is transmitted in real time to operators and traffic controllers. The existence of such a system, which recognizes the identification and location of all vehicles on a given section of track, would have alerted the train crew and the welding crew and reduced the risk of collision.

Findings as to causes and contributing factors

1. While on an authorized movement, train 148 collided with a track maintenance vehicle whose track occupancy permit (TOP) was inadvertently cancelled by the rail traffic controller (RTC).
2. The protective barrier in the requirements in the regulations requiring read-back and identification of the TOP limits did not work as intended.

Findings as to risks

1. Even though the RTC had only two tasks to do, performing them within a short period of time increased the risks of error and decreased the RTC's ability to perform his duties properly in order to ensure rail safety.
2. The lack of an error filter function in the computerized management system in Montréal increased the risks of error in making a selection from the TOP screen.
3. Further progress could be made in reducing the number of communication errors if all parties involved in a communication were required to not only read back the information received but to correct errors made by the other party.
4. A system that recognizes the identification and location of all vehicles on a given section of track would have alerted the train crew and welding crew and prevented the collision.

To minimize communication errors, Canadian National (CN) issued a special instruction as a supplement to Canadian Rail Operating Rules (CROR) Rule 826 requiring that, when a track occupancy permit (TOP) is cancelled, the foreman read back the limits of the TOP to be cancelled. The instruction also requires that the RTC read back the TOP limits to the foreman.

CN has placed an order with Siemens AG for new computerized rail traffic control systems (RTC 2). They will be installed in all railway control centres. These systems use a revised method for managing TOPs and include a process for transmission, read-back and underscoring that includes the limits of the TOP to be cancelled. The RTC will be able to select the desired TOP directly from a geographic representation of the section of track to be protected, instead of using a mouse to select from a list on a graphic screen. The name of the foreman will be superimposed on the protected section of track on the monitoring screen. The systems will include a number of improvements that will reduce the number of authorization forms and, consequently, reduce the RTC's workload.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 26 August 2004.

Appendix A - Procedure for cancelling track occupancy permits

In Canadian National's operating rules dated 01 March 2002, Rules for the Protection of Track Units and Track Work, the procedure for cancelling a track occupancy permit (TOP) was as follows:

826. When a TOP is no longer required:

1. the foreman must promptly advise the RTC, stating the foreman's name, the TOP number and the limits of the TOP;
2. the RTC must cancel the TOP by stating to the foreman the TOP number, the foreman's name, the limits of the TOP, the cancellation time and the initials of the RTC;
3. the foreman must acknowledge the cancellation by repeating the TOP number, the cancelled time and the initials of the RTC to the RTC;
4. the cancellation does not take effect until it has been correctly repeated and acknowledged by the foreman.