Railway Investigation Report R09T0057

On 11 February 2009 at 2118 Eastern Standard Time, the Southern Ontario Railway 0900 Hagersville Switcher, consisting of 4 locomotives and 43 cars, ran uncontrolled from Mile 0.10 to Mile 1.9 of the Hydro Spur track. The train reached a speed of 20.7 mph before travelling over a split switch derail and derailing 9 loaded dangerous goods tank cars. Three tank cars loaded with gasoline (UN 1203) were breached and released approximately 31 000 litres of gasoline. Two nearby homes were evacuated; there were no injuries.

On 11 February 2009, the Southern Ontario Railway (SOR) 0900 Hagersville Switcher (the train) was switching rail cars in various industrial tracks around Nanticoke, Ontario (see Figure 1). The train was powered by four locomotives with RLK 4057 in the lead position and RLK 3873 in the trailing (fourth) position. The train was handling a total of 43 cars, with 13 loads of steel, 14 tank car loads of dangerous goods (DG), and 16 residue DG cars. The train weighed 3561 tons and was 2904 feet long. The train crew, a locomotive engineer, a conductor, and an assistant conductor, were familiar with the territory and met fitness and rest standards.

Image

Current federal work/rest regulations permit train crews to work for up to 12 consecutive hours^{Footnote 1}. During a 12-hour day shift, the train delivers cars to customer tracks and lifts outbound cars from those tracks. At the end of the day shift, SOR's Train Service Plan (dated 01 July 2007) instructed crews to leave the train at Garnet Yard, where the train is re-designated as the 2200 Brantford Turn and the crew is changed for the night shift. However, it was accepted company practice to allow crews to deviate from the service plan by leaving the train on the Hydro Spur, just south of the 3rd Concession Road crossing (the crossing) at Nanticoke. Crew members also leave their vehicles near this location, where they have easier access to the train.

The accident

Because of a heavy workload, the assistant conductor was added to the crew to assist with switching duties. The crew began their shift at 0900^{Footnote 2} on the day of the occurrence. For most of the shift, the assistant conductor worked outdoors in near-freezing temperatures and periodic heavy rains. Late in the shift, the assistant conductor, who was also a Canadian National (CN) qualified locomotive engineer, exchanged duties with the locomotive engineer.

To expedite tasks, train securement and administrative office duties were often done concurrently. In this case, the crew members were nearing the end of their 12-hour shift, with about 20 minutes of paperwork yet to complete. The assistant conductor was to secure the train while the locomotive engineer and conductor travelled to the office in Hagersville to complete the paperwork.

At 2105, with the assistant conductor operating from trailing locomotive RLK 3873, the train began its last move of the shift by shoving southward onto the Hydro Spur. The conductor and locomotive engineer had detrained and were waiting in a vehicle at the crossing for the train to pass. Once the train was clear, they departed for Hagersville, about 20 minutes away. At 2146, they faxed the paperwork to the Operations Office in Stellarton, Nova Scotia, after which they left for home.

At 2114, the assistant conductor brought the train to a controlled stop just south of the crossing (see Figure 2) with the locomotives coupled, the brake pipe connected, and the engines running. The plan was to secure the train and to change locomotives by setting lead locomotive RLK 4057 into the controlling position^{Footnote 3}. In preparing for the change of control, the assistant conductor set the MU2A valve on the control stand of RLK 3873 to the "Trail" position and the automatic brake cut-off valve to the "Cutout" position. The assistant conductor then detrained and departed the site without placing lead locomotive RLK 4057 in the controlling position. It is not known whether, or how many, handbrakes were set.

Hydro Spur diagram (not to scale)

Image

Just after 2200, the replacement crew for the 2200 Brantford Turn arrived at the crossing, but the train was not at the pre-determined location. An SOR employee was sent to investigate and reported that cars had derailed further south on the Hydro Spur, beyond the unprotected 2nd Concession Road crossing, and that the smell of gasoline was present. Staff at the nearby Imperial Oil plant were informed, and the plant's emergency response team (ERT) responded, along with the Haldimand County Fire Department. The ERT and fire department arrived on site by 2300. Two homes in the immediate vicinity of the derailment were evacuated at that time. There were no injuries or fire.

Site inspection

The nine tail-end cars of the train (35th to 43rd) derailed at a split-switch derail located at Mile 1.9 of the Hydro Spur, about 100 feet north of Rainham Road (see Photo 1). The derailed cars came to rest in various positions. These nine DG tank cars included seven loads of gasoline (UN 1203) and two loads of fuel oil (UN 1202). Three tank cars loaded with gasoline, the 38th, 40th, and 42nd cars respectively, were damaged and released product.

Image

Approximately 31 000 L of gasoline were released from three cars. About 10 000 L of the released product entered the surface water system in ditches adjacent to the track and were lost to the environment. Approximately 300 feet of track was destroyed.

Recorded information

The table that follows presents information from the event recorder of locomotive RLK 4057:

TSB calculations based on train make-up and air brake characteristics determined that at 2114:07, when the brake pipe pressure reached 65 psi at the lead locomotive, brake pipe pressure at the tail end of the train was approximately 70 psi.

Train air brakes

Post-accident inspection determined that the locomotive air brake systems were functioning as designed.

Trains operate with an air brake line charged to approximately 90 psi. A full service brake application reduces the train air brake line pressure to about 65 psi. To make a full service brake application, the locomotive engineer places the automatic brake handle on the locomotive control stand in the "Full Service" position; air is subsequently vented from the control valve on the lead locomotive. This action reduces air pressure in the train air brake line and initiates a brake application on each subsequent car. Similarly, charging the air brake line increases pressure in the brake line and initiates a brake release on each car.

Because of the length of the train air brake line, initiation of a full service brake application reduces the head-end air brake pipe pressure below the level of the tail-end air brake pipe pressure. The resulting pressure differential between the head end and tail end of the train can be as high as 12 psi. To equalize the pressure differential, the automatic brake handle on the control stand must, once the train air brake line display in the locomotive reaches 65 psi, remain in the "Full Service" position until pressure in the air brake line equalizes and the control valve ceases to exhaust air.

In most modern freight cars, air brake control valves have a quick service release feature. These valves sense increases in brake pipe air pressure (a brake release) and release air from the auxiliary reservoir (emergency portion) to charge the brake line and speed the brake release process. As little as 1.5 pounds of pressure differential can activate the quick release feature, and once activated on one car, the release is sequentially triggered on subsequent cars. Moving the automatic brake handle out of the "Full Service" position before the brake valve fully exhausts can create a rear-to-front pressure wave within the brake line that attempts to balance the pressure differential. This pressure wave can initiate a quick service brake release.

Southern Ontario Railway, Subdivision and Spur information

RailAmerica, Inc. (RA) is one of the largest owners and operators of short-line freight railways in North America, with a portfolio of 40 railways. As one of RA's Canadian operations, SOR is a federally regulated railway. RA railways are operated as independent businesses with local management responsible for daily operations. However, in Canada, some common RA operations functions, such as rail traffic control operations in North Bay and car control/train planning operations in Nova Scotia, are shared between SOR and other Canadian-operated RA subsidiaries. The SOR interchanges cars with CN at Brantford and both CN and Canadian Pacific Railway at Hamilton. SOR handles about 42 000 carloads annually and at the time of the accident had a total of 40 employees. SOR had 28 operations staff, including one trainmaster and two operations coordinators.

The SOR Hagersville Subdivision extends from Nanticoke (Mile 0.0) to Simpson (Mile 35.0). Rail movements on this subdivision are governed by the Occupancy Control System of the Canadian Rail Operating Rules (CROR) and supervised by a rail traffic controller in North Bay, Ontario. The maximum authorized speed on this line is 30 mph. At the time of the occurrence, about two trains operated daily on the Subdivision. The Hydro Spur (Mile 0.0) extends south off of the Hagersville Subdivision and descends southward to Lake Erie at a 1% grade. An Imperial Oil refinery is located just south and east of Mile 0.0 and an Ontario Hydro facility is located at the southern extremity of the spur (Mile 3.17). Train movements on the spur are governed by CROR Rule 105 and have a maximum authorized speed of 10 mph.

Crew training and information

Operations on the Hagersville Subdivision are subject to RA's General Operating Instructions (GOIs). Crews on this subdivision also operate on CN interlocking tracks, and CN requires them to carry a CN rules card, a practice that is common in the industry when short-line railways have operating agreements for sharing track. As part of SOR's mentoring program, rules qualification and requalification were conducted by an SOR locomotive engineer in a classroom using RA and CN CROR course material. Outside of the classroom, no on-the-jobRA training was done to assess performance in a real situation. In some cases, new SOR employees who possessed valid rules qualification from CN were provided with the necessary operating documents, including the RA GOIs and rules, and were placed into service. The SOR crew members involved in the occurrence were unaware that RA practices for securement of unattended trains differed from CN practices.

The locomotive engineer was a former CN employee with more than 30 years of railway experience. He joined SOR in 1996, when the Hagersville Subdivision was transferred from CN. He had most recently re-qualified in September 2006. Between January 2005 and February 2009, he was efficiency-tested seven times and failed at least one category three times. There was no indication that follow-up efficiency testing was done after the failures occurred.

The conductor began working with SOR in June 2003 and had most recently re-qualified in November 2006. Between January 2005 and February 2009, he was efficiency-tested 33 times and failed a category 16 times. Over that period, he averaged more than 6 efficiency tests and 3 category failures annually. There was no indication that follow-up efficiency testing was done after the failures occurred.

The assistant conductor began working with SOR in January 2008. He had previously worked with CN for 40 years. He had last qualified as a locomotive engineer with CN in October 2007. His locomotive engineer qualifications also qualified him as a CN conductor or assistant conductor. When he began to work at SOR, he was provided a copy of RA's GOIs, but did not receive any training on the contents. He was expected to become familiar and be compliant with the document when working on RA territory. He was efficiency-tested once, on 09 July 2008, with no exceptions noted.

In September 2008, the assistant conductor was involved in another occurrence involving runaway cars. On that occasion, a string of cars was moved into a storage track already containing cars that had not been properly secured. Subsequently, the unsecured cars ran uncontrolled out of the track and side-collided with another cut of cars left standing on the lead. The assistant conductor was suspended for not ensuring the cars already in the track had been properly secured, but the suspension was not required to be served. No additional monitoring or targeted efficiency tests were done after that suspension.

CROR Rule 112: Securing equipment

Rules governing the securement of rolling stock, including trains, are set out in CROR Rule 112, Securing Equipment, which states (in part):

1. When equipment is left at any point, a sufficient number of hand brakes must be applied to prevent it from moving. Special Instructions will indicate the minimum hand brake requirements for all locations where equipment is left.
2. Before relying on the retarding force of the hand brake(s), the effectiveness of the hand brake(s) must be tested by fully applying the hand brake(s) and moving the cut of cars slightly to ensure sufficient retarding force is present to prevent the equipment from moving.

Railways can establish their own Special Instructions (that is, contained in railway subdivision timetables and/or GOIs) for rolling stock securement as long as the instructions provide for a level of safety that is equivalent to that required by the CROR.

Rail America general operating instructions

Rail America GOIs apply to all of its short-line freight railways in North America, including SOR. Section 1 of the RA GOIs states (in part) that one person does not engage in work activity that can only be done safely by two or more people.

Instructions for securing a train left unattended with locomotive attached and running are contained in RA GOIs Section 5, Hand Brakes – Leaving Locomotives, Cars and Trains.

• Item 1.0, "Hand Brake Policy," states that crew members are responsible to inquire and confirm with each other that equipment is left in accordance with these GOIs.
• Item 1.1 (g), "Leaving Railway Equipment Unattended," sets forth criteria for the minimum number of hand brakes that must be applied to rolling stock left unattended. It states that when leaving railway equipment, the MINIMUM number of hand brakes must be applied as indicated in the hand brake chart. Based on the number of cars in the occurrence train, the crew were required to set a minimum of five hand brakes on the head end of the train. The item further states that additional hand brakes may be required; factors that must be considered are these:
  • Total number of car brakes
  • Cars loaded or empty
  • Track grade
  • Hand brake force applied
• Item 1.2, "Testing Hand Brake Effectiveness," provides instruction for testing the effectiveness of hand brakes applied. To ensure that an adequate number of hand brakes are applied, release all air brakes and allow or cause the slack to adjust. It must be apparent, when slack runs in or out, that the hand brakes are sufficient to prevent the cut of cars from moving. This procedure must be done before uncoupling or before leaving equipment unattended.
• Item 3.0, "Leaving a Train Unattended," indicates that trains unattended with a locomotive or locomotives attached may be left as follows:
  1. On an ascending grade, train must be stopped with slack action stretched; other than ascending grade, stop with slack in or out.
  2. Locomotives must be attached with brake pipe coupled and angle cocks open.
  3. Apply hand brakes on the head end of the train.
  4. Test the effectiveness of hand brakes.
  5. On the controlling locomotive, the control stand must be left as follows:
     • Independent brake cut-in and fully applied.
     • Automatic brake cut-in and handle in release.
     • Generator off, engine run on, control / fuel pump on.
     • Reverser handle removed.
     • Take the reverser handle from the cab of all locomotives in the consist.

All steps in the procedure should be followed; otherwise, hand brakes on the cars at the low end of a downward-sloping track are to be applied in accordance with Section 1.1 (e) and Section 1.1 (g). When required to leave a train in this manner, the information relative to hand brakes applied and inspection performed must be documented on the crew-to-crew form.

The instructions for changing the controlling locomotive in a multi-unit locomotive consist are contained in RA's GOIs at Section 6, "Air Brake Tests and Procedures."

• Item 2.1, "Perform a Locomotive Air Brake Test," states (in part) that a locomotive air brake test must be performed when changing operating ends.
• Item 2.3, "Locomotive Brake Test Procedure," sets forth detailed requirements for performing the test and notes that "a qualified person must be positioned on the ground to observe that all brake pistons extend and retract as intended on the locomotive being tested."

CN general operating instructions

At the time of the accident, SOR crews were using CN's GOIs. Section 7.12, "Application of Handbrakes," contains instructions for leaving a train unattended with locomotives attached and running. It states (in part):

10. Unattended movements with locomotive(s) attached are exempt from handbrake requirements provided:
    1. The locomotive controlling the air brake system is left running.
    2. Brake pipe continuity is present through the train movement.
    3. A full service application is made.
    4. The independent brake and handbrake is applied on the lead locomotive.

CN requires the crew to perform an air brake continuity test when changing the controlling locomotive^{Footnote 4}. The test verifies the capability to transmit a signal between the leading locomotive and the last piece of equipment on the train. However, the occurrence train was not set up to monitor brake pressure at the tail end of the train. In this situation, the air brake continuity test requires two qualified persons, one located in the controlling locomotive and the other at the tail end of the train.

Regulatory overview

Transport Canada (TC) promotes and regulates the safety of federally regulated railway companies through the Railway Safety Act and other applicable legislation. Data collection and analysis, inspections and safety audits are among the activities TC uses to monitor compliance and safety. Inspections may be conducted as a stand-alone activity or as part of a safety audit process. Separate regulatory audits or inspections are conducted for equipment, engineering (that is, track infrastructure) and operations compliance. TC targets the audits or inspections using a risk-based approach that takes several factors into consideration. Those factors include a company's accident history, a review of occupational safety and health data, employee and community complaints, and past monitoring history.

Between 2006 and 2009, TC conducted three to four equipment program audits per year at SOR's Hamilton operations. Equipment program audits target compliance with equipment-related rules or standards.

TC's Safety Management System (SMS) Regulations^{Footnote 5} mandate that, as of 31 March 2001, all federally regulated railways must implement and maintain an SMS, the details of which are documented in an SMS manual. A company SMS manual should include a process for identifying safety issues and concerns, including those associated with human factors, a process for identifying significant changes to railway operations, and a method for evaluating and classifying risks by means of a risk assessment. To ensure compliance with the regulations, TC audits every railway company's SMS. During the audit, the SMS is reviewed to ensure that the stated objectives and practices are in place and are effective.

TC identified RA as an audit candidate in 2005, through integrated risk-based business planning. The safety audit primarily focused on two of the three operating RA railways within Ontario (Ottawa Valley Railway and Goderich-Exeter Railway Company Ltd.).

On 16 January 2008, TC met with RA to discuss next steps. The parties agreed to work together in an effort to progress rail safety. Over the summer of 2008, RA submitted its implementation plan to TC to ensure continuous improvement. At the time of this occurrence, TC's verification of RA SMS implementation at SOR had not begun.

RailAmerica's Safety Management System

RailAmerica's SMS applies to all of its short-line freight railways in North America, including SOR. Section 6.1.2 (page 44) of RA's Canadian Operations' SMS Manual outlines the company's efficiency testing practices. Efficiency testing is performed by a supervisor and involves periodic observation of an employee's on-the-job performance for compliance to a set of core CROR rules and safe work practices outlined in the GOIs. Testing should be routinely performed for employees and managers who regularly work in the field. Front-line supervisors should conduct at least 10 efficiency tests per month, 5 of which should be conducted on targeted employees. Employees targeted for efficiency testing include those who

• have failed two or more efficiency tests in a 90 day period;
• have sustained an injury while at work;
• have been involved in a human factor incident or accident; or
• have less than one year of service.

Although a list of targeted employees was required by its SMS, SOR had no such list. SOR records indicate that 163 efficiency tests were conducted in 2006, 163 in 2007, and 33 in 2008. The general manager and trainmaster were required to conduct efficiency tests, but the operations coordinators were not.

Section 10.1 (page 87) of RA's Canadian Operations' SMS Manual outlines the company's practices for hiring locomotive engineers with prior experience. Management should "not allow employees to operate a locomotive by relying on another railroad's qualification." Employees must attend a safety and rules class, write an "A Card/CTC1987-3RAIL"^{Footnote 6} test, and earn a 90 per cent or better grade to begin qualifying trips. Otherwise, they have to complete full locomotive engineer training. In addition, a RA officer will ride with the employee to determine suitability for qualification. The SMS manual similarly requires a conductor with previous railway experience to be trained, tested, and familiar with RA operations. With regard to SMS, RA had little or no oversight of SOR operations.

Other Transportation Safety Board investigations involving the Safety Management System

On 29 June 2006, CN freight train L 567 51 29 was travelling southward on the Lillooet Subdivision when the crew lost control while descending the grade near Lillooet, British Columbia. Two of the three crew members were fatally injured; the other was taken to hospital with serious injuries. The TSB investigation (R06V0136) revealed that operational changes had been made without conducting a formal risk assessment to identify potential hazards. As a result of the investigation, the Board recommended that

TSB investigation reports R03V0083, R05V0141, R06V0183, R07V0213, and R08M0015 also examined SMS issues. The Board also issued Rail Safety Advisories 02/07, 12/07, 14/07, and 04/08, which deal with SMS issues. Nevertheless, significant SMS deficiencies remain across a wide range of operations. The two issues in particular that stand out are changes made by companies to operations without performing adequate risk assessment and inadequate regulatory overview. Consequently, the Board added SMS to its Watchlist of key safety issues within Canada's transportation system.

Neither the condition of the rolling stock nor the track infrastructure played a role in this accident. The analysis discusses the securement of the unattended train, safety management practices, and company and regulatory overview of train crews.

The accident

The crew left the train unattended on a 1% grade, without the train being properly secured. These actions were not in compliance with CROR Rule 112 or with either of RA's or CN's system special instructions or company GOIs.

The locomotive engineer and conductor had already departed the site to complete paperwork. Within four minutes after the train came to a stop on the Hydro Spur, the freight car air brakes and the automatic train brakes released, and the locomotive independent air brakes bled off. The assistant conductor had also departed the site, without changing the controlling locomotive or applying a sufficient number of handbrakes, within the same four minutes. Without sufficient handbrakes applied, the unoccupied train began to move southward with its tail end leading. By 2123:41, the train had begun to accelerate, and it rolled uncontrolled downgrade for 1.4 miles, reaching a speed of 20.7 mph before encountering a split switch derail and derailing the nine tail-end cars. The split switch derail at Mile 1.9 functioned as designed and prevented the uncontrolled train from entering the hydro plant.

A full service brake application was initiated at 2113:44, and the train came to a stop 15 seconds later. At 2114:07, brake pipe pressure had reached 65 psi at controlling locomotive RLK 3873, indicating that a full service brake application had been made. At the time, the assistant conductor was in the process of changing the controlling locomotive by setting the MU2A valve to "Trail" and the automatic brake valve to "Cutout". The increase by two pounds in air brake pipe pressure only two seconds after 65 psi was reached suggests that the automatic brake valve was prematurely moved to the "Cutout" position, trapping a pressure gradient within the train air brake line. As the pressure gradient equalized, it sequentially activated the quick service release of the air brakes on all freight cars behind the locomotives.

Cutting out the automatic brake valve also stopped all subsequent charging of the train air brakes. Because no other locomotive in the consist was set in the controlling position, the supply of air pressure required to maintain independent brakes was cut off, which permitted all locomotive independent brakes to slowly bleed off and release. With all freight car and locomotive air brakes released, the absence of a sufficient number of handbrakes applied left the train unsecured.

Errors and adaptations to train securement practices

Because of a heavy workload, the assistant conductor was added as an extra crew member to assist with switching duties. The crew was familiar with the territory, met fitness and rest standards, and had done this job many times before. For most of the 12-hour shift, the assistant conductor worked outdoors in near-freezing temperatures and periodic heavy rains. His vigilance^{Footnote 7} and level of performance at the end of the shift was likely reduced, affected by the length of the shift and the outdoor work in difficult weather conditions.

As the crew neared their maximum 12 hours of service, they rushed to complete their work. Although action was not required, the crew intended to change the controlling locomotive. While setting up the train for the next crew on the 2200 Brantford Turn assignment, they did not cut-in the lead locomotive before departing the site. The train was therefore left without a controlling locomotive, allowing the locomotive-independent brakes to bleed off.

RA and CN train securement practices were both designed to prevent this type of accident. However, to expedite operations, adaptations^{Footnote 8} were made to the SOR Train Service Plan, the CROR, and the RA and CN GOIs.

• SOR's Train Service Plan required that the train be left at Garnet Yard; however, to save time and for ease of access, the accepted practice was to leave the train on the descending grade of the Hydro Spur.
• The assistant conductor was left alone to secure the train while the locomotive engineer and conductor travelled to the office in Hagersville to complete paperwork. According to the RA and CN GOIs, securing the train was an operation that required two people.
• An insufficient number of handbrakes were applied on the head-end cars or locomotives.

Each of these company and crew deviations from standard operating practices associated with train securement increased the risk of uncontrolled movement and contributed to the accident.

Securing a train made up predominantly of dangerous and special dangerous commodities, adjacent to a major refinery on a descending grade, requires increased vigilance to safely complete the task. When only one crew member is left to complete train securement tasks at the end of a work shift, the risk for runaway equipment is increased, because there is no opportunity for other crew members to identify and correct any errors.

Safety Management Systems

Limited resources, distributed management and operations, and shared administrative staff can present particular challenges to the management of an effective SMS on short-line railways. Notwithstanding, there is still a regulatory requirement for SMS implementation. A number of the procedures and practices at SOR were ad hoc and/or did not comply with RA practices and SMS. Those procedures and practices include

• inadequate efficiency testing. At the time of the occurrence, SOR had a general manager and a trainmaster supervising operations staff. Based on that number, RA's SMS required that 240 efficiency tests be conducted annually (10 per month per supervisor). In 2006 and 2007, SOR conducted only 67% of the required number, and in 2008, only 14% of the required number. At those levels of testing, RA and SOR oversight was insufficient to monitor performance or to deter non-compliance, which increased the risk that adaptations would occur and result in unsafe operating practices.
• targeted employees and the absence of follow-up testing. The RA SMS manual required the maintenance of a targeted employee list and specified that half of a supervisor's efficiency testing (five tests per month) be conducted on targeted employees. However, there was no such SOR list. Furthermore, SOR employees targeted for efficiency testing should have included those who had been involved in a human-factor accident or who had less than one year of service, which would have encompassed the assistant conductor.
• non-qualified personnel operating rolling stock. The RA SMS manual does not allow employees to operate a locomotive based on their qualifications from another railroad, and yet SOR implemented a hiring and training program that accepted CN-qualified employees without requalification, as was the case with the assistant conductor.
• Deviation from Train Service Plan with no risk assessment. The operational practice of leaving unattended trains on Hydro Spur deviated from the Train Service Plan. SOR management were aware that the practice had changed, but to expedite operations, allowed it to continue without performing a risk assessment. When operations are changed, a proactive SMS should trigger a formal risk assessment with a view to establish specific risk mitigation measures for the new operating practice.

Between 2006 and 2009, TC conducted several equipment program inspections annually, and yet no records document any TC inspections or safety audits that targeted SOR's SMS, operating practices, or rules. The RA SMS manual contained comprehensive safety policies and processes, but neither RA nor TC provided effective guidance or oversight to ensure that SOR staff understood, implemented, and maintained an SMS. As a result, SOR management did not fully implement SMS, did not identify safety-deficient practices, and did not perform risk assessments when operations changed. Insufficient company oversight allowed the deviations in standard operating practices to occur. Effective safety management requires that companies and regulators have structures and processes in place to allow for proactive identification and mitigation of risks. Without effective company and regulatory overview, safety management on the SOR was not sufficiently developed to ensure the progression of SMS philosophy and implementation through to policies, procedures, and practices.

Findings as to causes and contributing factors

1. The accident occurred when the crew left the train unattended on a 1% grade, without the train being properly secured. Subsequently, the train rolled uncontrolled downgrade for 1.4 miles, across an unprotected crossing, reaching a speed of 20.7 mph before it encountered a split switch derail and derailed the nine tail-end cars.
2. The automatic brake valve was prematurely moved to the "cutout" position, trapping a pressure gradient within the train air brake line. As the pressure gradient equalized, it sequentially activated the quick service release of the air brakes on all freight cars behind the locomotives.
3. Because no other locomotive in the consist was set in the controlling position, the supply of air pressure required to maintain independent brakes was cut off, which permitted all locomotive independent brakes to bleed off and release.
4. With all freight car and locomotive air brakes released, the absence of a sufficient number of handbrakes applied left the train unsecured.
5. The train crew and company deviated from a number of standard operating practices associated with train securement, each of which increased the risk for an uncontrolled movement to occur and contributed to the accident.
6. With only one crew member left at the end of the shift, the other crew members did not have an opportunity to verify whether the train was properly secured.
7. Insufficient company oversight allowed the deviations in standard operating practices to occur.

Finding as to risk

1. Without effective company and regulatory overview, the risk that a short-line railway's Safety Management System philosophy will not be effectively progressed through to its policies, procedures and practices is increased.

Other finding

1. The split switch derail at Mile 1.9 functioned as designed and prevented the uncontrolled train from entering the hydro plant.

On 20 February 2009, Transport Canada issued a notice under subsection 31.(3) of the Railway Safety Act. The notice required SOR management to report in writing by 06 March 2009 how the company intended to resolve the hazard or condition resulting from failure of SOR employees to properly secure unattended equipment on the Hydro Spur at Nanticoke, Ontario.

On the same day, SOR issued operating bulletins Nos. 003-2009 and 004-2009 under CROR Rule 83(a). The bulletins were related to the practice of leaving unattended cars or trains on the Hydro Spur.

Bulletin 003-2009 addressed the procedures for building and setting the outbound train for the 2200 Branford Turn:

The train "must" be brought to Garnet yard and left between Highway #3 and the crossing located at the south end of Garnet yard. In the event that the number of cars exceed the room at this location, the train must be cut at the crossing located at the south end of Garnet yard and the head-end of the train pulled and stopped between the two crossings at either end of Garnet yard.

Both sections of the train must be secured as per the RA GOI Section 5. item 3. In addition, any time the controlling locomotive is changed in the locomotive consist used at Garnet yard, a locomotive brake test (schedule B) must be completed on the consist.

Bulletin 004-2009 addressed crew duties:

Prior to going off duty, crews must ensure that no cars or locomotives are being left unattended on the Hydro Spur. If crews are nearing their maximum hours of service, they must plan their work to allow cars to be moved to the Stelco Spur prior to going off duty.

In the case of an emergency, which prevents crews from complying with this bulletin, they must contact the Operations Supervisor and report that there are cars being left on the Hydro Spur. Crews will be governed by the Operations Supervisor's instructions.

TC further conducted a series of inspections between May and August 2009 under its Mobile Audit Program. It inspected trains stored in Garnet Yard, Hagersville, Ontario, for CROR Rule 112 compliance and interviewed selected employees and supervisors on practices and expectations related to the securing of equipment.

To monitor safety and compliance, RA has taken a more active approach in the management of safety at its railways. Specifically, all incidents and efficiency test levels are monitored weekly by the regional vice president and the manager of safety and operating practices (MSTOP) responsible for the railway. Incidents are further reviewed weekly by the chief operating officer and the vice-president of safety and operating practices.

SOR has made the following changes:

• All operating employees were re-qualified in the RA GOIs.
• The transportation management at SOR were restructured. Specifically, the structure of general manager, trainmaster and two operational coordinators was replaced with general manager, assistant general manager, trainmaster, assistant trainmaster and operations supervisor, all with efficiency testing responsibility.
• Annual regional review of the internal SMS audit requirement and constant monitoring of rules training was initiated by the regional vice president and the MSTOP.
• Annual unannounced safety audits by the MSTOP were initiated in 2010.
• The MSTOP will conduct annual rules reviews for all operating employees to ensure that any changes in rules or special instructions are covered over and above the CROR rules requalification requirement.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 04 August 2010.