Rail Investigation Report R11E0063

On 23 June 2011, at approximately 0625 Mountain Daylight Time, Canadian National Railway Company (CN) freight train Q10131-21, proceeding westward at 25 mph on the Wainwright Subdivision, collided with the tail end of stationary CN freight train A41751-23 at Mile 262.76 in Edmonton, Alberta. The collision resulted in 2 derailed intermodal flat cars (3 car bodies) and 1 damaged locomotive CN 2234. There were no dangerous goods involved and no injuries.

Ce rapport est également disponible en français.

At 0625^{Footnote 1} on 23 June 2011, train Q10131-21 (train Q101), proceeding westward on the north main track of the Wainwright Subdivision collided with the tail end of stationary train A41751-23 (train A417) at Mile 262.76 in Edmonton, Alberta (Figure 1). The collision resulted in the derailment of 2 intermodal flat cars of train 417 (3 platforms) and locomotive CN 2234 of train Q101 being damaged. In total, 6 empty containers and 2 containers loaded with waste paper and metal scrap were damaged (Photo 1). No dangerous goods were involved.

On the morning of the accident, the sky was clear with bright sun and the temperature was 22°C.

Train Q101 was an intermodal, distributed-power (DP) train, consisting of 3 locomotives (head end, middle and tail end), 53 empty cars and 146 loaded cars. The train was approximately 13,449 feet in length and weighed about 6904 tons. Train A417 was a conventional train, powered by 2 locomotives that handled 27 empty and 33 loaded cars. Train A417 was approximately 4546 feet in length and weighed about 5460 tons.

The crew of train Q101, a locomotive engineer and a conductor, had been ordered for duty starting at 0005, Thursday, 23 June 2011, at Biggar, Saskatchewan (Mile 0.0 of the Wainwright Subdivision). The crew members were qualified for their respective positions; they were familiar with the territory and met company and regulatory requirements respecting mandatory time off-duty and maximum hours of service.

Train Q101 departed Biggar at 0052. The train had received priority handling en route resulting in the trip taking less time than normal for a premium service train. There had been no delays due to work blocks and only 2 meets with opposing trains. In both cases, train Q101 held the main track. The trip had proceeded without incident until the collision.

Train A417 originated in Clover Bar Yard in Edmonton and was travelling westward on the north main track to Walker Yard, also in Edmonton. As it had stopped for instructions from the Yardmaster, the tail end of train A417 was situated just west of the 50th Street overpass. Signal 2625N was situated just east of the overpass (Figure 2).

In the vicinity of the accident, the Wainwright Subdivision consists of double main track beginning at Mile 260.9, west of the Beverly Bridge. At the time of the occurrence, a third train (eastbound CN freight train 304) was stopped on the south main track, just west of the switch at Bailey, waiting for train Q101 to clear.

Train movements in the area are governed by the centralized traffic control system (CTC), as authorized by the Canadian Rail Operating Rules (CROR) and supervised by a rail traffic controller (RTC) located in Edmonton. The permissible track speed in this area is 40 mph.

Recorded information indicates that:

• At 0621:10, train Q101 passed signal 2601 (Mile 260.1) at a speed of approximately 30 mph in throttle position 7. The signal installation at this location was a high-mast, double-aspect signal. As the train passed this location, the signal indication was Clear to medium (yellow over green).^{Footnote 2}
• At 0622:23, the train passed signal 2609 (Mile 260.9), a high-mast, triple-aspect signal, at a speed of approximately 32 mph in throttle position 7. The signal indication was Limited to stop (red over yellow over red with an L letter plate affixed to the mast).^{Footnote 3} In this instance the L letter plate is used instead of a flashing middle aspect.
• At 0624:58, while approaching signal 2625N (Mile 262.5) at a speed of 37 mph with the throttle in idle, train Q101 was placed into emergency braking. Signal 2625N at Mile 262.5 was a high-mast, two-aspect (staggered) signal. The signal indication was restricting (red over red with an R letter plate affixed to the mast).^{Footnote 4}
• At 0625:15, train Q101 collided with the tail end of stationary train A417 at Mile 262.76, just past the signal, while travelling at 25 mph.

The crew members of train Q101 had identified and communicated the signals approaching the point of collision. They had not communicated with the RTC on their trip. They had used the radio to communicate signals when required and to ask for instructions from Walker Yard control and the Yardmaster when approaching Edmonton.

The crew on train Q101 did not hear any radio communication involving train A417 and were not aware of its presence in the area. Although it is common practice for the RTC to advise trains of meet locations or of other train movements, it is not required by the CROR. Such communication is made primarily to provide information to employees and does not provide any operating authority.

The third train (eastbound train 304), which was stopped on the south track, had its cars extended westward along the left-hand curve towards the 50th Street overpass. Train Q101's view of signal 2625N and the tail end of train A417 was initially blocked by train 304, but came into clear view when train Q101 approached within about 900 feet of them.

Operational delays

On 01 March 1998, at approximately 1531 Mountain Standard Time, Canadian National Railway Company (CN) freight train A-447-51-01 (train 447) collided with the rear end of stationary CN freight train C-771-51-28 (train 771) at Mile 165.4 of CN's Edson Subdivision, near Obed, Alberta (TSB Investigation no. R98C0022). The 2 crew members in the lead locomotive on train 447 were seriously injured. The last car from train 771 and the lead locomotive from train 447 derailed and both sustained extensive damage.

The Board concluded that the effective and safe operation of a railway is largely dependent upon accurate and timely communications between the RTC and the others whose work may affect or be affected by train operation. The interpretation of “prompt advising”, per existing rules, does not always promote timely notification to the RTC, trains and others in the vicinity when a train is being delayed and poses a safety risk. Immediate communications on recognition of the potential for train delays promotes timely adjustment by others affected. Therefore, the Board recommended that

In January 2012, in response to this recommendation, Transport Canada (TC) indicated that

TC contends that there may be times when unconfirmed information provided by train crews pertaining to train locations may or may not be beneficial. However, this occurrence substantiates TC and the railway's position because when the crew heard the scanner's message they misinterpreted the unconfirmed information to believe that Train 771 had left that location and therefore disregarded the requirements of travelling at restricted speed. TC also believes that CTC rules, when properly complied with, are safer than OCS types of control, as it removes part of the human element, thus reducing the chance of mistakes caused by human error. The use of unconfirmed information to control train movements negates the effectiveness of the signal system and is a violation of Rule 126 of the CROR that is in specifically in place to prevent these situations from happening. The CTC system drastically reduces the number of human interactions that reduces the number of errors and, if it were increased, would only contribute to additional system errors that everyone is striving to reduce.

TC has reviewed its response to the TSB recommendation and all subsequent updates provided to the TSB since 2000, and assessed with the railways suitability of current Canadian Rail Operating Rules (CROR) and railway instructions concerning the immediate reporting of operating delays to all concerned when there is a safety risk and any possible safety deficiencies. TC has come to a determination that current CROR are adequate, that no safety deficiency exist and that any suggested modification to current operating rules or any other methods of collision avoidance, such as radio notification, may compromise the safety of the existing railway operating system rather than improvement. Human factors issues and positive train control are being looked at by industry.

Board reassessment of the response to R00–03 (February 2012)

Transport Canada (TC) reviewed the deficiency with the Railway Association of Canada, but decided not to seek any changes to rules or instructions. TC made an assessment of the suitability of current Canadian Rail Operating Rules and railway instructions concerning the immediate reporting of operation delays to all concerned when there is a safety risk and determined that the current rules are adequate. In consideration that TC performed the assessment as recommended, but the safety deficiency remained unaddressed, the Board reassessed the response to Recommendation R00-03 as being Unsatisfactory.

Failure to communicate known information to all concerned continues to contribute to railway accidents.

Centralized traffic sontrol

Centralized Traffic Control uses interconnected track circuits and signals in the field. Computer displays and controls are installed in the RTC office. Signals are actuated by the presence of a train. Signal indications convey information to train crews specifying the speed at which they may operate and how far they are permitted to travel. In addition, signal indications provide certain protection against other conditions, including if the block ahead is occupied, a rail broken, or a switch left open.
Crews must be familiar with the signal indications specified in CROR. According to industry rules and TC requirements, crews are trained, tested, and qualified at periodic intervals. Crews are required to control their trains in accordance with those rules. If a crew does not respond appropriately to a signal or other point of restriction, CTC does not provide any form of automatic means to stop the train.

In the RTC office, track occupancy is shown on the RTC's computer screen. Track occupancy normally indicates the presence of a train, but can also indicate an abnormal condition (e.g., unauthorized track occupancy or an interrupted track circuit caused by a broken rail or a switch left open). The RTC can control power-operated switches and certain signals. These signals can be set to Stop or to display permissive indications. When an RTC requests signals for trains, the signal system determines how permissive the indications will be based on the presence of other track occupancies.

Forward-facing locomotive video

Train Q101 was equipped with a forward-facing locomotive video camera. The video recording of train Q101's approach was reviewed. However, with the bright sun from behind on the morning of the occurrence, it was not possible to confirm the signal indications from the video recording (TSB Laboratory Report LP075/2011). The sun did not interfere with the crew's ability to identify signals throughout the trip.

Signal system testing and functionality

The signals in use on the Wainwright Subdivision were Type H-2 searchlight signals, manufactured by Union Switch and Signal Corporation and equipped with compound spread-type lenses. They were built according to Association of American Railroad specifications.

Following the accident, CN signal personnel inspected and tested the signal mechanisms and vital relays. All signal-control cables and underground control circuits were meggered,^{Footnote 5} lamp voltages were taken and battery-ground tests were conducted. No anomalies were found.

A re-enactment test of the signal system was also conducted. The westbound signal aspects were conditioned (set) as they occurred before the accident. Testing verified that when the main track switch at Bailey was lined for a westbound train to enter the north track, and there was a simulated track occupancy just west of signal 2625N, the signal indications would have been displayed as follows (Figure 3):

• the controlled signal, 2601, at Brettville Junction displayed a Clear-to-medium indication (yellow over green);
• the controlled signal, 2609, at Bailey displayed a Limited-to-stop indication (red over yellow over red with an L letter plate on the mast); and
• the intermediate signal, 2625N, just east of the 50th Street overpass displayed a Restricting signal (red over red staggered, with an R letter plate on the mast).

Intermediate and absolute signals

Signals commonly are referred to as either intermediate or absolute:

• For intermediate signals, the most restrictive indication that can be displayed is Stop and Proceed. If an R letter plate is affixed to the signal mast, the most restrictive indication that can be displayed is a Restricting signal. When a train passes an intermediate signal displaying its most restrictive indication, there is no alarm associated with this action as it is acceptable to do so provided a stop has been made or the movement is in compliance with the requirements of restricted speed.^{Footnote 6} In either circumstance, the movement within the next block must be made at restricted speed. Crews must anticipate the possible presence of equipment (rolling stock) in the next track block, including just beyond the signal.
• For absolute signals, the most restrictive indication is CROR Rule 439, Stop Signal - Stop. In CTC, these signals are also known as controlled signals^{Footnote 7} and they usually govern movement through controlled locations. If a train movement is operated past a stop signal, the RTC is notified immediately through an alarm or other office control indication. Within the railway industry, the unauthorized passing of a stop signal is a serious event, as a collision with a conflicting movement is a distinct possibility. Such events typically are investigated by the railway and dealt with through internal disciplinary processes.

Signal recognition and compliance

Crew members are expected to know their operating territory, including the location of individual signals. This knowledge is used to facilitate the detection of signals and to help recognize the presence of any imperfection or absence of a signal.

Perception of signals is a three-step process: detect, discriminate and decide on the aspect displayed. This process can be rapid. When the signals are not obscured or obstructed and there is good visibility, signal perception (that is, recognition) can be accomplished from relatively long distances. However, several factors can affect the time and accuracy of the perception of signals, including the crew’s fitness for duty, visibility, perceptual context and the signals themselves.

Signal recognition and compliance is governed by the following CROR:

CROR Rule 27, SIGNAL IMPERFECTLY DISPLAYED states (in part):

1. [. . .] a fixed signal which is imperfectly displayed, or the absence of a fixed signal where one is usually displayed, must be regarded as the most restrictive indication that such signal is capable of displaying. An imperfectly displayed signal must be communicated to the proper authority as soon as possible.

CROR Rule 34, FIXED SIGNAL RECOGNITION AND COMPLIANCE states (in part):

1. The crew on the controlling engine of any movement and snow plow foremen must know the indication of each fixed signal (including switches where practicable) before passing it.
2. Crew members within physical hearing range must communicate to each other, in a clear and audible manner, the indication by name, of each fixed signal they are required to identify. Each signal affecting their movement must be called out as soon as it is positively identified.
3. If prompt action is not taken to comply with the requirements of each signal indication affecting their movement, crew members must remind one another of such requirements. If no action is then taken, or if the employee controlling the engine is observed to be incapacitated, other crew members must take immediate action to ensure the safety of the movement, including stopping it in emergency if required.

CRORs Rule 578, RADIO BROADCAST REQUIREMENTS states (in part):

1. Within single track, a member of the crew on all trains or transfers must initiate a radio broadcast to the airwaves on the designated standby channel stating the name of the signal displayed on the advance signal to the next controlled location, controlled point or interlocking.

Additional defences required

The railways and TC have based their safety philosophy on a cornerstone of strict rules compliance. While the Board believes that regulatory compliance is necessary for accident prevention in transportation, it does not accept that regulatory compliance alone is sufficient to maintain safety in a complex transportation system. Organizations that place excessive reliance on strict regulatory compliance tend to believe that the safety rules they have developed are invulnerable to human error. A rule-bookculture can produce an attitude which assumes that all accidents are the result of individual failures to follow the rules. Unfortunately, in a complex system such as transportation, even the most rigorous set of rules will not cover every contingency; interpretation by individuals will be required to cover unanticipated situations. Indeed, notwithstanding their knowledge of the rules, even the most motivated employees are subject to the normal slips, lapses and mistakes that characterize human behaviour. The defence-in-depth-philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors.

For many years the railway industry in Canada has relied on crew compliance with wayside track signals. Wayside signal systems provide train crews with a series of signal indications requiring actions relative to the signals displayed. The signal indications convey information such as the condition of the track ahead, how far trains are permitted to travel, and how to govern the movement of the train between signals. Train crews must be familiar with the signal indications and must control their trains accordingly. The level of safety afforded by wayside signal systems has not advanced significantly beyond their original design. However, high-speed passenger trains now share track with freight trains and the overall pace of freight rail transportation has increased in the 100 years since wayside signals were introduced.

Following the investigation into a 1998 train collision involving 2 CP trains near Notch Hill, British Columbia (TSB Occurrence no. R98V0148), the Board determined that backup safety defences for signal indications were inadequate. The Board recommended that:

Action to date on the deficiency has resulted from procedural improvements implemented by CP with its crew resource management practices. More than a decade later, there have been no added safety defences that do not involve crew compliance with another rule or operating instruction. While there is some safety benefit these administrative or procedural defences are not always adequate to protect against the misinterpretation and or misperception of wayside signal indications. In February 2012, the Board reassessed the response to Recommendation R00-04 to remain as Satisfactory in part.

Since 2007, the TSB has conducted 4 investigations where the misinterpretation and/or misperception of wayside signal indications has been a cause or contributing factor.

• R10Q0011 (Saint-Charles-de-Bellechasse) – On 25 February 2010, at approximately 0425 Eastern Standard Time, VIA train no. 15, proceeding westward from Halifax, Nova Scotia, to Montreal, Quebec, entered the siding at Mile 100.78 of the CN Montmagny Subdivision in the municipality of Saint-Charles-de-Bellechasse, Quebec, at approximately 64 mph and derailed 2 locomotives and 6 passenger cars. Two locomotive engineers and 5 passengers were injured.
• R10V0038 (KC Junction) – On 03 March 2010 at about 1410 Pacific Standard Time, Canadian Pacific Railway train 300-02 operating eastward on the north track of the Mountain Subdivision approaching KC Junction, British Columbia, side collided with westward Canadian Pacific Railway train 671-037 that was departing Golden from the north track through the crossovers onto the south track. As a result of the collision, 3 locomotives and 26 cars derailed. The crew on train 300-02 were transported to hospital for observation.
• R09V0230 (Redgrave) – On 30 October 2009 at about 2225 Pacific Daylight Time, Canadian Pacific Railway train 355-429 operating westward on the signalled siding track at Redgrave, British Columbia, on the Mountain Subdivision, side collided with eastbound Canadian Pacific Railway train 110-30 that was stopped on the main track. As a result of the collision, 2 locomotives and 6 cars derailed.
• R07E0129 (Peers) – On 27 October 2007 at 0505 Mountain Daylight Time, the crew on CN train A41751-26 (train 417) operating westward on the main track of the Edson Subdivision initiated an emergency brake application approximately 475 feet from a stop signal at the west end of Peers, Alberta. The train was unable to stop prior to passing the signal and collided with eastbound CN train M34251-26 (train 342) that was entering the siding. As a result of the collision, train 417’s locomotives and 22 cars derailed. Ten other cars sustained damage but were not derailed. Five cars on train 342 derailed and 4 other cars sustained damage but did not derail.
  

The rail industry has developed technology to address the risk of misinterpreting or not following signal indications. Some technologies in use or being discussed include the following:

Proximity detection

A proximity detection device was developed and put into use after a 1996 collision on the Quebec North Shore & Labrador Railway (TSB Occurrence no. R96Q0050). The proximity detection device can trigger penalty braking if a train crew or track unit operator does not acknowledge the alert warning status when they come within a predetermined distance from other movements. However, no similar systems, except for limited trials, have been implemented on other Canadian railways.

Cab-Signalling systems

Cab-signalling is a railway safety system that communicates signal indications to a display device mounted inside the cab of a locomotive (Photo 2). The simplest systems display the wayside signal indication while more advanced systems also display maximum permissible speeds. These systems can be combined with a train protection system to warn of proximity to points of restriction and to initiate enforcement action to slow or stop a train.^{Footnote 8} Cab signals can reduce the risk of signal recognition errors.

In 1922, the United States (U.S.) Interstate Commerce Commission made a ruling that required U.S. railroads to install some form of automatic train control in one full passenger division by 1925. In response to this ruling, the first cab-signalling systems were developed and put into use in the U.S.^{Footnote 9}

Cab-signalling systems have evolved and can now be combined with train protection systems. These systems remain in use in some U.S. passenger train corridors. In Canada, there are currently no cab-signalling systems in use by freight or passenger railways.

Positive Train Control

Positive train control (PTC) is an emerging train control technology that is designed to prevent

• train to train collisions;
• over-speed derailments;
• incursions into work zone limits; and
• movement of a train through a switch left in the wrong position.
  

If no adequate response is initiated by the crew, PTC would automatically slow or stop the train.

In the U.S., the need for safety improvements was highlighted in 2002 when a freight train and a commuter train collided head-on in Placentia, California. It was further reinforced when, on 12 September 2008, a collision between a Metrolink passenger train and a Union Pacific freight train in California, resulted in 25 fatalities and more than 135 serious injuries. The Metrolink accident prompted the passage of the Rail Safety Improvement Act of 2008 which mandates that, by 2015, PTC be installed on many higher risk rail lines in the U.S.

Transport Canada advised that the industry is exploring the use of PTC technology which would help protect against human factors type issues with signal recognition and/or distractions. It is anticipated that the US implementation of PTC will be delayed beyond the 31 December 2015 deadline. Any application of PTC in Canada likely would not occur for a number of years after the US implementation is complete.

Situational awareness and mental models

Situational awareness (SA) in relation to operational matters refers to the operator knowing what is happening in the immediate environment. There are three levels of SA:^{Footnote 10}

• Perception, refers to the recognition that new cues exist. Some cues are clear; others are ambiguous.
• Comprehension, refers to understanding the order of importance of the new cues.
• Projection, refers to the ability to forecast future events based on information given.

A train crew’s SA may come from various information sources. These can include radio transmissions (e.g., crew-to-crew conversations, messages received from wayside inspection systems). Other information sources can include:

• signal indications;
• RTC radio-transmitted instruction;
• in-cab displays;
• observation of the track;
• environmental conditions;
• sounds from the environment (for example, noise from other trains and traffic); and
• written information (for example, operating authorities, timetables, line-ups, and operating bulletins).

Railway rules and operating instructions also affect SA. For example, CROR and general operating instructions (GOI) provide information that operating crews are either permitted or required to use. When operating a train, decisions and actions greatly depend upon the crew’s assessment and understanding of train operations and their ability to select the appropriate course of action based on SA.

The overall understanding of a situation is based on experience and knowledge of how something works, resulting in a mental model. If cues are not clear, more effort is required to assess a situation accurately. It is difficult to alter a mental model once developed, particularly in a short period of time. To change one’s thinking, the existing model must be superseded by another. New information must be provided which is sufficiently noticeable and compelling to result in an update of the mental model.

Work/rest rules for operating employees

Work/rest schedules are developed based on TC’sthe Work/Rest Rules for Operating Employees (Work/Rest Rules),^{Footnote 11} the railway companies’ fatigue management plans and practices, and through collective agreement. CN specifies that the rules define the requirements for hours or work and rest in order to ensure operating employees remain alert throughout their duty period. CN operating employees are required to have this document with them when on duty.

The Work/Rest Rules state (in part):

2. Statements of Principle
   • 2.2 Railway companies shall establish and maintain working conditions that allow:
     1. operating employees sufficient opportunity to obtain adequate rest between tours of duty; and
     2. alertness to be sustained throughout the duty period
   • 2.3 Operating employees have a responsibility to report for work rested and fit for duty.

6. Fatigue Management Plans
   • 6.1 Requirements
     • 6.1.2 Fatigue management plans shall be designed to reduce fatigue and improve on-duty alertness of operating employees
     • 6.1.3 Fatigue management plans shall reflect the nature of the operations under consideration. Including work trains on a particular territory, taking into account such items as size, complexity, traffic density, traffic patterns, run length and geographical consideration.
   • 6.2 Development and Implementation
     • 6.2.2 Fatigue management plans must consider but not be limited to the following
       1. Employee work scheduling practices;

There are no specific rules governing the number or distribution of shift start/end times.

Work/rest schedule for train crew

The 52-day work/rest history for respectively the locomotive engineer and the conductor of train Q101 was reviewed. It was determined that:

• The work/rest schedules were in compliance with TC’s work/rest requirements.
• Both the locomotive engineer and conductor work histories had frequent shifts from daytime to nighttime wakefulness. Specifically, the following variations in shift times and duty times were noted:
  • Shift start times ranged over 12 hours 34 minutes for the locomotive engineer and 15 hours 4 minutes for the conductor.
  • Shift finish times ranged over 20 hours 14 minutes for the locomotive engineer and 15 hours and 52 minutes for the conductor.
  • Duty times ranged from 9 hours 14 minutes to 15 hours 46 minutes for the locomotive engineer and 8 hours 42 minutes to 15 hours 1 minute for the conductor.
  • The conductor had been off work for 6 days and the locomotive engineer had been off work for 2 ½ days before this shift.
  • In the 24-hour period before the accident, the locomotive engineer had 3.5 hours of sleep and the conductor had not slept at all.

Sleep/wake cycle and alertness

Alertness can be defined as being mentally attentive and responsive when performing tasks. The sleep/wake cycle follows a 24-hour rhythm with approximately 1/3 of this time spent sleeping. Although individual rhythms vary, there are two distinct sets of alertness peaks and dips. The big dip (that is, the lowest point of alertness) is at night in the hours just before dawn between 0300 and 0500.

A lower level of alertness negatively affects task performance as it involves a lower attention to details and it impedes the cognitive process. Taking shortcuts, missing or misinterpreting cues, or miscommunications are examples of performance degradation resulting from a lower level of alertness.

The signal system functioned as designed. There were no track or equipment defects considered causal in this occurrence. The analysis will focus on the method and manner of train Q101's operation, crew performance and the role of system safety defences.

The accident

During the approach to the point of collision, the crew of train Q101 positively and correctly identified the signals. As train Q101 closed in on signal 2625N at 50th Street, it was operating on a limited to stop signal indication (signal 2609) that required the crew to be prepared to stop at the signal. The crew were aware that signal 2625N was an intermediate type signal that had an R letter plate affixed to the mast making its most restrictive indication a restricting signal.

Given that signal 2625N was an intermediate-type signal, it was not equipped to display a stop indication. Passing such a signal without stopping was permitted. A common misconception of restricted speed is that in all circumstances such a signal can be passed at 15 mph. This is only true if the track ahead is clear. In reality, it is entirely possible to have a train situated just beyond the signal; in such case the requirement to stop within half the range of vision must prevail.

Train Q101 was travelling at 37 mph as it approached signal 2625N. During the approach, the crew's mental model was based upon the following misconceptions:

• There was no train present just beyond signal 2625N.
• The implications of the most restrictive indication on an intermediate type signal were not as severe as that of an absolute signal, that is restricting signal versus stop signal.
• A restricting signal would permit them to pass the signal and enter the block at 15 mph.
• If necessary, they had sufficient distance to take evasive action to reduce their speed before passing the signal.

Even though the crew of train Q101 had correctly identified the preceding signal, their misperception of the requirements of restricted speed, their belief that there was no train ahead of them and the visual obstruction of the track ahead by stationary train 304 led them to operate in a manner that did not permit them to stop short of the rear of train A417.

The crew's mental model was likely influenced by the fact that they were operating a premium service freight train. Before reaching Edmonton, train Q101 had received many permissive signal indications and had been given priority routing en route from Biggar, Saskatchewan.

During the approach, the crew's view of the signal and of the tail end of train A417 was obstructed by stationary train 304 on the adjacent south track. Train 304 had its cars extended westward along the left-hand curve towards the 50th Street overpass. It was not until train Q101 had closed to within about 900 feet of the signal that a clear view was established. Without a direct line of sight from further back, the train crew overestimated the distance to signal 2625N and did not reduce train speed appropriately during the approach. Upon seeing train A417 ahead, train Q101 was immediately placed into emergency. Despite the emergency braking, with the train travelling at about 37 mph, there was insufficient distance to avoid the collision with train A417.

The accident occurred just after a known period of reduced alertness (that is, between 0300 and 0500). However, in the 24-hour period before the occurrence, the locomotive engineer had only 3.5 hours of sleep while the conductor had not slept at all. The cognitive processes of the experienced and qualified train crew members were likely impeded by reduced alertness, leading to the inappropriate train-control decisions.

Both crew members of train Q101 had a wide variation in assignment start times, finish times and duration of assignment in the 7 weeks (that is, 52 days) before the accident. Further, neither employee had adequate rest in the previous 24 hours before the occurrence although there was an adequate opportunity to do so. Despite the availability of the Work/Rest Rules, work scheduling practices for train crews continue to be a challenge for both employers and employees in the railway industry.

Following signal indications

There are a number of safety defences in place on the Wainwright Subdivision that are designed to prevent accidents of this type. Some of these defences are associated with the train control system (that is, CTC) and some are associated with administrative protocols and rules (that is, CROR and the railway's GOI).

Wayside signals provide a physical signal installation combined with an administrative requirement to follow the signal indication. This defence relies on the train crew to observe the signal, recognize the intent of the signal, and take appropriate action. Operating rules and company GOI require that all signals be identified and announced within the cab of the locomotive and that others be announced over the railway radio system. These defences, while of value, are inadequate in situations where the train crew misinterprets, misperceives or does not follow a signal indication.

For more than a decade, the Board has had an outstanding recommendation calling for additional defences in signalled territory to help ensure that signal indications are consistently recognized and followed. In this occurrence, the signal indications were appropriate and were correctly identified, but the subsequent train-control decisions that lead to the collision were not appropriate. In the absence of additional backup safety defences in signalled territory, when signal indications are not correctly identified or followed, existing defences may not be adequate to reduce the risk of collision and derailment.

In June 2012, the Board updated its Watchlist. The Watchlist—based on an analysis of hundreds of TSB investigation reports, safety concerns and Board recommendations—identifies the transportation safety issues that pose the greatest risk to Canadians. In each case, the TSB has found that actions taken to date are inadequate, and that industry and regulators need to take additional concrete measures to eliminate the risks. The Board has found that there is a risk of a serious train collision or derailment if wayside signals are not consistently recognized and followed. In its 2012 Watchlist, the Board has included a new item called “Following Signal Indications.”

Reliance on strict rule compliance has been a cornerstone of railway safety philosophy in Canada for many years. This concept has served the industry well but it has limitations. This accident is one in which the requirement to follow rules failed to compensate for human error. Human error must be anticipated as even the best trained and well-meaning employees will occasionally make errors. It can be considered that by not anticipating and planning for error in the design of a safety critical system such as railway operations in signalled territory, the system is predisposed to failure.

The concept of “defense-in-depth” is one that has been known to some industries for many years. Layers of defences or redundancy have proven to be a successful approach to ensure a single system failure does not lead to catastrophic consequences. The issue of following signal indications is a good example of a situation where inadequate defences permit a single-point failure, that is the inappropriate response to a signal indication, to result in a serious accident. While the need for additional physical safety defenses to reduce the consequences of inevitable human errors in signalled territory has been on the safety radar for many years, the railway industry in Canada has not yet taken the necessary steps to reduce the risk.

Findings as to causes and contributing factors

1. The crew were unaware that train A417 had stopped on the north track ahead and the crew's mental model was that there were no trains present just beyond signal 2625N.
2. Despite having positively and correctly identified the signals, the crew did not reduce speed believing the track ahead to be clear.
3. While travelling at 37 mph approaching signal 2625N, the crew's view of the signal and of train A417 was obstructed by stationary train 304 on the adjacent south track.
4. Without a clear and direct line of sight from further back, the train crew overestimated the distance to signal 2625N and did not reduce train speed appropriately during the approach.
5. Once a clear view of signal 2625N was established, there was insufficient distance for the crew to stop train Q101 before it collided with the tail end of stationary train A417.
6. The cognitive processes of the experienced and qualified train crew members were likely impeded by reduced alertness, leading to the inappropriate train control.

Finding as to risk

1. In the absence of additional back-up safety defences in signalled territory, when signal indications are not correctly identified or followed, existing defences may not be adequate to reduce the risk of collision and derailment.

Other findings

1. The signal system functioned as designed and track and equipment did not play a role in the collision.
2. Despite the availability of the Work/Rest Rules, work scheduling practices for train crews continue to be a challenge for employers and employees in the railway industry.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 26 September 2012. It was officially released on 18 October 2012.