Railway Investigation Report R12V0008

At approximately 0413 Pacific Standard Time on 14 January 2012, Canadian National freight train A41651 13, proceeding eastward from Kamloops, British Columbia, to Edmonton, Alberta, struck a track unit at Mile 14.5 of Canadian National's Clearwater Subdivision. There were no injuries and there was no derailment. The track unit was destroyed. The lead locomotive of the train was undamaged.

Ce rapport est également disponible en français.

At approximately 0230^{Footnote 1} on 14 January 2012, a signal maintainer (the foreman) was called to repair a malfunctioning signal at Mile 13.3 of the Clearwater Subdivision, near Messiter, British Columbia (Figure 1). To perform this work, the foreman required access to the signal bungalow situated near Mile 14.5.

Image

At about 0330, the rail traffic controller (RTC) issued a track occupancy permit^{Footnote 2} (TOP) with 2 segments^{Footnote 3} (Appendix A). The first segment was a follow-up TOP,^{Footnote 4} which allowed the foreman to follow behind train Q10131-11 (train 101). This segment was given for the south track and main tracks, between signal 25S at Mile 2.5 (Ewasiuk, British Columbia) and signal 134N at Mile 13.4 (Messiter East) (Figure 2). The second segment was given for the north track from signal 134N to signal 159N at Mile 15.9 (Messiter West). The TOP was issued over the radio, and the foreman wrote the instructions on to the proper form. The foreman correctly repeated the instructions back to the RTC, including the requirement to take the north track at Messiter East. No call-back time was arranged between the RTC and the foreman. During the communications, there was no indication given of switch position at Messiter East.

Image

After completing the TOP, the foreman departed for Messiter, following behind train 101. At about 0353, the foreman travelled over the switch at Messiter East, which had been lined to the south track for train 101's movement. The foreman continued to Mile 14.5, where he exited the track unit^{Footnote 5} to work in the signal bungalow that was located south of the track.

Approximately 5 hours earlier (at 2239 on 13 January 2012), eastward Canadian National (CN) freight train A41651 13 (train 416) had departed Kamloops, British Columbia, (Mile 139.4 of the Clearwater Subdivision) and was destined for Edmonton, Alberta. The train was comprised of 2 locomotives, 25 loaded cars, 88 empty cars, and 29 residue cars. It weighed approximately 7180 tons and was about 9515 feet long. Train 416 operated with a locomotive engineer and a conductor. Both crew members were qualified for their respective positions, familiar with the territory, and had met company and regulatory fitness and rest standards.

During train 416's approach to Messiter, the crew broadcasted the advance signals. While stopped at the signal bungalow, the foreman had the external radio of the track unit tuned to the standby channel. The train crew also had its radio tuned to the standby channel. The foreman did not hear any of the broadcasts from the train crew. The train crew did not hear any broadcasts from the foreman.

At about 0413, as train 416 rounded a right-hand curve on the south track (Mile 14.65) at 33 mph, while operating on a Clear to Stop signal indication,^{Footnote 6} the crew noticed the foreman's track unit situated on the track approximately 800 feet ahead. The train was placed into emergency braking. When the foreman, who was retrieving equipment from back of the track unit, noticed the oncoming train, he exited the right-of-way to the south. Train 416 slowed to about 10 mph before striking the track unit. The train came to a stop approximately 235 feet east of the accident location. The train crew then made an emergency radio broadcast and advised the RTC of the accident. There were no injuries and there was no derailment. The track unit was destroyed, but the lead locomotive of the train was undamaged.

At the time of the occurrence, the temperature was −8°C, with light winds at approximately 8 km/h. The sky was dark, but visibility was clear.

Subdivision information

The Clearwater Subdivision consists of sections of double track and single main track. It extends west from Mile 0.0 (Blue River, British Columbia) to Mile 139.4 (Kamloops). This subdivision is an important east/west corridor for passenger trains and CN freight traffic. In the vicinity of the accident, the maximum permissible speed is 30 mph for freight trains, and 35 mph for passenger trains.

Train movements on this subdivision are controlled by the Centralized Traffic Control System (CTC), as authorized by the Canadian Rail Operating Rules (CROR), and supervised by an RTC in Edmonton.

The rail traffic controller

At the time of the accident, the RTC was supervising an RTC trainee who was operating the rail traffic control system. The RTC was qualified for the position and was familiar with the territory. The RTC trainee had completed the required classroom training and had been working at the Edmonton office for approximately 1 month. For most of this time, the RTC trainee had been working on the Clearwater Subdivision. Both the RTC and the RTC trainee met company and regulatory fitness and rest standards.

The foreman

The foreman regularly worked a normal day shift from 0700 to 1700, from Monday to Friday. He also participated in an on-call program that required him to return to work when called. On the day prior to the accident, he had worked his normal shift. That evening, as he was suffering from the effects of a cold, he did not get to sleep until approximately 0000. At 0230, he received a call from the railway to return to work to repair a malfunctioning signal.

Alertness and circadian rhythms

The human body's circadian rhythms are synchronized so that people are awake during the day and can sleep at night. During the 24-hour cycle, there are 2 circadian low periods (between 0300 and 0500 and between 1500 and 1700), where an individual can experience increased sleepiness and a lower level of alertness. These periods of reduced alertness can lead to a lower level of performance in the completion of certain tasks.

Mental models

Cognitive studies have shown that people use mental models as partial representations of complex situations. They are created to achieve specific goals by filtering inputs and using what is perceived to be the most critical information.^{Footnote 7}

For dynamic tasks (e.g., driving a vehicle or operating a train), the operator's mental models are created from experience, expectations, anticipation, visual cues, and audio cues. Once an operator has created a mental model, the operator will tend to look for reinforcements to support the mental model and will tend to reject any contradictory evidence. This type of mental processing is referred to as confirmation bias or hypothesis lock.^{Footnote 8}

Track occupancy permits and train control systems

From 1990 to about 2006, CN used RTC I as its train traffic control software system. Governed by the application of the CROR and operated by an RTC, this system allowed for the protection of trains and other movements (e.g., track units) in CTC territory. Protection was provided by issuing or restricting the authority to occupy a section of track. Authority was granted through the use of permissive signals for trains and TOPs for track units. Foremen operate in track units, some of which have insulated running gear (i.e., wheels, axles) and do not actuate railway signal systems. An authority was issued, usually for each section (block) of track that had to be occupied. In this regard, the foreman would require a number of TOPs, each with an authorization number, to travel across the territory. The foreman would cancel the TOP for each block as he entered the limits of the next block. Within the RTC I system, the TOP coverage was graphically displayed on the RTC's screen.

In the later years, the RTC I system was modified to allow track units to follow behind trains within the same block, by using a TOP that protects against the train (i.e., follow-up TOP). Verification techniques were used to ensure that the train had passed a specific location before the track unit was permitted to enter the main track. The follow-up TOP would be authorized up to the next controlled location,^{Footnote 9} excluding exit signals^{Footnote 10} associated with crossover locations. For situations involving exit signals, the RTC I system would prevent the RTC from continuing with the follow-up TOP if the route diverged from the route of the train being followed.

In 2006, RTC II, an updated version of CN's train control system for CTC, was introduced. This system provides additional flexibility to RTCs when controlling trains and other movements in CTC territory. For example, TOPs with multiple segments were introduced. In addition, other forms of authorization or restriction could be issued in one document under one authorization number. As a foreman travels across the territory, he can cancel TOP segments without having to obtain additional TOPs. This feature reduces the workload of both the foreman and the RTC.

However, for follow-up TOPs, RTC II (unlike RTC I) does not prevent the RTC from selecting a diverging route from the preceding train movement. While this practice is prohibited by company procedures, the RTC II system does not prompt the RTC with a warning. The expectation is that the RTC understands the requirements of the RTC procedures and the operation of the RTC II system. In some circumstances, there is potential for a foreman to occupy track ahead of a train he is supposed to be following.

In both the RTC I and RTC II systems, TOPs are issued "in writing"^{Footnote 11} by using the radio. When issuing the TOP, the RTC is required to read the contents of the TOP to the foreman, including an authority number and a description of the signals limiting the extent of the authority. The foreman must make a written copy and repeat back to the RTC the contents of the TOP to ensure proper transmission and transcription. The RTC must verify the information as it is being repeated after which a "completed" time is issued, making the authority effective.

When a TOP is to be cancelled, all employees under the protection of the TOP must first clear the track. The foreman then advises the RTC by stating his name, the TOP number, and the limits of the TOP to be cancelled. The RTC must verify the limits of the TOP to be cancelled. The RTC will cancel the TOP by stating to the foreman the TOP number, the cancellation time, and the initials of the RTC. The foreman must then repeat and acknowledge this information.

CN RTC Manual

CN developed an RTC Manual which provides work instructions to RTCs. Item 779 of the Manual^{Footnote 12} ("Issuing a TOP") states in part that:

Dual control switches … for the requested route must be lined by the RTC. When this is not possible due to a conflicting TOP within the same or overlapping limits, the RTC must comply with CROR Rule 815.^{Footnote 13}

The RTC Manual also states that:

Each TOP must include a call before time or location. (Exception: A call before time is not required if the RTC and the Foreman can come to an understanding of how and when the foreman will clear (applicable at terminals and short moves)).

RTC notice 2011-007, an addition to Item 781 of the Manual ("Behind Train TOP"), states in part that:

RTCs must ensure that the TOP limits do not extend beyond the limits of where the movement is authorized. If the foreman wishes to continue on a different route than the movement, a new TOP must be issued from that point. Anytime a movement leaves the limits of a follow up TOP, a new TOP must be issued removing Behind Train portion.

Common rail traffic controller practices regarding track occupancy permits

Through discussion with RTCs,^{Footnote 14} it was determined that:

• Although required to do so by company procedure, RTCs often do not provide call back times to foremen who are patrolling the track. Because communication will be frequent, a call-back is thought to be redundant.
• Although contrary to the RTC Manual, some RTCs provide follow-up TOP limits that diverge onto an adjacent main track which can extend to a signal further in the direction of travel than the authorization of the train being followed.
• RTCs commonly provide switch position information to foremen if the switch is lined for "other than the intended route".

Advance warning of oncoming trains

It is common for foremen to work alone on the track. In the event of a distraction, there is no associated defence mechanism in place to prevent a lone foreman from mistakenly travelling outside the limits of authority given. Advance warning systems do exist and can provide backup safety defences for foremen. These systems are not typically used in Canada.

In the United States, some railroads (e.g., Union Pacific Railroad) use a system called Track Watch (Figure 3) to provide employees working on the track with advance warning of approaching trains. The system employs an optical track-mounted proximity device to detect the passing of a train. The system then sends a signal to a portable repeater, which relays the signal to personal receivers worn by each track worker. When a train is detected, the personal receiver device emits a loud audible alarm, a vibration alert, and a flashing light signal. There is also an optional track-side warning system which incorporates dual warning sirens and a strobe light. When operating in difficult terrain, a signal repeater can be used to increase the system's range.

Image

Proximity detection

A proximity detection device was developed and put into use after a 1996 collision on the Quebec North Shore & Labrador Railway (TSB report R96Q0050). The proximity detection device can trigger penalty braking if a train crew or track unit operator does not acknowledge the alert warning status when they come within a predetermined distance from other movements. While this device is currently used on single track territory, it is possible to enter additional coordinates into the database to sufficiently accommodate double track. However, except for limited trials, no similar systems have been implemented on other Canadian railways.

Radio broadcast and monitoring requirements

CROR Rule 119, "Continuous Monitoring" specifies (in part):

(c) Foreman named in … TOP … must set their radio to "scan mode" when not being used to communicate with another employee and must otherwise have their radio set to monitor the applicable designated standby channel.

CROR Rule 578, "Radio Broadcast Requirements" specifies (in part):

(a) Within single track, a member of the crew on all trains or transfers must initiate a radio broadcast to the airwaves on the designated standby channel stating the name of the signal displayed on the advance signal to the next controlled location, controlled point or interlocking.

CN's General Engineering Instructions, item 10.11, specifies (in part):

General radio broadcasts on the designated operating channel, should be initiated by the track unit operator at regular intervals. Broadcasts should include the following information:

• identification of the track unit,
• present location and
• direction of travel.^{Footnote 15}

Examination of hi-rail strobe lights and radio communications

During discussions with railway personnel, it was highlighted that the audio clarity of radio transmissions can be affected when strobe lights on a hi-rail vehicle are operating. The interference can be severe enough to require turning off the strobe light in order to continue with the radio communication. However, employee reports of radio interference due to hi-rail strobe lights were not documented nor fully investigated by the railway.

The strobe light and radio from the track unit involved in this occurrence were retrieved and sent to the TSB Laboratory. It was determined that:

• During testing with the radio retrieved from the track unit, radio communication was not affected by the operation of the strobe light.
• During testing with other similar radios, strobe light operation did affect radio reception over various frequencies.

The following TSB Laboratory report was completed:

• LP 018/2012 – Strobe Light Interference

The analysis will focus on the reasons why the foreman went outside the limits of his TOP, and why the foreman was not alerted to the presence of the oncoming train.

The accident

Train 416 struck the track unit after the foreman travelled beyond the limits of the TOP. The foreman had vacated the vehicle in order to perform signal maintenance activities.

At about 0330 on 14 January 2012, the foreman received a TOP with 2 segments from the RTC, giving him the authority first to travel behind train 101 along the main track between Mile 2.5 and Mile 13.4, and then to take the north main track, where he was authorized to travel as far as Mile 15.9. The foreman copied the TOP on the prescribed form and repeated it back to the RTC. The RTC verified the repeated information prior to finalizing the authorities by issuing a complete time.

The requirement for TOPs to be "in writing", as prescribed by the CROR, is intended to ensure accurate communication and understanding of the authority provided. Despite this procedure, when the foreman arrived at signal 134S, approximately 30 minutes later, he did not recall that the designated track for the second segment of the TOP was different from the first. He continued on the south main track instead of diverging to the north main track, placing himself in direct conflict with approaching train 416, of which he was not aware.

The foreman had met the regulatory fitness and rest standards. However, since he normally worked the day shift, his sleep would generally occur at night. Prior to being called back to work on the night of the accident, the foreman had difficulty sleeping due to the effects of a cold. Also, the foreman's circadian rhythm was not synchronized to night work. There are 2 periods of maximum sleepiness during a 24-hour period, and one of these periods occurs between 0300 and 0500. During this period of maximum sleepiness, there is diminished alertness.

Given that the foreman's circadian rhythms were oriented around being awake and functioning well during the day, he was likely suffering from reduced alertness levels due to the circadian timing of the low period in performance. He was therefore susceptible to performance-related errors.

The foreman's primary task that night was to repair the signal at Mile 13.3. He was familiar with the Clearwater Subdivision and aware of the location of the signal bungalow. Because he was focused on working at the bungalow, which was situated south of the tracks, his mental model was based on travelling on the south track. With this mental model, he did not pay full attention to his TOP, specifically to the second segment (for the north track). The foreman's diminished state of alertness and his focus on the south portion of the right-of-way likely contributed to him formulating an erroneous mental model, which resulted in taking the south track instead of the north track as required at Mile 13.4.

When travelling under the authority of a TOP, the switches are usually lined for the intended route. Should the switches not be lined for the employee on a follow-up movement, the employee will normally be notified by the RTC or would have to contact the RTC to line the switch. The foreman had not been informed by the RTC that the switch at Mile 13.4 was lined against him. When the foreman reached the switch and found it lined for the south track, rather than triggering a recollection that he was to take the north track, this reinforced his erroneous mental model.

Establishing a call-back time

Some RTCs have developed alternate work procedures to help manage their workload. An example of an alternate work procedure is not always establishing a call-back time when issuing a TOP, even though company procedures require it to be done. In this occurrence, the foreman was on a section of track and at a time where very few trains were expected. While not patrolling at the time, he was not given a call-back time as it was likely anticipated that there would be frequent communication. Although this may be inconsequential in some instances, in this accident, the foreman inadvertently travelled outside his authorized limits, and his vehicle's presence was not detectable by the RTC and the train control system. When a call-back time is not established, communications may be delayed, which can lead to missed opportunities for the RTC and the foreman to identify potential errors, therefore increasing the risk of collision with another track movement.

Lone foreman protection

It is not uncommon for foremen to be travelling and working alone under the authority of a TOP. To minimize the risk associated with this type of track activity, there are technologies available that can provide advanced warning of approaching trains. The Track Watch system used by the Union Pacific Railroad and proximity detection devices used by Quebec North Shore and Labrador Railway are examples of such technology.

However, typically in Canada, there are no other lines of defence for the lone foreman. In these situations, given that it is not always possible for the RTC to line all switches when issuing a TOP, a lone foreman may inadvertently travel beyond the limits of his authority. Also, as the track unit is normally not detectable by the train control system, the RTC would not be aware that the foreman was beyond his limits of authority. In addition, even when the RTC is communicating with the foreman during a call-back, there is no requirement for the foreman to identify his location. Although there are procedures in place to guard against errors when TOPs are issued, there are increased safety risks for lone foremen, as critical errors can go undetected when there are no other lines of defence to trigger recall.

Proximity detection is one example of technology that could warn trains and RTCs of the presence of track units.

RTC II train control system

The main function of an RTC is to move train traffic across the territory in the safest and most productive manner. Similar to all railway personnel working in a safety-critical position, an RTC's attention is often divided between multiple responsibilities, making the RTC susceptible to distraction and potential errors. To help with the RTC function, software systems have been developed and implemented. A well-designed software system should be able to eliminate or minimize erroneous information and reduce the possibility of error.

The RTC II train control system, which was implemented by CN in 2006, presents a number of significant design improvements in comparison to the previous system (RTC I). However, the possibility of issuing a follow-up TOP with limits diverging from those of the train being followed is an RTC II design feature that can negatively affect safety. This practice is contrary to CN instructions. Some RTCs provided follow-up TOP limits that diverged from those of the trains being followed because they did not understand the risks associated with this practice.

Findings as to causes and contributing factors

1. Train 416 struck the track unit after the foreman had travelled beyond the limits of his track occupancy permit.
2. Despite following the verification procedures when the track occupancy permit was issued, the foreman took the south main track instead of the north track upon arriving at signal 134S.
3. The foreman's diminished state of alertness and his focus on the south portion of the right-of-way likely contributed to the formulation of an erroneous mental model, resulting in him taking the south track.
4. The foreman had not been informed by the rail traffic controller that the switch at Mile 13.4 was lined against him. When the foreman reached the switch and found it lined for the south track, rather than triggering a recollection that he was to take the north track, this reinforced his erroneous mental model.

Findings as to risk

1. When a call-back time is not established, communications may be delayed, which can lead to missed opportunities for the rail traffic controller and the foreman to identify potential errors, increasing the risk of collision with another track movement.
2. There are increased safety risks for lone foremen, as critical errors can go undetected when there are no other lines of defence.

Other findings

1. There are technologies available that can provide advanced warning of approaching trains to lower the risks associated with human error.
2. Some rail traffic controllers provided follow-up track occupancy permit limits that diverged from those of trains being followed because they did not understand the risks associated with this practice.

In January 2012, CN Engineering employees received a written safety flash addressing the events of this accident, as well as a reminder of the proper TOP requirements.

In March 2012, CN conducted 18 rail traffic controller (RTC) efficiency tests involving follow-up track occupancy permits to ensure that proper procedures were followed.

During June and July 2012, RTC notice 2011-007, an addition to Item 781 of the RTC Manual ("Behind Train TOP"), was reviewed with RTCs in the Edmonton office to ensure that they fully understood the procedures for follow-up TOPs.

CN is implementing new technology (E-TOP) for the electronic issuance of TOPs. E-TOP is to be used in conjunction with the RTC II control system. E-TOP was introduced at the Edmonton RTC Centre in April 2012. It is anticipated that this technology will be implemented system-wide. The following points detail some of the intended functions and operating characteristics of the system:

• Targeted for CN Engineering Services personnel;
• Cell phone coverage must be available to connect to the CN local area network;
• The CN foremen will be able to select limits from a live track line display;
• The RTC has ability to accept or reject requests;
• The CN foremen will have the ability to "instant message" the RTC;
• Follow-up TOPs (i.e., behind 1 train only) are allowed but not over cleared signals; and
• A following foreman will not be allowed to take a diverging route.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 09 January 2013. It was officially released on 23 January 2013.

Appendix A – Segmented track occupancy permit

Image