Railway Investigation Report R13C0049

On 18 May 2013, at about 1330 Mountain Daylight Time, Canadian Pacific Railway train 351-424, operating westward on the north main track of the Maple Creek Subdivision approaching Dunmore, Alberta, struck the side of eastward Canadian Pacific Railway train 100-17 that was departing Dunmore from the north main track through the crossover onto the Depot 1 track. As a result of the collision, the 2 lead locomotives and following 2 cars on train 351-424 derailed. On train 100-17, 2 cars derailed and several others sustained damage. The conductor of train 351-424 sustained minor injuries and was taken to hospital.

Le présent rapport est également disponible en français. Factual information

The accident

On 18 May 2013, at about 1330,^{Footnote 1} westbound Canadian Pacific Railway (CP) train 351-424 (train 351) struck the side of eastbound train CP 100-17 (train 100) at Mile 138.7 of the Maple Creek Subdivision in Dunmore, Alberta (Figure 1). Train 351 comprised 2 head-end locomotives, 1 mid-train remote locomotive, and 112 loaded grain hopper cars. The train weighed 14 012 tons and was 6667 feet in length. Train 100 comprised 1 head-end locomotive, 1 tail-end remote locomotive, and 49 loaded container cars. The train weighed 5567 tons and was 6414 feet in length.

As a result of the collision, the 2 lead locomotives and the following 2 cars on train 351 derailed. On train 100, 2 cars derailed and several others sustained damage. The conductor of train 351 sustained minor injuries and was taken to hospital.

After departing Medicine Hat, Alberta, train 100 proceeded to Dunmore where the train was lined onto the north main track, and brought to a stop. The crew set out a locomotive, returned to their train, and waited at signal 1388N for eastbound train X198-16 to depart ahead of them.

Train 100 then continued eastward on the Maple Creek Subdivision using the crossover to go from the north main track back onto the south main track. The train then diverged immediately southward onto Depot 1 track. As train 100 began entering Depot 1 track, the crew observed train 351 approaching from the east on the north main track at a higher-than-anticipated speed, considering the impending need for train 351 to stop at signal 1387N.

Train 351 originated at Java, Saskatchewan, (Mile 5.6) on the Swift Current Subdivision, at 0840 and proceeded to Kincorth, Saskatchewan, (Mile 97.0) where locomotive CP 9804 was lifted and placed in the trailing position in the head-end consist. Train 351 then proceeded without incident to Pashley, Alberta, (Mile 132.6) where it took the siding for a meet with eastbound train X198-16. After providing the mandatory roll-by inspection, train 351 re-entered the main track on signal indication and continued westward. At this time, the conductor contacted the Supervisor of Operations and obtained yarding instructions for Medicine Hat Yard.

Train 351 next encountered intermediate signal 1347S (Figure 2). The signal indication was identified and communicated in the cab as Clear to Limited (Figure 3). The written entry in the conductor's centralized traffic control (CTC) Signal Record form^{Footnote 2} for this signal was Clear to Limited. As this signal was an advance signal to a controlled location, an announcement was made over the train standby channel stating the name of the signal and the controlled location to which the signal governs movement.

At Mile 134.6, train 351 encountered a hot box detector (HBD) that scanned the wheels and axle bearings for heat, and evaluated the train for dragging equipment.

The next signal encountered was signal 1365S (Figure 2) at Larkhall, Alberta, (Mile 136.5) which is the beginning of the two main tracks that extend westward to Bellcott, Alberta, (Mile 141.9). At signal 1365S, the continuation of the single main track becomes the south main track, and train 351 was lined to diverge onto the north main track.

In the cab, signal 1365S was identified and communicated by the locomotive engineer (LE) as a Limited to Clear indication (Figure 3). The LE believed that the conductor had repeated Limited to Clear in response. However, the conductor believed that he had identified the signal as a Limited to Stop indication, and had called Limited to Stop to the LE. Neither crew member noted any discrepancy with the indication vocalized by the other. The indication that was entered on the conductor's CTC Signal Record form for signal 1365S was Limited to Stop.

At this time, radio traffic on the train standby channel was busy. The radio traffic included the HBD announcement of “no defects” and a number of broadcasts for other operational activities, including the required radio announcements for several trains in the area.

When train 351 was fully on the north main track (i.e., the tail end had cleared the turnout at Larkhall), maximum permissible speed increased from 45 mph to 55 mph. As the LE was operating with the expectation that the next signal, 1387N (Figure 2), would be Clear, allowing him to proceed past this point with no restrictions, train speed was increased to 48 mph.

As train 351 proceeded westward on a slight curve (i.e., 1.0 degree) on the north main track, the conductor was occupied with other operational activities (i.e., paperwork) and was not specifically observing the route ahead. Shortly thereafter, the LE observed that train 100 was crossing over at Dunmore, with the tail end of the train still occupying the north main track. He then initiated an emergency brake application. At approximately 1200 feet from signal 1387N, the LE observed the Stop indication and attempted to contact the crew of train 100 by radio to request that they accelerate to clear the north main track.

Train 351 had locomotives in the lead and mid-train positions as well as a sense and braking unit (SBU) on the tail end. The emergency brake application propagated from all three locations providing a rapid brake response throughout the train.

Train 351 travelled approximately 1100 feet past the Stop signal and collided with the 39th car of train 100. At the time of the collision, train 351 was travelling at 20.2 mph. The lead locomotives of train 351 (CEFX 1049, CP 9804) derailed to the north and came to rest leaning at about 20 degrees and 70 degrees respectively (Photo 1).

Approximately 80 litres of diesel fuel was lost when the fuel tanks punctured. A small fire started post-accident due to engine oil igniting. The fire was extinguished by emergency services personnel upon their arrival. The conductor of train 351 sustained minor injuries and was taken to hospital.

Maple Creek Subdivision

The Maple Creek Subdivision begins in Swift Current, Saskatchewan, (Mile 0.0) and ends in Medicine Hat, Alberta, (Mile 147.4). Train movements are governed by the CTC method of train control, as authorized by the Canadian Rail Operating Rules (CROR) and supervised by a rail traffic controller (RTC) located in Calgary, Alberta.

In the vicinity of Dunmore, the subdivision consisted of double main track oriented in an east-west direction, and ascending to the west. The track structure was composed of 136-pound continuously welded rail fastened to hardwood ties by 14-inch double-shouldered tie plates. The rail was secured with 5 spikes per tie plate and was anchored with Super Fair Pandrol® clips. The track condition was considered to be good.

Equipment information

Inspection and maintenance records for the locomotives and cars on train 351 and train 100 were reviewed. It was determined that all equipment was in serviceable condition and was operating as intended.

Weather information

At the time of the occurrence, the weather was mostly cloudy with good visibility. The temperature was approximately 19°C.

Crew information

The operating crews for train 351 and train 100 were each composed of a locomotive engineer and a conductor. Both crews were qualified for their respective positions and met company and regulatory fitness and rest standards. The crew members on train 351 had accumulated more than 10 years' experience in their respective positions. The LE had qualified as a conductor in 1988 and was promoted to LE in 2003. The conductor qualified in 2003. At the time of the occurrence, the crew of train 100 had been on duty for about 2 hours and the crew of train 351 had been on duty for about 6 hours.

Railway and regulatory requirements at signals

The CROR^{Footnote 3} specifies (in part):

CROR Rule 406 – Clear to Limited signal indicates:

Proceed, approaching next signal at LIMITED Speed.^{Footnote 4}

CROR Rule 416 – Limited to Clear signal indicates:

Proceed, LIMITED speed passing signal and through turnouts.

CROR Rule 421 – Limited to Stop signal indicates:

Proceed, LIMITED speed passing signal and through turnouts, preparing to stop at next signal.

CROR Rule 439 – Stop signal indicates:

Stop

CROR Rule 34 – Fixed Signal Recognition and Compliance indicates (in part):

1. The crew on the controlling engine of any movement and snow plow foremen must know the indication of each fixed signal […] before passing it.
2. Crew members within physical hearing range must communicate to each other, in a clear and audible manner, the indication by name, of each fixed signal they are required to identify. Each signal affecting their movement must be called out as soon as it is positively identified, but crew members must watch for and promptly communicate and act on any change of indication which may occur.

CROR Rule 578 – Radio Broadcast Requirements indicates (in part):

Within single track, a member of the crew on all trains or transfers must initiate a radio broadcast to the airwaves on the designated standby channel stating the name of the signal displayed on the advance signal to the next controlled location, controlled point or interlocking.

Canadian Pacific Railway's centralized traffic control signal record form

Following a number of train collisions in signalled territory, CP implemented the CTC Signal Record form in July 2010. A revised pre-printed version of the form was piloted in July 2011. Based on positive feedback, the revised form was implemented across CP's Canadian network in November 2011.

The CTC Signal Record form includes specific guidance and instructions as follows:

Fixed Signal recognition combined with in cab communication and radio broadcast [as per Rules 34(b) and 578] are critical tasks for the safe operation of movements.

The "CTC Signal Record" must be completed for each signal subject to Rule 578 as follows:

Immediately after the leading end of the movement passes each applicable signal, the Conductor must record:

1. The track, when locations exist on more than one track in multi-track E.g.: "N" - North track, "1" - No 1 track, etc.;
2. the current time in the "Time" column;
3. record a checkmark in the "Clear Signal" column or the name of the signal, using the first two letters of each signal name I.e.: "CL" = "Clear", "CL to ST" = Clear to Stop, Etc. in the "Other than Clear Signal" column;
4. a "Y" as applicable in the "Job Briefing" column to indicate that communication of the required actions to comply with any signal restriction has taken place.

The names of the Conductor and Locomotive Engineer must be printed on the applicable portion of the form and submitted in the designated location at the home terminal.

On 30 May 2013, the requirement for conductors to complete the Signal Record form was rescinded. CP determined that the form was no longer adding benefit to the process and had become an unnecessary distraction.

Positioning of the signals at Dunmore

For westbound trains at Dunmore, the wayside signals are positioned as follows:

• The north main track signal (1387N) is positioned to the right of the track and approximately 20 feet west of the cantilever structure for the south main track signal.
• The south main track signal (1387S) is prominently displayed on an overhead cantilever structure (Photo 2).

The north main track signal is positioned in this manner to accommodate the western access to the grain terminals. When approaching this signal, because of the track curvature and the fact that there are multiple tracks to the north and south of the main track, it may be difficult to observe signal 1387N when there are railcars on these tracks.

However, with no cars or obstructions on the adjacent tracks, the signals are normally visible for approximately 2500 feet.

On the day of the occurrence, due to a train on the adjacent south main track, the signals were in view from about 1200 feet, and the clear but overcast skies provided good contrast for signal visibility.

Centralized traffic control

CTC is a method of traffic control that employs interconnected track circuits and signals in the field to control movements. Computer displays and controls are installed in the RTC office. Signals are actuated by the presence of a movement. The signal indications in the field provide

• information to train crews that indicates the speed at which they may operate and how far they are permitted to travel; and
• protection against certain conditions, including if the block ahead is occupied, a rail is broken, or a main track switch is left open.

Train crews, who must be familiar with the signal indications specified in CROR, are required to control their trains in accordance with these rules. CTC does not provide automatic enforcement to slow or stop a train before it passes a Stop signal or other point of restriction.

In the RTC office, track occupancy is displayed on the RTC's computer screen. Track occupancy normally indicates the presence of a train, but can also be an indication of an interrupted track circuit (e.g., a broken rail or a switch left open). The RTC can control certain signals (controlled signals) by setting them to a Stop indication or by requesting that they display permissive indications.

When an RTC requests signals for a train, the signal system determines how permissive the signals will be based on the presence of other track occupancies and how many consecutive signals have been requested.

Recorded information

Based on RTC recordings, it was determined that

• a broadcast was made by train 351 at Larkhall;
• the content of train 351's broadcast could not be established as the broadcast occurred just as the HBD system message was ending and a broadcast from another switching crew was starting.

There were no voice recorders or video recorders in the cab of the leading locomotive of train 351. In addition, the lead locomotive of train 351 was not equipped with a forward-facing video camera.

The signal logs were reviewed. It was confirmed that the sequence of signal indications for train 351 was as follows:

• a Clear to Limited indication at signal 1347S;
• a Limited to Stop indication at signal 1365S at Larkhall (i.e., the advance signal^{Footnote 5} to Dunmore); and
• a Stop indication at signal 1387N (i.e., the controlled signal governing westbound movements on the north main track at Dunmore).

Hot box detector system broadcasts

HBD systems on CP typically provide an automated broadcast on the train standby channel that includes

• mileage and subdivision of the detector;
• ambient temperature;
• total axles on the train; and
• whether or not there are any hot wheel, hot bearing or dragging equipment alarms.

The broadcast is repeated and the transmission ends with “message complete, detector out.” The total broadcast time is typically about 36 seconds. On the CP network, HBD systems are normally installed close to yards, sidings or back tracks, which can be used as designated set-off points. Damaged or defective rolling stock identified through HBD inspections can then be set out at these locations for repair.

Following the investigation into a collision involving 2 CP trains at Redgrave, British Columbia, on 30 October 2009,^{Footnote 6} the Board made the following finding:

When hot box detector (HBD) broadcasts are received, they require crew attention at locations in which distraction can potentially lead to the misidentification of signals or can preclude crews from announcing signals. As a result, there is some risk that signal recognition errors will occur and go uncorrected, leading to unauthorized movements.

Situational awareness and mental models during train operations

Situational awareness (SA) in relation to operational matters refers to the operator knowing what is happening in the immediate environment. A train crew's SA comes from various information sources, including radio transmissions, signal indications, in-cab displays, observation of the track, environmental conditions, and written information.

Railway rules and operating instructions also affect SA. For example, CROR and general operating instructions (GOI) provide information that operating crews are required to use. When operating a train, decisions and actions greatly depend on the crew's assessment and understanding of the operational situation.

There are 3 stages of SA:^{Footnote 7}

• “Perception” refers to the recognition that new unambiguous cues exist.
• “Comprehension” refers to understanding the order of importance of the new cues.
• “Projection” refers to the ability to forecast future events based on information given.

Accurate SA is highly dependent on switching attention between different information sources during which people can get trapped in a phenomenon called attention narrowing or tunnelling. When succumbing to tunnelling, they lock in on certain cues or features of the environment they are trying to process, and will either intentionally or inadvertently drop their scanning behaviour. In these cases, people will believe that this limited focus is sufficient because the situation they are attending to is most important in their minds. In other cases, people can fixate on certain information and forget to reinstate their information scan. Either situation can result in their SA being inaccurate. The reality is that keeping at least a high-level understanding of what is happening across the board is a prerequisite to being able to know that certain factors are indeed still more important than others. Otherwise, it is often the neglected aspects of the situation that prove to be the fatal factors in loss of SA.^{Footnote 8}

Defences for signal indications

With respect to train operations in signalled territory, the railways and Transport Canada (TC) have based their safety philosophy on strict rules compliance. Train crews are expected to react to the progression of wayside signal indications. The level of safety afforded by wayside signal systems has not advanced significantly beyond their original design which dates back more than 100 years.

In a complex system, such as rail transportation, even the most rigorous set of rules will not cover every contingency and interpretation by individuals. In addition, even motivated and experienced employees are subject to the normal slips, lapses and mistakes that characterize human behaviour. The defence-in-depth-philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors.

Following the investigation into the 1998 train collision involving 2 CP trains near Notch Hill, British Columbia,^{Footnote 9} the Board determined that backup safety defences for signal indications were inadequate. The Board recommended that:

Action to date on the deficiency has resulted in procedural improvements implemented by CP with its crew resource management practices. While there has been some safety benefit, administrative or procedural defences are not always adequate to protect against an operating crew misinterpreting and/or misperceiving wayside signal indications. To date, there has been no formal strategy developed to adapt either emerging technology or existing on-board computer systems to provide fail-safe physical train control defences. Therefore, in its latest reassessment, the response to Recommendation R00-04 was assessed as Satisfactory in Part.

Following the investigation into the 2012 derailment and collision of VIA 92 near Burlington, Ontario,^{Footnote 10} on Canadian National's (CN) Oakville Subdivision, the Board indicated that TC and the industry should move forward with a strategy that will prevent accidents like this one, by ensuring signals, operating speeds and operating limits will always be followed. Therefore, the Board recommended that:

This recommendation is related to the TSB Watchlist issue of “Following railway signal indications” where there is a risk of a serious train collision or derailment if railway signals are not consistently recognized and followed.

Action to date has not led to the implementation of physical fail-safe train controls. TC formed a working group under the auspices of the Advisory Council on Railway Safety (ACRS), which includes representatives from Canadian National, Canadian Pacific, VIA Rail, the Railway Association of Canada (RAC) and the Canadian Association of Railway Suppliers. The first meeting of the working group was held in January 2014 to review the draft Terms of Reference for the project.

The working group held another meeting in February 2014 to discuss the scope of work, including a research component with TC's Railway Research Advisory Board (RRAB). Three research projects were initiated in 2014:

• an evaluation of the cognitive and human factors aspects of signal recognition and following, including cognitive vulnerabilities of the task and an overview of mitigating strategies and their effectiveness
• a literature review of existing technologies, including their capabilities, vitality and miles of use in revenue service
• a literature review of the human factors considerations of train control automation in the cab, including an analysis of accidents where train control technology did not successfully prevent the occurrence.

The working group has begun a process which may lead to positive safety action. However, the process may take significant time to produce any positive results. The risk of a serious train collision or derailment occurring in the absence of physical fail-safe train controls continues. Therefore, in its latest reassessment, the response to Recommendation R13-01 was assessed as Satisfactory in Part.

Technologies to protect against signal misinterpretation

• The railway industry has developed various technologies to address the risk of misinterpreting or not following signal indications. The technologies currently in use on North American railways include
• proximity detection;
• cab signalling systems; and
• positive train control.

Proximity detection

A proximity detection device was developed and implemented by Quebec North Shore & Labrador Railway after a 1996 collision involving 2 of its trains.^{Footnote 11} The proximity detection device is designed to trigger penalty braking if train crews or track unit operators do not acknowledge the alert warning status when they come within a predetermined distance of another movement. Except for limited trials, no similar systems have been implemented on other Canadian railways.

Cabsignalling systems

Cab signalling is a communications system that provides track status information to a display device mounted inside the locomotive cab. The simplest systems display the wayside signal indication while more advanced systems also display maximum permissible speeds. The cab signalling system can be combined with Automatic Train Control (ATC) to warn operating crews of their proximity to points of restriction and to initiate enforcement action to slow or stop a train.^{Footnote 12} Cab signals can reduce the risk of signal recognition errors.

In 1922, the United States of America (U.S.) Interstate Commerce Commission (ICC) made a ruling that required U.S. railroads to install some form of ATC in one full passenger division by 1925. In response to this ruling, the first cab signalling systems were developed and put into use in the U.S.^{Footnote 13} Cab signalling systems have evolved and remain in use in some U.S. passenger train corridors. For example, Amtrak Acela locomotive cabs are equipped with in-cab voice recording interfaced with the locomotive event recorder (LER). In Canada, there is currently no cab signalling system in use by freight or passenger railways.

Positive train control

Positive train control (PTC) is an emerging train control technology that is designed to prevent

• train-to-train collisions;
• overspeed derailments;
• incursions into work zone limits; and
• movement of a train through a switch left in the wrong position.

If the operating crew does not initiate an adequate response, the PTC system would automatically slow or stop the train. In the U.S., PTC technology has been under development for many years.

The September 2008 collision between a Metrolink passenger train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the Rail Safety Improvement Act of 2008. This legislation mandated that, by 2015, PTC be installed on the higher-risk rail lines in the U.S. However, due to a number of technical challenges, it is anticipated that the U.S. implementation of PTC will be delayed beyond the 31 December 2015 deadline.

In Canada, there are currently no PTC systems in use by freight or passenger railways, and there are no planned PTC installations. Any application of PTC in Canada likely would not occur for a number of years after the U.S. implementation is complete. However, to meet the PTC requirements for U.S. operations, both CN and CP have PTC implementation plans.

• As part of CP's implementation plan, 1004 locomotives are planned to be equipped with the required on-board systems. CP plans to install PTC on approximately 2850 miles of track in the U.S.
• As part of CN's PTC implementation plan, 820 high horsepower locomotives and 180 low horsepower locomotives will be equipped with the required on-board systems. CN will install PTC on approximately 3720 route miles of track in the U.S.

For both CN and CP, the PTC system will be based on the Interoperable Electronic Train Management System (I-ETMS). CN will install it on 41 subdivisions, and CP will install it on 17 subdivisions, corresponding respectively to 62% and 89% of their total U.S. route miles (excluding yard limits). I-ETMS is a locomotive-centric, train control system that uses a combination of locomotive, office and wayside data that is integrated using a radio network. This system will provide the following functions:

• Alert train crews to pending authority and speed limit violations, including passing a stop signal.
• Stop trains before exceeding authority and speed limits, including signals at stop.
• Interrogate upcoming wayside signals and switches, in a train route when operating in I-ETMS territory.
• Protect work zone limits by enforcing compliance with work zone restrictions.

This system is under development and awaiting Federal Railroad Administration (FRA) certification for use in revenue service.

Transportation Safety Board investigations involving misinterpretation/misperception of wayside signals

• Since 2007, the TSB has conducted 6 investigations into train collisions or derailments where the misinterpretation and/or misperception of wayside signal indications by an operating crew was a cause or contributing factor, as follows:
• R12T0038 (Aldershot) ― On 26 February 2012, VIA Rail Canada Inc. passenger train No. 92 (VIA 92) was proceeding eastward from Niagara Falls, Ontario, to Toronto, Ontario, on track 2 of the CN Oakville Subdivision near Burlington, Ontario. After a stop at the station at Aldershot, Ontario, (Mile 34.30) the train departed on track 2. The track switches were lined to route the train from track 2 to track 3, through crossover No. 5 at Mile 33.23, which had an authorized speed of 15 mph. At 1525:43 Eastern Standard Time, VIA 92 entered crossover No. 5 while travelling at about 67 mph. Subsequently, the locomotive and all 5 passenger cars derailed. The operating crew was fatally injured and 45 persons (44 passengers and the service manager) sustained various injuries.
• R11E0063 (Bailey) ― On 23 June 2011, at approximately 0625 Mountain Daylight Time, CN freight train Q10131-21, proceeding westward at 25 mph on the Wainwright Subdivision, collided with the tail end of CN freight train A41751-23 at Mile 262.30. As a result of the collision, 2 intermodal flat cars derailed (3 car bodies) and locomotive CN 2234 was damaged.
• R10Q0011 (Saint-Charles-de-Bellechasse) ― On 25 February 2010, VIA train No. 15 (VIA 15) was proceeding westward from Halifax, Nova Scotia, to Montréal, Quebec. At approximately 0425 Eastern Standard Time, near Saint-Charles-de-Bellechasse, Quebec (Mile 100.78 of the CN Montmagny Subdivision), the train entered a siding switch, which had an authorized speed of 15 mph, while travelling at approximately 64 mph. Two locomotives and 6 passenger cars derailed. Two locomotive engineers and
  5 passengers were injured.
• R10V0038 (KC Junction) ― On 03 March 2010, at about 1410 Pacific Standard Time, CP train 300-02, operating eastward on the north track of the Mountain Subdivision approaching KC Junction, British Columbia, struck the side of westbound CP train 671-037 when it was departing Golden from the north track through the crossovers onto the south track. As a result of the collision, 3 locomotives and 26 cars derailed.
• R09V0230 (Redgrave) ― On 30 October 2009, at about 2225 Pacific Daylight Time, CP train 355-429, operating westward on the signalled siding track on the Mountain Subdivision at Redgrave, British Columbia, struck the side of eastbound CP train 110-30 that had stopped on the main track. As a result of the collision, 2 locomotives and 6 cars derailed.
• R07E0129 (Peers) ― On 27 October 2007, at 0505 Mountain Daylight Time, the crew on CN train A41751-26 (train 417), operating westward on the main track of the Edson Subdivision, initiated an emergency brake application approximately 475 feet from a stop signal at the west end of Peers, Alberta. The train was unable to stop prior to passing the signal and collided with eastbound CN train M34251-26 (train 342) that was entering the siding. As a result of the collision, train 417's locomotives and 22 cars derailed, and 5 cars on train 342 derailed.

Locomotive voice and video recorders

Objective data are invaluable to investigators in helping them understand the sequence of events leading up to an accident and in identifying operational issues involving human factors and crew performance. Voice recordings would allow TSB investigators to confirm crew communications as well as crew actions and interactions. Such information would also allow accident investigators to eliminate more quickly extraneous factors that did not play a role in the accident. Technology for recorded information is abundant and has been for some time. The aviation industry has had cockpit voice recordings for over 30 years.

A number of railway accident investigations in North America have led to findings, recommendations and other safety communications where human factors were identified as an underlying condition. Many of these investigations would have benefitted from a recording of crew communications immediately prior to the accident.

While some railways are considering installing in-cab voice and video recorders for day-to-day use in their safety management system (SMS), Canadian law, under the Canadian Transportation Accident Investigation and Safety Board Act (CTAISB), protects these recordings and does not currently allow for their use, except as part of a TSB investigation.

Following the investigation into the 2012 derailment and collision of VIA 92 near Burlington, Ontario,^{Footnote 14} the Board indicated that:

To advance safety, accident investigation agencies rely on efficient, timely and accurate collection, assimilation and analysis of information in order to provide timely communication of safety deficiencies and accident reports to industry, regulators and the public. In addition, there may be potential for companies to use voice and video recordings proactively in a non-punitive way in order to enhance their Safety Management Systems, which could reduce risk and improve safety before an accident occurs. This is particularly important in an environment that depends on administrative defences alone to ensure safety and where there are no physical fail-safe train control systems. Therefore, the Board recommended that:

The Department of Transport require that all controlling locomotives in main line operation be equipped with in-cab video cameras.
Transportation Safety Recommendation R13-02

This recommendation is related to the TSB Watchlist issue “On-board video and voice recorders”.

TC has accepted the TSB recommendation. However, TC supports the Advisory Council on Railway Safety (ACRS) Working Group's recommendation to install voice/video recording devices on a voluntary basis only, and has written letters to individual railway companies and the Railway Association of Canada (RAC) urging the voluntary installation of recorders. The Board notes the actions of VIA Rail and Rocky Mountaineer Railway and commends them for their proactive actions.

Furthermore, the Board is pleased that TC has committed to the use of voice and video recorders in a non-punitive manner in the context of SMS programs. This will require legislative change, but at this time, there is no specific plan of action in this regard.

However, this initiative falls short of mandating a clear plan of action to fully address the safety issue. Therefore, in its latest reassessment, the Board assessed the response to Recommendation R13-02 as Satisfactory in Part.^{Footnote 15}

There were no equipment or track defects that were considered causal or contributing factors in this occurrence. The analysis will focus on train operations, safety defences in centralized traffic control (CTC), train crew situational awareness (SA), and voice and video recorders in locomotive cabs.

The accident

The collision occurred when train 351 was operated past the Stop signal at Dunmore, Alberta, (signal 1387N) and into the side of train 100 that was crossing over from the north main track onto the Depot 1 track. The conductor had correctly identified and recorded the advance signal to Dunmore (signal 1365S) as displaying a Limited to Stop indication, yet he chose to engage in other operational tasks at a critical time. The locomotive engineer (LE) had inadvertently identified the signal as displaying a Limited to Clear indication. Although the signal identifications had been vocalized within the cab of the locomotive, the error was not identified and corrected. The LE continued to operate the train with the expectation that the next signal would be Clear.

To maintain situational awareness when operating a train, it is often necessary to switch attention between different information sources. When confronted with these types of situations, crew members can get trapped in a phenomenon called attention narrowing or tunnelling. When succumbing to tunnelling, they tend to lock in on certain aspects or features of the environment they are trying to process and may either intentionally or inadvertently drop their scanning behaviour. In this occurrence, the attention of both crew members was likely diverted away from the task of establishing a common understanding of the signals by the demands of other operational tasks, including obtaining yarding instructions for Medicine Hat, Alberta, listening to the hot box detector (HBD) inspection results, and completing paperwork.

Signal positioning

Wayside signals can be installed in a variety of designs and configurations to suit the circumstances of each specific location. In this occurrence, when approaching Dunmore from the east, the signal for the south main track is mounted on an overhead cantilever. The signal for the north main track is mounted on a mast and is positioned just west of the western access to the grain terminals. When travelling westward on the north main track approaching Dunmore, due to the slight track curvature and the positioning of the signal mast, the view of signal 1387N can be partially obstructed, especially if the adjacent tracks to the south are occupied.

Safety defences against signal recognition errors

There are a number of safety defences in place on the Maple Creek Subdivision that are designed to prevent accidents of this type. Some of these defences are associated with the train control system (i.e., CTC), and some are associated with the Canadian Rail Operating Rules (CROR) and the railway's general operating instructions (GOI) (i.e., administrative defences).

Wayside signals include a physical signal installation combined with an administrative requirement to follow the signal indication. This defence relies on the crew to observe the signal, to recognize the intent of the signal, and then to take appropriate action. Operating rules and company GOI require that all signals be identified and announced within the cab of the locomotive and that other signals (e.g., controlled block signals) be announced over the railway radio system. At the time of the occurrence, the conductor had to document the signal indications on a prescribed form (rescinded by CP on 30 May 2013). These defences, while useful, do not always prevent the type of signal recognition errors that have led to a number of recent collisions and derailments in CTC territory. While the CROR requirements regarding signals and the additional administrative task of recording signal indications on a prescribed form may provide some measure of defence, they are not fail-safe and cannot take the place of a meaningful physical defence against signal recognition errors.

In addition to the CTC physical installations and administrative defences, there are a number of technologies that can provide a safety defence against signal recognition errors. For example, cab signalling systems can enhance CTC by providing a continuous display of signal indications within the locomotive cab. Cab signalling was developed in the U.S. about 85 years ago. Since then, it has evolved to its current form in which train protection systems are overlaid.

The positive train control (PTC) technology, under development and in limited use in North America, can also offer additional defences in some circumstances. For example, if an operating crew does not respond appropriately to a signal or other restriction, PTC will alert the crew to the fact that they are not reacting as expected. If there is no further action by the crew, the system can intervene to slow or stop the train by applying the brakes.

If existing CTC systems are not enhanced to include physical fail-safe capabilities, signal recognition errors will remain undetected, increasing the risk of train collisions and derailments.

Forward-facing video

The lead locomotive of train 351 was not equipped with a forward-facing video camera. While some railways have installed forward-facing video cameras, these initiatives have been voluntary, resulting in an inconsistent implementation. While these cameras may not have been designed to record signal indications along the route, they can be a useful tool when such verification is required. If lead locomotives are not equipped with forward-facing video cameras, there is a risk that the signal indications encountered by trains and other significant operational events that transpire in the forward field of view cannot be fully verified if required during an accident investigation.

In-cab voice and video recorders

Without in-cab voice and video recorders, many aspects of the dynamics and interaction between crew members cannot be fully verified. For example:

• Were all signals correctly identified?
• Were all signals called as required?
• Were all signals acknowledged?
• Were there any distractions in the cab?

Information from in-cab voice and video recorders and forward-facing video cameras can quickly direct the focus of an investigation by identifying obvious hazards or causal elements and by eliminating extraneous factors that are shown not to be involved in the accident. Technology for such recorded information is abundant and has been available for some time. For example, the aviation industry has had cockpit voice recordings for over 30 years.

In the United States, Amtrak Acela locomotive cabs are equipped with in-cab voice recording interfaced with the locomotive event recorder (LER). In comparison, no railway in Canada presently uses this technology. The Board's recommendation R13-02, issued in June 2013, addressed the need for in-cab voice recordings and identified that objective data are critical in helping investigators understand the sequence of events as well as in identifying operational issues and any human factors that may influence crew performance. The issue has been further highlighted in the TSB Watchlist.

Accident investigation agencies benefit from more efficient, timely, and accurate collection, assimilation and analysis of information. This will result in more timely communication of safety deficiencies. Despite these significant safety benefits, there is no requirement for in-cab voice or video recorders. If locomotive in-cab voice and video recorders are not installed on lead locomotives, there is a risk that valuable information that can lead to the identification and elimination of safety deficiencies will continue to be unavailable.

Findings as to causes and contributing factors

1. The collision occurred when train 351 was operated past the Stop signal at Dunmore, Alberta, (signal 1387N) and into the side of train 100 that was crossing over from the north main track onto the Depot 1 track.
2. The conductor had correctly identified and recorded the advance signal to Dunmore, signal 1365S, as displaying a Limited to Stop indication, while the locomotive engineer had inadvertently identified the signal as displaying a Limited to Clear indication.
3. Although the signal identifications had been vocalized within the cab of the locomotive, the error was not identified and corrected. The locomotive engineer continued to operate the train with the expectation that the next signal would be Clear.
4. The attention of both crew members was likely diverted away from the task of establishing a common understanding of the signals by the demands of other operational tasks, including obtaining yarding instructions for Medicine Hat, Alberta, listening to the hot box detector inspection results, and completing paperwork.

Findings as to risk

1. If existing centralized traffic control systems are not enhanced to include physical fail-safe capabilities, signal recognition errors will remain undetected, increasing the risk of train collisions and derailments.
2. If lead locomotives are not equipped with forward-facing video cameras, there is a risk that signal indications encountered by trains and other significant operational events that transpire in the forward field of view cannot be fully verified if required during an accident investigation.
3. If locomotive in-cab voice and video recorders are not installed on lead locomotives, there is a risk that valuable information that can lead to the identification and elimination of safety deficiencies will continue to be unavailable.

Other findings

1. While the Canadian Rail Operating Rules requirements regarding signals and the additional administrative task of recording signal indications on a prescribed form may provide some measure of defence, they are not fail-safe and cannot take the place of a meaningful physical defence against signal recognition errors.
2. When travelling westward on the north main track approaching Dunmore, due to the slight track curvature and the positioning of the signal mast, the view of signal 1387N can be partially obstructed, especially if the adjacent tracks to the south are occupied.

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on 05 November 2014. It was officially released on 16 December 2014.