Railway Investigation Report R14Q0045

On 06 November 2014, at approximately 0540, Eastern Standard Time, Quebec North Shore and Labrador Railway ore train BNL-212J was proceeding northward when it struck a rock and gravel slide. The collision caused the 2 lead locomotives and the first 9 cars to derail. The lead locomotive rolled down the slope and came to a stop at the bottom of the Moisie River, completely submerged. The locomotive engineer was fatally injured. About 1000 litres of diesel fuel spilled from the locomotive. About 100 feet of railway track was destroyed.

1.1 The accident

On 06 November 2014, at 0443,^{Footnote 1} the locomotive engineer (LE) of Quebec North Shore and Labrador Railway (QNS&L) ore unit train BNL‑212J (the train) obtained permission from the rail traffic controller (RTC) to enter the main track at Mile 8.9 of the Wacouna Subdivision, travelling northward to Wabush, Newfoundland and Labrador (Figure 1). The train consisted of 3 locomotives (2 at the head end and 1 two-thirds back) and 240 empty ore cars. It measured 8544 feet and weighed 6222 tonnes. Only one person was on board the train,^{Footnote 2} an LE who was familiar with the territory. The LE met fitness and rest requirements and was qualified for the position.

At approximately 0500, the LE verified the reset safety control and brake pipe continuity. At approximately 0520, the train left the Sept-Îles Yard, Quebec. At Mile 10.1, the train passed a hot box and dragging equipment detector without generating an alarm. At approximately 0528, the train entered the tunnel near Mile 12, and the signal from the proximity detection device (PDD)^{Footnote 3} was lost for about 2 minutes. At 0535, the train passed advanced signal 129.^{Footnote 4} The train was travelling at 21 mph and was coming out of a series of reversing curves when, at approximately 0540, it struck a slide of rock, gravel, mud and trees that was blocking the main track. The 2 head-end locomotives (QNSL 522 and QNSL 516) and the first 9 empty ore cars derailed, rolled down the embankment and slid towards the river. The lead locomotive was fully submerged. The LE was fatally injured in the accident. About 100 feet of track was damaged.

Following the departure of train BNL-212J and until approximately 0635, the RTC was occupied with various operational tasks. At approximately 0630, train BNL-212J was supposed to meet train PH-825S at Nicman, Mile 35.1. At approximately 0635, the RTC noticed that train BNL-212J was still in the block before the Tellier Station. However, the lead locomotive no longer appeared on the RTC PDD screen^{Footnote 5}. After a few verifications, the RTC attempted to communicate with the train's LE by radio, on several channels, but without success. QNS&L's emergency response measures were implemented. An employee was dispatched to the site by helicopter and flew over the area at approximately 0720.

At the time of the accident, it was generally cloudy and the temperature was 2 °C. Sunrise was at 0625. In the 24 hours preceding the accident, there was some precipitation in the form of snow and rain. The temperature was near the freezing point and no seismic activity was recorded.

1.2 Site examination

The train derailed at the exit of a 7-degree left-hand curve, at Mile 14.65. The end of this curve, located about 9250 feet north of signal 129, is preceded by a series of 8-degree, 7‑degree, and 7-degree reversing curves.

The lead locomotive (QNSL 522) ended up at the bottom of the Moisie River. The second locomotive came to rest on the shore of the river, below the track and leaning at about 60 degrees in the embankment on the west side of the main track, with the leading truck heading into the water. The 2 locomotives were examined after they had been extracted from the water.

The lead locomotive spent 104 days submerged in the Moisie River. The inspection showed signs of impact on the front of the cab. The collision was sufficient to twist the underframe to a point where the front part of the cab lifted and jammed the 2 access doors. However, despite the collision, the cab structure remained relatively intact. There was a mass of rocks on the side running board of the locomotive. The 2 windshields and several windows were broken and many rocks had fallen inside the cab through the openings thus created and onto the seat on the conductor side. Some of the LE's personal effects, including a digital tablet and a travel bag containing clothing, were found under the pile of rocks.

Besides this damage, the examination of the derailed locomotive showed no mechanical malfunction before the accident. The lead locomotive event recorder was recovered and sent to the TSB Laboratory in Ottawa, Ontario. The data were extracted by the laboratory's specialists.

The rear end of the consist (2nd locomotive, QNSL 516) exhibited damage from impact with other cars. Several safety components, such as the steps and handrails, were damaged or destroyed. Some side panels had come apart, and the fuel tank was dented. There was no evidence of pre-accident mechanical malfunction.

The first 2 derailed cars (positions 3 and 4) had detached from the locomotive consist and rolled on their side. They jackknifed and came to rest at the bottom of the west embankment. The next 7 cars (positions 5 to 11) were still coupled to each other and came to rest in the gravel embankment (Photo 1). All the other cars remained on the track. The examination of the derailed cars showed no pre-accident mechanical malfunction.

The track was covered with boulders and gravel that had slid from the east-side rock face that runs along the track. The rock pile was about 10 feet tall, 50 feet long and 20 feet wide, for a total of about 350 cubic yards.

The wooden ties under the boulders were displaced. The rails near the pile-up of rocks and derailed cars were broken into several pieces. The surfaces of the rails showed signs of having been subjected to excessive lateral force. About 100 feet of track was completely destroyed.

In way of the pile-up, the rock face was vertically split and water from the top of the mountain was seeping down a smooth, sharply sloped surface. About 70 feet of the ditch on the east side of the track was blocked.

On the west side of the track, sparse vegetation had grown over a length of about 75 feet. The embankment was flattened from the track to the bank. A row of poles bordering the track and supporting a power line was not damaged.

A spill of diesel fuel was reported after the derailment. A fine silver layer on the river attested to the presence of oil product. About 1000 litres of fuel leaked from the submerged locomotive. The necessary measures were taken by the ministère du Développement durable, de l'Environnement et de la Lutte contre les changements climatiques du Québec (Quebec's Ministry of Sustainable Development, Environment and Fight against Climate Change) to ensure the safety of the population and protection of the environment.

1.3 Track information

The Wacouna Subdivision consists of a single main track linking Sept‑Îles (Mile 8.9) to Emeril Junction (Mile 225.30). Train movements are governed by the Centralized Traffic Control (CTC) system, as authorized by the Canadian Rail Operating Rules (CROR), and supervised by an RTC located in Sept-Îles.

The track is Class 3 according to the Track Safety Rules (TSR) approved by Transport Canada (TC). The maximum allowable speed in the subdivision is 40 mph for ore and freight trains and 50 mph for passenger trains. A permanent slow order limited train speeds to 30 mph between Mile 11.7 and Mile 16.0. Temporary General Bulletin Order 376, in effect at the time of the accident, restricted the speed to 20 mph due to the track geometry in the curves between Mile 10.4 and Mile 13.0.

Traffic consists of 9 trains per day (ore, freight and passenger), for an annual tonnage of close to 28 million gross tons.

The last train (CH-821A) to travel on this section of track departed Sept-Îles Junction at 0332. When that train passed through the accident area, approximately 1 hour and 50 minutes before the occurrence, no serious situation was observed by the LE.

A distance counter, activated by the LE, is used to determine the position of the tail end of the train based on its length and to confirm that it is entirely outside the restricted speed zone.

1.4 Recorded information

Table 1 shows the sequence of the main events and the actions taken by the LE working alone on board the locomotive.

1.5 Track information

The track consists of 136-pound continuous welded rail, manufactured in 2010. In the derailment area, the rails are laid on 18-inch double-shouldered tie plates secured by clips.^{Footnote 6} The tie plates are fastened to the ties with 5 flat-end screws. There are approximately 3250 wooden ties per mile of track. The ballast is about 12 inches thick, with shoulders between 12 and 16 inches. It is mainly made up of 1.5- to 3-inch-diameter crushed rock.

The main track profile for a train travelling northward, from Sept-Îles Junction (Mile 8.9) to Saumon (Mile 26.7), is typically descending and the grades can reach 0.63%. In the 3 miles preceding the accident site, between Mile 11.65 and Mile 14.65, there are 24 curves and reversing curves with 4-degree to 8-degree curves. Thirteen of these curves turn right and 11 turn left. The curves total 10 963 feet, or 69% of this section. In the last mile, between Mile 13.65 and Mile 14.65, there are 7 curves and reversing curves with 6-degree to 8-degree curves. Three of these curves turn right and 4 turn left (Figure 2). The curves total 4385 feet, or 83% of the distance.

There is a tunnel of about 2200 feet between Mile 11.3 and Mile 11.7. Radio communications are interrupted when rolling stock is inside the tunnel.

At Mile 12.9, when a train passes the dragging equipment detector in either direction, a “talker system” transmits an automated voice message. LEs must not use the radio system while their trains pass through detectors and they must wait until they hear the detector's report on the results of the inspection.

1.6 Track inspections

The railway track inspection program consists primarily of routine inspections, internal rail defect testing, track geometry inspections and special inspections in extreme circumstances. In the accident area, the inspections were conducted according to the TSR provisions and did not reveal any defects requiring immediate attention.

The following inspections were conducted:

• The last routine inspection was conducted from a hi-rail vehicle on 04 November 2015.
• The last internal rail defect testing was done on 26 October 2014.
• A track geometry inspection was conducted from a track evaluation car on 06 October 2014.

1.7 Inspection of rock faces

1.7.1 QNS&L rock face inspection program

The rock faces along the main track of the Wacouna Subdivision extend from about Mile 10 to Mile 110. Over the years, these rock faces have been carefully inspected by QNS&L's engineering personnel.

In 2008, a consultant was tasked with conducting detailed inspections of elements along the track that could affect the stability of the track infrastructure and the rock faces. The following elements were to be observed:^{Footnote 7}

• the vegetation;
• the drainage (natural and underground water);
• the adjacent slopes;
• the rock faces;
• the condition of the river embankment;
• identification of areas prone to landslides and that could pose a threat to the track; and
• identification of risks and repair priorities.

During the inspection, the consultant was required to examine the following:

• cracks, openings and movement;
• new pieces of rock on the ground;
• loose anchor bolts;
• water infiltration;
• water (or ice) accumulation;
• weathering of the rock;
• the condition of the rock and anchoring;
• the rail surfacing;
• contaminated ballast;
• drainage (ditches and culverts);
• ditch clearances;
• verification of dimensions; and
• soil and rock stability.

The consultant was required to submit an observation report and make recommendations for corrective actions to be taken over the next 5 years to minimize the risks associated with slides and landslides. The consultant used a scale of 1 to 5 to prioritize the actions identified (Table 2).

According to several reports submitted by the consultant, rock falls, particularly on the east side of the track, could cause a train derailment, equipment damage and loss of production; in more serious cases, such slides could cause loss of life.

1.7.2 Last inspection of rock faces

The rock faces and soil were last inspected in June 2013. The inspection report submitted to QNS&L revealed 3 possible types of failure that could jeopardize the stability of the railway:

• boulders breaking loose in the rock cuts and tunnels;
• sensitive clay under the granular base of the track; and
• drainage and steep slope on the river embankment.

The report also stated that all the areas previously identified as potential rock fall areas had deteriorated and posed a greater risk. Tree roots or water infiltration during freeze and thaw periods or a combination of the two had caused weathering and cracks in the rock. More than a dozen locations were identified as posing a “very high” risk.

The report contained the following recommendations:

• perform stabilization and rock scaling work at several identified locations;
• continue the annual inspection program;
• keep a log of all areas exhibiting weakness;
• accurately locate areas exhibiting potential weakness;
• increase the budget;
• sample and characterize the soil;
• install retaining walls to support the track infrastructure;
• install a culvert;
• install a slide detection system at 3 specific locations; and
• replace the slide detection system^{Footnote 8} currently at the south side of the tunnel, at Mile 65.

1.7.3 Rock faces identified as priorities

Between 2008 and 2013, several locations between Mile 10 and Mile 20 were identified by the consultant and assigned priority code “1” on the annual inspection reports:

• 2008 – 6 locations identified;
• 2010 – 9 locations identified, including 6 recurring and 3 new;
• 2011 – 8 locations identified, including 8 recurring and 1 repaired;
• 2012 – 7 locations identified, including 3 recurring and 4 new, and 5 risks lowered;
• 2013 – 8 locations identified, including 7 recurring and 1 new.

The rock face that collapsed had not been identified, but the risk level of an adjacent rock face had been assessed as “very high.”

1.7.4 QNS&L management of rock face inspection contracts

Until 2013, inspection contracts were managed by QNS&L's Engineering Services. After receiving and skimming through the consultant's reports, the project manager would send them to operations personnel or to their representative.

Over the years, organizational changes led to turnover in the personnel responsible for planning and tracking rock face and embankment stabilization work.

After QNS&L personnel received the consultant's reports, no official meeting was held between the 2 parties to discuss critical points identified in order to prepare the annual work program.

In 2014, no particular rock face inspection was conducted and no specific report was produced.

1.8 Rock face work performed

Since 2010, QNS&L has installed rock face wire mesh, stabilized embankments and tunnels, and performed anchoring and emergency work.

In 2010, work was undertaken in the tunnel at Mile 65.02. In December 2010, the track infrastructure, which had been damaged by a washout at Mile 32, was repaired.

In 2011, following deterioration in the rock face, rendering it unstable, the consultant recommended stabilizing the rock face between Mile 19.1 and Mile 19.5. Protective wire mesh was installed. Anchors were installed at Mile 52.5.

In 2012, emergency rock face stabilization work was performed by installing wire mesh and anchor bolts near Mile 16.7.

In 2013, the work to stabilize the tunnel walls near Mile 12 was completed.

In 2014, the work to stabilize the north tunnel walls at Mile 65 was completed.

1.9 Safety management system

1.9.1 General description

A safety management system (SMS) is a systematic process to manage safety risks. An SMS is based on detecting hazards, analyzing and assessing the related risks, identifying control or mitigation measures, and verifying their effectiveness. These steps must be documented. Implementing an SMS acknowledges the need for proactive management in order to eliminate or minimize the risks associated with operating activities. To this end, any SMS must clearly answer the following 5 questions:^{Footnote 9}

• What are the processes that govern operations and that make them safe?
• What are the hazards, and the incidents or accidents that happened or could happen?
• What are the probabilities and the severities of those events?
• What corrective actions, controls or mitigation measures can be implemented?
• How effective are corrective actions or mitigation measures?

1.9.2 Management of rock face risks

Some rail infrastructures, such as culverts and bridges, and other hazards, such as rock faces, require special attention to detect and mitigate risks. Since the current rules and regulations do not contain specific requirements concerning risk management for such infrastructures and hazards, the management of these risks must therefore be an integral part of the SMS of railway companies.

Reference documents prepared by TC are available for some of these infrastructures (culverts^{Footnote 10} and bridges^{Footnote 11}). These documents are intended to provide a framework to allow railway companies to develop programs adapted to their operations. There are no specific guidelines or reference manuals for risks associated with rock faces. However, TC has a program in place to monitor ground hazards such as rock falls, landslides, subsidence, erosion, avalanches and freezing-related problems. It has also undertaken research on those ground hazards in cooperation with the railway industry and the Canadian universities.

In Western Canada, Canadian National and Canadian Pacific Railway have developed risk management programs for rock faces, with detailed lists of several hundreds of rock faces identified as being “at risk.” Besides identifying engineering controls to manage identified hazards, these railway companies use additional controls such as rock face inspections by track maintenance personnel and reduced speed zones. Programs have also been implemented to train track personnel to conduct rock face inspections. These rock face risk management programs in Western Canada have evolved in recent years and are due to awareness of the dangers of rock faces following slides that caused severe damage.

To be effective, such a risk management program requires that, initially, rock faces be carefully monitored to identify any disturbances of concern (such as shifting rock massifs or unstable slopes). Then, it must be possible to quickly take the necessary corrective actions to prevent any slides. Current monitoring technologies include such instruments as extensometers, slide detector nets and vibration sensors.

1.9.3 QNS&L safety management system

QNS&L's SMS is framed by the programs of its parent company (Iron Ore Company), that is Santé Sécurité Environnement (SSE) (Health Safety Environment) and Health Safety Environment Quality Safety Management (HSEQ SM). QNS&L's SMS is based on 17 elements that fit into the 4 risk management steps: planning, execution, verification and adjustment. Step 3 (verification) contains instructions for identifying hazards and managing the associated risks, as well as the following definitions:

• Probability: The most realistic or plausible likelihood that the result of an event will have “maximum reasonable consequences.”
• Maximum reasonable consequences (MRC): The most realistic or possible severe consequences of an event given the location of the occurrence, the population exposed and the credible failure of existing control measures.

QNS&L's risk analysis has 3 levels:

• Level 1 - Assessment of hazards
• Level 2 – Qualitative risk assessment (see Figure 3)
• Level 3 – Quantitative risk assessment

The results of the level 2 and 3 assessments must be documented in the SSE risk log.

The risks are assigned the following ratings based on the results of the qualitative risk assessment:

• Critical: The risks largely exceed the acceptance threshold and require immediate attention. Review frequency: Every year.
• High: The risks exceed the acceptance threshold and require proactive management. Includes risks for which proactive measures have been taken but for which additional measures cannot be applied. If no other action is taken, the appropriate director general is responsible for accepting the risk. However, active monitoring is required. Review frequency: Every year.
• Moderate: The risks are within the acceptance threshold and require careful monitoring. Implementation of additional measures could further reduce the risk. Review frequency: Every 3 years.
• Low: The risks are below the acceptance threshold and do not require active management. Review frequency: Every 3 years.

1.10 Visual perception from the locomotive

1.10.1 TSB visibility test

On the evening of 03 February 2015, TSB investigators and a QNS&L crew conducted a visibility test using a locomotive identical to the lead locomotive involved in the accident. The test was conducted to determine the distance from which it would have been possible to see the slide on the track from the cab of a moving locomotive with the headlights on. At the time of the test, the track was clear, the ground adjacent to the track was snow covered and visibility was good. The locomotive was travelling at 20 mph. The following observations were made:

• About 970 feet from the slide, part of the headlight beam momentarily illuminated the site above a bend in the river. From that distance, the rails were not visible and it was impossible to see that there was debris on the track.
• From the exit of the curve south of the slide, that is from about 250 feet, at night, there was an 8- to 10-second window to see the debris on the track.

1.10.2 Locomotive headlights

According to the rules and regulations,^{Footnote 12} locomotive lights must meet the following requirements:

• Locomotive headlights must be aligned to centreline in the horizontal plane and depressed in the vertical plane to illuminate the rail up to 244 metres (800 feet) ahead of the locomotive in the direction of movement.
• Locomotive ditch lights must be aligned in the horizontal plane to cross the locomotive centreline 122 metres (400 feet) ahead of the locomotive and depressed in the vertical plane to illuminate the rail up to 244 metres (800 feet) in the direction of movement.

According to the event recorder, the lead locomotive headlights and ditch lights were on at the time of the accident.

1.11 Reaction time

Reaction time consists of detection, identification, decision and reaction. Several studies have been conducted for drivers of motor vehicles, but not for LEs. However, the results of these studies provide insight on driver behaviour when visual stimuli require them to react, more specifically, to apply the brakes. In calculating sight and stopping distances for road vehicles, a minimum reaction time of 2.5 seconds is recommended with respect to the placement of road signs and public crossings.^{Footnote 13} It is well known that drivers' reaction times increase considerably as a function of a situation's complexity and unexpected stimuli.^{Footnote 14}

1.12 Braking distance

Based on information obtained during the investigation, for a train of 240 empty ore cars travelling on relatively flat surface at 20 mph and using the emergency brakes, the braking distance to a full stop was about 250 feet (excluding reaction time).

1.13 Issue of locomotive event recorders

In this accident, a forward-facing video recorder would have made it possible to accurately determine the visual perception, the visibility conditions from the locomotive and whether the slide occurred before or while the train was approaching. Also, a cab video recorder would have made it possible to determine where the LE was focusing his attention. Some Canadian railway companies have installed forward-facing video cameras, but none has installed on-board cab video and voice recording systems. These recordings would make it possible to better understand the events leading up to an accident. The Board has already published 2 recommendations concerning on-board recorders. In investigation reports R99T0017 and R12T0038, respectively, the Board recommended that:

These recommendations are related to the TSB 2014 Watchlist safety issue titled “On-board video and voice recorders.” The Board acknowledges the participation of all the stakeholders in working on studies that will lead towards addressing this safety deficiency. However, in the absence of definitive commitments and plans to install on-board cab video and voice recorders that would be available for accident investigation purposes, the Board considers the responses to recommendations R03-02 and R13-02 as satisfactory in part.

1.14 Survivability

Despite the fact that injuries sustained by a victim can be disabling and reduce the person's ability to extract himself/herself from a damaged container, survivability is analyzed in order to improve safety based on certain fundamental criteria, including:

• the crashworthiness^{Footnote 15} of the locomotive cab structure and of its interior components in order to provide safe space to occupants; and
• the emergency evacuation devices and personnel protection after the accident.

A study^{Footnote 16} identified various evacuation options for a locomotive crew following a railway accident that damaged the locomotive cab. Three options were examined as follows:

• a hatch system in the locomotive cab ceiling providing an exit for crew members or access for emergency responders;
• a removable windshield that can be taken out from the cab interior by a crew member; and
• removable door hinges, should the door become stuck.

All these proposals are still under review, and the lead locomotive cab was not equipped with any.

1.15 TSB laboratory reports

The TSB completed the following laboratory report in support of this investigation:

• LP083/2015 – LER [Locomotive Event Recorder] Data Recovery and Analysis – QNS&L Train, BNL-212J

No track or equipment defects were considered contributory to the accident. Consequently, the analysis will focus on visual perception, braking distance, single-person train operation, inspection of rock faces, risk management and locomotive emergency egress.

2.1 The accident

The derailment occurred when the train collided with boulders that were blocking the track.

The train passed advanced signal 129 at 21 mph, and its speed remained stable until Mile 14.65, a distance of about 9250 feet. The train was operated at normal speed. The rail traffic controller (RTC) Centralized Traffic Control (CTC) panel indicated that the block handled by signal 129 was clear until it was occupied by the train. Had the slide occurred before the train reached signal 129 and had there been a rail failure, the CTC panel would have indicated that the block was occupied, and signal 129 would have displayed a restricting signal.

It is possible that the slide occurred after the train passed signal 129. In such a case, even if the slide had caused a rail failure that would have been detected by the signalling system (signal 129 displaying a restricting signal), the locomotive engineer (LE) would not have been able to see that signal. The LE received no alarm or indication that an obstacle was blocking the track before the distance of visual perception.

This accident raises the need for additional defences as it is possible that slides may not be detected by the signalling system (no rail failure) or that they may occur after the train has passed the last signal. Slide detection systems can be installed to complement the existing signalling system. If effective slide detection systems are not put in place, the existing signalling system may prove inadequate in giving the train crew enough warning that the track is blocked, thereby increasing the risk of collision and derailment.

Following the departure of train BNL-212J and until approximately 0635, the RTC was occupied with various operational tasks. The RTC CTC panel does not warn the RTC of an abnormal situation that does not affect the track; it is not designed to do so.

It could not be accurately determined whether the slide occurred before the train arrived in way of signal 129 or whether it coincided with the train's approach. Based on the damage to the lead locomotive, the collision was head-on and not lateral, suggesting that there was debris on the track before the train arrival. It is therefore more than likely that boulders were blocking the track as the train approached.

2.2 Visual perception from the locomotive

According to the test conducted by the TSB, it would have been possible to detect debris or a slide on the track 8 to 10 seconds before the collision. The event recorder shows that the LE did not attempt to brake. This does not exclude the possibility that the LE saw the debris. Even if the locomotive headlights allowed the LE to see debris on the track, it could have been difficult to ascertain that the accumulation of rocks, mud and trees was a slide on the track. Given that the track follows a winding path around rock cliffs, the accumulation of debris (unexpected occurrence) could have been perceived initially as part of the cliff. Moreover, the reduced peripheral vision due to darkness at the time of the accident limited visual cues, making it difficult to identify an obstruction on the track. Given the winding geometry of the track and the darkness, it would be difficult for an LE travelling at the permitted speed to take the necessary protective measures against an obstacle on the track when it becomes visible considering the available reaction time and braking distance. That being said, it cannot be determined with certainty whether the LE saw the debris on the track.

It is also possible that the LE did not see the debris on the track. The analysis of the handling of the various locomotive controls before the collision suggests that the LE was adequately controlling the movement of the train. In addition, the configuration of the track section where the accident occurred, located in a remote area not accessible to the public, required minimum monitoring. It is therefore possible that the LE's attention was focused elsewhere, especially on the console's distance counter. When the lead locomotive passed the sign indicating the end of the 20 mph zone, the LE should have set the distance counter. Given that the train measured 8544 feet, the distance counter would have been reset about 170 feet before the debris.

Since the presence of debris on the track is an unexpected occurrence, a reaction time of several seconds is required. Consequently, whether or not the LE saw the debris, at the permitted speed, the distance of visual perception provided by the headlights allowed to apply the emergency brakes, but not to avoid the collision.

2.3 Emergency braking

The braking distance required for a train similar to the one involved in the accident to come to a complete stop, using the emergency brakes and travelling at 20 mph, was about 250 feet.

Application of the emergency brakes would have reduced the train speed at the point of collision. However, given the site topography, a locomotive derailing at this location would likely have rolled down the embankment to the river.

2.4 Single-person train operation

QNS&L is the only federally regulated railway company that uses a single operator on some of its trains. While the presence of a second crew member would have provided an additional possibility of seeing the debris on the track, it could not be determined whether the presence of a second crew member would have resulted in an attempt to apply the emergency brakes. Even if a second crew member had been on board, it would still have been difficult to perceive and identify the debris on the track.

2.5 Inspection of rock faces

The track inspections were conducted in accordance with the Track Safety Rules (TSR) and were focused on the condition of the track. Under the TSR, no periodic inspection of the rock faces above the track is required.

Prior to this slide, QNS&L had experienced minor slides without major consequences. In the event of those minor slides, QNS&L reacted by performing emergency work (anchoring and wire mesh) as well as tunnel stabilization work.

The rock face inspection reports submitted to QNS&L identified specific engineering work for each high-risk rock face. However, no other risk control measure was identified and documented.

Moreover, these inspection reports did not include maximum reasonable consequences for each rock face. It can therefore be concluded that QNS&L was not conducting complete, documented risk analyses for each rock face identified as high risk. A comprehensive, detailed analysis should address the following: probability, severity, possible corrective action or mitigation measures and the effectiveness of such measures.

Alternative measures to engineering work can include more frequent inspections conducted by track personnel and slow orders so as to increase the time available to detect and react to a hazard, and reduce braking distance. Including maximum reasonable consequences for each hazard can invariably increase the probability that immediate measures will be taken to ensure proactive management.

Over the years, the probability and potential consequences of occurrences associated with rock faces have become less of a priority given the multitude of other risks managed by QNS&L. The engineering work recommended for the rock faces was regularly postponed until the next inspection.

The management of rock face risks became reactive rather than proactive, and other engineering work was given priority at the expense of work on rock faces. The rock faces identified as high risk received no immediate attention and were not specifically monitored. If each problematic rock face is not documented and thoroughly analyzed, this can hinder the implementation of measures for proactive risk management and therefore increase the risk that other slides will jeopardize train operations.

2.6 Management of rock face risks

QNS&L had a periodic rock face inspection program that included risk management elements (for example, list of rock faces, risk rating, recommended engineering control measures). However, that program was not comprehensive and did not contain certain elements, including:

• a description of the qualifications, training and identification of persons assigned to duties concerning rock face management;
• a detailed, documented analysis of each very high-risk rock face, taking into account the probability and maximum reasonable consequences for each identified hazard;
• an inspection schedule, procedures and log for each rock face assessed; and
• a periodic documented examination of the consultant's inspection reports.

The rules and regulations do not require railway companies to implement a rock face safety management program. However, the safety management system (SMS) that each railway company is required to implement must include proactive risk management of rock faces and other natural hazards.

Unlike the reference documents published by Transport Canada (TC) concerning culvert and bridge safety management, there are no specific guidelines or reference manuals concerning the assessment of risks relating to rock faces. If adequate guidelines on managing risks relating to rock faces are not available, it is possible that a more robust risk management program will not be developed, thereby increasing the risk of collision and derailment due to slides.

2.7 Emergency egress from damaged locomotives

This accident has shown that the access doors of locomotive cabs can be blocked and can prevent personnel from exiting in an emergency situation. Although egress through the side window was an option in this accident, it might not be possible in other circumstances. Moreover, some locomotive models do not even offer this option, as the windows are too small.

In the event that the main exits are damaged in an accident, an adequate emergency evacuation system should allow crew members to exit the cab or emergency responders to enter the cab to provide assistance to people in difficulty.

3.1 Findings as to causes and contributing factors

1. The derailment occurred when the train collided with boulders that were blocking the track.
2. The locomotive engineer received no alarm or indication that an obstacle was blocking the track before the distance of visual perception.
3. The distance of visual perception provided by the headlights allowed to apply the emergency brakes, but not to avoid the collision.

3.2 Findings as to risk

1. If effective slide detection systems are not put in place, the existing signalling system may prove inadequate in giving the train crew enough warning that the track is blocked, thereby increasing the risk of collision and derailment.
2. If each problematic rock face is not documented and thoroughly analyzed, this can hinder the implementation of measures for proactive risk management and therefore increase the risk that other slides will jeopardize train operations.
3. If adequate guidelines on managing risks relating to rock faces are not available, it is possible that a more robust risk management program will not be developed, thereby increasing the risk of collision and derailment due to slides.

3.3 Other findings

1. Had the slide occurred before the train reached signal 129 and had there been a rail failure, the Centralized Traffic Control panel would have indicated that the block was occupied, and signal 129 would have displayed a restricting signal.
2. The rail traffic controller Centralized Traffic Control panel does not warn the rail traffic controller of an abnormal situation that does not affect the track; it is not designed to do so.
3. Given the winding geometry of the track and the darkness, it would be difficult for a locomotive engineer travelling at the permitted speed to take the necessary protective measures against an obstacle on the track when it becomes visible.
4. Given the site topography, a locomotive derailing at this location would likely have rolled down the embankment to the river.
5. It could not be determined whether the presence of a second crew member would have resulted in an attempt to apply the emergency brakes.
6. Under the Track Safety Rules, no periodic inspection of the rock faces above the track is required.
7. An adequate emergency evacuation system should allow crew members to exit the cab or emergency responders to enter the cab to provide assistance to people in difficulty.

4.1 Safety action taken

4.1.1 Quebec North Shore and Labrador Railway

Quebec North Shore and Labrador Railway (QNS&L) implemented several measures aimed specifically at managing ground hazards and improving rail operations as follows:

• had a geotechnical specialist conduct a rock face inspection between Mile 0 and Mile 110;
• identified and approved stabilization work for 2015;
• established a special inspection procedure for freeze/thaw periods;
• drafted directives for speed reductions during freeze/thaw periods;
• trained its maintenance and operating employees on ground hazard management;
• had audits conducted, by an independent consultant, of its planned and work programs;
• set up a database in order to compile information on ground hazards and employee observations; and
• retained the services of a geotechnical specialist from Rio Tinto to conduct regular testing.

QNS&L has taken specific safety action in the vicinity of Mile 14.65 as follows:

• had a detailed inspection of the cliff conducted by 2 independent firms;
• dynamited the cliff to secure the area;
• implemented constant monitoring of rock face and soil movements during the stabilization work;
• implemented a temporary slow order during the freeze/thaw periods in spring and fall 2015;
• had 2 independent experts verify the anchoring plan;
• improved drainage; and
• proceeded with major stabilization work.

This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 09 March 2016. It was officially released on 30 March 2016.