Railway Investigation Report R16H0024

On 06 March 2016, at approximately 1540 Eastern Standard Time, Canadian Pacific Railway freight train 100-03 was proceeding eastward at about 35 mph when it collided with a stationary hi-rail vehicle at Mile 118.36. The foreman and machine operator had exited the hi-rail vehicle just before the collision. There were no injuries and there was no derailment. The hi-rail vehicle was destroyed. The lead locomotive of train 100-03 sustained minor damage.

Le présent rapport est également disponible en français.

1.1 The accident

On 06 March 2016, a Canadian Pacific Railway (CP) foreman and a CP machine operator (maintenance-of-way [MOW] employees) were clearing snow at track switches at various locations on the Nemegos Subdivision. During the day, the foreman had received 5 track occupancy permits (TOP) from the rail traffic controller (RTC), providing protection for the snow-removal equipment and for hi-rail vehicle 53705 (the vehicle).

At about 1500,^{Footnote 1} upon finishing work at Kinogama Siding, near Nemegos, Ontario, the machine operator secured the snow-removal equipment at the east end of the back track. Before returning to their home location (the bunkhouse at Ramsey, Ontario), the MOW crew had to travel to Chapleau, Ontario, to re-fuel the vehicle, which would take approximately 3 hours. Positioned in the vehicle in the siding, the foreman reviewed the 2 TOPs that were still in effect. One TOP protected their movement in the signalled siding between Signal 1094B (Mile 109.4) and Signal 1105B (Mile 110.5). The second TOP protected their movement on the main track between Signal 1093 (Mile 109.3) and Signal 1106 (Mile 110.6).

After the equipment was secured and following a discussion between the MOW employees, it was realized that the snow-removal equipment should have been placed at the west end of the back track. The machine operator then moved the snow-removal equipment to the west end of the back track and re-secured it.

Upon return to the vehicle, the machine operator entered on the driver's side to take over the driving tasks, with the foreman seated in the passenger side. The foreman indicated that, to remove the vehicle from the track, they were to proceed westward on the main track to the crossing at Mile 118.60. The machine operator  proceeded to the west switch at Kinogama Siding. After the foreman lined the switch for the main track, the vehicle was moved onto the main track and stopped clear of the switch points. The foreman then restored the switch to the power position and re-entered the vehicle. The radio was on the MOW channel^{Footnote 2} and no broadcast was made to announce that the vehicle was entering the main track. The vehicle departed for the crossing, travelling outside its limits of authority for about 8 miles.

CP freight train 100-03 (the train) consisted of 2 head-end locomotives, 1 remote locomotive, and 80 loaded cars. It weighed 10 841 tons and was 11 928 feet in length. The train crew consisted of a locomotive engineer and a conductor. Both crew members were qualified for their respective positions, were familiar with the territory, and met established rest and fitness requirements.

At about 1505, the train left Chapleau (Mile 136.4) and proceeded eastward on the Nemegos Subdivision (Figure 1). Between Chapleau and Nemegos, the train crew made 6 radio broadcasts on the train standby channel.^{Footnote 3}

About 5 minutes after the last radio broadcast, as the train entered the left-hand curve at Mile 118.50 at a speed of about 42 mph, the train crew observed an approaching vehicle on the main track about 750 feet away. The train crew initiated an emergency brake application. At about the same time, the MOW employees observed the approaching train. The machine operator stopped the vehicle (Mile 118.36) and placed it in Park. Both MOW employees then rapidly exited the vehicle. About 6 seconds later, the train, travelling at about 35 mph, struck the stationary vehicle. There were no injuries and the train did not derail. The locomotive sustained minor damage. The vehicle was destroyed (figures 2 and 3).

At the time of the occurrence, visibility was clear with some blowing snow. The temperature was 1.1 °C, with winds of 28 km/h.

1.2 Summary of events

Table 1 provides a summary of the events on 06 March 2016. This information was compiled from a number of sources: the locomotive event recorder,^{Footnote 4} the forward-facing camera from the train's lead locomotive, the signal download, site measurements, and recording of the radio transmissions.

Table 1. Summary of events

Time	Event
0700	At the start of the shift, the MOW employees performed a job briefing for the day.
0810 (approximate)	The MOW employees arrived at Sultan.
0810 to 1210	The MOW employees performed various maintenance duties at Sultan.
1210	The MOW employees departed Sultan on the main track under a TOP authority to Kinogama. The foreman obtained a TOP for the signalled siding track at Kinogama.
1346 (approximate)	The foreman received a TOP for the main track at Kinogama between outer signals (Mile 109.3 and Mile 110.6). The foreman received permission from the RTC to place the dual control switch in the hand position to clean the switch.
1500 (approximate)	The MOW employees completed maintenance work at the switches at Kinogama. The machine operator parked the snow-removal equipment at the east end of the back track while the foreman waited in the vehicle, which was positioned on the signalled siding track.
1505	CP freight train 100-03 departed Chapleau.
1505 (approximate)	The machine operator returned to the vehicle. Reviewing the timetable, the MOW employees noted that the snow-removal equipment should have been parked at the west end of the back track. The machine operator exited the vehicle.
1510 (approximate)	The machine operator moved the snow-removal equipment to the west end of the back track. The foreman drove the vehicle to the west end of the siding to pick up the machine operator.
1515 (approximate)	Looking at the TOP book, the foreman noted that TOP 2213 stated "main track" and incorrectly believed that the track limits on the main track were up to Nemegos.
1520 (approximate)	Entering the vehicle on the driver side, the machine operator took control of the vehicle. The foreman, who was now seated on the passenger side, informed the machine operator to proceed westward.
1522 (approximate)	The foreman lined the vehicle onto the main track. After the vehicle entered the main track, the foreman restored the switch to the power position. The vehicle then departed Kinogama.
1522 (approximate)	At Devon, the train crew on CP freight train 100-03 called the approach signal over the radio.
1524 (approximate)	At the west end of Devon, the train crew called the home signal over the radio.
1533 (approximate)	At Nemegos, the train crew called the approach signal over the radio.
1535 (approximate)	At the west end of Nemegos, the train crew called the home signal over the radio.
1540:43	CP freight train 100-03 whistled for the crossing at Mile 118.60.
1541 (approximate)	At about Mile 118.50, while entering the curve, the train crew observed the vehicle ahead on the main track.
1541 (approximate)	The machine operator observed the train and advised the foreman.
1541 (approximate)	The train crew initiated an emergency brake application.
1541 (approximate)	The vehicle was brought to a stop and the MOW employees rapidly exited the vehicle.
1541:04	The train collided with the vehicle.

1.3 Subdivision information

The Nemegos Subdivision consists of a single main track, extending westward from Cartier, Ontario (Mile 0.0) to Chapleau (Mile 136.4). In the vicinity of the occurrence, the maximum permissible speed is 60 mph for freight trains. However, for trains handling over 7500 tons, which was the case for the occurrence train (10 841 tons), the maximum speed was restricted to 50 mph.

Train movements on the Nemegos Subdivision are controlled by the centralized traffic control system (CTC), as authorized by the Canadian Rail Operating Rules (CROR), and supervised by an RTC located in Calgary, Alberta.

1.4 Train control system

The CTC system controls train traffic using signal indications. The RTCs will monitor their territory on computer screens from their console. For track maintenance activities, MOW movements on the track are typically protected by TOPs or by planned protection (CROR Rule 842/42).

On the CTC screen, the entire subdivision, including sidings, signals, and train limits, is displayed. The presence of a train in a block or at a controlled location^{Footnote 5} activates an indication on the computer screen, showing the location of the train as it passes these locations. If a train passes a controlled location that is outside its limits of authority, an audible and visual warning is activated on the CTC screen. The CTC screen will also display TOP limits. However, as most track units (e.g., the hi-rail vehicle in this occurrence) do not activate the signal system, the location of track units is not available for display on the RTC's console. Based only on the RTC screen, there is no way to know if a track unit is operating outside its limits of authority.

1.5 Track occupancy permits

A TOP is an "[a]uthority issued for the protection of track units and track work"^{Footnote 6} in order to occupy the main track or a signalled siding to perform work. In CTC territory, TOPs are protected by signal indications. The foreman must therefore clear the track before trains can be given authority to proceed.

Train crews do not receive information regarding TOPs on their tabular general bulletin orders (TGBO).^{Footnote 7} Similarly, MOW employees will not typically be aware of the frequency and location of trains unless communicated by the RTC.

In this occurrence, on 4 occasions throughout the day, the foreman had asked the RTC about other traffic in the area. The foreman was told to expect train 421, which passed through at approximately 1030. After train 421 passed through, the foreman was advised a few times to expect the Budd Rail Diesel Car (Budd car),^{Footnote 8} which passed through at approximately 1340. The foreman had not been told about train 100-03.

The TOP process encompasses a number of steps that act as defences to limit the likelihood that a hi-rail vehicle and MOW employees will proceed outside of a protected area. The success of the TOP system depends not only on employees knowing the steps in the TOP process more generally, but, for each TOP, the employees have to follow the correct sequence of steps, to monitor which steps have been taken, and to identify and initiate the steps that remain.

At CP, TOPs are generally issued over the radio by the RTC and recorded in writing into the foreman's track occupancy permit (TOP) book. CP's Rule Book for Engineering Employees states (in part):

Receiving TOP

1. When requesting a TOP, the foreman must provide the RTC with the foreman's name, track(s) to be occupied and limits required.
2. When correctly repeated, the RTC will state "complete" and provide their initials which must be recorded and acknowledged by the foreman.
3. The TOP is not in effect until the word "complete" and initials of the RTC have been provided, it must not be acted on until it is in effect.^{Footnote 9}

CROR Rule 854, One Track Unit – Foreman Requirements, states the following:

Before acting under the authority of a TOP, a foreman in charge of a single track unit must;

1. read the TOP aloud to the employees accompanying the track unit; and
2. require those employees who hold a valid certificate of rules qualification to read and initial the TOP.^{Footnote 10}

Both MOW employees should have been aware that a new TOP was required before departing Kinogama Siding. The machine operator did not ask to verify the limits of the TOP. The foreman did not request a new TOP. If a new TOP had been obtained, he would have been required to read aloud the TOP and to require the machine operator to read and initial the TOP.

1.6 Logistical challenges for maintenance-of-way employees in northern Ontario

The Nemegos Subdivision is located in a relatively remote area of northern Ontario. The railway and its employees often face challenges to meet operational requirements in this area.

The Nemegos Subdivision consists of a single main track. As crossings on this subdivision are generally spaced far apart,^{Footnote 11} MOW employees in track units (including hi-rail vehicles) may have to travel long distances to get on and off the tracks. As priority is typically given to freight trains, it can take some time for track units to obtain permission to occupy the main track and then to travel to the set-off location.

Shifts for MOW employees are typically 11.25 hours. For some maintenance activities, much of the work day can include travel time to/from the work location(s) and wait time in sidings to allow train traffic to proceed.

Most MOW employees generally stay in company accommodations or hotels during their assignments. Cellular telephone coverage in northern Ontario can be intermittent or non-existent. MOW employees must rely on company radios in case of emergency.

1.7 Requirements for maintenance-of-way employees

1.7.1 Job briefing

CP's Engineering Safety Rule Book states:

1. Employees must participate in a job briefing before beginning work and when the task or job conditions change.
   The job briefing includes the following:
   • a discussion of the general work plan,
   • task to be performed,
   • each employee's individual responsibility,
   • existing or potential hazards,
   • ways to eliminate or protect against hazards,
   • other parties involved in the work must also be included where appropriate.^{Footnote 12}

The job briefing is to be conducted by the employee in charge (i.e., in this occurrence, the foreman). Once the job briefing is completed, CP's Engineering on Track Safety / Task Assessment Booklet (booklet) must be filled out. The booklet contains multiple 2-page forms that prompt the employee in charge on the items that must be covered in the briefing (referred to as On Track Safety) and the task assessment. The booklet states (in part):

Follow-up OTS [On Track Safety] must be conducted whenever:

• Working conditions or procedures change
• Other workers enter the working limits, or
• Track authority is changed, extended, or about to be released.^{Footnote 13}

In this occurrence, at the beginning of the shift, before leaving the accommodations at Ramsey, the foreman conducted a job briefing with the machine operator, which covered the work that was to be completed until the end of the shift. No other job briefing was performed that day.

Performing job briefings with co-workers acts as a defence by requiring a group with shared goals to review material relevant to tasks in a standardized way, for example by using a standard form. Discussing and thinking about the material before an activity increases the likelihood that it will be remembered later on. Job briefings are required to be performed when the tasks or job conditions change. This means that job briefings are required when a new TOP is obtained when track authorities are extended.

1.7.2 Operation of a dual control switch

To facilitate the cleaning of the dual control switches^{Footnote 14} at Kinogama Siding, the MOW employees requested and obtained permission from the RTC to place the switch in the hand position as per CROR Rule 815, which states:

When a track unit(s) is required to move over a dual control switch;

1. the switch must be lined by the RTC, except where the RTC gives permission to the foreman to operate such switch in the "hand" position; and
2. when a dual control switch is operated by the foreman in the "hand" position, and after the track unit has cleared the switch points, the foreman must ensure that the selector lever has been restored to the "power" position and locked and immediately advise the RTC.^{Footnote 15}

Rule 10.2: Track Unit Operation, of CP's Rule Book for Engineering Employees states (in part):

Switches – Dual Control and Power-operated

[…]

3. When operated by "hand", after the track unit has cleared the switch points, the foreman must ensure that:
   1. if it is a dual control switch, it has been restored to the "power" position;
   2. immediately advise the RTC^{Footnote 16}

In this occurrence, after the snow-removal equipment was secured in the back track, the MOW employees approached and stopped at the west-end dual control switch at Kinogama Siding. The foreman exited the vehicle and lined the switch (which was already in the hand position) for the main track. The foreman motioned the machine operator to advance onto the main track, clear of the switch points. Once the switch was lined to the normal position, the foreman restored the dual control switch to the power position. The RTC was not then notified that the switch had been restored and locked to the power position.

1.7.3 Radio broadcast for main-track occupancy

A foreman that is protected by a TOP must make a radio broadcast on the train standby channel before entering the main track. CP's Rule Book for Engineering Employees states:

Radio Broadcast under TOP

When protected by a TOP, prior to occupying any main track or passing station mile signs with OCS [Occupancy Control System] or CTC, the employee responsible for the track unit(s) must, at first opportunity arrange for an announcement over the train standby channel designated in the time table stating:

1. track unit, operator, person in charge or crew
2. location
3. direction
4. designation of track, and
5. TOP limits.

Note: This announcement must be made immediately prior to occupying the track except when not practicable due to radio congestion. In such cases, the track unit may proceed, and the announcement made at the first opportunity.^{Footnote 17}

In this occurrence, prior to entering the main track, the foreman did not make a radio broadcast on the train standby channel.

1.7.4 Continuous radio monitoring

At CP, all track units are equipped with radios. In addition, each MOW foreman will normally have a portable radio. When performing work within the limits of a TOP and communicating with other MOW employees, radios are set to the MOW channel.

CROR Rule 119, Continuous Monitoring, states (in part):

3. Foremen named in […] TOP or clearance must set their radio to "scan mode" when not being used to communicate with another employee and must otherwise have their radio set to monitor the applicable designated standby channel.^{Footnote 18}

In this occurrence, the foreman had not set the radio to scan mode to allow the designated standby channel to be monitored. When radios are in scan mode, all channels are being monitored.

For train crews, the radios in the locomotive cab are normally set to the train standby channel. As such, train crews do not typically hear the communications transmitted from the MOW channel.

1.8 Maintenance-of-way employees

The foreman in this occurrence had started working with CP in 1989, holding various positions until qualifying as a foreman in 2002. The machine operator had started working with CP in 1986, holding various MOW positions throughout the years.

Both employees were qualified for their positions.

1.8.1 Efficiency testing

To ensure compliance with railway operations, railway officials will periodically conduct efficiency testing. An employee will receive a pass or a fail for each test. When an efficiency test is conducted on an employee, immediate feedback is given to the employee in both pass or fail situations. When a failure occurs, the employee is provided verbal coaching to improve the employee's knowledge and respect for the rule. For more serious failures, a rules review and rewrite or disciplinary action can result. In all cases, a follow-up with the employee will be done, including a re-test, within 7 days of the initial failure.

In the previous 12 months, the foreman was tested 52 times. On some occasions, more than one test had been conducted at the same time. This number of tests for the foreman was not unusual: it was typical of the number of tests for other foremen at CP. The machine operator was tested 31 times. Some of these tests had been conducted concurrently (i.e., when both employees were working together). Some of the tests involved documentation, including forms and paperwork such as copying a TOP. Other tests assessed radio communications and these were conducted remotely by monitoring the radio. As the foreman was responsible for completing most of the paperwork and for most of the radio communications, the foreman was tested more frequently than the machine operator.

During the previous 12 months, the foreman received 9 failed test results and the machine operator received 3 failed test results. These failed test results included:

• not initialling a TOP (i.e., both employees during the same efficiency test);
• not filling out paperwork (i.e., foreman – 2 fails on 2 different occasions);
• sub-foreman authorization error and incorrect communication with a train (i.e., foreman – fail on 1 occasion).

1.8.2 Discipline

At the time of the occurrence, under CP's discipline system, occurrences were individually reviewed to determine what discipline was warranted. The extent of such discipline was based on the circumstances and the severity of the issue. Discipline could include a warning, demerit points, suspension and/or dismissal.

Since 2006, the foreman in this occurrence had been disciplined 7 times. Over the same period, the machine operator had been disciplined once. The discipline records for these employees are summarized in Table 2.

Table 2. Summary of disciplinary issues

Disciplinary issue	Foreman	Machine operator
Violation of several rules and instructions	Dismissed for 2 months (July 2013)	Received demerit points (July 2013)
Failure to properly operate equipment	Received demerit points on 3 occasions	–
Improper securement of a track unit	Received demerit points	–
Violation of a cardinal rule	Received demerit points	–
Run-through switch	Received demerit points	–

1.9 Fitness for duty

1.9.1 Rules and procedures

In Canada, the Railway Rules Governing Safety Critical Positions approved by Transport Canada (TC) define a safety-critical position as

1. any railway position directly engaged in operation of trains in main track or yard service; and
2. any railway position engaged in rail traffic control.^{Footnote 19}

According to section 4 of the Railway Medical Rules for Positions Critical to Safe Railway Operations, to occupy a safety-critical position,

• 4.1 […] a person shall undergo a company organized Medical Fitness for Duty assessment:
  1. prior to the commencement of employment in a Safety Critical Position;
  2. upon promotion or transfer to a Safety Critical Position; and
  3. every five years until the age of forty, and every three years thereafter until retirement, or until that person is no longer employed in a Safety Critical Position.^{Footnote 20}

Based on these rules, MOW positions are not considered to be safety-critical.

However, under CP's Fitness to Work Medical Procedures, safety-sensitive positions  are defined as railway positions where impaired performance may put public safety at occasional risk as well as put at risk the safety of employees, customers, customers' employees, property or the environment. Safety-sensitive positions are reviewed periodically to reflect any changes in job function. All persons (unionized and non-unionized) who may perform any of these functions, such as track foremen and machine operators, are deemed to hold safety-sensitive positions. While there are no requirements regarding testing for ongoing medical fitness for duty for employees in safety-sensitive positions, all employees (including those in safety-critical positions), are accountable for their own health. They are also required to seek appropriate assistance from their supervisor, health professional, occupational health and safety or the Employee and Family Assistance Program (EFAP) if they have any concerns about their ability to perform their job or if they are unable to perform their duties. Employees in safety-sensitive positions have to advise their supervisor of any job-specific limitations and/or restrictions and comply with all applicable medical monitoring requirements.

1.9.2 Fatigue science

Section 28 of the Railway Safety Management System Regulations, 2015^{Footnote 21} (SMS Regulations) requires railways to apply the principles of fatigue science and have a method of applying the principles of fatigue science. When scheduling the work of an employee who is required to work according to a schedule meeting prescribed requirements, railways need to take into consideration the following principles:

1. that human fatigue is governed by physiology;
2. that human alertness is affected by circadian rhythms;
3. that human performance degrades in relation to hours of wakefulness and accumulated sleep debt; and
4. that humans have baseline minimum physiological sleep needs.

The section 28 requirements would apply to schedules worked by MOW employees in the following conditions:

1. The railway company must include, in its safety management system, a method for applying the principles of fatigue science when scheduling the work of an employee who is required to work according to a schedule that
   1. is not communicated to the employee at least 72 hours in advance;
   2. requires the employee to work beyond his or her normal work schedule; or
   3. requires the employee to work between midnight and 6:00 a.m.^{Footnote 22}

In the case of the foreman and machine operator involved in this occurrence, their schedule was communicated to them at least 72 hours in advance, they rarely had to work beyond their normal work schedule, and they worked the day shift. Therefore, that requirement did not apply to them.

Research has shown that sleep-related fatigue contributes to performance impairments in memory and decision making.^{Footnote 23} In addition, the number of hours worked per week over and above the "normal" work week of 40 hours is associated with increased risk of work-related injury.^{Footnote 24} Analysis^{Footnote 25} indicates that people who work more than 64 hours per week are at an 88% increased risk of being involved in an accident compared to those who work less than 40 hours per week. Part III of the Canada Labour Code (CLC) specifies that the maximum number of hours most employees can be required or allowed to work in a week is 40. The CLC contains provisions for work schedule modifications due to the nature of the work, allowing for an average of 48 hours per week over a 2-week period.

Most of CP's rail system in northern Ontario is in remote areas, and MOW employees in these areas have compressed work schedules. In this case, the foreman and the machine operator were working a 7-days-on/7-days-off shift schedule. Based on a "drive-in, drive-out" model, whereby travel to and from the remote work location is considered non-work time, these employees were housed during off-duty hours at the local company bunkhouse. Daytime scheduled shifts were approximately 11.25 hours in duration, typically starting at 0700 and finishing at 1815. Overtime was normally performed only on an as-needed basis. With minimal overtime, the number of work hours for each on-duty week was about 78.75, plus travel time. Positive aspects of this schedule that can help limit the potential for fatigue include predictability, the requirement to work during daytime hours, and the consecutive days off in between work periods.

When working 7 consecutive day shifts, a worker must be able to get sufficient good-quality, nighttime sleep to avoid any cumulative fatigue. However, if a worker sleeps fewer hours than needed, or if the sleep between day shifts is of poor quality, a chronic sleep deficit can accumulate and can result in fatigue. This sleep-related fatigue can increase the risk of an incident or accident.^{Footnote 26}

In this occurrence, the MOW employees had been working the 6th of 7 scheduled shifts on the day of the accident. In addition, the foreman had also worked an additional overtime shift the day prior to the normal work week. Travel to the bunkhouse took approximately 3.25 hours for the foreman, and 5.25 hours for the machine operator. They would typically car pool to the bunkhouse the day before their first shift, with the machine operator doing the driving. They would return home immediately following the 7th work shift,^{Footnote 27} and would therefore be awake and performing safety-sensitive activities, such as driving a motor vehicle, for at least 16.5 hours that day.

A quantitative analysis of the MOW employees' work/rest history was carried out using the Fatigue Avoidance Scheduling Tool (FAST)^{Footnote 28} software. For the machine operator, it was determined that, on the afternoon of the occurrence, fatigue was unlikely to have been significant. For the foreman, some fatigue risk factors were present that day.

1.9.3 Canadian Pacific Railway fatigue management plan

Requirements for establishing fatigue management plans are set out in the Work/Rest Rules for Railway Operating Employees.^{Footnote 29} Pursuant to these requirements, CP and the Teamsters Canada Rail Conference (Teamsters) have established a fatigue management plan (FMP) that addresses education and training, scheduling practices, dealing with emergencies, alertness strategies, rest environments, implementation policies, and evaluation of FMPs and crew management effectiveness.^{Footnote 30}

The plan is based on the principle of shared responsibility for fatigue management and indicates that solutions will be achieved through a "combination of corporate and individual responsibility and empowerment to manage fatigue."^{Footnote 31} The FMP elaborates on this principle, setting out roles and responsibilities across the system.

The current Work/Rest Rules for Railway Operating Employees and CP's FMP do not apply to MOW employees, such as the track unit crew.

1.9.4 Circadian rhythm and performance

Due to changes in body physiology that are synchronized to a circadian (daily) rhythm, time of day can have a strong effect on an individual's alertness and performance. This 24-hour cycle allows the body to prepare for action during the day and to recuperate at night.

The occurrence took place at approximately 1530, during the afternoon circadian dip,^{Footnote 32} when feelings of fatigue may be more pronounced for some individuals than at other times during the day and can affect performance.^{Footnote 33}

1.9.5 Polysomnographic study

In the 5 months preceding the occurrence, the foreman had regularly experienced poor quality sleep of shortened duration.

Following the occurrence, the foreman underwent a polysomnographic (sleep) study. Based on this sleep study, it was determined that the foreman had mild obstructive sleep apnea (OSA) and mild periodic limb movement disorder.

1.9.5.1 Obstructive sleep apnea

OSA is a medical disorder characterized by partial or complete obstruction of airflow during sleep that causes the individual to awaken for short periods in order to breathe. The fragmented sleep can lead to impaired performance during wakefulness, and is associated with increased risk of occupational^{Footnote 34} and motor vehicle^{Footnote 35Footnote 36} accidents. The prevalence of OSA in the general public has been estimated to be 4% in men and 2% in women.^{Footnote 37} Some estimates indicate a higher prevalence of OSA for middle-aged men, especially if they are overweight. These estimates can be as high as 10% for men between the ages of 40 and 60.^{Footnote 38} In addition, OSA is more common in people who snore,^{Footnote 39} and is reliably linked to obesity.^{Footnote 40} Treatment options for OSA include weight loss, continuous positive airflow pressure (CPAP),^{Footnote 41} mandibular splints, and upper airway surgery.

Following this occurrence, the foreman was diagnosed with mild OSA, and exhibited the following risk factors: snoring, difficulties with sleep, elevated body-mass index, and being middle-aged. The sleep study identified OSA-related sleep disruptions occurring mostly during the first third of the (nighttime) sleep period.

1.9.5.2 Periodic limb movement disorder

Periodic limb movement disorder is a sleep disorder characterized by periodic episodes of repetitive, involuntary limb movements that occur during sleep.^{Footnote 42} The limb movements can result in arousals and awakenings of which the person may be unaware. In other cases, people with this disorder may also have difficulty falling asleep and/or staying asleep due to the limb movements they experience. People with periodic limb movement disorder are at higher risk of fatigue and excessive daytime sleepiness than others, due to the fragmented sleep they obtain.^{Footnote 43} The prevalence of periodic limb movement disorder in the middle-aged and elderly ranges between 4% and 11%.^{Footnote 44} Periodic limb movement disorder is known to co‑occur with OSA.

Following this occurrence, the foreman was diagnosed with mild periodic limb movement disorder, which caused his sleep to be somewhat disrupted, particularly during the latter two-thirds of the (nighttime) sleep period.

1.10 Decision making and situational awareness

To facilitate effective decision making, individuals need to have an accurate understanding of their goals, decisions, and information requirements. In addition, effective decision making depends on the accuracy of one's situational awareness (i.e., perception of elements in the environment within a volume of time and space, comprehension of their meaning, and projection of their status into the future^{Footnote 45}). Accurate situational awareness enables informed, accurate predictions of the potential consequences of one's decisions. When people receive information that they expect to receive, they tend to react quickly and error-free. However, when they receive information that is contrary to their expectations, their performance tends to be slow or inappropriate.^{Footnote 46}

In this occurrence, the foreman was not aware that train 100-03 would be passing through the area.The foreman believed that the track limits for TOP 2213 extended up to Nemegos. The crew had intended to leave Kinogama and to remove the track unit at the crossing at Mile 118.60, which required a new TOP. At the time when the foreman should have been obtaining a new TOP to depart, the MOW employees were focused on the placement of the snow-removal equipment in the back track (from the east to the west end).

1.10.1 Enforcement of track occupancy permit limits within the Canadian Rail Operating Rules

Conflicts between trains and track units are a high risk, yet low probability event. To minimize and prevent these conflicts in CTC, a number of rules have been established in the CROR, including:

• Rule 34 (Fixed Signal Recognition and Compliance);
• Rule 42 (Planned Protection);
• Rule 44 (Unusual Track Signal Conditions);
• Rule 80 (Main Track Authorization);
• Rule 119 (Continuous Monitoring);
• Rule 131 (Recording);
• Rule 136 (Copying, Repeating, Completing and Cancelling);
• Rule 567.1 (Protect Against a Foreman);
• Rule 567.2 (Entering Foreman's Limits);
• Rule 803 (Track Unit and Track Work Authorization);
• Rule 816 (Foreman Requirements – Identifying Arrival and/or Departure of Movements);
• Rule 842 (Planned Protection – Rule 42);
• Rule 854 (One Track Unit – Foreman Requirements); and
• Rule 856 (Communication Between Employees and Foremen).

Appropriate enforcement of CROR is only possible in a work environment that can be suitably monitored. While the MOW employees were being regularly tested, they often worked alone (in small teams) in relatively isolated locations. Therefore, the likelihood of detecting CROR violations on a consistent basis was low.

In December 2013, the track unit crew in this occurrence had been found to be in non-compliance with several company rules and instructions. The machine operator received demerit points for the non-compliance. The foreman was initially dismissed from the railway due to having had several other rule violations (since 2006) for which he had received demerit points. In February 2014, the foreman was re-hired with the railway and returned to the position.

1.11 Technologies for track unit protection

1.11.1 Positive train control

Positive train control (PTC) is an emerging train control technology that is designed to prevent:

• train-to-train collisions;
• overspeed derailments;
• incursions into work zone limits; and
• movement of a train through a switch left in the wrong position.

PTC systems include functions to:

• alert train crews to pending authority and speed limit violations, including passing a Stop signal;
• stop trains before they exceed authority and speed limits, including signals at stop;
• interrogate upcoming wayside signals and switches on a train route; and
• protect work zone limits by enforcing train compliance with work zone restrictions.

In the United States, the September 2008 collision between a Metrolink passenger train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the Rail Safety Improvement Act of 2008. This legislation mandated that, by 2015, PTC be installed on higher‑risk rail lines in the United States. However, due to a number of technical challenges, the PTC implementation deadline was extended until 31 December 2018, and could be extended further on a case-by-case basis by individual railroads with the permission of the Federal Railroad Administration (FRA).^{Footnote 47} Furthermore, before it is used in revenue service, the FRA must certify the technology and its application for each railroad.

In Canada, no PTC systems are currently in use by freight or passenger railways, nor are any planned for federally regulated railways. However, both CP and Canadian National Railway Company (CN) are required to meet the PTC requirements for their U.S. operations. CP plans to complete the full PTC implementation for its U.S. operations by the end of 2018.

Within a PTC system, to protect MOW vehicles and to provide a positive stop of equipment before a collision, the system would also require a method to detect track units on the track. Examples of technology to detect track units include:

• shunting of on-track MOW equipment;
• global positioning system (GPS) locating devices;
• electronic track occupancy permits (ETOPs), which would result in the locking out of sections of track where work authorities exist; and
• radio-based technology to communicate between trains and track units.

1.11.2 Shunting of on-track railway equipment

Electric current (track circuit) runs through the rails from a power source to determine track occupancy. Shunting occurs when electricity flows between the rails such as when a rail car's non-insulated wheels and axles permit the current to pass from one rail to another.

Tracks are divided into blocks of varying length and each block is divided from adjacent blocks by insulated joints. In CTC territory, at the entrance of each block, railway signals are in place to govern train movements and to ensure proper train separation. When a train approaches a block that is free of traffic, the signal will display a permissive signal indication. However, if another train or another vehicle that shunts the rail (shorts the circuit) is occupying a block ahead or if the electrical continuity of the rails is interrupted due to a broken rail or an open switch, the system generates a sequence of signals informing the crew to stop the train or to reduce its speed enough for it to be able to stop within half the range of vision (figures 4 and 5).

In Canada, as the wheels of most track units are insulated, they do not shunt the rails. As a result, most track units do not activate railway signals^{Footnote 48} and cannot be tracked by RTCs on their control screens.

For track units, another benefit of shunting the rail is the activation of the grade crossing warning system (GCWS) at actively protected level crossings. In Canada, between 2010 and 2016, there have been 17 collisions (Appendix A) between track units and road vehicles at a crossing equipped with a GCWS (i.e., flashing lights and bell or flashing lights, bell and gates) where the GCWS was not operating at the time of the accident.

On 01 March 2016, the TSB sent Rail Safety Information Letter 04/16 to TC following a collision between a road vehicle and CP snow-removal equipment (track unit) at the Dennison Road public crossing (Mile 105.19) on the Winchester Subdivision, near Bedell, Ontario (TSB occurrence R16H0017). The GCWS was not operating when the collision occurred. The letter stated (in part):

There are, however, limitations to the shunting by track units. For example, in situations when the wheels of the track unit do not establish effective contact with the rail (e.g., rusty rail surfaces, wheel lift occurs over deposits of material such as snow, sand, dirt, leaves), shunting may not occur consistently. In such circumstances, track occupancies can be intermittent or not show at all.

In the United States, the Union Pacific Railroad has required all equipment operating on its track, including track units, to be shunted. Other U.S. railways have implemented the requirement to use shunting devices while work crews are working on the track (Figure 6). These shunting devices are typically installed by hand and are used to protect work crews. This track protection system ensures that stop signals will be displayed to trains when approaching the blocks that are occupied by the workers. These shunting devices are not designed to protect MOW employees while travelling as they must be installed on the track and then removed upon travelling through the block. Therefore, shunting devices would not have prevented this occurrence since the track unit was moving.

1.11.2.1 National Transportation Safety Board recommendation regarding shunting

On 29 January 1988, a northbound Amtrak train struck MOW equipment in Chester, Pennsylvania. The locomotive engineer on the train was seriously injured. Eight train crew members and 15 passengers sustained minor injuries. As a result of its investigation into this occurrence, the United States National Transportation Safety Board (NTSB) issued the following recommendation to the American Railway Engineering Association (AREA):

On 14 June 1989, in response to the recommendation, the AREA stated (in part):

On 15 November 1989, the NTSB assessed the response from the AREA as unacceptable. The NTSB stated (in part):

^{Footnote 50}

In a similar, recent accident, on 03 April 2016, Amtrak passenger train 89 struck a roadway maintenance machine (backhoe) near Chester, Pennsylvania. While travelling at 106 mph, the locomotive struck the backhoe. The backhoe operator and a MOW supervisor were fatally injured. Of the 7 crew members and 337 passengers on board the train, 41 people were transported to hospital. The NTSB investigation into this occurrence is ongoing. Among the safety deficiencies identified by the NTSB was the failure to apply a supplemental shunting device.^{Footnote 51}

1.11.3 Equipment detection and GPS technology

Some railway companies use GPS technology to locate and monitor on-track equipment. In the future, this technology could also be used within a collision-avoidance system.  

Following a 1996 collision involving 2 trains near Sept-Îles, Quebec (TSB Railway Investigation Report R96Q0050), a GPS-based collision avoidance system was developed by the Quebec North Shore and Labrador Railway (QNS&L). This proximity detection device (PDD) was implemented on its rail network in July 1997. The PDD uses GPS technology to locate all on-track locomotives and track units. It provides audible and visual warnings to equipment operators of other equipment within specified distances and triggers penalty braking if train crews do not take action. Except for limited trials, no similar systems have been implemented on other Canadian railways.

In the United States, in the early 2000s, the Burlington Northern Santa Fe Corporation (BNSF) implemented a collision prevention system (Hy-Rail Limits Compliance System) to add an additional layer of safety to the operation of hi-rail vehicles on active main tracks through the use of GPS technology. The system monitors the location of hi-rail vehicles by comparing authorization limits issued to a vehicle against its physical location. When a vehicle approaches its limits of authority, the maintenance workers are alerted. If the vehicle exceeds its limits of authority, it receives a continuous alarm and the system alerts the dispatcher.

In 2004, BNSF began testing the Electronic Train Management System (ETMS), a collision-avoidance technology to keep trains within their authorized limits and at or under their authorized speed limit, using GPS data and software to determine train location. These 2 systems developed for BNSF are based on similar technologies. ETMS is an approved PTC system and formed the blueprint for the Interoperable Electronic Train Management System (I-ETMS), also an approved PTC system that is being adopted by most freight railways in the United States, including CP and CN on their US-based rail lines.

At CP, GPS devices had been installed on most of its track units. However, the occurrence track unit had not been installed with a GPS device. Although GPS information is collected by CP, this information is used primarily for fleet management. GPS information was not being used for on-rail vehicle tracking by the RTC, by the operating crews or by the MOW employees.

1.11.4 Electronic track occupancy permits

In May 2012, in response to occurrences where track units were operated outside of their limits of authority, CN implemented a system for electronic track occupancy permits (ETOP). The system is used by RTCs and rules-qualified MOW employees. A laptop, displaying the CTC screen, was installed in each track unit.

When track occupancy is required, the foreman can initiate the request on the screen by blocking the section of track required. If the RTC approves the ETOP, the RTC acknowledges the authority and the section of track covered in the TOP is indicated (in yellow) on the CTC screen. The CTC screen also displays other TOPs, as well as trains and their intended path.

Within the track unit, the CTC screen is displayed in near real time, as the system will refresh the screen every 7 seconds. The information is stored on the laptop for 72 hours, before being uploaded to a central database.

However, there are some limitations to the ETOP system. For example, as cellular telephone coverage is required,^{Footnote 52} the system is not suitable for some remote locations on the rail network such as northern Ontario. Another limitation is that the system does not monitor or intervene if incorrect information is entered, such as the wrong track (multi-track territory) or a mileage outside the limits of the TOP.

At the time of the occurrence, CP was working on a system called Employee in Charge (EIC). The EIC system was introduced in July 2016 and is expected to be fully implemented in 2017 across CP's network in Canada. It allows qualified employees to electronically request and receive TOPs in the field on a laptop and provides a subdivision overview similar to a CTC overview, displaying TOP limits and trains. The EIC system requires communication between the laptop and RTC office via cellular connection or Wi-Fi hotspot. However, the system is not suitable for some remote locations on the rail network such as northern Ontario. It is expected that the system will reduce the potential for transcription errors or confusion on limits when requesting and acting on a TOP from the RTC and when protecting sub-foremen or issuing movement instructions. At the time of the occurrence, the EIC system had not been implemented at CP.

Both the CN and CP systems for ETOPs were not designed to provide warnings to MOW workers as they approach the end of their TOP limits.

1.11.4.1 Similar occurrences involving track units

An examination of TSB's rail occurrence database (RODS) was conducted for the 10-year period between 2007 and 2016 to identify similar occurrences where track units were operated outside their limits of authority.

During this 10-year period, there were 263 such occurrences (Figure 7)—139 at CP and 124 at CN. Of these 263 occurrences, 16 resulted in a collision between a train and the track unit on the main track.

At CN, in the 5 years since the introduction of the ETOP system in 2012, there has been no additional improvement in the rate of these occurrences. During the same time period, at CP, there was an increase of about 28% in these occurrences. Some of these changes may be a result of increased maintenance activity or other factors.

1.12 Canadian Pacific Railway's safety management system

TC developed the SMS Regulations, under which railways are responsible for managing their safety risks.

Paragraphs 5(e) and 5(g) of the SMS Regulations state that:

A railway company must develop and implement a safety management system that includes […]

5. a process for identifying safety concerns;^{Footnote 55} […]

7. a process for implementing and evaluating remedial action^{Footnote 56} [...].^{Footnote 57}

Furthermore, section 13 of the SMS Regulations states that:

A railway company must, on a continual basis, conduct analyses of its railway operations to identify safety concerns, including any trends, any emerging trends or any repetitive situations. The analyses must, at a minimum, be based on

1. any reports of railway occurrences;
2. any internal documentation relating to railway occurrences;
3. any reports of injuries;
4. the results of any inspections conducted by the railway company or by a railway safety inspector;
5. any reports of contraventions or safety hazards that are received by the railway company from its employees;
6. any complaints relating to safety that are received by the railway company;
7. any data from safety monitoring technologies;
8. the conclusions of the annual report referred to in subsection 29(3); and
9. the findings of any audit reports.^{Footnote 58}

Paragraph 15(1)(a) of the SMS Regulations states the following:

A railway company must conduct a risk assessment in the following circumstances:

1. when it identifies a safety concern in its operations as a result of the analysis conducted under section 13; [...].^{Footnote 59}

As part of CP's safety management system (SMS), safety data is collected and analyzed to identify emerging trends, including repetitive situations where safety is compromised. There was no indication that CP had specifically identified the upward trend of track units being operated outside their limits of authority, although CP had initiated work on their EIC system.

1.13 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Safety management and oversight is a Watchlist 2016 issue. All transportation companies have a responsibility to manage safety risks in their operations.

Some companies consider safety to be adequate as long as they are in compliance with regulatory requirements, but regulations alone cannot foresee all risks unique to a particular operation. That is why the TSB has repeatedly emphasized the advantages of SMS, an internationally recognized framework to allow companies to effectively manage risk and make operations safer.

The move toward an SMS regime must be supported by appropriate regulatory oversight. Given that regulators will encounter companies with varying degrees of ability or commitment to effectively manage risk, this oversight must be balanced. It needs to include proactive auditing of companies' safety management processes, ongoing education and training, and traditional inspections to ensure compliance with existing regulations.

1.14 TSB Engineering Laboratory examination of the track unit

The track unit (i.e., hi-rail vehicle) involved in this occurrence was a leased 2015 Ford F350 4X4 crew cab, long box pickup truck with 15 000 km.

The damaged vehicle was examined at the TSB Engineering Laboratory. It was determined that:

• The only manufacturer-installed unit with recoverable data relevant to the occurrence was the restraints control module (RCM). The RCM was removed from the vehicle for download. The crash data from the RCM started 5 seconds prior to impact and continued for 5 seconds after impact.
• For the 5 seconds prior to impact, the vehicle had not been moving (speed of 0 mph), it was in "Park," the engine was idling, and the driver's seatbelt was unbuckled.
• Within 128 milliseconds after impact, the vehicle was travelling at a speed of almost 40 mph in reverse direction (direction of the train's forward travel) while being pushed by the train.
• There had been little side impact force to the vehicle, and the maximum roll was measured to be 1.58 degrees.
• The FM transceiver radio (VHF) had kept its settings after losing power at the time of impact. The radio was set to channel 11 (MOW channel), the volume was at 9, and it was not set to the scan mode.
• The automatic lock feature was set so that all doors could be unlocked as soon as any door handle was pulled. The childlock feature for the rear doors was disabled.^{Footnote 60}
• There was no manufacturer-installed GPS or after-market GPS unit present on the vehicle.

1.14.1 TSB laboratory reports

The following laboratory report was completed in support of this investigation:

• LP063/2016 – Data Retrieval and Analysis for Hi-Rail Track Unit

Neither the condition of the track nor the manner in which freight train 100-03 was operated contributed to the occurrence. The analysis will focus on the administrative defences for maintenance-of-way employees (MOW), the fatigue risk factors, and the technologies for track unit protection.

2.1 The accident

The collision occurred when the track unit was operated past the outer main-track signal west of Kinogama Siding without having obtained a track occupancy permit (TOP) to protect the movement.

Upon completing the work at Kinogama Siding and with the need to travel to Chapleau to re-fuel the hi-rail vehicle before returning to Ramsey, the MOW employees had been preparing to depart. However, the MOW employees realized that the snow-removal equipment had been secured at the wrong location at a time when the foreman should have been ensuring that they had the proper limits to depart. The MOW employees became occupied with the re-securing of the equipment at the correct location. The need for a new TOP extending the limits to Nemegos and a subsequent job briefing were overlooked.

When the machine operator entered the vehicle after having re-secured the snow-removal equipment at the west end of the back track, the foreman, believing that their TOP limits extended to Nemegos, indicated that they could proceed westward to the crossing at Mile 118.60 to remove the vehicle from the track. However, prior to proceeding, the MOW employees did not conduct a further job briefing as required by the Canadian Pacific Railway (CP) Engineering on Track Safety/Task Assessment Booklet, including completing the review of the TOP. Without the process of discussing the TOP limits prior to departing Kinogama Siding, the foreman's misunderstanding of the TOP limits was not identified. However, as the machine operator had viewed and initialed the previous TOP, the machine operator should have been aware that a new TOP was required before leaving the siding. Therefore, the machine operator should have expected a job briefing to take place to view and initial the new TOP. As the machine operator did not ask to view and initial the TOP as required, another opportunity to identify that the crew did not have authorization to proceed onto the main track was lost.

With the snow-clearing work being performed at Kinogama Siding that day, the dual control switch had to be operated and lined several times. As a result, the rail traffic controller (RTC) permitted the MOW employees to take control of the switch by setting it to the hand position. Once the work was completed that day, the MOW employees were required to restore the switch to the power position and then advise the RTC. The MOW employees did not inform the RTC that the dual control switch had been restored to the power position as required by Rule 10.2 of CP's Rule Book for Engineering Employees.

Any time a track unit enters the main track, CP's Rule Book for Engineering Employees requires that the MOW crew must make a radio broadcast over the standby channel. This broadcast should include information such as location, direction of travel, destination and TOP limits. This requirement represents a backup safety defence, as it would remind the MOW employees of their operating limits and would advise nearby trains and track units of an approaching movement. Situational awareness for all would be maintained. However, in this occurrence, the MOW employees did not broadcast their entrance onto the main track.

In addition, MOW equipment radios are required by Canadian Rail Operating Rules (CROR) Rule 119 to be set to the scan mode so that broadcasts by nearby traffic can be heard. The MOW employees had not set their radio to scan mode. Backup safety defences were nullified when the MOW employees did not call the RTC to advise on the status of the dual control switch, did not broadcast their entrance onto the main track, and did not set their radio to scan mode.

At CP, these types of hi-rail vehicles do not shunt the rail, and thus, Centralized Traffic Control System (CTC) signals are not activated and occupancy for these vehicles is not displayed on the RTC control screen. As a result, after departing Kinogama Siding, the track unit was operated for about 8 miles, undetected on the RTC's control screen and undetected by the crew of the approaching freight train.

Near Mile 118.50, as the train and the hi-rail vehicle approached the curve from opposite directions, the train crew observed the track unit and initiated an emergency brake application. At about the same time, the MOW employees observed the train and immediately brought the track unit to a stop.

Because the automatic lock and childlock features of the track unit were set up to allow ease of egress, the MOW employees were able to exit the vehicle relatively unhindered. About 6 seconds later, without sufficient opportunity to stop, train 100-03 struck the stationary track unit.

2.2 Administrative defences

Efficiency testing of the employees in the previous 12 months determined that, on at least one other occasion, both employees had acted upon a TOP that had not been initialed and completed.

Earlier in the work day, the RTC and the foreman had several discussions regarding the movement of trains. During these discussions, the foreman was not aware that train 100-03 would be passing through the area. With the expected trains having already passed through, the foreman's expectation was that no other trains would be passing through that afternoon.

As required by the CROR and various company procedures, there were several defences designed to help identify and correct errors and to enhance situational awareness. However, in this occurrence, the MOW employees did not use all the defences available including:

• not performing a job briefing prior to departing Kinogama Siding;
• not setting the vehicle radio to "scan," which made it impossible for them to monitor movements by other crews in the area;
• not broadcasting that they were entering the main track, which could have acted as a reminder of their TOP limits and potentially alerted the oncoming train; and
• not notifying the RTC that the switch had been restored to the power position when departing Kinogama Siding.

If rules and company procedures relating to track unit operation on the main track are not consistently followed, administrative defences to identify errors and enhance situational awareness may be nullified, increasing the risk of collisions between trains and track units.

2.3 Fatigue risk factors

The work schedule for the MOW employees required them to work seven 11.25-hour shifts in a 1-week period, totalling about 78.75 hours, followed by a week off duty. The 6.5 to 10.5 hours taken to drive to and from the remote work location was not considered work time, but effectively increased the total time performing safety-sensitive activities (including driving a motor vehicle) up to about 90 hours per week.

Compared to schedules of 40 hours per week, extended work weeks are associated with an increased risk of being involved in an accident. Although the 7-days-on/7-days-off work schedule facilitates MOW work in remote locations, the schedule requires a large number of hours of work compressed into a relatively short time frame. In this situation, if nighttime sleep quantity or quality is disrupted for any reason, a worker will be at an increased risk of experiencing fatigue, and associated performance decrements, during the day. To limit the likelihood of fatigue under these circumstances, consistent, good-quality, nighttime sleep of sufficient duration is required.

An analysis of the crew's hours of work and rest for the 7-day period preceding the accident and related factors was conducted. It was determined that, on the afternoon of the occurrence, fatigue was unlikely to have been significant for the machine operator. For the foreman, some fatigue risk factors were present. These included a cumulative sleep deficit due to ongoing disturbances in the quantity and quality of sleep throughout the nighttime sleep cycle related to mild obstructive sleep apnea and mild periodic limb movement disorder. In addition, the timing of the occurrence, during the afternoon circadian trough, would also have increased the likelihood of the foreman being fatigued at the time the decision was made to leave the Kinogama Siding.

A quantitative analysis of the foreman's work/rest history was carried out using the Fatigue Avoidance Scheduling Tool (FAST) software. The FAST analysis determined that, during the period of time leading up to the accident, the performance of the foreman would likely have been in the range of that of a normal person who had missed one full night of sleep. At the time the decision was made to depart Kinogama Siding, the foreman's level of fatigue and its negative impact on performance had been influenced by a number of interacting factors, likely including the combined effects of 2 sleep disorders (which were each considered mild), the time of day during a circadian trough, and a demanding work schedule.

2.4 Track unit protection

In Canada, track units do not activate signals and their occupancy is not shown on the RTC control screen. Consequently, if track units are operating outside the limits of authority, a train or other movement may not be aware of their presence, which can lead to collisions.  There are technologies available that can provide advanced warning of approaching movements to identify and locate equipment on a given section of track to help lower the risks associated with human error.

At least one railway in the United States operates non-insulated track units, which shunt the rail, resulting in the signals being activated and making them visible to other trains and to the RTC. Another benefit of non-insulated track units is the activation of crossing signals. Shunting devices can also be used to protect working crews. However, these devices are normally limited to protecting MOW employees within a work block, and not while travelling on the track. Under certain circumstances, the use of non-insulated track units and shunting devices can be an effective means of detecting on-track MOW employees and equipment to help mitigate the risk of unprotected track unit movements.

Global positioning system (GPS) technology can also provide a reliable means of detecting on-track equipment by RTCs, by train crews and by other MOW crews. For example, the proximity detection device (PDD) developed and implemented by Quebec North Shore and Labrador Railway (QNS&L) uses this technology. Furthermore, if integrated with a positive train control (PTC) system, such technology would provide full protection of MOW equipment by stopping trains before a collision.

Electronic track occupancy permit  systems may contribute to a reduction in the number of occurrences where track units are operated outside their authorized limits. However, they cannot be used in areas where there is no cellular telephone coverage.

In this occurrence, the MOW employees were being monitored and efficiency tested by the railway on a regular and consistent basis. In the previous 12 months, the foreman had been tested 52 times. This number of tests for the foreman was not unusual, as it was typical of the number of tests for other foremen at CP. The machine operator had been tested 31 times. Some of the tests involved documentation, including forms and paperwork such as copying a TOP. Other tests involving radio communications were only able to be conducted remotely by monitoring the radio. During the previous 12 months, the foreman received 9 failed test results and the machine operator received 3 failed test results. Despite the numerous tests and failures, the crew continued to violate some rules.

With a large number of track unit crews working over a large rail network, and in the absence of technology to monitor the location of track units, it can be difficult to detect rule violations related to TOP limits, particularly in remote areas such as northern Ontario.  Real-time monitoring allows the RTC or other equipment to identify and take action when any equipment is operated outside its limits of authority. If physical safety defences to warn or to intervene when a track unit has exceeded its TOP limits are not implemented, unsafe situations resulting from human error can remain undetected, increasing the risk of collisions between trains and track units.

2.5 Implementation of remedial action at Canadian Pacific Railway

The TSB Watchlist emphasizes the need for safety management systems (SMS) to be implemented effectively to ensure that hazards are proactively identified and that risks are maintained at an acceptable level.

The Railway Safety Management System Regulations, 2015 (SMS Regulations), under which railways are responsible for managing their safety risks, stipulate that railways need to have a process to identify safety concerns and to implement and evaluate remedial action. Under the SMS Regulations, railways must also analyze their railway operations to identify any trends, emerging trends or repetitive situations.

As part of CP's SMS, safety data is collected and analyzed to identify emerging trends, including repetitive situations where safety is compromised. There was no indication that CP had specifically identified the upward trend of track units being operated outside their limits of authority. However, CP had initiated work on its EIC system, which was designed to mitigate safety risks during track unit operation. If railway safety data are not regularly reviewed to identify trends, emerging trends or repetitive situations, and appropriate action is not taken, safety risks may remain unidentified and unmitigated, increasing the risk of accidents.

2.6 Safety-critical positions

In Canada, MOW employees are not considered as holding safety-critical positions. Therefore, these employees are not subject to additional requirements such as periodic medical evaluations to assess their fitness for duty, including the presence of any sleep disorders. Under CP's Fitness to Work Medical Procedures, the foreman and machine operator were deemed to hold safety-sensitive positions. This meant that they were accountable for their own health and were required to raise any concerns about their ability to perform their work. If MOW employees who carry out safety-critical tasks or are in charge of ensuring the safety of employees working on or near the track are not subject to enhanced medical requirements, underlying medical conditions, including sleep disorders that affect the safety performance of employees, can go undetected, increasing the risk of accidents.

3.1 Findings as to causes and contributing factors

1. The collision occurred when the track unit was operated past the outer main-track signal west of Kinogama Siding without having obtained a track occupancy permit to protect the movement.
2. Without the process of discussing the track occupancy permit limits prior to departing Kinogama Siding, the foreman's misunderstanding of the track occupancy permit limits was not identified.
3. As the machine operator did not ask to view and initial the track occupancy permit as required, another opportunity to identify that the crew did not have authorization to proceed onto the main track was lost.
4. Backup safety defences were nullified when the maintenance-of-way employees did not call the rail traffic controller to advise on the status of the dual control switch, did not broadcast their entrance onto the main track, and did not set their radio to scan mode.
5. After departing Kinogama Siding, the track unit was operated for about 8 miles, undetected on the rail traffic controller's control screen and undetected by the crew of the approaching freight train.
6. At the time the decision was made to depart Kinogama Siding, the foreman's level of fatigue and its negative impact on performance had been influenced by a number of interacting factors, likely including the combined effects of 2 sleep disorders (which were each considered mild), the time of day during a circadian trough, and a demanding work schedule.

3.2 Findings as to risk

1. If rules and company procedures relating to track unit operation on the main track are not consistently followed, administrative defences to identify errors and enhance situational awareness may be nullified, increasing the risk of collisions between trains and track units.
2. If physical safety defences to warn or to intervene when a track unit has exceeded its track occupancy permit limits are not implemented, unsafe situations resulting from human error can remain undetected, increasing the risk of collisions between trains and track units.
3. If railway safety data are not regularly reviewed to identify trends, emerging trends or repetitive situations, and appropriate action is not taken, safety risks may remain unidentified and unmitigated, increasing the risk of accidents.
4. If maintenance-of-way employees who carry out safety-critical tasks or are in charge of ensuring the safety of employees working on or near the track are not subject to enhanced medical requirements, underlying medical conditions, including sleep disorders that affect the safety performance of employees, can go undetected, increasing the risk of accidents.

3.3 Other findings

1. Because the automatic lock and childlock features of the track unit were set up to allow ease of egress, the maintenance-of-way employees were able to exit the vehicle relatively unhindered.
2. Under certain circumstances, the use of non-insulated track units and shunting devices can be an effective means of detecting on-track maintenance-of-way employees and equipment to help mitigate the risk of unprotected track unit movements.

4.1 Safety action taken

4.1.1 Transport Canada

On 08 March 2016, Transport Canada (TC) issued a letter of non-compliance with respect to Rule 803 of the Canadian Rail Operating Rules (CROR) to Canadian Pacific Railway (CP).

On 15 April 2016, CP replied to the letter of non-compliance, indicating the following:

• On 09 March 2016, a safety flash that reviewed the incident and applicable rules was issued to all CP Engineering employees in Canada;
• As of 15 April 2016, 2576 employees in Canada had been tested on proper track protection procedures; and
• CP was exploring initiatives for electronic authorities, including an initiative under way to design and pilot a new system for electronically requesting track occupancy permits.

As part of TC's oversight, TC's Ontario Regional Office had identified CP track units exceeding limits of authority as an issue in 2016-2017. As a result, 6 inspections were performed to assess compliance to CROR Rule 803. No CROR non-compliances were noted during these inspections.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. the Board authorized the release of this report on 14 August 2017. It was officially released on 30 August 2017.

Appendix A – Collisions from 2010 to 2016 between track units and road vehicles at crossings equipped with a grade crossing warning system that was not operating

Occurrence number	Date	Location	Summary
R10T0074	20 April 2010	Mile 304.29, Kingston Subdivision, Whitby, Ontario	While proceeding westward on the south main track, a Canadian National Railway Company (CN) track unit (spiker) struck a vehicle at the South Blair Street public crossing. No injuries were reported.
R10W0307	25 October 2010	Mile 0.45, Letellier Subdivision, Winnipeg, Manitoba	While proceeding northward, a CN ballast regulator struck a car at the Windemere Avenue crossing. There were no injuries.
R11Q0049	21 September 2011	Mile 143.22, Mont-Joli Subdivision, Saint-Simon, Quebec	A CN track unit, operating eastward at 20 mph, struck a vehicle at the de la Gare Street public crossing. No injuries were reported.
R11W0287	16 December 2011	Mile 2.58, Rosetown Subdivision, Saskatoon, Saskatchewan	A CN speed swing was transporting a piece of rail over Highway 60 public crossing when a vehicle struck the rail. No injuries were reported.
R12E0102	14 August 2012	Mile 236.42, Wainwright Subdivision, Lindbrook, Alberta	A CN hi-rail track unit contacted a vehicle at the Secondary Highway 630 public crossing. No injuries were reported.
R12W0243	26 October 2012	Mile 3.23, Winnipeg Beach Subdivision, Winnipeg, Manitoba	A Canadian Pacific Railway (CP) ballast regulator was struck by a vehicle at the Templeton public crossing. As a result of the collision, the lone occupant in the vehicle sustained minor injuries.
R13T0013	28 January 2013	Mile 25.87, Galt Subdivision, Mississauga, Ontario	A CP hi-rail track unit contacted a vehicle at the Ninth Line Road public crossing. No injuries were reported.
R13V0150	04 November 2013	Mile 58.93, Telkwa Subdivision, Broman Lake, British Columbia	While proceeding over the crossing at Broman Lake, a CN undercutter machine contacted a vehicle. The lone vehicle occupant was taken to hospital with minor injuries. The undercutter did not sustain any damage and did not derail.
R14C0021	10 January 2014	Mile 32.30, Red Deer Subdivision, Crossfield, Alberta	A CP hi-rail vehicle was struck by a vehicle travelling west at a public crossing. There were no injuries.
R14E0180	01 October 2014	Mile 44.20, Grande Prairie Subdivision, Grande Prairie, Alberta	A Mark IV tamper contracted by CN was struck by a vehicle at a public crossing. There were no injuries. Damage was sustained to the tamper.
R15W0217	07 January 2015	Mile 4.89, Warman Subdivision, Saskatoon, Saskatchewan	A CN hi-rail vehicle, proceeding north to perform track inspections, was struck by a vehicle, moving east, at a public crossing. The vehicle struck the hi-rail on the driver's door. There were no injuries. Both vehicles were damaged.
R15D0042	09 April 2015	Mile 14.17, Sorel Subdivision, Varennes, Quebec	While travelling east at 4 mph, a CN hydro spiker was struck by a vehicle travelling south at the de la Marine Street public crossing. The CN machinery was engaged at 3/4 onto the public crossing when the impact occurred. There were no injuries and no damage to the rail equipment.
R15T0125	09 June 2015	Mile 29.30, Galt Subdivision, Milton, Ontario	A CP track unit, backing up westward on the south track, slid through the crossing and struck a vehicle travelling north at a public crossing. There were no injuries. The vehicle sustained damage.
R16H0017	18 February 2016	Mile 105.19, Winchester Subdivision, Bedell, Ontario	A CP snowfighter track unit, proceeding east on the Winchester Subdivision, struck a pick-up truck, travelling north, at the Dennison Road public crossing. The vehicle operator sustained injuries and was taken to hospital.
R16W0129	22 June 2016	Mile 12.02, Oak Point Subdivision, Winnipeg, Manitoba	A ballast regulator operating on the Prairie Dog Central Oak Point Subdivision was struck by a pick-up truck at the Perimeter Highway public crossing. There were no injuries, no derailment, and no leaks.
R16M0038	18 October 2016	Mile 0.18, Springhill Subdivision, Truro, Nova Scotia	A CN ballast regulator, operating west on the Springhill Subdivision, stopped and proceeded over a public crossing. The track unit was struck by a car travelling southward. There were no injuries and no damage to equipment.
R16E0111	15 November 2016	Mile 34.51, Brazeau Subdivision, Red Deer Junction, Alberta	A CN rail heater (track unit) proceeding south on the Brazeau Subdivision was struck by a truck travelling east at a public crossing. There were no injuries and no derailment. The rail heater sustained damage.