Rail transportation safety investigation report R18E0007

On 10 January 2018, at approximately 0228 Mountain Standard Time, Canadian National Railway Company freight train L76951-10, proceeding southward on the Luscar Industrial Spur from the Teck Resources Limited Cardinal River Operations coal loading facility near Cadomin, Alberta, experienced a loss of control while proceeding down the mountain grade to Leyland, Alberta. The train reached a maximum speed of 53 mph before it came to a stop at Mile 0.5. There were no injuries.

The uncontrolled movement of the train occurred when the available brake capacity was insufficient to control the train as it descended the steep mountain grade of the Luscar Industrial Spur. Inspection immediately after the train came to a stop revealed that the air brakes on 27 of the 58 loaded coal cars were not applied. While the train was at Luscar, the temperature dropped below a critical point, which adversely affected the function of the air brake control valves on the cars in this train. At the time of the occurrence, the ambient temperature was −24 °C.

Worn rubber seals from the bottom cover exhaust port of the DB-10 service portions of the air brake control valves experienced shrinkage in the extreme cold temperatures that resulted in auxiliary reservoir leakage and the unintended release of brakes on 27 freight cars following service air brake applications. Even though previous performance issues with the DB-10 service portion control valves had manifested themselves in cold weather and resulted in an Association of American Railroads (AAR) Circular in 2013, the failure mode that was previously identified was repeated in this occurrence. If performance issues involving rubber components in air brake control valves are not fully analyzed when they occur, degradation in the efficacy of the control valve, particularly during cold weather conditions, may not be identified and addressed in a timely manner, increasing the risk of a loss of control event.

Railway operations in cold weather

It is well known in the Canadian railway industry that cold weather can result in air leakage from freight car air brake systems. Rubber seals and gaskets become stiff and metal contracts, resulting in leakage of pressurized air.

In recognition of the challenges encountered in train operations during the winter months, railways operating in northern climates typically develop and implement a winter operating plan. Canadian National Railway Company’s (CN) winter operating plan for 2017–2018 contained a number of procedural modifications that were intended to facilitate ongoing railway operations at this time of year, such as speed reductions and reduced maximum train lengths. However, this plan did not contain any specific limitations applicable to the occurrence train operating on the steep mountain grades of the Luscar Industrial Spur when ambient temperatures dropped below a particular point. For example, there were no additional requirements for a qualifying brake test (such as a No. 1A test) after the train was loaded and ready to depart. This test would have verified the application and release of the brakes on each car of the train before descending the steep mountain grade in extreme cold weather conditions.

Following the occurrence, the CN implemented new air brake testing procedures for cold weather operations at Luscar to verify that car brakes apply. In addition, the following specific operating parameters have been adopted for winter operations on the Luscar Industrial Spur:

• When the temperature reaches −25 °C or lower, loaded coal train operations cease on the Luscar Industrial Spur.
• When the temperature is between −22 °C and −25 °C, loaded coal train operations are conducted only during the day.

Single-car air brake testing

A single-car air brake test checks the effectiveness of a car’s air brakes and confirms, among other things, that the brakes remain applied and air pressure leakage is within predetermined levels. However, the current requirements do not include testing at cold temperatures, when vulnerabilities in air brake performance are more likely to become apparent. Currently, the single-car air brake test is most commonly performed in a controlled environment within a car shop, where temperatures do not reflect operational conditions. While single-car air brake tests can validate the function of air brake control valves in moderate operating temperatures, the industry lacks a practical test method that can identify operational vulnerabilities in air brake control valves during extreme cold weather operations.

For the leased train-set involved in this occurrence, single-car air brake tests had not been performed when the cars were brought out of storage or before or after they were delivered to CN. There are currently no requirements for single-car testing for cars returning to active service after having been in storage, provided the time in storage does not result in the cars being in non-compliance with existing requirements.

CN has implemented a requirement that car owners ensure that leased cars come to CN with freight car air brake control valves that are less than 10 years old. Newly leased coal cars on CN lines must have passed a single car air brake test within the preceding 5 years. All car control valves greater than 10 years old must be replaced.

In addition, CN implemented other changes in procedures including:

• systematically replacing freight car air brake control valves that are 10 years or older on CN-owned railcars;
• randomly selecting and performing an automated single car test (ASCT) on 10% of all railcars coming out of storage;
• requiring that all new freight car air brake control valves installed will have the DB-60II brake cylinder pressure maintaining feature;

On 08 July 2018, the TSB issued Rail Safety Advisory 04/18 to Transport Canada concerning potential brake valve failures on cars that have been in long-term storage. The TSB suggested the following to Transport Canada:

Given the potential consequences of a loss of braking function due to brake valve failure, Transport Canada may wish to alert railways and car owners of the need to examine the brake valve functionality of cars that have been in long-term storage, particularly if the cars are to be used in cold weather service.

Transport Canada responded to this safety advisory by indicating that it had issued a Rail Safety Bulletin in 2019 entitled “Potential brake valve failures on cars in long-term storage.” The Bulletin states the following:

Transport Canada is of the view that railway companies and car owners should examine the complete valve functionality of cars placed in long-term storage, where the potential for rubber setting of valve seals is possible, before placing the cars in service. This is of particular concern if cars are to be used in cold weather service.

Effective 01 July 2020, the AAR introduced a change to Rule 4 of its Field and Office Manuals of Interchange Rules enabling the removal of control valves older than 13 years. This rule change establishes renewal requirements for brake valves regarding age and cold weather.

Unplanned and uncontrolled movements

This occurrence is one of 589 occurrences^{Footnote 1} reported to the TSB from 2010 to 2019 that were related to unplanned and uncontrolled movements among all railways in Canada. Of these occurrences, loss of control, as in this occurrence, was the causal category in 21 (4%) of them. While uncontrolled movements due to loss of control are low-frequency events, 57% of them (12 out of 21) affected the main track. In these cases, there is an increased potential to encounter the public at crossings and to collide with main-track freight and passenger trains. Consequently, these are considered low-frequency/high-risk events. The TSB remains concerned that the current defences are not sufficient to reduce the number of uncontrolled movements and improve safety.

On 09 January 2018, a Canadian National Railway Company (CN) train crew was called at 1203^{Footnote 2} and came on duty at 1400 in Edson, Alberta. They planned to operate unit^{Footnote 3} coal train C76850-09 westward from Holloway, Alberta, on the Foothills Subdivision to the Mountain Park Subdivision, and hence to the Luscar Mine (at the Cardinal River Operations owned by Teck Resources Limited) at Mile 5.5 on the Luscar Industrial Spur. The Luscar Industrial Spur extends northward for 5.8 miles from Mile 22.4 on the Mountain Park Subdivision (Figure 1).

Train C76850-09, a conventional train,^{Footnote 4} comprised 3 locomotives (CN 2870 in the lead, CN 2888, and IC 2718) and 116 empty aluminum gondola coal cars. The train weighed 3081 tons and was 6380 feet long. The crew consisted of a locomotive engineer (LE) and a conductor. The LE had over 30 years of experience with CN, including 25 years as an LE. The conductor had 7 years of experience and was also a qualified LE.

Before being called for train C76850-09, both crew members had gone off duty at 0800 on 07 January 2018. The crew members met fitness and rest requirements when they reported for duty and were qualified for their positions. They both had extensive operating experience in the territory.

At Edson, the crew took a taxi to Holloway, where they relieved the incoming Jasper, Alberta, crew. At about 1535, train C76850-09 departed Holloway and proceeded to Parkhill Junction (Mile 35.9), where it continued westward on the Mountain Park Subdivision. At about 1830, on arrival at Wingo, Alberta (Mile 20), the crew set out the first 58 cars at the siding.

When the set-out was completed, train C76850-09 proceeded with the remaining 58 empty cars to the main-track switch (Mile 22.4), at the entrance to the Luscar Industrial Spur, where they stopped. The CN bunkhouse, where crews report on and off duty and can take rest, is located at Leyland (Mile 22.5 of the Mountain Park Subdivision). The crew members reported to the supervisor at the bunkhouse, contacted the coal loading facility at Luscar Mine, and started preparing their paperwork for the trip to the mine site.

The train was redesignated as train L76951-10. At about 1915, the train departed northward for the mine, which is at the top of an ascending grade. About 30 minutes later, the train arrived at the Luscar Mine. On arrival, the train speed was reduced to about 7 mph using throttle only. The train was given a pull-by inspection by a mine employee positioned at the coal loading structure (Figure 2).

When the pull-by inspection was completed, the train came to a stop using the independent brake only. The train then made a reverse movement, backing up at slow speed to facilitate spraying the inside of the empty coal cars with latex.^{Footnote 5} Before the train was backed up, the train brakes had been set up using a minimum reduction position on the automatic brake valve.^{Footnote 6} The train brakes were used to assist in controlling the speed and to bring the train to a stop when it was south of the loading chute. Just before the train came to a stop, the train brakes were further applied by reducing brake pipe^{Footnote 7} pressure (BPP) by an additional 8 psi. After the train came to a stop, the train brakes were released and recharged.

At approximately 2005, the train was repositioned forward, placing the 1st empty car under the loading chute. Lead locomotive CN 2870 was set up for slow-speed control.^{Footnote 8} When the mine was ready to begin loading, a signal was given by radio to the LE to begin moving the train forward at a loading speed of 0.17 mph.

When the loading was complete at 0048, the locomotives were configured for the return trip. The crew had planned to set up the train for distributed power^{Footnote 9} (DP) operation. Locomotive CN 2888 was to be the lead locomotive, followed by locomotive CN 2870 and locomotive IC 2718 as the tail-end DP remote locomotive. However, during set-up verification, locomotive IC 2718 was disqualified^{Footnote 10} from remote operation.

Consequently, the train was configured to operate conventionally. As locomotive CN 2888 was facing southward, it was placed in the lead position for the return trip. Locomotives CN 2870 and IC 2718 were marshalled behind. The 3 locomotives were given a shop track air brake test.^{Footnote 11} In addition, the crew tested the sense and braking unit^{Footnote 12} (SBU). The 3 locomotives were then moved southward on the adjacent track and placed on the south end of the train for the return trip down the hill.

The locomotives were coupled to the train, the brake pipe hoses were coupled together, and the angle cocks between the trailing locomotive and the 1st car were opened. BPP at the controlling locomotive was set to 90 psi. Brake pipe continuity was confirmed,^{Footnote 13} with the operator display screen indicating that tail-end BPP was increasing. About 17 minutes after opening the angle cocks between the trailing locomotive and the 1st car, the airflow indicator^{Footnote 14} had stabilized at 33 cubic feet per minute (CFM) and the end-of-train BPP was displayed as 88 psi. The train air brake system was considered fully charged, with a 2 psi true brake pipe gradient.^{Footnote 15} At that time, the crew was ready to take the train back to Holloway.

1.1 The occurrence

On 10 January 2018, at about 0228, conventional freight train L76951-10 left the Luscar Mine, travelling south toward Leyland on the Luscar Industrial Spur (Figure 3). The train comprised 3 locomotives and 58 gondola cars loaded with coal. It weighed 8513 tons and was 3296 feet in length.

Just before departure, at about 0227, with the train standing at Mile 5.14 (Figure 4), the LE applied the train brakes by making a brake pipe reduction of 11 psi using the automatic brake valve handle. When a positive reduction^{Footnote 16} was indicated on the input and display unit (IDU)^{Footnote 17} and the LE was satisfied that the train brakes were set, the independent brakes (i.e., locomotive brakes) were released and the train began to move. The throttle was then placed in notch 1 and another 3 psi brake pipe reduction was made to increase the train brake application.

After the whole train began to move and reached a speed of about 4 mph, the LE placed the throttle back to idle. The LE waited about 33 seconds before placing the dynamic brake^{Footnote 18} (DB) lever to the SET UP position, and then began to increase dynamic braking effort. Once the train had reached a speed of about 7 mph, another brake pipe reduction of 5 psi was made with the automatic brake. When the train speed was at 11 mph, another brake pipe reduction of 3 psi was made. At this point, the total train brake application was 22 psi, about 4 psi less than a full service brake application.

As the train speed reached about 14 mph, the DB lever was moved to position 8, and the automatic brake valve handle was placed into the full service position. Even with the train brakes fully applied and the DB producing maximum retarding effort, the train speed continued to accelerate. The LE observed on the accelerometer that the rate of speed increase was higher than normal, indicating that the braking force was insufficient. By about Mile 4.51, the train speed had reached 20 mph, and the LE moved the automatic brake valve handle to the emergency position.^{Footnote 19} An emergency brake application should result in an increase in brake cylinder pressure of about 20% at each car in the train.

After placing the train into emergency, the crew contacted the rail traffic controller (RTC), located in Edmonton, Alberta, using the emergency call feature of the locomotive radio. The RTC maintained radio communication with the crew during the train’s descent.

The train continued to gain speed as it descended the grade. At about Mile 1.73, the train had attained a speed of 53 mph. The train did not begin to slow down until about Mile 1.48. At about 0239, the train came to a stop, with the head end stopped at about Mile 0.5. The RTC continued to keep an open channel with the crew after the train had come to a stop, advising the crew to take a few minutes to debrief.

Before any attempt was made to recover the train air brakes and recharge the system, the conductor made a walking inspection of the train. During this inspection, it was noted that the brake cylinder pistons were not extended on 27 of the 58 cars, indicating that the brakes were not applied on these cars. Further details on the operation of locomotive and freight car air brakes are contained in Appendix A.

1.2 Recorded information

1.2.1 Sequence of events

Table 1 provides a summary of the events compiled from the locomotive event recorder (LER) of the lead locomotive. Appendix B provides more details on train handling based on the LER information.

Table 1. Summary of events

Time	Mile	Speed (mph)	Event
0227:32	5.14	0	With the reverser placed in the forward position, an 11 psi brake pipe service reduction is made. The brake pipe airflow is 33 CFM before the train brake application and rises to 41 CFM after the train brakes are applied.
0227:43	5.14	0	The independent brake handle is moved to the release position.
0227:52	5.14	0	The head end of the train starts to move forward.
0228:06	5.14	1.0	The tail end (last car) of the train starts moving.
0228:14	5.13	1.0	The throttle is placed in notch 1.
0228:24	5.13	2.0	A 3 psi brake pipe service reduction is made.
0228:51	5.11	4.0	The throttle is placed in idle.
0229:24	5.06	5.0	The DB handle is placed in the SET UP position.
0230:18	4.97	6.0	The DB lever is moved to position 4.
0231:20	4.85	7.0	A 5 psi brake pipe service reduction is made.
0232:06	4.73	11.0	A 3 psi brake pipe service reduction is made.
0232:14	4.71	12.0	The DB lever is moved to position 6.
0232:30	4.65	14.0	The DB lever is moved to position 8.
0232:35	4.64	15.0	The automatic brake valve handle is moved to the full service position.
0232:58	4.51	20.0	An emergency brake application is initiated by the LE.
0237:57	1.73	53.0	The train reaches its maximum speed.
0238:15	1.48	52.0	The train begins to slow down.
0239:58	0.52	0.0	The train comes to a stop on the ascending grade.

During the loading sequence before the uncontrolled movement, there were 4 occasions when the mine load foreman asked the LE to bring the train to a stop. At this location, the track gradient is slightly downhill from Mile 5.5 to Mile 6. In each of these circumstances, the LE applied the train brakes and locomotive independent brakes, bringing the train to a stop.

At 2254, 2 hours and 50 minutes after the train loading had begun, the train brakes were applied for the 1st time. This involved a minimum reduction train brake application and full locomotive independent brakes. At that time, slow-speed control was disengaged and the train came to a stop. Between 2254:03 and 2256:28, a period of 2 minutes and 25 seconds, brake pipe airflow gradually increased from 25 CFM to 62 CFM and end-of-train pressure dropped from 81 psi to 76 psi. Then the train brakes were released. Four minutes later, the train brakes were again applied, using a minimum reduction train brake application with brake pipe airflow at 65 CFM. Full locomotive independent brakes were applied, slow speed was disengaged, and the train came to a stop. With the train brakes applied, brake pipe airflow stabilized at about 60 CFM and remained at that rate until the brakes were released. For 1 hour and 12 minutes after the release of the 2nd air brake application, airflow remained above 53 CFM. Near the end of the loading phase, the train was brought to a stop 2 more times, with similar results concerning the airflow. The LE did not notice the changes in brake pipe airflow during the brake applications while the cars were being loaded, nor did he notice that airflow remained at 53 CFM before the third brake application.

1.3 Weather information

At the time of the occurrence, the ambient temperature^{Footnote 20} was −24 °C. There was a light wind and light snowfall throughout the night. As it was dark and overcast, visibility was limited.

On 09 January 2018, the day before the occurrence, the temperature in the region began to steadily decrease, starting at about 0300 (Figure 5). The ambient temperature at the beginning of the day was between −4 °C and −6 °C. At 0228 on 10 January 2018, the temperature had dropped to −24 °C. The ambient temperature at the time of key events is depicted in Figure 5.

1.3.1 Canadian National Railway Company’s winter operating plan

Recognizing the challenges of operating trains in cold-weather conditions, CN has developed a winter operating plan to mitigate associated risks. These cold-weather challenges include snow removal, operation of dual-control switches, increased brake pipe leakage on trains, deadheading crews (transferring them to and from their work locations) safely, as well as the effects of cold temperatures on steel rails and wheels and high-impact^{Footnote 21} rail cars.

CN’s winter operating plan is reviewed and updated before each winter season to incorporate lessons learned from previous seasons. This plan includes contingencies for cold-weather track inspection, a policy for cold-weather slow orders, and a policy for moving trains through centralized traffic control (CTC) system territory where a block is down. Some of the elements in the plan are triggered by threshold levels of snow accumulation and/or threshold temperatures, namely −25 °C and −30 °C. During the winter of 2017–2018, CN had a winter operating plan in place.

The winter operating plan includes guidelines for train length in winter temperatures. Because of the increased leakage from brake pipes during operations in extreme cold weather, these guidelines aim to limit the overall length of the brake pipe. The winter operating plan takes into account the use of DP locomotives or mid-train air cars when determining maximum train lengths.

Under the operating plan, a reduction of train length is triggered if the predicted temperature at the departing terminal, or while en route, is −25 °C or below. These measures help prevent online delays when recharging the air brake system after the brake pipe is reconnected. The winter operating plan does not require any modification to air brake testing procedures at colder temperatures.

1.4 Subdivision information

1.4.1 Foothills Subdivision

The CN Foothills Subdivision connects to the Edson Subdivision at Bickerdike, Alberta (Mile 139.9 of the Edson Subdivision). The timetable direction of the Foothills Subdivision is east–west. The single main track of the Foothills Subdivision begins at Bickerdike, Mile 0.0, and ends at Coal Valley, Alberta, Mile 45.8. The track extends to Mile 50.86.

Train movements on the Foothills Subdivision are controlled by the CTC between Mile 0.0 and Mile 35.9, and by the occupancy control system (OCS) between Mile 35.9 and Mile 45.8. Train movements under both CTC and OCS methods of control are authorized by the Canadian Rail Operating Rules (CROR), and supervised by an RTC located in Edmonton.

West of Mile 45.8, where the main track ends, the track is designated as subdivision track. Subdivision track is defined in the CROR as follows:

A Non-Main Track so indicated in the time table method of control column that is an extension of the main track, and the through track at that location, defined with subdivision mile posts.^{Footnote 22}

Train operations on non-main track are governed by Rule 105 of the CROR, which states the following:

105. Operation on Non-Main Track

Special instructions will indicate when this rule is not applicable on a specific track.

Unless otherwise provided by signal indication, a movement using non-main track must operate at REDUCED speed and be prepared to stop short of the end of track or the red signal prescribed by Rule 41.

1. In CTC, movements may only enter a siding by signal indication or with permission from the RTC.
2. Unless otherwise provided by signal indication or special instructions, movements operating on non-main tracks must not exceed fifteen (15) MPH.
3. In addition to moving at REDUCED speed, a movement using a non-signalled siding or using other non-main tracks so designated in special instructions, must operate at a speed that will allow it to stop within one-half the range of vision of a track unit.^{Footnote 23}

1.4.2 Mountain Park Subdivision

The CN Mountain Park Subdivision begins at Parkhill Junction (Mile 35.9 on the Foothills Subdivision). The timetable direction is east–west. The Mountain Park Subdivision consists of a single main track from Mile 0.0 (Parkhill Junction) to Mile 20.0 and a designated subdivision track from Mile 20.0 to Mile 26.0 (end of track).

Train movements on the Mountain Park Subdivision are controlled by the OCS method of train control between Mile 0.0 and Mile 20.0, as authorized by the CROR, and supervised by an RTC located in Edmonton.

1.4.3 Luscar Industrial Spur

The Luscar Industrial Spur extends northward for 5.8 miles, starting at Mile 22.4 on the Mountain Park Subdivision. The timetable direction is north–south. Between Mile 1.0 and Mile 4.5, train movements are governed by the OCS method of train control and supervised by an RTC located in Edmonton. The track between Mile 0.0 and Mile 1.0 and between Mile 4.5 and Mile 5.8 is designated as non-main track under CROR Rule 105 – Operation on non-main track.

1.5 Locomotive consist information

The locomotive consist^{Footnote 24} was made up of 3 locomotives: CN 2888, CN 2870, and IC 2718. The locomotives were set up for multiple-unit operation, with CN 2888 as the controlling lead locomotive. At the time of the occurrence, the 3 locomotives were running and online (producing tractive effort).

These 4400-hp locomotives, manufactured by GE Transportation (GE), are classed as road freight diesel-electric locomotives. Each locomotive has 6 axles driven by traction motors. Other operating or physical characteristics of these locomotives include the following:

• CN 2888 and CN 2870 are both GE locomotive model ES44AC, and both built in 2014. They are equipped with GE Evolution 12-cylinder diesel engines, type GEV012, with alternating current (AC) traction motors. These locomotives weigh approximately 420 000 pounds each.
• IC 2718 is a GE locomotive model C44-9W, built in 2004. It is equipped with a 16-cylinder diesel engine, type 7FDL16, with direct current (DC) traction motors. This locomotive weighs approximately 390 000 pounds.
• The DB on all 3 locomotives is type F – Extended Range Flat. On the occurrence train, the trailing locomotive (IC 2718) had the DB feature disabled to comply with CN operating instructions.^{Footnote 25} This was done by cutting out the No. 1 traction motor.
• CN 2888 and CN 2870 are equipped with the DB holding feature, which retains dynamic braking during an emergency or penalty brake application. The LER data for these 2 locomotives verified that this feature was working as designed at the time of the occurrence.
• CN 2888 is equipped with an electronic air brake (EAB) system using a computer-controlled brake valve and associated components manufactured by New York Air Brake (NYAB). EAB systems are microprocessor-based braking systems that are integrated into onboard electrical and mechanical devices. The EAB operates in a fashion similar to the traditional 26-L pneumatic train air brake system with the same functions.

1.6 Locomotive inspection reports

1.6.1 Post-occurrence inspection

Following the occurrence, CN conducted on-site inspection and testing of air brakes, communications systems, and safety control devices. Each of the locomotives in the consist passed the locomotive safety inspection. CN form Schedule B^{Footnote 26} was issued by a certified locomotive inspector^{Footnote 27} and signed by a mechanical supervisor.

The following observations were noted in the work order report:

• Piston travels were good.
• Operation of all 3 hand brakes was in good order.
• The locomotive safety inspection was noted as “ok.”.
• Schedule B was completed.
• Wheel size 40.125, computer 4.2.
• Self-test for air brakes in the lead unit was successfully completed.
• DB was checked in CN 2888 (lead) and CN 2870 (middle). It was impossible to verify the DB in locomotive IC 2718 because the No. 1 motor was cut out.

1.6.2 Locomotive inspection and repair history

The inspection and repair history was obtained for the 3 locomotives. All 3 locomotives had received the required yearly (368-day) and semi-yearly (184-day) electrical and mechanical inspections.^{Footnote 28} The locomotives had also received regular maintenance and repair as needed.

1.7 History of the leased train cars

CN had leased the coal cars from CIT Group Inc. These cars were built by FreightCar America Inc. in 2006. The 116 cars were open-top aluminum gondola cars with high sides and ends and a depressed bottom for unloading in dumping machines (Figure 6). The control valves for these cars, manufactured by NYAB, were model DB-60^{Footnote 29} and were built in 2006, making them about 11 years old at the time of the occurrence. In addition, some of the emergency portions on the cars ^{Footnote 30}had been manufactured by Wabtec Freight Car Pneumatics (Wabtec).

The leased cars had been in storage in Mobile, Alabama, U.S., for 22 to 34 months. On 30 November 2017, the cars were taken out of storage and sent to Memphis, Tennessee. Before departing Mobile, a No. 1 air brake test was performed. On 02 December 2017, another No. 1 air brake test and a certified car inspection were performed in Memphis. From Memphis, the leased cars were sent to Symington Yard in Winnipeg, arriving on 05 December 2017.

From Symington Yard, the leased cars were sent westward to begin coal service in western Canada. The cars were first loaded with coal in Coal Valley, Alberta, on 08 December 2017, and then unloaded at Ridley Terminals Inc. in Prince Rupert, British Columbia, on 12 December 2017.

From 14 December 2017 to 06 January 2018, the leased cars were included in a train that made 3 trips between Ridley Terminals and Tumbler, British Columbia. The average turnaround time for each trip was 5 days from when the empty train departed Ridley Terminals and returned loaded from Tumbler. On the 2nd trip to Tumbler, the train experienced problems with the air brake system on some of the cars.

1.7.1 Malfunction of the air brakes at Tumbler

On 21 December 2017, at about 2000, after arriving in Tumbler (Mile 61.6 of the CN Tumbler Subdivision), the empty leased cars were secured in 2 yard tracks. While securing the cars, the crew noted that the brakes on some of the cars had not responded to a crew-initiated emergency brake application.^{Footnote 31} After the crew notified a supervisor, an engine service officer (ESO) was contacted. The temperature at the time was −25 °C.

The ESO tried to troubleshoot the problem with the LE over the radio. However, because the problem could not be resolved, 2 ESOs from Prince George arrived at Tumbler the next day (22 December 2017). Working with 2 certified car inspectors and the train crew, the ESOs were still unable to determine the cause of the problem.

After being loaded on 23 December 2017, the leased cars were taken back to Prince George for further examination. Because the problem was believed to be with the control valves, the emergency portion on each car was replaced. The leased cars were then retested; the brakes (emergency and service) were confirmed to be functioning as intended, and the cars were sent back to Ridley Terminals. However, the cars were not single-car tested before being put back in service, as required by Rule 3 of the Association of American Railroads (AAR) Interchange Rules.^{Footnote 32} CN did not want to further delay the unloading of these cars because of concerns that the cars would become more difficult to unload the longer the product remained in them in sub-zero temperatures. Additionally, as CN had not planned to invoice the owner of the leased cars at the time, the single-car tests were delayed.

The cars were used for another round trip to Tumbler before being sent to Luscar. During the round trip to Tumbler, the train air brakes had functioned as intended.

1.8 Regulatory requirements and company instructions for brake tests

Transport Canada–approved Railway Freight and Passenger Train Brake Inspection and Safety Rules set the requirement for a No. 1 brake test as follows:

11.NO. 1 BRAKE TEST

11.1A No.1 brake test shall be performed by a certified car inspector(s) at safety inspection locations on:

1. trains that are made up at that location;
2. cars added to a train at that location;
3. cars that are interchanged.
4. If a train is made up at other than a safety inspection location, a No. 1 brake test will be performed at the safety inspection location designated for that train by the railway company in the direction of travel.

11.2Exceptions: A No.1 brake test is not required on:

1. trains operating over main tracks, between yards, up to a maximum of a thirty (30) mile (fifty (50) kilometre) radius. Such trains shall be engaged exclusively in the setting off or lifting of equipment at industry(s), and/or the transfer of equipment between yards, and they shall be filed with the Department.
2. a block swap of cars that have been off air for no more than 24 hours or 48 hours after notifying the department.

11.3A No.1 brake test shall verify:

1. the integrity and continuity of the brake pipe;
2. that the condition of the brake rigging on each car in the train meets the minimum requirement specified in Sections 20, 21 and 22 of these Rules;
3. that the application and release of the brakes on each car is performed by visible verification of the piston or brake indicator device displacement; and
4. that piston travel on each car is within the specified limits.

11.4A pull-by inspection by a certified car inspector may be performed to verify the release of the train brakes.

11.5Certified car inspectors shall report, in accordance with company procedures/work instructions, the results of all brake tests performed. Any brake system defect(s) discovered during the brake test and not repaired prior to departure shall be documented as bad order and reported to the conductor, or in his or her absence, the locomotive engineer. The conductor/engineer shall update the train brake status system with the identified defect(s). The results of the tests performed by certified car inspectors shall be retained for ninety-two (92) days.

11.6After completing a No.1 brake test, a train may depart from a safety inspection location with ninety-five (95) percent of the train brakes operative, once every reasonable effort has been made to maintain one hundred (100) percent operative brakes. This requirement does not apply to cars referred to in Subsection 8.4 of these Rules.

11.7A No. 1 brake test is not required at an interchange point and/or when entering Canada provided the locomotive engineer has access to records that indicate that a No.1 brake test, as per these Rules, or an initial terminal brake test by mechanical personnel in the United States, was performed.^{Footnote 33}

In accordance with these rules and CN’s General Operating Instructions, the No. 1 brake tests are conducted by certified car inspectors at locations where trains are made up or at specified locations for trains in service. The inspectors conducting these tests must verify the brake pipe integrity and continuity, as well as the brake rigging condition on each car, to ensure that the brakes meet the minimum requirements. To conduct this test, the brakes are applied and the brake cylinder pistons are visually verified to ensure that the brakes have applied on each car and that the brake cylinder piston travel is within specification. After releasing the brakes, the brake cylinder pistons are again visually verified on each car to ensure that the brakes have released.

Empty unit trains in coal service between Ridley Terminals and Luscar receive a No. 1 brake test before departing Prince George. When leaving Prince George, at least 95% of the cars must have operative brakes. On 09 January 2018, CN-certified car inspectors conducted a No. 1 brake test on train C76850-09. At Luscar, a brake pipe continuity test and an SBU test were performed after the train was loaded and ready to depart. As Luscar was not a safety inspection location for the occurrence train, there was no requirement for the crew to perform a No. 1A brake test.^{Footnote 34}

Table 2 provides a summary of the No. 1 brake tests performed on the leased cars.

Table 2. No. 1 brake tests performed on the leased cars

Date	Time	Location	Inspection type
2017-11-30	1831	Mobile, Alabama	No. 1 air brake inspection
2017-12-02	0330	Memphis, Tennessee	No. 1 air brake inspection
2017-12-15	1845	Prince George, British Columbia	No. 1 air brake inspection
2017-12-21	1753	Prince George, British Columbia	No. 1 air brake inspection
2017-12-24	1542	Prince George, British Columbia	No. 1 air brake inspection
2017-12-28	1153	Prince George, British Columbia	No. 1 air brake inspection
2018-01-03	1602	Ridley Terminals, British Columbia	No. 1 air brake inspection
2018-01-09	0610	Prince George, British Columbia	No. 1 air brake inspection

1.9 Single-car air brake test

A single-car air brake test verifies the effectiveness of car brakes and ensures, among other things, that the brakes remain applied and have no leaks. This test is performed on a repair track or in a shop by a certified car inspector. The device used to conduct this test is equipped with a special control valve and flowmeter to verify the essential braking functions. During the test, pressure loss is measured in the brake cylinders for 4 minutes following a reduction of 10 psi in the brake pipe. The allowable pressure loss is 1 psi (or less).

According to the Field Manual of the AAR Interchange Rules, a single-car test is required:

when a car is on a repair track or in a shop and has not received a single car test for more than a year; or

when a car has been in service without having had a single car test for a period of 5 years.^{Footnote 35}

No single-car air brake tests were performed on any of the leased cars when they were brought out of storage in Mobile or at any time before or after they were delivered to CN.

With respect to a car returning to service after having been in storage, there are no specific requirements to conduct a single-car air brake test, provided that the time in storage does not result in the car being in non-compliance with other existing requirements.

No single-car air brake tests were conducted on the leased cars after the air brake malfunctions at Tumbler on 21 December 2017, or after the emergency portions of the control valves were replaced shortly afterward in Prince George.

1.10 Air brake system leakage

The air brake system contains many connections, seals, and gaskets that are prone to air leaks, particularly in extreme cold weather (below −25 °C). Many of the seals and gaskets in the air brake system are made of rubber. The effects of cold-weather conditions on rubber can vary, depending on the composition of the rubber. However, cold-weather conditions are generally known to decrease rebound resilience, making the rubber stiffer and less effective at preventing fugitive airflow.

For conventional trains, during cold-weather operations, the tail-end BPP is usually lower than the BPP at the lead locomotive(s). The pressure differential between the front end and the tail end of the train (the brake pipe gradient) is the observed difference between these 2 values. As specified in the Transport Canada–approved Railway Freight and Passenger Train Brake Inspection and Safety Rules, the maximum brake pipe gradient when operating a conventional train is 15 psi.

Following a service brake or emergency brake application, air from the auxiliary reservoir and the emergency reservoir at each car enters the brake cylinder through the control valve. When the desired braking force has been reached, the control valve automatically goes into the lap (neutral) position, which isolates the brake cylinder and related piping from the rest of the train braking system. If air leaks from the brake cylinder, the pressure applied by the brake cylinder piston is reduced. As a result, the brakes are gradually released until there is no more air in the brake cylinder and the brakes are completely released.

Air leaks can also be affected by contamination of the brake cylinder components and by degradation of the grease lubricating the system. These leaks are also accentuated in cold weather, when metal contracts.

Minor air leaks that do not affect BPP cannot be easily detected by the LE. Significant air leaks are indicated to the LE through an increased brake pipe gradient and increased airflow from the locomotives.

1.11 Previous occurrence that resulted in an Association of American Railroads circular letter

On 25 October 2013, the AAR issued Circular Letter C-12027 concerning cold-temperature malfunctions during service brake applications (Appendix C). At that time, testing had determined that worn rubber seals (O-rings) from the bottom cover exhaust port of the DB-10 service portions (Figure 7) could shrink during extreme cold temperatures. This shrinkage of rubber seals could then result in auxiliary reservoir leakage and lead to a localized, unintended release of a car’s service brake application.

The location of rubber seals in the DB-10 service portion is shown in Figure 8.

On 09 September 2013, NYAB issued General Letter GL-490, “Cold Temperature DB-10 Auxiliary Reservoir Leakage”, which was attached to AAR Circular C-12027 (Appendix C). This letter defined the condition identified as follows:

DB 10 valve portions subject to high vibration in high mileage service may develop low temperature leakage some point in time above thirteen years of age.

With regard to single-car tests in cold weather, the NYAB General Letter stated:

Single Car Tests conducted at temperatures above 40°F will not identify valves that need to be removed from service due to this condition.

1.12 Testing of control valves in occurrence cars

Following the occurrence, various brake valve components were removed from the leased cars and sent to the manufacturer (NYAB) for detailed examination. Some of the conclusions and relevant observations from this examination are summarized in Appendix D. The testing, completed in conjunction with the TSB Engineering Laboratory, consisted of the following:

• 5 emergency portions from cars involved in the 21 December 2017 occurrence
• 5 service portions from cars involved in this occurrence on 10 January 2018^{Footnote 36}

Under controlled-temperature conditions, the testing was able to duplicate the failure mechanism experienced in this occurrence.

The NYAB tests determined that the unintentional release of freight car brakes in this occurrence was likely the result of the same type of failure and leakage of the DB-10 service portions that was the subject of the AAR Circular in 2013 (i.e., shrinkage of worn rubber seals from the bottom cover exhaust port during extreme cold temperatures).

For the DB-20 emergency portions (Figure 9), the NYAB tests established that the failure mechanism was not the same as that for the service portions. Instead, the failure of the emergency portions was related to deformed K-rings inside the vent valve, which resulted in excessive leakage during extreme cold temperatures and thus resulted in the failure to propagate the emergency brake application command. The setting and deformation of the K-ring rubber had likely occurred when the leased cars were in storage for an extended period before being delivered to CN. Because of these permanent deformations, the intended performance of the K-rings, particularly during cold temperatures, was negatively affected.

Four emergency valve portions from the leased cars that had been manufactured by Wabtec were sent back to the company for detailed examination (Appendix E). The test results of the Wabtec valve portions from the train indicated that they functioned as intended. The data also indicated that these emergency portions did not contribute to the significant increase in applied airflow that had been experienced in this occurrence.

1.13 Cold-wheel detection

CN has 5 cold-wheel detectors on its network. Two of the cold-wheel detectors are on the Robson Subdivision. Westbound trains departing Jasper typically travel over one of these detectors before diverging north onto the McBride Subdivision.

Cold-wheel detectors read the temperature of the wheels of passing trains and are set up at locations where train brakes are normally applied. These detectors capture significant departures from normal temperatures on the wheels of a given train.

In this occurrence, wheel temperature information for the train had been captured by the cold-wheel detector on the Robson Subdivision. However, there was no significant departure from normal temperatures. As a result, this train was not identified as having poor braking characteristics.

CN has also created a thorough work scope document for the inspection of cars that have been identified with cold wheels. This work scope is considered a “living document,” which is adjusted as innovations are discovered. It stipulates that CN-owned equipment must have the car control valves replaced before any testing of cars on which all wheels are cold. All other cars must undergo thorough testing and any defective components must be repaired or replaced.

1.14 TSB train dynamic analysis

The TSB completed a train dynamic analysis ^{Footnote 37} using Train Energy and Dynamics Simulator (TEDS) software for the occurrence train.

It was determined that the malfunction of the air brake system on the 27 cars and the reduced effective brake ratio of the 31 functioning cars provided insufficient braking force to hold the occurrence train on the steep grades.

In addition, the effective brake ratio of the 31 functioning cars was approximately 7%, on average.

1.15 Locomotive engineer training relating to airflow

CN’s LE training course covers the use of airflow indicators and the pressure-maintaining feature of the automatic brake valve. ^{Footnote 38} Specific topics included in this training are:

• Airflow summary – automatic brake system
• Pressure-maintaining feature
• Measuring airflow into the brake pipe
• Brake pipe flow meter
• Airflow meter indicator
• Airflow indicators on operator display screens
• Airflow meter operation
• Airflow meter indicating an unintentional release
• Cautions relative to the freight car air brake system

CN’s Locomotive Engineer Operating Manual states the following:

The flowmeter will also warn locomotive engineers of an unintentional release of the brakes when using a pressure maintaining type automatic brake valve. A sudden increase in the flowmeter’s reading, followed by a return to normal, indicates a heavy demand for air by the train, and usually indicates a release of the brakes. To verify end-of-train pressure and train integrity, you can also consult the IDU display on the control stand. For further information on the TIBS [train information braking system] and unintentional releases, refer to “Section G: Train Handling”.^{Footnote 39}

CN’s train operating instructions are not designed to diagnose the mechanical failure of multiple car control valves on a train. Further, references to brake pipe airflow being an indicator of unintentional release are specific to situations in which cycle braking^{Footnote 40} has taken place and there is a false gradient in the brake pipe.

1.15.1 Operator display screens in the locomotive cab

For locomotives equipped with a multi-function operator display screen, control feedback is provided through a “smart display” (Figure 10). In this occurrence, the lead locomotive was equipped with such a screen.
The LE can use the smart display to monitor speed and braking inputs, as well as other operating parameters, including:

• Distance
• Tractive effort
• Reverser and throttle position
• End-of-train information
• Lead locomotive status
• Fuel level
• Distributed power information
• Trip Optimizer information

When train brakes and/or locomotive brakes are activated, the status of various items is displayed on the screen, including equalizing reservoir pressure, BPP, end-of-train status, and brake cylinder pressure. These items can be monitored by the LE and used to calculate the brake pipe gradient.

When using the DB, the LE can monitor the status of the following inputs on the display screen: tractive dynamic braking effort (Effort Klb) and throttle/DB handle status (Throttle). In addition, the LE can monitor speed and acceleration.

1.15.2 Monitoring airflow

When using the automatic brake system, the LE can also monitor brake pipe airflow (red circle in Figure 10).

The airflow is the measured rate of air that is flowing from the locomotive to the brake pipe. This information indicates to the LE

• the rate at which the air brake system is being charged or recharged;
• if there is a heavy demand for air in the brake pipe (e.g., when a hose has separated or ruptured); and
• if air is flowing into the brake pipe when the pressure-maintaining feature of the automatic brake valve compensates for normal leakage.

When the brakes are applied and the airflow indicator shows increased airflow (as was the case in this occurrence), one of the following events could be occurring:

• the brakes on the train are releasing (unintentionally);
• a brake pipe coupling hose has come apart somewhere in the train;
• there is a brake pipe or hose rupture somewhere in the train; or
• there are other sources of air leakage.

If unexpected airflow is detected while the brakes are applied, railway procedures^{Footnote 41} require that increased braking effort be applied to stop the train, using emergency braking if required. The operator display screens do not have any alarms linked to applied brake pipe airflow; i.e., when airflow increases subsequent to a brake application.

1.16 Use of automatic slow-speed control feature during loading operations

At CN, the GE ES44AC locomotives are equipped with an automatic slow-speed control feature. Using this feature, the LE can automatically control speed during the loading or unloading of cars, which must be performed at a slow speed. The LE operates the slow-speed control feature using screen commands and soft keys.^{Footnote 42}

When the slow-speed control feature is active, the on-board computer maintains a steady speed that is not achievable with manual operation. Once the feature is engaged, the LE only needs to monitor the system. However, a reset safety control (RSC) feature^{Footnote 43} remains active when this feature is being used.

1.17 Human factors research on the automation of train operating tasks

A human factors analysis for another in-cab automated system, the European Rail Traffic Management System (ERTMS), determined that automating a significant part of the train driver’s task resulted in fewer psychomotor tasks and fewer visual tasks as information is combined on the in-cab display. Over a typical trip, the train driver could have up to 1000 fewer cognitive tasks to consider.^{Footnote 44} Implementation of this type of system resulted in a shift from a proactive, anticipatory driving strategy toward a more reactive monitoring strategy.^{Footnote 45} Such a shift was shown to produce low-workload situations^{Footnote 46} that could have the following effects:

• Low-workload and monotonous tasks can lead to increases in feelings of sleepiness and tiredness, as they reduce the individual’s arousal levels.^{Footnote 47} In particular, long periods with minimal control inputs can lead to passive fatigue.^{Footnote 48} If an individual is already fatigued, low workload with minimal inputs could exacerbate the perception of that fatigue.
• Reductions in workload and arousal levels may lead to corresponding reductions in vigilance. Vigilance is associated with states of sufficient alertness to monitor the environment effectively, with a particular emphasis on scanning for potentially dangerous stimuli.^{Footnote 49} A study of the effects of automation on LEs found that vigilance was poorer with high levels of automation, and that this effect worsened with time on task.^{Footnote 50}
• Decreased vigilance has been shown to reduce the overall detection rate of critical stimuli over the duration of a task.^{Footnote 51} The same has been seen for in-car automation technologies such as cruise control. Car drivers perform better on secondary tasks when primary tasks are automated but are generally slower to detect hazards.^{Footnote 52}

Based on this research, the Rail Safety and Standards Board in the United Kingdom advised that, with the introduction of new technologies, driver training needs to be updated to reflect changes to non-technical skills. This additional training could include skills such as attention to detail, overall awareness, maintenance of concentration, and anticipation of risk.^{Footnote 53}

In another human factors study, the U.S. Department of Transportation^{Footnote 54} compared the different levels of automation in train operations (cruise control to full autopilot). It determined that, for normal operations, full automation facilitated situational awareness of the overall driving task, as the automation freed up attentional resources to perform secondary tasks and to monitor faults. However, some operators reported that they felt “out of the loop” with the primary task. This highlighted that there could be problems maintaining awareness when there were complex faults on the primary task, especially in the presence of any complacency or fatigue.

1.18 Other human factor issues relating to operator performance

1.18.1 Situational awareness

Situational awareness can be divided into 3 levels: the perception of elements in the environment, the comprehension of their meaning, and the projection of their status.^{Footnote 55} To have accurate situational awareness, LEs need to perceive the relevant features and information in their environment, understand what the features and information mean, and accurately predict what that information means for their journey’s progress.

Several factors may affect the probability that LEs can accurately perceive the relevant features and information of their environment. This may include missing presented information as a result of reduced vigilance, perceiving only some of the elements when there is too much information to manage, and/or selectively perceiving only certain information as a result of cognitive or perceptual biases.

If the first stage of situational awareness—perceiving the critical elements of the environment—is not achieved, operators may not be able to fully understand the context of any scenario hazard, which affects their ability to manage that hazard in a timely manner.

1.18.2 Workload and information processing

When tasks have been automated and the operator’s system interaction has shifted to a monitoring role, such as when an LE uses slow-speed control, this may produce low-workload situations.^{Footnote 56} Such low-workload situations may lead to increases in feelings of sleepiness and tiredness, as they reduce the individual’s arousal levels.^{Footnote 57} They may also result in reduced vigilance,^{Footnote 58} which has been shown to impair detection of critical task stimuli.^{Footnote 59} The degree of these effects depends on factors such as task repetition, familiarity and predictability, task duration, and the absence of response requirements. ^{Footnote 60} The introduction of the RSC feature is a mitigation for such low-workload tasks, as it ensures that the LE is maintaining vigilance and making control inputs periodically.

Conversely, in hazardous scenarios in which time is limited and/or the pressure to resolve the hazard is high, the associated workload may impair an operator’s ability to sufficiently manage all presented information in several ways. First, the operator may intentionally prioritize the pieces of task information. Indeed, one indicator of increased workload under time constraints is shedding of “secondary” tasks.^{Footnote 61} Second, in very high-workload scenarios, the workload may lead to unintentional narrowing of attention.^{Footnote 62} Both scenarios limit the operator’s ability to perceive all relevant critical elements of the environment, thus impairing overall situational awareness.

1.18.3 Attention and information displays

To improve situational awareness and mitigate any potential information-processing deficiencies as a result of low workload, high workload, and/or perceptual biases, the information presented to an operator needs to be appropriately relevant and conspicuous. In locomotives, in particular, the LE is required to periodically monitor the airflow box (Flow) on the smart display, as this information could provide important feedback on braking effectiveness.

“Sensory conspicuity” refers to the ability of an object to capture the attention of an observer who does not necessarily expect it to be present or is looking the other way. ^{Footnote 63} Characteristics of warnings, objects, or conditions that are likely to attract an operator’s attention include areas or objects that differ greatly from their backgrounds in terms of brightness, colour, and texture; flickering or flashing stimuli; objects of large size; and objects that are moving.^{Footnote 64} Red flashing lights and an audible warning are typical characteristics of warnings that are designed to attract attention. The AAR Manual of Standards and Recommended Practices stipulates that, in terms of design philosophy, the urgency of rail information conveyed by an alarm shall be indicated by the background colour (that is, alarms with red backgrounds are most urgent, alarms with yellow backgrounds are less urgent, and alarms with white backgrounds are the least urgent).^{Footnote 65}

Older, more traditional airflow meters had a design philosophy in line with these recommended practices. They were associated with amber warning lights and auditory feedback from the 26L automatic brake valve, which indicated to the LE when the airflow was increasing above normal parameters. With more modern locomotives, information is presented on the smart display, where the airflow indicator is not associated with any alarms, alerts, or colour coding. EAB systems are silent inside the operating cab.

“Cognitive conspicuity” concerns the importance and relevancy of information to an operator’s context, ^{Footnote 66} such as airflow information when braking. To ensure that the most important visual cues for a specific scenario are detected by the operator, the cues need to be easily discriminated as the most relevant and not masked or weakened by other more noticeable cues.

The “Flow” box on the smart display of the occurrence locomotive remained a small white number that did not flash, change colour or prominence, regardless of the circumstances or the flow rate that was displayed.

1.18.4 Closed-loop control systems

In a closed-loop control system within the locomotive cab, the LE operates as a component of a system that includes a circular “perception-decision-actuation paradigm;” that is, the LE “perceives the state of the vehicle and environment, decides on a course of action, and takes action through the available vehicle controls (actuators).”^{Footnote 67} The LE then immediately perceives the result of that action and makes further decisions and actions as required. With traditional manual closed-loop control systems,^{Footnote 68} the operator gathers data by observing and interpreting vehicle and system state information through both visual and aural information channels. The operator then uses these data, in conjunction with operating rules and regulations, to make control command decisions and carry out physical actions (throttle and brake control). With the traditional 26L pneumatic train air brake system, the LE would hear the airflow as the brake handle was moved, i.e., applied and released. Such a closed-loop system would provide audible feedback that would help an LE identify unusual brake pressure activity; however, the audible feedback provided by the 26L brake valve is known to negatively affect speech intelligibility inside the locomotive cab and contribute to crew member hearing loss and fatigue.

With more modern automated braking systems, the data gathering and/or control command tasks can be automated. If data gathering is automated, the LE receives information presented on a display, which has been automatically generated and presented accordingly. If control command is also automated, this may involve supervisory control systems, such as slow-speed control, that take over control of some or all of the physical adjustments of the locomotive. Even when manual control is maintained, the modern system produces more computer-generated braking control, eliminating the raw tactile feedback that LEs used to get when they moved the handle.

The modern automatic air brake system and its automatic brake valve handle are microprocessor-based braking systems integrated into onboard electrical and mechanical devices. Although they operate in a similar fashion to the traditional pneumatic systems, the LE does not hear or feel any air pressure when using the brakes. Instead, for speed/braking feedback, the LE relies on automated data gathering presented via multiple parts of the smart display, along with the outside environmental cues.

1.19 Work-rest history of train crew

In this occurrence, the LE had been on vacation for 3 weeks before returning to work on 06 January 2018, when he worked from 1700 to 0100 (8 hours). The LE then had 2 days off and returned to work, for the occurrence shift, on 09 January 2018 at 1400, having been called out at 1203.

In the weeks preceding the occurrence, the LE’s work-rest schedule meant that he had regular opportunities for sleep, allowing him to maintain a normal (nighttime) sleeping pattern from approximately 2200 to 0700. The LE also regularly napped in the afternoon for approximately 1 to 2 hours. In the days preceding the occurrence, this sleeping pattern had been maintained, except for a late sleep onset time 3 days before the occurrence, when the LE finished work at 0100. At the time of the occurrence (i.e., at approximately 0230), the LE had been on duty for 12.5 hours and had been awake for approximately 18 hours. The LE had missed his regular afternoon nap that day. The occurrence happened at a time when the LE would normally be asleep.

The conductor had worked on 03 January 2018 from 1900 to 0300 (8 hours), on 04 January 2018 from 1900 to 0615 (11.25 hours), and on 06 January 2018 from 1700 to 0100 (8 hours). He was off duty on 07 and 08 January 2018 and returned to work on 09 January 2018 at 1400 for the occurrence shift.

In the week preceding the occurrence, the conductor had worked 3 night shifts, finishing at 0300, 0615, and 0100, which meant that the conductor had irregular sleep onset times.

ACTIONS REQUIRED Fatigue management in rail transportation will remain on the Watchlist until TC takes the following actions: TC develops a policy framework for the management of fatigue based on its review of fatigue management systems, fatigue science, and best practices. TC works with industry and employee representatives and fatigue science specialists to develop a comprehensive approach to fatigue management in the rail sector. TC completes amendments to the Work/Rest Rules for Railway Operating Employees (2011), based on fatigue science.

The schedule for both crew members met the limits prescribed by the Work/Rest Rules for Railway Operating Employees.^{Footnote 69}

1.20 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer.

Fatigue management in rail, marine and air transportation is a Watchlist 2018 issue. During this occurrence, the locomotive engineer was likely affected to some extent by fatigue during the loading process at the mine site.

1.21 TSB occurrence statistics involving unplanned/uncontrolled movements

From 2010 to 2019, there were 589 occurrences^{Footnote 70} reported to the TSB related to unplanned and uncontrolled movements among all railways in Canada (Table 3).

Table 3. TSB occurrences involving unplanned and uncontrolled movements between 2010 and 2019

Reason for unplanned or uncontrolled movement	2010	2011	2012	2013	2014	2015	2016	2017	2018	2019	Total
Loss of control	2	3	0	3	0	1	4	2	5	1	21
Switching without air	10	16	12	24	21	22	18	21	27	31	202
Securement	25	32	44	42	38	37	29	39	34	46	366
Total	37	51	56	69	59	60	51	62	66	78	589

The TSB classifies uncontrolled movements into 1 of the following 3 causal categories:

1. Loss of control: When a LE or a remote control locomotive system (RCLS) operator cannot control a locomotive, a car, a cut of cars, or a train with available locomotive and/or train air brake systems.
2. Switching without air: When a movement is switching with the use of the locomotive independent brakes only with no air brakes available on the cars being switched or kicked. The vast majority of these incidents occur in yards.
3. Securement: When a car, a cut of cars, or a train is left unattended and begins to roll away uncontrolled, usually because
   • an insufficient number of hand brakes have been applied to a car, a cut of cars or a train; and/or
   • a car (or cars) has faulty or ineffective hand brakes.

Table 4 provides a breakdown of uncontrolled movements that result from loss of control by consequence.

Table 4. Consequences of uncontrolled movements resulting from loss of control only

Consequence*	2010	2011	2012	2013	2014	2015	2016	2017	2018	2019	Total
Derailment of 1 to 5 cars	0	1	0	1	0	0	1	1	2	0	6
Derailment of more than 5 cars	0	0	0	0	0	0	1	0	0	0	1
Collision	2	1	0	1	0	0	2	0	0	0	6
Affected the main track**	1	2	0	2	0	1	2	1	3	0	12
Involved dangerous goods	0	1	0	0	0	0	0	0	0	0	1
Injuries or fatalities	0	0	0	1	0	0	1	0	0	0	2

* Some occurrences may have more than one consequence.
** Originated on the main track, moved onto the main track, or fouled the main track.

Over the 10 years from 2010 to 2019, loss of control, as in this occurrence, was the causal category in 4% (21 of 589) of the occurrences. However, 57% (12 of 21) of the occurrences that involved loss of control affected the main track.

Since 1994, including this occurrence, the TSB has investigated 36 occurrences that involved uncontrolled movements, 13 of which were due to loss of control (Appendix F).

1.22 Board safety concern relating to uncontrolled movements

Given the number of occurrences and TSB investigations involving uncontrolled movements due to various causes, the Board has issued a recommendation^{Footnote 71} and a safety concern^{Footnote 72} calling for improved physical defences to prevent runaway equipment. The TSB remains concerned that the current defences are not sufficient to reduce the number of uncontrolled movements and improve safety.

1.23 TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP016/2018 – NVM Recovery – EOT (Non-Volatile Memory Recovery – End of Train)
• LP035/2018 – Air Brake Control Valve Analysis
• LP184/2018 – Train Dynamic Analysis

The condition of the track is not considered to have contributed to the occurrence. The train was handled in accordance with railway train handling procedures. All 3 locomotives were in serviceable condition. The analysis will therefore focus on the initial loss of control and the response of the crew, failure of the freight car air brake control valve, railway operations in extreme cold weather, and operator performance.

2.1 The occurrence

The uncontrolled movement of the train occurred when the available brake capacity was insufficient to control the train as it descended the steep mountain grade of the Luscar Industrial Spur. The train brakes had worked normally on the trip from Holloway to Luscar. During that trip, the locomotive engineer (LE) had not experienced any problems with the air brake control valves on this train and had no reason to suspect anything was out of the ordinary.

Shortly after departing Luscar, the LE realized that the train was not responding to his control actions as expected. The accelerometer was showing that the rate of acceleration was higher than normal, indicating that the braking force was insufficient. The LE’s attention became focused on the multi-function operator display screen as he attempted to determine why the train was not responding as expected. As the speed continued to increase, the LE applied more dynamic braking effort and more train brakes. When the speed reached 5 mph over the maximum, the train brakes were applied in emergency. After reaching a speed of 53 mph on track with an allowable maximum speed of 15 mph, the movement reached the bottom of the grade and began to ascend. The available braking capacity, combined with the effect of gravity, was then sufficient to bring the train to a stop. The actions taken by the LE to control the train while descending the grade were appropriate and consistent with railway train-handling requirements. Inspection immediately after the train came to a stop revealed that the air brakes on 27 of the 58 loaded coal cars were not applied.

The LE was experienced with mountain-grade train operations and was also familiar with the effects of extreme cold weather on air brake system performance. Due to an unanticipated set-up problem with the trailing locomotive, the train could not be configured for distributed power operation. With the train in conventional configuration, i.e., all locomotives at the front, the LE anticipated that there may be additional air brake system leakage due to the cold ambient temperature, but he expected that the brakes would be serviceable. However, while the train was at Luscar, the temperature dropped below a critical point, which adversely affected the function of the air brake control valves on the cars in this train.

Testing following the occurrence determined that worn rubber seals from the bottom cover exhaust port of the DB-10 service portions of the air brake control valves shrank in the extreme cold temperatures, resulting in auxiliary reservoir leakage and unintended release of air brakes on 27 freight cars following service air brake applications. This testing also determined that the unintentional release of the brakes was consistent with the type of failure and leakage of the DB-10 service portions that was the subject of an Association of American Railroads (AAR) Circular in 2013.

Shortly after the train brakes were applied (just before starting the descent), the brake pipe airflow increased to a higher rate. It had been 33 CFM before the train brake application and rose to 41 CFM after the train brakes were applied. Then, each time the train brakes were further applied to control train speed, airflow increased above 33 CFM. This phenomenon also occurred several times during the loading sequence, when the mine loading foreman instructed the LE to stop. As referenced in railway locomotive and train operating instructions, spontaneous increases in brake pipe airflow are known to be an indicator of an unintentional release of the train brakes during cycle braking situations. However, the Canadian National Railway Company’s (CN’s) train operating instructions are not designed to diagnose the mechanical failure of multiple car control valves on a train. The LE, in this circumstance, did not notice the slow and gradual increases in brake pipe airflow that coincided with each train brake application. Unless an LE continuously monitors the brake pipe airflow, these gradual increases can be easily overlooked during regular train operations.

Although the multi-function operator display screen in the locomotive cab included a field for brake pipe airflow, the field was not particularly conspicuous among other information displayed. This field displayed brake pipe airflow consistently in white text on a black background, regardless of what changes occurred in the rate of airflow. Despite these difficulties, the railway expected LEs to monitor brake pipe airflow.

“Cognitive conspicuity” refers to the importance and relevancy of information to an operator’s context, such as the rate of airflow from the locomotives to the train. To ensure the most important visual cues for a specific scenario are detected by the operator, these cues, such as the airflow information, would need to be easily discriminated as the most relevant. This safety-significant information should not be masked or weakened by other more noticeable cues.

The AAR Manual of Standards and Recommended Practices stipulates that the urgency of information conveyed by an alarm shall be indicated by the background colour (that is, alarms with red backgrounds are the most urgent, alarms with yellow backgrounds are less urgent, and alarms with white backgrounds are the least urgent).^{Footnote 73} The “Flow” box on the smart display of the occurrence locomotive indicated a small white number that did not flash, change colour, or change prominence, regardless of the circumstances or the flow rate that was displayed. Although an increase in brake pipe airflow after a train brake application is a known indicator of an unintentional release of the train brakes, there were no changes in the airflow indicator on the locomotive multi-function operator display (colour, flashing, or audible alarm) to assist the LE in identifying problematic airflow.

If established design principles are not applied to the display of safety-significant information on the locomotive multi-function operator display, important cues can be missed, increasing the risk of accidents.

2.2 Air brake problems at Tumbler before the occurrence

On 21 December 2017, a malfunction of the air brakes on the leased cars was noted while the cars were at Tumbler. A train crew yarding the train noted that many of the cars would not go into emergency braking. The emergency portions of the air brake control valve were inspected, and the failure was determined to be related to a deformed K-ring inside the vent valve, which resulted in excessive leakage during extreme cold temperatures and in failure to propagate the emergency brake application command. It was surmised that the setting and deformation of the K-ring rubber had likely occurred when the coal cars were in storage for an extended period of time before being delivered to CN. The permanent deformation of the K-ring negatively affected its intended performance, particularly during extreme cold temperatures (−25 °C). Testing of the DB-20 emergency portions established that the failure mechanism was different from the failure mechanism of the service portions in this occurrence.

Both the problems discovered at Tumbler and the loss of control at Luscar occurred at ambient temperatures at or near −25 °C. The 2 events involved different parts of the DB-20 emergency brake control valve and different circumstances, yet, in both events, the properties of rubber seals and their precondition were negatively affected by extreme cold ambient temperatures leading to air brake system failures. Previous performance issues with the DB-10 service portion control valves had manifested themselves in cold weather and resulted in an AAR Circular in 2013; the failure mode identified in the circular was repeated in this occurrence. Moreover, a new failure mode involving the rubber components of the emergency portions of these same control valves in cold weather has emerged.

If performance issues involving rubber components in air brake control valves are not fully analyzed when they occur, degradation in the efficacy of the control valve, particularly during cold weather conditions, may not be identified and addressed in a timely manner, increasing the risk of a loss-of-control event.

2.3 Cold-weather railway operations

2.3.1 Canadian National Railway Company’s winter operating plan

It is well known in the Canadian railway industry that cold weather can result in air leakage from freight car air brake systems. Rubber seals and gaskets become stiff and metal contracts, resulting in leakage of pressurized air. It is also well known that, below a certain temperature (about −25 °C), the effectiveness of air brake systems can further decline. At the time of the occurrence, the ambient temperature was −24 °C.

In recognition of the challenges encountered in train operations during the winter months, railways operating in northern climates typically develop and implement a winter operating plan. CN’s winter operating plan for 2017–2018 contained a number of procedural modifications that were intended to facilitate ongoing railway operations at this time of year, such as speed reductions and reduced maximum train lengths. However, this plan did not contain any specific limitations applicable to the occurrence train operating on the steep mountain grades of the Luscar Industrial Spur when ambient temperatures dropped below a particular point. For example, there were no additional requirements for a qualifying brake test (such as a No. 1A test) after the train was loaded and ready to depart. This test would have verified the application and release of the brakes on each car of the train before descending the steep mountain grade in extreme cold weather conditions.

Without specific measures to ensure the safety of train operations during severe cold weather in mountain-grade territory, there is an increased risk of loss of control, derailments, and injuries to train crew members and the public.

2.4 Single-car air brake testing

A single-car air brake test checks the effectiveness of a car’s air brakes and confirms, among other things, that the brakes remain applied and air pressure leakage is within predetermined levels. However, the current requirements do not include testing at cold temperatures, when vulnerabilities in air brake performance are more likely to become apparent. Currently, the single-car air brake test is most commonly performed in a controlled environment within a car shop, where temperatures do not reflect operational conditions.

For the leased train-set involved in this occurrence, single-car air brake tests had not been performed when the cars were brought out of storage or before or after they were delivered to CN. There are currently no requirements for single-car testing for cars returning to active service after having been in storage, provided the time in storage does not result in the cars being in non-compliance with existing requirements.

In addition, single-car air brake testing was not performed on any of the cars following the replacement of the emergency portion of the control valves in Prince George, as required by the AAR Interchange Rules. This repair work had been performed specifically to address the problem that some of the cars were not going into emergency braking when activated.

The railway did not want to further delay the unloading of these cars because of concern that frozen product would become more difficult to unload over time. The single-car tests were also delayed because the railway did not intend to invoice the owners of the leased cars at that time.

Single-car tests on the leased cars at normal shop temperatures would have been unlikely to discover either of the problems later attributed to extreme cold weather operations of the control valves. Both the worn rubber seals from the bottom cover exhaust port of the DB-10 service portions and the deformed K-ring inside the vent valve of the DB-20 emergency portions became problematic only during extreme cold weather operations. While single-car tests can validate the function of air brake control valves in moderate operating temperatures, the industry lacks a practical test method to identify operational vulnerabilities in air brake control valves during extreme cold weather operations.

2.5 Operator performance

At the time of the occurrence, the LE had been awake for approximately 18 hours and had been on duty for about 12.5 hours. In addition, the occurrence took place at a time of day when the LE would have normally been sleeping (about 0230). Although the LE met the limits prescribed in the Work/Rest Rules for Railway Operating Employees, he was likely affected by fatigue to some extent.

Moreover, during coal loading at the Luscar Mine, the train was being moved under automated control, which required little monitoring. As a result, the LE’s level of vigilance was likely reduced while the train was under automated control. Brake pipe airflow increased subsequent to air brake applications on several occasions during the loading sequence. However, the LE did not notice this, likely due to reduced vigilance while the train was under automated control.

While departing Luscar, the LE noted immediately that the train was not responding as expected to the initial brake applications and took immediate action to control the train. His experience in cold weather train operations led him to expect that there would be increased airflow, particularly on a conventionally configured train during extreme cold. As a result, the LE did not pay particular attention to the increases in brake pipe airflow after each successive brake application. Although the LE was likely affected by fatigue to some extent, his actions to control the train while descending the grade were appropriate and consistent with railway train-handling requirements.

2.6 Unplanned/uncontrolled movements

Of the 589 occurrences that resulted in unplanned/uncontrolled movements between 2010 and 2019 inclusive, loss of control, as in this occurrence, was the causal category in 21 (4%) of them. While uncontrolled movements due to loss of control are low-frequency events, 57% of them (12 out of 21) affected the main track. In these cases, there is an increased potential to encounter the public at crossings and to collide with main-track freight and passenger trains. Consequently, these are considered low-frequency/high-risk events. The TSB remains concerned that the current defences are not sufficient to reduce the number of uncontrolled movements and improve safety.

3.1 Findings as to causes and contributing factors

These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence.

1. The uncontrolled movement of the train occurred when the available brake capacity was insufficient to control the train as it descended the steep mountain grade of the Luscar Industrial Spur.
2. Inspection immediately after the train came to a stop revealed that the air brakes on 27 of the 58 loaded coal cars were not applied.
3. While the train was at Luscar, the temperature dropped below a critical point, which adversely affected the function of the air brake control valves on the cars in this train. At the time of the occurrence, the ambient temperature was −24 °C.
4. Worn rubber seals from the bottom cover exhaust port of the DB-10 service portions of the air brake control valves shrank in the extreme cold temperatures, resulting in auxiliary reservoir leakage and the unintended release of brakes on 27 freight cars following service air brake applications.
5. Although spontaneous increases in brake pipe airflow after brake applications are known to be an indicator of an unintentional release of the train brakes, the LE did not notice the slow and gradual increases in brake pipe airflow that coincided with each train brake application.
6. Although the multi-function operator display screen in the locomotive cab included a field for brake pipe airflow, the field was not particularly conspicuous among other information displayed.

3.2 Findings as to risk

These are conditions, unsafe acts, or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences.

1. If established design principles are not applied to the display of safety-significant information on the locomotive multi-function operator display, important cues can be missed, increasing the risk of accidents.
2. If performance issues involving rubber components in air brake control valves are not fully analyzed when they occur, degradation in the efficacy of the control valve, particularly during cold weather conditions, may not be identified and addressed in a timely manner, increasing the risk of a loss-of-control event.
3. Without specific measures to ensure the safety of train operations during severe cold weather in mountain-grade territory, there is an increased risk of loss of control, derailments, and injuries to train crew members and the public.

3.3 Other findings

These items could enhance safety, resolve an issue of controversy, or provide a data point for future safety studies.

1. Although the LE was likely affected by fatigue to some extent, his actions to control the train while descending the grade were appropriate and consistent with railway train-handling requirements.
2. While single-car tests can validate the function of air brake control valves in moderate operating temperatures, the industry lacks a practical test method to identify operational vulnerabilities in extreme cold weather operations.

4.1 Safety action taken

4.1.1 Canadian National Railway Company

The Canadian National Railway Company (CN) implemented new air brake testing procedures for cold weather operations at Luscar to verify that car brakes apply.

CN has initiated the use of 5 cold-wheel detectors on the network. One is located near Williams Lake, British Columbia, 2 are west of Jasper, Alberta, 1 is north of Superior, Wisconsin, U.S., and 1 is in Quebec. Each of these detectors has been located in an area of significant grade and allows CN to identify cars on which the individual brake systems are not applying sufficient retarding force. When a car is so identified, it is marked as bad order and addressed accordingly.

CN has implemented a requirement that car owners ensure that leased cars come to CN with freight car air brake control valves that are less than 10 years old. Newly leased coal cars on CN lines must have passed a single-car air brake test within the preceding 5 years. All car control valves greater than 10 years old must be replaced.

CN has implemented additional changes in procedures,:

• systematically replacing freight car air brake control valves that are 10 years or older on CN-owned railcars;
• randomly selecting and performing an automated single-car test on 10% of all railcars coming out of storage; and
• requiring that all new freight car air brake control valves installed have a DB-60II brake cylinder pressure-maintaining feature.

The following specific operating parameters have been adopted for winter operations on the Luscar Industrial Spur:

• When the temperature reaches −25 °C or lower, loaded coal train operations cease on the Luscar Industrial Spur.
• When the temperature is between −22 °C and −25 °C, loaded coal train operations are conducted only during the day.

4.1.2 Transportation Safety Board of Canada

On 08 July 2018, the TSB issued Rail Safety Advisory 04/18 to Transport Canada (TC) concerning potential brake valve failures on cars that have been in long-term storage. The TSB suggested the following to Transport Canada:

Given the potential consequences of a loss of braking function due to brake valve failure, Transport Canada may wish to alert railways and car owners of the need to examine the brake valve functionality of cars that have been in long-term storage, particularly if the cars are to be used in cold weather service.

4.1.3 Transport Canada

TC responded to the TSB Rail Safety Advisory 04/18 on 20 November 2019, indicating that it had issued a Rail Safety Bulletin in 2019 entitled “Potential brake valve failures on cars in long-term storage.” The Bulletin states the following:

Transport Canada is of the view that railway companies and car owners should examine the complete valve functionality of cars placed in long-term storage, where the potential for rubber setting of valve seals is possible, before placing the cars in service. This is of particular concern if cars are to be used in cold weather service.

4.1.4 New York Air Brake

On 01 November 2018, New York Air Brake (NYAB) issued General Letter (GL) 49003 to re-issue GL-490 and to include DB-20 emergency portions. The following revised corrective actions were recommended:

Any DB-10 service portion experiencing one or more of the described symptoms should be removed from service as soon as practical and refurbished per NYAB Maintenance Specification NYR-332.

In addition, any DB-20 Emergency Portion partnered with the above removed DB-10 service portion that is OEM/COT&S [original equipment manufacturer/clean oil test and stencil] date-coded the same age, is older or has no legible date code should be removed.

Replacing any valve portion warrants Single Car Test of the brake system per Rule 3 of the Field Manual of the AAR Interchange Rules. ^{Footnote 74}

In response to a 2019 request by the Association of American Railroads, NYAB performed an analysis of freight control valves collected from the field and data collected from the clean oil test and stencil portions. Based on the findings of independent analyses, NYAB formally submitted a letter of recommendation for a time-based maintenance overhaul period of 12 years for freight control valves.

4.1.5 Association of American Railroads

Effective 01 July 2020, the Association of American Railroads introduced a change to Rule 4 of its Field Manual and Office Manual of Interchange Rules enabling the removal of control valves older than 13 years. This rule change establishes renewal requirements for brake valves regarding age and cold weather. In accordance with the revised rule, service and/or emergency portion control valves with a manufacture or recondition date (whichever is later) of 13 years may be renewed, and if over 14 years must be renewed for over age cause on a car if:

• The car will be part of a unit train in coal or grain, a high-hazard flammable unit train, or in a toxic inhalation hazard service; and
• The unit train will be operating on any part of its route in a territory above the 37th parallel for any length of time within the date range of 01 November through 01 April.

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 3 June 2020. It was officially released on 19 August 2020.

Appendix A – Locomotive and freight car air brakes

Train air brakes

Locomotives are equipped with 2 air brake systems: automatic and independent. The automatic brake system applies the brakes to each car and locomotive on the train and is normally used during train operations to slow and stop the train.

Each locomotive is also equipped with an independent brake system, which applies air brakes only on the locomotive. Independent brakes are not normally used during train operations, but are primarily used as a parking brake, sometimes in conjunction with the hand brake.

Automatic brake system

A train’s automatic brake system is supplied with air from compressors located on each operating locomotive. The air is filtered, dried, compressed and stored in the locomotive's main reservoirs. Air pressure in the main reservoirs is maintained at between 130 and 140 psi. These reservoirs supply air through the brake pipe to each locomotive and individual car in a train.

The automatic brake system is equipped with a regulating valve that is used to set the air pressure supplied to the brake pipe to approximately 90 psi.^{Footnote 75} Given a sufficient amount of time, the entire train brake system will charge to 90 psi. The time to fully charge a train brake system depends on train length, the ambient temperature, the positioning of locomotives throughout the train, and the amount of leakage^{Footnote 76} throughout the train.

Rail cars are equipped with the following 6 basic air brake components: the brake pipe, a car control valve, auxiliary and emergency air reservoirs, brake cylinder, and a retaining valve (Figure A1). A car control valve has 3 portions: a service portion, an emergency portion, and a pipe bracket (Figure A2). The car control valve has 3 functions: to charge the auxiliary and emergency reservoirs from the brake pipe, to apply the brakes, and to release the brakes.

The brake pipe supplies compressed air to each car^{Footnote 77} in the train when the train brakes are released and the system is being charged. The auxiliary reservoir on each car supplies compressed air to the brake cylinder when the brakes are applied and is recharged when the brakes are released. This action is controlled by the car control valve reacting to changes in brake pipe pressure.

The brake pipe acts as a signal line to apply or release/recharge the train brakes. The signal is controlled from the automatic brake valve on the lead locomotive by changing the air pressure in the brake pipe. Train air brakes are based on the principle of lowering brake pipe pressure to apply the brakes and increasing brake pipe pressure to release the brakes. Thus, the train air brake system must be sufficiently charged with compressed air to operate as designed.

When a freight train air brake system is sufficiently charged, the brakes are applied through a controlled reduction in brake pipe pressure. This is called a service reduction. Train brakes can be applied with a minimum application, which is the lightest brake possible, and gradually applied harder in stages until a full service application^{Footnote 78} is achieved. Although a service train brake application can be incrementally increased, it cannot be incrementally released; it can only be fully released.

To apply the train brakes harder than a full service application requires an emergency brake application.^{Footnote 79} This is done by venting the brake pipe air at an uncontrolled rate, allowing the pressure to drop rapidly to 0 psi. Once an emergency brake application is initiated, the drop in brake pipe pressure to 0 psi cannot be stopped.

The car control valve on a freight car reacts to an abrupt drop in air pressure by allowing air pressure stored in the emergency reservoir to flow into the brake cylinder. The auxiliary reservoir is also used during an emergency brake application. This causes a faster and higher build-up of brake cylinder pressure, resulting in a harder brake application and a faster stop.

When a normal automatic brake application is required, the locomotive engineer (LE) moves the automatic brake valve handle (Figure A3) to the desired position. This action removes air from the brake pipe at a service rate. As each car control valve senses a sufficient reduction in pressure, air flows from the auxiliary reservoir located on each car into that car’s brake cylinder, applying the brake shoes to the wheels.

To release the brakes, the LE moves the automatic brake valve handle to the release position. This action allows air to flow from the main reservoir back into the brake pipe, restoring pressure to 90 psi. Sensing an increase in brake pipe air pressure, the car control valve on each car allows air to be released from the brake cylinder through its retaining valve, and the brake shoes are removed from the wheels.

To reapply the train brakes after a release, the brake pipe pressure must again be reduced using the automatic brake valve. Before reapplying the train brakes, the system needs time to recharge. Not allowing sufficient time for the system to recharge may result in the brakes not applying or unintentionally releasing after a short time.

Independent brake system

On a locomotive, the independent brakes are also supplied with air from the main reservoir. Unlike the automatic brake system, the independent brake system is a direct air system. An independent brake valve controls a relay valve that will allow air from the main reservoir to flow into the brake cylinders on the locomotives only.

When a full independent brake application is required, the LE moves the independent brake valve handle (Figure A4) to the full application position, and air pressure is supplied to the locomotive brake cylinders. This causes the brake shoes to apply to only the locomotive wheels. Brake cylinder pressure can also be gradually increased or decreased as needed by moving the brake valve handle in the application zone.

To release the independent brakes, the LE moves the independent brake valve handle to the release position. This causes air to be released from the locomotive's brake cylinders, and the brake shoes are removed from the locomotive wheels. Air pressure in the locomotive brake cylinders is relative to the position of the independent brake valve handle.

Brake pipe pressure maintaining

Pressure maintaining is a feature of the automatic brake valve that allows air to flow into the brake pipe at a controlled rate to overcome normal brake pipe leakage without causing the brakes on the train to release. During service brake applications, it allows the selected brake pipe pressure reduction to be maintained for long periods. This feature allows trains to descend long mountain grades with the brakes applied as needed.

Without brake pipe pressure maintaining, leakage would cause the brake pipe pressure to continue falling after the brakes have been applied. Eventually, the brake pipe pressure would drop to 0 psi. Thus, controlling train speed on long descending grades is difficult without brake pipe pressure maintaining.

Pressure maintaining is always functioning when a locomotive is set up for lead operation, but is disabled on locomotives set up for trail operation. Only 1 automatic brake valve in a locomotive consist controls brake pipe pressure.

Airflow indicator

The airflow indicator is designed to measure the flow of air into the brake pipe. The flow is measured in cubic feet per minute (CFM). When the air brake system is charging following a release of the automatic brake, there is a demand for main reservoir air to supply the brake pipe. Air from the brake pipe recharges the auxiliary reservoir on each car in the train, and, in the case of recharging following an emergency brake application, also the emergency reservoir on each car in the train.

On locomotives equipped with operator display screens, the airflow is displayed in a box identified as “Flow” (Figure A5). The value displayed on the screen indicates the amount of airflow into the brake pipe in CFM. On this type of airflow indicator, when the demand for air falls below 20 CFM, it will display 0.^{Footnote 80}

When the train brake system is being charged, the airflow indicator displays a high value, typically higher than 60 CFM. This indicates that there is a high flow of air into the brake pipe. As the system becomes charged, the value displayed comes down, indicating a decrease of flow.

When the value on the airflow indicator stops falling and stabilizes, it indicates that the demand for air is steady and the system is fully charged. The pressure-maintaining feature of the automatic brake valve will compensate for brake pipe leakage. If there is leakage in the brake pipe, the flow value may not reach 0 CFM when the train brake system is fully charged.

Because the airflow indicator measures the rate of airflow to the brake pipe, it can also indicate

• the rate at which a train is being charged or recharged;
• a heavy demand of air in the brake pipe, if a hose has separated or ruptured; or
• a flow of air into the brake pipe as the pressure-maintaining feature of the automatic brake valve compensates for normal leakage.

If the airflow indicator shows increased airflow while the brakes are applied, it could indicate

• that the brakes are releasing (unintentional release);
• that somewhere in the train, a brake pipe coupling hose has come apart;
• that somewhere in the train, a hose or brake pipe has ruptured; or
• that there is excessive leakage.

Reset safety control

Locomotives manufactured since 1986 must be equipped with a reset safety control (RSC). The RSC is a vigilance system that activates alarms and then applies a penalty brake if it is not reset by the LE or if the controls are not being manipulated within a predetermined time interval.

Penalty braking

A penalty brake application is similar to a full service automatic brake application. However, this type of braking further reduces the brake pipe pressure to 0, requiring a moving train to stop and recharge the brake pipe. This type of braking occurs as a result of a “penalty” applied by the system, such as when the RSC is not reset or the locomotive goes above a predetermined speed. This brake application occurs at a rate that allows only air from the auxiliary reservoir to flow into the brake cylinder on each car.

Emergency braking

An emergency brake application is the maximum application of a train’s air brakes, during which the brake pipe pressure is rapidly reduced to 0, either from a separation of the brake pipe or operator-initiated action. Following an emergency brake application, the air from the auxiliary and emergency reservoirs combine in the brake cylinder. When brake pipe pressure is below 45 psi, a rapid reduction in brake pipe pressure cannot be relied upon to initiate an emergency brake application.

Appendix B – Train handling

Figure B1 presents a graphical summary of the train-handling control actions made during this occurrence, from the beginning of the train movement to the point where the train came to a stop.

Row (a), Speed,  depicts the acceleration of the train as it descended the mountain grade, followed by the deceleration of the train as it travelled over the ascending grade at the bottom of the hill. A maximum speed of 53 mph was reached.

Row (b), Throttle / DB Excitation, depicts the initial activation between notch 1 and idle as the train began to move. At the transition into DB mode, the coloured line changes to red. DB was increased to maximum, position 8, where it remained until the train came to a stop.

Row (c), Trac Effort, depicts tractive effort measured in kips . Tractive effort transitions from a pulling force to a retarding force when the locomotives are taken out of throttle and moved into DB mode. This plot generally follows Row (b ), Throttle / DB Excitation. Note how tractive effort in DB decreases as the maximum speed of the train is reached, then increases as the train slows. This is consistent with expected DB performance under these circumstances.^{Footnote 81}

Row (d), Brakes, depicts train and locomotive brake activity, as reflected by changes in air pressure. This row contains 5 parameters:

• EAB BP, or Electronic Air Brake - Brake Pipe
• EAB BC, or Electronic Air Brake - Brake Cylinder
• EOT BP, or End of Train - Brake Pipe
• EAB ER, or Electronic Air Brake - Equalizing Reservoir
• EAB MR, or Electronic Air Brake - Main Reservoir

This row includes brake pipe pressure (BPP) changes, both at the lead locomotive and at the rear of the train. Reductions in BPP are an indicator of train brake applications, whereas increases in BPP are an indicator of release and recharge of the train brakes. This row also includes brake cylinder pressure, which is an indicator of the application and release of the brakes on the locomotives only. Unlike BPP, increases in brake cylinder pressure indicate that the locomotive brakes are being applied and reductions in brake cylinder pressure indicate that the locomotive brakes are being released. Equalizing reservoir pressure is also depicted in this row. The equalizing reservoir is a control volume on the lead locomotive that is increased and decreased in response to operator commands through the automatic (train) brake valve handle. Changes in equalizing reservoir pressure are mirrored in BPP by the automatic brake control valve. The data in this row also show the release of the locomotive brakes as the train begins to move and the application of the train brakes before and during the descent of the grade. The location where BPP drops to 0 psi is the point where the LE applied the train brakes in emergency.

Row (e), Airflow, depicts the airflow from the lead locomotives to the brake pipe in CFM. LEs expect to see higher-than-normal airflow on conventional trains in very cold weather due to increased leakage in the air brake system throughout a train. This row depicts increases in airflow immediately following each service air brake application before the final emergency brake application. These increases in airflow subsequent to service brake applications can indicate an unintentional release of the train brakes.

Row (f), PCS Open, depicts the activity of the pneumatic control switch (PCS). This switch is opened automatically in response to an emergency brake application, whether operator-initiated or train-initiated. The blue line begins where the emergency brake application was initiated.

Row (g), EAB Emer, depicts when the electronic air brake (EAB) is in emergency.

Row (h), EIE, depicts an employee-initiated emergency (EIE) brake application.

When the train speed exceeded the maximum authorized speed by over 5 mph, the train was placed in emergency using the automatic brake valve. The actions taken by the LE to control the train speed were in accordance with railway operating procedures in place at the time of the occurrence.

The LE did not observe the non-standard increases in airflow subsequent to the service air brake applications.

Appendix C – Association of American Railroads Circular Letter C-12027 and New York Air Brake General Letter GL-490

Source: Association of American Railroads

Source: New York Air Brake

Appendix D – New York Air Brake evaluation of Canadian National Railway Company DB-60 control valve cold temperature failures

• New York Air Brake (NYAB) evaluated the DB-60 control valve failures and reached the following conclusions:
• The DB-10 service portion failures reported by Canadian National Railway Company (CN) were determined to be the same as the balancing valve issue that was evaluated in 2013 and covered under Association of American Railroads (AAR) Circular Letter C-12027 and NYAB General Letter GL-490 (Appendix C).
• Rubber setting, a form of rubber wear, was determined to be the root cause of the emergency portion vent valve failure at cold temperatures. This is further evident in the service portion release valve and balancing valve, where there are different cycle rates. The evaluation found that all three K-rings failed at approximately the same temperature and measured the same outside diameter as their associated bushing inside diameter, which indicates that something other than normal wear caused the K-ring leakage. The condition of the O-rings inspected provides additional supporting evidence. The major contributing factor is believed to be the result of the train sitting in storage with idle brakes from 31 January 2016 to 10 November 2017 (21 months).
• When a train is stored and the dynamic effects of movement and pressurization are no longer at work on the rubber, the environment goes to work on it. As the rubber sits, it flows slowly to fill its container and normalize the stress in the material. As time passes, the elastomers evaporate, the rubber memory is lost, and the rubber products (K-ring, O-rings, and diaphragms) become permanently deformed, affecting the intended functional performance, especially at cold temperatures, when the rubber begins to shrink and becomes stiffer.

Appendix E – Wabtec test report of emergency portions returned by the TSB

Source: Wabtec Freight Car Pneumatics

Appendix F – TSB investigations involving uncontrolled movements

Occurrence number	Date	Description	Location	Cause
R18M0037	2018-12-04	Employee fatality, Canadian National Railway Company, yard assignment L57211-04, Mile 1.03, Pelletier Subdivision	Edmundston, New Brunswick	Securement
R18Q0046	2018-05-01	Uncontrolled movement and derailment of rolling stock on non-main track, Quebec North Shore and Labrador Railway, cut of cars, Sept-Îles Yard	Sept-Îles, Quebec	Switching without air
R18H0039	2018-04-14	Uncontrolled movement of rolling stock, Canadian Pacific Railway, locomotive remote control system yard assignment T16-13, Mile 195.5, Belleville Subdivision	Toronto, Ontario	Loss of control
R18E0007	2018-01-10	Uncontrolled movement of rolling stock, Canadian National Railway Company, freight train L76951-10, Mile 0.5, Luscar Industrial Spur	Leyland, Alberta	Loss of control
R17W0267	2017-12-22	Employee fatality, Canadian National Railway Company, extra yard assignment Y1XS-01	Melville, Saskatchewan	Switching without air
R17V0096	2017-04-20	Non –main-track uncontrolled movement, collision, and derailment, Englewood Railway, Western Forest Products Inc., cut of cars	Woss, British Columbia	Switching without air
R16W0242	2016-11-29	Uncontrolled movement, collision, and derailment, Canadian Pacific Railway , ballast train BAL-27 and freight train 293-28, Mile 138.70, Weyburn Subdivision	Estevan, Saskatchewan	Loss of control
R16T0111	2016-06-17	Uncontrolled movement of railway equipment, Canadian National Railway Company, remote control locomotive system (RCLS) 2100 west industrial yard assignment, Mile 23.9, York Subdivision, MacMillan Yard	Vaughan, Ontario	Loss of control
R16W0074	2016-03-27	Uncontrolled movement of railway equipment, Canadian Pacific Railway, 2300 RCLS training yard assignment, Mile 109.7, Sutherland Subdivision	Saskatoon, Saskatchewan	Switching without air
R16W0059	2016-03-01	Uncontrolled movement of railway equipment, Cando Rail Services, 2200 Co‑op Refinery Complex assignment, Mile 91.10, Quappelle Subdivision, Canadian National Railway Company	Regina, Saskatchewan	Securement
R15D0103	2015-10-29	Runaway and derailment of cars on non-main track, Canadian Pacific Railway, stored cut of cars, Mile 2.24, Outremont Spur	Montréal, Quebec	Securement
R15T0173	2015-07-29	Non–main-track runaway, collision, and derailment, Canadian National Railway Company, cut of cars and train A42241‑29, Mile 0.0, Halton Subdivision	Concord, Ontario	Switching without air
R13D0054	2013-07-06	Runaway and main-track derailment, Montreal, Maine & Atlantic Railway, freight train MMA-002, Mile 0.23, Sherbrooke Subdivision	Lac-Mégantic, Quebec	Securement
R12E0004	2012-01-18	Main-track collision, Canadian National, runaway rolling stock and train A45951-16, Mile 44.5, Grande Cache Subdivision	Hanlon, Alberta	Securement
R11Q0056	2011-12-11	Runaway train, Quebec North Shore and Labrador Railway, freight train LIM-55, Mile 67.20, Wacouna Subdivision	Dorée, Quebec	Loss of control
R09D0053	2009-09-09	Non–main-track collision, VIA Rail Canada Inc., locomotive 6425, VIA Rail Canada Inc., Montréal Maintenance Centre	Montréal, Quebec	Switching without air
R09T0057	2009-02-11	Runaway and non–main-track train derailment, Southern Ontario Railway, 0900 Hagersville Switcher, Mile 0.10 and Mile 1.9 of the Hydro Spur	Nanticoke, Ontario	Securement
R08V0270	2008-12-29	Non–main-track train runaway and collision, Kettle Falls International Railway, Waneta Turn Assignment, Mile 141.20, Kettle Falls Subdivision	Waneta, British Columbia	Loss of control
R07H0015	2007-07-04	Runaway rolling stock, Canadian Pacific Railway, runaway cut of cars, Mile 119.5, Winchester Subdivision	Smiths Falls, Ontario	Securement
R07V0109	2007-04-23	Non-main-track train derailment, Kootenay Valley Railway, 0700 Trail yard assignment, Mile 19.0, Rossland Subdivision	Trail, British Columbia	Loss of control
R06V0183	2006-09-03	Runaway and derailment, White Pass and Yukon Railway, work train 114, Mile 36.5, Canadian Subdivision	Log Cabin, British Columbia	Loss of control
R06V0136	2006-06-29	Runaway and derailment, Canadian National, freight train L-567-51-29, Mile 184.8, Lillooet Subdivision	Lillooet, British Columbia	Loss of control
R05H0011	2005-05-02	Runaway and main-track train collision, Ottawa Central Railway, freight train 441, Mile 34.69, Alexandria Subdivision	Maxville, Ontario	Securement
R04V0100	2004-07-08	Uncontrolled movement of railway rolling stock, Canadian National, train M-359-51-07, Mile 57.7, Fraser Subdivision	Bend, British Columbia	Loss of control
R03T0026	2003-01-21	Yard collision, Canadian Pacific Railway, car HOKX 111044, Mile 197.0, Belleville Subdivision, Toronto Yard	Agincourt, Ontario	Switching without air
R03T0047	2003-01-22	Yard collision, Canadian National, tank Car PROX 77811, Mile 25.0, York Subdivision	Toronto, Ontario	Switching without air
R99D0159	1999-08-27	Runaway cars, Canadian National, Mile 69.4, Kingston Subdivision, Wesco Spur	Cornwall, Ontario	Securement
R98M0029	1998-09-24	Main-track runaway, collision, and derailment, Matapédia Railway, Canadian Nationaltrain A402-21-24, Mile 105.4, Mont-Joli Subdivision	Mont-Joli, Quebec	Securement
R98M0020	1998-07-31	Main-track runaway and collision, VIA Rail Canada Inc. passenger train 14 and an uncontrolled five-pak movement, Mile 105.7, Matapédia Railway Mont-Joli Subdivision	Mont-Joli, Quebec	Securement
R97C0147	1997-12-02	Runaway and derailment, Canadian Pacific Railway, train 353-946, Laggan Subdivision	Field, British Columbia	Loss of control
R96C0172	1996-08-12	Main-track collision, Canadian National, train 117 and an uncontrolled movement of 20 cars, Mile 122.9, Edson Subdivision	Near Edson, Alberta	Securement
R96C0209	1996-10-09	Runaway cars, Canadian Pacific Limited, CP 0700 yard assignment, Mile 166.2, Willingdon Subdivision, Clover Bar exchange track	Edmonton, Alberta	Securement
R96T0137	1996-04-24	Runaway of 5 tank cars, Canadian National, Mile 0.0, Hagersville Subdivision	Nanticoke, Ontario	Securement
R96C0086	1996-04-13	Runaway train, Canadian Pacific Railway, freight train 607-042, Mile 133.0, Laggan Subdivision	Field, British Columbia	Loss of control
R95M0072	1995-12-14	Runaway cars, Canadian National, train 130-13, Mile 0.0, Pelletier Subdivision	Edmundston, New Brunswick	Securement
R94V0006	1994-01-18	Runaway train, CN, freight train 459-GP-18, Mile 175, Grande Cache Subdivision	Latornell, Alberta	Loss of control