Rail transportation safety investigation report R19W0002

On 03 January 2019, about 0610 Central Standard Time,^{Footnote 1} Canadian National Railway Company (CN) eastbound freight train M31851-01 (train 318) began following eastbound CN train Q11651-30 (train 116) near Rivers, Manitoba, on the CN Rivers Subdivision. Both trains were destined for Winnipeg, Manitoba. Train 318 was a key train^{Footnote 2} operating on a key route,^{Footnote 3} as defined by the Transport Canada (TC)–approved Rules Respecting Key Trains and Key Routes.

At 0906:54, train 318 was travelling at 42 mph, with Trip Optimizer (TO) engaged and the throttle in position 7, as it passed a Clear to Stop signal indication at Mile 52.2. The conductor had called out the signal in the locomotive cab and identified the Clear to Stop indication. However, the conductor did not hear the locomotive engineer (LE) verbally respond to acknowledge the signal, and the LE appeared to be staring straight ahead. At this point, conversation in the cab ceased. TO remained engaged, and the train continued at track speed.

As CN train 318 was proceeding on the south track, a westbound CN freight train M31541-03 (train 315) was transitioning from single track to the north track while exiting the equilateral turnout (Mile 50.37) at Nattress near Portage la Prairie, Manitoba.

At Mile 51.13, while travelling at 46 mph, train 318 passed the head end of train 315. The train 318 conductor then reminded the LE that they were operating under a Clear to Stop indication. Once reminded, the LE disengaged TO and made a full service brake application at 0908:34; 24 seconds later, he inadvertently placed the brake handle into the suppression position (rather than the emergency position), and then applied the locomotive independent brake. After a further 10 seconds, as Stop Signal 504S came into view, the LE placed the train in emergency and the crew evacuated the locomotive cab.

Train 318 side-collided with train 315 while travelling at 23 mph (Figure S1). Shortly thereafter, the train 318 crew members jumped from the locomotive to the south side of the track and sustained minor injuries.

As a result of the collision, the 2 head-end locomotives on train 318 and 8 cars on train 315 derailed. Although no cars loaded with dangerous goods were involved, the head-end locomotives on train 318 lost a combined total of about 3500 imperial gallons of diesel fuel. The released diesel fuel was contained locally and cleaned up with no waterways affected.

The investigation concluded that:

• The train 318 crew had formed the expectation that they would follow train 116 clear through to Winnipeg, without stopping at Nattress, because that is what had happened on the previous 9 eastbound trips along the Rivers Subdivision.
• Train 318 had accelerated to 42 mph by the time it encountered Advance Signal 522S. From that point on, the train 318 crew should have been preparing to stop the train before arriving at Signal 504S at Nattress.
• The train 318 operating crew did not respond appropriately to the signal indications displayed in the field at Mile 52.2 and Mile 50.4, which ultimately led to the collision.
• The train 318 LE was fatigued due to acute sleep disruption brought on by abbreviated and disrupted sleep periods during the 2 nights preceding the accident.
• The train 318 LE experienced decreased vigilance due to the reduced workload while using TO and due to the performance decrements associated with his fatigue, which contributed to his delayed reaction to the restrictive signals at Mile 52.2, and to him selecting an inappropriate braking technique when initially trying to stop the train.
• Due to the inexperience of the train 318 conductor and the authority gradient that existed between the crew members, the conductor deferred to the LE without questioning the operation of the train and, as a result, the crew’s actions to slow and stop the train before Controlled Signal 504S were delayed and ineffective.
• In the absence of a physical defence such as an enhanced train control system, there was no automatic intervention to slow or stop the train when the crew did not initially respond to the Clear to Stop signal displayed in the field.

Safety action taken

Canadian National Railway Company

Following this occurrence, CN distributed System Notice No. 904 to all operating employees in Canada. The notice warned train crews that there had been an increase in Canadian Rail Operating Rules Rule 439 violations across the CN system because of train crews failing to stop at signal indications requiring them to do so, primarily due to a lack of focus on situational awareness. Notice No. 904 stated that “operating crews must not be influenced by other information such as train lineups, detector broadcasts or other crew’s [sic] broadcasts until they themselves positively identify the next signal.”

Safety action required

Enhanced train control for key routes

The basic design of centralized traffic control (CTC) signalling systems in Canada has been well established for some time. Although newer signal circuitry has been integrated into the CTC system over the years, railway operations still rely predominantly on administrative defences, which are the least effective method for mitigating risk. Administrative defences place an over-reliance on a train crew to follow the rules and do not consider the human factors that affect behaviour. For example, the CTC train control system in this case had the administrative requirement for train crews to follow the signal indications displayed in the field, yet this defence did not prevent the accident from occurring.

A signalled CTC system does not provide any advance warning to either the train crew or the rail traffic controller. CTC also does not provide automatic enforcement to comply with speed restrictions in order to slow or stop a train before it passes a restrictive signal. As a result, when a train crew misperceives, misinterprets or does not follow a signal indication, the administrative defences as a whole fail. As demonstrated in this and 80 other TSB investigations since 1990, when an administrative defence fails and there is no secondary defence, it can result in an accident that otherwise could have been prevented.

For comparison, Class 1 railways that operate in the United States (U.S.) have implemented physical fail-safe train control systems known as positive train control (PTC). PTC is designed to prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movement of a train through a switch left in the wrong position. In Canada, the term “enhanced train control” (ETC) has been adopted to describe such systems.

A PTC/ETC system would address the risk of crews misinterpreting or not following signal indications by automatically intervening to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. A fully functioning PTC/ETC system would also offer a physical fail-safe defence against operating crew errors that are influenced by fatigue, which played a role in this accident.

In the U.S., the Rail Safety Improvement Act (RSIA) of 2008 required that PTC be installed on high-hazard routes; as of 31 December 2020, PTC was fully implemented on all required track, a total of 57 535.7 miles, or about 41% of the nearly 140 000 route-miles of the U.S. rail network. The total miles of track that have PTC installed includes the U.S. operations of both CN (3107 miles) and Canadian Pacific Railway Company (CP) (2118 miles).

In comparison, the Canadian rail network comprises about 26 000 route-miles of track. Key routes account for a combined total of about 10 940 miles of main track, which represents about 42% of the Canadian rail network. However, in contrast to the U.S., there is no requirement to install PTC or ETC on routes that carry dangerous goods in Canada.

Since 2000, the Board has issued 2 recommendations related to the need for additional train control defences:

• Recommendation R00-04 was issued following its investigation into the 1998 collision between 2 CP trains near Notch Hill, British Columbia.^{Footnote 4} The Board recommended that the railway industry implement additional backup safety defences to help ensure that signal indications are consistently recognized and followed.
• Recommendation R13-01 was issued following a TSB investigation into the 2012 derailment and collision of VIA Rail Canada Inc. passenger train 92 (VIA 92) near Burlington, Ontario.^{Footnote 5} The Board recommended the implementation of physical fail-safe train controls, beginning with Canada’s high-speed rail corridors.

In 2014, in response to the 2 TSB recommendations, a joint TC–industry train control working group (TCWG) was established and contracted a report from the Canadian Rail Research Laboratory (CaRRL). After these activities, there were a series of ongoing meetings, discussions, and studies related to the development and implementation of ETC systems in Canada with no implementation plan or other tangible results to date. While TC did publish a Notice of Intent in the Canada Gazette, Part I, in February 2022 signalling its intent to require the implementation of ETC in Canada, there is still no implementation plan. In the time it took TC and industry to strike the TCWG, study the issue, produce the TCWG Final Report, contract a follow-on report from the CaRRL and study the CaRRL results, PTC had been fully implemented in the U.S. on all of the high-hazard trackage required by the RSIA legislation.

The CN Rivers Subdivision is a key route and is also an integral part of one of the major rail traffic corridors in Canada. This also means that the cities, towns, and villages along this key route are continually exposed to the risks associated with key trains transporting dangerous goods (DG). Any collision or derailment involving a key train presents a risk of a DG release and potential adverse consequences to people, property or the environment.

The implementation of physical fail-safe train control technologies such as ETC would provide an extra layer of safety when operated in conjunction with existing administrative defences. However, the Canadian railway industry continues to rely solely on administrative defences to protect against train crews not responding appropriately to signal indications displayed in the field.

If TC and the railway industry do not take action to implement physical fail-safe defences to reduce the consequences of inevitable human errors, the risk of collisions and derailments will persist, with a commensurate increase in risk on key routes in Canada. Therefore, the Board recommends that

Recurrent crew resource management training

In general, railway companies do not use closed-loop communication methods. Rail operating rules require that when a train encounters a signal indication displayed in the field, 1 crew member must communicate the signal indication aloud within the locomotive cab to the other crew member. While the other crew member is required to repeat the message back, there is no requirement for the original sender to confirm that the message was received accurately or understood by the other crew member.

As demonstrated by this occurrence, when there is a significant difference in level of experience between operating crew members, an authority gradient may develop in which the less experienced crew member may not always intervene to ensure compliance with all of the rules. In these situations, there is a danger that safety-compromising behaviour will be overlooked because a less experienced employee may be reluctant to question the actions of a more senior employee or intervene in the operation of the train even when it may be critical to do so, such as occurred in this accident.

Crew resource management (CRM) is a concept introduced in the aviation and marine industries to limit or eliminate human errors by recognizing the importance of cognitive and interpersonal skills, thereby improving safety. CRM training seeks to improve a crew’s skills, abilities, attitudes, communication, situational awareness, problem solving, and teamwork. Crew members must successfully interact with each other, their equipment, and their environment to effectively manage threats, errors, and unexpected conditions that may be encountered.

Crew actions need to be based on a common understanding of the state of the equipment, the intended route to be taken, and any other potential threats. When this understanding is consistent, crews are better able to effectively anticipate and coordinate their actions to achieve their common goal. This common understanding between crew members is referred to as team or shared situational awareness.

Shared situational awareness is developed and maintained by a crew through a number of discrete and continuous behaviours. These behaviours include in-trip briefings, the identification of key points throughout the trip, threat and error management (TEM), callouts to any change in the state of the equipment, the instrument setting or mode, and the communication of any change in plans to ensure that all crew members have a common understanding of activities.

CRM training teaches personnel to approach their activities from a team perspective rather than from an individual perspective. Significant safety benefits were experienced in the aviation and marine industries with the introduction of CRM. Given the prevalence of human factors in rail accident statistics, this type of training could yield significant safety benefits in the rail industry.^{Footnote 6}

However, the adoption of CRM training in the rail industry has been sporadic and the approach differs between railways. Similarly, the Railway Employee Qualification Standards Regulations have no requirement for operating crews to complete a separate module on CRM when they qualify or re-qualify in accordance with the regulations.

The TSB has investigated 8 other rail occurrences, dating back as far as 1996, where ineffective CRM practices were identified as a factor that contributed to the accidents.^{Footnote 7}

If operating crew members do not receive enhanced initial and recurrent CRM training to develop skills in crew communication, the coordination of decision making and activities, and dealing with authority gradients that may exist within a locomotive cab environment, there is an increased risk that inadequate crew communication will lead to unsafe operations. Therefore, the Board recommends that

1.1 Canadian National Railway Company freight train Q11651-30

Eastbound Canadian National Railway Company (CN) freight train Q11651-30 (train 116) originated in Roberts Bank, British Columbia.^{Footnote 8} Train 116 consisted of 2 head-end locomotives hauling 137 loaded intermodal cars. It was 9210 feet long and weighed 8106 tons. On 03 January 2019, a crew was ordered for 0400^{Footnote 9} for train 116 at Rivers, Manitoba, located at Mile 143.2 of the Rivers Subdivision. Train 116 departed Rivers at about 0445, destined for Winnipeg, Manitoba.

1.2 Canadian National Railway Company freight train M31851-01

Eastbound CN freight train M31851-01 (train 318) originated in Edmonton, Alberta, and was destined for Winnipeg. It was classified as a key train^{Footnote 10} according to the Transport Canada (TC)–approved Rules Respecting Key Trains and Key Routes. The power for train 318 consisted of four 6-axle road locomotives. There were 3 locomotives on the head end and 1 distributed power (DP) remote locomotive located at Line 99; the 1st, 2nd and DP locomotives were on-line while the 3rd head-end locomotive was isolated. Train 318 was hauling 160 cars (134 loaded and 26 empty), which included 33 loaded dangerous goods (DG) tank cars and 6 residue DG tank cars.^{Footnote 11},^{Footnote 12} It was 9613 feet long and weighed 19 275 tons.

At 0430 on 03 January 2019, a CN operating crew was ordered for train 318 in Rivers. The crew consisted of a locomotive engineer (LE) and a conductor. The LE was familiar with the subdivision; the conductor had transferred to Winnipeg in October 2018. Between 04 November 2018 and 03 January 2019, the conductor had completed the requisite 2 familiarization trips and 29 other trips^{Footnote 13} over the Rivers Subdivision.

Both crew members were qualified for their positions and met fitness requirements. Their work histories were in compliance with the TC–approved Work/Rest Rules for Railway Operating Employees (Work/Rest Rules). At about 0610, train 318 departed from the Rivers Yard eastbound on the Rivers Subdivision, which is also a key route^{Footnote 14} (Figure 1). The train 318 crew operated the train from the lead locomotive (CN 3009).

1.3 Canadian National Railway Company freight train M31541-03

Westbound CN freight train M31541-03 (train 315) originated in Winnipeg and was destined for Edmonton. There were 5 locomotives on the head end; 2 locomotives were on-line and the remaining 3 locomotives were isolated. Train 315 was hauling 136 cars (57 loaded and 79 empty), which included 9 tank cars loaded with DG^{Footnote 15} and 52 DG residue tank cars.^{Footnote 16} It was 9189 feet long and weighed 8301 tons.

At 0530 on 03 January 2019, a CN operating crew was ordered for train 315 at Winnipeg, located at Mile 0.0 of the Rivers Subdivision. The crew consisted of an LE and a conductor. Both crew members were qualified for their positions and met regulatory fitness and rest requirements. At about 0730, train 315 departed westbound from Winnipeg on the Rivers Subdivision.

1.4 Train activity on the Rivers Subdivision before the accident

Eastbound train 116 departed Rivers at 0445 ahead of train 318, which departed Rivers Yard at approximately 0610.

Throughout the duration of the trip, train 318 was operated in Trip Optimizer (TO)^{Footnote 17} mode three times:

• between 0610 (Mile 142.6) and 0620 (Mile 136.7);
• between 0700 (Mile 126.8) and 0740 (Mile 96.1);
• between 0900 (Mile 56) and 0908 (Mile 51.4).

As train 318 approached Elk Crossing (Mile 89.9), it started to receive Advance Clear to Stop and Clear to Stop^{Footnote 18} signal indications until just west of Bloom (Mile 64.3). In response to these restrictive signals, braking action was delayed in anticipation of a less restrictive signal being displayed. As anticipated, these signals changed to a Clear signal before train 318 passed.

Train 318 stopped at the Bloom west siding switch behind train 116, which was stopped at the Bloom east siding switch for a meet with another westbound train. Since both train 318 and train 116 were in close proximity, the train 318 crew overheard the train 116 crew calling signal indications on the radio and the automated hot box detectors broadcasting automated talker reports on the radio.

When the westbound train 315 cleared into the siding at Bloom, train 116 received a Clear signal indication to depart eastward, and train 318 followed up to the Bloom east siding switch governed by a Clear to Stop signal indication requiring that the crew be prepared to stop at the next signal. Train 318 subsequently received a Clear signal indication at the Bloom east siding switch and departed Bloom after train 116 had cleared 2 blocks ahead^{Footnote 19} in the direction of travel.

After passing a Clear signal indication at West Tower (Mile 56.1), train 318 was placed in TO mode and received Clear signal indications at the next 2 stations of Kearns (Mile 55.7) and Portage la Prairie (Mile 55.3), Manitoba, respectively.

As train 318 approached Portage la Prairie, the train 318 crew overheard a radio conversation between the rail traffic controller (RTC) and train 116. During the conversation, it was indicated that train 116 had been lined right through to St. James Junction, which meant that train 116 would be cleared straight to Winnipeg without any additional train meets.

In light of the conversation between the RTC and train 116, the train 318 crew expected that they would continue to follow train 116 straight into Winnipeg without stopping; any westbound traffic train 318 might encounter would likely have been stopped at Nattress (Mile 50.4), as was the case for the train 318 crew’s most recent trips. However, unknown to the train 318 crew, the RTC had planned to hold train 318 at Nattress to allow westbound train 315 to pass after train 116 had cleared Nattress. As train 318 continued on the south main track, the LE continued to operate the train with TO engaged.

During the trip eastward, the train 318 conductor regularly called out the signal indications displayed in the field within the locomotive cab as required by Rule 34(b) of the Canadian Rail Operating Rules (CROR).^{Footnote 20} However, the conductor did not always hear the LE verbally respond to acknowledge the signal indication. In addition to their normal work duties, the LE and the conductor engaged in conversation about the Rivers Subdivision because the conductor was still learning details about the territory.

1.5 The accident

At about 0903, while proceeding at 31 mph with the throttle in position 5, train 318 encountered Controlled Signal 542S (Mile 54.2),^{Footnote 21} which displayed a Clear to Limited indication. The signal indication identified that the train could “[p]roceed, approaching next signal at LIMITED speed.”^{Footnote 22} Limited speed is defined as “[a] speed not exceeding 45 miles per hour.”^{Footnote 23} The conductor called out the signal indication in the cab and the LE responded and verbally acknowledged it. The train continued with the TO feature engaged and the air brake pipe pressure steady at 89 psi. Conversation in the cab continued.

Between 0903:26 and 0906:01, the train horn was sounded in advance of the crossings at Mile 54.22, Mile 53.58, and Mile 52.89.

At about 0906, while at the Mile 52.89 crossing, the train 318 conductor observed Advance Signal 522S (Mile 52.2), which was the next signal in the progression. Signal 522S displayed a Clear to Stop indication.^{Footnote 24} The conductor called out the Clear to Stop indication displayed by Advance Signal 522S in the locomotive cab as the headlight from westbound train 315 that was travelling on the north track came into view. However, the conductor did not hear the LE verbally respond to acknowledge the signal. The LE appeared to be staring straight ahead and unresponsive. At this point, conversation in the cab ceased. The TO remained engaged, and the train continued at track speed.

At 0906:54, eastbound train 318 was proceeding on the south main track at 42 mph with the throttle in position 7 as it passed the Clear to Stop indication (Mile 52.2) while westbound train 315 was proceeding on the north main track at about 38 mph. At this time, the train 318 TO was engaged and the air brake pipe pressure was 89 psi. Normally, the LE would disengage TO after passing an indication other than Clear, but in this instance, he did not.

At 0907:36, while the train was proceeding at 44 mph and as was normal practice, the LEs on both train 318 and train 315 extinguished their lead locomotive headlights as they approached each other. On train 318, TO remained engaged, the throttle was in position 6, and the air brake pipe pressure was 89 psi.

At 0908:22, the head-end locomotives of both train 318 and train 315 passed each other at Mile 51.13, just past a private farm crossing located at Mile 51.3. As this occurred, the train 315 crew noted that train 318 was approaching at a higher than expected speed. At about the same time, the train 318 conductor reminded the LE that they were proceeding on a Clear to Stop indication. The LE initially seemed unresponsive but then appeared to regain awareness. The LE had no recollection of the conductor calling the Clear to Stop signal in the cab nor of the events that subsequently transpired until the conductor reminded him that they were proceeding on a Clear to Stop indication. At that time, the train 318 TO remained engaged, the throttle was in position 6, the air brake pipe pressure was 89 psi, and the headlight remained off.

At 0908:33, train 318 was proceeding at 46 mph at Mile 50.99 when the LE disengaged TO in order to assume manual operating control of the train.

At 0908:34, with the air brake pipe pressure at 88 psi, the LE reduced the throttle to idle and went directly to a full service brake application (reduction of 25 psi) using the automatic brake handle to apply the train automatic air brakes.

At 0908:58, train 318 was proceeding at 43 mph at Mile 50.68. The throttle remained in idle and the air brake pipe pressure was 68 psi. The LE intended to place the automatic air brake handle into the emergency position but inadvertently placed it into the suppression^{Footnote 25} position. At the time, train 318 was quickly approaching the Nattress main track equilateral turnout^{Footnote 26} at Mile 50.37, where the double main track transitions to a single main track (between Mile 50.37 and Mile 50.1) and the track traverses the Assiniboine River.

At 0909:00, train 318 was proceeding at 39 mph at Mile 50.66 when the LE noticed that the train was not slowing sufficiently and applied the locomotive independent brakes (IB). The throttle remained in idle, the train air brake pipe pressure was 67 psi, and the locomotive brake cylinder pressure was 1 psi. At about this time, the train 318 LE called the train 315 crew to ask them to increase their speed in order for train 315 to clear the turnout more quickly.

At 0909:06, train 318 was proceeding at 39 mph at Mile 50.59 when the locomotive IB were fully applied. The throttle remained in idle, the air brake pipe pressure was 64 psi, and the locomotive brake cylinder pressure was 70 psi.

At 0909:08, train 318 was proceeding at 39 mph at Mile 50.57 when the LE activated the emergency toggle on the input and display unit (IDU), initiating a train emergency brake application from the sense and braking unit (SBU)^{Footnote 27} at the end of the train (EOT). At this time, the throttle remained in idle, the air brake pipe pressure was 63 psi (full service application), the head-end locomotive brake cylinder pressure was 70 psi, the EOT brake pipe pressure was 73 psi, and Signal 504S would have just become visible from the locomotive cab. This pressure differential between the head end and EOT indicated that the full service brake application had not yet fully propagated to the tail end of train 318.

The LE called to the conductor to get out, then grabbed him in preparation to evacuate. The LE and the conductor subsequently evacuated the locomotive cab through the right-side rear door located behind the LE control stand onto the locomotive platform.

At 0909:17, with train 318 proceeding at 34 mph at Mile 50.48, the air brake pipe pressure had dropped to 0 psi at both the head end and tail end of the train, which indicated that the train brakes were fully applied in emergency throughout the train.

At 0909:26, train 318 passed Signal 504S (Mile 50.4), which displayed a Stop indication, while travelling at 27 mph.

At 0909:30, while train 318 was proceeding at 23 mph, it side-collided with the 95th car of train 315 at Mile 50.37 (Figure 2). Shortly after the collision, the crew members jumped from the locomotive to the south side of the track.

By about 0910:00, the lead locomotive of train 318 had derailed and come to a stop on the south side of the track at approximately Mile 50.33.

During their egress, the train 318 crew members sustained minor injuries. They were transported to hospital where they were treated and released.

At the time of the accident, the temperature was about 3 °C with 13 km/h winds from the southwest. The skies were overcast and visibility was good.

1.6 Site examination

The 2 lead head-end locomotives on train 318 (CN 3009 and GECX 7371) both remained mainly upright but had derailed all wheels. The lead locomotive (CN 3009) came to rest at about a 45-degree angle from the track, partway down the south embankment. The north side of both locomotives had sustained damage. Lead locomotive CN 3009 was extensively damaged (Figure 3) while GECX 7371 exhibited some impact damage and scrapes. The fuel tanks on both locomotives were punctured, which resulted in the loss of a combined total of about 3500 imperial gallons (15 911 litres) of diesel fuel. The fuel was contained locally during site remediation and was subsequently cleaned up. No waterways were affected.

On train 315, the 95th to 102nd cars (inclusive) behind the head-end locomotives were derailed. The 95th and 102nd cars remained upright while the 96th to 101st cars were derailed onto their side (Figure 4). All train 315 derailed cars displayed various forms of impact damage sustained during the accident. Two empty non-DG Class DOT 111 tank cars were located in the 95th and 96th positions (UTLX 204215 and UTLX 204234). The south side of the 95th car tank shell was punctured, and the 96th car was derailed onto its side but was not punctured. Although it is not unusual for empty tank cars to have residue product remaining inside, no product was released during the accident.

1.7 Recorded information and train 318 crew actions

Table 1 provides a summary of the events, including train 318 crew actions, based on the review of the locomotive event recorder (LER) data from train 318 lead head-end locomotive CN 3009 and the forward-facing video camera recordings from both train 318 and train 315.

Table 1. Sequence of events

Time	Train speed (mph)	Mile	Event / train 318 crew actions	Distance from Controlled Signal 504S at Mile 50.4
0903:26	30	54.29	The train horn began sounding 0.13 miles in advance of the crossing at Mile 54.22 while travelling at 30 mph and lasted 15 seconds.*	3.89 miles (20 539 feet)
0903:37	31	54.2	The head end of train 318 passed East Tower Controlled Signal 542S (Mile 54.2), which displayed a Clear to Limited indication. TO was on, the throttle was in position 5, and the air brake pipe pressure was 89 psi.	3.8 miles (20 064 feet)
0904:27	33	53.75	The train horn began sounding 0.26 miles in advance of the crossing at Mile 53.58 while travelling at 33 mph and lasted 27 seconds.	3.35 miles (17 688 feet)
0905:58	39	52.83	The train horn began sounding at the crossing at Mile 52.89 while travelling at 39 mph and lasted 3 seconds.	2.43 miles (12 830 feet)
0906:54	42	52.2	The head end of train 318 passed Advance Signal 522S (Mile 52.2), which displayed a Clear to Stop indication. TO was on, the throttle was in position 7, and the air brake pipe pressure was 89 psi.	1.8 miles (9504 feet)
0907:36	44	51.7	The LE turned off the headlight for a meet with train 315. The train 318 TO was on, the throttle was in position 6, and the air brake pipe pressure was 89 psi.	1.3 miles (6864 feet)
0908:22	46	51.13	The head-end locomotives of train 318 and train 315 met just past a farm crossing (Mile 51.3). The train 318 TO was on, the throttle was in position 6, and the air brake pipe pressure was 89 psi. The headlight remained off and the horn was not sounded.	0.73 miles (3854 feet)
0908:33	46	50.99	The LE disengaged TO.	0.59 miles (3115 feet)
0908:34	46	50.98	The LE reduced the throttle to idle and initiated a full service brake application (25 psi) to apply the train automatic air brakes. The air brake pipe pressure was 88 psi.	0.58 miles (3062 feet)
0908:58	43	50.68	The automatic air brake handle was placed into the suppression position. The throttle remained in idle, and the air brake pipe pressure was 68 psi.	0.28 miles (1478 feet)
0909:00	39	50.66	The locomotive IB were initially applied. The throttle remained in idle, the air brake pipe pressure was 67 psi, and the locomotive brake cylinder pressure was 1 psi.	0.26 miles (1373 feet)
0909:06	39	50.59	The locomotive IB were fully applied. The throttle remained in idle, the air brake pipe pressure was 64 psi, and the locomotive brake cylinder pressure was 70 psi.	0.19 miles (1003 feet)
0909:08	39	50.57	The LE activated the IDU, which initiated an emergency brake application from the SBU on the EOT. The throttle remained in idle, the air brake pipe pressure was 63 psi, the locomotive brake cylinder pressure was 70 psi, and the EOT brake pipe pressure was 73 psi.	0.17 miles (897 feet)
0909:17	34	50.48	Train 318 air brake pipe pressure dropped to 0 psi at the head end and tail end, which indicated that the train emergency brakes were fully applied.	0.08 miles (422 feet)
0909:26	27	50.4	Train 318 passed Controlled Signal 504S (Mile 50.4).	0 miles
0909:30	23	50.37	The lead locomotive (CN 3009) of train 318 side-collided with the 95th car on train 315 and derailed.	−0.03 miles (−158 feet)
About 0910:00	0	50.33	The derailed lead locomotive (CN 3009) of train 318 came to rest.	−0.07 miles (−370 feet)

* For trains travelling in excess of 44 mph, Rule 14(l) of the Transport Canada–approved Canadian Rail Operating Rules requires the locomotive horn to be sounded, from the whistle post positioned ¼ mile in advance of a public crossing until the crossing is fully occupied, by using 2 long, 1 short, and 1 long whistle. For trains travelling 44 mph or less, the horn sounding must provide at least 20 seconds of warning prior to entering the crossing.

1.7.1 Locomotive voice and video recorders

The use of in-cab locomotive voice and video recorders (LVVR) is an objective and reliable method of more clearly determining the role that human factors, such as crew intra-cab communication, distraction and fatigue, may play in a railway occurrence. Although TC has developed the Locomotive Voice and Video Recorder Regulations that identify the technical requirements for the LVVR equipment and the privacy protections for employees, the new LVVR Regulations will not fully come into force until 02 September 2022.

Because there was no in-cab LVVR in use, the events in the cab could not be immediately confirmed and the train’s process through Signal 504S, which displayed a Stop indication, could not be quickly explained.

1.8 Train braking systems

Locomotives are equipped to manage 2 air brake systems: the train automatic brakes and the locomotive IB.

The automatic brake system applies the brakes to each car and locomotive on the train, and is normally used for service brake applications and emergency brake applications during train operations to slow and stop the train.

The locomotive independent air brake system applies brakes only on the locomotives. It is primarily used to control locomotive speed when switching, to control or stop a train when travelling below 15 mph, and to stop locomotive wheel slips. The IB is generally not used during main line train operations.

Each freight car is equipped with a service brake valve and an emergency brake valve. A car’s air brake system is further equipped with an accelerated application valve (AAV) and a quick service feature that directly exhausts air brake pipe pressure and provides a faster service brake application.

CN 3009 is a General Electric model ET44AC locomotive built in August 2015, capable of producing up to 4400 HP. It is equipped with train controls placed on a control stand located to the left of the LE seat (Figure 5). The automatic brake handle is located on the left side of the control stand and is identified by the red handle.

1.8.1 Automatic brakes (service brake application)

A train’s automatic brake system is supplied with air from compressors located on each operating locomotive. The air is stored in the locomotive’s 2 main reservoirs. Number 2 main reservoir supplies approximately 90 psi of air to a brake pipe that runs along the length of the entire train, connecting to each locomotive and individual car. During operation, the locomotive compressors charge the train air brake pipe as needed. Air pressure reduction within this brake pipe activates the brakes on the entire train.

To make a service brake application, an LE moves the automatic brake handle to the desired position (Figure 6).

Internally, the handle positions are notched so that there is a natural stop at each position; additional effort is needed to move the handle to the next position. LEs are trained to place a train into emergency by moving the automatic brake handle to the right, as far as it will go, until it encounters a stop.

To activate the air brakes, air is removed from the brake pipe. As each car’s service air brake valve senses the pressure reduction, it allows air to flow from a reservoir located on each car into that car’s brake cylinder, applying the brake shoes to the wheels.

To release the brakes, the LE moves the automatic brake handle to the release position. This causes air to flow from the No. 2 main reservoir on the locomotive into the brake pipe, restoring pressure to 90 psi throughout the train air brake pipe. Subsequently, as each car senses an air brake pipe pressure increase, its service air brake valve allows air to be released from its brake cylinder, and the brake shoes are removed from the wheels.

1.8.1.1 Split-service brake application

When making a service brake application, CN’s LEs are trained to use a split-service brake application to take advantage of the freight car air brake AAV and quick service feature. A split-service brake application requires an initial minimum reduction of 7 psi in the brake pipe, which activates the AAV and quick service feature on the freight car air brake valves. The LE monitors the IDU in the locomotive cab and once air pressure begins to reduce at the EOT, the LE makes a second reduction to complete the service brake application to the desired level, up to a total air pressure reduction of 25 psi in the brake pipe.

If an LE goes directly to a full service brake application, the AAV action and quick service feature that directly exhaust air brake pipe pressure locally at each car are bypassed. When these features are bypassed, the air brake pipe pressure exhausts only from the control valves on the head-end and remote locomotives. This subsequently delays the air brake pipe pressure reduction and corresponding service brake application and brake cylinder pressure build-up.

1.8.2 Locomotive independent brakes

The locomotive IB are also supplied with air from the No. 2 main locomotive air reservoir. When an IB application is required on a 6-axle road locomotive, an LE moves the IB handle, which, in turn, injects up to 72 psi of air pressure directly from the No. 2 main reservoir into the brake cylinders of the locomotive. This causes the brake shoes to apply to the wheels.

To release the IB, an LE moves the IB handle to the release position. This causes air to be released from the locomotive’s brake cylinders, and the brake shoes are removed from the wheels.

1.8.3 Emergency brake application

An emergency brake application is the maximum application of a train’s air brakes, during which the brake pipe pressure is rapidly reduced to 0 psi, either from a separation of the brake pipe or train crew-initiated action. In either case, once a train goes into emergency, the air brake pipe pressure reduction propagates throughout the train air brake pipe. As the air brake pressure reduction propagates, the air is directly exhausted from the locomotive brake valves and locally at each car through its emergency brake valve. The exhausting air makes a distinct sound that is clearly audible within a locomotive cab. As well, the pneumatic control switch (PCS) open light illuminates (red) on the locomotive main screen display, the tail-end air brake pipe pressure indicates 0 (red), the equalizing No. 2 reservoir pressure indicates 0 (red), the locomotive brake pipe pressure indicates 0 (red), a message indicating the emergency brakes have been applied appears (yellow) and, on the occurrence locomotive, the overhead cab light illuminates (red).

The CN Locomotive Engineer Operating Manual^{Footnote 28}provides train handling instructions for LEs. Regarding the application of the emergency brakes, section G2.8 Emergency Brake Application states the following in part:

In response to any emergency brake application (including UDE):^{Footnote 29}

1. The emergency toggle switch on the IDU must be activated to initiate an emergency application from the rear of the train,
2. The throttle must be moved to IDLE, and
3. The automatic brake valve handle must remain in EMERGENCY position until the train stops.

After the train has stopped, wait for the PC [power cut out] to reset (60 to 90 seconds). When safe to do so, move the automatic brake valve to the RELEASE position.

To prevent wheel slide or excessive in-train (buff or draft) forces during an emergency brake application, use the following procedure to regulate locomotive brake cylinder pressure:

Head-End Stretched

1. (i)  Until the train brakes become effective, keep the independent brake handle in the RELEASE position while actuating to maintain head-end slack stretched.

1.8.3.1 Company follow-up for train emergency brake applications

When a CN train goes into emergency, whether train-initiated or crew-initiated, select railway managers receive instant notification, and the information from the train is downloaded. This allows managers to react immediately to a potential emergency and evaluate the operation of the train.

1.8.4 Penalty brake application

A penalty brake application is similar to a full service brake application but occurs as a result of a “penalty” applied by the system. This type of braking reduces the brake pipe pressure to 0 psi, requiring a moving train to stop and recharge the brake pipe in order to recover from the penalty brake application.

Penalty brake applications can be initiated when a locomotive overspeed^{Footnote 30} occurs, or when an LE fails to respond to the reset safety control (RSC) alert^{Footnote 31} and does not reset the RSC. A penalty brake application reduces the air brake pipe pressure to 0 psi, but does not deplete all of the air in each car’s reservoir.

1.8.5 Suppression

The suppression position is at a specific location on the locomotive’s automatic brake valve handle. It provides a full service brake application of the brake pipe pressure, since the brake valve handle has already moved through the full service zone in order to reach this position. The propagation rate of the air pressure reduction through the brake pipe when the brake valve handle is placed in the full service zone or the suppression position is the same; both are less than the propagation rate during an emergency application of the brakes. Suppression is used to suppress or recover from penalty brake applications.

As a result of a penalty brake application, a train is brought to a stop. The automatic brake handle must then be placed and left in the suppression position for 60 seconds in order to recover from the penalty brake application and be able to charge the brake system once again.

When operating with a fully charged brake pipe, placing the automatic brake handle into the suppression position during regular train operations does not provide any additional braking force compared to a full service brake application. At no time should suppression be used when a train is moving.

1.9 Stopping distance calculations and observations

The LER data were reviewed, and braking calculations were made to verify the braking function of train 318 and estimate various stopping distances. It was determined that the train 318 air brakes were fully functional at the time of the accident.

Advance Signal 522S (Mile 52.2), which displayed a Clear to Stop indication, and Controlled Signal 504S (Mile 50.4), which displayed a Stop indication, are located 9504 feet apart.

1.9.1 Estimated stopping distances using alternate train handling scenarios

Additional calculations provided estimated stopping distances for train 318 for various train handling techniques to bring the train to a stop from the speeds of 46 mph and 39 mph respectively, if no accident occurred.

The estimated braking distances are conservative and based on the make-up (train length, total tonnage and distributed power [DP] configuration) of train 318. The calculations are based on reasonable assumptions using industry-wide accepted air brake stopping distance formulas. The calculations assume there was an initial air brake pipe (BP) pressure of 89 psi and include estimated air brake propagation time throughout the train as well as brake cylinder build-up time for each car.

The calculations also assume that the mid-train DP remote locomotive would propagate either a service or an emergency brake application signal forward and backward, as it receives the radio signal from the lead locomotive. The air brake application on the front half of the train ahead of the DP remote locomotive would take the least amount of time to activate as air propagates backward from the lead locomotive and forward from the DP remote locomotive simultaneously.

For service brake applications, the following assumptions were made:

• Each car takes approximately 0.30 seconds to develop full brake cylinder pressure for a full service application.
• The service air brake propagation signal travels throughout the air brake pipe at about 600 feet/second.

For a split-service brake application, the following assumptions were made:

• The split-service brake application would activate the AAV and quick service feature of the freight car brakes, which would reduce brake cylinder build-up time slightly to about 0.25 seconds per car.
• The service air brake propagation signal travels throughout the air brake pipe at about 600 feet/second.

For emergency brake applications, the following assumptions were made:

• Each car takes approximately 0.1 seconds to develop full brake cylinder pressure.
• The emergency air brake propagation signal travels throughout the air brake pipe at about 900 feet/second.

Assumptions for the calculations used for estimating stopping distances are outlined in the scenarios below:^{Footnote 32}

1. A full service brake application (air brake pipe pressure reduction of 25 psi) is activated using the automatic brake handle only. The estimated stopping distances assume a total of 32.5 seconds for air brake propagation time throughout the train and the brake cylinder build-up time for each car.
2. A split-service automatic brake application requires an initial minimum reduction of 7 psi to activate the AAV and quick service feature on the freight car air brake valves, followed by a further reduction of 18 psi for a total air brake pipe pressure reduction of 25 psi. The estimated stopping distances assume a total of 28.75 seconds for air brake propagation time throughout the train and brake cylinder build-up time for each car.
3. A full emergency brake application is performed using the automatic brake handle in conjunction with activating the toggle on the IDU to initiate a simultaneous emergency brake application from the EOT.^{Footnote 33} Because the emergency application is activated from 2 locations, 1 on either end of the train, the air brake propagation time throughout the train and the brake cylinder build-up time for each car is reduced to 8.4 seconds of total activation time.

The estimated stopping distances, for scenarios 1 to 3, from 46 mph and 39 mph respectively, are contained in Table 2.

Table 2. TSB estimates of stopping distances for train 318, by braking assumption and train speed

Scenario	Braking assumption	Estimated time to activate full brake (seconds)	Speed (mph)	Estimated stopping distance (feet)
1	Full service brake application (25 psi BP reduction)	32.5	46	4744
			39	3778
2	Split-service brake application (initial reduction of 7 psi followed by a further reduction of 18 psi for a total reduction of 25 psi)	28.75	46	4416
			39	3499
3	Emergency brake application with head-end and IDU EOT activation	8.4	46	2316
			39	1760

1.10 Rivers Subdivision and track information

The CN Rivers Subdivision extends from Mile 0.0 at Winnipeg, westward to Mile 280.30 at Melville, Saskatchewan. It is part of one of CN’s main traffic corridors and consists of both double and single track. Train movements on this subdivision are governed by the centralized traffic control (CTC) method of train control, as authorized by the CROR, and are dispatched by an RTC located in Edmonton. A total of 23 wayside inspection systems (hot box detectors) and 2 dragging equipment detectors are located at various intervals along the subdivision.

Traffic on the Rivers Subdivision consists of an average of 35 freight trains and 1 passenger train per day. It is one of the busiest subdivisions on the CN system and transports a significant amount of DG, about 60% of which are Class 3 flammable liquids. Due to the number of car loads of DG transported on the Rivers Subdivision, it meets the criteria to be designated as a “key route.” The total annual traffic (in millions of gross tons per mile) and the DG traffic (in car loads) on the subdivision are listed in Table 3. The DG traffic that traverses the Rivers Subdivision includes over 150 different DG products.

Table 3. Annual traffic on the Rivers Subdivision in the vicinity of Nattress

Year	Total annual traffic (millions of gross tons per mile)	Total DG traffic (car loads)
2015	107	184 824
2016	104	89 818
2017	117	97 314
2018	123	144 789

Data source: CN

This section of track meets the criteria of Class 4 track as defined by the TC–approved Rules Respecting Track Safety, also known as the Track Safety Rules (TSR). The authorized track speed for Class 4 track is 60 mph for freight trains and 80 mph for passenger trains. In the vicinity of the accident, the train speed listed in the CN Rivers Subdivision timetable is 50 mph for freight trains and 60 mph for passenger trains. Key trains are restricted to a maximum speed of 50 mph while operating on main track. There is a permanent slow order of 45 mph in effect between Mile 49.5 and Mile 51.0 for both freight and passenger trains. At the time of the accident, there were no other slow orders in place.

In the vicinity of the accident, the rail is 136-pound continuous welded rail. The track structure was inspected in accordance with regulatory and company requirements and was in good condition.

1.10.1 Track configuration and signal conspicuity in the vicinity of the accident

The area of the accident is primarily double-track territory. Equilateral turnouts (with a speed limit of 45 mph) are located at Mile 50.37 and Mile 50.1 in order to transition the parallel north and south tracks to a single main track that traverses the Assiniboine River. Signals 504S and 504N at Nattress are 2-aspect signals permanently positioned on either side of the track (Figure 7).

The signals stand about 15 feet higher than the surrounding area and are designed to be relatively eye-level for an approaching eastbound train crew when the approach to the signal is unobstructed. A dark backing or target is located behind the signal aspect to aid signal indication visibility in bright ambient lighting conditions.

The westward facing signals display indications that govern eastbound movements accessing the equilateral turnout at Mile 50.37 (Figure 8).

From about Mile 50.84 to Mile 50.51 (approximately 1700 feet), the track curves to the left (in the direction of travel for train 318) as the track nears the equilateral turnout at Nattress (Mile 50.37). For an eastbound train operating on the south main track with an unobstructed view, the signal indications at Signal 504S (Mile 50.4) are normally visible from an estimated 1600 feet to the west (Mile 50.7). Beyond 1600 feet, the signals become obscured by brush and foliage along the railway right-of-way.

When the adjacent north track is occupied by a train, the combination of the adjacent train and track curvature obscures the signal indications at Signal 504S (Mile 50.4) up to an estimated 900 feet to the west (Mile 50.57).

1.11 Centralized traffic control system

Train control systems provide for safety during the operation of trains, during track work, and during maintenance on one or more main tracks. In particular, CTC uses track circuits interconnected with signals displayed in the field to control train movements. While the basic fundamentals of CTC are over 100 years old, there have been some improvements over the years, such as newer circuitry. CTC is currently the most advanced method of rail traffic control used by railways for main track train operations in Canada.

A “signal” is the physical location of the signal mast. Each individual light on a signal mast is an “aspect.” The combination of aspects displayed on a signal mast form the “signal indication” that governs the train movement. At each signal location in the field, CTC track circuitry and associated systems allow for the display of a variety of signal aspects. The CTC system displays a combination of red, yellow, green, and sometimes flashing signal aspects to train crews. Signal indications are differentiated by colour, position of colours, flashing of the lights, or combinations thereof.

The CTC system has several types of signals:

• Controlled signals are fixed signal installations situated in the field at the entrance to a block to govern a movement entering or using that block. These signals display a Stop indication until requested to display a less restrictive indication by the RTC. The signal system determines how permissive^{Footnote 34} each signal indication will be.
• Advance signals are fixed signal installations used in connection with one or more other signals to govern the approach of a movement to that signal. If an advance signal displays a Clear to Stop indication, it is, in effect, informing train crews of the next potential signal indication.

Signal indications are used to control train movements by visually conveying advance information to train crews about such things as authorities, speed, and other limits within which the train may operate.

Signal indications identify if the block ahead is occupied by another movement, and provide protection against some conditions, such as an occupied block, broken rail, or a switch left open. Signal indications are progressive: the preceding signal indicates what the next signal will potentially display.

Signal indications are displayed on an RTC screen as either a Stop or a permissive indication. On an RTC screen, an advance signal located between controlled signals is actuated by the presence of a train; however, the system does not differentiate between the direction of the train occupying the block. While the CTC system allows the RTC to monitor a train’s progress along blocks in a subdivision, the train’s exact location within a specific block is not displayed on the RTC screen. Only the occupied block^{Footnote 35} that the train is in is displayed.

If a train is about to pass beyond an authorized point, the CTC system does not provide any advance warning to either the train crew or the RTC. CTC also does not provide automatic enforcement to comply with speed restrictions in order to slow or stop a train before it passes a restrictive signal.

For this occurrence, the signal logs were reviewed to determine the sequence of signals for train 318. The investigation confirmed that the signal system functioned as designed.

1.12 Canadian Rail Operating Rules governing signals

The following CROR rules provide context for compliance with signals displayed in the field.

CROR Rule 33 states the following:

If speed requirements for their movement are exceeded, crew members must remind one another of such requirements. If no action is then taken, or if the locomotive engineer is observed to be non-responsive or incapacitated, other crew members must take immediate action to ensure the safety of the movement, including stopping it in emergency if required.^{Footnote 36}

CN Special Instructions to CROR Rule 33 further state:

Speeds indicated are maximum authorized speeds between locations named, but do not modify any rule or instruction that may require a lower speed. Maximum speed must be maintained to the extent possible, consistent with safety and efficiency. Unnecessary delays must be avoided.^{Footnote 37}

CROR Rule 34 (Fixed Signal Recognition and Compliance) states the following:

1. (a) The crew on the controlling engine of any movement and snow plow foremen must know the indication of each fixed signal (including switches where practicable) before passing it.
2. (b) Crew members within physical hearing range must communicate to each other, in a clear and audible manner, the indication by name, of each fixed signal they are required to identify. Each signal affecting their movement must be called out as soon as it is positively identified, but crew members must watch for and promptly communicate and act on any change of indication which may occur.

   The following signals/operating signs must be communicated:

   • (i) Block and interlocking signals;
   • (ii) Rule 42 and 43 signals;
   • (iii) One mile sign to interlocking;
   • (iv) One mile sign to hot box detector;
   • (v) Stop sign;
   • (vi) OCS begins sign;
   • (vii) Red signal between the rails;
   • (viii) Stop signal displayed by a flagman;
   • (ix) A switch not properly lined for the movement affected;
   • (x) One mile to Cautionary Limit Sign;
   • (xi) Cautionary Limit Sign;
   • (xii) Advance Permanent Slow Order (PSO) Signs; and
   • (xiii) Zone speed Signs where there is a reduction in speed from the previous zone
3. (c) If prompt action is not taken to comply with the requirements of each signal indication affecting their movement, crew members must remind one another of such requirements. If no action is then taken, or if the locomotive engineer is observed to be incapacitated, other crew members must take immediate action to ensure the safety of the movement, including stopping it in emergency if required.^{Footnote 38}

CROR Rule 34 does not specify which employee should be the first to call out the signals during a trip.

1.13 Signal indications

Train crews are required to understand all signal indications specified in the CROR and control their trains accordingly. Crew members are expected to know their operating territory, including the location of individual signals. This knowledge is used to facilitate the detection of signals and to help recognize the presence of an imperfectly displayed signal or absence of a signal.

Train crews must communicate their understanding of signal indications displayed in the field to those within hearing distance in the locomotive cab, and take appropriate action to comply with the indication. According to CROR Rule 34, if there is uncertainty, the crew must take immediate action to ensure the safety of the movement, including stopping it in emergency if required.

In this occurrence, eastbound train 318 was proceeding on the south main track when it encountered a progression of 3 signal indications displayed in the field that governed the approach to Nattress:

• The first signal in the progression was 2-aspect Controlled Signal 542S at Mile 54.2, which displayed a Clear to Limited indication (CROR Rule 406). The signal indication identified that the train could proceed, approaching the next signal at limited speed not to exceed 45 mph.
• The next (second) signal in the progression was single-aspect Advance Signal 522S at Mile 52.2, which displayed a Clear to Stop indication (CROR Rule 411) that identified that the train could proceed but must prepare to stop at the next signal.
• The final (third) signal in the progression was 2-aspect Controlled Signal 504S at Mile 50.4, which displayed a Stop indication (CROR Rule 439) because westbound train 315 was still occupying the track ahead.

The signal indications and associated CROR rules that are relevant to this occurrence are detailed in Table 4.

Table 4. Signal aspects and associated CROR rules relevant to this occurrence (Source of diagrams and alternative text: Canadian Rail Operating Rules, General Description and Location of Fixed Signals)

Signal aspects displayed	CROR rules
Image	Rule 405—Clear Signal—Proceed (at track speed)
Image	Rule 406—Clear to Limited—Proceed, approaching next signal at limited speed (not exceeding 45 mph)
Image	Rule 411—Clear to Stop—Proceed, preparing to stop at next signal
Image	Rule 439—Stop—Unless required to clear a switch, crossing, controlled location, or spotting passenger equipment on station platform, a movement not authorized by Rule 564 must stop at least 300 feet in advance of the Stop signal.

1.14 Locomotive Trip Optimizer

Trip Optimizer (TO) is a closed-loop energy management system^{Footnote 39} that functions similarly to a car’s cruise control system. TO is an industry initiative driven primarily by operational efficiencies. There is no regulatory oversight or rule that governs the use of TO.

TO uses complex algorithms derived from information such as global positioning system (GPS) location, track profile and train characteristics to maintain track speed and reduce train crew errors, and to maximize fuel conservation and reduce in-train forces, all of which contribute to either improvements in safety or operational efficiencies. Once TO has been activated by an LE, the LE is no longer manually controlling the speed of the train. TO automatically controls the throttle and dynamic braking functions while the LE monitors the TO running screen on the Smart Display Integrated System (SDIS) in order to ensure the train’s safe operation and to resume manual control when required. TO is activated and operated through the LE display screen and the screen soft keys. The display screen contains a rolling track map showing the exact location of the train and approaching track features.

TO remains engaged until the LE transitions to manual control mode either in planned areas of manual control or in response to any event that requires the LE to take control to stop the train, such as when operating on a restrictive signal.

TO is disengaged below 12 mph. It neither receives nor responds to any signal indications.

1.14.1 Canadian National Railway Company Trip Optimizer Procedure Guide

The operating requirements in CN’s Trip Optimizer Procedure Guide^{Footnote 40} specify the following:

When locomotive engineers are trained in TO operation and circumstances permit, TO must be activated and the train operated in Auto Control. However, if an employee is receiving locomotive engineer training, the train must be operated in Manual Control, unless the training is specific to the TO system. Crews must advise the RTC when operating in Auto Control.

As the locomotive engineer, you are responsible for all braking. You must maintain full vigilance and apply situational awareness at all times to ensure the train is operating within safe limits.

You are responsible for controlling the train through any region in which the train is required to stop or operate at a speed less than that given through permanent or temporary speed restrictions.

TO does not consider signal indications or limits of authority. Compliance with all operating rules and safe train handling procedures remains the responsibility of the locomotive engineer.

TO allows Trip Initialization while the locomotive is moving. During this time, you must always be aware of changing conditions outside the cab related to collision avoidance, authority limits and safe train operation.

You must remain cognizant of track signals, train conditions, grade and environmental conditions to ensure that the required stopping distance of the train is preserved.

Anytime the train is operating on a restrictive signal indication^{Footnote 41} or is approaching limits of authority, it’s the locomotive engineer’s responsibility to take manual control of the train to meet the reduced speed conditions.

TO does not provide the ability to ensure required stopping distances are preserved. Failure to apply proper vigilance and to provide for adequate stopping distances may result in a train movement passing a signal.

Any anomaly detected by the locomotive engineer which impacts safety shall be a cause for immediate termination of TO use.

1.14.2 Trip Optimizer use on the Rivers Subdivision

When TO is available for a particular subdivision, such as the Rivers Subdivision, it is the preferred method of train operations at CN. Employees are expected to use the system when operating locomotives equipped with TO on subdivisions that are mapped for its use.

To enable the system to operate on the Rivers Subdivision, the track profile, track speeds, switch locations and other subdivision-specific information are pre-loaded into TO, while train-specific information (e.g., train length and weight, as well as temporary speed restrictions) is uploaded into the system for each individual train.

The train 318 LE had used TO on the 9 previous eastbound trips in the month preceding the collision. During these previous eastbound trips, the train 318 LE had always received permissive signals from West Tower (Signal 562) to, and through, Nattress.

1.15 Human factors issues associated with train operations

In railway operations, a variety of human factors issues can have an influence on the outcome of any given situation. In a complex system, such as rail transportation, even the most rigorous set of rules may not cover every contingency and interpretation by individuals. In addition, even motivated and experienced employees are subject to the normal slips, lapses,^{Footnote 42} and adaptations^{Footnote 43} or other mistakes that characterize human behaviour.

1.15.1 Situational awareness

Situational awareness is the perception of the elements in the environment, the comprehension of their meaning, and the projection of their status in the future.^{Footnote 44} In a dynamic environment, situational awareness requires extracting information from the environment, integrating this information with relevant internal knowledge to create a coherent mental picture of the current situation, and using this picture to anticipate future events. Fatigue can cause lowered vigilance and situational awareness, and reduced attention span.

Shared situational awareness^{Footnote 45,Footnote 46} between an LE and a conductor depends on the extent to which the respective situational awareness of each crew member is similar. Train crew members who have a shared situational awareness can anticipate and coordinate their actions, and therefore act with cohesion and efficiency.

1.15.2 Train crew perception of signals displayed in the field

Train crew awareness of signal indications displayed in the field relies on visual detection and perception. A train crew’s accurate and timely visual perception of signals is essential for compliance. The visual perception of signal indications and the associated crew action is a sequential process involving the following steps: detect and see, identify and call, confirm indication between crew members, and adjust train speed accordingly.

Familiarity with a territory improves a train crew’s knowledge of signal locations and enables crew members to take forward-planning (proactive) measures to detect and see signals. The knowledge of signal locations in a specific territory increases with the frequency of trips. When less familiar with a territory, train crews can refer to track schematics provided by CN, which identify the location of each signal. Alternatively, signals can be detected without prior knowledge of their locations; this is considered reactive, as opposed to proactive, detection.

When signal indications are not obscured or obstructed, and there is good visibility, signal perception can be accomplished rapidly from relatively long distances. However, signal perception can be affected by a crew’s fitness for duty, distraction, as well as mental models and expectations.

1.15.3 Mental models and expectations

People use their prior experience and knowledge to rapidly categorize the situation they are experiencing, expect what is to happen next, and select an appropriate course of action based on these expectations.^{Footnote 47} In highly practiced situations, attention and expectations are often driven by a person’s existing mental model of the situation, given that previous experience will dictate what information is important and how the situation will unfold.^{Footnote 48}

Mental models are critical for effective performance in dynamic time-critical environments because they reduce the need for time-consuming evaluation of the situation and enable quick actions. However, when mental models of situations are inaccurate, they can also lead to errors in how information is perceived, making it less likely for a train crew to detect information that is opposite of what is expected, and to reassess the initial assessment.^{Footnote 49}

1.15.4 Use of Trip Optimizer

When operating a train using TO, the LE’s tasks shift from a proactive, anticipatory driving strategy, toward a more reactive monitoring strategy and lower workload.^{Footnote 50}

Low workload and monotonous tasks can lead to

• increased feelings of sleepiness and tiredness because they reduce an individual’s arousal levels.^{Footnote 51}
• a reduction in vigilance. Vigilance is associated with a state of sufficient alertness to monitor the environment effectively, with a particular emphasis on scanning for stimuli that signal a potential hazard.^{Footnote 52} Decreased vigilance has been shown to reduce the overall detection rate of critical stimuli over the duration of a task.^{Footnote 53}
• reductions in situational awareness. The U.S. Department of Transportation^{Footnote 54} compared different levels of train automation (from cruise control to full auto-pilot) and found that, for normal operations, full automation (like TO) facilitated situational awareness of the overall driving task because the automation freed up attentional resources to perform secondary tasks and fault monitoring. However, operators reported they felt out of the loop with the primary task. This indicated potential problems with respect to maintaining awareness of the primary task, especially in the presence of fatigue.

1.15.5 Authority gradient

The concept of authority gradient is universal and has been demonstrated in other transportation modes.^{Footnote 55},^{Footnote 56},^{Footnote 57} When an authority gradient exists, there is usually a difference in level of experience and/or authority between the operating crew members. In these situations, safety-compromising behaviour can be overlooked because a less experienced or subordinate employee is often reluctant to question the actions of a more senior employee.

Railway operations are governed by rules and instructions that place equal responsibility for safe train operations on all crew members. However, when an authority gradient exists between crew members in a locomotive cab, intra-cab crew communication can fail and lead to adverse outcomes. To encourage open lines of communication among crew members, strategies such as crew resource management (CRM) practices can be used.

1.16 Crew resource management

Crew resource management (CRM) is understood to mean the effective use of all available resources—human, hardware, and information—to conduct operations safely and efficiently. CRM includes skills, abilities, attitudes, communication, situational awareness, problem solving, and teamwork.

CRM principles include emphasizing critical cognitive and interpersonal skills with the objective of reducing human error. When operating in a 2-crew environment, crew members must successfully interact with each other, their equipment, and their environment to effectively manage threats, errors, and unexpected events that may be encountered.

From a CRM standpoint, effective communication plays a critical role in the crew’s shared understanding of the situation. However, communication skills require practice and reinforcement to be effective, particularly during periods of high workload or an unexpected situation.

Modern CRM programs highlight barriers to effective communication and provide multiple communication strategies that allow individuals to select the most appropriate strategy, depending on the severity of the situation, the time available, and the other people involved in the communication process.

1.16.1 Closed-loop communication

Closed-loop communication is a technique used to avoid misunderstandings and requires that, when the sender communicates a message, the receiver repeats the message back and the sender confirms whether the message has been received accurately.

A TSB marine investigation report^{Footnote 58} recently highlighted the importance of closed-loop communication that incorporates some CRM fundamentals. The investigation identified that the crew relaxed their adherence to operational guidance for navigation, resulting in helm orders that were informal and communication that was not closed-loop, which likely contributed to navigation errors.

In the present occurrence, the investigation determined that communications between the 2 crew members were not always closed-loop, as the callouts by the conductor were not always acknowledged or repeated back by the LE, and the conductor did not confirm that the LE had understood the communication.

1.16.2 Crew resource management in the air and marine transportation sectors

Flight crew actions need to be based on a common understanding of the current state of the aircraft, the intended flight plan, and the threats to crew and flight activities in order to perform in a coordinated, efficient, and safe manner. This common understanding between the crew members is referred to as team or shared situational awareness.^{Footnote 59},^{Footnote 60} When this understanding is consistent, crews are better able to effectively anticipate and coordinate their actions to achieve their common goal.

Shared situational awareness is developed and maintained by a crew through a number of discrete and continuous behaviours. These behaviours include in-flight briefings, and identification of key points in the flight, such as those communicated during descent, approach, and landing checklists. These activities are carried out at planned checkpoints to describe current state and future plans, and to provide an opportunity for checking that all crew members have a common understanding.

Continuous behaviours include threat and error management (TEM), callouts of changes of aircraft state and instrument setting or mode, and communication of changes to plans. These behaviours ensure that information and state changes are communicated between crew members to update the shared situational awareness on an ongoing basis.

The 3 core elements of TEM in air transportation are threats, errors, and undesired aircraft states. Every flight has hazards that the crew must manage. These hazards, referred to as threats, increase flight risks and may include environmental threats (adverse weather conditions, runway contamination, etc.) or operational threats (short runways, etc.). TEM stresses the principles of anticipation, recognition, and recovery^{Footnote 61} and is based on the proactive detection of threats that could reduce safety margins. Crews can establish countermeasures during the planning stage or during flight, modifying the plan according to circumstances.

Effective error management is associated with specific behaviours by the flight crew, the most common being vigilance, a propensity to ask questions or provide feedback, and assertiveness. Although threats exist and errors occur during most flight segments, they are rarely accompanied by serious consequences, because the crew is managing them effectively.

Transport Canada Civil Aviation (TCCA) has developed updated CRM training standards, which were implemented in the fall of 2019. Under these new standards, air operators are required to provide contemporary CRM training to flight crews, flight attendants, dispatchers, flight followers, ground crew, and maintenance personnel, on an initial and annual basis.

In the marine industry, bridge resource management (BRM) is the effective management and use of all resources, human and technical, available to the bridge team to ensure the safe completion of the voyage. BRM encompasses skills, knowledge, and strategies on effective communication, workload management, problem solving, decision making, teamwork, and situational awareness, especially during critical operations.

Effective communication is a key concept of BRM because it helps to establish a shared mental model among the bridge team. When the bridge team has a shared understanding of how manoeuvres will proceed, team members are able to work together to accomplish these manoeuvres, identify operational or human errors, and intervene as required.^{Footnote 62}

1.16.3 Crew resource management in the rail industry

Following a 1998 collision between 2 freight trains, the U.S. National Transportation Safety Board (NTSB) recommended that a number of railway stakeholders, including the regulator, railway companies, industry associations, and labour organizations, collaborate to develop and require CRM training in the railway industry. That training would cover, at a minimum, crew member proficiency, situational awareness, effective communication and teamwork, and strategies for appropriately challenging and questioning authority.^{Footnote 63}

Subsequent to this recommendation, the U.S. Federal Railroad Administration (FRA), in cooperation with academic and industry partners, developed and piloted rail CRM training.^{Footnote 64} Initial assessment of the pilot training showed increases in knowledge and improved attitudes toward CRM principles.^{Footnote 65}

CRM training focuses on providing crews with the interpersonal skills required to carry out their tasks safely and “typically consists of an ongoing training and monitoring process through which personnel are trained to approach their activities from a team perspective rather than from an individual perspective.”^{Footnote 66}

A 2015 study entitled Human Factors Analysis of “Missed Signals” in Railway Operations,^{Footnote 67} when addressing team training, indicated that CRM training

emphasizes non-technical skills such as communication, briefing, backing up behaviour,^{Footnote 68} mutual performance monitoring, team leadership, decision making, task-related assertiveness (e.g., a junior operator speaking up to a dominant colleague), and team adaptability.

The report went on to state that CRM training includes aspects of team situational awareness such as “perception” and “information sharing, coordination and crosschecking information” and instructed crews to “become vigilant for losses of [situational awareness]; both one’s own and by others.”

A review of the adaptation of CRM principles outside of aviation in 2010 found that, in the North American railway industry, “interest in CRM training principles remains sporadic.”^{Footnote 69} The review also described voluntary initiatives by specific railways to implement CRM training, as well as industry initiatives to develop training materials for railways to use. For example, the review indicated that Canadian Pacific Railway Company (CP) implemented a CRM training program targeting new-hire conductors and operating personnel in 1999.

In contrast to the air and marine transportation sectors, TC has not established a standard for either initial or recurrent CRM training for Canadian railway operators. Additionally, CRM training is not mandatory for the rail industry in the U.S.

1.16.3.1 Crew resource management training at Canadian Pacific Railway Company

CP required all existing operating employees to take CRM training when it was initially introduced in 1999. The CRM training program has been regularly provided to new operating employees since then. It consists of a 1-hour presentation during the first week of the classroom portion of the conductor program and is 1 of 11 modules presented on the same day. There is no practical component to CP’s CRM training.

The course objective is to provide “a greater awareness of the concepts, philosophies, and objectives of CRM [to] enhance safety, leading to the prevention of incidents and accidents as well as encourage commercially efficient train operations.”^{Footnote 70} The CRM training is divided into the following fundamental principles:

• human factors
• situational awareness
• technical proficiency
• communication
• teamwork

The training provides tools to help employees maintain situational awareness, which will contribute to a safe work environment by ensuring that employees are aware of their surroundings at all times. One of the tools to maintain situational awareness emphasizes peer-to-peer communication between crew members. The training states:

Crews who communicate well will commit fewer errors because talking to each other enables them to make more accurate assessments of problems, and they are more coordinated in their actions for dealing with them.^{Footnote 71}

Further, CP’s CRM training presentation states the following:

Job briefings are a critical step in defining your tasks and responsibilities, which will allow you to plan your work and will contribute to your situational awareness.^{Footnote 72}

CP does not provide formal dedicated recurrent CRM training to its operating employees when they requalify.

1.16.3.2 Canadian National Railway Company’s assessment of communication and coordination during conductor training

CN does not provide conductors with formal rail CRM training. However, the conductor trainee evaluation form used at CN includes behavioural indicators to help trainers assess communication and coordination among crew members. For example, the form sets out the expectation that the conductor trainee will participate in job briefings and will have a clear understanding of tasks to be performed and safety hazards to be identified.

With respect to peer-to-peer communication between crew members, the form describes the expectation that a conductor trainee will communicate in specific situations (e.g., derails applied or removed, switches lined, hand brakes applied), and will participate in ongoing job briefings, and communicate restrictions and changes in plans. The form also includes an overall assessment of initiative, confidence, and cooperation with co-workers.

In 2017, as part of the CN conductor training program, CN began delivering a course called “Looking out for each other,” which has some elements of CRM and is also part of CN’s conductor requalification program delivered every 3 years. While the CN training is insightful and well structured, it is broadly focused and does not specifically deal with train crew interaction within a locomotive cab or the authority gradients that may exist in that environment.

1.16.3.3 VIA Rail crew training

Since 2013, VIA Rail Canada Inc. (VIA) has been providing its locomotive engineers with a course known as locomotive cab awareness, followed by recurrent training every 3 years. The objective of the course is to improve safety by providing locomotive engineers with the principles of CRM.

1.16.3.4 TSB investigations related to peer-to-peer communication and crew resource management

Since 1996, the TSB has conducted 8 rail accident investigations in which ineffective CRM practices were identified as a factor that contributed to the accident.

R96Q0050 – On 14 July 1996, a Quebec North Shore and Labrador Railway (QNS&L) southbound freight train collided with the tail end of a stationary freight train at Mile 131.68 of the Wacouna Subdivision. The last 3 rail cars of the stationary train derailed and were extensively damaged. The locomotive of the moving train was extensively damaged. The LE of the moving train sustained minor injuries. The investigation determined that there was no established CRM program in use on the railway that would ensure that all persons involved were aware of the most up-to-date, accurate information concerning the movement of trains and engines.

R98V0148 – On 11 August 1998, CP freight train No. 463-11 (train 463) collided with the rear end of CP freight train No. 839-020 (train 839) at Mile 78.0 of the CP Shuswap Subdivision, near Notch Hill, British Columbia. One car on train 463 and 2 cars on train 839 derailed. There were no injuries. The investigation determined that neither the conductor nor the locomotive engineer challenged each other’s identification of signals; the authority gradient between the 2 crew members probably prevented the conductor from challenging the locomotive engineer and expressing his concerns.

R07E0129 – On 27 October 2007, the crew on CN freight train A41751-26 (train 417) operating westward on the main track of the Edson Subdivision initiated an emergency brake application approximately 475 feet from a stop signal at the west end of Peers, Alberta. The train was unable to stop prior to passing the signal and collided with eastbound CN freight train M34251-26 (train 342) that was entering the siding. As a result of the collision, train 417’s locomotives and 22 cars derailed. Ten other cars sustained damage but were not derailed. Five cars on train 342 derailed and 4 other cars sustained damage but did not derail. There were no serious injuries and no release of dangerous goods. The investigation determined that in the absence of procedures that recognize the risks inherent in an authority gradient, intra-cab communication can fail.

R07C0040 – On 22 April 2007, CP freight train 375-237 (train 375) collided with CP freight train 862-012 (train 862), derailing 5 loaded coal cars, 2 loaded grain cars, and 3 locomotives at Mile 42.55 on the Taber Subdivision. The crew from train 375 sustained minor injuries. The investigation determined that the CRM was inadequate in preventing the collision. The conductor did not remain alert to the actions of the locomotive engineer, did not remind him of the requirement to stop at the west siding switch, and did not take independent action to stop the train.

R08W0058 – On 07 April 2008, southbound CP freight train 498-07 (train 498) struck the tail end of stationary CP freight train 292-05 (train 292) at Mile 97.5 of the CP Weyburn Subdivision at Centennial Station near Ralph, Saskatchewan. Seven cars on train 292 derailed and 2 cars on train 498 derailed. In addition, 2 cars on CP freight train 497-04, which had stopped adjacent to train 292 in Centennial siding, derailed. A fire ensued involving 5 cars, 4 of which contained dangerous goods or dangerous goods residues. Local residents within a 1-mile radius of the accident were evacuated. There were no injuries. The investigation determined that when crew members do not adequately communicate and confirm understanding (for example, during close-ups), there is an increased risk that miscommunication and perception errors will go undetected, potentially leading to train collisions.

R16E0051 – On 04 June 2016, CN freight train Q11251-03 (train 112) was proceeding eastward on the Edson Subdivision when it collided at 18 mph with the tail end of train M30251-02 (train 302) at Mile 34.9 near Carvel, Alberta. No cars derailed as a result of the collision. There was minor damage to 1 empty hopper car on train 302. There were no injuries. The investigation determined that if operating employees are not trained in CRM, including how to make decisions when authority gradients are present, crew coordination and interaction may not be effective, increasing the risk of human factors–related accidents.

R17W0267 – On 22 December 2017, a CN foreman and a helper were performing switching operations at CN’s Melville Yard in Melville, Saskatchewan. The foreman was operating extra yard assignment Y1XS-01 using a remote control locomotive system when the foreman became pinned between the assignment and the lead car of an uncontrolled movement while applying a hand brake. The foreman received fatal injuries. There was no derailment and no dangerous goods were involved. The investigation determined that if crew members do not receive enhanced CRM training to develop skills in crew coordination and communication, there is an increased risk that inadequate crew communication will lead to unsafe operations.

R18H0039 – On 14 April 2018, a CP yard foreman and a CP yard helper were performing switching operations at CP’s Toronto Yard in Toronto, Ontario using a remote control locomotive system (RCLS). The yard foreman was operating yard assignment T16-13 (the assignment) when it began to roll uncontrolled eastward on the Staines connecting track. The assignment ran through the main track switch, entered the main track, and rolled uncontrolled for an additional 3 miles with the helper positioned on the head end. After the helper applied hand brakes on the 2 locomotives and on the 1st car and the assignment encountered an ascending grade, it came to a stop near Mile 192.5 of the Belleville Subdivision. There was no derailment or collision and there were no injuries. The investigation determined that if crew members who provide on-the-job training are not sufficiently familiar with the principles and practice of CRM, new employees will not receive adequate training on CRM, increasing the risk of inadequate crew communication and loss of situational awareness.

1.17 Train 318 crew information

1.17.1 Locomotive engineer

The LE on train 318 was hired by CN as a switchman/conductor on 15 April 2011. He had worked all subdivisions out of the Winnipeg terminal, including the Rivers Subdivision, and was familiar with the territory.

In July 2015, he qualified as an LE and continued to work all subdivisions out of the Winnipeg terminal. He was permanently assigned as an LE on the Rivers Subdivision in October 2018 and had been working exclusively on the Rivers Subdivision until the accident occurred.

Over a 5-year period from January 2014 to January 2019, the LE underwent 74 proficiency tests, 72 of which were compliant; 2 identified at-risk behaviours related to peer-to-peer communication and radio broadcasting requirements. Supervisors gave verbal coaching to the LE following those 2 tests.

1.17.2 Conductor

The conductor on train 318 was hired by CN on 07 November 2017 at Smithers, British Columbia, and began 7 weeks of classroom training at the CN campus training centre in Winnipeg. Following classroom training, the conductor completed 30 road trips between Smithers and Prince Rupert, British Columbia, and 15 yard assignments, and was qualified as a conductor in March 2018.

Following the completion of the conductor course, the conductor received Conductor Locomotive Operation (CLO) training. This training consisted of a 1-week in-class portion where the conductors received basic locomotive operation training, followed by a 2-week on-the-job training where they operated short distances while paired with an LE in an area where limited train handling was required. Following CLO training, the conductor had not operated a train in that capacity.

In October 2018, the conductor transferred to Winnipeg and received 8 hours of training on CN Symington Yard and the Winnipeg terminal area, and 2 familiarization trips over each of the CN Fort Frances and Rivers subdivisions. Following this, CN considered the conductor to be familiar with the territory. The conductor began working regular assignments out of the Winnipeg terminal on 04 November 2018. Between 04 November and 29 December 2018, the conductor completed 6 trips over the Fort Frances Subdivision and 31 trips over the Rivers Subdivision, including the familiarization trips.

The number and frequency of trips likely improved the conductor’s familiarity with the territory. He continued to use a job aid for the CN Rivers Subdivision that contained station names, mileages, signal locations, speeds and other relevant subdivision information. While on duty, the conductor kept the job aid open on the console and followed along while the train proceeded.

From November 2017 to January 2019, the conductor was proficiency-tested 8 times by supervisors, with no at-risk behaviours identified.

1.18 Canadian Railway Employee Qualification Standards Regulations

In Canada, federally regulated railways must abide by the Railway Employee Qualification Standards Regulations^{Footnote 73} (the regulations). These regulations establish the minimum qualifications for LEs, transfer hostlers, conductors, and yard foremen. The regulations apply to all railway employees performing the duties of the specified occupational category. The regulations contain a schedule that identifies the training requirements for each occupational category for operating crews (Table 5).

Table 5. Training requirements for operating crews, by occupational category (Source: Schedule, Section 14, Railway Employee Qualification Standards Regulations [04 April 2022], p. 7)

Subject	Locomotive engineer	Transfer hostler	Conductor	Yard foreman
Regulations No. 0-8, Uniform Code of Operating Rules	Yes	Yes	Yes	Yes
Railway Radio Regulations	Yes	Yes	Yes	Yes
Dangerous commodities	Yes	No	Yes	Yes
Train marshalling	Yes	No	Yes	Yes
Air brake systems and tests	Yes	No	Yes	Yes
Locomotive operation	Yes	Yes	No	No
Train handling	Yes	No	No	No
Freight car and train inspection	Yes	No	Yes	Yes
Passenger evacuation procedures	No	No	Yes	No

1.19 Training

1.19.1 Locomotive engineer training

Under the regulations, LEs are required to receive recurrent training in locomotive operation and train handling. Operating a locomotive is a complex task, and LEs are trained to recognize the characteristics of the train they are operating such as length, tonnage, and weight distribution within the train.

They must also know the characteristics of the territory (i.e., undulating terrain, grade, and curvature) in which they are operating. LEs must anticipate the train’s response and must adapt its operation to negotiate changes in terrain as well as to comply with signal indications and RTC instructions. To do this, they must understand how to properly use the throttle and brakes. In addition, to reduce the in-train forces, changes to train speed must be planned and gradual.

1.19.2 Conductor training on locomotive operations

The regulations do not require conductors to receive in-depth training on locomotive operation or train handling, which includes tonnage distribution within a train or assignment, the topography for a given area, and the collective effect both can have on train handling and maintaining control of a train.

Many CN conductors receive CLO training, as did the conductor in this occurrence. CLO training provides basic locomotive operation instructions to give a conductor the ability to offer limited momentary relief for an LE if required. A conductor with CLO training is only expected to conduct limited throttle modulation to maintain speed, emergency brake application, trackside monitoring, and the sounding of the locomotive horn and bell at crossings. CLO training does not provide a conductor with a detailed understanding of locomotive and train air brake operation or the knowledge of when it may be necessary to intercede if an LE does not respond appropriately to signals displayed in the field.

1.19.3 Subdivision familiarization training for operating employees

When operating employees have been on leave for an extended period, or when they are transferred to a new terminal, they are required to make at least 1 familiarization trip on each subdivision for which they are regularly subject to being called. Familiarization trips involve riding with a qualified crew over the subdivision. Upon completion of the required trip(s) and confirmation that the employee is comfortable with operating on the subdivision, the employee is considered familiar with the subdivision.

If the employee feels that more trips are required, the employee can meet with a company officer to determine the steps to become more familiar. These steps could include making additional trips on the subdivision with a qualified crew. Employee familiarization with the subdivision can also be evaluated on an ad hoc basis during proficiency testing by supervisors who accompany them on train rides.

The train 318 conductor, who had recently transferred to Winnipeg, had completed the required Winnipeg terminal training and 1 return trip per subdivision, and was considered to be familiar with the territory at the time of the occurrence. He did not request further familiarization trips, indicating that he felt comfortable with the territory.

1.20 Work/Rest Rules for Railway Operating Employees

In a 24/7 industry, fatigue-related errors are common. Sleep-related fatigue or sleepiness increases the likelihood of errors of execution or planning. To address the risk of railway operating employee fatigue, the TC–approved Work/Rest Rules for Railway Operating Employees (Work/Rest Rules) were developed pursuant to section 20(1) of the Railway Safety Act. These rules^{Footnote 74} apply to federally regulated railway companies and operating employees.

Section 2, Statements of Principle, states the following:

2.1 To meet the safety and operational challenges of managing operating employee fatigue, railway companies, in association with operating employees and their designated representatives, must have a flexible approach that will:

• a) take ongoing advantage of new developments in research and technology;
• b) meet operating employees’ needs;
• c) meet operational needs of the railway companies; and
• d) be implemented over a wide range of operating conditions.

2.2 Railway companies shall establish and maintain working conditions that allow:

• a) operating employees sufficient opportunity to obtain adequate rest between tours of duty; and
• b) alertness to be sustained throughout the duty period.

2.3 Operating employees have a responsibility to report for work rested and fit for duty.^{Footnote 75}

Fit for duty means “reporting for duty rested and prepared to maintain alertness for the duration of the tour of duty.”^{Footnote 76}

Besides setting limits for hours of work and scheduling for operating employees, the Work/Rest Rules also require railway companies to implement a fatigue management plan designed to reduce fatigue and improve on-duty alertness. The Work/Rest Rules require that fatigue management plans consider the following:

• Education and training of employees
• Scheduling practices
• Dealing with emergencies
• Alertness strategies
• Rest environments
• Implementation policies
• Evaluation of fatigue management plans and crew management effectiveness

TC’s Fatigue Management Plans: Requirements and Assessment Guidelines^{Footnote 77} identify several risk factors that can increase the likelihood of operator impairment due to a lack of sleep. However, the TC guidelines do not identify the effects of circadian rhythm desynchronization as a risk factor.

1.21 Transport Canada Railway Safety Management System Regulations, 2015

The Transport Canada Railway Safety Management System Regulations, 2015^{Footnote 78} also address the risk of railway operating employee fatigue.

Section 28 is entitled Process with Respect to Scheduling and states:

Principles of fatigue science

28 (1) A railway company must apply the principles of fatigue science when scheduling the work of the employees referred to in subsection (2), including the principles

• (a) that human fatigue is governed by physiology;
• (b) that human alertness is affected by circadian rhythms;
• (c) that human performance degrades in relation to hours of wakefulness and accumulated sleep debt; and
• (d) that humans have baseline minimum physiological sleep needs.

Method

(2) The railway company must include, in its safety management system, a method for applying the principles of fatigue science when scheduling the work of an employee who is required to work according to a schedule that

• (a) is not communicated to the employee at least 72 hours in advance;
• (b) requires the employee to work beyond his or her normal work schedule; or
• (c) requires the employee to work between midnight and 6:00 a.m.

Communication

(3) The railway company must communicate, to any employees who are required by the railway company to work according to a schedule referred to in subsection (2), how the principles of fatigue science have been taken into account when requiring them to work according to that schedule.

1.22 Canadian National Railway Company fatigue management training for operating employees

In accordance with the Work/Rest Rules, CN developed a training course entitled Fatigue Management for Operating Employees that it delivers to all of its operating employees. The initial course is delivered as part of CN’s 7-week induction training for new hires and is about 2 hours in duration. CN operating employees are also required to complete an online refresher module on fatigue management in conjunction with their CROR requalification every 3 years.

1.23 Work scheduling and performance decrements associated with fatigue

Most freight LEs and conductors work on an unscheduled basis and, consequently, they are called for trips as required. Trips are assigned to LEs and conductors in subdivision “pools,” based on a first-in first-out system, subject to mandatory off-duty time and maximum duty times outlined in the Work/Rest Rules. When crew members finish a trip, their names are placed back into their respective pool lists for reassignment to their next trip. Such scheduling practices can lead to shift start times varying throughout the day.

In addition to the Work/Rest Rules, crews in these pools have the following rest provisions available to them in accordance with their collective agreements:

• Upon arrival at the away-from-home terminal, employees are permitted to take up to 8 hours of rest exclusive of call time (2 hours).
• Upon arrival at the home terminal, employees are permitted to take up to 24 hours of rest exclusive of call time.
• LEs have the option of taking up to 48 hours of rest after completing 1075 miles on 3 occasions per month.
• LEs have the option of not working after reaching the monthly mileage threshold of 3800 miles.

The conductor in this occurrence had a more structured schedule. He worked in a pool from a home terminal that had assigned calling windows, assigned work days, and assigned rest days. These calling windows rotated throughout the schedule from 0501-1300 to 1301-1900 and then to 1901-0500. This schedule was created by CN and the union, and was validated using the biomathematical fatigue model Fatigue Audit InterDyne (FAID).^{Footnote 79}

Crews attempt to manage their sleep by monitoring train line-ups that estimate arrival times at the away-from-home terminal. However, train line-ups and estimated arrival times are not always predictable and can change dramatically within a short time for a variety of reasons related to operations, equipment, or tracks. Trains can also be cancelled outright.

Unpredictable and variable shift start and end times have been shown to increase the risk of fatigue and to make it difficult for workers to obtain good-quality sleep.^{Footnote 80} Several factors can contribute to sleep-related fatigue, including acute or chronic lack of good-quality sleep, being awake for more than 17 hours, circadian rhythm effects, sleep disorders, medical or psychological conditions, and effects from medications.

Research shows that, compared to workers with regular shift schedules, workers with irregular shift patterns get, on average, less sleep. They are also more likely to experience sleep disturbance, excessive sleepiness, and desynchronized circadian rhythms, all of which place them at risk of developing circadian rhythm sleep disorders. Symptoms of circadian rhythm desynchronization will often result in a further reduction in sleep time and quality.^{Footnote 81},^{Footnote 82}

There are numerous biological rhythms in humans that follow a circadian (daily) pattern. Many circadian rhythms are interdependent and synchronized both to each other and to the time of day. Fatigue and sleep propensity also follow a circadian pattern and increase significantly at night. Changing sleep-wake patterns too quickly can cause circadian rhythms to desynchronize, which can lead to performance impairments. Circadian desynchronization occurs when the internal biological rhythms are not synchronized to each other, or if internal sleep-wake rhythms are not synchronized to the light-darkness cycle. Optimal human performance occurs when all circadian rhythms are synchronized to each other as well as to external time cues.^{Footnote 83}

The human body functions optimally when it follows a predictable routine. Any time there is a change to its routine, it takes time to adjust. During the adjustment period, the body functions at sub-optimal levels. Changes to the sleep-wake schedule are no exception and can also result in sub-optimal functioning. If the pattern is not stable, a person’s circadian rhythms will become desynchronized and reduced performance will result.^{Footnote 84}

Early morning shifts are associated with shorter sleep (sleep obtained prior to the work shift will be shortened) and greater level of stress^{Footnote 85} than are shifts that begin later in the day. A recent study found that when a worker sleeps 5 hours or less in a 24-hour period, the worker is at risk of fatigue-related impairment and fatigue-related accidents.^{Footnote 86}

Performance decrements associated with shift work-related fatigue are established as significant risk factors and predictors of occupational accidents and injuries.^{Footnote 87} These performance decrements can include slowed (or no) reaction time, reduced vigilance, impaired decision-making ability, inability to concentrate, poor judgment, poor memory, distraction, and loss of awareness in critical situations.^{Footnote 88} Train operation performance decrements associated with shift work-related fatigue include slow reaction time to signals displayed in the field^{Footnote 89} and impaired conformance with train operating requirements.^{Footnote 90}

Workers experiencing shift work-related fatigue are also at greater risk of experiencing micro-sleeps. Micro-sleeps are brief, unintended episodes of loss of attention or uncontrollable sleep periods associated with blank stares, head-snapping events, and periods of prolonged eye closure. Even well rested individuals are at risk of micro-sleeps when performing monotonous tasks, such as driving long distances.^{Footnote 91} Micro-sleeps are short in duration (from 0.5 to 15 seconds, or more) and a person is often unaware of them.

While falling asleep represents the most extreme consequence of fatigue, other related driver states can be exacerbated when a person is fatigued. One of these is called “driving without awareness” (DWA), a trance-like state in which a person drives a motor vehicle in a normal manner, yet has no recollection of doing so. DWA illustrates behavioural automaticity, or the ability to perform actions without consciously thinking about them. While DWA can occur in non-fatigued drivers under monotonous conditions, it is more likely to occur when a driver is fatigued. Research has suggested that DWA represents an intermediate phase between wakefulness and severe sleepiness, and that DWA often precedes micro-sleeps.^{Footnote 92}

1.24 Train 318 crew work/rest history

While the work histories for both crew members in the 4-week period preceding the accident met the requirements of the Work/Rest Rules, the LE and the conductor had each been working varied and irregular shifts.

1.24.1 Locomotive engineer

In the 4 weeks preceding the occurrence, the LE had worked a variable pattern of day and night shifts starting during early morning (e.g., 0230), morning (e.g., 0535), afternoon (e.g., 1315) and night (e.g., 2200). While there were six 24-hour rest periods during this time (06, 09, 12, 13, 17 and 21 December), the LE worked a portion of every day between 04 December 2018 and 25 December 2018, a period of 21 days (Table 6).

Table 6. Locomotive engineer’s work history from 04 December 2018 to 03 January 2019

Date	Train	Call time/date	Order time/date	Tie-up time/date
04 December 2018	M31341-04	1834/04	2030/04	0525/05
05 December 2018	Q11651-02	1145/05	1345/05	0155/06
07 December 2018	B78741-07	1117/07	1315/07	0350/08
08 December 2018	Q11451-06	1156/08	1300/08	0030/09
10 December 2018	M30141-10	0905/10	1100/10	2005/10
11 December 2018	M30251-07	0445/11	0645/11	1615/11
12 December 2018	M34791-10	2035/12	2230/12	0900/13
13 December 2018	M30451-10	1729/13	1930/13	0440/14
15 December 2018	A40141-15	0908/15	1100/15	2055/15
16 December 2018	Q11251-12	0613/16	0800/16	1550/16
17 December 2018	M34791-15	2055/17	2245/17	0935/18
18 December 2018	U26251-17	1729/18	1925/18	0400/19
20 December 2018	Q19991-18	0331/20	0530/20	1635/20
21 December 2018	M31451-18	0038/21	0230/21	1325/21
22 December 2018	DHT156B-22	1639/22	1830/22	2215/22
23 December 2018	M30251-19	0351/23	0545/23	1730/23
24 December 2018	RZ40541-23	0338/24	0535/24	1420/24
24 December 2018	M31451-23	2003/24	2200/24	0810/25
02 January 2019	Q11791-31	0434/02	0630/02	1800/02
03 January 2019	M31851-01	0445/03	0530/03

Such a work pattern had the potential to create acute and chronic sleep disruption, increased sleepiness, and desynchronized circadian rhythms.

Additional opportunities for rest periods that were available to the LE, if requested, went unused. For example, of the 3 opportunities that the LE had to take up to 48 hours of rest (following his shift on 08 December, 16 December and 23 December), the LE requested 31 hours of rest following his shift on 08 December and did not use the other opportunities. Between 05 December and 25 December, the LE had the opportunity to take up to 264 hours of rest in Winnipeg but only took 115 hours of rest. This represents 44% of the rest that was available to him. The LE reported feeling tired in the month preceding the occurrence due to irregular and unexpected shifts.

During his time off for the holiday season, from 25 December 2018 to 01 January 2019 (8 days), the LE did not take daytime naps. He regularly went to bed around 2300 and got up at 0700 in order to try to reset his night sleep schedule from the varied and intermittent sleep pattern that he had maintained while working shifts leading up to his vacation. He also regularly experienced 1 or 2 periods of wakefulness at night to meet family obligations.

On 02 January 2019, the LE was called at 0430 and took a 30-minute nap before leaving for his 0630 start time on a westbound train. The LE operated the westbound train to Rivers, was off duty at 1800 on 02 January 2019, and was provided an opportunity to rest in the CN Bunkhouse at Rivers.

On 03 January 2019, the LE was called at 0330 for train 318 ordered at 0530. With his cellular phone on silent, he slept through the call and was later awoken by a knock at the door of his sleeping quarters at 0445. He had obtained 5.5 hours of poor-quality sleep the night before. At about 0610, train 318 departed eastbound from Rivers on the Rivers Subdivision.

The LE had not been diagnosed with a sleep disorder or a medical condition that would interfere with obtaining quality sleep.

1.24.2 Conductor

In the 4 weeks preceding the occurrence (Table 7), the conductor had a variable pattern of day and night shifts starting during early morning (e.g., 0230, 0500) and night (e.g., 2215).

Table 7. Conductor’s work history from 06 December 2018 to 03 January 2019

Date	Train	Call time/date	Order time/date	Tie-up time/date
06 December 2018	U26051-03	0019/06	0215/06	1330/06
07 December 2018	A43981-06	0116/07	0315/07	1305/07
09 December 2018	M34841-08	0303/09	0500/09	1725/09
10 December 2018	RQ11651-06	0511/10	0630/10	1525/10
11 December 2018	DHT209B-11	0338/11	0500/11	0930/11
15 December 2018	Q10521-13	0034/15	0230/15	1240/15
15 December 2018	G84441-15	2227/15	2355/15	0635/16
17 December 2018	Q11131-16	0632/17	0830/17	1850/17
18 December 2018	Q19651-14	0358/18	0545/18	1615/18
19 December 2018	X31341-19	0500/19	0700/19	1810/19
20 December 2018	X10651-18	0350/20	0550/20	1700/20
24 December 2018	RM30331-22	0307/24	0500/24	0845/24
26 December 2018	U26051-23	1621/26	1815/26	0300/27
27 December 2018	DHT076B-27	2015/27	2215/27	0245/28
29 December 2018	SL54541-28	0503/29	0700/29	1150/29
02 January 2019	Q11791-31	0434/02	0630/02	1800/02
03 January 2019	M31851-01	0330/03	0530/03

The conductor occasionally took melatonin supplements to help him fall asleep when working variable shifts. It has been shown that melatonin can shift circadian rhythm to a desired sleep-wake pattern if taken as directed.^{Footnote 93} Melatonin should not be used to initiate sleep and, if taken at the wrong time or not as directed, it can disrupt circadian rhythms.^{Footnote 94} The conductor had not been diagnosed with a sleep disorder or a medical condition that would interfere with obtaining quality sleep. The conductor reported feeling tired in the days leading up to the occurrence.

From 30 December 2018 to 01 January 2019 (3 days), the conductor was off work.

On 02 January 2019, the conductor was called at 0434 and was on duty at 0630 on a westbound train. The conductor worked with the same LE on the westbound train to Rivers, was off duty at 1800, and was provided an opportunity to rest in the CN Bunkhouse at Rivers.

On 03 January 2019, the conductor was called at 0330 for train 318 ordered at 0530. At about 0610, train 318 departed eastbound from Rivers on the Rivers Subdivision.

1.25 Fatigue analysis for crew members

A thorough fatigue analysis of the train 318 crew was conducted, including consideration of the crew’s 30-day work history, their normal sleep patterns, known sleep periods, and estimated sleep history when specific sleep/wake times were unknown (Appendix A).

1.25.1 Qualitative fatigue assessment

Six risk factors were examined in order to determine the likelihood that the crew was experiencing fatigue at the time of the occurrence: acute sleep disruption, chronic sleep disruption, continuous wakefulness, circadian rhythm effects, sleep disorders, and medical or psychological conditions, illnesses or drugs that could lead to fatigue (Appendix B). Of these, the qualitative assessment determined that the LE was affected by acute sleep disruption, but did not identify fatigue as a factor for the conductor.

The LE obtained less sleep than he normally would have on the 2 nights leading up to the occurrence (approximately 5.5 hours of disrupted sleep each night). On the morning of the occurrence, the LE was awoken at 0445 for a 0530 start time. Employees working early morning shifts that shorten sleep length or individuals who sleep a total of 5 hours or less in a 24-hour period are at an increased risk of sleepiness, fatigue-related impairment, and fatigue-related accidents during their shift.^{Footnote 95},^{Footnote 96} Because of the early morning starts and because the LE had had only 5.5 hours of disrupted sleep (likely totaling less than 5 hours of restorative sleep) during each of the 2 nights before the occurrence, he was at risk of fatigue due to acute sleep disruption.

The investigation also determined that the LE and, to a lesser extent, the conductor were at risk of fatigue in the weeks leading up to the occurrence. The variable work history would have made it difficult for the crew members to obtain sufficient restorative sleep during the times when they had the opportunity to sleep. Specifically with respect to the LE, his decision not to take all of the available opportunities for rest exacerbated this situation. Changes to the sleep-wake schedule can result in sub-optimal functioning during the adjustment period. If the pattern is not stable, a person’s circadian rhythms will become desynchronized, and reduced performance will result. Because the crew had worked a challenging, unstable work pattern in the first 3 weeks of December, there is a risk that their circadian rhythms were desynchronized, making it more difficult to obtain sufficient restorative rest, and increasing the risk of fatigue.

1.25.2 Fatigue Avoidance Scheduling Tool

Computerized analyses of the crew’s sleep-wake histories were done using the Fatigue Avoidance Scheduling Tool (FAST). Although FAST does not provide a predicted outcome measure for fatigue, it does provide a numeric prediction of effectiveness that is derived from a predicted level of fatigue.

Using what is known of normal human performance on a proven measure of cognitive functioning called the psychomotor vigilance test (PVT), FAST predicts departures of performance ‘effectiveness’ of an average person from a normal-rested ‘baseline’. A prediction of 100% performance effectiveness is not necessarily error-free performance; rather, it means that performance would be expected to be at 100% for a normal person who sleeps 8 hours per night during nighttime hours. Predictions on the PVT have been correlated with reaction time, mean throughput on a battery of cognitive tests, and lapse index (likelihood of exceptionally long reaction times) (Appendix C).

For each point in time, FAST evaluates the influence of 5 fatigue factors on the corresponding effectiveness level, and displays those that are a concern as a red flag in the FAST dashboard. The 5 fatigue factors are:

• Recent sleep (last 24 hours) – the total number of sleep hours in the previous day.
• Chronic sleep debt – the cumulative number of hours of sleep that have been missed since the last time the sleep reservoir was full.
• Hours awake – the number of continuous hours since the last period of sleep.
• Time of day – an evaluation of vulnerability to error based on the person’s own adjusting circadian rhythm. For a person with a “normal” bedtime of 2300, maximum vulnerability is considered to be between midnight and 0600. Times are shown in base time zone but are always adjusted to a person’s own rhythm.
• Out of phase – a measure of the degree of desynchronization of the person’s own circadian rhythm relative to the optimal phase for the current pattern of sleep and wakefulness, measured as the number of hours out of phase – a measure of “jet lag” or “shift lag.”

The colour zones on a FAST output graph depict the following levels of performance effectiveness:^{Footnote 97}

• Green – 100% to 90% effectiveness of PVT speed. Approximates the range of performance during a normal, daytime duty day following an 8-hour period of excellent sleep at night.
• Yellow – 90% to 65% effectiveness of PVT speed. Approximates the range of performance after having missed 1 night of sleep (24 hours awake).
• Red – below 65% effectiveness of PVT speed. Represents performance following sleep deprivation of 2 full days and 1 night (40 hours awake). An individual’s reaction time when effectiveness is in the red zone is more than 50% longer than that of a well-rested person.

To assess and forecast performance changes associated with sleep-wake patterns resulting from work schedules similar to the crew’s work history, a hypothetical sleep schedule based on the crew’s actual work history for the 30 days prior to the occurrence, their normal sleep pattern, and known sleep periods was developed (Appendix A). Sleep and awake times were estimated when sleep periods were unknown.

As the FAST output graphs (Appendix D) show, because the LE experienced acute sleep disruption on the nights of 01 and 02 January, his estimated level of performance at the time of the occurrence was 87% of the PVT speed, which is in the range of that of a normal person who has missed 1 full night of sleep. According to FAST-related performance metrics, a person who had maintained a sleep-wake history like that of the LE would be expected to have a reaction time about 15% slower, cognitive performance about 7% poorer, and would have about double the number of lapses compared to a sufficiently rested person. The FAST software ‘red flag’ for ‘recent sleep’ is present because the LE had had only 5.5 hours of sleep in the 24 hours prior to the accident. These FAST results are consistent with the results of the qualitative fatigue analysis.

The conductor’s FAST output graph shows that he was at low risk of experiencing fatigue at the time of the occurrence.

The LE’s FAST output graphs for the 3 weeks prior to his vacation (25 December until 02 January) show that he would have been at risk of working in a state of reduced effectiveness (below 90% of PVT speed and other associated aspects of poorer performance) due to fatigue at some point during 17 of the 18 shifts. During 7 of those shifts, his estimated level of performance dipped below 65% (red zone) due to a combination of all 5 fatigue factors, including circadian rhythm desynchronization. At the end of his work shift on 19 December at 0400, his performance on the PVT was estimated to be 50% that of a normal person who had slept 8 hours per night during nighttime hours, or performance that is representative of someone who was deprived of a night’s sleep between 2 days where they remained awake. The estimated reaction time for someone with this level of fatigue would be about 100% slower, cognitive performance would be about 43% poorer, and there would be about 12 times the number of lapses compared to a sufficiently rested person. At the end of his work shift on 24 December, his estimated performance was 61%.

The conductor’s estimated performance during work shifts leading up to the occurrence ranged between 65% and 90% (yellow zone), or the range of performance of a normal night-sleeping person during the 24-hour period after having missed 1 night of sleep. At the end of his shift on 16 December, his estimated performance was 65% due to circadian rhythm desynchronization (out of phase), recent sleep, chronic sleep debt, and time of day fatigue factors.

1.26 Canadian National Railway Company train crew stop signal violations

On 14 November 2018, CN distributed System Notice No. 912 titled Educational Notice – Rule 439 / Stop Signal VIOLATIONS. In the notice, CN noted that in the previous 10 months, there had been a marked increase in rule violations as 37^{Footnote 98} movements had passed a stop signal without authorization in Canada. There had also been an increase of near-miss incidents in which only drastic last-minute action prevented movements from passing signals displaying a Stop indication.

A CN investigation discovered that, in many instances, operating crews did not adhere to the instructions they had received from the signal indication displayed on advance signals, particularly Advance Clear to Stop and Clear to Stop indications. In many cases, crews wrongly anticipated that signals they were approaching would be permissive by the time they reached them, despite receiving Advance Clear to Stop and Clear to Stop indications on advance signals.

The notice also identified that train crews sometimes made assumptions based on radio chatter indicating, for example, that the train or foreman they were meeting was in the clear, or the train they were following was a sufficient distance ahead.

The company notice served as a reminder to crews of the rules and instructions regarding signal indications and how to maintain situational awareness while on duty at all times.

1.27 Technologies for ensuring signals are followed

Safety professionals in North America have identified 5 types of hazard controls and ranked them in terms of their effectiveness. From the most effective to the least effective, the hazard control types are:

• Elimination – the physical removal of the hazard
• Substitution – the replacement of something that creates a hazard with something that does not
• Engineering (physical) defences – the isolation of the hazard from the person
• Administrative defences – a change in the way people work
• Personal protective equipment

To mitigate the hazards facing train operating crews, the railway industry in Canada predominantly uses administrative defences such as policies, procedures, rules, employee training, warning signs, and wayside signalling systems. To further address the risk of crews misinterpreting or not following signal indications, the railway industry in the U.S. has also adopted and integrated physical fail-safe defences, such as cab-signalling systems and positive train control (PTC).

1.27.1 Cab-signalling systems

Cab signalling is a communications system that provides track status information to a display device mounted inside the locomotive cab. The simplest systems display wayside signal indications, while more advanced systems also display maximum permissible speeds and can warn operating crews of their proximity to points of restriction so the crew can take action to slow or stop a train.^{Footnote 99} Cab signals can reduce the risk of signal recognition errors.

In 1922, the U.S. Interstate Commerce Commission ruled that U.S. railroads must install some form of train control system in one full subdivision that had passenger traffic, by 1925. In response to this ruling, the first cab-signalling systems were developed and implemented in the U.S.^{Footnote 100} Over the years, cab‑signalling systems have evolved and are now integrated into train control systems such as PTC that can monitor signal indications and enforce associated speed restrictions. In Canada, there is no cab‑signalling system in use by freight or passenger railways.

1.27.2 Positive train control

PTC is a physical fail-safe train control technology that is designed to prevent

• train-to-train collisions;
• overspeed derailments;
• incursions into work zones; and
• movement of a train through a switch left in the wrong position.

A fully functioning PTC system also offers a physical fail-safe defence against operating crew errors that are influenced by fatigue.

1.27.2.1 How positive train control works

In a fully-functioning PTC system, all the wayside signal indications are electronically communicated through system computers to the PTC-equipped lead locomotive. PTC uses predictive braking algorithms to prevent collisions and overspeeding. If an operating crew does not initiate an adequate response to a signal indication displayed in the field, to identified hazards (e.g., a broken rail or a switch left in an abnormal position) or to authorities issued to govern the operation of the train, PTC will intervene and automatically slow or stop the train. To be fail-safe, predictive braking algorithms must have a high degree of reliability in order to stop trains before a violation or accident occurs.

The PTC system integrates and processes

• the train’s GPS information;
• static track information such as track profile and subdivision speed limits;
• train-specific information such as train speed, tonnage, length, consist information, movement authorities, speed restrictions, work zones, and consist restrictions; and
• communications with wayside devices checking for track occupancies, proper switch alignment, and signal indications.

The data are combined to develop a braking algorithm and create predictive warning and braking curves for train operation in real time. As the train moves along the track, a computer on board the lead locomotive continuously calculates the warning and braking curves. When PTC is in use, the braking curves enforce speed limits in accordance with wayside signals displayed in the field, track authorities in non-signaled territory, and in response to any hazards identified on the route ahead. PTC predictive braking curves force a train to stop no closer than 300 feet from a Stop signal displayed in the field.

Once the braking curves are established, if the train speed enters the warning curve zone, an alarm is activated and an LE is expected to bring the train speed back within the braking curve zone. If the LE does not take action or the PTC system determines that the train cannot stop before the Stop signal displayed in the field, a penalty brake application occurs to stop the train (Figure 9).

During a PTC penalty brake application, PTC still calculates the train speed and the remaining stop distance, and can also initiate an emergency brake application if it deems that the full service penalty brake application is not sufficient to bring the train to a stop before reaching the Stop signal indication.

1.28 Evolution of positive train control in the United States

In the U.S., the NTSB issued its first recommendation for the development and implementation of a PTC system in 1970 following its investigation into a fatal head-on collision that occurred in August 1969 between 2 Penn Central commuter trains in Darien, Connecticut, in which there were 4 fatalities and 43 injuries.

The NTSB has observed that, in the last half century, it “investigated more than 150 PTC-preventable accidents that have taken nearly 300 lives and injured about 6,700 others [….]”.^{Footnote 101} From these investigations, the NTSB made another 51 PTC-related recommendations.

In 1990, the implementation of PTC was included in the NTSB’s first Most Wanted List of Transportation Safety Improvements that served as the NTSB’s primary advocacy tool for highlighting the most urgent transportation safety needs. The implementation of PTC remained on the NTSB’s Most Wanted List until 2008.

On 12 September 2008, there was a collision between a Metrolink commuter train and a Union Pacific freight train in Chatsworth, California, that resulted in 25 fatalities and 102 injuries. The Metrolink accident prompted the passage of the Rail Safety Improvement Act of 2008 (RSIA), which mandated that, by 2015, PTC be installed on high-hazard rail lines in the U.S. that met the following criteria:

• Class 1 railroad main lines that had 5 million or more gross tons of traffic annually.
• Rail lines that had any shipments of products that were poison or toxic by inhalation (PIH/TIH).
• Rail lines over which regularly scheduled intercity passenger or commuter rail services were provided and any other rail lines that the Secretary may prescribe by regulation or order.

The U.S. Federal Railroad Administration (FRA) was tasked with overseeing the implementation of PTC.

After the RSIA enactment, the NTSB removed PTC from its Most Wanted List. However, due to technical challenges and delays in implementing PTC, the deadline was extended to 31 December 2020. Consequently, in 2014, the NTSB reinstated PTC to the Most Wanted List.

1.29 Rail networks in the United States and Canada

The U.S. rail network is comprised of nearly 140 000 route-miles of track.^{Footnote 102} As of 31 December 2020, PTC was fully implemented in the U.S. on 100% of the trackage required by the RSIA legislation. As such, PTC is now fully operational on a total of 57 535.7 miles of track, which accounts for about 41% of the U.S. rail network. The total miles of track that have PTC installed includes the U.S. operations of both CN (3107 miles) and CP (2118 miles). The Canadian rail network is comprised of about 26 000 route-miles of track.^{Footnote 103} Of these:

• CN owns about 13 800 miles of track (53% of the rail network) of which about 5900 miles are designated as key routes.
• CP owns about 7500 miles of track (29% of the rail network) of which about 4900 miles are designated as key routes.
• Other railways own about 4700 miles of track (18% of the rail network) of which about 140 miles are designated as key routes.
• Key routes account for a combined total of about 10 940 miles of main track, which represents approximately 42% of the Canadian rail network.

Despite significant investment in PTC technology for the CN and CP locomotive fleets and their U.S. infrastructure, it is unclear what, if any, action is planned by the railways and the Canadian regulator to implement the use of PTC or a similar form of automatic or enhanced train control (ETC) in Canada.

1.30 TSB occurrences that may have been prevented by, or the severity of the outcome reduced by, positive train control or an equivalent system

A review of all TSB rail investigation reports (excluding Class 5 occurrences and including this occurrence) since the creation of the TSB in 1990 determined that there have been 80 occurrences that may have been prevented, or the severity of the outcome reduced, by a train control system equivalent to PTC (Appendix E).

A review of the findings of the 80 investigation reports identified that, combined, they resulted in the following:

• 53 train derailments resulting in 530 derailed rolling stock;
• 41 train collisions resulting in 35 derailments;
• 128 rail cars involved that contained and/or lost dangerous goods;
• 13 locomotives that lost diesel fuel;
• 318 injuries to employees and passengers;
• 8 fatalities;
• 19 of the 80 (24%) occurrences had a finding related to operator fatigue.

1.31 TSB investigations and recommendations related to train control

In 2000, the TSB made its first recommendation for implementing additional train control defences following its investigation into the 1998 collision between 2 CP trains near Notch Hill, British Columbia.^{Footnote 104} After determining that backup safety defences for signal indications were inadequate, the Board recommended that

In April 2001, Transport Canada (TC) initially indicated that it supported the intent of Recommendation R00-04, but took no action and provided no new information until 2010 when CP identified that it had implemented additional administrative defences, in the form of a crew checklist and some CRM principles, to assist crews with rules compliance.^{Footnote 105} Otherwise, there were no tangible efforts to establish physical fail-safe train control systems in the event that a crew does not respond appropriately to a signal displayed in the field.

In 2012, the derailment and collision of VIA passenger train 92 near Burlington, Ontario, resulted in 3 operating crew members being fatally injured while 44 passengers and the VIA service manager sustained various injuries.^{Footnote 106} In 2013, following the investigation, the TSB indicated that TC and the industry should move forward with a strategy that would prevent accidents like that one by ensuring that signals, operating speeds, and operating limits are always followed. The Board therefore recommended that

In 2014, in response to TSB recommendations R00-04 and R13-01, a joint TC–industry train control working group was established under the Advisory Council on Railway Safety (ACRS) to study the issue.

1.31.1 Train control working group and final report

The train control working group (TCWG) was primarily made up of industry stakeholders. It was chaired by TC Rail Safety and included representatives from the following organizations:

• Transportation Development Centre (TDC)
• Railway Association of Canada (RAC)
• Association of American Railroads (AAR)
• Unifor National Canada
• Teamsters Canada Rail Conference (TCRC)
• Canadian National Railway Company
• Canadian Pacific Railway Company (CP)
• VIA Rail Canada Inc. (VIA)
• GO Transit
• Canadian Association of Railway Suppliers (CARS)

In September 2016, the TCWG produced a report called Train Control Working Group Final Report.^{Footnote 108} The report stated that from 2011 to 2015, 38% (2604 of 6786) of occurrences recorded in the TSB rail occurrence database system (RODS) were main-track occurrences, and that “380 of 2604, or one in six [14.6%],^{Footnote 109} can be defined as ETC-preventable occurrences.”^{Footnote 110}

For the preliminary review, the ETC-preventable occurrences were divided into 5 categories.^{Footnote 111} The majority of these occurrences were categorized as “movement exceeds limits of authority” (MELA), which represented 71% (273 of 380) of preventable accidents and incidents, or an average of 55 preventable occurrences yearly.

The report identified that ETC could be a very advanced system or a more basic system. The report concluded that a targeted, risk-based, corridor-specific implementation of train control technologies would be the best option for Canada. Such a system could include “a static display of track infrastructure, speed limits and operating restrictions, but provide a dynamic display of current train location”^{Footnote 112} that could provide aural or visual alarms without positive enforcement. However, such a system would still rely on the operating crew for compliance. A more extensive ETC “could be designed using fail-safe design methods and incorporate positive enforcement capabilities.”^{Footnote 113}

The report made the following recommendations:

Based on the work done by the working group, it is recommended that the next steps include a closer look into which specific risks are being considered; which technologies would help reduce those risks; and which segments of a railway’s network would most benefit from those systems. Additionally, any specific functionality desired by enhanced train control (ETC) systems would be factored into the analysis leveraging lessons learned from the US implementation of PTC, towards the development of a comprehensive cost-effective approach for Canada.

To achieve this objective, it is recommended that a technical task force be created to develop a clear corridor risk-prioritization methodology. This methodology would include identification of primary risk factors as well as clarification of how each risk factor is mitigated by the various ETC technologies currently available. This would provide the building blocks that could be used to define the optimum ETC implementation strategy to ensure that the desired safety improvements are achieved, capital investments are minimized and potential corridor operating impacts are minimized. This work will require the involvement of railway industry technical systems experts working in conjunction with TC.^{Footnote 114}

Finally, the report indicated that it would be important to continue monitoring the implementation of PTC in the U.S. and apply lessons learned to the deployment of ETC technologies in Canada.^{Footnote 115}

1.31.2 TSB review of the Train Control Working Group Final Report

The TCWG report stated that from 2011 to 2015, 38% (2604 of 6786) of occurrences recorded in RODS were main-track occurrences, and that 380 of 2604, or 1 in 6 (14.6%), can be defined as ETC-preventable occurrences.

However, even on main track, ETC would not be intended to prevent crossing, trespasser, fire, or hi-rail vehicle derailment or collision accidents. RODS data for main-track crossing, trespasser, fire, and hi-rail vehicle derailment or collision accidents from 2011 to 2015 are contained in Table 8 below.

Table 8. 2011-2015 data for main-track crossing, trespasser, fire, and hi-rail vehicle derailment or collision accidents

Year	Crossing	Trespasser	Fire	Hi-rail vehicle derailment or collision	Total
2011	171	66	23	34	294
2012	192	71	17	25	235
2013	184	56	11	41	292
2014	185	54	36	27	302
2015	165	50	32	43	290
Total	897	297	119	170	1483

When these accident type totals (1483) are excluded from the 2604 main-track accidents over 5 years, there are 1121 occurrences, of which 380, or 33.9%, can be defined as ETC-preventable occurrences.

1.31.3 Canadian Rail Research Laboratory Report on Enhanced Train Control

In 2017, TC contracted the Canadian Rail Research Laboratory (CaRRL) at the University of Alberta to conduct a follow-on study in support of the Train Control Working Group Final Report and conclusions. CaRRL submitted its follow-on Report on Enhanced Train Control to TC in February 2018.

In the report, CaRRL categorized ETC into 4 levels, which are all theoretical in nature, but ETC Level 1 to 3 systems should be able to be implemented with existing technologies. Level 3 is an ETC system that has the same functionality as PTC. Level 4 is the most advanced and involves a complete redesign of existing train control infrastructure into a communication-based moving block system. At Level 4, all requirements for wayside signalling would be eliminated and all operating authorities would be contained within the ETC system.^{Footnote 116} Implementing a Level 4 ETC system would involve considerable additional technological development.

The CaRRL report identified that 5.96% (837 of 14 036) of RODS occurrences from 2007 to 2016 (inclusive) were preventable by a Level 4 ETC system. CaRRL also specifically assessed that 58.39% of MELA occurrences were ETC-preventable, and that 3.93% of main-track collisions or derailments were ETC-preventable (31.48% of main-track collisions and 2.39% of main-track derailments).

The CaRRL report concluded that “widespread implementation of the ETC framework established in this study may clearly not be the best approach to improve overall rail safety in Canada.”^{Footnote 117}

1.31.4 TSB review of the Canadian Rail Research Laboratory Report on Enhanced Train Control

The CaRRL report identified that only 5.96% (837 of 14 036) of RODS occurrences (from 2007 to 2016) would be preventable by a Level 4 ETC system. However, 14 036 is the total number of RODS occurrences for that 10-year period. Since ETC systems would only be implemented on main track, only main-track occurrences should be included and, even on main track, ETC would not be intended to prevent crossing, trespasser, fire, or hi-rail vehicle derailment or collision accidents.

Accordingly, the occurrence baseline should exclude crossing, trespasser, fire, and hi-rail vehicle derailment and collision accidents. Using this methodology, the total number of main-track occurrences was 2668. Therefore, the TSB’s estimate is that 837 of 2668 main-track occurrences, or 31.4%, would have been ETC-preventable.

The TSB’s conclusion relating to ETC differs substantially from both the TCWG and CaRRL reports. Furthermore, the benefits of this physical defence could likely be achieved using existing technology and a Level 3 ETC system that has the same functionality as PTC without a Level 4 ETC system redesign.

1.31.5 TSB reassessment of recommendations R00-04 and R13-01

Since issuing railway investigation reports R98V0148 and R12T0038, the TSB has followed up periodically with TC on action being taken to address the recommendations. Each time, TC has provided a response indicating what action has been or will be taken, and the TSB has assessed that response.

In March 2022, the Board reassessed TC’s December 2021 response to Recommendation R13‑01^{Footnote 118} as Satisfactory in Part. The TSB’s assessment of this response, as well as previous responses and assessments, are available on the TSB website. The Board did not specifically reassess Recommendation R00-04,^{Footnote 119} and will not do so going forward as it is linked to Recommendation R13-01, and will be similarly assessed.

To address Recommendation R13-01, in 2021, TC entered into a research partnership with the Volpe Institute in the U.S. and signed a Memorandum of Understanding with the Standards Council of Canada. In February 2022, TC published a Notice of Intent in the Canada Gazette, Part I, signalling its intent to implement ETC in Canada. Despite these efforts, the Board remains very concerned that there are still no specific strategies in place to address the risk of train collision or derailment in the absence of additional backup safety defences, and strongly encourages TC and the Railway Association of Canada to accelerate the pace of ETC implementation.

In Canada, there are currently no ETC systems in use or planned by freight or passenger railways; however, most commuter light rail services have implemented such systems.

1.32 TSB Watchlist 2020

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer. When the TSB published its Watchlist 2012, it identified Following railway signal indications as one of the key safety issues in the Canadian transportation industry, and this issue has remained on the Watchlist ever since.

1.32.1 Following railway signal indications

For over a century, Canada has relied on a system of visual signals to control traffic on a significant portion of its rail network. These signals convey directives such as operating speed and the operating limits within which the train is permitted to travel. Train crews are required to identify and communicate the signal indications among themselves, and then take required action in how they operate the train.

Sometimes, however, train crews misinterpret or misperceive a signal indication, which results in it not being followed. In the absence of physical fail-safe defences, this could result in a collision or derailment. Although the probability of a missed signal leading to an accident may be low, the resulting train collision or derailment can have catastrophic consequences for people, property, and the environment.

From 2004 to 2019, there was an annual average of 31 reported occurrences in which a train crew did not respond appropriately to a signal indication displayed in the field, and the number of these occurrences each year is on the rise (Figure 10).

Note: Sen’s estimate of slope is an unbiased estimator of the true slope of the trend line. In this chart, the Sen’s estimate of slope expressed by the line indicates an upward trend in the number of occurrences over the period (τb = 0.324, p 1-tailed = 0.0425).

The years 2018 and 2019 had the highest number of these occurrences, with 40 and 38 respectively.

This occurrence demonstrates that when a train crew does not respond appropriately to a signal indication displayed in the field, without physical fail-safe defences that can intervene and bring the train to a controlled stop, a serious train collision or derailment can occur.

ACTIONS REQUIRED Following railway signal indications will remain on the Watchlist until TC requires that railways implement additional physical safety defences to ensure that signal indications governing operating speed and operating limits are consistently recognized and followed.

1.32.2 Fatigue management

In the transportation industry, crews often work long and irregular schedules—sometimes in challenging conditions or crossing multiple time zones—that are not always conducive to proper restorative sleep. Fatigue poses a risk to the safety of air, marine, and freight train operations because of its potential to degrade several aspects of human performance.

Fatigue is pervasive in modern societies that rely heavily on 24/7 industries like transportation. A Statistics Canada study released in 2017^{Footnote 120} revealed that about a third of Canadian adults slept less than the recommended 7 to 9 hours per night.^{Footnote 121} Short sleep duration and poor sleep quality were also reported as relatively common.

This occurrence demonstrates that fatigue can impact human performance in ways that can lead to accidents. This is why the TSB routinely investigates if fatigue was present in an occurrence, if it played a role, and if the railway company had practices in place to manage the associated risks effectively.^{Footnote 122} The issue of fatigue management in freight train operations has been on the TSB Watchlist since 2016.

The Work/Rest Rules in effect at the time of the occurrence did not reflect the latest fatigue science on daily and cumulative work and rest periods, and only applied to operating crews. While these Work/Rest Rules recognized that the management of fatigue is a shared responsibility between the employee, their designated representative, and the railway, the regime relied more on an employee’s ability to judge their own fatigue.

To address some of these issues, TC approved new Duty and Rest Period Rules for Railway Operating Employees on 25 November 2020, but they will not fully come into force until May 2023 for freight railways, and 2024 for passenger railways.

ACTIONS REQUIRED Fatigue management in rail transportation will remain on the Watchlist until the following actions are taken: TC develops a policy framework for the management of fatigue based on its review of fatigue management systems, fatigue science, and best practices. TC works with industry and employee representatives and fatigue science specialists to develop a comprehensive approach to fatigue management in the rail sector.

In this occurrence, no equipment or track defects were considered causal, and the wayside signalling system functioned as designed and intended. The locomotive engineer (LE) and the conductor of eastbound Canadian National Railway Company (CN) freight train M31851-01 (train 318) were familiar with the territory, and both were qualified for their respective positions. There was no evidence that the crew had been using electronic devices at the time of the accident that could have impeded their performance.

The analysis will focus on the operation of train 318; human performance, including crew expectations, mental models and situational awareness; the potential for fatigue in employees who work varied schedules; defences for fatigue; the use of Trip Optimizer (TO); crew experience and authority gradient; and safety defences in centralized traffic control (CTC) territory and alternate forms of train control to prevent collisions.

2.1 The accident

The area of the Rivers Subdivision where the accident occurred is primarily double-track territory. Equilateral turnouts (with a speed limit of 45 mph) are located at Mile 50.37 and Mile 50.1 in order to transition the parallel north and south tracks to a single main track that traverses the Assiniboine River. Westbound CN freight train M31541-03 (train 315) was being operated in accordance with the signal indications it encountered, but eastbound train 318 was not.

The train 318 crew egressed from the locomotive cab, jumped to the south of the track just after the side-collision, and sustained minor injuries.

2.2 Train 318 crew actions during the trip

Eastbound CN freight train Q11651-30 (train 116) departed Rivers, Manitoba, about 85 minutes ahead of eastbound train 318. During the trip eastward, the train 318 conductor regularly called out the signal indications displayed in the field within the locomotive cab; however, the conductor did not always hear the LE verbally respond, as required by Canadian Rail Operating Rules (CROR) Rule 34(b). During the trip, the train 318 crew engaged in casual conversation, some of it about the Rivers Subdivision as the conductor had been transferred to the area 2 months prior and was still learning details about the territory.

As train 318 followed train 116, it encountered Advance Clear to Stop and Clear to Stop signal indications, among others, until just west of Bloom (Mile 64.3). After train 116 had departed Bloom and cleared the 2 blocks ahead, train 318 subsequently received a Clear signal indication, departed eastward from Bloom, and continued to follow train 116. Train 318 received a Clear signal indication at the next station (West Tower) and the crew engaged TO. Train 318 then received a Clear signal indication at the next 2 stations, Kearns and Portage la Prairie, Manitoba.

As train 318 approached Portage la Prairie, the train 318 crew overheard a radio conversation between the rail traffic controller (RTC) and train 116 that implied that train 116 would be cleared straight through to Winnipeg without any additional stops.

2.3 Signal indications displayed in the field approaching Nattress

As train 318 proceeded on the south track toward the equilateral turnout at Mile 50.37 at Nattress, it encountered 3 progressive signal indications that provided direction to the train 318 crew on how to proceed. Specifically:

• Controlled Signal 542S at Mile 54.2 displayed a Clear to Limited indication, which identified that train 318 could proceed at track speed, but must approach the next signal (522S) at limited speed (not to exceed 45 mph). This identified to the train 318 crew that they would likely encounter more restrictive signals ahead and that they should handle the train accordingly.
• Advance Signal 522S at Mile 52.2 displayed a Clear to Stop indication, which identified that the train could proceed at track speed, but that the crew must also be prepared to bring the train to a stop in advance of the next signal (504S) at Nattress.
• Controlled Signal 504S at Mile 50.4 displayed a Stop indication, which required train 318 to stop at least 300 feet before Signal 504S.

Between signals 542S and 522S, TO remained engaged, and train speed increased from 31 mph to 42 mph by the time train 318 encountered Advance Signal 522S. From that point on, the CROR required the train 318 crew to be prepared to stop the train before arriving at Signal 504S at Nattress.

2.4 Train 318 approach to Nattress

At 0906:54, eastbound train 318 was proceeding on the south main track at 42 mph with the throttle in position 7 as it passed the Clear to Stop indication (Mile 52.2). At that time, the train 318 TO was engaged, and the lead locomotive was about 9500 feet west of Signal 504S.

At 0908:33, train 318 was operating on a restrictive signal and proceeding at 46 mph at Mile 50.99 when the LE disengaged TO in order to assume manual operating control of the train. When this occurred, the train had travelled 6389 feet past Advance Signal 522S on a restrictive signal with TO engaged, and was only 3115 feet west of Controlled Signal 504S. One second later, the LE made a full service brake application (reduction of 25 psi) when the lead locomotive of the train was 3062 feet west of Signal 504S.

2.4.1 Train handling and stopping distances

The TSB conducted braking calculations to estimate stopping distances for train 318 from 46 mph and 39 mph using 3 train handling techniques. Braking distances for the calculations are contained in Table 9 below.

Table 9. TSB estimates of stopping distances for train 318, by braking assumption and train speed

Braking assumptions	Train speed (mph)	Estimated stopping distance (feet)
Full service brake application (BP reduction of 25 psi)	46	4744
	39	3778
Split-service brake application (initial reduction of 7 psi followed by a further reduction of 18 psi for a total reduction of 25 psi)	46	4416
	39	3499
Emergency brake application with head end and input and display unit (IDU) EOT activation	46	2316
	39	1760

To stop train 318 from 46 mph using a full service brake application (reduction of 25 psi), which was the method used by the LE, required an estimated stopping distance of 4744 feet. If a full service application with an initial split-service brake application had been used, it would have required an estimated stopping distance of 4416 feet.

By 0908:34, at Mile 50.98, the LE had disengaged TO and made a full service brake application when the lead locomotive of the train was 3062 feet west of Signal 504S.

2.4.2 Visibility of Controlled Signal 504S

For an eastbound train operating on the south main track with an unobstructed view, the signal indications at Signal 504S (Mile 50.4) are normally visible from an estimated 1600 feet to the west (Mile 50.7). When the adjacent north track is occupied by a train, as it was in this occurrence, the combination of the adjacent train and track curvature obscures the signal indications at Signal 504S until an estimated 900 feet to the west (Mile 50.57). Although the train 318 crew’s view of the Stop indication displayed at Signal 504S was obscured by a combination of track curvature and train 315, which was proceeding on the adjacent north track, the previous Clear to Stop signal indication displayed at Advance Signal 522S provided adequate information to the train 318 crew that Signal 504S could display a Stop indication.

2.5 Train 318 crew mental model and expectations

In highly practiced situations, attention and expectations are often driven by a person’s existing mental model of a situation, given that previous experience will dictate what information is important and how the situation may unfold. On the 9 previous eastbound trips in the month preceding the collision, the trains that the LE operated had always received permissive signals up to and through Nattress. It was in this context that the LE had formed a mental model that they would receive permissive signal indications up to and through Nattress.

Train 318 had been following train 116 since departing Rivers, and had predominantly encountered Clear signal indications up to Bloom. When the train 318 crew overheard the RTC inform the train 116 crew that they would be operating straight through to Winnipeg without stopping, they expected their train to follow train 116. However, the train 318 crew was unaware that the RTC had planned to hold their train at Nattress to allow westbound train 315 to pass, after train 116 had cleared Nattress. Consequently, the train 318 crew was expecting to receive permissive signal indications up to and past Nattress.

In response to the restrictive signals, braking action was delayed in anticipation of a less restrictive signal being displayed. This was consistent with the crew’s expectations and the LE’s mental model of the situation.

Inaccurate situation assessment can lead to errors in how information is perceived, making it less likely for someone to reassess the initial assessment and update it with new information, while dismissing or not detecting information that is the opposite of what is expected.^{Footnote 123}

2.6 Actions of the train 318 locomotive engineer

At 0908:58, train 318 was proceeding at 43 mph at Mile 50.68. The LE intended to place the automatic air brake handle into the emergency position and apply the train emergency brakes, but inadvertently placed the automatic brake handle into the suppression position when the lead locomotive of the train was 1478 feet west of Signal 504S. However, at that point, even if the LE had placed the train into emergency, the accident was inevitable as there was insufficient distance to stop train 318 prior to it colliding with train 315.

Placing the automatic brake handle into the suppression position was contrary to the LE’s training for placing a train into emergency, which requires that the automatic brake handle be moved all the way to the right, as far as it can go, until it encounters a stop. There are also a number of visual red light indicators within a locomotive cab that are available to inform an LE when a train is placed in emergency. Furthermore, as the emergency air brake pressure reduction propagates, and air is directly exhausted from the locomotive brake valves, there is a distinct sound that is clearly audible within a locomotive cab. The unactivated red lights and the absence of this audible cue should have been clear indicators that the train was not yet in emergency. The train was placed into suppression first, then into emergency 10 seconds later when Signal 504S, displaying a Stop indication, came into view. The activation of locomotive independent brakes and the train 318 LE’s call to the train 315 crew to request that they increase speed were also unusual and non-standard practices.

2.7 Fatigue management

Unpredictable variability in train crew shift start and end times can make it difficult to obtain an adequate amount of quality sleep and can cause an individual’s biological circadian rhythms to become desynchronized or result in an accumulated sleep debt, which can lead to fatigue. Compared to workers with regular shift schedules, workers with variable shifts get less sleep and are more likely to experience sleep disturbance, excessive sleepiness, disrupted circadian rhythms, and potentially accumulate sleep debts. Train operations performance decrements associated with shift work-related fatigue include slow reaction time to signals displayed in the field, loss of situational awareness in critical situations, and impaired compliance with train operating requirements.

Transport Canada (TC) recognized the challenges with variable shift work in the railway industry. As such, the TC–approved Work/Rest Rules for Railway Operating Employees (Work/Rest Rules) require railway companies to implement fatigue management plans designed to reduce fatigue and improve train crew on-duty alertness. The rules also identify that operating employees have a responsibility to report for work rested and fit for duty. Also the TC Railway Safety Management System Regulations require railways to apply the principles of fatigue science when scheduling work for their operating employees.

CN developed a training course entitled Fatigue Management for Operating Employees that it delivers to all of its new-hire operating employees. All CN operating employees are also required to complete an online refresher module on fatigue management in conjunction with their CROR requalification every 3 years. Both crew members of train 318 had received this training.

Before returning to work, the LE had 8 days off over the holiday season, and the conductor had 3 days off. The accident occurred during their second trip after returning to work. The CN work histories for both crew members in the 4-week period preceding the accident were reviewed and met the requirements of the Work/Rest Rules in terms of scheduling. However, as the detailed qualitative analysis and the FAST analysis show, and as the Railway Safety Management System Regulations require, the crew’s work history did not align with the principles of fatigue science.

The LE reported having no recollection of a short period of time prior to being reminded of the Clear to Stop signal indication by the conductor, and the conductor reported that the LE was unresponsive and unaware for that same time period.

A detailed qualitative assessment of the train 318 crew work/rest history for fatigue-related risk factors was conducted, which included the crew’s actual 30-day work history and estimated sleep history. The assessment revealed the following:

• The LE was likely experiencing some fatigue during the time leading up to the occurrence due to acute sleep disruption brought on by truncated sleep periods (5.5 hours of disrupted sleep) during the 2 previous nights.
• No fatigue risk factors were present for the conductor at the time of the occurrence.
• The LE and, to a lesser extent, the conductor, were at risk of circadian rhythm desynchronization in the first 3 weeks of December caused by variability in their work shifts’ start and end times.

The results from the Fatigue Avoidance Scheduling Tool (FAST) analysis, which predicts fatigue-related performance decrements, supported the findings from the qualitative analysis. The FAST analysis predicted that employees who worked a schedule similar to that of the LE would have demonstrated a performance decrement due to acute sleep disruption at the time of the occurrence. No performance decrement was estimated for employees working a schedule similar to that of the conductor at the time of the occurrence.

The FAST analysis also showed that employees working a schedule similar to those of the LE and the conductor in the first 3 weeks of December would have demonstrated an estimated performance decrement during some of their shifts due to circadian rhythm desynchronization (out of phase), in addition to inadequate recent sleep (last 24 hours), chronic sleep debt, and time of day fatigue factors.

Leading up to the collision, some elements of the LE’s performance and cognitive functioning were consistent with known performance decrements of fatigue. Specifically:

• The LE appeared unresponsive when the Clear to Stop indication displayed at Advance Signal 522S (Mile 52.2) was called out in the locomotive cab.
• The LE had no recollection of approximately 2.5 minutes from the time the train approached Signal 522S until he was reminded that they were operating under a Clear to Stop signal. During this time, the LE was staring straight ahead and was not verbally responding to the conductor.
• The LE did not perceive the Clear to Stop signal, and his unresponsiveness to the conductor’s signal call and lack of input to control the train after passing the Clear to Stop signal suggests that the LE may have experienced a brief micro-sleep, and was driving without awareness.
• The LE was unable to assess new and relevant information that contradicted his expectation and understanding that they were not stopping at Nattress (i.e., passing the Clear to Stop signal and the head end of train 315, which was still occupying the turnout at Nattress).
• The LE needed reminding of the signal indication (Clear to Stop) that they were proceeding under.
• The LE did not disengage TO or otherwise respond appropriately to the signal indication displayed in the field after encountering Advance Signal 522S (Mile 52.2).
• At Mile 50.68, the LE inadvertently moved the automatic brake handle to the suppression position rather than the emergency position.

2.7.1 Defences against fatigue

A review of all TSB rail investigation reports since 1990, excluding Class 5 occurrences and including this occurrence, determined that there have been 80 occurrences that may have been prevented if a train control system equivalent to positive train control (PTC) had been available, and 19 of 80 (24%) of these investigations had a finding related to operating employee fatigue. In any 24/7 industry, fatigue-related errors are common. Sleep-related fatigue or sleepiness increases the likelihood of errors of execution or planning.

To address the risk of fatigue to railway operating employees, the TC–approved Work/Rest Rules were developed pursuant to section 20(1) of the Railway Safety Act. Besides setting limits for hours of work and scheduling for operating employees, the Work/Rest Rules also require railway companies to implement a fatigue management plan designed to reduce fatigue and improve on-duty alertness.

To assist railways in developing fatigue management plans, TC developed Fatigue Management Plans – Requirements and Assessment Guidelines. The guidelines identify several risk factors that can increase the likelihood of operator impairment due to a lack of sleep, but they do not identify the effects of circadian rhythm desynchronization as a risk factor.

The information and training for operating employees on fatigue management is a positive step in reducing the risk associated with operating employee fatigue. However, the Work/Rest Rules, TC fatigue management plan guidelines, SMS fatigue requirements, the requisite company fatigue management plans, rest provisions provided in collective agreements, and training for operating employees are all administrative defences. Such defences rely on an individual to follow the rules and take advantage of the rest opportunities provided, and do not consider the human factors that affect behaviour in everyday life.

The challenge is that there is no way to monitor or influence employee behaviour when they are off duty. Furthermore, there is no physical fail-safe system available in Canada with the potential to reduce the risk of an accident when an operating employee may be fatigued.

2.8 Trip Optimizer

Railways have widely implemented the use of TO primarily to gain operational efficiencies. TO uses complex algorithms derived from information such as global positioning system (GPS) location, track profile, and train characteristics to more efficiently maintain track speed, reduce train crew errors, maximize fuel conservation and reduce in-train forces, all of which contribute to either improvements in safety or operational efficiencies.

The operating requirements in CN’s Trip Optimizer Procedure Guide specify that the LE is responsible for all braking, and must maintain vigilance and apply situational awareness at all times. The guide further outlines that when a train is being operated on a restrictive signal indication, which is a signal that displays anything other than a Clear indication, or is approaching limits of authority, it is the LE’s responsibility to take manual control of the train to meet the reduced speed conditions. Numerous subdivisions throughout the CN system have been mapped for TO. CN LEs are trained to use TO and are required to use it when operating locomotives that are equipped with it.

2.8.1 Human factors issues associated with the use of Trip Optimizer

When operating a train using TO, which is similar to cruise control on automobiles, an LE’s tasks shift from a proactive, anticipatory driving strategy toward a more reactive monitoring strategy and lower workload.

A lower workload can lead to increases in feelings of sleepiness and tiredness as it reduces the individual’s arousal levels. If an individual is already fatigued, low workload can exacerbate the perception of that fatigue. Reductions in workload can also lead to reduced vigilance, which has been shown to reduce the overall detection rate of critical stimuli over the duration of a task. Train crews may also experience problems maintaining situational awareness of the primary task, especially in the presence of fatigue. The LE in this occurrence was likely affected by these factors.

2.9 Train 318 crew experience and authority gradient

The Canadian Rail Operating Rules (CROR) specify that the responsibility for rules compliance, including signal recognition and confirmation, is equally shared among all crew members present in the cab, regardless of experience.

At the time of the accident, the LE had almost 8 years of operations experience, 3.5 of which were as a qualified LE and all of which were working out of the CN Winnipeg terminal. By comparison, the conductor had 10 months of experience as a qualified conductor and had transferred to the CN Winnipeg terminal in October 2018. The conductor used job aids provided by CN and kept them in front of him in the locomotive cab to reference while working.

At about 0906 on the day of the occurrence, the conductor observed Advance Signal 522S (Mile 52.2), which displayed a Clear to Stop indication identifying that the train could proceed at track speed but must be prepared to stop at the next signal: Controlled Signal 504S (Mile 50.4) at Nattress. When the conductor called out the signal indication in the locomotive cab, he did not hear the LE verbally respond. The LE had not consistently acknowledged all signals that train 318 had encountered while enroute.

The conductor had limited knowledge of locomotive operation or train braking systems, and relied on the LE to operate the train. He assumed that the LE understood the restrictive signals and was operating the train accordingly. The fact that the conductor did not hear the LE respond to his callout of the Clear to Stop indication at Advance Signal 522S (Mile 52.2) was not sufficiently compelling to cause the conductor to question the LE’s understanding of the situation.

At about 0908:22, the head-end locomotives of both train 318 and train 315 passed each other at Mile 51.13, 3854 feet west of Signal 504S (Mile 50.4). At that time, the train 318 conductor reminded the LE that they were proceeding on a Clear to Stop indication, which meant that they should be preparing to stop. Once reminded, the LE took immediate action, disengaged TO at 0908:33, and made a full service train brake application at 0908:34. Twenty-four seconds later, at 0908:58, the LE attempted to apply the emergency brakes, but put the brake handle into the suppression position rather than the emergency position. Ten seconds later, at 0909:08, when Signal 504S came into view, the LE initiated an emergency brake application from the tail end of the train using the input and display unit (IDU) toggle switch.

The conductor did not ensure that the LE understood that they should be preparing to stop, and did not intervene to perform an emergency brake application. As a result, the crew actions to slow and stop the train before Controlled Signal 504S were delayed and ineffective.

The concept of authority gradient is universal and has been demonstrated in most transportation modes. When an authority gradient exists, there is usually a difference in the level of experience and authority between the operating crew members. In these situations, there is a danger that safety-compromising behaviour can be overlooked because a less experienced employee is often reluctant to question the actions of a more senior employee.

Railway operations place equal responsibility for safe train operations on all crew members. However, as demonstrated by this accident, when an authority gradient exists between crew members in a locomotive cab, intra-cab crew communication can fail and lead to adverse outcomes. In this case, the conductor did not ensure that the LE understood that they should be preparing to stop, and neither the LE nor the conductor attempted to make an emergency brake application at a distance that would have permitted the train to be safely brought to a stop.

2.9.1 Crew resource management

Although an administrative tool, crew resource management (CRM) training in aviation and other industries has been found to help crews develop the skills to overcome communication issues and coordinate their activities more effectively within the operating environment. In-depth CRM training emphasizes non-technical skills such as:

• communication to avoid misunderstandings,
• briefing,
• backing up behaviour,
• mutual performance monitoring,
• team leadership,
• decision making,
• task-related assertiveness (e.g., a junior operator speaking up to a dominant colleague), and
• team adaptability.

CRM training also alerts crews to become more vigilant for losses of situational awareness and discusses aspects of team situational awareness such as perception, information sharing, coordination, and crosschecking information.

Closed-loop communication avoids misunderstandings and requires that when a sender communicates a message, the receiver repeats the message back, and the sender then confirms that the message has been received and understood.

In the rail industry, operating rules require that crew members verbally acknowledge signal indications displayed in the field to each other, but do not require full closed-loop communication. When a train encounters a signal indication displayed in the field, 1 crew member must communicate the signal indication aloud within the locomotive cab to the other crew member. While the other crew member is required to repeat the message back, there is no requirement for the original sender to confirm that the message was received accurately or understood by the other crew member.

There is currently no regulatory requirement to include CRM training as a module for LE and conductor qualification and requalification. Consequently, the adoption of CRM training in the rail industry has been sporadic, and the approach differs between railways. Since 2017, CN has delivered a course called “Looking out for each other” as part of its operating crew requalification programs delivered every 3 years.

While the CN training is insightful and well structured, it is more broadly focused and does not address train crew interaction within a locomotive cab or the authority gradients that may exist in that environment. CP provides CRM training to its new operating employees, but does not provide its operating crews with formal recurrent CRM training. Although railway training touches on CRM principles, neither CN nor CP provide dedicated, recurrent CRM training that explores all aspects of CRM.

2.10 Train control defences

Rail transportation is a complex system. The defence-in-depth philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors. Wherever possible, a combination of rules-based (i.e., administrative) defences and physical defences should be implemented to address normal slips, lapses, and mistakes that characterize human behaviour. The design of CTC signalling systems in Canada relies on administrative defences, which are not as effective for mitigating risk as are physical defences.

Administrative defences place an over-reliance on an individual to follow the rules and do not consider the human factors that affect behaviour in everyday life. For example, the CTC train control system relies on train crews observing each signal indication, broadcasting it, and then taking the appropriate actions. If the crew does not correctly observe the signal indication or does not take the appropriate action, the administrative defence as a whole fails.

In contrast to the administrative defences for train control systems available in Canada, Class 1 railways that operate in the U.S. have implemented physical fail-safe train control systems, known as PTC, that are designed to prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movement of a train through a switch left in the wrong position. A PTC system addresses the risk of crews misinterpreting or not following signal indications by automatically intervening to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. A fully functioning PTC system also offers a physical fail-safe defence against operating crew errors that are influenced by fatigue.

By the end of 2020, both CN and CP had fully implemented PTC on the required subdivisions of each railway’s U.S. operations. Specifically, PTC was fully operational on a total of 3107 miles of CN’s U.S. infrastructure and 2118 miles of CP’s U.S. infrastructure. Despite significant investment in PTC technology for the CN and CP locomotive fleets and their U.S. infrastructure, it is unclear what, if any, action is planned by the railways and the Canadian regulator to extend the use of PTC or a similar form of automatic or enhanced train control (ETC) in Canada.

2.11 Risks associated with administrative defences for train operations

A review of all TSB rail investigation reports (excluding Class 5 occurrences and including this occurrence) since the creation of the TSB in 1990determined that there have been 80 occurrences that may have been prevented, or the severity of the outcome reduced, by a train control system equivalent to PTC.

When TSB Class 5 occurrences are also considered, between 2004 and 2019, there was an annual average of 31 reported occurrences in which a train crew did not respond appropriately to a signal indication displayed in the field, and the number of these occurrences each year is on the rise. The years 2018 and 2019 had the highest number of these occurrences, with 40 and 38 respectively.

CN had recognized this trend and, on 14 November 2018, issued a System Notice that identified an increase in CROR Rule 439 violations in Canada that involved movements passing stop signals without authorization. In many instances, operating crews did not adhere to a signal indication displayed in the field or wrongly anticipated that signals they were approaching would be permissive by the time they reached them. CN also noted that train crews sometimes made assumptions based on radio chatter they overheard regarding a train they were going to meet or a train they were following.

These elements identified by CN in the notice were also factors that contributed to this accident. While the company notice served as a reminder to crews on the rules and instructions regarding signal indications and how to maintain situational awareness while on duty, it was still just another administrative defence that did not fully address the problem, and 1.5 months later, this accident occurred. Furthermore, although the train crew’s work history was in accordance with the Work/Rest Rules, this did not prevent them from being fatigued.

This demonstrates that current administrative defences for train operation, such as company procedural guidelines, the CROR, and the Work/Rest Rules, are not always effective. The implementation of physical fail-safe train control technologies would provide another layer of safety when operated in conjunction with existing administrative defences.

2.12 Risks associated with train operations on key routes

A key route is defined as any track on which, over a period of 1 year, the railway carries 10 000 or more loaded tank cars or loaded intermodal portable tanks containing dangerous goods (DG).

In 2018, there were 144 789 car loads of DG transported on the eastern portion of the Rivers Subdivision. The DG transported included a variety of over 150 products, some of which were highly flammable, toxic or poisonous to the extent that they could present a serious risk to the public in the event of a release. By definition, the CN Rivers Subdivision is a key route and is also an integral part of one of the major rail traffic corridors in Canada.

This also means that the cities, towns, and villages along this key route are continually exposed to the risks associated with key trains transporting DG. Any collision or derailment involving a key train presents a risk of a DG release.

2.13 Positive train control in the United States

In the U.S., the National Transportation Safety Board (NTSB) issued its first recommendation for the development and implementation of a PTC system in 1970. Over the next half century, the NTSB investigated more than 150 PTC-preventable accidents that took the lives of more than 300 people and injured about 6700 others. From these investigations, the NTSB made another 51 PTC-related recommendations.

In September 2008, a collision between a Metrolink commuter train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the Rail Safety Improvement Act of 2008 (RSIA) in the U.S. The RSIA mandated that, by 2015, PTC be installed on rail lines in the U.S. that met the following criteria:

• Class 1 railroad main lines that had 5 million or more gross tons of traffic annually.
• Rail lines that had any shipments of products that were poison or toxic by inhalation (PIH/TIH).
• Rail lines over which regularly scheduled intercity passenger or commuter rail services were provided and any other rail lines that the Secretary may prescribe by regulation or order.

However, due to technical challenges and delays in implementing PTC, the deadline was extended to the end of 2020.

As of 31 December 2020, PTC was fully implemented on all track required by the RSIA legislation, a total of 57 535.7 miles, which accounts for about 41% of the nearly 140 000 route-miles of the U.S. rail network. The total miles of track that have PTC installed includes the U.S. operations of both CN (3107 miles) and CP (2118 miles).

Despite significant investment in PTC technology for the CN and CP locomotive fleets and their U.S. infrastructure, it is unclear what, if any, action is planned by the railways and the Canadian regulator to implement the use of PTC or a similar form of automatic or ETC in Canada.

2.14 Regulatory oversight and initiatives for enhanced train control in Canada

In 2000, the TSB made its first recommendation (R00-04) for implementing additional train control defences following its investigation into the 1998 collision between 2 CP trains near Notch Hill, British Columbia.^{Footnote 124}

In 2013, the TSB made its second recommendation (R13-01) for implementing additional train control defences following its investigation into the 2012 derailment and collision of VIA Rail Canada Inc. passenger train 92 (VIA 92) near Burlington, Ontario.^{Footnote 125} The Board recommended that TC require major Canadian passenger and freight railways to implement physical fail-safe train controls, beginning with Canada’s high-speed rail corridors.

In 2014, in response to the 2 TSB recommendations, a joint TC–industry train control working group (TCWG) was established under the Advisory Council on Railway Safety (ACRS) to study the issue. The TCWG was chaired by TC Rail Safety, and primarily included representatives from the railway industry and operating crew unions.

2.14.1 Train Control Working Group Final Report

In 2016, the TCWG produced a report called Train Control Working Group Final Report. The TCWG report stated that from 2011 to 2015, 38% (2604 of 6786) of occurrences recorded in the TSB rail occurrence database system (RODS) were main-track occurrences, and that 380 of 2604, or 14.6%, could be defined as ETC-preventable occurrences.

However, even on main track, ETC would not be intended to prevent crossing, trespasser, fire, or hi-rail vehicle derailment or collision accidents. A TSB review of the data concluded that when these accident type totals (1483) are excluded from the 5-year dataset, 1121 of 6786 (16.5%) of occurrences recorded in RODS were main-track occurrences, and that 380 of the 1121 (33.9%) can be defined as ETC-preventable occurrences.

The report concluded that a targeted, risk-based, corridor-specific implementation of train control technologies would be the best option for Canada. However, such a system could include a static display of track infrastructure, speed limits, and operating restrictions without positive enforcement, and would still rely on the operating crew for compliance. A more extensive ETC system could be designed using fail-safe design methods and could incorporate positive enforcement capabilities.

2.14.2 Canadian Rail Research Laboratory follow-on study in support of Train Control Working Group Final Report conclusions

In 2017, TC contracted the Canadian Rail Research Laboratory (CaRRL) to conduct a follow-on study in support of the Train Control Working Group Final Report and conclusions. CaRRL submitted its follow-on Report on Enhanced Train Control to TC in February 2018.

In the report, CaRRL categorized ETC into 4 levels, which are all theoretical in nature, but ETC Level 1 to 3 systems should be able to be implemented with existing technologies. Level 3 is an ETC system that has the same functionality as PTC. Level 4 is the most advanced and involves a complete redesign of existing train control infrastructure into a communication-based moving block system. At Level 4, all requirements for wayside signalling would be eliminated and all operating authorities would be contained within the ETC system.^{Footnote 126} Implementing a Level 4 ETC system would involve considerable additional technological development.

The CaRRL report identified that 5.96% (837 of 14 036) of RODS occurrences from 2007 to 2016 (inclusive) were preventable by a Level 4 ETC system. The CaRRL report concluded that widespread implementation of the ETC framework referenced in the CaRRL report may not be the best approach to improve overall rail safety in Canada.

2.14.3 TSB review of the Canadian Rail Research Laboratory Report on Enhanced Train Control

The CaRRL report identified that only 5.96% (837 of 14 036) of RODS occurrences (from 2007 to 2016) were preventable by a Level 4 ETC system. However, ETC systems would not be intended to prevent crossing, trespasser, fire, or hi-rail vehicle derailment or collision accidents, and therefore, the occurrence baseline should exclude these accidents.

When crossing, trespasser, fire, and hi-rail vehicle derailment and collision accidents are excluded, the total number of main-track occurrences was 2668, not 14 036 as indicated in the CaRRL report. Consequently, the TSB estimates that 837 of 2668 main-track occurrences, or 31.4%, would have been ETC-preventable.

Both the TCWG and CaRRL reports arrived at conclusions that suggested that widespread implementation of ETC may not be the best approach to improve overall rail safety in Canada. However, the TSB results show that about 1 in 3 accidents on main track were potentially preventable by ETC, and therefore, a more widespread implementation of ETC could provide some meaningful positive impacts on rail safety. Lastly, this could likely be accomplished using existing technology and a Level 3 ETC system without a Level 4 ETC redesign.

Since 2000, when the TSB made its first recommendation (R00-04) for implementing additional train control defences, the TSB has conducted 33 investigations (including this one) that were determined to be ETC-preventable.

Since 2014, in the time it took TC and industry to strike the TCWG, study the issue, produce the Train Control Working Group Final Report, contract a follow-on report from the CaRRL and study the CaRRL results, PTC had been fully implemented in the U.S. on all of the high-hazard trackage required by the RSIA legislation. This equates to 57 535.7 miles of track, which is about 41% of the nearly 140 000 route-miles of the U.S. rail network.

In Canada, key routes account for a combined total of about 10 940 miles of main track, which represents approximately 42% of the Canadian rail network. When the key route criteria are compared to the high-hazard route criteria of the U.S. RSIA, it is reasonable to conclude that the hazards and percentages for route-miles of affected track are similar.

3.1 Findings as to causes and contributing factors

1. The collision occurred as eastbound Canadian National Railway Company (CN) train M31851-01 (train 318), operating on the south track of the CN Rivers Subdivision, went past Controlled Signal 504S at Mile 50.4, which displayed a Stop indication, and struck the 95th to 102nd cars of westbound CN train M31541-03 (train 315). Train 315 was on the north track where it transitions to double main track and was exiting the equilateral turnout at Mile 50.37 when the accident occurred.
2. As a result of the collision, the 2 lead head-end locomotives on train 318 and 8 cars on train 315 sustained damage and derailed.
3. After the train 318 crew overheard the radio conversation between the rail traffic controller and train Q11651-30 (train 116) crew, the train 318 crew expected to continue to follow train 116 to Winnipeg without stopping.
4. The train crew did not respond to the Advance Signal 522S Clear to Stop indication, and operated on a restrictive signal for 6389 feet with Trip Optimizer engaged and without slowing down.
5. The locomotive engineer assumed manual control from Trip Optimizer and made a full service brake application with insufficient distance to be able to stop the train before Signal 504S and to avoid the collision using the selected braking technique.
6. The locomotive engineer’s mental model of the situation and expectation of how the situation would unfold contributed to a delayed reaction to the restrictive signal indication displayed at Advance Signal 522S (Mile 52.2).
7. The locomotive engineer was fatigued due to acute sleep disruption brought on by abbreviated and disrupted sleep periods during the 2 nights preceding the accident. As a result, at the time of the occurrence, he was likely experiencing a performance decrement that contributed to the delayed reaction in responding to restrictive Signal 522S.
8. It is likely that the low workload associated with operating train 318 using Trip Optimizer, together with fatigue, reduced the locomotive engineer’s arousal levels and impacted his ability to maintain vigilance and situational awareness.
9. Due to the inexperience of the train 318 conductor and the authority gradient that existed between the crew members, the conductor deferred to the locomotive engineer without questioning the operation of the train and, as a result, the crew’s actions to slow and stop the train before Controlled Signal 504S were delayed and ineffective.
10. In the absence of a physical defence such as an enhanced train control system, there was no automatic intervention to slow or stop the train when the crew did not initially respond to the Clear to Stop signal displayed in the field.

3.2 Findings as to risk

1. Despite the administrative defences provided by the Work/Rest Rules for Railway Operating Employees and fatigue management guidelines, as well as railway company scheduling practices and fatigue management plans, operating employees continue to be negatively influenced by fatigue, increasing the risk of accidents occurring.
2. If operating crew members do not receive enhanced initial and recurrent crew resource management training to develop skills in crew communication, the coordination of decision making and activities, and dealing with authority gradients that may exist within a locomotive cab environment, there is an increased risk that inadequate crew communication will lead to unsafe operations.
3. If the Canadian railway industry continues to rely solely on administrative defences, such as company procedural guidelines, the Canadian Rail Operating Rules, or the Work/Rest Rules for Railway Operating Employees, to protect against train crews not responding appropriately to signal indications displayed in the field, there is a continuing risk of train accidents and incidents occurring.
4. If a train accident occurs on a key route, a key train, or trains, may be involved, increasing the risk of a dangerous goods release and adverse consequences to people, property or the environment.
5. If Transport Canada and the railway industry do not take action to implement physical fail-safe defences to reduce the consequences of inevitable human errors, the risk of collisions and derailments will persist, with a commensurate increase in risk on key routes in Canada.

3.3 Other findings

1. The distance of 9504 feet between Advance Signal 522S and Controlled Signal 504S was sufficient to safely stop train 318 using the locomotive engineer’s selected method of a full service brake application.
2. An emergency brake applied from both the lead locomotive and the end-of-train unit would have been sufficient to bring the train to a stop 2316 feet before Signal 504S.
3. Placing the automatic brake handle into the suppression position while the train was moving did not provide any additional braking force compared to a full service brake application, and further increased the estimated stopping distance compared to an emergency brake application.
4. The train 318 locomotive engineer and conductor were at risk of fatigue-related performance decrements in the weeks preceding the occurrence due to circadian rhythm desynchronization as a result of variability in shift start and end times.
5. Class 1 railways that operate in the United States (U.S.) have implemented positive train control on the trackage required by U.S. legislation, which also provides a physical fail-safe defence against operating crew errors that are influenced by fatigue.

4.1 Safety action taken

4.1.1 Canadian National Railway Company

On 04 April 2019, following this occurrence, Canadian National Railway Company (CN) distributed System Notice No. 904 to all operating employees in Canada. The notice warned train crews that there had once again been a marked increase in Canadian Rail Operating Rules Rule 439 violations across the CN system. In these cases, train crews failed to stop at signal indications requiring them to do so, primarily due to a lack of focus on situational awareness.

It also noted that “operating crews must not be influenced by other information such as train lineups, detector broadcasts or other crew’s [sic] broadcasts until they themselves positively identify the next signal.”

4.2 Safety action required

Eastbound CN train M31851-01 (train 318) was proceeding on the south main track of the Rivers Subdivision. Train 318 was a key train operating on a key route, as defined by the Transport Canada (TC)–approved Rules Respecting Key Trains and Key Routes.

At 0906:54, train 318 was travelling at 42 mph, with Trip Optimizer (TO) engaged and the throttle in position 7, as it passed a Clear to Stop signal indication at Mile 52.2. The conductor had called out the signal in the locomotive cab and identified the Clear to Stop indication but did not hear the LE verbally respond to acknowledge the signal.

At Mile 51.13, while travelling at 46 mph, train 318 passed the head end of train M31541-03 (train 315), which was westbound on the north track. The train 318 conductor then reminded the locomotive engineer (LE) that they were operating under a Clear to Stop indication. Once reminded, the LE disengaged TO and made a full service brake application at 0908:34; 24 seconds later, he inadvertently placed the brake handle into the suppression position, and then applied the locomotive independent brake.

At 0909:08, train 318 was proceeding at 39 mph at Mile 50.57 when the LE recognized that a collision was inevitable and placed the train in emergency. By 0909:30, train 318 had slowed to 23 mph when it side-collided with the 95th car of train 315 at Mile 50.37, as train 318 negotiated the equilateral turnout.

The investigation concluded that:

• The train 318 operating crew did not respond appropriately to the signal indications displayed in the field at Mile 52.2 and Mile 50.4, which ultimately led to the collision.
• It is likely that the low workload associated with operating train 318 using TO, together with fatigue, reduced the LE’s arousal levels and impacted his ability to maintain vigilance and situational awareness.
• In particular, in the absence of a physical defence such as an enhanced train control system, there was no automatic intervention to slow or stop the train when the crew did not initially respond to the Clear to Stop signal displayed in the field.
• Due to the inexperience of the train 318 conductor and the authority gradient that existed between the crew members, the conductor deferred to the LE without questioning the operation of the train and, as a result, the crew’s actions to slow and stop the train before Controlled Signal 504S were delayed and ineffective.

4.2.1 Enhanced train control for key routes

The rail transportation system is complex. The defence-in-depth philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors. Wherever possible, a combination of rules-based (i.e., administrative) defences and physical defences should be implemented to address normal slips, lapses, and mistakes that characterize human behaviour. Although newer circuitry has been integrated over the years, the basic design of centralized traffic control (CTC) signalling systems in Canada is well established. Despite this newer circuitry, railway operations still rely predominantly on administrative defences, which are the least effective method for mitigating risk.

Administrative defences, such as the Canadian Rail Operating Rules, railway general operating instructions and bulletins, place an over-reliance on a train crew to follow the rules and do not consider the human factors that affect behaviour in everyday life. For example, the CTC train control system in this case had the administrative requirement for train crews to follow the signal indications displayed in the field. Safe train operations are contingent on train crews observing each signal indication, broadcasting it, and then taking the appropriate actions.

A signalled CTC system does not provide any advance warning to either the train crew or the rail traffic controller if a train crew does not observe a signal indication or does not take the appropriate action. CTC also does not provide automatic enforcement to comply with speed restrictions in order to slow or stop a train before it passes a restrictive signal.

In instances where a train crew misperceives, misinterprets or does not follow a signal indication, the administrative defences as a whole fail. As demonstrated in this and other occurrences, when an administrative defence fails and there is no secondary defence, it can result in an accident that otherwise could have been prevented.

In contrast to the administrative defences for train control systems available in Canada, Class 1 railways that operate in the United States (U.S.) have implemented physical fail-safe train control systems known as positive train control (PTC). PTC is designed to prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movement of a train through a switch left in the wrong position. In Canada, the term “enhanced train control” (ETC) has been adopted to describe such systems.

A PTC/ETC system would address the risk of crews misinterpreting or not following signal indications by automatically intervening to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. A fully functioning PTC/ETC system would also offer a physical fail-safe defence against operating crew errors that are influenced by fatigue, which played a role in this accident.

In the U.S., over the last 50 years, the National Transportation Safety Board (NTSB) has investigated more than 150 PTC-preventable accidents that took the lives of more than 300 people. From these investigations, the NTSB made 51 PTC-related recommendations.

In September 2008, a collision between a Metrolink commuter train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the Rail Safety Improvement Act of 2008 (RSIA) in the U.S. The RSIA mandated that PTC be installed on main rail lines that had specific risks associated with the transportation of dangerous goods (DG) as well as intercity and commuter passenger rail service.

As of 31 December 2020, PTC was fully implemented in the U.S. on all track required by the RSIA legislation, a total of 57 535.7 miles, which accounts for about 41% of the nearly 140 000 route-miles of the U.S. rail network. The total miles of track that have PTC installed includes the U.S. operations of both CN (3107 miles) and CP (2118 miles).

For comparison, the Canadian rail network comprises about 26 000 route-miles of track. Key routes account for a combined total of about 10 940 miles of main track, which represents about 42% of the Canadian rail network. When the key route criteria are compared to the high-hazard route criteria of the U.S. RSIA, it is reasonable to conclude that the hazards and percentages for route-miles of affected track are similar. Although U.S. legislation required that PTC be installed on high-hazard routes, there is no similar requirement to install PTC or ETC on comparable routes in Canada that carry DG.

A review of all TSB rail investigation reports (excluding Class 5 occurrences and including this occurrence) produced since the inception of the TSB in 1990 determined that 80 occurrences may have been prevented had a train control system equivalent to PTC (i.e., ETC) been available.

Furthermore, when TSB Class 5 occurrences are also considered, from 2004 to 2019, there was an annual average of 31 reported occurrences in which a train crew did not respond appropriately to a signal indication displayed in the field, and the yearly number of these occurrences is on the rise. In particular, 2018 (40) and 2019 (38) had the highest number of these occurrences.

In 2000, the TSB issued its first recommendation (R00-04) for implementing additional train control defences following its investigation into the 1998 collision between 2 CP trains near Notch Hill, British Columbia.^{Footnote 127} After determining that backup safety defences for signal indications were inadequate, the Board recommended that

In 2013, the TSB issued another recommendation (R13-01) for implementing additional train control defences following its investigation into the 2012 derailment and collision of VIA Rail Canada Inc. passenger train 92 (VIA 92) near Burlington, Ontario.^{Footnote 128} Following the investigation, the TSB indicated that Transport Canada (TC) and the industry should move forward with a strategy that would prevent these types of accidents by ensuring that signals, operating speeds, and operating limits are always followed. The Board recommended that

In 2014, in response to the 2 TSB recommendations, a joint TC–industry train control working group (TCWG) was established. The group was chaired by TC Rail Safety, and also included representatives from the railway industry and operating crew unions. After establishing the TCWG, there were a series of ongoing meetings, discussions, and studies related to the development and implementation of ETC systems in Canada with no implementation plan or other tangible results to date. While TC did publish a Notice of Intent in the Canada Gazette, Part I, in February 2022 signalling its intent to require the implementation of ETC in Canada, there is still no implementation plan.

In the time it took TC and industry to strike the TCWG, study the issue, produce the TCWG Final Report, contract a follow-on report from the Canadian Rail Research Laboratory (CaRRL) and study the CaRRL results, PTC had been fully implemented in the U.S. on all of the high-hazard trackage required by the RSIA legislation.

Despite significant investment in PTC technology for the CN and CP locomotive fleets and their U.S. infrastructure, and 2 TSB recommendations to TC related to ETC dating back over 20 years, little has been done to extend the use of PTC into Canada or develop a similar form of ETC in Canada.

In this occurrence, with no backup physical fail-safe defence, such as a PTC/ETC system, there was no automatic intervention available to slow or stop the train. Consequently, the collision occurred after the train 318 LE, who was fatigued, did not respond appropriately to the Clear to Stop signal displayed in the field.

By definition, the CN Rivers Subdivision is a key route and is also an integral part of one of the major rail traffic corridors in Canada. This also means that the cities, towns, and villages along this key route are continually exposed to the risks associated with key trains transporting DG. Any collision or derailment involving a key train presents a risk of a DG release. If a train accident occurs on a key route, a key train or trains may be involved, increasing the risk of a DG release and potential adverse consequences to people, property or the environment.

It is clear that the current administrative defences for train operation, such as company procedural guidelines, notices and instructions, as well as the TC–approved Canadian Rail Operating Rules and Work/Rest Rules for Railway Operating Employees, are not always effective. Consequently, incidents and accidents continue to occur.

The first TSB recommendation on this issue is over 20 years old. The 2013 recommendation called for the implementation of physical fail-safe train controls, beginning with Canada’s high-speed rail corridors.^{Footnote 129} While the high-speed corridors are generally comprised of key routes, more recent accident history demonstrates that there is also a need for the implementation of fail-safe train control systems on all key routes.

The implementation of physical fail-safe train control technologies such as ETC would provide an extra layer of safety when operated in conjunction with existing administrative defences. However, the Canadian railway industry continues to rely solely on administrative defences, such as company procedural guidelines, the Canadian Rail Operating Rules, and the Work/Rest Rules for Railway Operating Employees, to protect against train crews not responding appropriately to signal indications displayed in the field. If TC and the railway industry do not take action to implement physical fail-safe defences to reduce the consequences of inevitable human errors, the risk of collisions and derailments will persist, with a commensurate increase in risk on key routes in Canada. Therefore, the Board recommends that

4.2.2 Crew resource management training

Railway operations are governed by rules and instructions that place equal responsibility for safe train operations on all crew members. Safe railway operations are predicated on all crew members following all of the rules, all of the time. In the rail industry, operating rules require that crew members verbally acknowledge signal indications displayed in the field to each other. When a train encounters a signal indication displayed in the field, 1 crew member must communicate the signal indication aloud within the locomotive cab to the other crew member. While the other crew member is required to repeat the message back, there is no requirement for the original sender to confirm that the message was received accurately or understood by the other crew member. As a result, this communication can fail.

The railway rules do not specify a closed-loop communication method, meaning there is no requirement for the original sender of the message to acknowledge, and therefore confirm, that it was received accurately. Moreover, when there is a significant difference in level of experience between operating crew members, an authority gradient may develop in which the less experienced crew member may not always intervene to ensure compliance with all of the rules. In these situations, there is a danger that safety-compromising behaviour will be overlooked because a less experienced employee may be reluctant to question the actions of a more senior employee or intervene in the operation of the train even when it may be critical to do so.

In this occurrence, the investigation determined that communications between the 2 crew members were not always closed-loop. The callouts of signal indications by the conductor were not always acknowledged or repeated back by the LE. The conductor did not confirm that the LE had understood the communication nor was he required to do so. The inexperience of the conductor on the subdivision, and with locomotive operations, also deterred him from trying to intervene and stop the train.

Crew resource management (CRM) is a concept introduced in the aviation and marine industries to limit or eliminate human errors by recognizing the importance of cognitive and interpersonal skills, thereby improving safety. CRM targets a crew’s skills, abilities, attitudes, communication, situational awareness, problem solving, and teamwork. Crew members must successfully interact with each other, their equipment, and their environment to effectively manage threats, errors, and unexpected conditions that may be encountered.

In order to perform in a coordinated, efficient, and safe manner, crew actions need to be based on a common understanding of the current state of the equipment, the intended route to be taken, and any other potential threats. When this understanding is consistent, crews are better able to effectively anticipate and coordinate their actions to achieve their common goal. This common understanding between crew members is referred to as team or shared situational awareness.

Shared situational awareness is developed and maintained by a crew through a number of discrete and continuous behaviours. These behaviours include in-trip briefings, the identification of key points throughout the trip, threat and error management (TEM), callouts to any change in the state of the equipment, the instrument setting or mode, and the communication of any change in plans to ensure that all crew members have a common understanding of activities.

TEM stresses the principles of anticipation, recognition, and recovery when addressing threats, errors, and undesirable equipment states, and is based on the proactive detection of threats that could reduce safety margins. Effective error management is associated with specific behaviours by the crew, the most common being vigilance, a propensity to ask questions or provide feedback, and assertiveness.

A 2015 study entitled Human Factors Analysis of “Missed Signals” in Railway Operations,^{Footnote 130} when addressing team training, indicated that CRM training

emphasizes non-technical skills such as communication, briefing, backing up behaviour,^{Footnote 131} mutual performance monitoring, team leadership, decision making, task-related assertiveness (e.g., a junior operator speaking up to a dominant colleague), and team adaptability.

The report went on to state that CRM training includes aspects of team situational awareness such as “perception” and “information sharing, coordination and crosschecking information” and instructed crews to “become vigilant for losses of [situational awareness]; both one’s own and by others.”

CRM focuses on providing crews with the interpersonal skills required to carry out their tasks safely: “CRM training typically consists of an ongoing training and monitoring process through which personnel are trained to approach their activities from a team perspective rather than from an individual perspective.”^{Footnote 132}

Significant safety benefits were experienced in the aviation and marine industries with the introduction of CRM. Given the prevalence of human factors issues in rail accident statistics, this type of training could yield significant safety benefits in the rail industry.^{Footnote 133}

Since 2017, CN has delivered a course called “Looking out for each other” as part of its operating crew requalification programs delivered every 3 years. While the CN training is insightful, it is broadly focused and does not specifically deal with train crew interaction within a locomotive cab or the authority gradients that may exist in that environment. While CP provides CRM training to its new operating employees, it does not provide formal dedicated recurrent CRM training.

The Railway Employee Qualification Standards Regulations have no requirement for operating crews to complete a separate module on CRM when they qualify or re-qualify. Consequently, the adoption of CRM training in the rail industry has been sporadic and the approach differs between railways. Although railway training touches on CRM principles, neither Canadian Pacific Railway Company (CP) nor CN provide dedicated, recurrent CRM training that explores all aspects of CRM. Recurrent CRM training would seek to improve non-technical skills that deal with in-cab communication, job briefings, backing up behaviour, mutual performance monitoring, team leadership, decision making, task-related assertiveness (e.g., a junior operator speaking up to a dominant colleague), team adaptability, as well as concepts of TEM and team situational awareness.

The TSB has investigated 8 other rail occurrences, dating back as far as 1996, in which ineffective CRM practices were identified as a factor that contributed to the accidents.^{Footnote 134}

If operating crew members do not receive enhanced initial and recurrent CRM training to develop skills in crew communication, the coordination of decision making and activities, and dealing with authority gradients that may exist within a locomotive cab environment, there is an increased risk that inadequate crew communication will lead to unsafe operations. Therefore, the Board recommends that

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 28 April 2022. It was officially released on 24 August 2022.

Appendix A – Hypothetical work/rest histories

To assess and forecast performance changes associated with sleep-wake patterns resulting from work schedules similar to that of the crew, a hypothetical sleep schedule was developed based on the crew’s work schedule for the 30 days prior to the occurrence, their normal sleep pattern, known sleep periods and sleep assumptions (see list below).

The following sleep assumptions were made when sleep times were unknown:

• on a day when the crew had no work, it was assumed that they went to sleep at 2300 and woke up at 0700;
• because the LE had small children who were cared for at home, if the LE arrived home from work in the middle of the night, a 0700 wake time was assigned;
• 1 hour at the end of each shift was applied for travel, eating, and personal care tasks before sleep;
• if the LE’s work shift ended in the morning and he was required to work again in the evening of the same day, an assumed 2-hour nap was applied before the LE was ordered for his shift (based on the LE’s reported sleep mitigation strategies);
• because the conductor lived alone and had no children, he would get as much sleep as possible between shifts, and would not nap between 1600 and 1900.

Appendix B – Quick reference guide: fatigue risk factors

Risk factor	Not present: no performance effect	May be present: possible performance effect	Likely present: likely performance effect
Acute sleep disruption	<30 minutes departure in optimal sleep quantity in last 3 sleep periods. No awakenings >30 minutes during last 3 sleep periods.	Some restriction to optimal sleep quantity in last 3 sleep periods. One or more awakenings resulting in >30 minutes lost sleep during last 3 sleep periods.	Significant restriction of sleep or multiple awakenings during last 3 sleep periods and/or no opportunity to recover.
Chronic sleep disruption* (total sleep time – total awake time x preferred ratio of sleep to wakefulness)	Chronic sleep debt of <2 hours. Few, or no, awakenings in sleep-wake history.	Chronic sleep debt of <8 hours. Awakenings occurred frequently in sleep-wake history.	Chronic sleep debt of >8 hours.
Continuous wakefulness	Continuous wakefulness <17 hours.	Continuous wakefulness >17 hours**.	Continuous wakefulness >22 hours.
Circadian rhythm effects	Event took place outside of nighttime or afternoon circadian rhythm troughs. Sleep onset time consistent with optimal routine.		Event took place during nighttime circadian rhythm trough (2230 to 0430 ± 1.5 hours) Event took place during daytime circadian rhythm trough (1400 ± 0.75 hours) Frequent small changes or one large change to sleep onset time with insufficient adjustment time.
Sleep disorders	No symptoms consistent with sleep disorder reported.	Symptoms consistent with a sleep disorder are reported and disorder not being effectively managed.	Individual diagnosed with sleep disorder and disorder not being effectively managed.
Medical and psychological conditions, illnesses and drugs	No medical conditions identified that could lead to fatigue or disrupt sleep. No indication of drug use that could cause fatigue or disrupt sleep.	Individual suffering from a condition or illness that has the potential to disrupt sleep. Individual ingested a drug that leads to fatigue directly or disrupts sleep.	Individual reports significant sleep disruption associated with condition, illness or treatment.

* To calculate chronic sleep debt:

1. a) Determine the person’s preferred ratio of sleep to wakefulness (preferred hours of sleep/preferred hours awake). An 8-hour sleeper will have a ratio of 0.5.
2. b) Calculate the sleep debt, which is equal to the total sleep time minus the total awake time times the ratio of sleep to wakefulness.

** May be shorter if hours of wakefulness are at night.

Appendix C – FAST-related performance metrics

The FAST effectiveness score has been found to be highly correlated with other useful metrics such as reaction time, mean throughput on a battery of cognitive tests, and the lapse index (likelihood of exceptionally long reaction times). The following table gives values for the psychomotor vigilance task (PVT) and associated reaction time, mean cognitive test battery throughput, and lapse index, all of which have been normalized in relation to the performance of a person at their peak when fully rested (baseline), which is defined as 100%.

Table C1. FAST-related performance metrics

FAST effectiveness (% PVT speed)	Reaction time (% baseline)	Mean cognitive test battery throughput (% baseline)	Lapse index (PVT, 1 = mean rested)
100	100.0	100.0	0.2
95	105.3	99.0	0.8
90	111.1	95.5	1.5
85	117.6	91.9	2.3
80	125.0	88.3	3.1
75	133.3	84.8	4.1
70	142.9	81.2	5.2
65	153.8	77.6	6.5
60	166.7	74.1	8.0
55	181.8	70.5	9.8
50	200.0	66.9	11.9

Appendix D – Fatigue Avoidance Scheduling Tool (FAST)

FAST was used in the analysis of this occurrence in order to obtain an indication of the likely relationship between working a schedule similar to that of the crew (based on their work history, which comprised varied shift start and end times) and the potential for fatigue. Because detailed sleep information for the entire period was not available for either crew member, the FAST analysis aims to ascertain risk factors for the existence of fatigue, and not for the influence of any fatigue on performance. A hypothetical work-rest history using all the available known data was used.

The FAST output graphs for the LE and the conductor are shown below. The heavy black line indicates the portion of the day when the employee was at work. The dotted line indicates the criterion line that identifies the middle of the yellow zone (77.5%). It is meant to be used as a guide for the need to use countermeasures to enhance performance.

Appendix E – TSB occurrences that may have been prevented by, or the severity of the outcome reduced by, positive train control or an equivalent system

Occurrence				Consequence
TSB investigation report	Occurrence date	Company	Location	Number of derailed rolling stock	Collision	Number of fatalities	Number of injuries
R18D0096	2018-10-31	VIA Rail Canada Inc. (VIA)	Drummondville, QC	0	N	0	0
R16T0162	2016-08-21	Canadian Pacific Railway Company (CP)	Toronto, ON	6	Y	0	1
R16D0073	2016-08-11	Canadian National Railway Company (CN)	Acton Vale, QC	1	N	0	0
R16E0051	2016-06-04	CN	Carvel, AB	0	Y	0	0
R15D0118	2015-12-11	VIA	Montréal, QC	1	N	0	1
R15T0245	2015-10-25	VIA	Whitby, ON	0	N	0	0
R15V0183	2015-09-06	CP	Beavermouth, BC	4	Y	0	1
R15V0046	2015-03-11	CP	Cranbrook, BC	0	N	0	0
R14T0294	2014-10-28	VIA	Newtonville, ON	0	N	0	0
R13C0049	2013-05-18	CP	Dunmore, AB	6	Y	0	1
R13Q0001	2013-01-11	Quebec North Shore and Labrador Railway (QNSL)	near Mai, QC	9	Y	0	2
R12Q0030	2012-08-09	VIA	Hegadorn, QC	0	N	0	0
R12T0038	2012-02-26	VIA	Aldershot, ON	6	N	3	45
R11W0247	2011-10-29	VIA	Meharry, MB	0	N	0	0
R11D0075	2011-09-24	CN	near Pointe-Saint-Charles, QC	6	N	0	0
R11E0063	2011-06-23	CN	Bailey, AB	2	Y	0	0
R10T0213	2010-10-01	CN	Falding, ON	21	N	0	0
R10V0038	2010-03-03	CP	KC Junction, BC	29	Y	0	2
R10Q0011	2010-02-25	VIA	Saint-Charles-de-Bellechasse, QC	8	N	0	7
R09W0259	2009-12-19	CP	North Portal, SK	8	Y	0	0
R09V0230	2009-10-30	CP	Redgrave, BC	8	Y	0	2
R09W0118	2009-06-28	CN	Jones, ON	7	Y	0	1
R08W0058	2008-04-07	CP	near Ralph, SK	11	Y	0	0
R07E0129	2007-10-27	CN	Peers, AB	29	Y	0	0
R07C0040	2007-04-22	CP	Bow Island, AB	10	Y	0	2
R06H0013	2006-06-06	VIA	New Hamburg, ON	0	N	0	0
R06W0079	2006-05-22	CP	near Swift Current, SK	22	N	0	0
R02V0057	2002-04-28	CP	Natal, BC	2	Y	0	1
R02C0022	2002-03-24	CP	Glenogle, BC	5	Y	0	1
R02T0047	2002-02-22	CP	Port Hope, ON	2	Y	0	2
R01M0024	2001-04-12	VIA	Stewiacke, NS	9	N	0	22
R01W0007	2001-01-08	CP	near Bowker, ON	59	N	0	0
R00M0007	2000-01-30	VIA	Miramichi, NB	9	Y	0	43
R00T0179	2000-07-09	VIA	Rockwood, ON	3	Y	0	14
R99H0007	1999-04-23	VIA	Thamesville, ON	9	Y	2	77
R99T0017	1999-01-19	VIA	Trenton, ON	0	N	0	0
R98V0183	1998-10-01	CN	Basque, BC	4	Y	0	0
R98V0148	1998-08-11	CP	Notch Hill, BC	3	Y	0	0
R98T0141	1998-06-17	St. Lawrence & Hudson Railway	Campbellville, ON	0	Y	0	0
R98C0022	1998-03-01	CN	Obed, AB	2	Y	0	2
R96C0172	1996-08-12	CN	near Edson, AB	39	Y	3	0
R96Q0050	1996-07-14	QNSL	near Mai, QC	4	Y	0	1
R96W0171	1996-07-02	CN	North Battleford, SK	10	Y	0	1
R96D0018	1996-01-31	CN	Charette, QC	0	Y	0	0
R95V0218	1995-10-01	CP	Greely, BC	0	Y	0	4
R95V0174	1995-08-20	CP	Savona, BC	27	Y	0	2
R95T0152	1995-05-18	CP	Toronto, ON	2	Y	0	2
R95M0027	1995-04-06	CN	Napadogan, NB	8	N	0	0
R95S0021	1995-02-16	CN	London, ON	8	Y	0	2
R95T0023	1995-01-29	CN	Netherby, ON	7	Y	0	2
R95C0016	1995-01-14	CN	Delia, AB	28	N	0	0
R94Q0065	1994-11-20	VIA	Rimouski, QC	3	N	0	0
R94T0334	1994-10-28	CN	Etobicoke, ON	3	Y	0	0
R94Q0029	1994-06-07	CN	Saint-Georges, QC	1	Y	0	3
R93H0025	1993-12-13	CP/CN	Prescott, ON	0	N	0	0
R93Q0052	1993-08-19	CN	Bruno Junction, QC	0	N	0	0
R93W0169	1993-08-16	CN	Campbell, SK	0	N	0	0
R93V0155	1993-08-13	CN	Longworth, BC	2	Y	0	0
R93M0059	1993-08-10	VIA	Moosehorn, NB	0	N	0	0
R93V0055	1993-03-17	CP	Choate, BC	0	N	0	1
R92M0155	1992-12-23	CN	Egerton, NS	7	N	0	1
R92Q0170	1992-10-22	CN	Pointe Bleue, QC	17	N	0	0
R92T0242	1992-09-01	CN/VIA	Acton, ON	0	N	0	0
R92T0193	1992-08-01	CP	Heron Bay, ON	0	N	0	0
R92H0022	1992-07-20	CN	Credit, ON	0	Y	0	0
R92V0112	1992-06-08	CN	Sapperton, BC	0	N	0	0
R92V0068	1992-04-12	CP	Forth Steele, BC	0	N	0	0
R92T0078	1992-04-03	CP	Prescott, ON	0	N	0	0
R92V0061	1992-04-02	CP	Shuswap, BC	1	Y	0	2
R92T0077	1992-04-02	CN	Nanticoke, ON	4	N	0	0
R92T0047	1992-02-20	CP	Britt, ON	0	N	0	0
R91V0237	1991-09-22	CN	Arnold, BC	15	N	0	0
R91H0026	1991-09-09	CN	North Bay, ON	7	Y	0	66
R91T0162	1991-07-26	CP	Romford, ON	0	Y	0	0
R91D0032	1991-03-02	VIA	Bromptonville, QC	0	N	0	0
R91V0061	1991-02-27	CP	Chemainus, BC	4	N	0	0
R91H0206	1991-02-06	CP/VIA	Smiths Falls, ON	0	N	0	1
R90E0208	1990-11-06	CN	Oliver, AB	10	Y	0	1
R90V0201	1990-10-27	CN	Conrad, BC	12	N	0	0