Rail transportation safety investigation report R22V0238

On 29 December 2022, at approximately 1003 Pacific Standard Time, Canadian Pacific Railway Company freight train 302-25 was proceeding eastward at about 28 mph on the Shuswap Subdivision when it collided with an unoccupied, stationary hi-rail vehicle at Mile 116.7 on the south main track near Campbell Creek, British Columbia. The vehicle caught fire and was destroyed. The lead locomotive sustained minor damage, but the train did not derail. There were no dangerous goods involved. No one was injured.

1.1 The occurrence

On 29 December 2022, a Canadian Pacific Railway Company (Canadian Pacific or CP)On 14 April 2023, Canadian Pacific Railway Company (CP) and Kansas City Southern (KCS) combined into a single railway company doing business as CPKC. As the occurrence took place before the transition date, the acronym CP will be used throughout the report. train crew was called for 0930All times are Pacific Standard Time. at Kamloops.All locations are in the province of British Columbia, unless otherwise indicated. The crew was scheduled to operate freight train 302-25 eastward on the Shuswap Subdivision, from Kamloops (Mile 128.5) to Revelstoke (Mile 0.0).

The train consisted of 4 locomotives—3 at the head end and 1 in a mid-train position—and was hauling 113 empty grain cars. It weighed 3858 tons and measured 6627 feet. It departed the yard at Kamloops at 0949.

That same morning, a track supervisor (supervisor) was working on the Shuswap Subdivision, visually inspecting the track. The supervisor was operating a hi-rail vehicle (vehicle L15034) that was usually assigned to another supervisor.At CP, track supervisors are usually assigned a hi-rail vehicle that is theirs to use for an extended period in the performance of their duties. However, during the week of the occurrence, the occurrence supervisor had lent his vehicle to a temporary supervisor who was working on the subdivision. When on duty that week, the occurrence supervisor was using vehicles from different supervisors who were off duty. He was travelling westward on the north main track, inspecting both the north and south main tracks from the cab of the vehicle.

To occupy the main track with his hi-rail vehicle, the supervisor needed to obtain a track occupancy permit (TOP)A track occupancy permit (TOP) is an “[a]uthority issued for the protection of track units and track work.” (Source: Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022], Definitions: track occupancy permit (TOP), p. 14.) TOPs are issued by the rail traffic controller (RTC) to a foreman to provide authority to occupy the main track or to perform track work; such permits are also used to protect track unit movements. The term “foreman” refers to “[a]n employee in charge of the protection of track work and track units.” (Source: Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022], Definitions: foreman, p. 11.) from the rail traffic controller (RTC). On the morning of the occurrence, using CP’s proprietary EIC (Employee in Charge) application for managing TOPs electronically, the supervisor had obtained and cancelled several electronic TOPs as he travelled westward from Chase (Mile 94.8). The RTC had received and authorized the requests for each TOP using his computer system.

At about 0902, the supervisor submitted another electronic request for a TOP, from signal 1218N (McCracken) to signal 1144N (Bromley) on the north main track, which the RTC also authorized. The supervisor continued inspecting the tracks. In the vicinity of the switch to the Lafarge Spur track, located on the south main track, he noticed that a rail pull-apart had developed at Mile 116.67. The rails had separated by about 2 inches, leaving a large gap at a joint. This defect would require that the track be either protected or taken out of service and repaired; the supervisor opted to complete the repair.

At about 0921, in preparation for repairing the pull-apart, the supervisor submitted another electronic TOP request, this time for the south main track from signal 1215S (McCracken) to signal 1144S (Bromley), indicating that he would need the TOP for 45 to 55 minutes.

The RTC received the supervisor’s TOP request for the south main track and, unaware that the request had been made to fix a track defect, issued an authorization indicating a “Call RTC Before” timeIt is customary for RTCs to indicate a call-back time, labelled ”Call RTC Before” time on the TOP form, to prevent traffic delays and to establish a time for obtaining a status update from the foreman. of 29 minutes, as this was the amount of track time that he judged he could provide without delaying train movements.TOPs remain in effect until cancelled by the foreman named in the TOP (in this occurrence, the track supervisor). While the recipient of a TOP may contact the RTC to request additional time, the Call RTC Before time can create an expectation that track maintenance personnel must complete the work in the allotted time to minimize operational delays.^,There were several other trains in the area that would have been delayed or further delayed by track work beyond the indicated Call RTC Before time: train 303-664 (which was stopped on the south track at Bromley), train 301-944 (which was stopped at the next station, Ducks), and train 587 (which was en route on the north track at McCraken).

At about 0922, in response to the 29 minutes of indicated time, the supervisor sent an instant messageThe instant messaging application is outside of the EIC application. to the RTC indicating that he would clear the north main track, i.e., cancel the TOP for the north main track. This would allow the RTC to route trains to that track, and hence prevent some traffic delays.

The message also indicated that the supervisor would hold the south main track until he had “burnt the joint together,” which was an indication to the RTC that he was performing a track repair and needed more time. However, the RTC did not see the message and therefore did not respond. Because he had a TOP for the south main track, the supervisor prepared to proceed with the repair.

The supervisor parked the hi-rail vehicle on the south main track immediately west of the pull-apart. Noticing that the batteries on his handheld radio were dead, he looked for the battery charger, but was unable to find it in the hi-rail vehicle he had borrowed, as he was not familiar with its content organization. The hi-rail vehicle was equipped with a radio but not with an external speaker; therefore, the supervisor opened the vehicle’s driver-side doors to hear radio communications outside the vehicle.

Repairing a rail pull-apart is a time-sensitive task that must be planned and executed efficiently.Repairing a pull-apart involves heating the rail by igniting a fuel-soaked rope that has been laid along the base of the rail for the prescribed distance. When heated sufficiently, the rail expands longitudinally until the bolt holes line up and the joint bars can be refastened with bolts. The repair must be completed before the rail cools and contracts. The supervisor began by burning fuel-soaked rope along the rail to heat and expand the rail. While the rail was heating, he returned to the hi-rail vehicle to get bolts, which he had difficulty locating. He eventually found some, but they were not the correct size. He called a coworker asking him to bring the necessary bolts.

At about this time, the supervisor realized that he had not yet cancelled the TOP for the north main track as he had indicated to the RTC in his instant message. He accessed the EIC application on the laptop computer in the cab of the hi-rail vehicle and inadvertently cancelled the TOP for the south main track instead of the TOP for the north main track.

Believing that the south main track was still protected, the supervisor continued repairing the pull-apart. At about 0945, he was joined by a welder, who had overheard on the radio that there was a pull-apart and had volunteered to assist. The welder had driven to the supervisor’s location on an adjacent roadway. The welder and supervisor conducted a verbal job briefing in which they discussed the type of track protection the supervisor had. However, they did not specifically discuss the limits of the track protection, nor did they review the electronic TOP on the laptop computer. After the job briefing, they resumed work on the track repair.

In the meantime, eastbound train 302-25 approached signal 1170S, the last controlled block signal before the location of the pull-apart in the direction of travel. The RTC, seeing that the TOP for the south main track had been cancelled and that the track was unoccupied,Track units, such as the hi-rail vehicle in this occurrence, do not activate signals in the centralized traffic control system, and their presence is not indicated on the RTC’s displays. provided the train with a permissive signal to continue eastward on the south main track.

At about 1001, the train passed by a hot box detector at Mile 118.5 on the Shuswap Subdivision, and a corresponding message was broadcast over the radio. At about 1002, the train crew called a Clear to Limited signalA Clear to Limited signal authorizes trains to proceed and approach the next signal at limited speed (Rule 406 of the Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022]). Limited speed is defined as a speed not exceeding 45 miles per hour (Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022], Definitions). for the south main track at signal 1170S, which was also broadcast over the radio. Neither the supervisor nor the welder heard the radio messages.

At about 1002, the welder noticed that a train was coming and mentioned it to the supervisor. When they realized that the train was on the south main track and that a collision was imminent, they ran down the embankment to safety.

At about 1002:45, the train’s locomotive engineer (LE), seeing the hi-rail vehicle ahead on what appeared to be either the track for the Lafarge Spur or the south main track,The train was on a slight (0.4% to 0.2%) descending grade, eastward, and on a slight (1°) left-hand curve, making it difficult for the train crew to immediately determine whether the hi-rail vehicle was on the spur track or the south main track. activated the locomotive horn, sounding a succession of short sounds, in accordance with the Canadian Rail Operating Rules (CROR).Canadian Rail Operating Rules (01 October 2022, approved by Transport Canada 09 May 2022), Rule 14(f), p. 25. At about 1003, the LE, still unsure whether the hi-rail vehicle was in the train’s direct path, and while travelling at approximately 47 mph, made a full-service brake application. About 15 seconds later, after realizing that a collision was imminent, the LE initiated emergency braking but was unable to prevent the collision. The crew made the required emergency radio broadcast on the train standby channel.Canadian Rail Operating Rules (01 October 2022, approved by Transport Canada 09 May 2022), Rule 102: Emergency Stop Protection, p. 39. The train was travelling at 28 mph when it collided with the stationary hi-rail vehicle at Mile 116.7 on the south main track. The collision occurred near Campbell Creek (Figure 1).

Image

The locomotive pushed the hi-rail vehicle approximately 507 feet further east before the train stopped (Figure 2).

Image

The train did not derail; the lead locomotive sustained minor damage. The hi-rail vehicle caught fire and was destroyed (Figure 3). No one was injured.

Image

1.2 Personnel information

1.2.1 Crew of train 302-25

The 2 crew members on train 302-25—an LE and a conductor—were qualified for their respective positions, met fitness and rest requirements, and were familiar with the Shuswap Subdivision.

1.2.2 Track maintenance personnel

The supervisor was hired by CP in October 2013 as a laborer on a tie crew. From 2016 onward, he worked in several track-supervisor positions. He had been working on the Shuswap Subdivision since 2019. He was qualified for his position and was adequately rested before starting his shift on the day of the accident.

The welder was hired by CP in 2017 and became a welder in 2019. At the time of the occurrence, he had been working on the Shuswap Subdivision since 2017. He was qualified for his position and was adequately rested before starting his shift on the day of the accident.

1.2.3 Rail traffic controller

The RTC qualified in 2005 for his position at CP. In the beginning of his career, he commonly worked the desk for the Shuswap and Thompson subdivisions, then worked on other subdivisions, including the Brooks and Laggan subdivisions. In 2020, he took over the day shift for rail traffic control of the Shuswap and Thompson subdivisions, which he was still holding at the time of the occurrence. He was adequately rested before starting his shift on the day of the accident.

1.3 Subdivision information

The Shuswap Subdivision comprises single and double main track running east to west from Mile 0.0 at Revelstoke to Mile 128.5 at Kamloops. At the occurrence location, there were 2 main tracks.

The Shuswap Subdivision is a key route.“’Key Route’ means any track on which, over a period of one year, is carried 10,000 or more loaded tank cars or loaded intermodal portable tanks containing dangerous goods, as defined in the Transportation of Dangerous Goods Act, 1992 or any combination thereof that includes 10,000 or more loaded tank cars and loaded intermodal portable tanks.” (Rules Respecting Key Trains and Key Routes [22 August 2021, approved by Transport Canada on 22 February 2021], Section 3.1.) Train traffic is governed by the centralized traffic control (CTC) system, in accordance with the CROR. All movements are dispatched by a CP RTC located in Calgary, Alberta.

Rail traffic on this corridor consists of about 27 freight trains per day. At the time of the collision, in addition to train 302-25, there were 12 other trains operating or ordered to operate on the Shuswap Subdivision.

1.4 Track information

The track at the location of the occurrence is Class 4 track under the Rules Respecting Track Safety. In the area of the derailment, the maximum allowable speed is 55 mph for passenger trains and 50 mph for freight trains.

In the vicinity of the occurrence, the track consisted of 136-pound continuous welded rail (CWR). The rails were laid on 14-inch standard double-shouldered tie plates fastened with 4 spikes per plate on hardwood ties. The rails were anchored with elastic fasteners; they were in good condition and within established wear limits. The ballast was clean, crushed rock in good condition. The subgrade and drainage were adequate.

1.4.1 Pull-apart near the Lafarge Spur switch

The Lafarge Spur switch at Mile 116.7 consisted of a No. 11 lift frog switch installed in 2016. At Mile 116.67, there was a 2-inch pull-apart at the first joint, east of the switch (Figure 4). The rail and joint bars had contracted eastward. The bolts fastening the other end of the joint bar to the rail on the west side of the joint had sheared off as the rails pulled apart. There was some minor rail end batter, indicating that there may have been train traffic through the area before the pull-apart was identified.

Image

The joint that had pulled apart had been secured with 6-hole joint bars for 136-pound rail, fastened with elastic clips and supported on rolled plates with lag bolts; the rolled plates were fastened with Pandrol clips and anchored every tie. The joint had been secured with 4 bolts, 2 on each side.It is not uncommon to drill only 4 holes in a joint rail when using 6-hole joint bars. This practice is used when the rail is to be permanently welded in the near future. If all 6 holes are drilled, it will not be possible to use thermite welding without cutting out the joint and replacing it with a plug rail, thereby creating 2 joints, which is not desirable. Hence, when the intent is to weld the joint, it is best not to drill the 2 holes closest to the rail end, which would compromise the integrity of the thermite weld. The joint rails were drilled to accommodate the 4 outer holes in each joint bar; i.e., the rails had not been drilled to accommodate the 2 holes in each joint bar closest to the rail ends.

At the time that the pull-apart was discovered, the 2 bolts on the west side of the joint had broken and fallen out, and the 2 bolts on the east side of the joint were still in place. At the time of the collision, 1 of the remaining bolts on the east side (for 115-pound rail)The Rules Respecting Track Safety do not prescribe which type of bolts must be used. In this occurrence, the bolt for 115-pound rail (1 inch in diameter) had been used as a temporary measure with the intention to eventually replace it with a bolt for 136-pound rail (1⅛ inch in diameter). Larger bolts are more resistant to shear stress caused by contracting rails. had been removed by the supervisor using the appropriate hand tool; the other was tight and would need to be removed with the use of power tools or cut out with a rail saw, which had not yet been done.

In the area of the pull-apart, every tie was anchored for 195 feet east and west of the switch, after which point every other tie was anchored. Under the joint, there were 2 hanging ties (i.e., the ties were no longer providing support).

Recent inspections in the area of the pull-apart included the following:

• A visual inspection of the south track on 26 December 2022; no defects were noted.
• A walking inspection of the turnout on 21 December 2022; no defects were noted.
• A rail flaw detector test on 15 December 2022; no defects were noted.

1.4.1.1 Maintenance and inspection plan for rail joints

Rail joints introduce discontinuities in the geometric and mechanical properties of the rail and are often considered one of the weakest locations in the track structure, making it more susceptible to defects and failures.

Section 5.3 of the Rules Respecting Key Trains and Key Routes requires railway companies to develop and adhere to a maintenance and inspection plan for permanent and temporary rail joints for CWR on main track and subdivision track portions of key routes. For temporary rail joints, the plan requires that the following elements be recorded, and that the records be retained for a minimum of 1 year (this list is not exhaustive):

• the time limit for retention until a permanent repair can be made;
• the location of a track segment where the rail joint has been installed in CWR, including the subdivision, mileage, and track identification, where applicable; and
• the installation date.Rules Respecting Key Trains and Key Routes (effective 22 August 2021, approved by Transport Canada on 22 February 2021), section 5.3, pp. 9–10.

This section of the Rules also requires railway companies to file a copy of the plan with Transport Canada (TC) by 01 September every calendar year.

In accordance with the Rules, CP developed a “Continuous Welded Rail Joint Management Plan,” effective 01 September 2021. The plan states that temporary rail joints must be welded or made into permanent joints within 3 years of being installed. CP’s plan stipulates that a record of a temporary rail joint’s location and installation date must be retained for 3 years, exceeding the minimum record retention timeframe stipulated in the Rules.

The requirements related to a maintenance and inspection plan for permanent and temporary rail joints came into effect on 22 August 2021. Before then, there was no regulatory requirement for railway companies to keep records of temporary rail joints, and CP did not maintain these records at that time. Consequently, information on the date of installation of the joint at Mile 116.67 is not available.

1.4.2 Rail joint defects near the occurrence location in 2022

In 2022, there were 15 occasions when joint maintenance was required near Mile 116.67 (up to 1 mile in either direction) on the Shuswap Subdivision (Table 1). The joint defects requiring this maintenance work were identified through CP’s inspection program and were addressed accordingly.

1.5 Track occupancy permits

TOPs authorize railway employees to operate track units on the main track or signalled sidings, within specified limits. Track workTrack work is “[a]ny work on or near the track that may render the track unsafe for movements at normal speed or where protection against movements may be required for employees and machines involved in track construction and repairs.” (Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022], Definitions, p. 14.) on the main track or on signalled sidings can also be performed within the limits of a TOP.

At CP, TOPs can be requested and issued over the radio or electronically.

1.5.1 Track occupancy permits managed over the radio

When TOPs are requested and authorized over the radio, there is direct verbal interaction between the RTC and the track maintenance employee.

With respect to cancelling TOPs over the radio, Rule 864 of the CROR states the following:

864. TOP CANCELLATION                                                             

(a) The foreman must advise the RTC of the TOP number to be cancelled;

(b) the RTC must state the TOP number and limits of the TOP to be cancelled which must be acknowledged as correct by the foreman;

(c) the RTC will state the TOP number, “cancelled” and the initials of the RTC which must be repeated by the foreman; and

(d) the cancellation does not take effect until it has been correctly repeated and acknowledged by the foreman.Transport Canada, Canadian Rail Operating Rules (01 October 2022, approved by Transport Canada 09 May 2022), Rule 864: TOP Cancellation, p. 104.

1.5.2 Track occupancy permits managed electronically

CP’s EIC application, which was introduced in 2016 and fully implemented across CP’s Canadian network in 2017, allows qualified employees to electronically request, receive, and cancel TOPs in the field, using a laptop and available wireless data network. The application also provides a subdivision overview, displaying TOP limits and trains.The Canadian National Railway Company has a similar system, called ETOP [electronic track occupancy permit], which it implemented in 2012.

Although the use of the EIC application is widespread at CP, track maintenance employees can still obtain and cancel TOPs over the radio at their discretion.

When performed by electronic means, TOP cancellations are governed by CROR Rule 131.1, which states:

When a GBO [General Bulletin Order], clearance, TOP, other authority, instruction or information is transmitted or cancelled using an ECM [electronic communication method] and not by voice communication, it will not be repeated to the RTC. When transmitted in this manner, the word “complete” and the initials of the RTC will be generated by the ECM. When cancelled, the initials of the RTC are not required.Transport Canada, Canadian Rail Operating Rules (01 October 2022, approved by Transport Canada 09 May 2022), Rule 131.1: Electronic Transmission and Cancellation, p. 57.

CP employees are provided self-paced training on how to use the EIC application, as well as a job aid that gives a short overview of the most common operations performed using the application.

The procedure for cancelling electronic TOPs as indicated in CP’s training material states, in part:

• Open the TOP and click the “Request Cancel” button at the bottom of the TOP screen. […]
• Review the limits of your TOP, and click the checkboxes to ensure that you are cancelling the right TOP.
• Confirm that no Track Work or Track Units will be left unprotected. […]
• Enter your password – this is the same password you use to sign-on to your computer when you turn it on.
• Remember !! Once you select and click the “Cancel my TOP” button. You cannot withdraw this decision.
• Click “Cancel my TOP” to complete the Cancellation.
• Click Close to close the TOP.Canadian Pacific Railway Company, 2778 V5E [EIC Terminal Training – Field Personnel [Foreman 1], last updated 15 September 2021.

With respect to cancelling TOPs, the job aid states, in part:

1. Open the TOP.
2. Click on the “Request Cancel” button at the bottom of the TOP.
3. Verify that no Track Work or Track Units will be left unprotected and then click the boxes.
4. Enter your Password and click OK
5. Close the TOP. The RTC will acknowledge the cancel when they are able to. You do not have to wait for this to be completed.[…]Canadian Pacific Railway Company, EIC Foreman Job Aid, last updated 04 May 2017.

1.5.2.1 Design of the EIC application

CP stated that, in lieu of using a specific usability design standard for development of the EIC application interface, it used information technology (IT) best practices and principles. The TSB investigation did not determine which of these IT best practices and principles related to usability; however, recognized usability standards and validation practices are normally specified in the design phase and mapped to user requirements of the software and hardware interfaces.

International Standard Organization standard ISO 9241-110 (2020), Ergonomics of Human-System Interaction – Interaction Principles, is an example of a design standard that describes requirements of interactive systems such as CP’s EIC application. The standard accounts for usability in allowing people to achieve goals effectively in specific contexts. Notably, it specifies that interactive systems should be developed to minimize user error, which it defines as actions that lead to a result different from the one intended by the manufacturer or by the user.

Interaction principles outlined in ISO 9241-110 go further to describe that a software application ought to

• be suited for the characteristics of the interactions that a person uses to complete their tasks;
• use a system that is self-descriptive, that is, a system that displays appropriate information where required and makes its capabilities obvious to users without unnecessary system interactions;
• conform with user expectations for the system’s behaviour and be predictable based on the context of use;
• allow users to not only discover capabilities of the system while minimizing the need for additional learning, but also provide support to users when guidance is required;
• allow user-control of the software interface for sequence and individualization of the system interaction; and
• accommodate users through error robustness, that is, the interactive system should assist users in avoiding errors and, when required, help users recover from errors.

Design standards shape human-system interfaces used in transportation occupations like rail traffic control. In essence, principles guiding the ergonomics of the software describe basic requirements whereby a system ought to optimize a person’s effort in accomplishing a task by presenting information in a clear and unambiguous manner. The software should conform with user expectations by reflecting appropriate and consistent responses to input that, by design, avoid error while offering easy means to recover from it.

1.5.2.2 Selecting authorities in the EIC application

To cancel a TOP in the EIC application, a foreman must use the touch-screen display; with limited screen space, the information is displayed in a small font. All active TOPs are listed in the Authority Summary window from which the foreman can select the TOP to cancel (Figure 5). 

Image

By default, the TOPs are sorted by authority number, with the lowest number (the oldest authority) at the top of thelist. However, this order can be reversed on the touch-screen display by tapping the Authority Number column heading. When a column heading is tapped, all that happens is that the order changes; the application provides no feedback to the foreman.

The investigation determined that the supervisor was unaware that this sorting feature existed. At the time of the occurrence, this feature was not covered in either the self-paced training or the job aid.

1.6 Track occupancy detection in the centralized traffic control system

1.6.1 Track circuit shunting

In the CTC system, a series of interconnected track circuits are used to transmit electric current through the rails. The current travelling through the rails can indicate the presence of trains and the continuity of the track circuits—that is, whether a rail is broken or a track switch has been left open. Tracks are divided into interconnected blocksA block is “a length of track of defined limits, the use of which by a movement is governed by block signals.” (Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022], Definitions, p. 8.) of varying lengths. At the entrance of each block, block signalsA block signal is “a fixed signal at the entrance of a block to govern movement entering or using that block.” (Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022], Definitions, p. 8.) are in place to govern train movements and to ensure proper train separation. When a train approaches a block that is unoccupied and the track circuits are complete, the signal system will display a permissive indication. However, if another train is occupying a block ahead, or if the continuity of the track circuits is interrupted due to a broken rail or an open switch, the signal system will display a restrictive indication informing the crew to stop the train before entering the block, or to reduce its speed enough for it to be able to stop within half the range of vision of equipment, a broken rail, or a switch not properly lined (figures 6 and 7).

Image

Image

1.6.2 Track units and track circuits

In Canada, most track units are specifically designed so that electric current does not travel between opposite wheels on the same axle: the axles are insulated so they do not shunt the track circuits.Many track units are not heavy enough to ensure reliable contact between the hi-rail wheels and the rail head to ensure consistent shunting of the track circuits. Additionally, some maintenance activities such as testing of signal systems and grade‑crossing warning systems are more expeditiously carried out with hi-rail vehicles that do not shunt the track circuits. Therefore, the location of a track unit is not usually indicated on the RTC’s subdivision display as a “track occupancy” and a track unit’s presence does not cause the signal system to display a Stop or Restricting signal when actuated by an approaching train. For track units, track occupancy is managed through the use of TOPs. Before issuing a TOP, RTCs are required to block at Stop all controlled signalsA controlled signal is “[A] CTC [centralized traffic control] system block signal which is capable of displaying a Stop indication until requested to display a less restrictive indication by the RTC. (Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada on 09 May 2022], Definitions, p. 8.) governing train movements into the area covered by the TOP.

1.6.2.1 United States National Transportation Safety Board recommendation on shunting of maintenance-of-way equipment

On 29 January 1988, a northbound Amtrak train struck maintenance-of-way equipment in Chester, Pennsylvania, United States (U.S.). The LE on the train was seriously injured. Eight train crew members and 15 passengers sustained minor injuries. As a result of its investigation into this occurrence, the U.S. National Transportation Safety Board (NTSB) issued the following recommendation to the American Railway Engineering Association (AREA):The American Railway Engineering Association merged with the American Railway Engineering and Maintenance-of-Way Association (AREMA) in 1997.

Determine methods to provide for positive shunting of signal circuitry by on-track, maintenance-of-way machinery, and include these methods in the manual of recommended practices.

NTSB Recommendation R-89-005U.S. National Transportation Safety Board, Recommendation R-89-005, at https://data.ntsb.gov/carol-main-public/sr-details/R-89-005 (last accessed 04 September 2024).

On 14 June 1989, in response to the recommendation, the AREA stated (in part):

[T]he decision as to whether [to] use insulated or non-insulated equipment is a decision best left up to the individual railroads depending on details of their safety rules and maintenance procedures, as determined by the operating departments, signal departments, and MOFW [maintenance of way] departments of each railroad. The primary safety mechanism needs to be written orders which prohibit the unanticipated simultaneous operation of train and maintenance of way equipment on the same track. For the above reasons, the AREA does not feel that it is appropriate for it to recommend practices in accordance with the NTSB suggestions. We believe the best interest of safety involves the AREA taking no action on the matters mentioned by NTSB in its safety recommendation R-89-5.Ibid.

On 15 November 1989, the NTSB assessed the response from the AREA as unacceptable and closed the file. The NTSB stated, in part:

The Safety Board continues to believe, as discussed in its report of the Amtrak accident in Chester, Pennsylvania that prompted this recommendation, that the protection provided by the automatic block signal system is essential to the prevention of human error-induced accidents. […] Until such a time that a reliable level of protection against out-of-service track intrusions can be ensured through the use of non-insulated equipment and positive shunting devices, the protection will depend solely on procedural rules. The Safety Board believes that Amtrak’s operating rules, and instructions for protection of on-track maintenance equipment should always be considered as the primary safety measure and to the extent possible, the procedures should be designed so that there is minimum chance of human error.Ibid.

Since the Amtrak occurrence, as a result of its investigations into other occurrences where a train struck track equipment or track employees, the NTSB has made several other recommendations calling for redundant signal protection such as track shunting: R-08-006,U.S. National Transportation Safety Board, Recommendation R-08-007, at https://data.ntsb.gov/carol-main-public/sr-details/R-08-006 (last accessed 04 September 2024). R-13-017,U.S. National Transportation Safety Board, Recommendation R-13-017, at https://data.ntsb.gov/carol-main-public/sr-details/R-13-017 (last accessed 04 September 2024). R-13-039,U.S. National Transportation Safety Board, Recommendation R-13-039, at https://data.ntsb.gov/carol-main-public/sr-details/R-13-039 (last accessed 04 September 2024). and R-18-024.U.S. National Transportation Safety Board, Recommendation R-18-024, at https://data.ntsb.gov/carol-main-public/sr-details/R-18-024 (last accessed 04 September 2024).

At least one railway, the Union Pacific Railroad, requires that hi-rail vehicles be capable of shunting track circuits so that they activate signals and active grade crossing warning systems. However, this requirement does not apply to hi-rail vehicles used by signal employees when testing signals. Several maintenance activities performed by signal maintainers, including testing and maintenance of crossing warnings, cannot be completed if the track is shunted.

There are limitations to the shunting of track circuits by track units. For example, in situations when the wheels of the track unit do not establish effective contact with the rail (e.g., when rail surfaces are rusty or when wheel lift occurs over deposits of material such as snow, sand, dirt, or leaves), shunting might not be consistent. In such circumstances, track occupancy indicators can be intermittent or not show at all on RTC subdivision displays. Consequently, the presence of a track unit might not activate signal indications in the field.

1.6.2.2 Shunting devices

Shunting devices (Figure 8) offer an alternative to the shunting by track units. These devices, which are installed by hand, shunt the track circuit and, therefore, ensure that Stop signals will be displayed to trains when approaching blocks occupied by workers.

Image

In the U.S., some railways require that shunting devices be used while work crews are working on the track. CP does not provide guidance on permitting or not permitting the use of shunting devices.

1.6.3 Track occupancy on the rail traffic controller subdivision displays

At CP’s Operations Centre, software enables RTCs to monitor their territory on computer displays. The displays provide an overview of the entire subdivision, including sidings, signals, trains, and TOP limits. If a train is within a controlled block or at a controlled location,A controlled location is “[A] location in CTC [centralized traffic control system] the limits of which are defined by opposing controlled signals.” (Canadian Rail Operating Rules [01 October 2022, approved by Transport Canada 09 May 2022], Definitions, p. 8.) the CTC display will also show the train as it leaves one controlled block and enters another and when it passes a controlled location.

In this occurrence, after the supervisor cancelled the TOP for the south main track, the CTC display was showing the track as unoccupied and available for use, even though the hi-rail vehicle was still occupying the track.

The TSB has investigated several accidents in which trains operating on permissive signal indications have collided with track units.TSB rail transportation safety investigation reports R98T0141, R00V0206, R03Q0003, R12V0008, R16H0024, R20D0088, and R20H0130. In each of these instances, the track unit did not shunt the track circuit and there was no other shunting device available to provide a backup defence against train / track unit collisions.

1.7 Use of global positioning system technology to detect on-track equipment

Some railway companies use Global Positioning System (GPS) technology to locate and monitor on-track equipment.

After a 1996 collision involving 2 trains near Sept-Îles, Quebec,TSB Railway Investigation Report R96Q0050. the Quebec North Shore and Labrador Railway developed a collision‑avoidance system, which it implemented on its rail network in July 1997. The device, which uses GPS technology to locate all on-track locomotives and track units, provides audible and visual warnings to operators of other equipment within specified distances and triggers penalty braking if train crews do not take action.

In the U.S., in the early 2000s, Burlington Northern and Santa Fe Railway also developed a collision-avoidance system that uses GPS-based technology. The Hi-Rail Limits Compliance System monitors the location of hi-rail vehicles by comparing authorization limits issued to vehicles against their physical locations. When a vehicle approaches its limits of authority, the track maintenance workers are alerted. If the vehicle exceeds its limits of authority, it receives a continuous alarm, and the system alerts the dispatcher.

More recently, in 2021–2022, Canadian National Railway Company (CN) installed an electronic track authority verification (ETAV) system in the U.S. and in Canada. This system is designed to help track workers navigate the track network by providing an accurate map of the CN field assets with real-time GPS tracking and track‑network positioning assistance. It also has the ability to create navigation corridors called “geofences.” The geofences represent the geographical limits of the TOPs granted by the RTC, which help foremen to be aware of their position on the track network. The ETAV system provides visual and audio cues of a track unit’s GPS position on the track network, thereby ensuring that foremen always stay within the limits of their TOPs. If a foreman inadvertently tries to cancel a TOP while still occupying the limits, an audible alert will be emitted, which warns the foreman against cancelling that TOP.

CP has installed GPS devices on most of its track units. GPS information is collected in near‑real time and is used primarily for fleet‑management purposes. At the time of this occurrence, GPS information was not being used for collision avoidance.

1.8 Job briefings for track work

At CP, the requirements for job briefings on track maintenance work are contained in the Engineering Safety Rule Book. Section E-0, under the heading “Engineering Specific Rules and Safe Work Procedures,” states, in part:

I. All individuals involved in the job or tasks, who are in the work area, must participate in a job safety briefing before beginning work. An updated job safety briefing must be conducted anytime conditions change. The Employee in Charge (EIC) will lead the job briefing and will record the briefing in the Engineering Job Safety Briefing Booklet.

The job safety briefing includes the following:

• a discussion of the general work plan,
• task to be performed,
• each employee’s individual responsibility including identification of the EIC,
• hazards recognized, evaluated and controlled (R.E.C)
• the type of track protection provided to carry out the work,
• working alone/ lone worker protection is established as necessary.
• location of emergency first aid equipment and qualified responders.
• the name of the employee(s) assigned to main track switches must be recorded in the Engineering Job Safety Briefing Book, if operation of main track switches is requiredCanadian Pacific Railway Company, Engineering Safety Rule Book (May 2022) p. 5.,The use of the term “Employee in Charge” and the acronym “EIC” in this section of CP’s Engineering Safety Rule Book is separate from CP’s use of this term and acronym referencing its electronic TOP application.

Additionally, Rule 7.1 in CP’s Rule Book for Engineering Employees states in part [bold and underline in original]:

Before Acting on a TOP:

(a) The foreman in charge of a single track unit must:

(i) read the TOP to employees in the track unit;

(ii) require those to read and initial the TOP.Canadian Pacific Railway Company, Rule Book for Engineering Employees (28 October 2021), section 7.1: Protection by TOP, p. 19.

CP’s EIC application includes a field where employees can initial the TOP to acknowledge that they have read it.

According to these instructions, the type of track protection must be discussed in the job briefing, but there is no explicit requirement that the discussion specifically covers the limits of the TOP. However, CP expects that the limits of the TOP are reviewed as part of these instructions.

During the mandatory job briefing conducted in this occurrence, the employees involved discussed neither to which track the electronic TOP applied nor the limits of the TOP; nor did they review the TOP or record the briefing results in the Engineering Job Safety Briefing Booklet.

1.9 Inspection of vehicles, materials, equipment, and tools

For track maintenance workers, CP provides a Vehicle, Hirail, Truck Crane Daily Safety Inspection and Planned Maintenance Record, known at CP as the “Green Book.” The Green Book requires that employees conduct a daily inspection of parts of the hi-rail vehicles they use, such as steering, gear, and locking pins.Canadian Pacific Railway Company, Vehicle, Hirail, Truck Crane Daily Safety Inspection and Planned Maintenance Record, effective January 2019. It does not require taking inventory of materials or tools necessary for track work.

In this occurrence, the supervisor completed the required inspection and determined that the hi-rail vehicle was in good working order.

1.9.1 Checklists

Checklists give employees an objective frameworkA. Degani and E. L. Weiner, “Cockpit Checklists: Concept, Design and Use,” Human Factors: The Journal of the Human Factors and Ergonomics Society, Vol. 35, Issue 2 (1993), pp. 28–43. that provides

• a standard foundation for verifying vehicle configuration;
• a sequential framework to meet internal and external operational requirements;
• a method of cross-checking the inventory of tools and equipment necessary for a given task; and
• an enhanced team concept by keeping all employees in the loop.

Operator checklists are widespread across the transportation industry, notably in the air and marine modes. However, checklists are not generally used in railway operations, as was the case in this occurrence.

1.10 Radio broadcasting and continuous radio monitoring

Radio broadcasting and continuous radio monitoring are important processes used by both railway operations employees (i.e., train crews and RTCs) and railway engineering services employees (i.e., track maintenance and signal and communications personnel). For safety and expediency, different radio channels are used by operations employees and engineering services employees. When RTCs are required to monitor each other’s activities, they need to use multi-channel scanning or manually change radio frequencies. RTCs regularly interact with both operations and engineering services employees and, as such, must be equipped with radios capable of accessing both categories of employees.

External speakers on track units or portable radios help engineering services personnel to monitor radio communications when they are working outside of their vehicles. Rule 119 of the CROR states:

119. CONTINUOUS MONITORING

(a)  When not being used to transmit or receive a communication, receivers must be set to the appropriate standby channel and at a volume which will ensure continuous monitoring. When required to use another channel to perform other duties, at least one radio, when practicable, should be set to the designated standby channel to receive emergency communications.

(b)  The volume of a radio receiver should be kept at a level that will avoid annoyance to the public in passenger cars and station facilities.

(c)  Foremen named in Form Y GBO [general bulletin order], TOP or clearance must set their radio to “scan mode” when [it is] not being used to communicate with another employee and must otherwise have their radio set to monitor the applicable designated standby channel.Canadian Rail Operating Rules (01 October 2022, approved by Transport Canada 09 May 2022), Rule 119: Continuous Monitoring, p. 54.^,Scan mode refers to leaving the radio open on the appropriate channel to overhear radio broadcasts from approaching trains and other track workers.

In this occurrence, the batteries in the supervisor’s portable radio were not sufficiently charged to last the duration of his shift and had died before he began the track repair.

The welder who had joined the supervisor was unaware that there was no external speaker on the track unit and that the supervisor’s portable radio was inoperative. When the welder left his truck parked next to the adjacent roadway, he did not bring his portable radio with him.

1.11 Impact of cognitive demand on situational awareness

Cognitive demand relates to a person’s problem‑solving capacity when faced with several tasks that must be completed within a given period of time. Generally, as task complexity increases, the ability of an individual to maintain the same level of performance in that task decreases. Similarly, demand increases if the number of tasks to be completed increases or if the time available to perform them decreases. Individuals use both physiological (e.g., release of fight or flight hormones)The sympathetic nervous system is part of the body’s autonomic nervous system, responsible for stress-response functions such as control of your heart rate, blood pressure, digestion, urination, and sweating. (Source: Cleveland Clinic, https://my.clevelandclinic.org/health/body/23262-sympathetic-nervous-system-sns-fight-or-flight; last accessed 04 September 2024) and cognitive (e.g., focusing attention) resources to manage high-demand situations. Excessive cognitive demand occurs when performing a task requiring more resources (including time) than are available, leading to reduced performance.

Situational awareness is the perception of elements in the environment, the comprehension of what these elements mean, and the projection of what their status will be in the future. Accurate situational awareness enables informed, accurate predictions of the potential consequences of one’s actions.M. R. Endsley, “Situation awareness in aviation systems,” in B.H. Kantowitz (ed.), Handbook of Aviation Human Factors, 2nd Edition (CRC Press, 2009), pp. 12-1 to 12-22.

The relationship between cognitive demand and situational awareness is not straightforward. Because they both rely on the same underlying processes, they have a tendency to conflict to some degree: “⦋t⦌he more demanding the task, the more complex the situation and the more ‘work’ is required to get the job done and the situation assessed.”P. S. Tsang and M. A. Vidulich, “Mental workload and situation awareness,” in G. Salvendy (ed.), Handbook of Human Factors and Ergonomics, 4th Edition (John Wiley & Sons, 2012), p. 248. Therefore, in most situations, excessive cognitive demand is usually accompanied by reduced situational awareness.

A mental model is a conceptual representation of a system that an individual constructs on the basis of their knowledge and understanding of that system.C. Capelo and J. F. Dias, “A system dynamics-based simulation experiment for testing mental model and performance effects of using the balanced scorecard,” System Dynamics Review, Vol. 25, No. 1 (2009), pp. 1–34. A mental model may include descriptive as well as spatial information. An accurate mental model—one that conforms closely to the real world—supports better decision making and better overall performance of tasks.Ibid. The development of a mental model requires memory and attentional resources. Multiple processes make ensuring the model’s accuracy easier, including repetition of the same or similar information over time. Mental models are generally resistant to change unless salient cues to the contrary are perceived and their meaning is understood. Under conditions of high mental workload, updating a mental model is more difficult as attention and memory resources are already being used elsewhere.

In this occurrence, the supervisor was contending with several factors that increased the cognitive demands he was under and degraded his situational awareness and affected his mental model. For instance:

• Because the RTC did not know that the supervisor was repairing a rail pull-apart (the data were not captured in the EIC application), he authorized the TOP for the south main track, with a Call RTC Before time of 29 minutes.
• He was using a borrowed vehicle and was not familiar with the location of essential materials and equipment in it.
• He was working alone until the welder arrived.
• He knew the consequences of delaying important train traffic (the Shuswap Subdivision being part of CP’s main transcontinental corridor); he also knew that the RTC would have to account for any delay.

1.12 Safety management systems

A safety management system (SMS) is an internationally recognized framework that allows companies to identify hazards, manage risks, and make operations safer. An SMS improves safety by building on existing processes, demonstrating corporate due diligence, and growing the overall safety culture.

Safety management is a systemic approach to safety—engaging, but not limited to, a continuous safety improvement process (Figure 9). An effective SMS incorporates the 4 pillars of safety management: safety policy and objectives, safety risk management, safety assurance, and safety promotion.

Image

The SMS framework is not new to Canadian railway operations; SMS regulations were introduced in 2001. In 2013, the investigation into a fatal derailment in Lac-Mégantic, Quebec,TSB Railway Investigation Report R13D0054. identified shortcomings in these regulations that led to their revision in 2015. Under the Railway Safety Management System Regulations, 2015 (SMS Regulations), railway companies must develop an SMS that includes processes for identifying safety concerns,The Railway Safety Management System Regulations, 2015 do not define “safety concern,” but provide trends, emerging trends, and repetitive situations as examples. for conducting risk assessments, and for implementing and evaluating remedial (safety) action.Transport Canada, SOR/2015-26, Railway Safety Management System Regulations, 2015, section 5.^,In the context of safety management systems, the terms “remedial action” and “safety action” are generally understood to be synonymous, and both describe actions taken to improve safety. The Railway Safety Management System Regulations, 2015 use the term “remedial action,” whereas, in this report, the term “safety action” is used. However, a rules-compliant process does not necessarily ensure an effective SMS.

Safety action taken is one step in the SMS process. Therefore, it is expected that any safety action taken as a result of an occurrence is part of a continuous safety improvement process, where the scope of change is defined, the hazards are identified, the risks are assessed, the safety actions are implemented and evaluated, and the entire process is documented. Consequently, the effectiveness of the safety action taken (its effectiveness in reducing the likelihood or severity of an undesired event) can be objectively measured.

The TSB investigates occurrences to identify safety deficiencies, including those in a company’s SMS, and reports on instances in which the safety system could manage risk more effectively or proactively.

1.12.1 Canadian Pacific’s safety management system

CP, in accordance with the SMS Regulations, has developed and implemented an SMS that includes a risk assessment policy and procedure. The risk assessment policy outlines the conditions under which a risk assessment must be conducted. It states, in part:

At CP, a risk assessment must be conducted when a safety concern is identified through analysis of safety data or when a proposed change to its railway operations has the potential to negatively affect the safety of its employees, the public, the environment or the operation […].Canadian Pacific Railway Company, Risk Assessment Policy (policy number H&S4400), last revised October 2015.

Although not explicitly stated in CP’s procedures, these conditions cover the situations listed under the SMS Regulations that require a risk assessment, notably:

(i)   the introduction or elimination of a technology, or a change to a technology;

(ii)  the addition or elimination of a railway work, or a change to a railway work;

(iii) an increase in the volume of dangerous goods it transports;

[…]

(v)  a change affecting personnel, including an increase or decrease in the number of employees or a change in their responsibilities or duties.Transport Canada, SOR/2015-26, Railway Safety Management Systems Regulations, 2015 (as amended 01 April 2015), paragraph 15(1)(c).

The TSB asked CP to provide records of its safety risk‑management process on the implementation of the EIC application and the use of electronic TOPs in Canada. CP provided a copy of its Risk Assessment Worksheet, used by CP personnel directly affected by a potential change, as it had been filled out for the rollout of the EIC application in Canada.

1.12.1.1 Risk assessment for the rollout of the EIC application in Canada

As new software, the EIC application required design and development. The implementation involved application testing, training, and process modifications. The EIC application would have direct effects on the tasks and workload of CP employees in the RTC office and in the way that track workers establish, maintain, and cancel track protection.

In March 2016, CP conducted a risk assessment related to the introduction of the EIC application, which it documented in the Risk Assessment Worksheet. In April 2016, the risk assessment was sent to CP’s Corporate Risk group for filing. The worksheet is dated 30 April 2016.

The TSB reviewed the completed worksheet, which describes the steps that guide and document the safety risk assessment and evaluation process. Subject‑matter experts and worker representatives participated in the process. It began with defining the trigger and scope of the risk assessment, followed by an identification of hazards and possible undesired events, and an assessment of the risks associated with these events. The worksheet ends with a list of safety actions in support of the SMS continuous improvement methodology.

According to the completed worksheet, the trigger for the risk assessment was identified as a proposed change to operations. The scope was focused on the adequacy of training resources and on-the-job training for the move from paper to electronic TOPs.

Some hazards and associated undesired events were identified, and their level of risk and likelihood of occurrence was determined. For instance, one of the identified potential undesired events was “Foreman occupies track with no authority” and the likelihood of this event happening was determined to be rare (in the worksheet, rare is defined as “May happen in only exceptional circumstances, less than once in fifty years.”) According to the worksheet, only 1 hazard (Foreman acting on TOP before granted) required remedial action (training).

Although the completed worksheet did not contain criteria for evaluating the effectiveness of the safety action in reducing or eliminating the identified risks, in practice, the effectiveness of the training was evaluated through efficiency tests on the EIC application (there were 5 different efficiency tests). From December 2020 to December 2023, CP conducted almost 206 000 such efficiency tests; the average failure rate was 4.6%.

1.12.1.2 Notification and filing of a proposed change to railway operations

Under the SMS Regulations, railway companies must notify the Minister of Transport before making an operational change that might affect the safety of the public or personnel, or the protection of property or the environment (such as the introduction or elimination of a technology, or a change in the responsibilities or duties of personnel):

Notification and filing

38 A railway company that proposes to make a change referred to in paragraph 15(1)(b) or (c) must, before making the change, notify the Minister of the change and must, at the request of the Minister, file with the Minister the documentation relating to the risk assessment that it conducted with respect to the change.Transport Canada, SOR/2015-26, Railway Safety Management Systems Regulations, 2015 (as amended 01 April 2015), section 38.

CP did not formally notify the Minister before implementing the EIC application in 2016, although TC was aware of the initiative. TC did not request the risk assessment completed in the spring of 2016 in relation to the rollout of this application.

1.12.1.3 Transport Canada’s comprehensive 2016 audit of Canadian Pacific’s safety management system

From September to November 2016, TC conducted a comprehensive auditThe objective of the comprehensive audit was to determine the company’s compliance to the Railway Safety Management System Regulations, 2015, and not to evaluate the effectiveness of its safety management system. of CP’s processes for risk assessment and for the implementation and evaluation of remedial action. The comprehensive audit process reviewed CP’s SMS documents to ensure that they complied with the requirements laid out in the SMS Regulations.

TC’s audit reviewed multiple risk assessments conducted in 2015 and 2016. Although CP’s risk assessment process related to the rollout of the EIC application had not been sent to TC, nor was it requested by TC, before the full implementation of EIC, it was included in the list of risk assessments reviewed in the audit.

In March 2017, TC provided CP with the audit report, which included the following findings:

• Managers leading the risk assessment process did not always understand the steps of the risk assessment procedure within the worksheet.
• Managers interviewed by TC during the audit stated that the risk assessments were approved before the implementation of safety actions.
• Completed worksheets were not submitted to CP’s Corporate Risk group for approval, as required in CP’s risk assessment procedure.
• The risk assessment worksheet did not provide clear details describing what each step required, which led to a lack of understanding among managers on how to adequately populate the fields within the worksheet.
• Formal training to develop the knowledge and skills to conduct risk assessments effectively was not available and a graduated on-the-job training and mentoring approach was not consistently applied.
• Training on the risk assessment process requested by CP management from the Corporate Risk group had been planned for 01 November 2015, but had not yet been delivered at the time of the audit in 2016.

In response, CP completed the following safety actions:

• Developed and rolled out an online risk assessment training program to all operations managers in Canada; the training clearly outlines procedure expectations, including the requirements pertaining to the consultation with the bargaining agents;
• Aligned roles and responsibilities with key risk assessment positions tasked with organizing and completing a risk assessment;
• Ensured that roles and responsibilities are clearly defined;
• Clarified steps for evaluating the effectiveness of remedial actions; and
• Continued to assess and enhance its risk assessment process, as needed.

1.12.2 Previous recommendation related to Canadian Pacific’s safety management system

Following its investigation of an occurrence on 04 February 2019, in which a CP freight train derailed on a steep descending grade near Field, British Columbia, and the 3 crew members on board were fatally injured,TSB Rail Transportation Safety Investigation Report R19C0015. the TSB determined that railway companies’ SMSs were not yet effectively identifying hazards and mitigating risks in rail transportation. When hazards are not identified—either through reporting or data trend analysis, or by evaluating the impact of operational changes—and when the risks that they present are not rigorously assessed, gaps in the safety defences can remain unmitigated, increasing the risk of accidents.

The Board also determined that, until CP’s overall corporate safety culture and SMS framework incorporate a means to comprehensively identify hazards, including the review of safety reports and data trend analysis, and assess risks before making operational changes, the effectiveness of CP’s SMS will not be fully realized. Therefore, the Board recommended that

In its December 2023 response to this recommendation, TC indicated that it had completed numerous activities over the past 16 months toward assessing the effectiveness of CP’s SMS. In July 2022, TC required periodic SMS filings from CP in order to help assess the efficacy of CP’s processes for hazard identification, identifying safety concerns, and risk assessment. TC also conducted 2 targeted audits of CP’s SMS and, as a result of these audits, it informed CP of its expectations, including the amendment of its process for identifying safety concerns. CP’s amended process was received, and TC is reviewing and assessing it. In addition, TC increased its inspection frequency of CP’s occupational health and safety committees by 7 inspections between fiscal years 2020-2021 and 2021-2022.

In its February 2024 assessment of TC’s response, the Board indicated that it was encouraged that TC conducted targeted audits of CP’s SMS and increased its inspection frequency for occupational health and safety committee monitoring, and that it looked forward to receiving the results of TC’s review and assessment of CP’s amended SMS processes. The Board assessed TC’s response to Recommendation R22-03 to show Satisfactory Intent.TSB Recommendation R22-03: Risk management through hazard identification, data trend analysis, and risk assessments at https://www.tsb.gc.ca/eng/recommandations-recommendations/rail/2022/rec-r2203.html (last accessed 04 September 2024).

1.13 TSB statistics for track unit movements that exceed limits of authority when an electronic track occupancy permit is inadvertently cancelled

To identify similar occurrences in which CP track maintenance employees operated track units (including hi-rail vehicles) on tracks without authority, the TSB conducted a review of its Rail Occurrence Database System (RODS) data for the 5-year period between 2017 and 2021 for an average to compare against the 2022 data. From 2017 to 2021, there were a total of 2 such occurrences; in comparison, there were 7 such occurrences in 2022 (Table 2). The number of occurrences in 2022 (7) can be considered a statistical outlier when compared to the other numbers in the period.The 7 occurrences in 2022 fall 2 standard deviations (standard deviation of 2.73) away from the 6-year average of 1.5.

* A description of these occurrences can be found in Appendix A.

As part of this investigation, the TSB asked CP why there had been a large increase in occurrences related to electronic TOP cancellations (7) in 2022 compared with earlier years. CP responded that all of the electronic TOPs that were cancelled in error were the result of “human factor errors” (such as a lack of attention to detail or a lack of focus on the task at hand). While CP confirmed that each of these occurrences were investigated internally, the company was unable at the time to determine why these occurrences peaked in 2022.

The analysis will focus on the factors that led to the inadvertent cancellation of the track occupancy permit (TOP) on the south main track, the adequacy of verification procedures when cancelling electronic TOPs using Canadian Pacific Railway Company’s (CP’s) EIC (Employee in Charge) application, the risk assessment conducted before the introduction of the EIC application in Canada, track unit detection on signalled main tracks, pre-shift checklists, and risks associated with not removing temporary joints in a timely fashion.

2.1 The occurrence

On the morning of 29 December 2022, a track supervisor (supervisor) was travelling westward in a hi-rail vehicle on the north main track, inspecting the north and south main tracks on the CP Shuswap Subdivision, when he identified a rail pull-apart on the south main track at Mile 116.67. At the time, the supervisor was authorized by electronic TOP, issued through the EIC application, to occupy that section of the north main track.

To protect the south main track while he completed the repair, the supervisor submitted another electronic TOP request indicating that he would need the south main track for 45 to 55 minutes. However, the request did not provide (nor was it required to) any detail as to why the TOP was needed. The rail traffic controller (RTC) authorized the TOP but provided a “Call RTC Before” time of 29 minutes.

The supervisor followed up with an instant message to the RTC to indicate that he would be holding the south track until the joint repair was completed; however, the RTC did not receive the instant message.

The supervisor repositioned his vehicle to the south main track and began repairing the pull-apart. However, he soon realized that, because he had not yet cancelled the TOP for the north main track, that track remained unavailable for train operations. The supervisor then inadvertently cancelled the TOP for the south main track instead of the TOP for the north main track, leaving himself, his track repair activities, and the hi-rail vehicle unprotected on the south main track.

The RTC, seeing on his monitor that the TOP for the south main track had been cancelled and that the track was unoccupied, requested a permissive signal for eastbound freight train 302-25 at signal 1170S, i.e., directly into the block where the supervisor’s hi-rail vehicle was positioned and the track repairs were underway.

The approaching train crew observed the hi-rail vehicle ahead on the tracks. The train was on a slight (0.4% to 0.2%) descending grade eastward, and on a slight (1°) left-hand curve, making it difficult for the train crew to immediately identify whether the hi-rail vehicle was on the spur track or the south main track. Nonetheless, a full-service brake application was made while the train was travelling at 47 mph. After the train crew realized that a collision was imminent, emergency braking was initiated but it was unable to prevent the train, which was travelling at 28 mph, from colliding with the unoccupied, stationary hi-rail vehicle. The hi-rail vehicle caught fire and was destroyed. The supervisor and the welder who was assisting him observed the approaching train and had moved to a position of safety before the collision. No one was injured.

2.2 Verification procedures for the cancellation of track occupancy permits

At CP, TOPs can be requested, issued, and cancelled over the railway radio system or, since 2017, electronically using the EIC application.

When radio communication is used, there is direct person-to-person verbal interaction between the track maintenance employee and the RTC at all stages of the process. When using the EIC application, interaction between the employee and the RTC is through electronic data transmissions and instant messaging and does not include a process to communicate and verify the receipt of safety-critical information.

The procedures for requesting and cancelling TOPs over the radio are well documented in the Canadian Rail Operating Rules (CROR).

With respect to the cancellation of TOPs by radio,

(a)  the foreman must advise the RTC of the TOP number to be cancelled;

(b)  the RTC must state the TOP number and limits of the TOP to be cancelled which must be acknowledged as correct by the foreman;

(c)  the RTC will then state the TOP number, “cancelled,” and the initials of the RTC, which must be repeated by the foreman.Canadian Rail Operating Rules (01 October 2022, approved by Transport Canada 09 May 2022), Rule 864.

The CROR further states that “the cancellation does not take effect until it has been correctly repeated and acknowledged by the foreman.”Ibid.

In contrast, when TOPs are cancelled via electronic transmission, the CROR does not require that the TOP be repeated to the RTC.

CP employees are provided training on how to use the EIC application, as well as a job aid that gives an overview of the most common operations performed using the application. These documents set out a more streamlined process for cancelling electronic TOPs:

1. The foreman navigates to the list of active TOPs in the EIC application and selects the applicable TOP.
2. The application displays the selected TOP and the foreman verifies that the information is correct, then places a checkmark in the appropriate checkboxes to confirm that no track work or track units will be left unprotected.
3. The foreman enters his or her password, then clicks OK, which automatically cancels the TOP. Track protection ends as soon as the foreman clicks OK in the EIC application. There is no requirement to wait for acknowledgment of the cancellation by the RTC, who is expected to acknowledge the cancellation when time permits.

The EIC application presents several advantages over the traditional method of managing TOPs over the radio. For instance, it can reduce the potential for transcription errors or confusion about limits, and it reduces the workload of the RTC. The process is considered more efficient, and is the method preferred by both track maintenance employees and RTCs for managing TOPs.

In this occurrence, the supervisor followed the procedure for cancelling electronic TOPs. However, although he reviewed the TOP that he had selected, he did not realize that it was the TOP for the south main track, as the 2 TOPs were similar. Consequently, he placed a checkmark in the checkboxes and clicked OK. Because the process for cancelling electronic TOPs does not require verification by a 2nd qualified individual, the error went unnoticed.

Inadvertent cancellation of electronic TOPs has only recently emerged as a more frequent occurrence. There have been 9 such occurrences at CP since 2017, when the EIC application was fully implemented. Of these occurrences, 7 happened in 2022, and all 7 were attributed by CP to human factor errors. CP’s investigations into these occurrences were unable to determine why these occurrences peaked that year.

2.3 Cognitive demand

To cancel a TOP in the EIC application, a track maintenance employee must select the TOP from the Authority Summary page, which lists all active TOPs in a table format. By default, the TOPs are shown in chronological order (oldest to newest). However, this order can be changed on the touch screen display by tapping column headings in the table. At the time of the occurrence, the supervisor and several other track maintenance employees were unaware that the order of the TOPs could be changed.

In this occurrence, the supervisor had obtained a TOP for the north main track, then later obtained another TOP with similar limits, but for the south main track. After the RTC authorized the TOP for the south main track, both TOPs were active, and both appeared in the Authority Summary page on the EIC application.

As he was repairing the pull-apart, the supervisor was contending with several time‑pressure factors that likely affected his mental model and degraded his situational awareness:

• The supervisor had requested the TOP for the south main track for 45 to 55 minutes, the time usually required to fix a pull-apart. However, unaware of the nature of the work to be accomplished, the RTC had authorized the TOP and provided a Call RTC Before time of 29 minutes because this was the amount of time that he judged he could give without delaying train movements. TOPs remain in effect until cancelled by the foreman in charge—in this occurrence, the supervisor—and therefore the supervisor was aware that he could occupy the south main track longer than indicated by the RTC. However, he was also aware that RTCs have to account for traffic delays and he strived to respect the allotted time of 29 minutes.
• Repairing a rail pull-apart at a joint between rails is a time-sensitive task; once the rail is heated and expands, the joint must be reconnected before the rail cools and contracts.
• The supervisor was using a borrowed vehicle and he was not familiar with how its contents were organized. He lost time looking for material, compounding the time pressure he was under.

When the supervisor cancelled the TOP, he had just completed a call with his coworker while simultaneously searching the truck for the material he needed. He quickly switched his attention to the EIC application and proceeded to cancel the TOP for the south main track. As he had cancelled several previous TOPs that day, all of which had appeared from oldest to newest on the Authority Summary page, his mental model was that the TOPs were still displayed in the same order. Therefore, he selected the TOP on the top of the list, unaware that he had inadvertently tapped a heading and reordered the TOPs so that the newest was displayed on top of the list.

Once the selected TOP was opened, the supervisor reviewed the information quickly and superficially, as he was short on time and his attention was divided between cancelling the TOP and planning the upcoming work. The 2 TOPs were for similar limits but different tracks. In addition, the TOP information was presented in a small font and hence was not salient enough to capture the supervisor’s attention and challenge his mental model. Consequently, he did not notice that he had selected the TOP for the south main track instead of the TOP for the north main track, and he completed the cancellation on the wrong TOP.

2.4 Safety management systems

Since 2010, the TSB Watchlist has emphasized the need for an operator’s safety management system (SMS) to be implemented effectively, to ensure that hazards are proactively identified and risks are mitigated.

Effective risk management does not completely eliminate risk. Rather, it manages risk to a level as low as reasonably practicable. Therefore, when the TSB identifies a hazard that likely contributed to an occurrence or risk of occurrence, it must consider whether the company’s SMS was applied and, if so, whether it was applied effectively.

Under the Railway Safety Management System Regulations, 2015 (SMS Regulations), railway companies must conduct a risk assessment in various circumstances—for instance, when a company introduces a new technology or when it makes a change to the responsibilities or duties of employees.

In accordance with the SMS Regulations, before implementing the EIC application in Canada, CP conducted a risk assessment using its Risk Assessment Worksheet. A review of the completed worksheet revealed the following:

• Even though the EIC application would fundamentally change how TOPs are managed (a safety-critical activity), the trigger for the risk assessment did not recognize that this application was a change that could introduce a new hazard in the workplace, nor that it could create or increase a direct safety risk to employees, property, or the public.
• The scope of the risk assessment focused on training related to the rollout of the new application; it made no mention of other risks related to the design, testing, and implementation of the application in the field.

The SMS Regulations require railway companies to notify the Minister of Transport before implementing certain changes in their operations, such as introducing new technology. CP did not formally notify the Minister before implementing the EIC application in 2016, although TC was aware of the initiative. TC did not request the risk assessment completed in the spring of 2016 in relation to the rollout of this application. Consequently, an opportunity was missed for TC to review the risk assessment and proactively identify any shortcomings.

In the risk assessment, the likelihood of occurrence was assessed for each identified potential undesired event. The likelihood that a foreman would occupy the track with no authority was assessed as “rare” (i.e., only in exceptional circumstances, less than once in 50 years). However, since the EIC application was first introduced, there have been several occurrences on CP’s Canadian network in which track maintenance employees operated track units without authority, having inadvertently cancelled an electronic TOP. The discrepancy between the likelihood indicated in the risk assessment and the number of occurrences recorded did not prompt a new evaluation cycle under CP’s SMS processes to confirm that all hazards had been identified, their risks were being adequately assessed, and the mitigation measures were effective.

2.4.1 Transport Canada’s surveillance of Canadian Pacific’s safety management system

In 2016, TC conducted a comprehensive audit of CP’s processes for risk assessment and for the implementation and evaluation of safety action. TC determined that a risk assessment for CP’s EIC application had been conducted, and the risk assessment was included in the audit.

In March 2017, TC sent CP a report of its findings. TC indicated that risk assessment training was not being delivered to CP managers, that managers did not always understand the steps required under the risk assessments, and that the risk assessment worksheets did not clearly define the requirements to be captured.

In April 2017, CP responded to TC and indicated its safety actions. These actions included risk assessment training for managers, as well as changes to the risk assessment procedure, to provide more clarity within specific sections and to indicate who is responsible for a given task.

2.5 Track units in the centralized traffic control system

In Canada, most track units are specifically designed so that electric current does not travel between opposite wheels on the same axle, i.e., the axles are insulated so that they do not shunt the track circuits. Therefore, when insulated hi-rail vehicles are on the main track, they do not reliably generate a track occupancy on the RTC’s subdivision display and they are not protected from approaching trains by the signal system.

In this occurrence, after the TOP had been inadvertently cancelled, which removed the signal blocking that had been in place to protect the TOP, the RTC’s subdivision display was showing the track as unoccupied and available for use. Therefore, the RTC selected the south main track as the route for train 302‑25 and lined up the controlled block signals for the eastward movement. When eastbound train 302-25 approached signal 1170S on the south main track, the signal system provided a permissive signal to train 302‑25, even though the hi-rail vehicle was still occupying the track.

The vulnerability of track units that do not shunt track circuits had been the subject of a recommendation by the United States National Transportation Safety Board (NTSB). In 1989, the NTSB specifically called on the American Railway Engineering Association to “[d]etermine methods to provide for positive shunting of signal circuitry by on-track, maintenance-of-way machinery, and include these methods in the manual of recommended practices.” To date, only limited action has been taken in the United States and the NTSB considers this recommendation to be closed and the response unacceptable.

The TSB has investigated several accidents in which trains operating on permissive signals have collided with track units. In each of these instances, the track unit did not shunt the track circuit and there was no other shunting device available to provide a backup defence against train / track unit collisions.

2.6 Job briefing to ensure adequate track protection

At CP, all individuals involved in track maintenance work, who are in the work area and working together, must participate in a job briefing. This briefing must be led by the employee in charge and be recorded in the Engineering Job Safety Briefing Booklet.

In this occurrence, the supervisor and welder completed a verbal job briefing, which included a discussion of the tasks at hand, the hazards present, and the type of track protection in effect (the electronic TOP for the south main track). However, the limits of the TOP were not reviewed, nor was it an explicit requirement that they be reviewed (although CP expects that the limits be reviewed). Moreover, the supervisor, as the employee in charge, was required to record the briefing in the Engineering Job Safety Briefing Booklet but decided to forego this step in favour of getting to work on the track repair.

2.7 Radio communications

There was no external speaker for the radio in the hi-rail vehicle that the supervisor had borrowed (external speakers are not mandatory on track units). Also, the batteries in the supervisor’s portable radio were not sufficiently charged to last the duration of his shift and had died before the track repair began. Furthermore, the supervisor was unable to locate a charger in the hi-rail vehicle. The welder, who had volunteered to help, was unaware that the supervisor’s portable radio had died; he had left his portable radio in his vehicle by the roadside when he arrived at the work location.

In this occurrence, the doors of the hi-rail vehicle were left open on the south side, so that radio broadcasts made by other railway employees could be heard on the hi-rail vehicle’s radio. However, while working on the pull-apart, the supervisor and welder were too far from the vehicle’s radio to overhear radio communications. They therefore did not hear the radio broadcasts when the train passed by a nearby wayside inspection system, nor did they hear the train crew broadcast the advance signal to their location.

The Canadian Rail Operating Rules require that radio receivers be set at a volume that allows for continuous monitoring. However, even when radios are set at an adequate volume and are in scanning mode, track maintenance employees may not hear a radio communication, for instance when it is weak, or when the noise from their maintenance activities precludes hearing it,. In addition, not all signal indications are required to be broadcast over the radio by train crews.

2.8 Pre-shift checklists

Checklists are useful to support memory: they help ensure that all of the steps of a process have been carried out and that mental models of a situation are accurate by, for example, telling foremen what materials or equipment they need to do a job.

In this occurrence, the supervisor did not have a checklist of essential equipment and materials for the vehicle and he did not ensure that the missing supplies were restocked at the beginning of the shift.

CP has a mandatory daily pre-shift inspection for hi-rail vehicles, which the supervisor completed. This inspection, however, focuses on mechanical and safety-related matters; it does not cover work equipment and material inventory.

2.9 Removal of temporary rail joints

The investigation determined that, in 2022, within 1 mile of the pull-apart that was under repair, there were 15 other occasions when joint maintenance was required. In addition, under the occurrence joint, there were 2 hanging ties (i.e., ties that were suspended from the bottom of the rail, no longer providing track support).

At the pull-apart, the joint had been secured with 6-hole joint bars with 4 bolts applied. Holes for the 2 innermost bolts had not been drilled through the web of the rail, suggesting that the original intent was to weld the joint permanently in a timely manner. A joint in continuous welded rail that is not installed with the full complement of bolts may be less likely to withstand normal service stresses, making it more prone to failure.

Joints are a known point of track vulnerability. Consequently, the Rules Respecting Key Trains and Key Routes require railway companies to develop and adhere to a maintenance and inspection plan for permanent and temporary rail joints for continuous welded rail on main track. For temporary rail joints, the plan must include the following elements (this list is not exhaustive):

• the time limit for retention until a permanent repair can be made,
• location of a track segment where the rail joint has been installed in continuous welded rail, including the subdivision, mileage, and track identification, where applicable; and
• the installation date.

CP’s plan calls for removal of temporary rail joints within 3 years of being installed in track on a key route.

Before 22 August 2021, there was no regulatory requirement for railway companies to keep records of temporary rail joints. Consequently, there is no record of when the joint at the pull-apart location was installed in this location. However, it is likely that the joint was installed at the same time as a switch in 2016.

3.1 Findings as to causes and contributing factors

1. When the electronic track occupancy permit that was protecting the track work at the rail pull-apart was inadvertently cancelled by the track supervisor, the south main track became available for the operation of trains. Subsequently, eastbound freight train 302-25 was routed on the track on which the track supervisor and a welder were working.
2. Once the train crew realized that the hi-rail vehicle was on the track ahead, emergency braking was initiated; however, there was insufficient time for the train to stop and avoid the collision.
3. In the absence of a multi-layer verification procedure in Canadian Pacific Railway Company’s EIC (Employee in Charge) application, the track supervisor was able to inadvertently select, verify, and cancel the track occupancy permit that was protecting his track work activities.

3.2 Findings as to risk

1. Using a means of communication that does not include a process to clearly convey and verify safety-critical information, such as instant messaging, can lead to decisions being made without both parties fully understanding the situation, increasing the risk of an accident.
2. If all foremen using a computerized application for managing track occupancy permits are not fully aware of system functionality, some foremen may make mistakes when navigating the application, especially in situations with high cognitive demand, increasing the risk that a track occupancy permit will be cancelled in error.
3. If the stated trigger and scope for a risk assessment are not accurately defined, the process may not be effective, leaving associated risks unmitigated.
4. If related occurrences continue to occur and do not trigger a reassessment of risks under safety management system processes, hazards may remain unidentified and risks unmitigated.
5. Until a backup for the protection of track units and track work on signalled main track, such as positive shunting devices, is used as a matter of course, there is a continued risk that train movements will be given permissive signals to operate in track work zones and on track occupied by unprotected track units.
6. If records showing the date of installation of temporary joints are not kept, it cannot be known for certain how long temporary joints remain in the track, which increases the risk of pull-aparts and derailments.

3.3 Other findings

1. Following Transport Canada’s 2016 audit, risk assessments that had been previously conducted by managers who did not understand the steps required under the risk assessment were not corrected, nor did Transport Canada require them to be.
2. The job briefing conducted between the track supervisor and the welder did not include a detailed review of the type, limits, and status of the track occupancy permit.
3. When track maintenance employees do not have operational portable radios or external vehicle speakers while working on or near main track, they can miss communications that could alert them to approaching train movements.
4. Implementing a pre-shift checklist that includes an inventory of essential equipment and materials in a hi-rail vehicle can help to ensure they are available to track maintenance employees. 

4.1 Safety action taken

4.1.1 Transportation Safety Board of Canada

4.1.1.1 TSB Rail Safety Advisory Letter 04/23

The TSB sent Rail Safety Advisory Letter 04/23, “Verification procedures when cancelling an electronic track occupancy permit” to Canadian Pacific Railway Company (CP) on 24 April 2023.

The letter indicated, in part, that the verification procedures for cancelling a track occupancy permit (TOP) using the EIC (Employee in Charge) application were less rigorous than those for cancelling a TOP over the radio. In particular, there was no requirement for a 2nd qualified employee to verify that the correct TOP was being cancelled before the cancellation was completed. Without verification by a 2nd qualified individual, there was a missed opportunity for employees to update their situational awareness, and to detect and correct errors before they can lead to accidents.

Given the potential consequences of the inadvertent cancellation of a TOP, the letter indicated that CP might wish to consider the need for more stringent verification procedures for railway employees cancelling electronic TOPs.

4.1.2 Canadian Pacific

On 06 July 2023, CP responded to RSA 04/23, indicating that it had implemented the following safety actions:

• It enhanced the EIC application by building in time delays to give the employee time to pause and review information while making changes to TOPs. The application also now has features to differentiate the TOPs on screen, and some sections are displayed in larger font, to make them easier to read. Employees were given an opportunity to provide feedback on the changes.
• It issued a Safety Flash, in which employees were reminded of the steps that must be completed when verifying a TOP and before cancelling it, and that cancelling a TOP is a critical task requiring full attention. Managers were required to review the Safety Flash with their teams.
• It developed a video reminding employees to take the time they need to perform work safely. The video was rolled out to all Engineering track employees.
• It implemented a new tool, referred to as the “4 second reset,” that identifies signs of rushing, frustration, fatigue, and complacency, and reminded employees what they should do if they or their coworkers lose focus, and that they should speak up if they see something that they are concerned about.

In 2023, CP also initiated a project to further enhance the EIC application. As part of this project, it reviewed past TOP errors over the last several years and engaged a third-party company that specializes in analyzing human-technology interactions. With respect to foremen releasing the wrong authority, it was determined that the TOP cancellation screen needed improvement. As a result, the following were implemented:

• The TOP selected for cancellation is now presented in a different colour, allowing foremen to visually differentiate the TOP selected for cancellation from any other active TOPs displayed.
• The application now displays an additional confirmation prompt for cancellation operations, which the foreman is required to answer.
• Once the new cancellation prompt is answered in the affirmative, the foreman must choose the correct TOP to be cancelled from the overview screen.
• After a TOP is cancelled, there is a delay of 4 seconds before the Finish button is enabled, which gives the foreman an opportunity to consider and undo the cancellation if needed.

Other changes implemented following this project include:

• An unacknowledged TOP is outlined and will flash. Once acknowledged, the TOP will change to a solid colour.
• Station names are now static (when a foreman zooms in on a station, the station name continues to appear on screen).

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 14 August 2024. It was officially released on 17 October 2024.

Appendix A – Canadian Pacific Railway Company track occupancy permits cancelled electronically while track maintenance personnel were still occupying the main track, 2017-2022