TSB Recommendation R22-04

The rail transportation system is complex. The defence-in-depth philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors. Wherever possible, a combination of rules-based (i.e., administrative) defences and physical defences should be implemented to address normal slips, lapses, and mistakes that characterize human behaviour. Although newer circuitry has been integrated over the years, the basic design of centralized traffic control (CTC) wayside signal systems in Canada is well established. Despite the use of newer circuitry, railway operations still rely predominantly on administrative defences, which are the least effective method for mitigating risk.

Administrative defences, such as the Canadian Rail Operating Rules, railway general operating instructions, operating bulletins, and the Work/Rest Rules for Railway Operating Employees place an over-reliance on a train crew to follow the rules and do not consider the human factors that affect behaviour in everyday life. For example, in this case, the CTC system had the administrative requirement for train crews to follow the signal indications displayed in the field. However, when the crew did not respond appropriately to the signal indications displayed in the train, the administrative defence failed.

Safe train operations are contingent on the administrative defence of train crews observing each signal indication, broadcasting it, and then taking the appropriate actions. However, a signalled CTC system does not provide any advance warning to either the train crew or the rail traffic controller if a train crew does not observe a signal indication or does not take the appropriate action. CTC also does not provide automatic enforcement to comply with speed restrictions in order to slow or stop a train before it passes a restrictive signal.

In instances where a train crew misperceives, misinterprets or does not follow a signal indication, the administrative defences as a whole fail. As demonstrated in this and other occurrences, when an administrative defence fails and there is no secondary defence, it can result in an accident that otherwise could have been prevented.

In contrast to the administrative defences for train control systems available in Canada, Class 1 railways that operate in the United States (U.S.) have implemented physical fail-safe train control systems known as positive train control (PTC). PTC is designed to prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movement of a train through a switch left in the wrong position. In Canada, the term “enhanced train control” (ETC) has been adopted to describe such systems.

A PTC/ETC system would address the risk of crews misinterpreting or not following signal indications by automatically intervening to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. A fully functioning PTC/ETC system would also offer a physical fail-safe defence against operating crew errors that are influenced by fatigue, which played a role in this accident.

In the U.S., over the last 50 years, the National Transportation Safety Board (NTSB) has investigated more than 150 PTC-preventable accidents that took the lives of more than 300 people. From these investigations, the NTSB made 51 PTC-related recommendations.

In September 2008, a collision between a Metrolink commuter train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the Rail Safety Improvement Act of 2008 (RSIA) in the U.S. The RSIA mandated that PTC be installed on main rail lines that had specific risks associated with the transportation of dangerous goods (DG) as well as intercity and commuter passenger rail service.

As of 31 December 2020, PTC was fully implemented in the U.S. on all track required by the RSIA legislation, a total of 57 535.7 miles, which accounts for about 41% of the nearly 140 000 route-miles of the U.S. rail network. The total miles of track that have PTC installed includes the U.S. operations of both CN (3107 miles) and CP (2118 miles).

For comparison, the Canadian rail network comprises about 26 000 route-miles of track. Key routes account for a combined total of about 10 940 miles of main track, which represents about 42% of the Canadian rail network. When the key route criteria are compared to the high-hazard route criteria of the U.S. RSIA, it is reasonable to conclude that the hazards and percentages for route-miles of affected track are similar. Although U.S. legislation required that PTC be installed on high-hazard routes, there is no similar requirement to install PTC or ETC on comparable routes in Canada that carry DG.

A review of all TSB rail investigation reports (excluding Class 5 occurrences and including this occurrence) produced since the inception of the TSB in 1990 determined that 80 occurrences may have been prevented had a train control system equivalent to PTC (i.e., ETC) been available.

Furthermore, when TSB Class 5 occurrences are also considered, from 2004 to 2019, there was an annual average of 31 reported occurrences in which a train crew did not respond appropriately to a signal indication displayed in the field, and the yearly number of these occurrences is on the rise. In particular, 2018 (40) and 2019 (38) had the highest number of these occurrences.

In 2000, the TSB issued its first recommendation (R00-04) for implementing additional train control defences following its investigation into the 1998 collision between 2 CP trains near Notch Hill, British Columbia.^{Footnote 3} After determining that backup safety defences for signal indications were inadequate, the Board recommended that

In 2013, the TSB issued another recommendation (R13-01) for implementing additional train control defences following its investigation into the 2012 derailment and collision of VIA Rail Canada Inc. passenger train 92 (VIA 92) near Burlington, Ontario.^{Footnote 4} Following the investigation, the TSB indicated that Transport Canada (TC) and the industry should move forward with a strategy that would prevent these types of accidents by ensuring that signals, operating speeds, and operating limits are always followed. The Board recommended that

In 2014, in response to the 2 TSB recommendations, a joint TC–industry train control working group (TCWG) was established. The group was chaired by TC Rail Safety, and also included representatives from the railway industry and operating crew unions. After establishing the TCWG, there were a series of ongoing meetings, discussions, and studies related to the development and implementation of ETC systems in Canada with no implementation plan or other tangible results to date. While TC did publish a Notice of Intent in the Canada Gazette, Part I, in February 2022 signalling its intent to require the implementation of ETC in Canada, there is still no implementation plan.

In the time it took TC and industry to strike the TCWG, study the issue, produce the TCWG Final Report, contract a follow-on report from the Canadian Rail Research Laboratory (CaRRL) and study the CaRRL results, PTC had been fully implemented in the U.S. on all of the high-hazard trackage required by the RSIA legislation.

Despite significant investment in PTC technology for the CN and CP locomotive fleets and their U.S. infrastructure, and 2 TSB recommendations to TC related to ETC dating back over 20 years, little has been done to extend the use of PTC into Canada or develop a similar form of ETC in Canada.

In this occurrence, with no backup physical fail-safe defence, such as a PTC/ETC system, there was no automatic intervention available to slow or stop the train. Consequently, the collision occurred after the train 318 LE, who was fatigued, did not respond appropriately to the Clear to Stop signal displayed in the field.

By definition, the CN Rivers Subdivision is a key route and is also an integral part of one of the major rail traffic corridors in Canada. This also means that the cities, towns, and villages along this key route are continually exposed to the risks associated with key trains transporting DG. Any collision or derailment involving a key train presents a risk of a DG release. If a train accident occurs on a key route, a key train or trains may be involved, increasing the risk of a DG release and potential adverse consequences to people, property or the environment.

It is clear that the current administrative defences for train operation, such as company procedural guidelines, notices and instructions, as well as the TC–approved Canadian Rail Operating Rules and Work/Rest Rules for Railway Operating Employees, are not always effective. Consequently, incidents and accidents continue to occur.

The first TSB recommendation on this issue is over 20 years old. The 2013 recommendation called for the implementation of physical fail-safe train controls, beginning with Canada’s high-speed rail corridors.^{Footnote 5} While the high-speed corridors are generally comprised of key routes, more recent accident history demonstrates that there is also a need for the implementation of fail-safe train control systems on all key routes.

The implementation of physical fail-safe train control technologies such as ETC would provide an extra layer of safety when operated in conjunction with existing administrative defences. However, the Canadian railway industry continues to rely solely on administrative defences, such as company procedural guidelines, the Canadian Rail Operating Rules, and the Work/Rest Rules for Railway Operating Employees, to protect against train crews not responding appropriately to signal indications displayed in the field. If TC and the railway industry do not take action to implement physical fail-safe defences to reduce the consequences of inevitable human errors, the risk of collisions and derailments will persist, with a commensurate increase in risk on key routes in Canada.

Therefore, the Board recommended that