Backgrounder (R19C0015)

Safety communications related to TSB investigation R19C0015 – February 2019 uncontrolled movement and main-track derailment near Field, British Columbia

The occurrence

On 4 February 2019, the Canadian Pacific Railway Company (CP) freight train 301-349 being operated by a relief crew derailed on Field Hill near Field, British Columbia, on a 13.5-mile section of track with a steep descending grade (average 2.2%) and several sharp curves.  The 3 crew members—a locomotive engineer, a conductor, and a conductor trainee—were fatally injured in the derailment.

Recommendations made on 31 March 2022

Reducing the risk of uncontrolled movements through the implementation of periodic maintenance requirements for brake cylinders

In this occurrence, the brake cylinders on the freight cars were leaking compressed air, a situation exacerbated by their age and condition and the extreme cold temperature (the ambient temperature was in the range of −25 °C  to −28 °C), reducing the braking capacity of the train’s automatic air brake system. From post-occurrence testing, it was found that about 50% of the cars on the occurrence train had reduced air brake effectiveness during the initial descent of Field Hill and, as a result, an emergency brake application was necessary. Given the extreme cold temperature and the length of time the train’s cars were stationary with the brakes applied at Partridge, the rate of brake cylinder pressure (BCP) loss on some cars was likely excessive. Consequently, about 3 hours later, the brakes could no longer hold the train, which began to roll on its own.

The leakage of compressed air from air brake components is a fundamental problem in cold ambient temperatures. Air brake leakage typically increases with decreasing temperature, and can become quite pronounced in extreme cold (at or below −25 °C). Many of the seals and gaskets in the air brake system are made of rubber or a composite material. The effects of cold-weather conditions on rubber can vary, depending on its composition, age, and wear. Also, cold-weather conditions are generally known to decrease rebound resilience, making the rubber stiffer and less effective at preventing leakage. This is particularly the case for air brake components with extended time in service, such as car control valve (CCV) gaskets, brake cylinder packing cup gaskets, and brake pipe flange gaskets.

Air leakage from the brake cylinders on rail cars can be especially problematic when descending a long steep grade, because a sufficient amount of BCP is needed for an extended period of time to maintain train speed. Descending the 13.5-mile Field Hill grade at 15 mph requires air brakes to remain engaged and provide a constant amount of brake retarding force for over 52 minutes.

To mitigate the risk of freight cars developing excessive air leakage from the brake cylinder, it is crucial that brake cylinders undergo regular testing and maintenance. However, there are no specific industry or regulatory requirements for regular maintenance on freight car brake cylinders.

The repair history for the 112 cars on the occurrence train showed that 23 cars (20.5%) had received brake cylinder replacement or servicing in the previous 5 years due to a failed single car test.

Brake cylinder leakage remains the second highest failure rate during the single car test, after CCV failures.

The railway industry has considered the problem of brake cylinder leakage. In 2011, the Association of American Railroads (AAR) Brake Systems Committee proposed to reduce by half the maximum brake cylinder leakage acceptable during a periodic single car test (SCT), a test which verifies the intended operation of car brakes and ensures, among other things, that the brakes remain applied and do not exceed allowable leakage rates.

According to AAR Standard S-486,^{Footnote 1} the maximum acceptable limit of brake cylinder leakage during an SCT is 1 psi/minute. At this leakage rate, the occurrence train would have lost 52 psi of BCP on the descent of Field Hill, which represents an 81.3% loss in braking capacity and, nearing the bottom of the descent, the remaining BCP on the train would have been the equivalent of a minimum reduction brake application (7 psi), which is insufficient to maintain train speed at 15 mph. In comparison, if the proposed maximum acceptable leakage rate of 1 psi/2 minutes were adopted, a train descending Field Hill would retain enough BCP to complete the descent at 15 mph with only one supplemental brake application to compensate for leakage.

The proposal from the AAR Brake Systems Committee was not accepted. The industry did not consider this revision to the standard to be needed for all of North America, primarily because of the regional nature of the problem: the more stringent maximum leakage rate is only needed for steep descending grade operations in cold winter temperatures.

Brake cylinders used to be subject to “clean, oil, test and stencil” (COT&S) reconditioning on a regular basis, but these requirements were eliminated by the AAR in 1992. ^{Footnote 2} Since then, the industry’s approach to brake cylinder maintenance has become one of voluntary preventative maintenance or run-to-failure. However, as this occurrence has shown, without periodic, scheduled maintenance, brake cylinder leakage can jeopardize safe train operations when sustained brake applications are required, especially in cold weather conditions.

The requirements for COT&S had also been removed for CCVs in 1992. However, following a 10 January 2018 occurrence at Luscar Industrial Spur in Leyland, Alberta, in which a freight train rolled uncontrolled while proceeding down a mountain grade,^{Footnote 3} and in response to a number of other occurrences in Canada and the U.S., the AAR reconsidered this position and made rule changes that have re-introduced a COT&S schedule for CCVs in certain circumstances.^{Footnote 4} The AAR has defined conditions under which CCVs should be replaced due to their age and exposure to service conditions in cold-weather environments. This new requirement applies to freight cars operating north of the 37th parallel during winter months that have CCVs older than 13 years since their last COT&S date.

Brake cylinders are also prone to declining performance after extended periods in service without maintenance, including lubrication and renewal of safety-critical rubber gaskets and seals. However, unlike the recent re-implementation of COT&S requirements for CCVs, there are no AAR requirements to service or replace brake cylinders on freight cars on a set time interval.

Excessive brake cylinder leakage of freight cars on steep descending grade territory in cold ambient temperatures increases the risks that loss of control events will occur due to degraded brake capacity. Uncontrolled movements of railway equipment, although low-frequency events, can create high-risk situations that may have catastrophic consequences.

For a train negotiating a long descending grade in cold weather conditions where a brake application will be held for an extended duration, such as Field Hill, with a brake cylinder leakage rate of 1 psi/minute—the maximum acceptable limit specified in AAR Standard S-486—there is a risk that brake cylinder leakage will render the air brake system ineffective. To prevent uncontrolled movements in these situations, brake cylinder leakage limits need to be regulated to a more stringent maximum acceptable level.

To mitigate the risk of freight cars developing excessive brake cylinder leakage, it is crucial that brake cylinders undergo regular, time-based, maintenance.

If Transport Canada and the railway industry do not take measures to prevent excessive brake cylinder leakage on freight cars, the risk of a loss of control due to insufficient braking capacity will persist, a risk that increases on steep descending grades, especially in cold ambient temperatures. Therefore, the Board recommends that

Reducing the risk of uncontrolled movements through the implementation of automatic parking brake technology

The issue of uncontrolled movements of railway equipment is not a new one. The TSB has pointed out the need for robust defences to prevent uncontrolled movements since 1996. On 12 August of that year, all 3 occupants in the operating cab of a locomotive were fatally injured when their train collided head-on with a cut of 20 runaway cars near Edson, Alberta.^{Footnote 5} In its investigation report, the TSB indicated that the facts surrounding this occurrence raised some concerns, notably with respect to the secondary defences against runaways.

The issue came to the forefront again in 2013 when, on 06 July, a runaway train derailed in the centre of the town of Lac-Mégantic, Quebec, destroying the town’s core and main business area, and causing the death of 47 people.^{Footnote 6} In its investigation report, the TSB indicated that equipment runaways are low-probability events that can have extreme consequences, and the cost to human life and our communities can be incalculable. For this reason, the Board recommended that

Since then, the trend in the number of uncontrolled movements has been on an upward trajectory. In 2014, the year after the Lac-Mégantic accident, there were 59 occurrences; in 2019, there were 78, including this one. Unplanned/uncontrolled movements of railway equipment remains a current issue and is included in the TSB’s Watchlist 2020, a list of issues that need to be addressed to make Canada’s transportation system even safer.

In the years since Recommendation R14-04 was issued, in an effort to address these concerns, Transport Canada (TC) has implemented several initiatives aimed at reinforcing and clarifying requirements in the Canadian Rail Operating Rules (CROR) governing the application of hand brakes. These initiatives included a revision to Rule 112 in 2015, which provided the industry with a comprehensive hand brake application chart to respond to various operating situations when securing unattended equipment.

Following the occurrence at Field, TC again modified the CROR with new requirements for the use of hand brakes. It introduced Rule 66 (Securing Equipment after an Emergency Brake Application on Grade) for the securement of trains stopped in emergency on heavy grades and mountain grades.^{Footnote 7} The new rule also includes a comprehensive hand brake application chart. It came into effect on 24 June 2020.

A hand brake is a mechanical device used to secure railway equipment and prevent uncontrolled movements. Hand brakes are installed on all railway rolling stock. They are manually applied and tightened by turning the hand brake wheel. This causes the brake shoes to be pressed against the wheel tread surface to prevent the wheels from moving or to retard their motion.

For hand brakes to securely hold a train, the right number of them must be applied to generate the needed brake force.

The hand brake application chart in Rule 66 indicates the number of hand brakes that must be applied on a train based on train tonnage and descending grade. For instance, given the occurrence train’s weight of approximately 15 000 tons and the average 2.2% grade on Field Hill, to meet the requirements of Rule 66, it would have been necessary to apply 75 hand brakes on the train after it had stopped in emergency.

There are several factors, however, that can reduce the effectiveness of hand brakes, most notably low input torque (the amount of force applied by the operator at the hand brake wheel), service wear, and reduced coefficient of friction (COF) of the brake shoes from rail conditions such as the presence of ice or snow. When some of the hand brakes on a train are not fully effective, more hand brakes are needed to achieve the brake force necessary to hold it stationary.

In practice, operators do not know how much force they are applying at the hand brake wheel, as hand brakes do not provide this type of feedback. Nor do they know the coefficient of friction of the brake shoes, or whether a hand brake’s effectiveness is reduced due to service wear. The only available means to determine whether a sufficient number of hand brakes has been applied, therefore, is to perform a hand brake effectiveness test. This test involves releasing the air brakes to confirm that the train does not begin to roll. If the train does roll, more hand brakes must be applied, and the test performed again. In the operating scenarios covered by Rule 66, however, this test is not feasible for a train stopped on a heavy or mountain grade. In such circumstances it would be highly risky to release the air brakes, as the train could begin to roll quite quickly and it may not be possible to stop it again. Therefore, operators must rely on the pre-determined number of hand brakes mandated by the rule. If some hand brakes on the train are not fully effective, this number may not be enough, and there is a risk of uncontrolled movement.

Applying hand brakes is physically demanding and time consuming. Operators must board the car by climbing the side ladder, position themselves safely at the hand brake wheel, and crank the wheel clockwise to take up chain slack before applying maximum force on the crank. They must then dismount, walk to the next car, and repeat the manoeuvre. Applying a large number of hand brakes requires a sustained effort over several hours. As fatigue sets in, the force that operators are able to exert at each hand brake wheel may diminish over time; with lower input torque, the effectiveness of the hand brakes is reduced, requiring more hand brakes to be applied.

Table 28 shows how many hand brakes would be needed to hold a 15 000-ton train on a 2.2% descending grade, assuming 55 foot-pounds input torque (the force achieved by the participants in the human performance assessment), and a coefficient of friction in the range of 0.3 to 0.4. In the presence of brake cylinder leakage, an increasingly higher number of hand brakes would be needed as the pressure drops. According to this table, the 75 hand brakes mandated by Rule 66 would be sufficient, based on a COF of 0.39, and a BCP of 10 psi.

As the table shows, the number of hand brakes needed to hold a train varies greatly based on several variables, over which train crews have no control.

* The numbers in this table assume a net hand brake ratio of 6.5%.
** A brake cylinder pressure of 77 psi corresponds to the pressure after an emergency brake application, when there is no brake cylinder leakage.

There is AAR-approved technology available for securing trains, which takes most of these variables out of the equation: automatic parking brakes for rail vehicles (APBs), such as Wabtec’s Automatic Park Brake and New York Air Brake’s ParkLoc. APB technology has been tested and approved for use on North American railways, but it has not been widely adopted.

APBs are brake cylinders equipped with an automatic, mechanically operated latch that locks the brake cylinder piston as needed depending on the pressure in the brake pipe. When the brake pipe pressure is depleted (e.g., after a penalty or an emergency brake application), the system automatically locks the brake cylinder piston in the extended position, thereby retaining the brake force. This occurs without any specific intervention or action by the train crew. Once the brake pipe pressure increases again, the system automatically releases the lock and retracts the brake cylinder piston, which releases the brake force. APBs can be configured for use on both truck-mounted and body-mounted brake systems, and they can be retrofitted on existing freight cars with no need to make modifications to the air brake system.

Because APBs lock the brake cylinder piston into position on the cars, their effectiveness is independent of input torque, and it is not affected by brake cylinder leakage. APBs, therefore, can hold a train on a steep grade indefinitely.

Uncontrolled movements of railway equipment, while low frequency events, can create high-risk situations that may have catastrophic consequences. TSB investigations into uncontrolled movements have revealed that the sequence of events almost always included inadequate train securement. TC has made several improvements to the rules governing the application of hand brakes. However, even with a comprehensive set of rules, it has been demonstrated over the years that depending solely on the correct application of rules is not sufficient to maintain safety in a complex transportation system. The concept of “defence in depth” has shaped the thinking in the safety world for many years. Layers of defences, or safety redundancy, have proven to be a successful approach in many industries, to ensuring that a single-point failure does not lead to catastrophic consequences.

Better and more numerous administrative defences have not been successful in establishing safety redundancy against uncontrolled movements. To date, the Canadian railway industry and the regulator have yet to look beyond strengthening an administrative defense such as the use of hand brakes.

Until physical defences such as automatic parking brakes are implemented across the Canadian railway network, the risk of uncontrolled movements due to inadequate train securement will persist, especially on steep grades where the effectiveness of hand brakes cannot be tested. Therefore, the Board recommends that

Risk management through hazard identification, data trend analysis, and risk assessments

A safety management system (SMS) is an internationally recognized framework that allows companies to effectively manage risk and make operations safer. Risk assessments are a cornerstone of a fully functioning and effective SMS, and are essential for safe operations. The Railway Safety Management System Regulations, 2015 (the SMS Regulations) require railway companies to conduct risk assessments, including when a safety concern is identified. However, what constitutes a safety concern is not defined in the regulatory provisions, leaving it to interpretation.

To identify safety concerns, railway companies are required to conduct, on an ongoing basis, an analysis of their operations, current or emerging trends, or any recurring situations. These analyses are based on information such as reports of safety hazards submitted by employees and data from safety monitoring technologies.

CP’s Reporting Contraventions, Safety Hazards and Identifying Safety Concerns Procedure defines safety concern as follows:

Safety Concern-is a hazard or condition which could result in an undesired event that constitutes:

• a threat to safe railway operations or could reduce the safety of railway
• presents a direct safety risk to employees; railway property; property transported by the railway; the public or property adjacent to the railway.^{Footnote 8}

At the time of the occurrence, CP’s procedure outlined the situations in which a safety hazard report should be made and an analysis conducted to identify safety concerns, emerging trends or recurring situations. It also identified the steps to be followed to progressively escalate a safety issue until it was resolved. However, the investigation revealed that the process was not always being followed, that hazard reports were not always rated or assessed, and that some reports were closed out without any clear indication of the corrective action undertaken or any indication of verification that the action had been completed or was effective.

Prior to this occurrence, safety hazard reports involving poorly braking unit grain trains descending Field Hill in cold winter weather had been submitted by train crews for a number of years in January and February. Although CP’s procedure for safety hazard reporting was actively followed at the Calgary terminal, the follow-up process was not effective at analyzing trends. CP did not consider that the trend in safety hazard reports represented a “safety concern,” as per the SMS Regulations, or by CP’s own Reporting Contraventions, Safety Hazards and Identifying Safety Concerns Procedure.

The individual notifications of this hazard were closed, yet new similar reports continued to be recorded through the reporting system. Still, year after year, the reports on the poor braking of unit grain trains on Field Hill were closed, no risk assessment was conducted, and insufficient corrective action was taken. Since braking performance degradation occurred seasonally on CP unit grain trains in extreme cold temperature, this condition had become normalized such that it was expected that close to maximum available braking would be required while descending Field Hill.

Furthermore, Transport Canada’s oversight of the occupational health and safety committee in Calgary did not identify the lack of corrective action on the reported substandard braking performance of unit grain trains descending Field Hill.

CP collects data from the wheel temperature detectors (WTD) on its network. These detectors facilitate the identification of cars with cold wheels, which is an indicator of poor braking performance. The data collected in winter allow the railway to monitor the temperature sensitivity and performance of the car air brakes when they are most susceptible to leakage. WTDs are a safety monitoring technology and, as such, data collected from these systems must be analyzed to identify safety concerns, trends or emerging trends, or recurring situations. However, at the time of the occurrence, this available data was not actively analyzed by CP and an opportunity was missed to identify the hazard and mitigate any risks related to the braking performance of grain trains in extreme cold temperatures.

Risk assessments must be conducted prior to implementing operational changes which have the potential to introduce new hazards or increase the level of severity of existing hazards. In the years preceding the occurrence, CP made several modifications to the operating procedures for Field Hill, such as changes to the speed threshold at which trains are permitted to descend Field Hill, and changes to the requirements for retainers and hand brakes after an emergency brake application. CP did not conduct a risk analysis to assess how these changes would impact safety.

The SMS Regulations require that railway companies ensure that employees performing duties essential to safe railway operations (such as conductors) have the skills and qualifications required to perform their duties safely. However, when CP changed its training program for conductors on the Laggan Subdivision, it did not conduct a risk assessment of this change.

Since the new SMS Regulations came into effect in 2015, the TSB has investigated 11 occurrences, including this one, in which shortcomings in hazard identification, analysis of relevant railway safety data, or risk assessments were identified as a risk factor. Of these, 7 occurred in CP operations.

The Board issued a recommendation to the Department of Transport related to the effectiveness of railways’ SMS in 2014, following its investigation into the July 2013 accident at Lac-Mégantic, Quebec. In its investigation report, the Board indicated that, until Canada's railways make the cultural shift to SMS, and TC makes sure that they have effectively implemented SMS, the safety benefits from SMS will not be realized. The Board recommended that

Since then, TC has completed its initial comprehensive audit of all federally regulated railways. As a result of these audits, TC requested corrective action plans where necessary, and stated that it continues to follow up to ensure that all railways have taken corrective action to address the findings. In its March 2021 assessment of TC’s response, the Board stated that it was encouraged by TC’s progress and looked forward to receiving information on the findings.

The effectiveness of railway SMS remains a concern and is included in the TSB’s Watchlist 2020, a list of issues that need to be addressed to make Canada’s transportation system even safer. As stated in the Watchlist, federally regulated railways have been required to have an SMS since 2001, and regulatory requirements were significantly enhanced in 2015. However, since then, companies’ SMS have not produced the expected safety improvements associated with mature safety management and safety culture, as the rate of main-track train accidents has not improved. The TSB believes that railway companies’ SMS are not yet effectively identifying hazards and mitigating risks in rail transportation. Safety management will remain on the Watchlist for the rail transportation sector until safety data is collected and analyzed to reliably determine risk assessment and risk mitigation, leading to measurable safety improvement.

An effective safety culture includes proactive actions to identify and manage operational risk. The identification of hazards within a risk assessment is critical to identifying the required mitigation measures needed, and is the foundation of an effective SMS.

When hazards are not identified, either through reporting, data trend analysis, or by evaluating the impact of operational changes, and when the risks that they present are not rigorously assessed, gaps in the safety defences can remain unmitigated, increasing the risk of accidents. Ultimately, it is the railway companies themselves which must ensure that they have the culture, structures, and processes in place to allow for proactive identification of hazards, assessment of risks, and implementation of mitigation strategies. However, Transport Canada also has a responsibility to ensure that railway companies not only comply with the SMS regulations, but are also managing the risks in their operations effectively.

Until CP’s overall corporate safety culture and SMS framework incorporate a means to comprehensively identify hazards, including the review of safety reports and data trend analysis, and assess risks before making operational changes, the effectiveness of CP’s SMS will not be fully realized. Therefore, the Board recommends that