Backgrounder (R19W0002)

Safety communications related to TSB investigation R19W0002: January 2019 main track train collision and derailment near Portage la Prairie, Manitoba

The occurrence

On 3 January 2019, eastbound CN freight train 318 collided with the side of westbound CN freight train 315 just east of Portage la Prairie, Manitoba.

At 0610, train 318 departed Rivers, Manitoba towards Winnipeg, Manitoba. At about 0730, westbound train 315 departed Winnipeg. Both trains were operating on the Rivers Subdivision, one of CN’s busiest routes which frequently transports dangerous goods.

Just under 3 hours later, while proceeding on the south track using Trip Optimizer (a system similar to cruise control on a car), train 318 passed a signal at Mile 52.2 indicating to the crew that they should be preparing to stop at the next signal, located at Mile 50.4 at Nattress. The conductor called out the signal as required, but did not hear the locomotive engineer (LE) verbally respond and the train continued at track speed.

Soon after, the head ends on train 318 and train 315 passed each other, and train 318’s conductor reminded the LE of the previous signal. The LE then applied the train brakes. However, as the Stop signal indication at Nattress came into view, the crew recognized that they would not be able to stop in time and applied the brakes in emergency. Shortly after train 318 collided with the side of train 315 at 23 mph (37 km/h), the crew jumped from the train, sustaining minor injuries. The two head-end locomotives on train 318 and eight cars on train 315 derailed as a result of the collision.

Recommendations made on 24 August 2022

The investigation concluded that:

• The train 318 operating crew did not respond appropriately to the signal indications displayed in the field at Mile 52.2 and Mile 50.4, which ultimately led to the collision.
• It is likely that the low workload associated with operating train 318 using TO, together with fatigue, reduced the LE’s arousal levels and impacted his ability to maintain vigilance and situational awareness.
• In particular, in the absence of a physical defence such as an enhanced train control system, there was no automatic intervention to slow or stop the train when the crew did not initially respond to the Clear to Stop signal displayed in the field.
• Due to the inexperience of the train 318 conductor and the authority gradient that existed between the crew members, the conductor deferred to the LE without questioning the operation of the train and, as a result, the crew’s actions to slow and stop the train before Controlled Signal 504S were delayed and ineffective.

Enhanced train control for key routes

The rail transportation system is complex. The defence-in-depth philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors. Wherever possible, a combination of rules-based (i.e., administrative) defences and physical defences should be implemented to address normal slips, lapses, and mistakes that characterize human behaviour. Although newer circuitry has been integrated over the years, the basic design of centralized traffic control (CTC) signalling systems in Canada is well established. Despite this newer circuitry, railway operations still rely predominantly on administrative defences, which are the least effective method for mitigating risk.

Administrative defences, such as the Canadian Rail Operating Rules, railway general operating instructions and bulletins, place an over-reliance on a train crew to follow the rules and do not consider the human factors that affect behaviour in everyday life. For example, the CTC train control system in this case had the administrative requirement for train crews to follow the signal indications displayed in the field. Safe train operations are contingent on train crews observing each signal indication, broadcasting it, and then taking the appropriate actions.

A signalled CTC system does not provide any advance warning to either the train crew or the rail traffic controller if a train crew does not observe a signal indication or does not take the appropriate action. CTC also does not provide automatic enforcement to comply with speed restrictions in order to slow or stop a train before it passes a restrictive signal.

In instances where a train crew misperceives, misinterprets or does not follow a signal indication, the administrative defences as a whole fail. As demonstrated in this and other occurrences, when an administrative defence fails and there is no secondary defence, it can result in an accident that otherwise could have been prevented.

In contrast to the administrative defences for train control systems available in Canada, Class 1 railways that operate in the United States (U.S.) have implemented physical fail-safe train control systems known as positive train control (PTC). PTC is designed to prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movement of a train through a switch left in the wrong position. In Canada, the term “enhanced train control” (ETC) has been adopted to describe such systems.

A PTC/ETC system would address the risk of crews misinterpreting or not following signal indications by automatically intervening to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. A fully functioning PTC/ETC system would also offer a physical fail-safe defence against operating crew errors that are influenced by fatigue, which played a role in this accident.

In the U.S., over the last 50 years, the National Transportation Safety Board (NTSB) has investigated more than 150 PTC-preventable accidents that took the lives of more than 300 people. From these investigations, the NTSB made 51 PTC-related recommendations.

In September 2008, a collision between a Metrolink commuter train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the Rail Safety Improvement Act of 2008 (RSIA) in the U.S. The RSIA mandated that PTC be installed on main rail lines that had specific risks associated with the transportation of dangerous goods (DG) as well as intercity and commuter passenger rail service.

As of 31 December 2020, PTC was fully implemented in the U.S. on all track required by the RSIA legislation, a total of 57 535.7 miles, which accounts for about 41% of the nearly 140 000 route-miles of the U.S. rail network. The total miles of track that have PTC installed includes the U.S. operations of both CN (3107 miles) and CP (2118 miles).

For comparison, the Canadian rail network comprises about 26 000 route-miles of track. Key routes account for a combined total of about 10 940 miles of main track, which represents about 42% of the Canadian rail network. When the key route criteria are compared to the high-hazard route criteria of the U.S. RSIA, it is reasonable to conclude that the hazards and percentages for route-miles of affected track are similar. Although U.S. legislation required that PTC be installed on high-hazard routes, there is no similar requirement to install PTC or ETC on comparable routes in Canada that carry DG.

A review of all TSB rail investigation reports (excluding Class 5 occurrences and including this occurrence) produced since the inception of the TSB in 1990 determined that 80 occurrences may have been prevented had a train control system equivalent to PTC (i.e., ETC) been available.

Furthermore, when TSB Class 5 occurrences are also considered, from 2004 to 2019, there was an annual average of 31 reported occurrences in which a train crew did not respond appropriately to a signal indication displayed in the field, and the yearly number of these occurrences is on the rise. In particular, 2018 (40) and 2019 (38) had the highest number of these occurrences.

In 2000, the TSB issued its first recommendation (R00-04) for implementing additional train control defences following its investigation into the 1998 collision between 2 CP trains near Notch Hill, British Columbia.^{Footnote 1} After determining that backup safety defences for signal indications were inadequate, the Board recommended that

In 2013, the TSB issued another recommendation (R13-01) for implementing additional train control defences following its investigation into the 2012 derailment and collision of VIA Rail Canada Inc. passenger train 92 (VIA 92) near Burlington, Ontario.^{Footnote 2} Following the investigation, the TSB indicated that Transport Canada (TC) and the industry should move forward with a strategy that would prevent these types of accidents by ensuring that signals, operating speeds, and operating limits are always followed. The Board recommended that

In 2014, in response to the 2 TSB recommendations, a joint TC–industry train control working group (TCWG) was established. The group was chaired by TC Rail Safety, and also included representatives from the railway industry and operating crew unions. After establishing the TCWG, there were a series of ongoing meetings, discussions, and studies related to the development and implementation of ETC systems in Canada with no implementation plan or other tangible results to date. While TC did publish a Notice of Intent in the Canada Gazette, Part I, in February 2022 signalling its intent to require the implementation of ETC in Canada, there is still no implementation plan.

In the time it took TC and industry to strike the TCWG, study the issue, produce the TCWG Final Report, contract a follow-on report from the Canadian Rail Research Laboratory (CaRRL) and study the CaRRL results, PTC had been fully implemented in the U.S. on all of the high-hazard trackage required by the RSIA legislation.

Despite significant investment in PTC technology for the CN and CP locomotive fleets and their U.S. infrastructure, and 2 TSB recommendations to TC related to ETC dating back over 20 years, little has been done to extend the use of PTC into Canada or develop a similar form of ETC in Canada.

In this occurrence, with no backup physical fail-safe defence, such as a PTC/ETC system, there was no automatic intervention available to slow or stop the train. Consequently, the collision occurred after the train 318 LE, who was fatigued, did not respond appropriately to the Clear to Stop signal displayed in the field.

By definition, the CN Rivers Subdivision is a key route and is also an integral part of one of the major rail traffic corridors in Canada. This also means that the cities, towns, and villages along this key route are continually exposed to the risks associated with key trains transporting DG. Any collision or derailment involving a key train presents a risk of a DG release. If a train accident occurs on a key route, a key train or trains may be involved, increasing the risk of a DG release and potential adverse consequences to people, property or the environment.

It is clear that the current administrative defences for train operation, such as company procedural guidelines, notices and instructions, as well as the TC–approved Canadian Rail Operating Rules and Work/Rest Rules for Railway Operating Employees, are not always effective. Consequently, incidents and accidents continue to occur.

The first TSB recommendation on this issue is over 20 years old. The 2013 recommendation called for the implementation of physical fail-safe train controls, beginning with Canada’s high-speed rail corridors.^{Footnote 3} While the high-speed corridors are generally comprised of key routes, more recent accident history demonstrates that there is also a need for the implementation of fail-safe train control systems on all key routes.

The implementation of physical fail-safe train control technologies such as ETC would provide an extra layer of safety when operated in conjunction with existing administrative defences. However, the Canadian railway industry continues to rely solely on administrative defences, such as company procedural guidelines, the Canadian Rail Operating Rules, and the Work/Rest Rules for Railway Operating Employees, to protect against train crews not responding appropriately to signal indications displayed in the field. If TC and the railway industry do not take action to implement physical fail-safe defences to reduce the consequences of inevitable human errors, the risk of collisions and derailments will persist, with a commensurate increase in risk on key routes in Canada. Therefore, the Board recommends that

Crew resource management training

Railway operations are governed by rules and instructions that place equal responsibility for safe train operations on all crew members. Safe railway operations are predicated on all crew members following all of the rules, all of the time. In the rail industry, operating rules require that crew members verbally acknowledge signal indications displayed in the field to each other. When a train encounters a signal indication displayed in the field, 1 crew member must communicate the signal indication aloud within the locomotive cab to the other crew member. While the other crew member is required to repeat the message back, there is no requirement for the original sender to confirm that the message was received accurately or understood by the other crew member. As a result, this communication can fail.

The railway rules do not specify a closed-loop communication method, meaning there is no requirement for the original sender of the message to acknowledge, and therefore confirm, that it was received accurately. Moreover, when there is a significant difference in level of experience between operating crew members, an authority gradient may develop in which the less experienced crew member may not always intervene to ensure compliance with all of the rules. In these situations, there is a danger that safety-compromising behaviour will be overlooked because a less experienced employee may be reluctant to question the actions of a more senior employee or intervene in the operation of the train even when it may be critical to do so.

In this occurrence, the investigation determined that communications between the 2 crew members were not always closed-loop. The callouts of signal indications by the conductor were not always acknowledged or repeated back by the LE. The conductor did not confirm that the LE had understood the communication nor was he required to do so. The inexperience of the conductor on the subdivision, and with locomotive operations, also deterred him from trying to intervene and stop the train.

Crew resource management (CRM) is a concept introduced in the aviation and marine industries to limit or eliminate human errors by recognizing the importance of cognitive and interpersonal skills, thereby improving safety. CRM targets a crew’s skills, abilities, attitudes, communication, situational awareness, problem solving, and teamwork. Crew members must successfully interact with each other, their equipment, and their environment to effectively manage threats, errors, and unexpected conditions that may be encountered.

In order to perform in a coordinated, efficient, and safe manner, crew actions need to be based on a common understanding of the current state of the equipment, the intended route to be taken, and any other potential threats. When this understanding is consistent, crews are better able to effectively anticipate and coordinate their actions to achieve their common goal. This common understanding between crew members is referred to as team or shared situational awareness.

Shared situational awareness is developed and maintained by a crew through a number of discrete and continuous behaviours. These behaviours include in-trip briefings, the identification of key points throughout the trip, threat and error management (TEM), callouts to any change in the state of the equipment, the instrument setting or mode, and the communication of any change in plans to ensure that all crew members have a common understanding of activities.

TEM stresses the principles of anticipation, recognition, and recovery when addressing threats, errors, and undesirable equipment states, and is based on the proactive detection of threats that could reduce safety margins. Effective error management is associated with specific behaviours by the crew, the most common being vigilance, a propensity to ask questions or provide feedback, and assertiveness.

A 2015 study entitled Human Factors Analysis of “Missed Signals” in Railway Operations,^{Footnote 4} when addressing team training, indicated that CRM training

emphasizes non-technical skills such as communication, briefing, backing up behaviour,^{Footnote 5} mutual performance monitoring, team leadership, decision making, task-related assertiveness (e.g., a junior operator speaking up to a dominant colleague), and team adaptability.

The report went on to state that CRM training includes aspects of team situational awareness such as “perception” and “information sharing, coordination and crosschecking information” and instructed crews to “become vigilant for losses of [situational awareness]; both one’s own and by others.”

CRM focuses on providing crews with the interpersonal skills required to carry out their tasks safely: “CRM training typically consists of an ongoing training and monitoring process through which personnel are trained to approach their activities from a team perspective rather than from an individual perspective.”^{Footnote 6}

Significant safety benefits were experienced in the aviation and marine industries with the introduction of CRM. Given the prevalence of human factors issues in rail accident statistics, this type of training could yield significant safety benefits in the rail industry.^{Footnote 7}

Since 2017, CN has delivered a course called “Looking out for each other” as part of its operating crew requalification programs delivered every 3 years. While the CN training is insightful, it is broadly focused and does not specifically deal with train crew interaction within a locomotive cab or the authority gradients that may exist in that environment. While CP provides CRM training to its new operating employees, it does not provide formal dedicated recurrent CRM training.

The Railway Employee Qualification Standards Regulations have no requirement for operating crews to complete a separate module on CRM when they qualify or re-qualify. Consequently, the adoption of CRM training in the rail industry has been sporadic and the approach differs between railways. Although railway training touches on CRM principles, neither Canadian Pacific Railway Company (CP) nor CN provide dedicated, recurrent CRM training that explores all aspects of CRM. Recurrent CRM training would seek to improve non-technical skills that deal with in-cab communication, job briefings, backing up behaviour, mutual performance monitoring, team leadership, decision making, task-related assertiveness (e.g., a junior operator speaking up to a dominant colleague), team adaptability, as well as concepts of TEM and team situational awareness.

The TSB has investigated 8 other rail occurrences, dating back as far as 1996, in which ineffective CRM practices were identified as a factor that contributed to the accidents.^{Footnote 8}

If operating crew members do not receive enhanced initial and recurrent CRM training to develop skills in crew communication, the coordination of decision making and activities, and dealing with authority gradients that may exist within a locomotive cab environment, there is an increased risk that inadequate crew communication will lead to unsafe operations. Therefore, the Board recommends that