Rail transportation safety recommendation R01-02

Reassessment of the responses from Transport Canada to Rail Safety Recommendation R01-02 – R99H0007

Signal Communications

Background

On 23 April 1999, at approximately 1200 eastern daylight time, VIA Rail train No. 74, travelling eastward on the north track of Canadian National's (CN) Chatham Subdivision, at Thamesville, Ontario, encountered a reversed switch, crossed over to the south main track and derailed at Mile 46.7. The derailed train collided with stationary rail cars on an adjacent track. The three cars that were struck were loaded with ammonium nitrate. All four passenger cars and the locomotive of the passenger train derailed, as well as four of the stationary cars on the adjacent track. The two train crew members in the locomotive cab were fatally injured. Seventy-seven of the 186 passengers and crew on board were treated at hospital. Four people were admitted with serious injuries. Numerous other passengers received first aid on site. Approximately 50 m of main track and 100 m of the adjacent track were destroyed. The locomotive was damaged beyond repair and the leading two passenger cars sustained substantial damage.

The investigation determined that, in Occupancy Control System (OCS) outside Automatic Block Signal System (ABS), existing safeguards were inadequate to prevent the unauthorized reversed main track switches from leading to the occurrence. Further, previous concerns expressed by the TBS with respect to the level of safety afforded by the OCS method of train control have been renewed by this accident. The Board identified over-reliance on procedural compliance in the operation of safety critical systems as an undesirable situation. Similarly, the Board has been advocating the development of safety strategies, where multiple layers of defences are used to improve error tolerance, where necessary. The Board believes that, when the effect of a single error on a safety critical system can lead to the derailment of a passenger train at high speed, the error tolerance of that system is inadequate.

Under the conditions of TC's Emergency Directive, issued 14 November 2000, passenger train operation in OCS outside ABS will no longer approach main track switches in the facing-point direction under the assumption that the switches are properly lined. This represents a fundamental change to the operating philosophy in this type of territory. The intent of this change and the associated speed limitation are to improve safety by reducing the risk of passenger trains diverging through unanticipated reversed main track switches at speeds in excess of their design speed, thus reducing the risks to which train crews, passengers and communities such as Thamesville are exposed. Although the effects of these measures cannot be quantified for some time, the Board anticipates that these initiatives will positively affect safety.

The Board concluded its investigation and released report R99H0007 on 02 April 2001.

Board Recommendation R01-02 (02 April 2001)

Unauthorized reversed main track switches are most often the result of inadvertent errors by railway employees. Past safety actions relating to unauthorized reversed main track switches have focussed primarily on eliminating errors through improved procedural compliance. The speed restrictions imposed through TC's Emergency Directive, although temporary, indicate an acknowledgement of the inevitability of some level of human error with respect to the handling of main track switches. This is a necessary first step toward understanding the effects of errors on a safety critical system and toward developing mitigating strategies. Therefore, the Board recommends that:

Response to R01-02 (02 July 2001)

Transport Canada accepted the intent of this recommendation.

Representatives from the department and the Railway Association of Canada (RAC) met in May 2001 with TBS officials to discuss the intent of this recommendation. Transport Canada in conjunction with the RAC intends to review the system design specification for computer-assisted and non-computer-assisted OCS in Canada. The department proposes to develop jointly with the RAC and with the involvement of the Railways, Unions, and provincial authorities, an instrument such as a questionnaire, for the railways to use that will allow them to analyze the system design specifications, including the consequence of human error on their own OCS operations. It is anticipated that if any inadequate system defence is identified by a railway when conducting this self-evaluation, corrective action will be initiated by the railway to improve the system design specifications of its OCS operation.

Transport Canada will review the railways' self-analysis and, based on the results, will initiate whatever appropriate action is deemed necessary.

Board Assessment of Response to R01-02 (July 2001)

TC supported the intent of TBS's recommendation, and developed a mechanism for the railways to analyse system design specifications. Although railway companies providing "self analysis" may be a biased measurement, TC's response was assessed as Satisfactory Intent.

Additional Response to R01-02 (02 February 2005)

TC responded after completing the Review of the Railway's System Design Specifications for Computer-Assisted and Non-Computer-Assisted Occupancy Control System, commonly referred to as the OCS Study. The scope of this review was three dimensional. The third dimension was to develop a formal protocol to be used by individual railways in order to analyze their own system design deficiencies. The review did not identify any system design deficiencies in computer-assisted and non-computer-assisted Occupancy Control System (OCS) and operations that were not already known to the rail industry or Transport Canada. TC accepted this report as final.

Board Reassessment of Response to R01-02 (December 2005)

TC completed its review of the system design specification, and although significant deficiencies regarding the error tolerance of the system were identified, TC maintains that no design deficiencies were found that were not already known to the railway industry. If any deficiencies exist, whether or not already known, what will be done to address them is the issue. Industry should therefore be encouraged to take mitigating action to improve conditions.

Because system sesign specifications were reviewed as recommended by the TBS, the response to recommendation R01-02 is reassessed as Satisfactory in Part.

Additional Response to R01-02 (January 2010)

Recent re-drafting of the Canadian Rail Operating Rules (CROR) rulebook did not bring forward any glaring OCS safety issues despite the rulebook having gone through a thorough review by TC, the RAC and the industry. Also, the OCS study completed in 2004 did not find an unacceptable level of safety.

Board Reassessment of Response to R01-02 (16 September 2010)

The OCS study was reviewed and the CROR has been revised. While TC, RAC and industry identified areas of the OCS system with less than optimum design their collective belief is that these areas do not create unacceptable risk. In consideration of the results of this review the Board reassesses the response to Recommendation R01-02 to remain Satisfactory in Part.

TSB review of Recommendation R01-02 deficiency file status (May 2017)

The Board requested that Recommendation R01-02 be reviewed to determine if the deficiency file status was appropriate. After an initial evaluation, it was determined that the safety deficiency addressed by Recommendation R01-02 still needed to be reassessed.

A request for further information was sent to Transport Canada and a reassessment will be conducted upon receipt of Transport Canada's response.

Consequently, the status of Recommendation R01-02 was changed to Active.

Transport Canada's response to Recommendation R01-02 (March 2018)

TC is not planning to look at this recommendation at this time.

TSB reassessment of the response to Recommendation R01-02 (March 2018)

TC had previously advised that an OCS Study (i.e., Review of the Railway's System Design Specifications for Computer-Assisted and Non-Computer-Assisted Occupancy Control System) was completed in 2004. TC also advised that the 2004 study did not identify any system design deficiencies in the non-computer-assisted Occupancy Control System (OCS) that were not already known. As such, TC accepted the study report as final.

In September 2016, in its final report presented to the Advisory Council on Railway Safety, the Train Control Working Group indicated that:

Significant amounts of track in Canada are controlled by OCS. The majority of the OCS track miles consist of single track on branch lines, but there are some sections of OCS-controlled track with passenger operations.

Since the 1999 Thamesville accident, there have been three TSB investigations^{Footnote 1} involving switches being left in the reverse position in OCS territory. During the most recent investigation (i.e., the 2016 derailment of a CN freight train at a misaligned switch near Acton Vale, Quebec [R16D0073]), it was determined that:

• The TSB's database contains 45 occurrences between 01 September 2007 and 31 August 2016 in which a train crew arrived at a switch left in the reverse position, in territory subject to OCS rules, without receiving advance notice. From 2007 to 2011, there were 29 occurrences of this type; from 2012 to 2016, there were 16.
• Passenger trains were involved in 15% (7) of the 45 occurrences. In 3 of these 7, the trains were unable to stop before reaching the switch in the reverse position.
• Freight trains were involved in 85% (38) of the 45 occurrences. In 16 of these 38, the trains were unable to stop before reaching the switch in the reverse position.

Ideally, the amount of track using the OCS method of train control will continue to decrease, as railways transition to other types of train control. Some of the proposed and recently completed railway signal upgrade projects include:

• Since 2012, VIA Rail has completed a number of signal upgrade projects resulting in the elimination of some non-signaled territory on its network, including on the Ottawa to Brockville corridor. In addition, on the Guelph Subdivision (owned by Goderich-Exeter Railway), the Centralized Traffic Control (CTC) system was installed between Silver Junction (Georgetown) and Pottersburg (London).
• CP is undertaking a number of signal upgrade projects to install CTC on its network, including portions of its North mainline in Ontario, Manitoba, Saskatchewan and Alberta; its Coal route in British Columbia; and its route between Moose Jaw and Portal.
• At CN, various signal upgrade projects involving the installation of CTC have recently been completed, including on its Vegreville Subdivision (Alberta) and its Joliette Subdivision (Quebec). 

An over-reliance on procedural compliance in the operation of a safety critical system (such as OCS) is an undesirable situation, as human actions are not always error-free. The Board advocates for the development of safety strategies where multiple layers of defences are used to reduce risk. The Board believes that TC and the railways must continue to review OCS operations as part of on-going risk assessments, audits and safety management initiatives to identify actions that will mitigate the residual risks when operating in OCS territory.

As TC has no plans to pursue additional work on this safety deficiency, the Board considers the response to the recommendation to be Satisfactory in Part.

Next TSB action

In consideration that no further action is planned to be taken and continued reassessment will not likely yield further results, the TSB will not request updates from TC on a regular basis. This deficiency file remains Dormant. However, the TSB will continue to monitor this safety deficiency as part of future investigations involving the OCS.