Railway Investigation Report R16W0242

• Table of contents

  1. Factual information
  2. Analysis
  3. Findings
  4. Safety action
  5. Appendices

Summary

On 29 November 2016, at about 0515 Central Standard Time, southbound Canadian Pacific Railway (CP) ballast train BAL-27 rolled uncontrolled in the siding at Estevan, Saskatchewan, and struck a freight car on northbound CP freight train 293-28, which was stationary on the main track at about Mile 138.70 of CP's Weyburn Subdivision. The locomotive on ballast train BAL-27 sustained damage, and 1 car on freight train 293-28 derailed and sustained minor damage. No dangerous goods were involved, and there were no injuries.

Le présent rapport est également disponible en français.

1.0 Factual information

On 28 November 2016, a Canadian Pacific Railway (CP) train crew was called at 1830^{Footnote 1} and came on duty at 2030 in Moose Jaw, Saskatchewan, to operate ballast train BAL-27 (train BAL-27) southward on the Weyburn Subdivision to North Portal, Saskatchewan (Figure 1). Train BAL-27 was composed of 1 locomotive (CP 2275), 55 empty open-top hopper ballast cars, and 1 maintenance-of-way car. The train consist recorded a train weight of 1800 tons and a length of 2640 feet.

The crew of train BAL-27 consisted of a locomotive engineer (LE) and a conductor. Both crew members had at least 20 years of experience. Both crew members had woken up at about 1000 on 28 November 2016, after a good night of sleep. The LE had a short nap during the day, but the conductor did not nap. The crew members were familiar with the territory, met fitness and rest requirements when they reported for duty, and were qualified for their positions.

Train BAL-27 departed Moose Jaw at about 2315. While en route, the crew had difficulty maintaining the authorized track speed of 50 mph, and train BAL-27 responded as though it were heavier than the weight indicated on the consist. An average speed of about 35 mph was maintained throughout the journey. Before arriving at Estevan, Saskatchewan, train BAL-27 had to clear the main track and occupy a siding at 4 locations for meets with 4 northbound trains.

On 29 November 2016, northbound CP freight train 293-28 (train 293) was ordered at 0300 in North Portal, and departed at about 0430. Train 293 consisted of 2 locomotives, 24 loaded cars, and 101 empty cars. It weighed 6363 tons and was 8981 feet long.

1.1 The accident

At about 0440, train BAL-27 entered the Estevan siding from the north siding switch and proceeded southward through the siding. As the train approached the south end of the siding, the LE manipulated the throttle and used the automatic brakes to slow the train. As train BAL-27 was stopping, the LE also used light independent brake applications and kept the train stretched as it stopped. At about 0445, train BAL-27 was brought to a stop, just clear of the fouling point with the main track at the south end of the siding. Train BAL-27 was left parked in the siding with the independent and automatic brakes fully applied as the crew waited for the arrival of northbound train 293 (Figure 2). The crew prepared to perform a passing train inspection of train 293 in accordance with the Canadian Rail Operating Rules (CROR)^{Footnote 2} and with CP's General Operating Instructions.^{Footnote 3}

The conductor left the cab and cleared snow from the south siding switch while the LE remained in the cab of the locomotive.

At about 0510, train 293 approached Estevan, and its crew members made a broadcast over the radio when they were about 1 mile from the south siding switch at Estevan. Upon hearing the broadcast, the conductor of train BAL-27 stopped clearing the south siding switch and took a position on the west side of the main track to perform a passing train inspection of the west side of train 293. At about the same time, the LE of train BAL-27 got up from the seat next to the control stand, exited the cab and took a position on the east side of the main track in preparation to perform the passing train inspection of the east side of train 293.

As train 293 was passing, the LE from train BAL-27 returned to the cab of locomotive CP 2275 for personal reasons. While in the locomotive cab, the LE went between the locomotive control stand and the seat to retrieve a paper towel from the locomotive console (Figure 3) and inadvertently moved the automatic brake handle to the release position. Unaware that the automatic brake handle was in the release position, the LE exited the locomotive cab and returned to the ground to complete the passing train inspection.

Train 293 had just come to a stop with its head end positioned south of the north siding switch to enable its crew to restore the switch to the normal position (i.e., aligned for the main track). As train 293 was longer than the siding, the tail-end portion occupied the south siding switch and the Kensington Avenue public crossing.

At 0512:55, the automatic brakes of train BAL-27 released, which left only the locomotive independent brakes to hold (secure) the train. About 2 minutes later, train BAL-27 began to move forward (south) at a speed under 1 mph. At the time, the LE was facing away from train BAL-27 and did not notice that it was moving. Upon recognizing that train BAL-27 was moving, the LE immediately boarded the locomotive, entered the cab and initiated an emergency brake application at 0516:11. However, train BAL-27 continued to move until locomotive CP 2275 struck the 92nd car (empty gondola CP 355005) on train 293 and lifted the wheels slightly off the rail. At 0516:18, train BAL-27 came to a stop. Freight car CP 355005 on train 293 and locomotive CP 2275 on train BAL-27 sustained minor damage.

At the time of the occurrence, the temperature was −4 °C with blowing snow and winds from the northwest gusting up to 40 km/h. There was an accumulation of snow, partly covering the rail.

1.2 Post-accident

Following the occurrence, the crew of train BAL-27 reported the collision to the rail traffic controller. The crew remained on site while CP officials and maintenance crews responded. Once on site, the railway began conducting its investigation into the occurrence. In addition, CP engineering and mechanical employees inspected the track and inspected both of the trains.

At about 0915, the trains were cleared to be separated. The crew members of train BAL-27 were requested to reverse train BAL-27 into the siding to clear the main track and to allow train 293 to depart. The reverse movement required careful attention because the derailed car on train 293 (CP 355005) was being held up by locomotive CP 2275 on train BAL-27. Train BAL-27 needed to be brought back slowly to separate the 2 trains.

The reverse movement of train BAL-27 was performed at 0916, about 12.75 hours after the crew came on duty (2030), and about 4 hours following the collision. The movement lasted for 1 minute and 10 seconds and travelled a total of 95 feet. Once the trains were separated, the wheels of car CP 355005 came down safely on the rail head. Train 293 then departed and continued north to Moose Jaw.

After the reverse movement was completed, the crew of train BAL-27 secured the train in the siding at Estevan. The crew completed the task by about 0930. The crew members were then sent by taxi to Moose Jaw, and were off duty at 1415.

1.3 Recorded information

Table 1 provides a summary of the events compiled from the locomotive event recorder of train BAL-27.

Once the train began to roll, it moved 70 feet in 1 minute (i.e., an average speed of 0.80 mph) before the LE applied the emergency brakes. The train moved an additional 10 feet after the emergency brake was applied, and stopped when it struck train 293.

A video recording from the forward-facing camera on train 293 was available to confirm some of the events. However, with no on-board recorders (i.e., locomotive voice and video recorders) on train BAL-27, it was not possible to fully verify the exact circumstances relating to the inadvertent release of the automatic brakes.

1.4 Subdivision information

The Weyburn Subdivision consists of a single main track that extends southward, from Moose Jaw (Mile 0.0) to the international border with the United States at North Portal (Mile 160.80). On this subdivision, train movements are governed by the occupancy control system (OCS) as authorized by the CROR and supervised by a rail traffic controller located in Calgary, Alberta. OCS territory is non-signalled (i.e., dark territory). The track is classified as Class 4 track according to the Transport Canada (TC)–approved Rules Respecting Track Safety, with an authorized track speed of 50 mph. At the time of the occurrence, train traffic averaged about 12 trains per day.

The Estevan siding runs parallel to, and east of, the main track through the town of Estevan between Mile 137.4 and Mile 138.7. There is a 0.1% descending grade (north to south) at the south end of the siding.

1.5 Electro-Motive Diesel locomotives

Locomotive CP 2275 is a GP20C-ECO locomotive remanufactured^{Footnote 4} by Electro-Motive Diesel (EMD), which was acquired by Progress Rail Services Corporation, a subsidiary of Caterpillar Inc. Locomotive CP 2275 met the enhanced crashworthiness standards for locomotives.

Between 2013 and 2015, CP purchased a total of 130 GP20C-ECO locomotives and a number of EMD SD30C-ECO locomotives. At the time of the occurrence, CP had a total 130 GP20C-ECO locomotives and 50 SD30C-ECO locomotives in its locomotive fleet.

GP20C-ECO locomotives are 2000-horsepower locomotives weighing 276 000 pounds and equipped with a computer-controlled brake II (CCB II) system manufactured by New York Air Brake (NYAB). Locomotive CP 2275 was built in July 2015 and was also equipped with high idle protection, which automatically increases engine RPM and engine noise if cooling water temperature drops below a certain point.

Locomotive specifications must comply with the Association of American Railroads (AAR) standards, as specified in its Manual of Standards and Recommended Practices. Locomotives must also comply with applicable Federal Railroad Administration and TC regulations and rules.

When purchasing locomotives, railways will typically provide a list of their own operational specifications to the manufacturer. Manufacturers have their own more general sales specifications for each type of locomotive. Reset safety control (RSC) roll-away protection was part of the manufacturer's sales specifications. EMD listed the activation speed for roll-away protection as 0.5 mph, which was consistent with the majority of CP's locomotives.

As of 2009, most new and remanufactured EMD locomotives, including the GP20C-ECO and SD30C-ECO, were equipped with the Functionally Integrated Railroad Electronics (FIRE) system, a standardized locomotive integration software. The RSC roll-away protection activation was one of the locomotive electronic components that the FIRE system controlled. To determine when RSC roll-away protection should activate, the system monitors train speed through the axle generator and will initiate a penalty brake application when train speed reaches the programmed speed. The roll-away protection activation speed within the FIRE system on EMD locomotives was programmed at the factory to be 2.5 mph.

1.5.1 Acceptance testing of Electro-Motive Diesel locomotives by Canadian Pacific Railway

Before accepting locomotives purchased from the manufacturer, CP would test a sample of the locomotives upon delivery. The tests included a walk-around for general appearance, a visual component inspection, a power-up to test the on-board computers and electrical components, a load test, and a brake system test. In addition, some locomotives were operated on a short test track if available.

During the brake system test, the RSC would be tested by releasing the brakes and performing time-out tests of the RSC with the locomotive stopped. However, CP did not specifically test the RSC roll-away protection activation speed.

1.6 Train air brakes

Locomotives are equipped with 2 air brake systems: automatic and independent. The automatic brake system applies the brakes to each car and locomotive on the train, and is normally used during train operations to slow and stop the train. Each locomotive is also equipped with an independent brake system, which only applies air brakes on the locomotive. Independent brakes are not normally used during train operations, but are primarily used as a parking brake, sometimes in conjunction with the hand brake.

1.6.1 Automatic brakes

A train's automatic braking system is supplied with air from compressors located on each operating locomotive. The air is stored in the locomotive's main reservoir. This reservoir supplies approximately 90 psi of air to a brake pipe that runs along the length of the entire train, connecting to each locomotive and individual car. An air pressure change at the appropriate reduction rate within the brake pipe would activate the air brakes on the entire train.

When an automatic brake application is required, the LE moves the automatic brake handle to the desired position. This action removes air from the brake pipe. As each car's air brake valve senses a sufficient reduction in pressure, air flows from an auxiliary reservoir located on each car into that car's brake cylinder, applying the brake shoes to the wheels.

To release the brakes, the LE moves the automatic brake handle to the release position. This action causes air to flow from the main reservoir into the brake pipe, restoring pressure to 90 psi. Sensing the pressure being restored, the brake valve in each car allows air to be released from the brake cylinder through its retaining valve, and the brake shoes are removed from the wheels.

1.6.1.1 Penalty brake application

A penalty brake application is similar to a full automatic service brake application. However, this type of braking further reduces the brake pipe pressure to zero, requiring a train to recharge the brake pipe after stopping. This type of braking occurs as a result of a "penalty" applied by the system, such as when the RSC's roll-away protection is activated. This penalty brake application differs from an emergency brake application in that it occurs at a rate that does not deplete the emergency reservoir pressure, but applies a full service brake application using only auxiliary reservoir pressure with the brake pipe pressure depleted to zero.

1.6.2 Independent brakes

The independent brakes are also supplied with air from the main reservoir. On the EMD GP20C-ECO locomotives, when a full independent brake application is required, the LE moves the independent brake handle to the full-set position, and the CCB II air rack reduces the pressure to 27 psi, supplying air pressure to the locomotive brake cylinders. This causes the brake shoes to apply to only the locomotive wheels.

To release the independent brakes, the LE moves the independent brake handle to the release position. This causes air to be released from the locomotive's brake cylinders, and the brake shoes are removed from the locomotive wheels.

1.7 Reset safety control

The RSC is a vigilance system that activates alarms and then initiates a penalty brake application of the automatic brakes if it is not reset by the LE or the controls are not being manipulated within a predetermined time and set-up interval. Some RSCs have been upgraded to include roll-away protection that will initiate a penalty brake application when power is interrupted to the RSC, locomotive brake cylinder pressure is less than 25 psi, or a preset activation speed is detected.

In February 1986, following the Hinton train collision in Hinton, Alberta, Mr. Justice René P. Foisy was appointed to inquire into the accident. In response to the inquiry's findings  that the collision would in all likelihood have been prevented if the lead locomotive had been equipped with an RSC,^{Footnote 5} all locomotives built since 1986 have been required to be equipped with an RSC.

The TC–approved Railway Locomotive Inspection and Safety Rules state in part:

13. SAFETY CONTROL EQUIPMENT

13.1 A controlling locomotive must be equipped with a safety control system which shall, as a minimum, initiate a full service brake application and remove all tractive effort in the event that the person operating the locomotive becomes inattentive or incapacitated.

13.2 A controlling locomotive equipped with a safety control system with roll-away protection must:

1. be wired such that the safety control system power source is fed through the battery knife switch or circuit breaker;
2. meet the requirements of the most current "Association of American Railroads Manual of Standards and Recommended Practices" (S-5513); and
3. commence safety control system warning timing cycle and subsequently initiate a penalty brake application of the train air brakes should any of the following occur:
   1. power is interrupted to the safety control system;
   2. locomotive brake cylinder pressure is less than 25 psi;
   3. speed is detected.^{Footnote 6}

The AAR Manual of Standards and Recommended Practices, Section M, Locomotives and Locomotive Interchange Equipment, Standard S-5513, entitled "Locomotive Alerter Requirements," states in part:

5.0 ALERTER^{Footnote 7} ACTIVATION AND NULLIFICATION

5.1 The alerter shall become activated if either of the following conditions is met:

• brake cylinder pressure falls below 25 psi
• speed is detected

[…]

7.1 To provide for roll-away protection, when the alerter system moves from a nullified state to an active state, the first activation of the alerter warning timing cycle shall occur at a time interval of approximately 10 seconds […]

The AAR Manual of Standards and Recommended Practices, Section M, Locomotives and Locomotive Interchange Equipment, Standard S-591, entitled Locomotive System Integration Operating Display, specifies the following requirements for alerter alarm sounds:

For an RSC, after a timing cycle of 10 seconds, the normal sequence of visual and audible alarms can take an additional 20 seconds before a penalty brake application occurs. However, with respect to roll-away protection, if the air brake pressure remains higher than 25 psi, the total 30-second penalty brake application cycle will not begin until the activation speed is attained. For the occurrence locomotive (CP 2275), the activation speed for roll-away protection was set for 2.5 mph.

1.7.1 Roll-away protection

If an RSC is equipped with roll-away protection, it will initiate the timing cycle once a preset activation speed is detected. However, neither the Railway Locomotive Inspection and Safety Rules nor the AAR Manual of Standards and Recommended Practices define the speed at which the roll-away protection should be activated.

Roll-away protection requires sufficient air brake pressure within the brake pipe to apply the brakes. During the Lac-Mégantic investigation,^{Footnote 8} the air brake system of a test train made up of locomotives and tank cars similar to the one involved in that occurrence was evaluated to study the relationship between air brake pressure and the application of the automatic brakes. When the brake pipe pressure dropped to 21 psi, the roll-away protection activated. However, because of the low pressure in the brake pipe due to air leakage, the penalty brakes did not apply.

A successful penalty brake application depends on brake pipe pressure level, auxiliary reservoir pressure level, and the proper rate of reduction of brake pipe pressure in order for the control valves to sense the full service brake application. Low brake pipe pressure can result in a weak signal to apply the brakes; consequently, the brakes may not consistently apply in all cases.

1.7.2 Testing of reset safety control by Canadian Pacific Railway and Electro-Motive Diesel

In May 2016, CP began testing the RSC on some locomotives, and requested that EMD perform the same testing on locomotives equipped with the FIRE-based alerter system. CP indicated that the tests were prompted by the need to verify that the roll-away protection activated as per the AAR standard, and to confirm the roll-away protection activation speed because roll-away protection was being used as a secondary method of securement. The testing determined that the roll-away protection on EMD locomotives equipped with the FIRE system activated at 2.5 mph (not the 0.5 mph indicated on the manufacturer's specification) or when the independent brake pressure fell below 25 psi. The activation warning timing cycle was also confirmed to be approximately 25 seconds (+/− 2 seconds).

Neither CP nor EMD required any modifications to the activation speed or timing following the tests. The RSC system for these locomotives remained "as is" even though it did not meet EMD's specifications. CP did not conduct a risk assessment following these tests. CP continued to use RSC roll-away protection on locomotives with the FIRE systems as a secondary method of securement in accordance with CROR Rule 112.

1.7.3 Testing of the reset safety control by the Transportation Safety Board of Canada

Following the occurrence, the TSB conducted testing of the occurrence locomotive in Moose Jaw and testing of 2 locomotives of the same series (CP 2282 and CP 2266) in Smiths Falls, Ontario. During these tests, the locomotives were moved by a second locomotive to simulate an uncontrolled movement.

The following was determined based on these tests:

• The RSC did not activate until a speed of between 2 mph and 3 mph was attained in every instance where the locomotives were moved while the independent brakes were fully applied; and
• The penalty brake initiation sequence was confirmed to be about 25 seconds for the locomotives.

On 20 December 2016, based on the understanding that a movement of 0.5 mph^{Footnote 9} should have initiated the roll-away protection braking sequence, the TSB issued Rail Safety Advisory (RSA) 16/16 relating to the roll-away protection activation of the RSC device on some CP locomotives. The RSA indicated that, based on the test results and the known risks associated with uncontrolled movements due to train securement, TC might wish to review the reliability of the RSC (including the roll-away protection feature) on CP 2200–series locomotives and on other locomotives (as appropriate) to ensure that the RSC feature will always operate as designed and in accordance with the TC-approved Railway Locomotive Inspection and Safety Rules.

On 22 December 2016, in response to RSA 16/16, TC issued a ministerial order (MO 16-07) requiring all railway companies to

1. Cease using the reset safety control with rollaway protection on Electro-Motive Diesel model GP20 and GP30 locomotives as a means of additional securement or mechanical device for the purpose of Rule 112 of the Canadian Rail Operating Rules until it is determined that the rollaway protection functions in accordance with its design specifications; and
2. Cease using the reset safety control with rollaway protection in any other locomotive model as a mean [sic] of additional physical securement or mechanical device for the purpose of Rule 112 of the Canadian Rail Operating Rules, unless the reset safety control with rollaway protection system is first tested and it is determined that the system functions in accordance with its design specifications. The testing must record the speed and time taken for (i) the safety control system to activate, (ii) the first audible warning and (iii) the initiation of the brake application.^{Footnote 10}

The accompanying letter to MO 16-07 ordered federally regulated railway companies to file the following with the Minister of Transport:

1. A list of locomotive models in service that are equipped with reset safety control rollaway protection and the design specifications of the system by January 23, 2017; and
2. Within 30 days of any testing done as per item 2 of MO 16-07, the result [sic] of the testing along with the process and procedure followed to ensure that the system functions in accordance with its design specifications.^{Footnote 11}

1.7.4 Response to Transport Canada's ministerial order

In response to MO 16-07, 43 railways indicated that they did not use roll-away protection and they were not required to provide testing results. All other railways that used roll-away protection as a secondary method of securement performed testing on their locomotive fleets.

Table 2 provides a summary of the roll-away protection activation speed results that railways provided to TC.

* When a locomotive control switch is placed in the isolate position, that is, the engine speed is held at idle and power cannot be applied by the locomotive, the roll-away protection speed is increased to allow a train to be pushed or pulled at slow speeds for product loading.

The roll-away protection activation speed varied between locomotive models and event recorder or RSC model. However, most EMD locomotives built after 2009 were equipped with the FIRE system that had a roll-away protection activation speed of 2.5 mph.

Based on the results received by the railways, TC determined that the roll-away feature for locomotives equipped with the RSC system functioned as designed as long as a penalty brake sequence was initiated when the independent brake pipe pressure fell below 25 psi or speed was detected and that the timeout speed was within standards (about 30 seconds).

Since no speed was defined within the AAR Manual of Standards and Recommended Practices or the TC-approved Railway Locomotive Inspection and Safety Rules, the railways could resume the use of the roll-away protection as a secondary method of securement provided that the system functioned in accordance with its design specifications.

1.8 Effect of snow and ice on train brakes

During the winter, cold weather, snow and ice conditions can negatively affect air brake effectiveness and increase braking distances. In the winter, blowing snow can build up on the brake components such as the brake shoes. Under these conditions, after the train has been operating for some time, when train air brakes are initially applied, the air brake effectiveness can be diminished due to the snow and ice buildup between the brake shoes and wheel treads.

During winter operations, in anticipation of using the brakes to slow or stop a train (e.g., when approaching yards or sidings), LEs will typically make a light brake application to heat the wheels and brake shoes, which will melt snow and ice buildup from the brake shoes. This conditioning of the wheels and brake shoes helps to maintain more normal braking forces. Once the brakes are released, snow and ice will initially melt while the temperature of the shoes is still warm, but then refreeze as the brake shoes cool, beginning the cycle once again. At locations where an LE knows that effective independent brakes will be required, the LE will make a light application of the independent brakes while moving at slow speeds to condition the brakes.

In this occurrence, the LE performed some conditioning of the locomotive independent brakes. While stopping at the north siding switch and the south siding switch, the LE used the independent brakes for a total of 29 seconds over a period of 8.5 minutes.

CP's General Operating Instructions contain the following instruction for conditioning train automatic brakes in winter conditions:

32.10 Winter Conditions

A - During weather conditions which may cause snow or ice buildup to occur between brake shoes and wheels, periodic running brake tests must be performed to insure proper braking effort is being provided.

B - During weather conditions described above, when trains are approaching a location which will require the use of the train air brake, the locomotive engineer must make an automatic brake application sufficiently in advance of that location to determine that brakes are working properly.^{Footnote 12Footnote 13}

[…]

There are no such instructions for the conditioning of the independent brakes.

1.9 Brake holding calculations

Train BAL-27 was stopped in the Estevan siding on a 0.1% descending grade. After the inadvertent release of the automatic brakes, the locomotive independent brakes remained fully applied (27 psi). Based on braking force calculations, about 3600 pounds of retardation force^{Footnote 14} would have been required to secure the 1800-ton train BAL-27 in the siding. Using the known braking ratios, a fully applied independent brake on locomotive CP 2275 should have been sufficient to hold train BAL-27 on the descending grade unless

• the locomotive independent brake braking force was lower than designed,
• the train was heavier than indicated,
• the brake shoe coefficient of friction (COF)^{Footnote 15} on the locomotive was reduced, or
• any combination of the above.

1.9.1 Independent braking force for locomotive CP 2275

To assess the independent braking force of locomotive CP 2275, tests using brake shoe force test equipment were conducted. The following was determined:

• As per AAR's Recommended Practice RP-509, the locomotive was required to generate a net braking ratio of 27% at the time of manufacture. The net braking ratio is determined by dividing the sum of the measured braking force at each wheel by the weight of the locomotive. The tests confirmed that the independent brakes on locomotive CP 2275 met the AAR requirement, with a total braking force of 75 920 pounds and a net braking ratio of 27.5%.
• The COF of dry high-friction composition brake shoes is normally in the range of 30% to 35%.^{Footnote 16} Assuming a 30% COF, the retardation force available on locomotive CP 2275 with the independent brakes fully applied was 22 776 pounds.

1.9.2 Train weight

The ballast cars involved were 45-foot-long open-top hopper cars divided into 2 identical compartments. The walls within the compartments are angled towards the bottom to direct the ballast to where it can be unloaded from hatches underneath and at the bottom sides of the car.

The ballast cars on train BAL-27 were used to dump ballast the previous week near Moose Jaw. At that time, the weather at Moose Jaw included 3 days of freezing rain / wet snow with temperatures between 3 °C and −10 °C. Under these weather conditions, it is not uncommon for ballast in open-top hopper cars to freeze, making it difficult to completely empty the cars during unloading.

According to the train consist, train BAL-27 was transporting 55 empty open-top hopper ballast cars. However, many of the cars still contained ballast, with some cars remaining more than half full. When train BAL-27 was assembled, the ballast cars were not individually weighed, nor were they required to be. Instead, only the tare weight (about 30 tons) of each car was used to calculate the tonnage of the train (1800 tons).

Considering the slow acceleration of the train in full throttle, the investigation obtained the wheel impact load detector (WILD) inspection report from a detector located in Georgeville, Minnesota, dated 01 December 2016. The weight of the train was verified to be 2868 tons at that time.^{Footnote 17} Based on this tonnage, the average weight of each car would have been about 49 tons (i.e., 19 tons greater than the tare weight of 30 tons).

Based on the reported weight of 2868 tons, a braking effort of more than 5750 pounds of retardation force would have been required to hold train BAL-27. The retardation force available on locomotive CP 2275 with the independent brakes fully applied was 22 776 pounds, which should have been sufficient to hold the train.

1.9.3 Brake shoe coefficient of friction

Considering the reported weight of the train (2868 tons), the siding track profile, and the revised calculated retardation force of 5750 pounds, to allow the train to move, the effective COF for the brake shoes on locomotive CP 2275 was likely no more than 7.5%. This COF level is in the typical range for brake shoes that are saturated with ice and snow.

1.10 TSB Lac-Mégantic investigation and Board recommendation R14-04

On 06 July 2013, shortly before 0100 Eastern Daylight Time, eastbound Montreal, Maine & Atlantic Railway freight train MMA-002, which had been parked unattended for the night on the main track at Nantes, Quebec, Mile 7.40 of the Sherbrooke Subdivision, started to roll. The train travelled about 7.2 miles, reaching a speed of 65 mph. At about 0115, while approaching the centre of the town of Lac-Mégantic, Quebec, 63 tank cars carrying petroleum crude oil, UN 1267, and 2 box cars derailed. As a result of the derailment, about 6 million litres of petroleum crude oil spilled. There were fires and explosions, which destroyed 40 buildings, 53 vehicles, and the railway tracks at the west end of Megantic Yard. A total of 47 people were fatally injured. There was environmental contamination of the downtown area and of the adjacent river and lake.

Since 1996, the TSB has pointed out the need for robust defences to prevent runaways, and since then, runaways have continued to occur in Canada. While equipment runaways are generally considered low frequency, they can also be high-risk events and have extreme consequences, particularly if they involve dangerous goods, as demonstrated by the Lac-Mégantic occurrence. For this reason, the Board recommended that

1.10.1 Actions by Transport Canada and industry following TSB Recommendation R14-04

On 29 October 2014, TC issued an emergency directive on additional physical defences for trains with operating locomotives to be left on the main track. It stated the following:

4a) Ensure that when equipment or movement are left unattended on main track, in addition to any securement requirements in Rule 112 of the CROR, at least one additional physical securement measure or mechanism is also used. The additional physical securement measures or mechanisms must prevent equipment from uncontrolled motion and must be one or more of the following:

• Permanent derails used within their design specifications;
• Mechanical emergency devices;
• Mechanical lock parking brake once approved by the Association of American Railroads (AAR);
• Reset Safety Control (RSC) with roll-away protection where air pressure is maintained or auto start is provided;
• Moving the equipment to a track protected with derails or bowled terrain verified by survey or track profile; or
• Other appropriate physical securement device accepted by Transport Canada.^{Footnote 18}

TC also required railway companies to formulate rules to address the securement of railway equipment. Following extensive consultations with the industry, the newly revised CROR Rule 112 was approved by the Minister of Transport and came into effect on 15 October 2015. The revised CROR Rule 112, "Leaving Equipment Unattended",^{Footnote 19} included 7 control measures that could be used as a secondary means of physical securement.

1.10.2 Board reassessment of Transport Canada's response to TSB Recommendation R14-04 (March 2017)

In March 2017, the Board reassessed TC's response to Recommendation R14-04 and acknowledged the effort TC made in revising CROR Rule 112. However, despite the actions taken, the number of uncontrolled movement occurrences remained the same in the past year (i.e., 42 occurrences in 2016 and 2015 and a five-year average of 39).^{Footnote 20} The Board reiterated that the physical defences should not rely on air brakes due to their lack of reliability. As air brakes are known to leak and the rate of leakage is generally unpredictable, this defence would not be a sufficient backup to the hand brakes. The reassessment concluded that

1.11 Distance a train could travel before a penalty brake application

In this occurrence, the train was initially parked in the siding clear of the main track but close to the fouling point. Any movement of train BAL-27 would have resulted in the train being foul of the main track and possibly derailing at the switch.

To determine the distance that a train similar to train BAL-27 could travel before a penalty brake application occurred, calculations were made for various RSC roll-away protection activation speeds. The calculations were specific for a train with a weight of 2868 tons, on a 0.1% descending grade. Changes to any of these factors would affect the distance travelled. The calculated distances do not include the additional stopping distance following the application of the penalty brake. Each scenario assumed a 30-second time delay before the RSC penalty brake application would activate. The following was determined:

• For a roll-away activation speed of 0.5 mph, a train could travel 62 feet.
• For a roll-away activation speed of 1.0 mph, a train could travel 213 feet.
• For a roll-away activation speed of 2.5 mph, a train could travel 1200 feet.

1.11 Locking pin for automatic brake handle

The train's automatic brakes are applied and released by moving the brake handle to the appropriate position. The automatic brake handle arrangement is equipped with 2 holes in the base of the handle and a locking pin that is attached to the control stand with a length of cable. When the locking pin is inserted into the hole on the left side of the base of the handle (the "full set" position), the handle cannot be moved to the release position (Figure 4). Similarly, when the locking pin is inserted into the hole on the right side of the handle (the "handle off" position), the automatic brakes cannot be applied.

This feature is intended to be used for locomotives in a trailing position. In these situations, when the automatic brakes are cut out, the pin would be inserted to lock the automatic brake handle in the handle off position to ensure that the emergency brakes are not inadvertently applied. For the head-end locomotive, the pin is not necessarily intended to be used to prevent inadvertent movement of the automatic brake handle. However, if the pin is inserted when the automatic brake handle is in the full set position, the pin would prevent an inadvertent release of the brakes.

1.12 Sound level measurements in the locomotive cab

Audio readings were performed on 3 CP locomotives: the occurrence locomotive, another GP20C-ECO locomotive with the same type of braking system, and an older model locomotive with a different style of braking system.

The sound levels of the repressurization of the brake pipe during an automatic brake release were recorded multiple times with the cab openings (window and door) closed, and with the window open. The sound levels were recorded near the control stand and near the locomotive door to determine if there was a difference in the audibility between the 2 locations.

The audio testing determined that the sound level of the repressurization of the brake pipe was only about 1 dB above the background noise level. There were also other similar background noises, such as the venting to atmosphere during an application of the automatic brakes (signal-to-noise ratio [SNR] of 4 dB) and the air release through the automatic drain valve (SNR of 18 dB), which produced higher audio levels.

In a report produced for TC entitled Locomotive Horn Evaluation: Effectiveness at Operating Speeds^{Footnote 21} and in other research,^{Footnote 22Footnote 23} the human ear can detect a signal in the 2.5 to 3 kHz range with a SNR of 6.5 dB. This means that the signal has to be 6.5 dB higher than the background noise at that frequency. This is the necessary level just to detect the signal. Full alerting to a signal requires a SNR of 9 dB to 10 dB above the detection threshold. This means that, for someone to be able to hear the sound and recognize that they should be alerted by it, the sound needs to be at least about 15 dB above the background noise.

At the time of the occurrence, the LE was wearing a hooded sweatshirt. Lab testing showed that this type of clothing can act as an effective filter for sounds in the 3 kHz to 21 kHz range with attenuation at about 10 dB or above and little attenuation at 1 kHz or below. This means that the hooded sweatshirt could have further reduced the volume of the repressurization sound, but allowed background noise at lower frequencies to remain at full volume.

1.14 Transport Canada Work/Rest Rules for Railway Operating Employees

The TC–approved Work/Rest Rules for Railway Operating Employees state in part:

5.1 Maximum Duty Times

5.1.1

1. The maximum continuous on-duty time for a single tour of duty operating in any class of service, is 12 hours, except work train service for which the maximum duty time is 16 hours. Where a tour of duty is designated as a split shift, as in the case of commuter service, the combined on-duty time for the two on-duty periods cannot exceed 12 hours.
2. When calculating on-duty time as outlined above, arbitrary time or allowances are not to be included. Preparatory and final times each shall not exceed 15 minutes.

[…]

5.1.5 Operating employees involved in an emergency situation may remain on-duty until they are relieved, subject to the fatigue management and reporting requirements set out in sections 6 and 7.^{Footnote 24}

The Work/Rest Rules for Railway Operating Employees define "emergency" as:

"Emergency" means a sudden or unforeseen situation where injury or harm has been sustained, or could reasonably be sustained to employee(s), passenger(s), the public or the environment such as those involving a casualty or unavoidable accident, an Act of God, severe storms, major earthquakes, washouts, derailments or where there has been a delay resulting from a cause not known to the railway company at the time employees leave the terminal and which could not have been foreseen.

Except as outlined above, normal operating problems that are inherent in railway operations that do not constitute an "Emergency", include but are not limited to:

1. crew shortages;
2. broken draw bars;
3. locomotive malfunctions;
4. equipment failure;
5. broken rails;
6. hot boxes;
7. switching;
8. doubling hills;
9. meeting trains;
10. train length.^{Footnote 25}

It is incumbent upon railway companies to establish that excess service cannot be avoided. When an emergency situation does occur, railway companies must exercise due diligence to avoid or limit such excess service.

Section 7 of the Work/Rest Rules for Railway Operating Employees states in part:

7. Filing/Reporting Requirements

[…]

7.3 A railway company shall file a report with the Department, as soon as possible, but not later than 48 hours following, when an Operating employee operates in excess of the maximum duty times permitted under the provisions subsections 5.1.1 and 5.1.3 under an emergency situation.^{Footnote 26}

Because CP did not declare an emergency at the time of the occurrence, it did not file a report with TC identifying that the crew members of train BAL-27 remained on duty following the accident and moved train BAL-27 to separate it from train 293 approximately 1 hour after their maximum duty time had expired.

TC subsequently requested additional information regarding the occurrence to clarify the hours worked by the crew of train BAL-27. On 28 June 2017, CP responded that it believed that the occurrence did meet the definition of an emergency. On 04 July 2017, TC informed CP that it was in non-compliance with section 7.3 (Filing/Reporting Requirements) of the Work/Rest Rules for Railway Operating Employees.

1.15 Risk of fatigue due to continuous wakefulness

A commonly known fatigue risk factor is being awake for too long, commonly referred to as prolonged or continuous wakefulness. Being awake continuously for more than 22 hours is typically considered the point at which fatigue causes almost all aspects of human performance, in all individuals, to decline. Uncontrollable brief episodes of sleep, commonly known as "microsleeps" (short periods of sleep lasting 3 to 4 seconds) and "state instability" (because wakefulness cannot be maintained) begin to occur in most individuals after this amount of wakefulness.^{Footnote 27}

The time of day at which a period of continuous wakefulness occurs will also contribute to the severity of its effects on performance. Many years of evolution have anchored human biology with sleep at night and wakefulness during the day, and studies^{Footnote 28} have shown that sleepiness is most profound in the early morning hours. This means that the biological drive for sleep during the night hours is much stronger than during the day hours. It also means that fatigue will result from fewer hours of continuous wakefulness if these hours occur at night rather than if they occur during the day.

The accident occurred at 0516:18 on 29 November 2016. At the time of the accident, the crew members had been awake (excluding the LE's afternoon nap) for approximately 19.5 hours. At the time when the crew moved the train on 29 November (0947), and excluding the nap for the LE, the crew members had been awake for approximately 24 hours.

1.16 Safety management systems

On 01 April 2015, the Railway Safety Management System Regulations, 2015 (the SMS Regulations) came into force, replacing the 2001 SMS Regulations. Under these regulations, federally regulated railway companies must develop and implement a safety management system (SMS), create an index of all required processes, keep records, notify the Minister of proposed changes to their operations, and file SMS documentation with the Minister when requested.

Section 10 of the SMS Regulations requires railways to have a process for ensuring compliance with regulations, rules and other instruments. This would include a process to meet regulatory requirements for reporting as set forth in regulations, rules and other instruments that apply to the railway. Section 10 of the SMS Regulations states (in part):

10 (1) A railway company must include, in its safety management system, a list of the following instruments relating to railway safety:

1. any regulations made under the Act that apply to the railway company and that are in force;
2. any engineering standards approved by the Minister under section 7 of the Act or established by the Minister under subsection 19(7) of the Act that apply to the railway company and that are in effect;
3. any rules approved or established by the Minister under section 19 of the Act that apply to the railway company and that are in force;
4. any exemptions granted under section 22 or 22.1 of the Act that apply to the railway company and that are in effect;
5. any notices sent to the railway company under section 31 of the Act that contain an order and that are in effect; and
6. any documents in effect by which the Minister has ordered the railway company to do or to not do something, including a ministerial order issued under section 32 of the Act and an emergency directive sent under section 33 of the Act.

11 A railway company must include, in its safety management system, a procedure for

1. reviewing and updating the list of instruments referred to in subsection 10(1); and
2. verifying compliance with
   1. the requirements of the regulations, engineering standards, rules, and notices and documents containing an order, that are referred to in the list of instruments, and
   2. the terms of the exemptions referred to in the list of instruments.^{Footnote 29}

CP maintains a list of the instruments and has a procedure in place for verifying compliance with those instruments. It also has a process in place for reporting under the Work/Rest Rules for Railway Operating Employees.

1.17 Locomotive voice and video recorders

In January 1999, a VIA Rail Canada Inc. (VIA) passenger train, travelling at 97 mph, passed a stop signal near Trenton, Ontario (TSB Railway Investigation Report R99T0017). Following an emergency brake application, the train came to a stop. There were no injuries to passengers or crew members. The investigation determined that the crew members had been engaged in conversations just before the occurrence. This distraction had likely contributed to the incident. Had the controlling locomotive cab been equipped with a voice recorder, it may have been possible to determine more definitively the effectiveness of the crew's communications as they approached the occurrence location. In July 2003, the TSB recommended that

In February 2012, a VIA passenger train entered a crossover near Burlington, Ontario, while travelling at about 67 mph (TSB Railway Investigation Report R12T0038). The crossover had an authorized speed of 15 mph. The locomotive and all 5 passenger coach cars derailed. The operating crew members were fatally injured, and 45 people sustained various injuries. The investigation report stated that, in the absence of voice and video recorders, it was difficult to identify with certainty the human factors that had contributed to the inappropriate crew response to the signal indications displayed. In addition, the dynamics and interaction between the 3 operating crew members could not be accurately determined. In June 2013, the TSB recommended that

In March 2017, the Board assessed TC's responses to recommendations R03-02 and R13-02 as follows:

This recommendation is related to the TSB Watchlist issue of "On-board voice and video recorders". Without a requirement for on-board voice and video recorders on locomotives, key information to advance railway safety may not always be available. [...]

In September 2016, the Transportation Safety Board released its safety study report on LVVR [locomotive voice and video recorders]. This safety study, which included participation from TC and key rail stakeholders (i.e., railways and unions), identified some best practices, identified and evaluated implementation issues, examined potential safety benefits of the expanded use of on-board recorders, and collected background information for the development of an action plan to implement LVVR. The report also highlighted that LVVR could support proactive safety management by railway companies, as well as post-accident investigations.

On 03 November 2016, the Minister of Transport publicly announced a commitment to mandate in Canada the installation and use of voice and video recorders in locomotive cabs. Following this announcement, TC is developing legislation and regulations to not only require installation and use of this technology for proactive safety management, but to protect the privacy of employees to the extent possible.

The Board considers the response to the recommendation to have Satisfactory Intent.

Other TSB investigation reports have reiterated the above recommendations.^{Footnote 30}

The results of these investigations suggest that the use of LVVRs is the only objective and reliable method to more definitively determine the influence of human factors—such as employee communications, distractions, fatigue, and training—on a railway occurrence. When causal links and related safety deficiencies can be confirmed, any resulting recommendations can be better tailored to address the underlying issues and to maximize rail safety improvements.

The TSB's Railway Safety Issues Investigation Report R16H0002, Expanding the use of locomotive voice and video recorders in Canada, published in September 2016, determined that there was no disagreement that LVVRs can lead to safety benefits. However, stakeholders had differences of opinion about appropriately using on‑board recordings while protecting the rights and obligations of all involved. Once these differing perspectives are reconciled, implementation of this technology will result in considerable safety benefits to the railway industry.

On 16 May 2017, the Minister of Transport introduced a bill in the House of Commons proposing amendments to the Railway Safety Act and the Canadian Transportation Accident Investigation and Safety Board Act to begin the process of installing LVVRs in the cabs of lead locomotives.

1.18 TSB railway investigation R16W0074 and Board safety concern

On 27 March 2016, at about 0235 Central Standard Time, while switching in Sutherland Yard in Saskatoon, Saskatchewan, Canadian Pacific Railway 2300 remote control locomotive system training yard assignment was shoving a cut of cars into track F6. As the assignment was brought to a stop, empty covered hopper car EFCX 604991 uncoupled from the train, unnoticed by the crew. The car rolled uncontrolled through the yard and onto the main track within cautionary limits of the Sutherland Subdivision. The car travelled about 1 mile and over 2 public automated crossings before coming to a rest on its own. There were no injuries and no derailment. No dangerous goods were involved.

The investigation determined that despite TC and industry initiatives, the desired outcome of significantly reducing the number of uncontrolled movements has not yet been achieved. Consequently, the Board was concerned that the current defences are not sufficient to reduce the number of uncontrolled movements and improve safety.

1.19 TSB occurrence statistics involving unplanned/uncontrolled movements

From 2008 to 2017, there were 541 occurrences^{Footnote 31} reported to the TSB related to unplanned/uncontrolled movements among all railways in Canada (Table 3).

Uncontrolled movements generally fall into 1 of 3 causal categories:

1. Loss of control – When available air brakes or locomotive systems are unable to hold a train left standing while attended or when an LE or a Beltpack operator cannot control a train when using the available air brakes.
2. Switching with no air – When a movement is switching with only the use of the locomotive air brakes (i.e., no air brakes are available on the cars being switched). When an uncontrolled movement occurs, these situations can result in the cars exiting a yard, siding or customer track and entering onto the main track.
3. Securement - When a car, a cut of cars or a train is left unattended and begins to roll away uncontrolled, usually due to
   • no hand brake applied or insufficient number of hand brakes applied; and/or
   • a car (or cars) is equipped with faulty or ineffective hand brakes; and/or
   • the train air brakes release for various reasons.

Table 4 provides a breakdown of the occurrences by consequences.

* Originated on the main track, moved onto the main track, or fouled the main track.

Of the 541 occurrences:

• Loss of control, as was the case in this occurrence, was the primary factor in 21 (4%) of the occurrences.
• Switching without air was the primary factor in 175 (32%) of the occurrences.
• Insufficient securement was the primary factor in 345 (64%) of the occurrences.
• There were 302 unplanned/uncontrolled movements (56%) that resulted in a collision.
• There were 61 unplanned/uncontrolled movements (11%) that affected the main track.

Of the 21 unplanned/uncontrolled movements that involved loss of control, as in this occurrence, 14 of them affected the main track..

Since 1994, the TSB has investigated 28 other occurrences that involved uncontrolled movements (Appendix B). The most significant of these occurrences was the 2013 Lac-Mégantic accident. Five of the investigations^{Footnote 32} involved loss of control of an attended train that affected the main track.

1.20 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Safety management and oversight is a Watchlist 2016 issue. A railway must have a process for ensuring compliance with regulations and rules and, as this occurrence shows, CP did not file the appropriate report to meet regulatory requirements.

On-board voice and video recorders is a Watchlist 2016 issue. Valuable data are going unrecorded, hindering the progress of TSB safety investigations and affecting the capability of railways to improve safety management systems.

Fatigue management systems for train crews are a Watchlist 2016 issue. Fatigue continues to pose a risk to the safe operation of trains, particularly freight trains, which move 70% of the country's surface goods. The initiatives taken to date have been inadequate to fully address the issue.

2.0 Analysis

The track infrastructure was in good condition and did not play a role in this occurrence. The analysis will focus on the actions of the locomotive engineer; use of the automatic brake handle locking pin; in-cab audio testing for automatic air brake repressurization; conditioning of the locomotive independent brake and other factors that contributed to the uncontrolled movement; the effectiveness of locomotive reset safety control for roll-away protection; the risk of uncontrolled movements entering main track; passing train inspections; crew fatigue; safety management systems; and statistics on unplanned/uncontrolled movements.

2.1 The accident

The accident occurred when train BAL-27 rolled uncontrolled southward from the siding at a speed of less than 1 mph and collided with northbound train 293-28, which was stationary on the main track.

Train BAL-27 approached the north siding switch at Estevan using primarily the automatic brakes with some light independent brakes when it came to a stop. Once the north siding switch was lined, the train entered the siding. While proceeding through the siding, the locomotive engineer (LE) continued to use a combination of automatic brakes and light independent brakes to control the speed of the train and to stop near the fouling point, just clear of the main track at the south siding switch. Once train BAL-27 was stopped, both the automatic and independent brakes were fully applied.

While the crew of train BAL-27 waited for the arrival of train 293-28, the conductor exited the cab to clean the south siding switch of snow while the LE stayed in the locomotive cab. When the BAL-27 crew heard the approaching train 293-28 crew radio broadcast, the conductor took a position on the ground west of the main track, and the LE exited the cab and took a position on the ground east of both tracks, in preparation for the passing train inspection.

During the passing train inspection of train 293 and as it was still moving, the LE from train BAL-27 left the position on the ground to return to the locomotive cab of train BAL-27 for personal reasons. While in the cab, as the LE moved between the locomotive control stand and the LE seat to retrieve a paper towel from the locomotive console, the LE inadvertently moved the automatic brake handle to the release position.

2.2Locking pin for automatic brake handle

The automatic brake handle arrangement is equipped with 2 holes in the base of the handle and a locking pin that is attached to the control stand with a length of cable. When the locking pin is inserted into the hole on the left side of the base of the handle (the "full set" position), the handle cannot be moved to the release position. Similarly, when the locking pin is inserted into the hole on the right side of the handle (the "handle off" position), the automatic brakes cannot be applied.

This feature is intended for use when a locomotive is being used in a trailing position. While the automatic brake handle locking pin is used to lock the handle in the handle off position to ensure that the brakes are not inadvertently applied on a trailing locomotive, using the pin when a train is left standing with the automatic brake in the full set position could also prevent the automatic brake from being inadvertently released.

2.3 Automatic air brake repressurization

When automatic air brakes are released, the brake pipe is repressurized with air from valves located under the floor of the locomotive cab. For some locomotive types, the LE positioned at the control stand in the locomotive cab can hear the repressurization during the release.

The human ear can only detect signals in the 2.5 kHz to 3 kHz range with a signal-to-noise ratio (SNR) of 6.5 dB. To detect a signal, it has to be at least 6.5 dB higher than the background noise at that frequency. Full alerting to a signal would typically require a SNR of 9 dB to 10 dB above the detection threshold. Therefore, in order for someone to be able to hear the sound and recognize that they should be alerted by it, the sound needs to be at least 15 dB above the background noise.

During audio testing involving GP20C-ECO locomotives, it was noted that the repressurization of the automatic air brake was quiet (i.e., about 1 dB above the background noise level), but discernable under the test conditions.

However, there were other factors that could have further limited the ability for the LE to hear the repressurization of the automatic air brake, including:

• air venting to atmosphere during an automatic brake application, which recorded a SNR of 4 dB;
• release of air through the automatic drain valve, which recorded a SNR of 18 dB; and
• the hooded sweatshirt that the LE was wearing at the time of the occurrence, which could have acted as a filter and further masked the sound of the automatic air brake repressurizing.

Given these circumstances, it is unlikely that the LE heard the repressurization of the automatic air brake. As the automatic air brake repressurization was not audible to the LE, he exited the cab unaware that the automatic air brakes had been released.

2.4 Independent brakes on locomotive CP 2275

Once the automatic brakes of train BAL-27 released, the independent brakes on locomotive CP 2275 alone were not able to hold the train. About 2 minutes later, train BAL-27 began to move forward (south). Upon recognizing that train BAL-27 was moving, the LE immediately returned to the locomotive cab and initiated an emergency brake application. At that time, the train was moving at about 1 mph and was about 10 feet from train 293. Given the delay in detecting the movement of train BAL-27, there was insufficient time and distance for the emergency brakes to stop the uncontrolled movement before it collided with train 293, about 7 seconds after the LE initiated an emergency brake application.

Based on braking force calculations, a braking effort of about 3600 pounds of retardation force would have been required to hold an 1800-ton train in the siding. The TSB conducted tests to assess the independent braking force of locomotive CP 2275. At the time of manufacture, the locomotive was required to generate a net braking ratio of 27%. The testing concluded that the independent brakes on locomotive CP 2275 met specifications with a total braking force of 75 920 pounds and a net braking ratio of 27.5%.

To translate braking force to retardation force, the average COF of 30% for dry high-friction composition locomotive brake shoes must be used to calculate the retardation force available. Under dry conditions, and considering the COF of the locomotive brake shoe, the retardation force available on locomotive CP 2275 with the independent brakes fully applied was 22 776 pounds, which exceeded the 3600 pounds of retardation force required to hold a 1800-ton train on a 0.1% descending grade.

2.5 Other factors that contributed to the uncontrolled movement

Since a retardation force of about 3600 pounds was required to hold an 1800-ton train in dry conditions and the independent brake of locomotive CP 2275 produced an actual retardation force of 22 776 pounds, additional factors contributed to the uncontrolled movement.

2.5.1 Train weight

The train BAL-27 open-top hopper ballast cars had been used to dump ballast the previous week near Moose Jaw. At that time, the weather at Moose Jaw included 3 days of freezing rain and wet snow, with temperatures between 3 °C and −10 °C. Under these weather conditions, it is not uncommon for ballast in open-top hopper cars to freeze, making it difficult to completely empty the cars during unloading.

At the time of the occurrence, many of the hopper cars still contained ballast, with some cars remaining more than half full. As a result, train BAL-27 was much heavier than the 1800 tons indicated on the train consist. The reported weight of the train was 2868 tons. Although the weight of train BAL-27 was listed at 1800 tons, frozen ballast had remained in many of the cars, resulting in the train being heavier, with a weight of 2868 tons.

2.5.2 Coefficient of friction of brake shoes

For a weight of 2868 tons, a braking effort of more than 5750 pounds of retardation force would have been required to hold that train on the 0.1% descending grade. Since the estimated retardation force available on locomotive CP 2275 with the independent brakes fully applied was 22 776 pounds, the independent brakes should have still been able to hold train BAL-27 in the siding unless the brake shoe COF was further reduced due to environmental conditions.

The COF of dry high-friction composition brake shoes is about 30%. When taking into account the calculated increased weight of the train, the siding track profile, and the revised calculated retardation force of 5750 pounds, the effective COF for the brake shoes of locomotive CP 2275 would have been no more than 7.5% in order to allow the train to move. Due to ice and snow buildup on the locomotive brakes and the train weight of 2868 tons, the effective COF on the locomotive independent brake shoes had been reduced to no more than 7.5%.

During winter operations, it is not uncommon for the train brake shoe COF to decrease because of snow and ice accumulation on the brake shoes. LEs will often condition the automatic train brakes in advance of slowing or stopping to ensure effective braking, by making light brake applications to warm the brake components and rid them of ice and snow.

In this occurrence, the LE used the independent brakes for a total of 29 seconds at slow speeds while coming to a stop at both the north siding switch and the south siding switch. Although the LE on train BAL-27 made light independent brake applications while pulling into the siding, the brake shoe conditioning to remove ice and snow from the brake components was insufficient to ensure that the locomotive brake shoes had an adequate COF to produce the retardation force necessary to hold the train in the siding.

2.6 Reset safety control equipped with roll-away protection

The reset safety control (RSC) is a vigilance system that activates alarms and then initiates a penalty brake application of the automatic brakes if it is not reset by the LE or the controls are not being manipulated within a predetermined time interval. Some RSCs have been upgraded to include roll-away protection that will initiate a penalty brake application in accordance with Transport Canada (TC)–approved Railway Locomotive Inspection and Safety Rules. The rules state that a controlling locomotive equipped with a safety control system with roll-away protection must meet the requirements of the most current Association of American Railroads (AAR) Manual of Standards and Recommended Practices Standard S-5513 (S-5513).

The RSC roll-away protection should start the safety control system warning timing cycle and subsequently initiate a penalty brake application of the train air brakes if the locomotive brake cylinder pressure falls below 25 psi or speed is detected. However, once the activation speed is attained, it can take up to an additional 30 seconds for the penalty brakes to activate.

The activation speed for RSC roll-away protection on locomotives is not defined within the Transport Canada–approved Railway Locomotive Inspection and Safety Rules or within the AAR standards. Consequently, as identified by Canadian railways' submissions to TC in response to ministerial order (MO) 16‑07, the activation speed is not consistently applied by railways in Canada, ranging from 0 to 2.5 mph with a commensurate variability in activation timing and stopping distances.

The RSC activation speed for locomotive CP 2275 was set for 2.5 mph. Since the uncontrolled movement only reached a speed of about 1 mph, the RSC roll-away protection did not activate. In addition, TSB testing on other locomotives determined that, when the locomotive air brake cylinder pressure dropped below 25 psi, the RSC roll-away protection timing sequence initiated, but under certain conditions, the penalty brakes did not activate due to low brake pipe air pressure and air leakage.

The TSB has previously stated that physical defences for train securement should not depend on air brake systems due to their lack of reliability. Specifically, air brakes are known to leak, and the rate of leakage is unpredictable. Despite the known issues with using air brakes for train securement, TC approved a revised CROR Rule 112 "Leaving Equipment Unattended," which came into effect on 15 October 2015. The revised rule listed an RSC system with roll-away protection as an acceptable secondary method of securement for leaving equipment unattended.

Calculations have demonstrated that, due to the variation in activation speeds and the timing of the penalty brake application that can extend up to 30 seconds, an uncontrolled movement can travel some distance even with the intervention of the RSC roll-away protection. Furthermore, if there is an uncontrolled movement due to air brake leakage that results in the RSC roll-away protection being activated with a penalty brake application, and the air leakage continues, there may not be enough air in the system to activate the RSC roll-away protection a second time. If locomotive RSC systems equipped with roll-away protection are used as a secondary protection, there is a risk they may not prevent uncontrolled movements.

In this accident, the LE was close enough to the locomotive to take action if the train should start to move. Therefore, train BAL-27 was attended and did not need to be secured with hand brakes and a secondary method of physical securement as per Canadian Rail Operating Rules (CROR) Rule 112.

2.6.1 Reset safety control roll-away protection activation speed

Neither the TC-approved Railway Locomotive Inspection and Safety Rules nor the AAR Manual of Standards and Recommended Practices define the speed at which the roll-away protection feature of an RSC must activate. For an RSC, after a timing cycle of 10 seconds, the normal sequence of visual and audible alarms can take an additional 20 seconds prior to a penalty brake application (i.e., a total of 30 seconds). If the air brake pressure remains higher than 25 psi, the total 30-second penalty brake application cycle will not begin until the activation speed is attained.

There was a perception amongst the regulator and some railways that roll-away protection activation speed was about 0.5 mph for most locomotives. However, based on the railways' responses to MO 16-07, only 31% of the locomotives equipped with RSC roll-away protection being used as a secondary method of securement in Canada recorded an RSC activation speed of 0.5 mph or below. The remaining 69% of the locomotives recorded an RSC roll-away protection activation speed between 1 mph and 2.5 mph.

Calculations determined that an uncontrolled movement could travel beyond the fouling point of a main track with each speed increment having a significant effect on the stopping distance required. Since RSC roll-away protection activation speed is not defined in regulations or rules, even speeds that exceed 2.5 mph could still meet requirements provided that the activation sequence does not exceed 30 seconds. In accordance with CROR Rule 112, railways in Canada are permitted to use the RSC with roll-away protection as a secondary method of train securement for an unattended train, regardless of its activation speed. This occurrence highlights a deficiency that could compromise the intent of CROR Rule 112 when an RSC with roll-away protection is used as a secondary method of securement for unattended equipment.

2.7 Risk of uncontrolled movements entering the main track

With an RSC activation speed of 2.5 mph and an activation time of up to 30 seconds, a train similar to BAL-27 could travel up to 1200 feet on a 0.1% descending grade before the roll-away protection system would activate a penalty brake application. These calculations do not include the stopping distance required once the penalty brake application occurs. Under conditions similar to the occurrence, if a single main track is unoccupied and an emergency brake application is not made, a train similar to train BAL-27 could travel up to 1100 feet onto the main track before the roll-away protection system would activate a penalty brake application. When the main track is in non-signalled occupancy control system territory, there are no signal indications to warn approaching trains when another train enters the single main track. If uncontrolled movements can enter the main track undetected, approaching trains or movements may not be warned in a timely manner, increasing the risk of collisions.

2.8 Passing train inspections

CROR Rule 110 requires, when duties and terrain permit, that at least 2 crew members of a standing train position themselves on the ground on both sides of the track to inspect the condition of the equipment on passing trains. From a position on the ground, train crew members have a better vantage point to observe rolling stock condition and to detect any safety defects that may be present.

In this occurrence, the LE left the position on the ground (i.e., the east of the main track) to return to the CP 2275 locomotive cab for personal reasons while train 293 was still moving. The passing train inspection of the east side of train 293 was not completed.

2.9 Risk of fatigue

According to the Work/Rest Rules for Railway Operating Employees (the work/rest rules), the maximum continuous on-duty time for a single tour of duty operating in any class of service is 12 hours. The occurrence crew was on duty at 2030 on 28 November 2017 and the accident occurred almost 9 hours later, at about 0516 on 29 November 2017.

Although CP did not declare an emergency situation following the occurrence, the crew remained on site in an operational capacity and completed the reverse movement to separate the trains. At about 0930 on 29 November 2017, the crew secured train BAL-27 in the siding at Estevan. Upon completing the reverse movement and securing the train in the siding, the crew members of train BAL-27 had been on duty for about 13 hours, which exceeded the maximum on-duty time of 12 hours as specified in the work/rest rules.

At the time of the accident, the conductor had been awake for about 19.5 hours. Depending on the quality of the LE's afternoon nap, the LE was potentially awake for the same length of time. By the time the crew had secured the train on 29 November 2016 (0930), the crew members had potentially been awake for about 24 hours. This is longer than the 22 hours considered to be the point at which fatigue causes almost all aspects of human performance to decline. Although both crew members were fatigued, it could not be determined if any significant performance decrements had occurred. Notwithstanding, if train crew members remain on duty after an extended period of wakefulness, there is a risk that the performance of cognitive tasks could be adversely affected.

2.10 Safety management systems

Section 10 of the Railway Safety Management System Regulations, 2015 (the SMS Regulations) requires railways to have a process for ensuring compliance with regulations, rules and other instruments. This would include a process to meet regulatory requirements for reporting as set forth in regulations, rules and other instruments that apply to the railway.

2.10.1 Requirements for regulatory reporting

The SMS Regulations require railways to have a process in place to meet regulatory requirements for reporting as set forth in regulations and rules such as the work/rest rules.

At the time of the occurrence, CP did not consider the occurrence to be an emergency situation and therefore did not submit a report to TC stating that the BAL-27 crew had operated in excess of the maximum duty time (12 hours), as required by Section 7 of the work/rest rules. However, on 28 June 2017, in response to a TC request for information, CP stated that it believed that this occurrence had been an emergency situation. Despite CP's determining that this occurrence was an emergency situation, a report was not submitted to TC stating that the crew of train BAL-27 had had to work for longer than the maximum duty time.

2.11 CP testing of GP20C-ECO and SD30C-ECO locomotives

Since 2009, most new and remanufactured EMD locomotives have been equipped with the Functionally Integrated Railroad Electronics (FIRE) system, which is standardized locomotive integration software. The roll-away protection activation speed of the FIRE system on EMD locomotives was programmed at the manufacturer to be at 2.5 mph. However, the EMD standard sales specification for the CP purchase listed the activation speed of an RSC with roll-away protection at 0.5 mph.

When purchasing locomotives, CP inspects and tests a sampling of the locomotives upon delivery. The RSC was tested by releasing the brakes and performing time-out tests with the locomotive stopped during the brake system test. During acceptance testing, CP did not test the RSC roll-away protection activation speed.

In May 2016, CP and EMD tested the RSC on CP locomotives equipped with the FIRE system to verify that the roll-away protection activated as per the AAR standards and to confirm the roll-away protection activation speed. The tests determined that roll-away protection activated at 2.5 mph and/or when the independent brake pressure fell below 25 psi. The roll-away protection activation warning time was confirmed to be about 25 seconds. No modifications to the activation speed or timing were made following the tests. Although CP identified that the RSC activation speed of 2.5 mph did not meet the purchase specification of 0.5 mph, CP did not consider this discrepancy to be a safety concern, so no further action was taken, and CP continued to use the RSC with roll-away protection as a secondary method of securement.

2.12 Locomotive voice and video recorders

In this occurrence, while the investigation concluded that the automatic brake handle was inadvertently released by the LE, the actual events could not be determined with certainty.

The use of locomotive voice and video recorders (LVVRs) is an objective and reliable method of more definitively determining the role that human factors play in a railway occurrence. When causal links and related safety deficiencies can be confirmed, the resulting findings and any recommendations can be better tailored to address the underlying issues and maximize rail safety improvements. This also results in the timely communication of safety deficiencies.

If locomotive in‑cab voice and video recorders are not installed on lead locomotives, there is a risk that valuable information that can lead to the identification and elimination of safety deficiencies will continue to be unavailable.

2.13 Statistics on unplanned/uncontrolled movements

In this occurrence, train BAL-27 experienced a loss of control that resulted in an unplanned/uncontrolled movement which fouled the main track and collided with train 293. From 2008 to 2017, there have been 541 occurrences reported to the TSB related to unplanned/uncontrolled movements among all railways in Canada.

Of the 541 occurrences, loss of control (similar to this occurrence) was the primary factor in 21 (4%) of the occurrences, of which 14 affected the main track. While the number of occurrences involving uncontrolled movements decreased to 51 in 2016, it increased to 62 in 2017. The five-year average (2013–2017) was 59.8 versus the ten-year average (2008–2017) of 54.1.

The number of occurrences involving uncontrolled movements (i.e., runaway rolling stock) increased by about 10% in the past 5 years, as compared to the 10-year average.

3.0 Findings

3.1 Findings as to causes and contributing factors

1. The accident occurred when train BAL-27 rolled uncontrolled southward from the siding at a speed of less than 1 mph and collided with northbound train 293-28, which was stationary on the main track.
2. During the passing train inspection of train 293-28 and as it was still moving, the locomotive engineer from train BAL-27 left the position on the ground to return to the locomotive cab of train BAL-27 for personal reasons.
3. While in the cab, as the locomotive engineer (LE) moved between the locomotive control stand and the LE seat to retrieve a paper towel from the locomotive console, the LE inadvertently moved the automatic brake handle to the release position.
4. As the automatic air brake repressurization was not audible to the locomotive engineer, he exited the cab unaware that the automatic air brakes had been released.
5. Given the delay in detecting the movement of train BAL-27, there was insufficient time and distance for the emergency brakes to stop the uncontrolled movement before it collided with train 293, about 7 seconds after the LE initiated an emergency brake application.
6. Although the weight for train BAL-27 was listed at 1800 tons, frozen ballast had remained in many of the cars, resulting in the train being heavier, with a reported weight of 2868 tons.
7. Due to ice and snow buildup on the locomotive brakes and the train weight of 2868 tons, the effective coefficient of friction on the locomotive independent brake shoes had been reduced to no more than 7.5%.
8. Although the locomotive engineer on train BAL-27 made light independent brake applications while pulling into the siding, the brake shoe conditioning to remove ice and snow from the brake components was insufficient to ensure that the brake shoes had an adequate coefficient of friction to produce the retardation force necessary to hold the train in the siding.

3.2 Findings as to risk

1. If locomotive RSC systems equipped with roll-away protection are used as a secondary protection, there is a risk they may not prevent uncontrolled movements.
2. If uncontrolled movements can enter the main track undetected, approaching trains or movements may not be warned in a timely manner, increasing the risk of collisions.
3. If train crew members remain on duty after an extended period of wakefulness, there is a risk that the performance of cognitive tasks could be adversely affected.
4. If locomotive in‑cab voice and video recorders are not installed on lead locomotives, there is a risk that valuable information that can lead to the identification and elimination of safety deficiencies will continue to be unavailable.

3.3. Other findings

1. The independent brakes on locomotive CP 2275 met specifications with a total braking force of 75 920 pounds and a net braking ratio of 27.5%.
2. The activation speed for reset safety control roll-away protection on locomotives, which is not defined within the Transport Canada–approved Railway Locomotive Inspection and Safety Rules or within the Association of American Railroads standards, is not consistently applied by railways in Canada, ranging from 0 to 2.5 mph with a commensurate variability in activation timing and stopping distances.
3. Upon completing the reverse movement and securing the train in the siding, the crew members of train BAL-27 had been on-duty for about 13 hours, which exceeded the maximum on-duty time of 12 hours as specified in the Transport Canada–approved Work/Rest Rules for Railway Operating Employees.
4. Despite being identified as an emergency situation by Canadian Pacific Railway, a report was not submitted to Transport Canada outlining that the crew of train BAL‑27 had to operate in excess of the maximum duty time.
5. The number of occurrences involving uncontrolled movements (i.e., runaway rolling stock) increased by about 10% in the past 5 years, as compared to the 10-year average.

4.0 Safety action

4.1 Safety action taken

4.1.1 Transportation Safety Board of Canada

On 20 December 2016, the TSB issued Rail Safety Advisory (RSA) 16/16 relating to the roll-away protection activation of the reset safety control (RSC) device on some Canadian Pacific Railway (CP) locomotives.

4.1.2 Transport Canada

On 14 December 2016, Transport Canada (TC) issued CP a letter of non-compliance to rules 114(a), 114(b), and 304.1 of the Canadian Rail Operating Rules (CROR). In response, CP committed to increase efficiency testing on fouling tracks and to perform dynamic testing on the Weyburn Subdivision for train meets. CP also committed to observe compliance based on train handling, speed, and compliance with all other CROR and General Operating Instructions.

On 22 December 2016, in response to RSA 16/16, TC issued a ministerial order (MO 16-07). The accompanying letter to MO 16-07 ordered federally regulated railway companies to file the following with the Minister of Transport:

1. A list of locomotive models in service that are equipped with reset safety control roll-away protection and the design specifications of the system by January 23, 2017; and
2. Within 30 days of any testing done as per item 2 of MO 16-07, the result of the testing along with the process and procedure followed to ensure that the system functions in accordance with its design specifications.

4.1.3 Railway Association of Canada

Member railways have set up a working group to proactively review the current roll-away protection rule and will further examine and explore areas where safety improvements can be made.

4.1.4 Canadian Pacific Railway

Following the occurrence, CP determined that the roll-away protection feature on the locomotive of train BAL-27 did not operate in accordance with manufacturer's specification.

On 19 December 2016, CP issued a System Bulletin (CPSB-057-16) to all operating employees. The bulletin indicated that, until further notice, the RSC with roll-away protection feature on all EMD GP20C-ECO (2200/2300 series locomotives) and SD30C-ECO (5000 series locomotives) is not to be used as a physical securement or mechanical device as outlined in CROR Rule 112 and CP's General Operating Instructions, Section 4.

On 13 January 2017, CP issued System Bulletin CPSB-002-17, identifying 5 additional series of locomotives^{Footnote 33} that cannot be used as physical securement or mechanical device as outlined in CROR Rule 112 and CP's General Operating Instructions, Section 4.

CP is taking part in a working group to review the RSC roll-away protection requirements.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. the Board authorized the release of this report on 28 February 2018. It was officially released on 29 March 2018.

Appendices

Appendix A – TSB investigations involving uncontrolled movements