Rail transportation safety investigation report R21H0114

Executive Summary

The accident

On 02 September 2021 at about 1028,^{Footnote 1} Canadian National Railway Company (CN) intermodal train Z14921-02 (train 149) was proceeding westward on the north main track of the Kingston Subdivision where a hand-operated switch provides access to an industrial spur track in the town of Prescott, Ontario.

Train 149 was to pass by the switch and continue on the north main track to Toronto, Ontario. However, having received permission from the rail traffic controller (RTC) to enter the north main track in accordance with Rule 568 of the Canadian Rail Operating Rules (CROR), the crew of CN train L53231-02 (train 532), an industrial switching assignment, had reversed the switch to track KE01 of the industrial spur.

The RTC did not obtain the required location report from the crew on train 149. Therefore, he did not know the train’s exact location in relation to the switch. When the RTC received the request from train 532 to enter the north main track, he developed a mental model that train 149 had already gone by the switch and he therefore issued the CROR Rule 568 permission to train 532. At that time, the RTC’s workload was complex, and his attention was diverted to other competing tasks.

Approaching the switch, the crew members on train 149 realized that it was lined against them and placed the train into emergency, but the train was unable to stop. Train 149 entered the spur track where it collided head-on with train 532 at approximately 37 mph.

As a result of the collision, the 4 locomotives (2 on each train) derailed and sustained significant impact damage. The fuel tank on the lead locomotive of train 149 was punctured and released diesel fuel, but the fuel did not ignite. Fourteen intermodal car bodies loaded with double-stack containers also derailed along with 2 stationary cars on the spur track. There was significant damage to the north main track, the south main track, and 2 of the tracks in the industrial spur; in total, approximately 1000 feet of track was destroyed.

Two crew members sustained minor injuries, and 1 crew member was admitted to hospital with serious injuries.

Results of mandatory post-accident alcohol testing of the rail traffic controller

Under CN’s Policy to Prevent Workplace Alcohol and Drug Problems, employees have to submit to mandatory breath alcohol testing following an accident. About 2 hours after the accident, the RTC submitted to the mandatory breath alcohol test, which was conducted by DriverCheck Inc., a third-party provider of workplace medical testing and assessments. A breath alcohol test indicated a breath alcohol concentration (BrAC) of 0.023 g/210L. Seventeen minutes later, a confirmation breath alcohol test was completed and indicated a BrAC of 0.019 g/210L. The results were reviewed by the chief medical review officer of DriverCheck Inc, who indicated that the RTC’s extrapolated blood alcohol concentration (BAC) was estimated to have ranged from 0.064% to 0.109% at the start of his shift, and from 0.044% to 0.069% at the time of the accident. The report produced by the chief medical review officer indicated that the RTC was either drinking alcohol at the beginning of his shift or had significant alcohol intake the early morning of or the night before work.

The RTC’s performance and level of attention were likely affected by the persistent effects of alcohol consumption.

Safety concern

Consumption of alcohol before assuming safety-critical duties

Alcohol affects human performance due to its negative effects on psychomotor skills and cognitive functions such as decision making, attention, and reasoning. Alcohol has a particularly serious effect on information processing and working memory, and even relatively low doses of alcohol can lead to reduced performance. Although psychomotor skills recover when the BAC decreases, cognitive performance can still be negatively affected.

The Railway Safety Act and regulations made under the Act do not prescribe a time period prohibiting the consumption of alcohol before assuming duties. Therefore, individuals are expected to self-assess and determine if the effects of alcohol have sufficiently diminished to be fit for duty. As the BAC of individuals decreases, there is a risk that they may not accurately self-assess, and therefore could subjectively perceive that they have recovered despite the effects of alcohol on cognitive performance persisting. In comparison, the Canadian Aviation Regulations stipulate, in part, that no person shall act as a crew member of an aircraft within 12 hours after consuming an alcoholic beverage or as an air traffic controller or a flight service specialist within 8 hours after consuming alcohol. These time prohibition periods allow for the elimination of alcohol and, as such, they reduce the risk that a person will assume safety-critical duties while under its influence.

Alcohol impairment involving employees in safety-critical positions can have significant adverse outcomes, affecting the safety of crews, passengers, and the environment.

Therefore, given that no time period prohibiting the consumption of alcohol by railway employees in safety-critical positions in Canada is required, the Board is concerned that such employees could perform their duties while under the influence of alcohol.

1.0 Factual information

In the morning of 02 September 2021, Canadian National Railway Company (CN) intermodal train Z14921-02 (train 149) was travelling westward on the Kingston Subdivision, en route from Dorval, Quebec, to Toronto, Ontario. The train was powered by 2 head-end locomotives (CN 3046 and CN 3102) and was hauling 202 intermodal cars loaded with double-stack containers. It weighed 14 688 tons and measured 12 359 feet. Train 149 was operated by 2 CN crew members: a locomotive engineer (LE) and a conductor. Both crew members were qualified for their positions, were familiar with the territory, and met all fitness and rest requirements.

That same morning, CN industrial switching assignment L53231-02 (train 532) was in an industrial spur within the town of Prescott, Ontario, preparing to return to Brockville, Ontario. It consisted of 2 locomotives (CN 4799 and IC 9629) and was not handling any rail cars. It was operated by 3 CN crew members: an LE, a conductor, and an assistant conductor. All crew members were qualified for their positions, were familiar with the territory, and met all fitness and rest requirements.

The movements of both trains were dispatched by a CN rail traffic controller (RTC) located in Edmonton, Alberta. The RTC was controlling rail traffic, including VIA Rail Canada Inc. (VIA) passenger trains, on the Kingston Subdivision, from Dorval East, Quebec (Mile 10.3), to Lyn, Ontario (Mile 127.4), a segment that covers 117 miles of high-speed, multi-track territory.

1.1 The occurrence

The RTC came on duty at 0630 Mountain Daylight Time (MDT), or 0830 Eastern Daylight Time (EDT). At about 0947 EDT^{Footnote 2}, he called the crew members on train 532 by radio and asked them to clear the north main track for a freight train. The crew members agreed and said that they would be clear of the main track within the next 5 minutes. The RTC acknowledged this, mentioned a freight train at Crysler, Ontario,^{Footnote 3} approximately 30 miles east of Prescott, and indicated that they would talk again.

At about 1022, the RTC received a call from the crew of train 532 requesting a Rule 568 permission^{Footnote 4} to re-enter the north main track of the Kingston Subdivision at a hand-operated switch located at Mile 113.36. No train had passed Prescott on the north track between 0947 and 1022. The RTC initiated the process to issue the Rule 568 permission on his computer system. The software displayed a prompt indicating that another train, train 149, was “within limits,” which meant that the train was somewhere within the 14.7-mile controlled block^{Footnote 5} where the hand-operated switch was located. This prompt presented 2 options: Continue or Abort. The RTC opted to continue.

At about 1023, while he was issuing the permission, a process that took about 2.5 minutes, the RTC was simultaneously performing several other tasks: he acknowledged a visual prompt reminding him to order a crew for another train, he informed a crew that they would be held on account of an approaching VIA train, and he lined signals for a CN train and a VIA train. In the interval, train 149 passed by a hot box detector at Mile 110 (about 3.4 miles east of the hand-operated switch at Prescott), and a corresponding blue visual cue appeared on one of the RTC’s screens.^{Footnote 6} The RTC did not see this visual cue while his attention was focused on issuing the permission.

During the conversation with the RTC, the LE and the assistant conductor on train 532 were in the cab of locomotive CN 4799, which was oriented westward, while the cab of trailing locomotive IC 9629 faced eastward. The conductor was on the ground, near the hand-operated switch, listening on his handheld radio (Figure 1). The LE and assistant conductor copied and repeated the contents of the authority provided by the RTC. Once the authority was made complete, the conductor reversed the main-track hand-operated switch to line his train from spur track KE01 eastward onto the north main track. Having lined the main-track switch first, he then took up a position adjacent to the back-track switch.^{Footnote 7}

After the switch was reversed, the assistant conductor on train 532 observed a train approaching on the main track from the east. At about the same time, the crew of train 149, after passing Signal 1119N on a Clear indication, made a radio call to train 532 to ascertain train 532’s location. During the call, it was established that train 532 was in the spur track and train 149 was approaching on the north main track.

Realizing that train 149 had been lined to diverge into the spur track and that a collision was imminent, the conductor on train 532 tried to warn train 149. The assistant conductor then exited the cab in an attempt to reach a safe location while the LE remained in the cab. The conductor was still on the ground, but not close enough to the switch to restore it to the normal position^{Footnote 8} to avoid the collision.

The crew members on train 149, which was travelling westward on the north main track at about 42 mph, observed a red reflectorized switch target indicating that the main-track hand-operated switch at Mile 113.36 was in the reverse position, i.e., lined for their train to diverge into the spur track. They applied the train’s brakes in emergency approximately 970 feet east of the spur track switch, but the train was unable to stop. At 1028, the train diverged from the north main track onto the spur track and collided head-on with train 532 at a speed of 37 mph.

The collision occurred in the spur track, adjacent to the north main track at Mile 113.44, under the Edward Street bridge in Prescott (figures 2 and 3).

The 3 crew members from train 532 were transported to a hospital in Ottawa, Ontario. Two crew members were treated for minor injuries and released, and 1 crew member was admitted to hospital with serious injuries. Neither of the crew members on train 149 were injured.

As a result of the collision, the 4 locomotives (2 on each train) derailed and sustained significant impact damage. Fourteen intermodal car bodies loaded with double-stack containers also derailed. There was significant damage to the north main track, the south main track, and the KE01 and KE07 spur tracks between Mile 113.36 and Mile 113.55; in total, approximately 1000 feet of track was destroyed (Figure 4).

1.2 Site examination

The 2 locomotives on train 149 derailed and sustained significant impact damage. The fuel tank on the lead locomotive of train 149 punctured and released an undetermined amount of diesel fuel, but the fuel did not ignite. One of the 14 derailed intermodal car bodies came to rest within a few feet of a natural gas line adjacent to the track, near a residential area (Figure 5), but it did not strike it.

The force of the collision propelled the 2 locomotives on train 532 westward on the KE01 spur track where 9 cars were stationary; the subsequent impact derailed and damaged 2 of the stationary cars (empty covered hopper cars CBFX 471459 and CBFX 471554). The 2 locomotives derailed and came to rest on their sides north of the spur track; they also sustained significant impact damage.

The derailed rolling stock blocked both the north main track and the south main track on the Kingston Subdivision for approximately 24 hours.

1.3 Subdivision and track information

The Kingston Subdivision extends from Dorval East (Mile 10.3) to Toronto (Mile 333.80).

The subdivision is a key route^{Footnote 9} and a major high-speed rail traffic corridor in Canada. An average of 18 CN freight trains and 12 VIA passenger trains operate in the area daily.

Train movements in the area are governed by the centralized traffic control system (CTC) as authorized by the Canadian Rail Operating Rules (CROR).^{Footnote 10}

The track in the vicinity of the collision consists of multiple main tracks. It is Class 5 track according to the Rules Respecting Track Safety.^{Footnote 11} The maximum authorized speed in the area of the collision is 60 mph for freight trains and 80 mph for passenger trains.

When operating on the KE01 and associated spur tracks, movements are restricted to a maximum speed of 15 mph.

1.4 Alcohol testing

1.4.1 Canadian National Railway Company’s policy on alcohol

CN’s Policy to Prevent Workplace Alcohol and Drug Problems applies to everyone working at the company. The purpose of the policy is to prevent workplace alcohol and drug problems. The policy encourages employees who feel that they may have a problem with alcohol or drugs to seek help as they can get assistance through CN’s confidential Employee and Family Assistance Program.

The policy states a zero tolerance for impairment at work, and that all employees are required to report and remain fit for duty, free of the negative effects of alcohol, cannabis, and other drugs. According to the policy, it is strictly prohibited to be on duty or to be in control of a CN vehicle or equipment while under the influence of alcohol or other drugs, including the after-effects of such use.

Under the policy, employees have to submit to mandatory breath alcohol testing following an accident. A breath alcohol test provides a measure of breath alcohol concentration (BrAC) in grams (g) of alcohol per 210 litres (L) of breath. The BrAC correlates with blood alcohol concentration (BAC), which is a measure of milligrams (mg) of alcohol in 100 millilitres (mL) of blood. The Canadian Criminal Code establishes that a person is deemed to be impaired when operating a conveyance (i.e., a motor vehicle, a vessel, an aircraft, or railway equipment) with a BAC of 0.08% or more (80 milligrams of alcohol in 100 millilitres of blood^{Footnote 12}). Some provinces, under their respective highway traffic safety acts, have supplemental laws and administer penalties when a BAC is 0.05% or over.

Any employee whose post-accident test results indicate a BrAC over 0.04% and/or who tests positive for legal or illegal drugs (without medical justification) will be considered to be in violation of the CN policy.

BAC calculators are available online to provide an indication of BAC level. BAC breathalyzers can be purchased by individuals for self-assessment. These tools vary in degree of accuracy and depend on the individual for correct use.

The CROR’s general rules state, in part:

A Every employee in any service connected with movements, handling of main track switches and protection of track work and track units shall;

[…]

(x) when reporting for duty, be fit, rested and familiar with their duties and the territory over which they operate;

[…]

G

(i) The use of intoxicants or narcotics by employees subject to duty, or their possession or use while on duty, is prohibited.

[…]

(iv) Employees must know and understand the possible effects of drugs, medication or mood altering agents, including those prescribed by a doctor, which, in any way, will adversely affect their ability to work safely.^{Footnote 13}

The Railway Safety Act states, in part:

18 (1) The Governor in Council may make regulations

[…]

(b) declaring positions in railway companies to be critical to safe railway operations;

(c) respecting the following matters, to the extent that they relate to safe railway operations, in relation to persons employed in positions referred to in paragraph (b):

[…]

(iv) the control or prohibition of the consumption of alcoholic beverages and the use of drugs by those persons [….]^{Footnote 14}

The Railway Safety Act and regulations made under the Act do not prescribe a period of time prohibiting consumption of alcohol before assuming duties.

In comparison, the Canadian Aviation Regulations stipulate, in part, that no person shall act as a crew member of an aircraft within 12 hours after consuming an alcoholic beverage, or shall act as an air traffic controller or a flight service specialist within 8 hours after consuming alcohol.^{Footnote 15}

1.4.2 Results of mandatory post-accident alcohol test for the rail traffic controller

In accordance with CN’s Policy to Prevent Workplace Alcohol and Drug Problems, about 2 hours after the accident, the RTC submitted to the mandatory breath alcohol test, which was conducted by DriverCheck Inc., a third-party provider of workplace medical testing and assessments. A breath alcohol test completed at 1039^{Footnote 16} indicated a BrAC of 0.023 g/210L. Seventeen minutes later, a confirmation breath alcohol test was completed and indicated a BrAC of 0.019 g/210L.

These results were reviewed by the chief medical review officer of DriverCheck Inc. The physician’s report indicated the following:

• 95% of the population would have a range of elimination from 0.01 to 0.02% BAC/hour (10–20 mg/100 mL/hour).
• Based on the breath alcohol and confirmation tests, the RTC’s BAC elimination rate was estimated to be 0.014% BAC/hour.
• The RTC’s extrapolated BAC is estimated to have ranged from 0.064% to 0.109% at 0630 (the start of his shift),and from 0.044% to 0.069% at the time of the accident.
• With a BrAC of 0.019 g/210 L measured at 1056, almost 4.5 hours after reporting for duty, the RTC was either drinking alcohol at the beginning of his shift, or had significant alcohol intake the early morning or night before work.

1.4.3 Effects of alcohol on performance

Alcohol affects human performance due to its negative effects on psychomotor skills and cognitive functions such as decision making, attention, and reasoning. Alcohol has a particularly serious effect on information processing and working memory, and even relatively low doses of alcohol can lead to reduced performance.^{Footnote 17}

Although psychomotor skills recover when BAC declines, cognitive performance can still be negatively affected.^{Footnote 18} While BAC decreases, individuals are likely to subjectively perceive that they have recovered despite the effects of alcohol on cognitive performance persisting.^{Footnote 19}

Consumption of alcohol is linked to poor sleep quality and duration, and effects depend on several factors such as amount and rate of consumption, tolerance, age, gender, and medical and physiological conditions. Alcohol may help to fall asleep more quickly; however, it could later disrupt the sleep cycles and affect the next day’s daytime alertness.^{Footnote 20}

The cognitive and behavioural effects of alcohol at various BAC levels depend on individual factors, notably age, gender, weight, and tolerance. Table 1 lists potential effects of increasing BAC levels. The relatively wide ranges of BAC in the table highlights that effects can vary significantly because of individual differences and tolerance.

1.5 Permissions to enter a main track

1.5.1 Rule 568 of the Canadian Rail Operating Rules – Signal or Permission to Enter Main Track

When train movements must enter the main track, such movements require permission. Permission to enter a main track in CTC is governed by CROR Rule 568 (Signal or Permission to Enter Main Track), which states, in part:

1. A train or transfer must not foul or enter a main track, nor re-enter one after having cleared it, except by signal indication or until permission has been received from the RTC.
2. When entry to the main track is to be made at a non-electrically locked hand operated switch, or at a switch where the seal on the electric switch lock is broken, such permission from the RTC must include the direction and route to be taken and must be in writing. The locomotive engineer must be made aware of the circumstances before moving.
   Before issuing such permission the RTC must;
1. ensure that there are no conflicting trains or transfers within, or authorized to enter, the controlled block affected; and
2. block at Stop all devices controlling signals governing trains or transfers into the affected controlled block.

[…]^{Footnote 21}

According to this rule, when entry to the main track is to be made at a hand-operated switch that is not electrically locked, as in this occurrence, the permission must be provided by the RTC in writing. The RTC must first ensure that there are no conflicting trains within, or authorized to enter, the affected controlled block.

1.5.2 Instructions in Canadian National Railway Company’s Rail Traffic Control Manual

To guide RTCs in the performance of their duties, CN created and maintains its Rail Traffic Control Manual (RTCM). With respect to the application of CROR Rule 568, the RTCM contains item 3018, which provides instructions for issuing permissions to enter a main track at a switch while a movement is already in the block. The instructions in RTCM item 3018 in effect at the time of the occurrence state, in part:

3018. RULE 568 (c) - ENTER MAIN TRACK AT A SWITCH WHILE A MOVEMENT IS STILL IN THE BLOCK

RTC must ascertain that any conflicting movement is by the location of the switch before permission is given to enter the main track. The RTC must contact each movement in the controlled block and obtain a track release report from them. The track reports must be entered in the control system.

[…]^{Footnote 22}

According to these instructions, if there is one or more conflicting movements on the main track, the RTC must obtain a location report^{Footnote 23} from the crew of each conflicting movement and record this report electronically in the train control system.

RTCM item 3018 had been updated in March 2019. The earlier version of the instructions only required that RTCs ascertain the location of any conflicting movement; it did not specify to contact these movements to obtain a location report, nor did it require that this report be entered in the system, although this was CN’s expectation. The RTC exams in 2018 and 2020 each contained a question about the requirement to obtain a location report from each movement in the controlled block. The occurrence RTC correctly answered the question during the exam in 2020, but there is no record of his answer on the 2018 exam. The exam question did not include that the location reports needed to be entered in the system.

Instructions on the issuance of a Rule 568 permission when a movement is already in a block differ between railways. At Canadian Pacific Railway Company, RTCs can obtain a location report for the conflicting movement from either the movement requesting the permission or from the movement that is occupying the block.^{Footnote 24}

1.5.2.1 Updates to the Rail Traffic Controller Manual

RTCM updates are sent to RTCs by email, but the company does not track whether the RTCs have read these emails. However, RTCs are governed by CROR Rule 83(b), which states the following:

Before commencing work at their home location where operating bulletins are posted or displayed, every employee responsible for the operation or supervision of movements must read and understand the operating bulletins that are applicable to the territory that they will operate on.

Management may follow up with a safety blitz or an efficiency test to ensure all RTCs have read and understood the changes, although no such blitz or test was conducted regarding the update to RTCM item 3018 issued in March 2019. The changes were also included in updates to RTC recertification material.

The investigation determined that some RTCs, including the occurrence RTC, did not have an understanding consistent with the updated requirements of RTCM item 3018, which required that RTCs get a location report from each movement already in the controlled block and input it in the system. In particular, they did not consistently enter location reports in the system.

1.5.3 Software used to issue Rule 568 permissions

At CN, RTCs use the RTC II software to issue Rule 568 permissions.

In the software, when an RTC initiates a Rule 568 permission, if the affected track block is already occupied, the system displays a message to that effect and prompts the RTC to choose between 2 options: Continue (the default option) or Abort (Figure 6). If the RTC clicks on “Continue,” there are no further prompts for confirmation. The software does not require the input of a location report from the train that is within the controlled block, and it does not prohibit the issuance of a Rule 568 permission if a location report is not entered.

In contrast, when RTCs use the same software to process a request for a track occupancy permit^{Footnote 25} when there is a train within the proposed limits, the software requires the input of a location report confirming that the train has already passed the location where the employees will enter the main track. If this report is not provided, the software aborts the authority.

1.5.4 Issuance of the Rule 568 permission by the rail traffic controller

In this occurrence, the crew of train 532 contacted the RTC to request a Rule 568 permission to enter the north main track of the Kingston Subdivision at a hand-operated switch located at Mile 113.36. A Rule 568 permission covers the entire controlled block for the requested location—in this instance, a 14.7-mile block from controlled signal 1037N to controlled signal 1184N (Figure 7).

The request made by the crew of train 532 for a Rule 568 permission was relatively routine. Train 532 regularly conducted switching operations at this location. Each time, in preparation to enter the main track, the crew would contact the RTC to obtain the necessary permission.

In this occurrence, the RTC did not contact the conflicting movement in the block (train 149) for a location report. The investigation determined that, on 5 other occasions within the 2 months before the accident, when the crew of train 532 requested a Rule 568 permission while another movement was already occupying the block, the occurrence RTC did not obtain a location report from the crew of the movement in the block, nor did he record a location report in the train control system. In those instances, the RTC delayed issuing the Rule 568 permission until advised by the crew of train 532 that the movement in the block had passed by train 532’s location.

Between September 2017 and August 2021, CN completed safety engagements with RTCs that verified compliance with all rules. A review of CN’s Safety Engagement Observations by Rule by Employee for the RTC for the same period shows that, on 15 March 2019, the RTC was noted to have correctly applied (“safe behaviour”) RTCM item 3017 (the instructions for authorizing a movement to enter a main track when no other movement is in the block). There were no entries regarding the RTC’s application of RTCM item 3018; however, opportunities to complete a safety engagement on either RTCM items 3017 or 3018 are limited. During his career as an RTC at CN, the RTC had been subjected to 353 rule verifications.

1.5.5 Time and attention required to issue a Rule 568 permission

As part of the investigation, the TSB conducted a simulated exercise to determine the time and attention required to issue a Rule 568 permission. The results of the exercise indicated the following:

• The entire process took approximately 4 minutes to complete; this included communication with the train crew, entering the information into the RTC II forms, repeating the information, and underscoring each word and digit. Obtaining a location report when a train was within the controlled block added about 45 to 60 seconds to the process.

• The forms that must be filled out are displayed on a different screen than the main screens used for controlling rail traffic. This diverts an RTC’s attention away from the screen displaying rail traffic.
• The time to complete a Rule 568 permission varies depending on several factors such as RTC experience and rail traffic volume and complexity. In this occurrence, the RTC took about 2.5 minutes to complete the task.

1.6 Rail traffic controller training and experience

The RTC in this occurrence qualified in 2006 with Canadian Pacific Railway Company in Montréal, Quebec. He then moved to Calgary, Alberta, in 2014, still working for the same company as an RTC.

In 2016, he took conductor and trainmaster training for management employees and qualified. Once qualified, he occasionally operated trains (road assignments) as management.

In 2017, he moved back to Montréal and accepted an RTC position with CN. There, he received CN-specific training for RTCs, which included training on the CROR. He successfully completed his training and began working as a CN RTC on 17 May 2017.

In August 2020, he transferred to Edmonton, where he continued to work as an RTC for CN. Shortly after, he followed CN’s recertification program for RTCs, which he passed on 14 September 2020. He also took an online RTC recertification course offered by CN, which he passed on 02 November 2020.

On the day of the occurrence, the RTC was working on desk ED, which is used to control train traffic and maintenance activities on the Kingston Subdivision. He had almost a full year of experience working on this desk.

1.7 Rail traffic controller workstation

Rail traffic controller workstations are set up with a number of screens to assist RTCs to perform their work. Different screens are used for different tasks, such as monitoring and directing the movement of trains and track work, managing communications, gathering information, requesting signals for train movements, and issuing track authorities.

On desk ED, there are at least 12 screens that the RTC may monitor and use, depending on the needs of the shift and personal preference (Figure 8).

* On the day of the occurrence, desk ED was used to control a larger territory than shown in the picture.

The 6 screens located immediately in front of the controller display information from the RTC II control system. One or more of the other available screens can be configured to display adjacent control territory when needed. These screens display the movement of trains and track maintenance work on the RTC’s assigned territory of control. The overlay of information on these screens can be altered by the individual controller to suit personal preferences.

Below the screens dedicated to the RTC II control system, there is a screen used for the Traffic Operations Planning & Control system (TOPC). This screen displays detailed train and crew information (names and time on duty), track and yard information, a summary of authorities, e-messages, templates of various forms, and information related to delays. Beside the TOPC screen, another screen is used to issue general bulletin orders (GBOs)^{Footnote 26} and tabular general bulletin orders (TGBOs).^{Footnote 27}

The remaining screens provide additional applications to support the RTC’s responsibilities. They include, but are not limited to, software used for VIA passenger train schedules and routing, communication applications such as Skype and Microsoft Outlook, internet browsers, and weather applications.

The radio screen and phone are located on the right-hand side of the workstation.

1.8 Rail traffic controller workload

1.8.1 Role and responsibilities of rail traffic controllers

RTCs continuously control and monitor train traffic. Their work requires that they manage multiple tasks while trying to optimize the movement of trains in a safe and efficient manner.

To maintain accurate situational awareness and associated mental models, RTCs continuously monitor multiple screens and use several methods of communication such as radio, phone, and instant messaging.

Their responsibilities require attention, dynamic re-planning, and decision making under time pressure. Some common activities include:

• Monitoring for, and processing of, requests for track occupancy permits, Rule 568 permissions, and similar permissions related to track protection
• Monitoring for train delays, keeping electronic records of these delays, and coordinating with crews as required
• Monitoring for reports of track status (blockages, rail conditions)
• Monitoring for, verifying, and responding to alarms, such as alarms for ghost trains^{Footnote 28} and for trains passing a stop signal
• Organizing track work and ensuring that the track, trains and Engineering employees are protected, while also minimizing delays and disruptions to traffic
• Reporting signal problems to Signal and Communications employees, and protecting the affected signal and block as required
• Protecting dimensional traffic (i.e., traffic of non-standard width, height, or weight) handled on trains by advising all affected employees and issuing the required restrictions for safe handling
• Protecting defective grade crossing warning systems and issuing the required GBOs to affected trains
• Arranging for protection to enable planned track work activities and issuing the required GBOs to trains
• Issuing slow orders to trains to protect track that has been deemed unsafe for movements at authorized speed
• Sending TGBOs as needed for recently ordered trains
• Adjusting planned meets
• Informing the crew office when to call new train crews for the next crew change location, and arranging transportation
• Responding to unexpected events, such as train breakdowns and changes in track usage; this can involve notifying all affected crews and railway employees (sometimes for other railways), securing the safety of the track, re-routing train traffic, recrewing trains, and resolving any issues as quickly as possible to minimize delays and disruptions to traffic

To address planned and unplanned situations that affect track usage, RTCs must switch their attention from controlling and monitoring traffic to attending to the relevant screens and communicating with numerous railway personnel.

RTCs are also expected to understand any and all recent changes to regulations and work instructions, and to properly apply them in dynamic situations.

Routes where there are passenger trains, as in this occurrence, add another layer of complexity to RTC tasks. Passenger trains are prioritized over freight trains. They travel much faster than freight trains, reducing the amount of time RTCs have to make decisions. When planning and coordinating locations where freight trains lift and set off cars, the effect of these activities on passenger train operations must be considered. Moreover, RTCs must remain cognizant of passenger station stops, paying particular attention to preferred track and platforms in multi-track territory to ensure that passenger trains are protected from freight trains operating on adjacent tracks while passengers are entraining or detraining.

Depending on the territory they are assigned, some RTCs must perform their duties in both official languages and sometimes translate information. This can add to their cognitive workload. In this occurrence, the RTC’s assigned territory included segments of track in Quebec and in Ontario, which required some work to be performed in both official languages.

1.8.2 Workload analysis of desk ED by Canadian National Railway Company

CN conducted a workload analysis for desk ED from 01 August to 02 September 2021, measuring every hour of every day.

The analysis took into account work related to the following:

• authorities (aborting, cancelling, retiring,^{Footnote 29} completing, confirming, issuing, requesting, and other miscellaneous actions)
• signals (requesting, aborting^{Footnote 30})
• switch requests
• operating bulletins (cancelling, retiring, issuing, requesting)
• radio and telephone calls

The majority of hours measured revealed that, typically, total tasks conducted amounted to less than 45 minutes per hour measured. CN recognizes that not all RTC tasks are captured in CN’s workload assessments. For this reason, CN uses a 45-minute threshold to determine when workload is high. Consequently, RTC desks that consistently have a workload of 45 minutes or more per hour are subject to review. Based on the results, it was determined that the workload for desk ED was not high. There were only 3 particular hours in the course of the entire month when the workload was considered high (when it exceeded 45 minutes of tasks in a work hour). As such, CN did not deem that further measurement was needed to reassess the workload for that desk.

In the month when the workload analysis was conducted, there were travel restrictions in effect to prevent the spread of COVID-19, and consequently traffic levels were down. Specifically, VIA passenger trains and freight traffic levels were reduced. VIA passenger trains had returned to a full schedule a few days before the occurrence, adding an additional 5 trains per day. This was the occurrence RTC’s third shift with the full VIA schedule. At the time of the occurrence, 2 VIA trains remained within the RTC’s assigned territory.

1.8.3 Workload review of desk ED by the TSB

As part of this investigation, the TSB reviewed the workload for desk ED for the hour before the accident. It was determined that at least 11 tasks typically conducted by RTCs using desk ED were not included in CN’s workload measurement analysis of this workstation:

• Monitoring and cognitive planning of trains and employees working on the track
• Holding conversations with RTCs on adjoining desks for train planning purposes
• Acknowledging electronic messages for electronic track occupancy permits
• Planning activities with various other personnel, such as the RTC chief, car control personnel, crew department, and yardmasters
• Recording train time for delay purposes
• Entering delays
• Writing in the utility book for other planning purposes
• Reviewing the VIA schedule for passenger train information
• Acknowledging alarms
• Ordering of train crew in TOPC
• Looking up train information in TOPC (length, dimensional traffic, work on line)

There were 11 minutes, spread over the hour, when the RTC was not actively interacting with the workstation or communicating with another individual. During these times, the RTC’s workstation was displaying train movements and track employee work. Additionally, there were 12 separate minutes where the RTC performed a single task such as issuing a TGBO, lining a switch, extending the routing of a movement, or acknowledging an alarm from a wayside inspection systems test. While these tasks take seconds to complete, additional time for planning and monitoring would have been required. These results indicate that, in the hour before the occurrence, the RTC workload was complex and required his attention.

1.8.3.1 Ongoing situations monitored by the rail traffic controller in the hour before the occurrence

In the hour before the occurrence, the RTC was controlling and coordinating the movement of 11 trains (including trains 532 and 149), 5 of which were passenger trains. He was monitoring several ongoing situations that required his attention:

• Train 532 was servicing the industrial spur at Prescott.
• From 0934 to 1004, the RTC had to evaluate, plan, and authorize 4 trains on 2 tracks (route VIA 60 and train 532 around train 368 and train 149 between Brockem [Mile 118.4] and Galop [Mile 102.9]).
• There were 4 ghost train alarms, 2 of which occurred approximately 11 minutes before the occurrence.
• The RTC was reviewing and either accepting or declining electronic track occupancy permit requests from Engineering employees who were conducting track inspections.
• The RTC was coordinating planned work blocks (Rule 42 authorities) with several foremen on the north and south tracks. The work blocks resulted in approximately 20 miles of single track. The RTC had to carefully anticipate and plan train routing with the foremen around this area and continuously monitor train movements to prevent delays, and ensure that all trains were routed to the south track at Dorval, including VIA passenger trains.

1.8.3.2 Workload while issuing the Rule 568 permission

In the lead up to and while he was issuing the Rule 568 permission to train 532, the RTC was performing several other concurrent tasks, all of which required his attention. He

• informed the crew members on train 532 that they would be held at Brockem for train VIA 63,
• received and acknowledged a prompt reminding him to order a new crew for some trains at Belleville, Ontario (the prompt appeared each time that a movement entered the block where the switch to the industrial spur at Prescott was located, and hence the RTC had to acknowledge the prompt several times throughout his shift),
• received and acknowledged the prompt that train 149 was in the same block as the hand-operated switch where train 532 would be entering the main track,
• lined a switch and then a signal for train 305,
• lined numerous signals for train VIA 60, and
• monitored traffic in order to line signals for train VIA 63 after train 368 cleared Galop.

1.8.4 Attention and workload

People have limited abilities to divide their attention. Increased workload can adversely affect an RTC’s ability to perceive and evaluate information from the environment and reduce situational awareness.

Workload is an RTC’s capacity to complete the number of tasks within a given amount of time. If the number of tasks that must be completed increases, or if the time available to complete them decreases, the workload increases. Task saturation occurs when the number of tasks to be completed in a given time exceeds an RTC’s capacity to perform them. When workload is complex or high, individuals must either abandon or defer some tasks and can get trapped in a phenomenon called attention narrowing or tunnelling (unintentionally focusing on information that is believed to be most important at the time while ignoring information considered less important, or fixating on certain information). Task adaptation is another workload strategy that increases the efficiency of tasks or reduces the amount of time to complete the task.

Interruptions or distractions can compete with other tasks and divert attention from higher priority tasks. This lapse of attention may result in missing information important to maintain situational awareness.^{Footnote 31}

1.8.5 Workload management

To manage workload or demanding situations, RTCs can take a number of measures:

• Prioritize passenger and freight train movements and defer other tasks such as issuing track occupancy permits, processing Rule 568 permissions, taking non-emergency calls, and ordering train crews. These other tasks are time sensitive, but RTCs usually defer them in order of priority to minimize delays.
• Defer secondary tasks, such as recording delays, to a quieter part of the shift or to the next shift, or ask another RTC to complete them, time permitting
• Hold trains.
• Request train crews to slow train speed.

RTCs can request assistance from the shift supervisor to manage their workload during their shift. The shift supervisor will review the desk and speak with the RTC to see what assistance is required. If possible, some of the territory can be moved to another RTC territory or an additional RTC desk can be opened for a period of time. It can be difficult to split the RTC’s territory because RTCs working on the Kingston Subdivision must be bilingual and the vast majority of RTCs are not fluent in French. In addition, there are no extra RTCs on duty in the rail traffic control centre in Edmonton, and, if the RTC who provides meal relief is used to assist an overworked RTC, other RTCs will not be able to take their breaks.

In this occurrence, the RTC did not make a formal request for assistance due to workload.

1.9 Situational awareness and mental models

Situational awareness is the perception of the elements in the environment, the comprehension of their meaning, and the projection of their status in the future. In highly practiced situations, attention and expectancies are more often driven by one’s existing mental model of the situation since previous experience will dictate what information is important and how the situation will unfold.^{Footnote 32}

A mental model is critical for effective performance in dynamic time-critical environments since it reduces the need for time-consuming evaluation of the situation and enables quick actions. However, it can also lead to errors in how information is perceived and to inaccurate situation assessments. For instance, inaccurate mental models can lead operators to rely too heavily on the first piece of information offered (anchoring bias) and increase the tendency to look for evidence that confirms or matches the current situation or decision since previous experience will dictate what information to expect at any given time (confirmation bias). These biases can make it less likely for an operator to reassess the initial situation assessment and update it with new information or lead them to “hand-pick” information that supports their current state of awareness.^{Footnote 33},^{Footnote 34} In many circumstances, people hear what they expect to hear and see what they expect to see.

1.10 Defences for the protection of train movements

1.10.1 Administrative defences in the centralized traffic control system

When entry to the main track in CTC is to be made at a hand-operated switch that is not electrically locked, as in this occurrence, the permission must be provided by the RTC in writing. In the absence of an electric lock, there is no physical defence to prevent such a switch from being reversed in error while a train is operating within the block. Moreover, if a train has already passed a permissive signal indication governing movement into the block and a switch within that block is then reversed in error, the crew of the approaching train will be unaware that a switch has been reversed until the switch target becomes visible.

To prevent this from happening, railways rely on administrative defences, such as CROR Rule 568 and the procedures contained in the RTCM. For example, the RTC needs to obtain a location report for a train already in the block to verify that it has already passed the switch location before issuing a Rule 568 permission to another train. However, even if a location report is obtained, an RTC could still mistakenly issue a Rule 568 permission to the crew of the second train, and neither crew would know about the presence of another train. This overlap in authority could lead to a collision.

Administrative defences can fail when errors are made. Procedural requirements to perform a task in a particular way can be forgotten, overlooked, or intentionally avoided, such as when shortcuts are taken. As demonstrated in numerous TSB investigations since 1990,^{Footnote 35} when an administrative defence fails (for whatever reason) and there are no physical fail-safe defences, accidents can occur.

1.10.2 Electric switch locks

Electric switch locks can provide a physical defence from opposing movements. In CTC, when trains need to enter or re-enter the main track where an electric switch lock is present, the train crew first needs permission from the RTC, in accordance with CROR Rule 568. The Rule 568 permission given must include the direction and route to be taken. Once permission is provided by the RTC, the train crew unlocks and opens the electric switch lock. Once the lock is opened, the track circuit is opened, which generates a track occupancy on the RTC screen for the controlled block affected. This prevents the RTC from lining controlled block signals into the block. If the block is already occupied when crew members attempt to open an electric switch lock, they will be unable to do so.

1.11 TSB occurrences involving the misapplication of Rule 568 in Canadian National Railway Company operations

In the 5 years before this occurrence, 6 occurrences were reported to the TSB by CN^{Footnote 36} in which the misapplication of CROR Rule 568 led to a movement exceeding the limits of its authority. In 2 of these events, a train was already occupying the affected block (TSB occurrences R20V0059 and R18E0139).

1.12 TSB occurrences involving the presence and/or the influence of drugs and alcohol in Canadian rail operations

As part of its investigations, the TSB considers drug and alcohol impairment, but the data in rail operations are quite limited. Since 1995, the TSB only has 4 investigation reports in its database involving the presence and/or the influence of drugs and/or alcohol for railway employees in safety-critical positions.^{Footnote 37}

1.13 Regulatory surveillance

From 2017 to 2021, TC inspected the CN rail traffic control centres across all of CN’s former and current locations (Toronto, Montréal, and Edmonton) 11 times. The inspection process did not detect any non-compliance of CROR Rule 568.

1.14 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer.

Regulatory surveillance is a Watchlist 2022 issue. As this occurrence demonstrates, Rule 568 violations can lead to train collisions and derailments. CN’s safety engagement observations are not always effective at identifying unsafe operating practices in the issuance of Rule 568 permissions, and TC’s audits did not identify this safety deficiency.

2.0 Analysis

There was no indication that train handling issues, track, equipment, or mechanical conditions contributed to this occurrence. The analysis will therefore focus on the following:

• effects of alcohol on the performance of the rail traffic controller (RTC)
• the instructions related to the issuance of Rule 568 permissions when a movement is already in the block and how the RTC understood and applied them
• the design of the RTC II software with respect to the issuance of Canadian Rail Operating Rules (CROR) Rule 568 permissions when a movement is already in the block
• the methods used to update and verify understanding of the changes to Canadian National Railway Company’s (CN) Rail Traffic Control Manual (RTCM)
• the RTC’s workload in the hour before the occurrence

2.1 The occurrence

On 02 September 2021 at about 1025, CN train Z14921-02 (train 149) was travelling westward on the north main track of the Kingston Subdivision and was approaching Mile 113.36, where a hand-operated switch provides access to an industrial spur in the town of Prescott, Ontario. The train was to pass by the switch and continue on the north main track to Toronto, Ontario. However, having received permission from the RTC to enter the north main track in accordance with Rule 568 of the CROR, the crew of CN industrial switching assignment L53231-02 (train 532) reversed the switch to track KE01 of the industrial spur.

Just after the switch was reversed, the assistant conductor on train 532 observed a train approaching on the main track from the east. Subsequent to a discussion between the 2 train crews, the crew members on train 149 realized that the switch was lined against them and that a collision with train 532 was imminent. They placed the train into emergency approximately 970 feet east of the spur track switch, but the train was unable to stop. At about 1028, train 149 entered the spur and, while travelling at 37 mph, collided head-on with eastward-facing locomotive IC 9629 of train 532.

2.2 Effects of alcohol on the rail traffic controller’s performance

In accordance with CN’s Policy to Prevent Workplace Alcohol and Drug Problems, about 2 hours after the accident, the RTC submitted to a mandatory breath alcohol test. The results indicated that, when the RTC assumed his duties, his extrapolated blood alcohol concentration (BAC) levels were in the range of 0.064% to 0.109%. At the time of the accident, his extrapolated BAC levels were in the range of 0.044% to 0.069%.

Throughout his shift, and at the time of issuing the Rule 568 permission, the RTC’s extrapolated BAC was at levels that can potentially affect cognitive performance and decrease the level of attention. Cognitive performance can still be negatively affected while BAC is decreasing. In addition, the quality of his sleep the previous night was likely affected by alcohol, potentially further affecting his performance.

When the crew of train 532 made a request for a Rule 568 permission, the RTC’s performance was likely affected by persistent effects of alcohol. Before issuing a Rule 568 permission, the RTC did not confirm the location of train 149; in addition, in his previous communication with the crew of train 532, he did not indicate the number and direction of train 149.

Alcohol affects human performance due to its negative effects on psychomotor skills and cognitive functions, and in particular on information processing. As such, CN’s Policy to Prevent Workplace Alcohol and Drug Problems states, in part, that all employees are required to report and remain fit for duty, free of the negative effects of alcohol. The CROR also strictly prohibit the use of intoxicants or narcotics by employees subject to duty, or their possession or use while on duty.

The Canadian Aviation Regulations stipulate, in part, that no person shall act as a crew member of an aircraft within 12 hours after consuming an alcoholic beverage or as an air traffic controller or a flight service specialist within 8 hours after consuming alcohol. These regulations stipulate a period of time prohibiting consumption of alcohol before assuming duties; these time prohibition periods are to allow for the elimination of alcohol and, as such, they reduce the risk that a person will assume safety-critical duties while under its influence.

In comparison, although the Railway Safety Act allows such provisions to be made, regulations applicable to federally regulated railways do not identify such time prohibition periods for consumption of alcohol. Individuals are expected to self-assess and determine when the effects of alcohol have sufficiently diminished to be fit for duty.

As the BAC of individuals decreases, they may not accurately self-assess, and therefore could subjectively perceive that they have recovered despite the effects of alcohol on cognitive performance persisting.

2.3 Issuance of the Rule 568 permission

RTC instructions on the issuance of a Rule 568 permission when a movement is already in a controlled block differ between railways. At Canadian Pacific Railway Company, where the occurrence RTC had worked for several years before being hired by CN, RTCs can obtain a location report from either the movement requesting the permission or from the movement that is occupying the block.

In this occurrence, the RTC did not contact train 149 for a location report, nor did he request a location report for train 149 from the crew of train 532. Therefore, the RTC did not input a location report in the system.

On 5 previous occasions, the RTC had planned with the crew members of train 532 that, if he told them that a train was occupying the block, they would wait until that train had gone by before requesting a Rule 568 permission. Therefore, to ascertain the location of the movement in the block, he was relying on the timing of the request for a Rule 568 permission from the crew of train 532, rather than obtaining a formal location report and entering it in the system.

On the day of the occurrence, during a conversation with the crew of train 532 about the timing of their re-entry on the north main track, the RTC mentioned a freight train at Crysler and told the crew members that they would talk again, implying that their next conversation (train 532’s request for a Rule 568 permission) would only take place after the freight train (likely meaning, but not stating, train 149) had passed. He did not, however, explicitly tell the crew members of train 532 that train 149 was occupying the block or ask them to call when the opposing train was past their location.

When the RTC received the request for a Rule 568 permission from the crew of train 532, because of previous practice, he formed a mental model that train 149 had gone by train 532’s location and by the switch at Mile 113.36.

2.4 Design of the RTC II software with respect to the issuance of Rule 568 permissions

When the RTC initiated the process to issue a Rule 568 permission to train 532, the RTC II software displayed a prompt indicating that train 149 was within track limits. This prompt presented 2 options: Continue (the default option) or Abort. Since the RTC was already aware that train 149 was in the block, he incorrectly assumed that it was west of the switch at Mile 113.36, chose not to obtain a location report, and selected “Continue.”

According to RTCM item 3018, RTCs are required to obtain a location report from a train that is within the controlled block before issuing a Rule 568 permission. RTCs must also input the location report into the system at the time it is received. However, this input is not automatically linked to the issuance of a Rule 568 permission, and the software allows the issuance of the permission even if the location report is not obtained.

In contrast, when RTCs use the same software to issue a track occupancy permit (TOP), an authority issued for the protection of track units and track work, the software requires the input of a location report if a train is within the controlled block where the proposed TOP limits are situated. If this report is not provided, the system aborts the authority.

2.5 Changes to the Rail Traffic Control Manual

RTCM item 3018 was updated in March 2019 to specify that RTCs must contact each movement in the controlled block to obtain a location report and record it in the computer system prior to issuing a Rule 568 (Signal or Permission to Enter Main Track) permission.

RTCM updates are posted on CN’s intranet site and sent to RTCs by email. In accordance with CROR Rule 83(b), RTCs must read and understand the operating bulletins that are applicable to their territory. However, the company does not track whether RTCs have read these emails. In this instance, the update to RTCM item 3018 was included in RTC recertification material. Management may follow up with a safety blitz or efficiency test to ensure that all RTCs have read and understood the changes, although no such blitz or test was conducted regarding the update to RTCM item 3018 issued in March 2019. The investigation determined that some RTCs did not have an understanding consistent with the updated requirements of item 3018.

When safety-critical procedures are revised, it is essential that employees who will apply the revised procedures have a thorough understanding of what is expected of them. This can only be ensured through effective training, audits, and supervision. Employees are required to ask for clarification if in doubt about a rule or instruction;^{Footnote 38} however, they would likely only do so if they are aware that they do not understand an updated rule or instruction.

2.6 Rail traffic controller workload on the day of the occurrence

CN conducted an RTC workload analysis for the Kingston Subdivision (desk ED) from 01 August to 02 September 2021, measuring every hour of every day. CN determined that the workload was not high (the majority of hours measured revealed that, typically, tasks were conducted less than 45 minutes per hour measured). There were only 2 particular hours in the course of the entire month when workload was considered high when tasks exceeded 45 minutes in a work hour. As such, CN did not deem that further measurement was needed to reassess workload. However, at the time this workload evaluation was conducted, there were travel restrictions in place to prevent the spread of COVID-19; specifically, VIA Rail Canada Inc. (VIA) passenger train levels were reduced.

VIA passenger trains had returned to a full schedule a few days before the occurrence, which increased the RTC’s workload. This was the occurrence RTC’s 3rd shift with the full VIA schedule. In high workload situations, the number of tasks that an RTC must complete can exceed the RTC’s capability to perform them within a given time. In such situations, RTCs can experience attention tunnelling.

The TSB performed its own review of the workload for desk ED for the hour before the accident. The results indicated that the RTC’s workload in that hour was complex. He was controlling and coordinating the movement of approximately 11 trains, 5 of which were passenger trains, which travel at higher speeds than freight trains. He was also monitoring several ongoing situations, all of which required his attention. While under this complex workload, his cognitive performance was also likely negatively affected by the persistent effects of alcohol consumption.

In this occurrence, in the 2.5 minutes that the RTC was issuing the Rule 568 permission, he was also performing several other concurrent tasks. His attention was directed away from the computer screen that displayed train 149 going over the hot box detector at Mile 110, east of the switch at Mile 113.36. He therefore missed an opportunity to correct his mental model of the location of train 149.

3.0 Findings

3.1 Findings as to causes and contributing factors

These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence.

1. Canadian National Railway Company (CN) train 149, travelling westward on the north main track in the town of Prescott, unexpectedly encountered a hand-operated switch lined in the reverse position at Mile 113.36; consequently, it entered industrial spur track KE01, where it collided head-on with CN train 532.
2. The rail traffic controller’s performance and level of attention were likely affected by the persistent effects of alcohol consumption.
3. The rail traffic controller did not obtain the required location report from the crew on train 149. Therefore, he did not know the train’s exact location within the 14.7-mile controlled block in relation to the switch at Mile 113.36 when he issued the Rule 568 permission to train 532 to enter the main track.
4. When the rail traffic controller received the request from train 532 to enter the north main track, he developed a mental model that train 149 had already gone by the switch at Mile 113.36 and he therefore issued the Canadian Rail Operating Rules Rule 568 permission to train 532.
5. The rail traffic controller bypassed the prompt displayed by the RTC II software regarding a conflict with train 149 and issued a Rule 568 permission for train 532 to enter the main track without inputting the required location report for train 149 in the system.
6. When the rail traffic controller was issuing the Rule 568 permission, his workload was complex, and his attention was diverted to other competing tasks.

3.2 Findings as to risk

These are conditions, unsafe acts or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences.

1. If a period of time prohibiting the consumption of alcohol before assuming safety-critical duties is not specified, there is an increased risk that railway employees will take over their duties having incorrectly perceived that they have recovered from alcohol consumption while the effects persist.
2. If the rail traffic control system permits a rail traffic controller to issue a Rule 568 permission when another train is in the controlled block without obtaining and inputting a location report into the system, the risk of collision increases.
3. If safety-critical procedures are updated and issued but without training or verification to ensure that they are clearly understood when they are issued, there is an increased risk that these procedures will be misapplied, thereby negating the benefits that these additional safety measures were meant to provide.
4. If a rail traffic controller’s workload analysis is completed during periods of lower volumes of rail traffic, the analysis may not be representative of actual conditions during higher traffic volumes, creating a risk that the rail traffic controller will not be able to manage their workload during such periods.

4.0 Safety action

4.1 Safety action taken

4.1.1 Transportation Safety Board

The TSB issued Rail Safety Advisory Letter 01/22 “Conflicting authority to enter main track without obtaining a train location report” to Transport Canada (TC) on 25 January 2022.

The letter indicated that both Canadian National Railway Company (CN) and Canadian Pacific Railway Company have software that rail traffic controllers (RTCs) use to manage rail traffic on their networks, which includes issuing permissions to enter a main track. These permissions are governed by Rule 568 of the Canadian Rail Operating Rules (CROR) and are commonly called Rule 568 permissions.

When an RTC processes a Rule 568 permission in the software, if there is a train lined in, or operating within, the same controlled block as the requested permission, a warning prompt is displayed. In these situations, the RTC is expected to obtain a location report for the train operating within the block to ensure that the train has passed the location where the train requesting the permission intends to enter the main track. The location must then be entered in the system.

However, it is possible for an RTC to override the prompt and issue the requested Rule 568 permission without obtaining the location report from the train occupying the block. When the prompt is overridden, the software will generate a completed Rule 568 permission, thus permitting a 2nd train to enter the main track before the conflicting train has passed by that location.

Significant train accidents can occur when a system prompt for compliance with a safety-critical task under the CROR can be overridden without the benefit of any secondary oversight or a physical defence. The letter indicated that TC may wish to review the railways’ rail traffic control software prompts of all safety-critical tasks that can be overridden when equipment is already in the block, including prompts displayed during the issuance of CROR 568 permissions, and confirm that there are adequate layers of defence to protect against unsafe decisions made by RTCs.

4.1.2 Canadian National Railway Company

On 02 September 2021, CN issued Notice 2021-017 to RTCs, prohibiting, until further notice, the issuance of Rule 568 permissions when a movement is already in the affected block. This prohibition was still in place as of December 2023.

4.1.3 Transport Canada

On 28 February 2022, TC provided a response to TSB Rail Safety Advisory Letter 01/22, indicating that it was working on several broad fronts to address this issue. TC

• took immediate action to investigate the circumstances that led to the conflicting movement and violation of CROR Rule 568 and issued a letter of non-compliance to CN;
• wrote on 23 September 2021 to railway companies using the centralized traffic control system and requested that they provide a description of their current operating practices and system safeguards, procedures, and special instructions that are in place to ensure that no conflicting movements operate within a controlled block; and
• reviewed the CROR to determine which safety-critical rule would require the RTC to make a determination that a conflicting movement was not present before authorizing a second movement to enter the track.

On 21 February 2023, TC performed an inspection at CN’s rail traffic control centre Edmonton office, where observations of Rule 568 were noted, including discussions with RTCs regarding the CN instructions (at the time) that no Rule 568 permissions were to be issued while any movement is in the affected block. All RTCs understood the requirement.

In mid-March 2023, TC conducted a safety management system (SMS) targeted audit. The scope of the audit was around RTC II software safety prompts.

4.2 Safety concern