Language selection

TSB Recommendation R22-04

Enhanced train control for key routes

The Transportation Safety Board of Canada recommends that the Department of Transport require major Canadian railways to expedite the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and on all key routes.

Rail transportation safety investigation report R19W0002
Date the recommendation was issued 24 August 2022
Date of the latest response January 2024
Date of the latest assessment February 2024
Rating of the latest response Satisfactory in Part
File status Active

Summary of the occurrence

On 03 January 2019, about 0610 Central Standard Time, Canadian National Railway Company (CN) eastbound freight train M31851-01 (train 318) began following eastbound CN train Q11651-30 (train 116) near Rivers, Manitoba, on the CN Rivers Subdivision. Both trains were destined for Winnipeg, Manitoba. Train 318 was a key trainFootnote 1 operating on a key route,Footnote 2 as defined by the Transport Canada (TC)–approved Rules Respecting Key Trains and Key Routes. At 0906:54, train 318 was travelling at 42 mph, with Trip Optimizer (TO) engaged and the throttle in position 7, as it passed a Clear to Stop signal indication at Mile 52.2. The conductor had called out the signal in the locomotive cab and identified the Clear to Stop indication. However, the conductor did not hear the locomotive engineer (LE) verbally respond to acknowledge the signal, and the LE appeared to be staring straight ahead. At this point, conversation in the cab ceased. TO remained engaged, and the train continued at track speed.

As CN train 318 was proceeding on the south track, westbound CN freight train M31541-03 (train 315) was transitioning from single track to the north track while exiting the equilateral turnout (Mile 50.37) at Nattress near Portage la Prairie, Manitoba. At Mile 51.13, while travelling at 46 mph, train 318 passed the head end of train 315. The train 318 conductor then reminded the LE that they were operating under a Clear to Stop indication. Once reminded, the LE disengaged TO and made a full service brake application at 0908:34; 24 seconds later, he inadvertently placed the brake handle into the suppression position (rather than the emergency position), and then applied the locomotive independent brake.

Ten seconds later, as Stop Signal 504S came into view, the LE placed the train in emergency and the crew evacuated the locomotive cab. Train 318 side-collided with train 315 while travelling at 23 mph. Shortly thereafter, the train 318 crew members jumped from the locomotive to the south side of the track and sustained minor injuries. As a result of the collision, the 2 head-end locomotives on train 318 and 8 cars on train 315 derailed. Although no cars loaded with dangerous goods were involved, the head-end locomotives on train 318 lost a combined total of about 3500 imperial gallons of diesel fuel. The released diesel fuel was contained locally and cleaned up with no waterways affected.

Rationale for the recommendation

The rail transportation system is complex. The defence-in-depth philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors. Wherever possible, a combination of rules-based (i.e., administrative) defences and physical defences should be implemented to address normal slips, lapses, and mistakes that characterize human behaviour. Although newer circuitry has been integrated over the years, the basic design of centralized traffic control (CTC) wayside signal systems in Canada is well established. Despite the use of newer circuitry, railway operations still rely predominantly on administrative defences, which are the least effective method for mitigating risk.

Administrative defences, such as the Canadian Rail Operating Rules, railway general operating instructions, operating bulletins, and the Work/Rest Rules for Railway Operating Employees place an over-reliance on a train crew to follow the rules and do not consider the human factors that affect behaviour in everyday life. For example, in this case, the CTC system had the administrative requirement for train crews to follow the signal indications displayed in the field. However, when the crew did not respond appropriately to the signal indications displayed in the train, the administrative defence failed.

Safe train operations are contingent on the administrative defence of train crews observing each signal indication, broadcasting it, and then taking the appropriate actions. However, a signalled CTC system does not provide any advance warning to either the train crew or the rail traffic controller if a train crew does not observe a signal indication or does not take the appropriate action. CTC also does not provide automatic enforcement to comply with speed restrictions in order to slow or stop a train before it passes a restrictive signal.

In instances where a train crew misperceives, misinterprets or does not follow a signal indication, the administrative defences as a whole fail. As demonstrated in this and other occurrences, when an administrative defence fails and there is no secondary defence, it can result in an accident that otherwise could have been prevented.

In contrast to the administrative defences for train control systems available in Canada, Class 1 railways that operate in the United States (U.S.) have implemented physical fail-safe train control systems known as positive train control (PTC). PTC is designed to prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movement of a train through a switch left in the wrong position. In Canada, the term “enhanced train control” (ETC) has been adopted to describe such systems.

A PTC/ETC system would address the risk of crews misinterpreting or not following signal indications by automatically intervening to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. A fully functioning PTC/ETC system would also offer a physical fail-safe defence against operating crew errors that are influenced by fatigue, which played a role in this accident.

In the U.S., over the last 50 years, the National Transportation Safety Board (NTSB) has investigated more than 150 PTC-preventable accidents that took the lives of more than 300 people. From these investigations, the NTSB made 51 PTC-related recommendations.

In September 2008, a collision between a Metrolink commuter train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the Rail Safety Improvement Act of 2008 (RSIA) in the U.S. The RSIA mandated that PTC be installed on main rail lines that had specific risks associated with the transportation of dangerous goods (DG) as well as intercity and commuter passenger rail service.

As of 31 December 2020, PTC was fully implemented in the U.S. on all track required by the RSIA legislation, a total of 57 535.7 miles, which accounts for about 41% of the nearly 140 000 route-miles of the U.S. rail network. The total miles of track that have PTC installed includes the U.S. operations of both CN (3107 miles) and CP (2118 miles).

For comparison, the Canadian rail network comprises about 26 000 route-miles of track. Key routes account for a combined total of about 10 940 miles of main track, which represents about 42% of the Canadian rail network. When the key route criteria are compared to the high-hazard route criteria of the U.S. RSIA, it is reasonable to conclude that the hazards and percentages for route-miles of affected track are similar. Although U.S. legislation required that PTC be installed on high-hazard routes, there is no similar requirement to install PTC or ETC on comparable routes in Canada that carry DG.

A review of all TSB rail investigation reports (excluding Class 5 occurrences and including this occurrence) produced since the inception of the TSB in 1990 determined that 80 occurrences may have been prevented had a train control system equivalent to PTC (i.e., ETC) been available.

Furthermore, when TSB Class 5 occurrences are also considered, from 2004 to 2019, there was an annual average of 31 reported occurrences in which a train crew did not respond appropriately to a signal indication displayed in the field, and the yearly number of these occurrences is on the rise. In particular, 2018 (40) and 2019 (38) had the highest number of these occurrences.

In 2000, the TSB issued its first recommendation (R00-04) for implementing additional train control defences following its investigation into the 1998 collision between 2 CP trains near Notch Hill, British Columbia.Footnote 3 After determining that backup safety defences for signal indications were inadequate, the Board recommended that

the Department of Transport and the railway industry implement additional backup safety defences to help ensure that signal indications are consistently recognized and followed.
TSB Recommendation R00-04

In 2013, the TSB issued another recommendation (R13-01) for implementing additional train control defences following its investigation into the 2012 derailment and collision of VIA Rail Canada Inc. passenger train 92 (VIA 92) near Burlington, Ontario.Footnote 4 Following the investigation, the TSB indicated that Transport Canada (TC) and the industry should move forward with a strategy that would prevent these types of accidents by ensuring that signals, operating speeds, and operating limits are always followed. The Board recommended that

the Department of Transport require major Canadian passenger and freight railways implement physical fail-safe train controls, beginning with Canada’s high-speed rail corridors.
TSB Recommendation R13-01

In 2014, in response to the 2 TSB recommendations, a joint TC–industry train control working group (TCWG) was established. The group was chaired by TC Rail Safety, and also included representatives from the railway industry and operating crew unions. After establishing the TCWG, there were a series of ongoing meetings, discussions, and studies related to the development and implementation of ETC systems in Canada with no implementation plan or other tangible results to date. While TC did publish a Notice of Intent in the Canada Gazette, Part I, in February 2022 signalling its intent to require the implementation of ETC in Canada, there is still no implementation plan.

In the time it took TC and industry to strike the TCWG, study the issue, produce the TCWG Final Report, contract a follow-on report from the Canadian Rail Research Laboratory (CaRRL) and study the CaRRL results, PTC had been fully implemented in the U.S. on all of the high-hazard trackage required by the RSIA legislation.

Despite significant investment in PTC technology for the CN and CP locomotive fleets and their U.S. infrastructure, and 2 TSB recommendations to TC related to ETC dating back over 20 years, little has been done to extend the use of PTC into Canada or develop a similar form of ETC in Canada.

In this occurrence, with no backup physical fail-safe defence, such as a PTC/ETC system, there was no automatic intervention available to slow or stop the train. Consequently, the collision occurred after the train 318 LE, who was fatigued, did not respond appropriately to the Clear to Stop signal displayed in the field.

By definition, the CN Rivers Subdivision is a key route and is also an integral part of one of the major rail traffic corridors in Canada. This also means that the cities, towns, and villages along this key route are continually exposed to the risks associated with key trains transporting DG. Any collision or derailment involving a key train presents a risk of a DG release. If a train accident occurs on a key route, a key train or trains may be involved, increasing the risk of a DG release and potential adverse consequences to people, property or the environment.

It is clear that the current administrative defences for train operation, such as company procedural guidelines, notices and instructions, as well as the TC–approved Canadian Rail Operating Rules and Work/Rest Rules for Railway Operating Employees, are not always effective. Consequently, incidents and accidents continue to occur.

The first TSB recommendation on this issue is over 20 years old. The 2013 recommendation called for the implementation of physical fail-safe train controls, beginning with Canada’s high-speed rail corridors.Footnote 5 While the high-speed corridors are generally comprised of key routes, more recent accident history demonstrates that there is also a need for the implementation of fail-safe train control systems on all key routes.

The implementation of physical fail-safe train control technologies such as ETC would provide an extra layer of safety when operated in conjunction with existing administrative defences. However, the Canadian railway industry continues to rely solely on administrative defences, such as company procedural guidelines, the Canadian Rail Operating Rules, and the Work/Rest Rules for Railway Operating Employees, to protect against train crews not responding appropriately to signal indications displayed in the field. If TC and the railway industry do not take action to implement physical fail-safe defences to reduce the consequences of inevitable human errors, the risk of collisions and derailments will persist, with a commensurate increase in risk on key routes in Canada.

Therefore, the Board recommended that

the Department of Transport require major Canadian railways to expedite the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and on all key routes.
TSB Recommendation R22-04

Previous responses and assessments

November 2022: response from Transport Canada

Transport Canada (TC) agrees with recommendation R22-04. The Department has taken concrete steps, in conjunction with government and industry partners, to advance the implementation of physical fail-safe train controls to ensure that signal indications are consistently recognized and followed by train crews.

The Notice of Intent (NOI) published in February of 2022 sent a strong signal of TC’s commitment to the deployment of Enhanced Train Control (ETC) on the Canadian rail network and made clear that the highest risk corridors must be equipped with fail safe, automatic train protection by 2030. Feedback from stakeholders supported the risk-based and corridor-specific implementation which ensures investments in safety improvements on a given corridor are tailored to the safety risk of that corridor.

TC continues to move forward with the necessary building blocks for regulating ETC in Canada, with emphasis on the methodology to assess individual corridor risk and a framework for ensuring interoperable train operations.

As outlined in the NOI, implementing a corridor risk assessment methodology that is robust and consistently applied across Canada will require the principles of the risk-prioritization criteria and methodology to be set out in the regulatory framework and subject to TC approval. To support regulatory development, TC is developing a corridor risk assessment methodology to be completed by September 2023 that will incorporate key risk factors, such as train speed, presence of dangerous goods, passenger traffic, and population density. The factors will serve to identify higher risk corridors and guide priority implementation of ETC across the Canadian rail network.

TC has entered into an agreement with the Standards Council of Canada to have the Canadian Standards Association (CSA) develop a National Technical Specification on Interoperability by September 2023. The CSA, as a standards development organization, has the expertise to bring industry and other stakeholders together to develop this essential building block for ETC. This will ensure that information, such as train position and train speed, can be communicated reliably and securely between railways, notwithstanding the chosen train control technology.

The development and deployment of ETC is a complex and capital-intensive undertaking. As discussed in the NOI, consideration will need to be given to other important elements such as telecommunications needs, access to spectrum, and how to ensure the regulation fosters innovative and evolving technology. TC is working diligently with stakeholders to advance these elements in order to meet our commitment of implementing ETC on the highest risk corridors by 2030.

In parallel with advancing ETC, the department has continued to strengthen the rail safety regulatory regime and has taken measures that address safety risks identified in this investigation report. These measures include new Locomotive Voice and Video Recorder Regulations, which ensures crucial information is available to help determine the cause of an accident and to prevent future accidents. The Duty Rest Rules, informed by the latest fatigue science, will reduce the occurrences of fatigue in railway operations by placing new limits on the length of a duty period and increasing the length of the minimum rest period between shifts. Strengthening of the Track Safety Rules and Key Trains and Key Routes Rules will reduce the likelihood of a derailment of a train carrying dangerous goods.

January 2023: TSB assessment of the response (Satisfactory in Part)

This recommendation is related to the TSB Watchlist 2022 key safety issue of “Following railway signal indications,” where there is a risk of serious train collision or derailment if railway signals are not consistently recognized and followed. It is also linked to dormant Board Recommendation R00-04 and active Recommendation R13-01.

A review of all TSB rail investigation reports (excluding Class 5 occurrences and including this occurrence) produced since the inception of the TSB in 1990 determined that 80 occurrences may have been prevented had a train control system equivalent to Positive Train Control (i.e., Enhanced Train Control [ETC]) been available.

From 2004 to 2021, there has been an annual average of 35 reported occurrences in which a train crew did not respond appropriately to a signal indication displayed in the field. Although the number of occurrences in 2019 increased to 45, the number of occurrences in 2020 and 2021 returned to the long-run average (34 and 32, respectively).Footnote 6

Transport Canada (TC) agrees with Recommendation R22-04 and has taken steps, in conjunction with government and industry partners, to advance the implementation of physical fail-safe train controls. TC published a Notice of Intent (NOI) in February 2022, identifying that highest risk corridors must be equipped with fail-safe, automatic train protection (i.e., ETC) by 2030.

To identify higher risk corridors, TC is developing a methodology to assess individual corridor risk, to be completed by September 2023; it will incorporate key risk factors, such as train speed, presence of dangerous goods, passenger traffic, and population density.

Interoperability is an essential building block for ETC. TC has stated it will ensure that information, such as train position and train speed, can be communicated reliably and securely between railways, notwithstanding the chosen train control technology. TC has entered into an agreement with the Standards Council of Canada to have the Canadian Standards Association (CSA) develop a National Technical Specification on Interoperability by September 2023.

The Board notes that the development and deployment of ETC is a complex and capital-intensive undertaking, and that consideration will need to be given to other important elements such as telecommunications needs, access to spectrum, and how to ensure the regulation fosters innovative and evolving technology. It also notes that TC has continued to strengthen the rail safety regulatory regime, with the new Locomotive Voice and Video Recorder Regulations and Duty and Rest Period Rules for Railway Operating Employees, and the strengthening of the Railway Track Safety RulesFootnote 7 and the Rules Respecting Key Trains and Key Routes.Footnote 8

The Board is encouraged that TC has accepted this recommendation and has committed, in conjunction with government and industry partners, to develop a corridor risk assessment methodology and a National Technical Specification on Interoperability by September 2023. This action is a positive step toward the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and on all key routes. However, until TC provides further clarification on which corridors will require ETC, the Board considers the response to Recommendation R22-04 to be Satisfactory in Part.

Latest response and assessment

December 2023: response from Transport Canada

Transport Canada is continually progressing in establishing the essential foundations for regulating enhanced train control (ETC) in Canada, with a particular focus on refining the methodology for evaluating corridor-specific risks. ETC is a complex technology that requires integrating advanced elements such as communication systems, sensors, and automation. Additionally, thorough testing, validation, and training are crucial before full implementation of the technology by the railway industry.Footnote 9

Following the publication of the Notice of Intent in 2022, Transport Canada developed a risk methodology to guide the implementation of ETC in Canada. This approach involves a multi-layered ETC technology application, incorporating automatic train protection for higher-risk track segments and a driver-assist system for medium-risk segments. Lower-risk segments would continue to adhere to existing Canadian Rail Operating Rules.

The risk methodology developed by Transport Canada evaluates various factors, including passenger service, annual gross ton-miles (GTM), and key route status. Key routes, defined as tracks carrying 10 000 or more cars with dangerous goods annually, are a focal point. This risk methodology was shared with the railway industry in May 2023, leading to bi-weekly discussions throughout the summer of 2023 between Transport Canada and the Railway Association of Canada, including representation from freight companies such as the Canadian National Railway Company and the Canadian Pacific Railway Company,Footnote 10 as well as passenger companies such as VIA Rail and Metrolinx. Simultaneously, the Canadian Standards Association has finalized and published a set of guidelines for interoperability of enhanced train control applications, marking a significant step toward ensuring the safety and efficiency of railway operations in Canada.

Transport Canada is currently advancing policy and risk analysis work and continues to engage with stakeholders to inform drafting of a future ETC regulation, including defining which rail corridors will require ETC.

January 2024: response from the Railway Association of Canada

The railway industry and TC engaged multiple times throughout 2023, discussing recommendations and supporting information to inform future Enhanced Train Control (“ETC”) regulations in consideration of the NOI. Engagement is planned to continue.

February 2024: TSB assessment of the response (Satisfactory Intent)

This recommendation is related to the TSB Watchlist 2022 key safety issue of “Following railway signal indications,” where there is a risk of serious train collision or derailment if railway signals are not consistently recognized and followed. It is also linked to dormant Board Recommendation R00-04 and active Recommendation R13-01.

Following the publication of the Notice of Intent (NOI) in February 2022, Transport Canada (TC) developed a risk methodology to guide the implementation of enhanced train control (ETC) in Canada. Such a system would incorporate automatic train protection for higher-risk track segments and a driver-assist system for medium-risk segments. Lower-risk segments would continue to adhere to the existing Canadian Rail Operating Rules.

TC shared the risk methodology with the railway industry in May 2023, leading to bi-weekly discussions throughout the summer of 2023.

The Canadian Standards Association (CSA) finalized and published a set of guidelines for interoperability of ETC applications to ensure the safety and efficiency of railway operations in Canada.

The Board acknowledges that the development and deployment of ETC is a complex and capital-intensive undertaking, and that consideration will need to be given to other important elements such as telecommunications needs, access to spectrum, and how to ensure the regulation fosters innovative and evolving technology. However, TC and the railway industry have been discussing the framework needed to address the safety issue of “Following railway signal indications” since 2013 and, while TC has taken positive steps toward identifying a solution for physical fail-safe defences in the form of ETC, the pace of development is slow.

At the time of this assessment, there were 3 active TSB investigations related to occurrences in which trains were operating on key routes and passed Stop signals. While the preliminary investigation into these occurrences indicates that each of the trains involved received appropriate advance warning of the requirement to stop, the existing administrative defences were inadequate to ensure that these trains respected their limits of authority:

  • R23H0006: On 13 April 2023, a Canadian National Railway Company (CN) freight train was proceeding eastward while a VIA Rail Canada Inc. (VIA) passenger train was proceeding westward on the same track on the CN Kingston Subdivision. The CN train went past a Stop signal at Wesco near Cornwall, Ontario, and the crew applied the brakes in emergency shortly therafter. The train came to a controlled stop approximately 20 car lengths east of the VIA train. There were no injuries reported. The VIA passenger train was transporting 168 passengers. Before encountering the Stop signal, the CN train had been provided with a progression of signals requiring preparation to bring the train to a stop.
  • R23E0079: On 08 August 2023, CN freight train Z11531-06 (train 115), travelling westbound on the south main track of the CN Wainwright Subdivision, passed a Stop signal in Wainwright, Alberta, and side-collided with CN freight train S77181-04 (train 771) that was departing the Wainwright Yard onto the south main track. Train 115 went past the Stop signal at 32 mph and, after an emergency application of the train brakes, side-collided with train 771 at about 20 mph. As a result of the collision, the 2 locomotives on train 115 derailed, as well as several rail cars on both trains. No one was injured. Before encountering the Stop signal, train 115 had been provided with a progression of signals requiring preparation to bring the train to a stop.
  • R23V0205: On 19 November 2023, northbound Burlington Northern Santa Fe (BNSF) freight train RNWE-804117 (train 804) collided with the side of southbound BNSF manifest freight train VBCEVE-118 (train 118) on the BNSF New Westminster Subdivision. Train 118 was entering the siding at Oliver in Delta, British Columbia, and its tail end had not yet cleared the main track when the collision occurred. Two intermodal cars on train 118 derailed. Two locomotives and 5 cars on train 804 derailed upright, including 3 tank cars containing liquefied petroleum gas (UN1075)—2 loaded and 1 residue. The fuel tank on the lead locomotive of train 804 was punctured, resulting in the release of about 5700 litres of diesel fuel (UN1202). There was no other product release. The crew members on train 804 did not sustain any injuries. Train 804 had encountered a progression of signal indications requiring that the train be stopped clear of the north siding switch at Oliver. It went past the Stop signal at 34 mph and into the side of train 118. In this occurrence, train 804, coming from the United States, had been afforded the protection of positive train control (PTC) up to the Canadian border, where PTC protection terminates for trains entering Canada.

Despite the calls from the TSB for additional physical fail-safe defences in signalled territory since 2000 and the implementation of such solution in the United States since 2020 (i.e., PTC), the Canadian railway system continues to rely on administrative defences centred on compliance with rules by train crews. However, human factors science shows, and the TSB has demonstrated in multiple investigation reports, that even well-trained, well-meaning train crews will occasionally misinterpret or misapply signals and that administrative defences alone are not effective to prevent adverse outcomes.

The Board is encouraged that TC has developed a corridor risk methodology and that the CSA has published a set of guidelines for interoperability of ETC applications. This action is a positive step toward the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and on all key routes by 2030. However, given the risks to train crews and the travelling public, TC and the railway industry are urged to accelerate the implementation of physical fail-safe train controls on Canada’s high-speed rail corridors and all key routes in Canada. The Board considers the response to Recommendation R22-04 to show Satisfactory Intent.

File status

The TSB will monitor TC’s progress on its planned actions.

This deficiency file is Active.