Railway Investigation Report R16W0074

On 27 March 2016, at about 0235 Central Standard Time, while switching in Sutherland Yard in Saskatoon, Saskatchewan, Canadian Pacific Railway 2300 remote control locomotive system training yard assignment was shoving a cut of cars into track F6. As the assignment was brought to a stop, empty covered hopper car EFCX 604991 uncoupled from the train, unnoticed by the crew. The car rolled uncontrolled through the yard and onto the main track within cautionary limits of the Sutherland Subdivision. The car travelled about 1 mile and over 2 public automated crossings before coming to a stop on its own. There were no injuries and no derailment. No dangerous goods were involved.

On 27 March 2016, the Canadian Pacific Railway (CP) 2300 remote control locomotive system (RCLS) training yard assignment (the assignment) was performing switching operations at the east end of CP's Sutherland Yard in Saskatoon, Saskatchewan (Figure 1). At the time of the occurrence, the assignment consisted of 2 locomotives that were switching 16 empty covered hopper cars. Locomotive CP 4441 was set up to operate using RCLS. The assignment was about 1000 feet long and weighed about 800 tons.

The assignment crew consisted of 2 conductors—a foreman, who was in charge of coordinating the switching activities, and a helper. Each crew member was equipped with a remote-control Beltpack^{Footnote 1} from which either crew member could operate the locomotive. Both assignment crew members were Canadian Rail Operating Rules (CROR)–qualified, met fitness and rest standards and were familiar with the territory, but neither had yet completed the full RCLS training.

In addition to the 2 conductors, a contracted RCLS trainer (the trainer) was positioned in the locomotive cab. The trainer accompanied the assignment crew during their shift to observe that the RCLS operations were being performed correctly. The trainer was a former railway employee who had not previously worked in Sutherland Yard and was no longer CROR–qualified.

1.1 The occurrence

At 2300^{Footnote 2} on 26 March 2016, the assignment crew commenced their shift by holding a job briefing with the assistant trainmaster (ATM) before activating the point protection zone (PPZ).^{Footnote 3} During the briefing, the ATM provided the crew with instructions for the switching activities to be completed at the east end of the yard during their shift.

The foreman and the helper were both working on the ground to facilitate switching activities. The foreman was in control of the assignment and operated the locomotive using the RCLS while the helper lined switches on the east-end F-yard lead track (Figure 2).

At about 0130 on 27 March 2016, eastbound CP potash unit train 602 (train 602) arrived at Sutherland on the main track. Train 602 consisted of 2 head-end locomotives and about 110 covered hopper cars loaded with potash. It weighed about 13 000 tons and was approximately 7500 feet long. In order for the tail end of train 602 to clear the Central Avenue crossing at Mile 109.78 of the Sutherland Subdivision, the train 602 crew contacted the assignment crew and requested permission to enter the PPZ on the main track at the east end of the yard. After the crew received permission, train 602 was operated alongside the yard and stopped with the locomotives to the west (and clear) of the 8th Street crossing at Mile 107.26. The train 602 crew secured the train on the main track and uncoupled the locomotives in preparation for taking them to the shop.

At about 0220, the assignment crew reversed into the east end of track F2. The assignment coupled to a cut of 16 empty covered hopper cars that needed to be switched into other tracks and released the hand brakes on the cut of cars. As was normal practice, the air brakes on all 16 cars had been previously discharged, leaving only the locomotive brakes to control the assignment. In the meantime, the helper had walked up the lead track, and lined the F6 east switch for track F6.

The foreman then stretched the movement. With the locomotives leading, the assignment pulled eastward onto the lead track until all cars cleared the F2 east switch. The helper then lined the F2 east switch for the lead track, and the assignment reversed toward track F6, where the crew intended to leave the tail-end car (16th) of the assignment, covered hopper car EFCX 604991. The helper remained on the ground near the switches at the east end of F‑yard.

At 0228:31, the assignment was brought to a stop with car EFCX 604991 on track F6 and the remainder of the assignment occupying the east-end F-yard lead track. The foreman applied the hand brake to car EFCX 604991, performed a hand brake effectiveness test, and then lifted the uncoupling lever to prepare the car to be set off from the assignment. At that moment, the train 602 crew called the foreman on the radio and requested permission to enter the east-end F-yard lead track within the PPZ with light engines (i.e., the 2 head-end locomotives only) in order to proceed to the shop track to park the locomotives.

The foreman was aware that, once train 602 was clear of the lead track, no more interruptions from arriving trains were expected for the rest of the shift. The foreman decided to reverse the entire assignment back into track F6 to allow the light engines from train 602 to proceed to the shop track. The foreman then released the hand brake on car EFCX 604991 and remained at the east end of track F6. At 0231:18, the assignment reversed into track F6, reaching a speed of 10 mph. At 0233:58, the assignment came to a stop after travelling 935 feet.

As the assignment stopped, car EFCX 604991, with its knuckle already released, uncoupled and rolled uncontrolled for the length of track F6, through the F6 west switch that was lined against it, along the west-end F-yard lead track and out of the yard onto the main track. Neither the assignment crew nor the ATM, who was located in the yard office, were aware that a car had separated from the cut of 16 cars on track F6.

Shortly thereafter, another crew that arrived by vehicle at the Sutherland Yard office noticed that a car was rolling uncontrolled westward on the main track. The crew immediately advised the ATM who called the assignment crew and notified them that a car had left the yard. The ATM requested the assignment crew to proceed west to retrieve the car. The assignment crew applied the requisite number of hand brakes to the remaining 15 cars in track F6, uncoupled the locomotives and proceeded with light engines to track F2, which was clear of cars, to access the west end of the yard. Upon arriving at the west end of the yard, the assignment crew noticed that car EFCX 604991 was missing from the cut of cars left on track F6 and realized that it was the car that had rolled uncontrolled.

With no derail in place to protect the main track, the car rolled uncontrolled for about 1 mile and traversed 2 public crossings, located at Central Avenue (Mile 109.78) and 115th Street (Mile 109.88), which were both equipped with grade crossing warning systems (GCWS). The car came to a stop at Mile 110.5 on the main track, within cautionary limits.^{Footnote 4} There were no injuries and no derailment. No dangerous goods were involved.

At the time of the occurrence, the sky was clear, there was a 10 km/h wind from the northeast, and the temperature was −4 °C.

1.2 Crossing activation and protection

With regards to crossing activation warning time and as referenced by the Transport Canada (TC) Grade Crossings Regulations (November 2014) (GCR), the TC Grade Crossings Standards (July 2014) (GCS) state the following:

16 CIRCUITRY

16.1 Warning Time

16.1.1  The time during which the warning system must operate, before the arrival of railway equipment at the crossing surface, must be the greatest of:

1. 20 seconds, unless the grade crossing clearance distance […] is more than 11 m (35 ft), in which case, the 20 seconds must be increased by one second for each additional 3 m (10 ft), or fraction thereof;
2. the Departure Time for the design vehicle […];
3. the Departure Time for pedestrians, cyclists, and persons using assistive devices […];
4. the gate arm clearance time, plus the time to complete the gate arm descent, plus 5 seconds;
5. the minimum warning time required for traffic signal interconnection […];
6. the time for the design vehicle to travel from the stopping sight distance, and pass completely through the clearance distance.^{Footnote 5}

The requirements under the GCR and the GCS are being phased in over a period of 7 years, some of which may be required earlier if a physical change to the component is made. For example, the GCWS requirements are only required by 28 November 2021, or before if modifications are made to the crossing. During and following the phase-in period, all crossings equipped with GCWS are governed by the specific crossing design plan for each crossing, which must be kept at the location of the grade crossing as required by the GCR which state the following:

Design plan – railway company

1. (1) The design plan for a warning system at a grade crossing must be kept at the location of the grade crossing and must clearly indicate the following information:
   1. the configuration of the components of the warning system;
   2. the layout of the circuitry and signal equipment;
   3. the parameters for the operation of the components of the warning system;
   4. the type of light, including the lens deflection angles, if applicable, and the alignment coordinates of the light units; and
   5. the details of any interconnection with a traffic control device.

Maintenance of warning system

(2) The warning system must conform to the design plan and must be maintained in accordance with article 17.1 of the GCS.

Design plan – modification or installation

(3) When a component of the warning system is modified or installed, a design plan reflecting the modification or installation must be prepared and must be kept at the location of the grade crossing until it is replaced by a revised design plan. ^{Footnote 6}

1.2.1 Canadian Rail Operating Rules

CROR Rule 103(b) states the following:

^{Footnote 7}

1.3 Subdivision information

The CP Sutherland Subdivision is a single main track that extends from Wynyard, Saskatchewan (Mile 0.0), to Saskatoon (Mile 113.5). Train movements are controlled by the occupancy control system (OCS) as authorized by the CROR and are supervised by a rail traffic controller (RTC) located in Calgary, Alberta. OCS territory is non-signalled (i.e., dark territory). Train traffic comprises about 7 trains per day for both the Central Avenue and 115th Street crossings.

1.3.1 Central Avenue crossing

Central Avenue is a 4-lane roadway that runs predominantly north/south and has a posted speed limit of 50 km/h. Trains in the area are limited to 10 mph. The vehicle traffic on Central Avenue averaged 16 000 vehicles per day for an estimated train/vehicle cross-product of 112 000.

The main track and the yard lead track traverse Central Avenue at an angle of 42 degrees. The roadway approaches have a slight ascending grade toward the crossing. The crossing is protected by standard railway crossbuck signs and GCWS protection, which consists of flashing lights, bell and gates, and cantilevered overhead flashing lights. On the main track, the GCWS protection design warning time was 37 seconds for trains travelling at 10 mph.

To reduce the inconvenience to the public due to trains switching in the yard, the Central Avenue crossing was designed with a short railway approach for the lead track. The short approach postponed the activation of the GCWS until a train was 240 feet from the crossing, and was designed to provide 32 seconds of warning time for trains travelling at 5 mph. However, the lead track speed limit was 15 mph. To ensure sufficient warning was provided at the Central Avenue crossing for rail traffic on the lead track, section 9.4 of CP's Timetable 32 for the Sutherland Subdivision for the Central Avenue crossing (Mile 109.78) stated the following:

The Central Avenue crossing met the crossing design plan requirements. However, automated GCWS, in general, are designed for the intended use of the crossing, and therefore provide sufficient warning times for the expected road and rail speeds. Consequently, while the crossing met regulatory requirements, it was not designed to protect against uncontrolled movements entering the main track from Sutherland Yard.

The download from the signal bungalow of the Central Avenue crossing was reviewed. It was determined that the GCWS protection was activated at 0235:55 and the crossing was occupied by the uncontrolled movement at 0236:05 (i.e., 10 seconds later).

Following the occurrence, the crossing warning cycle was video-recorded to observe the gate position during the GCWS activation (Figure 3). It was determined that the gates would not have been fully horizontal when the car, rolling uncontrolled, entered the crossing 10 seconds after the GCWS activation.

1.3.2 115th Street crossing

The 115th Street is a 2-lane roadway that runs predominantly east/west and has a posted speed limit of 50 km/h. Trains in the area are limited to 30 mph. The vehicle traffic averaged 2740 vehicles per day for a train/vehicle cross-product of 19 180.

The main track traverses 115th Street at an angle of 45 degrees. The roadway approaches have slight ascending grades toward the crossing. The crossing is protected by standard railway crossbuck signs and GCWS protection, which consists of flashing lights, bell and cantilevered overhead flashing lights. Trees and residential buildings along the railway right-of-way obscure the rail line for both eastbound and westbound roadway traffic.

A download for the signal bungalow at the 115th Street crossing was not available for review. However, activation of the crossing lights had reportedly been observed by CP staff from the yard office (Mile 109.7).

1.4 Uncoupling lever

Coupler assemblies are located at each end of rail cars to connect them to other cars. When cars are being connected, the coupler knuckle is designed to automatically transition from an open position to a closed-and-locked position. When knuckles are coupled together, the coupler knuckle rotates about the knuckle pin such that the pulling face of the knuckle engages with the pulling face of the adjoining coupler knuckle. The knuckle tails then retract into each coupler body. Once fully retracted, the tail of the knuckle is restrained by a locking block. The locking block is designed to drop down between the tail of the knuckle and the coupler body to prevent the knuckle from opening unintentionally.

To uncouple cars, coupler knuckles are opened manually by operating an uncoupling lever. This lever is operated from beside the car so that the employee does not have to enter between the cars (Figure 4). When manually operated and lifted, the uncoupling lever moves the lock-lift assembly vertically, which in turn lifts the locking block and frees the tail of the knuckle. Further rotation of the uncoupling lever forces the leg of the locking block to engage the knuckle thrower, which then opens the knuckle.

Undesired release of the knuckle is avoided by the anti-creep design of the lock-lift assembly, which prevents upward vertical movement of the locking block, unless the lock-lift assembly is activated by the uncoupling lever. The uncoupling lever cannot be used to secure the locking block. Once the locking block has been lifted by the uncoupling lever, the cars must be separated and then recoupled to lock the knuckle in place.

1.5 Use of derails

A derail (Figure 5) is a device that is designed to intentionally derail rolling stock in order to

• protect against an uncontrolled movement rolling out onto main track or becoming foul of another track;
• limit the movement of railway equipment to prevent injury to employees working on a track; or
• prevent damage to other equipment and structures.

While in the derailing position, a derail lifts the flange of a wheel up, deflecting the wheel laterally to drop clear of the rail head on the field side of the track. An unplanned movement is stopped when the wheels become imbedded in the track ballast.

There are other methods of protecting against an uncontrolled movement rolling out onto main track or becoming foul of another track. These other methods include the following:

• hand brakes;
• air brakes; and
• if in a yard: bowled terrain, stop block or wheel chocks.

1.5.1 Rules Respecting Track Safety

Subpart E of the TC-approved Rules Respecting Track Safety, also known as the Track Safety Rules, states (in part):

^{Footnote 8}

1.6 Remote control locomotive system

The RCLS consists of 3 components:

1. remote control locomotive(s) (RCL);
2. an onboard control computer, which is mounted inside the RCL to interface with the controls; and
3. an operator control unit (OCU), commonly referred to as a Beltpack. The OCU is a lightweight remote control device that attaches to the operator's safety vest.

Crew members can pass control of the locomotives back and forth between them as required (pitch and catch), but only 1 crew member can have control at a time. The OCU is equipped with (but not limited to) a speed selector, a forward and reverse selector, and a brake selector that includes an emergency brake feature (Figure 6).

1.7 Canadian Pacific Railway use of remote control locomotive systems

Historically, a yard crew consisted of 3 employees: a locomotive engineer (LE), a yard foreman to coordinate yard movements, and a yard helper. The foreman and the helper provided yard movement instructions by radio to the LE who controlled the locomotive.

In the late 1980s, RCLS operations were introduced in Canada. This technology was approved by TC for yard switching and humping operations in accordance with the CROR. The introduction of RCLS operations eliminated the role of the LE in yard operations. Control of the locomotive became the responsibility of a yard foreman and/or a yard helper, who were typically qualified conductors.

In the early 1990s, CP initially introduced RCLS operations at most of its major terminals across Canada and the United States. In the mid-2000s, CP began to move away from RCLS operations, primarily due to reliability issues at that time. In 2011, RCLS operations were discontinued at Sutherland Yard. Since that time, the reliability of the technology has improved.

In 2015, CP re-implemented RCLS operations across Canada for switching within yards and for servicing industrial customers that were typically located no further than 20 miles from CP yards. RCLS assignment crews consisted of 2 rules-qualified conductors who had also completed RCLS training.

Although the speed on RCLS yard assignments was limited to 15 mph, there were no tonnage or length restrictions. At the time of the occurrence, RCLS operations were planned or had been implemented at 15 CP locations, including Sutherland Yard. CP has plans to expand RCLS operations further across the country in an effort to reduce operating costs while increasing safety and efficiency (Appendix A).

1.8 Canadian Pacific Railway remote control locomotive system training

At CP, RCLS training is conducted separately from the conductor training program. With the re-implementation of RCLS operations, training was being performed locally and was facilitated by a contractor. The trainees were already qualified as conductors. Any conductor who had previously qualified as an RCLS operator was required to be re-trained.

RCLS training consisted of 1 week of classroom study followed by 2 weeks of practical training under the supervision of 2 RCLS trainers who worked for the contractor. A portion of the classroom component included some RCLS locomotive movements in a secluded area of the yard where the trainees could practice using the RCLS. The training focused on teaching employees how to

• safely start and shut down an RCLS locomotive;
• identify the RCLS components on a locomotive and the OCU (Beltpack);
• set up the locomotive and Beltpack for operation;
• conduct locomotive inspections and carry out preliminary tests;
• identify, troubleshoot and reset faults that may occur during a work shift;
• control the speed and braking of a train.

At Sutherland Yard, once the classroom component of the training was completed, the new RCLS operators were assigned to an on-job RCLS training assignment that replaced a regular yard assignment. This practical training component allowed the trainees to put their knowledge into practice by performing regular yard work accompanied by 2 contract trainers who shadowed them for the duration of the practical training. The RCLS trainers consisted primarily of retired LEs. The trainers were not CROR-qualified by the host railway, but each trainer had e‑RAILSAFE credentials.^{Footnote 9} The trainers were responsible for progress reports and for the qualification sign-off, in conjunction with a local CP supervisor. Upon completion of the practical training, the employees were considered RCLS-trained and began working in this capacity.

1.9 Assignment crew member training

On 06 July 2015, the assignment crew members both commenced conductor training.

On 07 January 2016, the helper qualified as a conductor after completing 90 training trips. Once qualified, the helper was placed on the spare board for about 3 days and then began work in the yard as part of a three-person yard crew that also included an LE. This provided an opportunity for the helper to receive guidance from a more experienced crew member when required.

On 27 January 2016, the foreman qualified as a conductor after completing 75 training trips. Once qualified, the foreman was placed on the spare board for 5 days and then was awarded a position in the yard working as both foreman and helper as part of a three-person yard crew that also included an LE. This provided an opportunity for the foreman to receive guidance from a more experienced crew member when required.

On 29 February 2016, the assignment crew commenced RCLS classroom training. On 21 March 2016, after the crew had completed 2 weeks of RCLS practical (field) training, the company decided that they required an additional week of practical training accompanied by 1 trainer located in the locomotive cab. The assignment crew was scheduled to complete the extra week of RCLS practical training on 28 March 2016.

As newly qualified employees, both crew members wore green vests while on duty.^{Footnote 10}

1.10 Sutherland Yard information

Sutherland Yard is located at Mile 109.7 of the Sutherland Subdivision, in a suburban neighbourhood, 3 miles east of Saskatoon. At the east end of the yard, there is a grade that crests at about Mile 109.05. From the crest, there is a westward descending grade that averages about 0.25%, with the steepest grade (0.40%) near the west yard switch (Mile 109.83).

Due to the grade, the west end of tracks C1 to C5 and tracks G5 to G7, which are mainly used for car storage, are protected using 6 hinged derails. However, at the lower west end of the yard, track D1, the west-end F-yard lead track, and tracks F1 to F13 and G1 to G4, which are primarily switching tracks, are not equipped with derails.

1.10.1 Sutherland Yard crewing

A total of 77 operating employees (conductors and LEs) worked out of Sutherland Yard.

In January 2016, CP reduced the number of yard crews from 3 three-person crews per day to 2 three-person crews per day. Although traffic volumes remained relatively constant at Sutherland Yard during this period, to reduce switching workload, cars were marshalled more strategically at other yards. With the improved marshalling, reduced staff accomplished the required work through efficiencies gained from switching without air and from the use of overtime when necessary.

In March 2016, CP commenced RCLS training for yard crews and resumed using 3 crews per day during the RCLS training period. However, each RCLS crew consisted of 2 trainees accompanied by 2 trainers. CP had planned on training 16 employees in RCLS operations. Of the 16 employees, 11 had less than 18 months of operating experience. Employees who had not received RCLS training would not be permitted to work as RCLS operators. Once RCLS crew training was completed, CP planned to return to 2 yard crews per day with each crew consisting of 2 qualified conductors.

Two of the crews had just completed RCLS training the week before the occurrence and were working their normal RCLS yard shifts. The third crew was the assignment crew. The assignment crew was still in training and was scheduled to finish training at the end of their shift the day following the occurrence (28 March 2016).

Each week, local assignments were posted for bidding. The positions were awarded to the most senior employees who had submitted bids. Some positions were more favoured than others due to the rate of pay, days off, and hours of work. Typically, the evening and nighttime shifts were the least desirable. Yard positions were regarded as the least desirable as the pay rates are the lowest.

When no job bids were received for a specific position, the position was normally awarded to the employee with the least amount of seniority. As such, it was not unusual for the 2 most junior employees at the terminal to work yard assignments together, particularly during the evening and nighttime shifts. In this occurrence, the assignment crew was composed of the 2 most junior and least experienced operating employees at Sutherland Yard.

In contrast, companies in other transportation industries, such as aviation, have policies in place to minimize the risk of 2 inexperienced operators working together.^{Footnote 11}

1.11 Operational changes at Sutherland Yard

In early 2016, CP implemented a number of operational changes at Sutherland Yard, including

• reduction in yard crews;
• switching operations without the use of air brakes;
• re-introduction of RCLS operations; and
• introduction of a PPZ.

1.11.1 Switching without air brakes

Until January 2016, much of the switching had been performed in Sutherland Yard using train automatic brakes (i.e., with air applied). The decision about whether to switch with air or without air was left up to the crew. In January 2016, to help expedite switching, a local CP practice was implemented that required yard movements in Sutherland Yard to be performed without the use of train automatic brakes (i.e., no air applied) in most circumstances.

During switching without air applied, cars are manually uncoupled and then "kicked" (i.e., shoved and separated) and left to roll on their own momentum into tracks, normally at a slow speed of about 4 mph or less. To safely kick cars, the first car(s) into each track must be secured by the use of a sufficient number of hand brakes before other cars are kicked into the track. To determine the sufficient number of hand brakes, a crew must take into account the total number of cars that will be kicked into the track. The number of hand brakes applied is not recorded, nor is there a requirement to do so. Cars that have been kicked usually stop once they have contacted and coupled with the secured car(s).

In comparison, during switching with air applied, cars must be shoved to a stop for each move since any separation of the cars while in movement will result in an emergency brake application due to the separation of the air hoses.

1.11.2 Re-introduction of remote control locomotive system operations

In early March 2016, RCLS operation was re-introduced in Sutherland Yard.

CP posted a bulletin advertising 6 yard RCLS training positions. Since only 3 experienced employees bid for the positions, 3 other employees with the least amount of seniority were assigned to the other positions.

The 6 employees were then provided with RCLS training. After 3 weeks of training, 2 crews became RCLS-qualified and began normal RCLS operations. The third crew (the assignment crew) were provided with an additional week of practical training during which 1 trainer would be located in the locomotive cab.

1.11.3 Introduction of a point protection zone in Sutherland Yard

On 02 March 2016, CP issued Operating Bulletin No. SSA-012-166 to all Operations, Mechanical and Engineering employees. The bulletin established a PPZ in Sutherland Yard for the first time, effective 07 March 2016. The PPZ extended from the 8th Street crossing (Mile 107.26) on the main track to the fouling point on the east end of tracks F1 through F13 and tracks G1 through G6 (Figure 2). The bulletin included all the details and instructions associated with the use of the PPZ and outlined the following:

• The PPZ would become active when permission was requested by an RCLS crew and granted by an ATM.
• The activation of the PPZ ensured that
• the zone was "known to be clear" (i.e., clear of equipment and conflicting movements), and therefore CROR Rule 105^{Footnote 12} and Rule 115^{Footnote 13} would not apply;
• there were no other track protections in place; and
• all switches were properly lined and secured.

Movements requiring access to the PPZ had to request permission from the RCLS assignment crew to enter the PPZ and would be governed by that assignment's instructions.

1.12 Railway Safety Management System Regulations, 2015

On 01 April 2015, the Railway Safety Management System Regulations, 2015 (SMS Regulations) came into force and replaced the 2001 SMS Regulations. Many of the changes incorporated into the 2015 SMS Regulations responded to the recommendations from the 2007 Railway Safety Act Review and from the 2008 study on rail safety by the Standing Committee on Transport, Infrastructure and Communities.

Under these regulations, federally regulated railway companies must develop and implement a safety management system (SMS), create an index of all required processes, keep records, notify the Minister of proposed changes to their operations, and file SMS documentation with the Minister when requested.

The SMS Regulations also require that a company develop and implement a risk assessment process (Appendix B). Sections 5(f) and 15(1) of the SMS Regulations state in part that a railway company must conduct a risk assessment when it proposes a change to its operations that may affect the safety of the public or personnel or the protection of property or the environment.

Such changes include but are not limited to

• the introduction or elimination of a technology, or a change to a technology;
• a change affecting personnel, including an increase or decrease in the number of employees or a change in their responsibilities or duties.

The regulations require that the risk assessment identify the risks that require remedial action as well as the remedial action taken.

Sections 5(k) and 28(1) of the SMS Regulations state in part that a railway must have a process with respect to scheduling. The scheduling process outlined in the regulations requires that the company apply the principles of fatigue science when scheduling the work of operating employees. There is no requirement to consider the experience of operating employees who may be paired together for work.

Sections 25 to 27 of the SMS Regulations require a railway company to have a process for managing knowledge. The company must establish a list setting out

• the duties that are essential to safe railway operations;
• the positions in the railway company that have responsibility for the performance of each of those duties; and
• the skills and qualifications required to perform each of those duties safely.

A railway company must also include in its SMS

• a plan for ensuring that an employee who performs any of the duties referred to in the list has the skills, knowledge and qualifications required to perform their duties safely.
• a method for verifying that an employee who performs any of the duties referred to in the list has the skills, knowledge and qualifications required to perform their duties safely.
• a method for verifying that a supervisor who performs any of the duties referred to in the list has the skills, knowledge and qualifications required to perform their duties safely.

With regards to managing knowledge, CP had a detailed list of essential duties for LEs and conductors, and a process for ensuring and verifying the required skills and qualifications for the performance of their duties essential to safe railway operations. However, CP did not have such a list or process for RCLS operators and related Beltpack operations. While CP conducted RCLS efficiency testing to ensure that employees had the requisite skills, qualifications and knowledge for safe operations, CP did not consider RCLS to be an essential service, and it was not contained in CP's SMS plan for managing knowledge.

1.12.1 A Guide for Developing, Implementing and Enhancing Railway Safety Management Systems

In 2010, to assist railways with implementing SMS, TC developed a guidance document entitled Railway Safety Management Systems – Guide: A Guide for Developing, Implementing and Enhancing Railway Safety Management Systems (TP 15058E).

The guide indicates that risk assessments should be documented, including any control strategies implemented, and stresses that companies must analyze any new activities and major operational changes. In addition, it states that a complete analysis of existing operations is not required if the current risk mitigation strategies are documented. The guide also states the following:

^{Footnote 14}

1.13 Risk assessment for remote control locomotive system operations and point protection zone at Sutherland Yard

In accordance with the SMS Regulations, CP has an SMS plan in place and conducts risk assessments when changes to operations occur.

Starting in January 2016, several operational changes were implemented by CP at Sutherland Yard. As a result of these operational changes, CP completed a combined risk assessment that covered RCLS operations and the introduction of a PPZ. The combined risk assessment was led by a superintendent and 7 other participants that included an LE, a consultant involved in RCLS implementation and training, and a number of managers from Operations, Engineering and Mechanical. The risk assessment did not consider the impact of reducing the number of train crews, or the change in local practice to primarily switching without air.

The risk assessment identified a number of potential hazards associated with the proposed changes, 1 of which was task overload for operators. The risk assessment also identified a number of undesired events or consequences as potential outcomes from these hazards. However, the risk assessment did not specifically identify a potential hazard related to crew inexperience or the potential consequence of an uncontrolled movement. As such, remedial action to address these issues was not considered.

1.14 Training and qualification of railway operating employees

1.14.1 Railway Employee Qualification Standards Regulations

In Canada, federally regulated railways must abide by the Railway Employee Qualification Standards Regulations^{Footnote 15} (the regulations) that were issued in 1987. These regulations establish the minimum qualifications for LEs, transfer hostlers, conductors, and yard foremen. These regulations apply to all railway employees performing the duties of the specified occupational category, whether the employee is unionized or not. An excerpt from the regulations is contained in Appendix C.

Since the regulations came into force, there have been significant operational changes within the rail industry, including the following: crew size has been reduced, RCLS operations have been widely implemented across the country, and the use of management crews qualified through accelerated training has become common at both CP and the Canadian National Railway Company (CN). Despite these significant changes in railway operations, the regulations have not been modified in 30 years.

When the regulations came into effect, most railway operating employees were unionized and the use of management crews was not widespread. At that time, there was a graduated promotion from unionized brakeman/yard helper to conductor/yard foreman and then to LE. As the industry and technology evolved, the role of brakeman was eventually eliminated, 2 years of experience as a brakeman was no longer required, and all new operating employees were hired as conductors. As a result, new unionized employees were considered qualified as yard helper, conductor and yard foreman as soon as they completed their conductor training.

Although the regulations require railway companies to file and report to TC information on their employee qualification program and any changes made to the program, the filings can be in the form of a summary and do not necessarily include all course content. While TC may occasionally conduct a cursory review of company submissions, the regulations do not require TC to review the course content in detail or to approve it.

Over the years, training delivery has changed, and unionized conductor training has been accelerated to the point where some new conductor candidates can now qualify within 6 months.

Subsection 19(2) of the regulations requires that a railway company establish and modify its employee training programs in consultation with the trade unions representing its employees in the respective occupational categories. This means that specific qualification requirements such as course content, experience required for qualification (time served in the trade or number of trips), and graduated qualification for unionized candidates in all occupational categories are negotiated between the company and the respective trade unions.

1.14.2 Employees not covered by the regulations

Training programs for unionized operating occupational categories, such as RCLS operators and RTCs, are not covered by the regulations, but most railways have training plans and manuals in place for those positions. In addition, given that the requirements for duration of training, number of trips and experience required are contained in collective agreements, they do not apply to company managers and supervisors who carry out LE and conductor duties. This gap has enabled railway companies to develop and implement accelerated qualification training programs for management employees with no pre-requisite for any operational experience.

CP requires all operations managers to be qualified conductors or LEs and to maintain their qualifications. For all other CP non-unionized employees, the expectation is that they become qualified conductors or LEs, unless they are medically unfit to do so. CN has similar practices. Both railways now periodically use management crews to operate trains at various terminals when it becomes necessary. Management crews can be sent to any terminal on the railway network during shortfalls in staffing in a service area. As such, there have been situations where management crews have operated trains without adequate training, which led to a serious incident^{Footnote 16} and an accident.^{Footnote 17}

CP's training for unionized and management railway operating employees met current regulatory requirements.

1.14.3 Railway Safety Act review panel final report (2007)

In December 2006, the Minister of Transport, Infrastructure and Communities initiated the Railway Safety Act review. The review was aimed at identifying gaps in the Railway Safety Act and making recommendations to strengthen the regulatory regime to meet the changing nature of the railway industry and its operations. In November 2007, the Railway Safety Act review panel issued its final report entitled Stronger Ties: A Shared Commitment to Railway Safety – Review of the Railway Safety Act, to the Minister.

Section 9.5 of the report dealt specifically with training for operating crews and stated (in part):

In the United States, the FRA [Federal Railroad Administration] certifies all locomotive crews.^{Footnote 18} As well, the Department of Transportation in the U.S. certifies all aviation and marine crew members. In Canada, Transport Canada also certifies all aviation and marine crew members, but there are no provisions for Transport Canada certification of railway operating employees.

Transport Canada, Rail Safety Directorate has programs in place to address the qualifications of locomotive crews and rail traffic control positions. Nonetheless, there is a perception that because sole responsibility for certification of the candidates rests with the industry, there may not be sufficient objectivity. While consideration was given to recommending alternative approaches to the certification of the running trades, we understand that the current regulation will be superseded by new training rules and that these rules will address this issue.^{Footnote 19}

Consequently, the Railway Safety Act review panel did not issue a recommendation relating to operating crew training.

In recognition that the regulations were out of date and to help address some of the operational changes that had occurred since the regulations were issued, the railway industry, including the Railway Association of Canada (RAC), drafted the Rules Respecting Minimum Qualification Standards for Railway Employees. In 2009, the rules were submitted to TC for approval. While TC initially approved the rules, the regulations were never repealed. Consequently, the regulations remain in force to this day.

1.14.4 Regulatory requirements for operating crews in the United States

Railways in the U.S. are required to ensure that only employees who meet the minimum federal safety standards will serve as LEs and conductors. These federal safety standards are specified in the U.S. Department of Transportation (DOT) Code of Federal Regulations (CFR), Title 49, Part 240 - Qualification and Certification of Locomotive Engineers (October 2012) and in DOT CFR 49, Part 242 - Qualification and Certification of Conductors (October 2012). The FRA is responsible for the oversight and enforcement of these regulations.

The standards prescribe the minimum federal safety standards for the eligibility, training, testing, certification, and monitoring of operating employees, but do not restrict a railway from adopting and enforcing more stringent requirements. Appendix D contains a summary of the U.S. regulations for operating crews.

1.15 Potential gaps in regulatory overview in Canada

A TSB review of historical and current railway work and training practices for unionized and management operating crews was conducted based on previous TSB reports, the Railway Safety Act review panel final report (2007), and relevant regulations in Canada and the U.S. The review identified potential gaps in the Railway Employee Qualification Standards Regulations in the following areas:

• qualification standards,
• graduated qualification,
• RCLS operations,
• management crews, and
• training and regulatory oversight.

1.15.1 Qualification standards

TC certifies all aviation and marine crew members, but there are no provisions for the certification of railway operating employees. The rail industry has sole responsibility for the qualification of candidates. Since there is no independent regulatory oversight for the qualification of operating crews in Canada, there might not be sufficient objectivity concerning operating crew qualification training.

The U.S. regulations require that a practical training component be completed in order for an operating employee in any occupational category to qualify or requalify for a given position while Canadian regulations contain no such requalification requirement.

The Canadian regulations contain qualification standards for on-job training instructors for LEs and transfer hostlers, but no requirement for on-job training instructors for conductors or foremen. This means that an inexperienced newly qualified conductor or foreman could be requested to act as an on-job training instructor for subsequent conductor candidates.

Since the regulations only apply to company employees, there are no qualification standards for contract instructors (trainers) who are not employed by the company. Consequently, there is no way to ensure that contract instructors are adequately qualified to deliver training or act as examiners for any occupational category.

1.15.2 Graduated qualification

In the past, there was a more graduated approach to operating crew qualification that presented more opportunities for mentoring as new operating employees gained experience. With the loss of the brakeman position and conductors operating RCLS, the opportunities for mentoring that previously existed within crews are now limited with the accelerated training process.

With the exception of unionized LEs, on-job training instructors for LEs, and transfer hostler candidates

• The regulations contain no graduated qualification system for any of the other occupational categories. Consequently, some operating employees might not acquire sufficient on-job experience to work independently and safely in all situations.
• The regulations do not require an experienced employee to work with a junior employee to enhance opportunities for mentoring. Presently, conductors with little experience may be paired together working as an RCLS assignment crew.

1.15.3 Remote control locomotive system operations

The regulations came into force in 1987, which preceded the widespread implementation of RCLS technology in the rail industry. The regulations do not require employees in any occupational category to receive training specific to RCLS operations. Similarly, there is no requirement for RCLS operators to requalify in RCLS operations.

In Canada, conductors normally operate RCLS yard assignments (Beltpack) within rail yards. These assignments can enter the main track to take up head room to assist with switching operations. Conductors can also operate transfers on the main track for distances of up to 20 miles at speeds of up to 15 mph, with no tonnage or train length restrictions. Conductors receive little training in locomotive operation or train handling, nor do the current regulations require such training.

1.15.4 Management crews

A new manager may take accelerated training and then become responsible for training and qualifying new employees, even though the manager might have little experience.

Management crews can be sent anywhere in the country to make up for shortfalls in staffing in a service area. As such, management crews might operate trains over any subdivision without having adequate familiarization training.^{Footnote 20}

1.15.5 Training and regulatory oversight

The regulations contain no guidance outlining requirements for course training material, test content or test delivery for any of the occupational categories.

Despite the fact that RTCs are involved in most aspects of train operations and are responsible for the safe movement of trains over a given territory in accordance with existing rules, bulletins and company instructions, there is no occupational category and no corresponding training or requalification requirements for them.

There is no occupational category for RCLS operators and no corresponding training or requalification requirements for them either.

When the regulations were written, railways had a graduated career progression within the operating trades. There were more opportunities for employee mentoring over a period of time, which allowed employees to gain valuable on-job experience. The current accelerated training program for unionized and management staff does not offer these benefits.

U.S. regulations require course training material or tests to be reviewed, critiqued or certified by the regulator. Canadian regulations have no such requirements. Although railway companies provide TC with information related to their training programs, TC does not assess the adequacy of the railway training programs and provides no further overview with regard to the training of railway operating employees.

Operating employees can be laid off for extended periods of up to several years, and most railways have policies in place outlining steps for familiarization or refresher training in preparation for reintegration in the workforce. However, the application of the policies can vary between terminals and individual employees based on their experience. Furthermore, there are no regulatory requirements for mandatory familiarization or refresher training for any of the operational categories when operating employees return to work.

1.16 TSB investigations outlining deficiencies in operating crew training regulations

Since 2002, the TSB has investigated 4 occurrences (including 1 fatal accident involving a crew member) that were directly related to deficiencies in operating crew training and related gaps in the regulations.^{Footnote 21}

1.16.1 R02W0060 – CN train derailment at Mile 251.3, Redditt Subdivision

On 26 April 2002, westward CN freight train E-201-31-24 was departing Winnipeg, Manitoba, along the north main track of the Redditt Subdivision. As the train traversed a crossover from the north main track to the south main track, 8 cars derailed at Mile 251.3. About 300 feet of track, a roadway underpass, and the line-side fibre-optic system buried in the grade were damaged. As a precaution, 6 homes from an adjacent residential area were evacuated. There were no injuries or release of product.

Regarding operating crew training, the investigation determined the following:

• The LE was first trained in 1976 and had never received any subsequent practical instruction on the use of locomotive high-capacity extended-range dynamic brake (DB) or the risks associated with its use in train-handling operations. This suggests that training for LEs had not kept pace with improvements in DB technology and train-handling methodologies. It further raises a question as to the adequacy of current LE training as overseen by TC under the existing regulations. Other TSB investigations^{Footnote 22} have also identified the inappropriate use of locomotive DB as a factor that contributed to the accidents.
• The regulations contained no requirement for a practical component to be completed for an LE to requalify and missed an opportunity to familiarize LEs with new equipment and train-handling techniques.
• The regulations did not require the regulator to review the content of training material, nor do they outline a mechanism for the regulator to recommend additions or improvements to the training criteria as operations in the rail industry change.

TC responded to the report and indicated that, in fall 2003, it would commence a review of the Railway Employee Qualification Standards Regulations. Based on the results of the review, TC would make recommendations to the industry concerning LE training and dynamic testing.

1.16.2 R04W0035 – CN train derailment at Symington Yard at Mile 145.20, Sprague Subdivision

On 17 February 2004, CN yard assignment YATS-02-17 was performing switching operations at Symington Yard in Winnipeg, Manitoba. At approximately 1150 Central Standard Time, the movement derailed 17 intermodal container car body platforms at switch W4RE at the east end of the west receiving tracks (Mile 145.20 of the Sprague Subdivision). At the time of the occurrence, the RCLS operator was located in a motor vehicle, well in advance of and facing away from the movement, as permitted by the exception to CROR Rule 115, which left the movement unmonitored. Furthermore, there were no regulatory or company guidelines governing the use of a motor vehicle when assisting with RCLS switching operations. About 1600 feet of track was damaged. There were no injuries, and no dangerous goods were involved.

Regarding operating crew training, the investigation determined that regulatory overview of training and requalification of RCLS operators has not kept pace with improvements in technology and operations.

TC acknowledged that the regulations were outdated and should be revised. TC was considering creating a working group to revise the regulations.

1.16.3 R13W0260 – CN employee fatality at Mile 61.0, Tisdale Subdivision

On 18 November 2013, CN freight train L586-41-18 was switching into the Murphys interchange track at Mile 61.0 of CN's Tisdale Subdivision, near Tisdale, Saskatchewan. At about 1818 Central Standard Time, during the hours of darkness, while reversing westward at approximately 12 mph, the train struck and seriously injured a conductor trainee. The employee was transported to hospital by ambulance, but succumbed to injuries during transport.

Regarding operating crew training, the investigation determined the following:

• The conductor trainee, who was unfamiliar with the territory and working without direct supervision, misapplied a number of safety-critical operational procedures. If conductor trainees work independently, without direct supervision in close proximity, there is an increased risk of error, which can result in an accident.
• If there is a reduced training period, an absence of direct supervision, and a lack of continuity and assessment among trainers, conductor trainees might not apply rules and instructions correctly in the field, which increases the risk of an accident.
• The regulations require railways to file with TC a description of all employee training programs and subsequent changes related to each occupational category. Railways are also required to submit an update report to TC on their employee training programs each year. Although TC is provided with the information, the adequacy of the training program for each respective railway is not assessed. Consequently, once railway companies have satisfied the training, consultation and reporting requirements of the regulations, TC provides no further overview with regard to the training of railway operating employees.
• If there is no regulatory oversight of the effectiveness of training programs for railway operating employees, there is an increased risk that these programs might not be sufficiently robust to ensure that trainees have adequate practical experience to work independently and safely.

The investigation identified that, despite TC's approval of new rules in 2009, these rules have never come into force because the existing regulations were not repealed.

1.16.4 R15V0046 - CP movement exceeds limits of authority at Mile 103, Cranbrook Subdivision

On 11 March 2015, a CP RTC stopped CP freight train 672-024 near Mile 102 on the Cranbrook Subdivision after the train had departed Cranbrook, British Columbia, and travelled east for 5 miles without authorization. A management crew was operating the train. Although qualified for their respective positions, the management crew members were not familiar with the territory.

The investigation determined the following:

• The incident occurred when the train was operated past the east cautionary limits sign at Cranbrook, without the required clearance. The train continued to operate another 5 miles into the OCS territory before the RTC requested the train to stop.
• During earlier radio communication, the crew misinterpreted a statement as confirmation that the cautionary limits at Cranbrook extended all the way to Fort Steele, British Columbia.
• With an incorrect understanding of the boundaries of the cautionary limits at Cranbrook, the train crew's mental model was that no additional authority (i.e., OCS clearance) was required to operate on the main track all the way to Fort Steele.
• Unlike operating employees whose primary job is to operate trains, management employees who operate trains on a part-time basis are not likely to gain the same level of experience and familiarity with the territory.
• With shorter training periods, fewer on-job training trips, and fewer prerequisites prior to starting training, it may be difficult for management employees to acquire the necessary knowledge and experience to become fully proficient with operating trains.
• For railway management employees who operate trains, if the regulatory framework does not adequately address the requirements for training, certification, and territory familiarization, trains can be crewed with management employees who are not sufficiently experienced or familiar with the territory, increasing the risk for unsafe train operations.

1.17 Slips of attention during skill-based tasks and operator experience

Among the errors most frequently associated with routine, well-practiced tasks are slips of attention. This type of error occurs when a check on the progress of a task sequence is mistimed or does not occur because the operator's attention is focused on another aspect of the task or some other preoccupation.

Because slips of attention typically occur in routine, well-practiced tasks, they can be common errors for both novice employees and experienced employees. However, a necessary condition for these errors to occur is the presence of attentional capture, where the operator's attention is focused on another aspect of the task. Given that operators who are learning new tasks or new aspects of a familiar task will need to devote more attention to these new, unpracticed elements of their roles, the increased demands on attention can create more opportunity for attentional capture errors.^{Footnote 23}

Employees gain competence through on-job experiential learning, which is the process of learning through experience, and the observation of more experienced employees performing the work properly.

As time progresses, effective experiential learning enhances a person's judgement, skills and effectiveness. As a person gains experience, tasks become familiar and practiced, thereby decreasing the demands for attention toward aspects of the task that were previously new, and decreasing the potential for attentional capture errors.

1.18 Federal Railroad Administration report on the safety of remote control locomotive operations

In 2002, to better understand the safety implications of remote control locomotive operations, the FRA initiated a multi-study research program.

In March 2006, the FRA published the Final Report: Safety of Remote Control Locomotive (RCL) Operations.^{Footnote 24} This report identified the potential for task overload of RCLS operators given that they would be required to conduct additional tasks that were previously the responsibility of LEs or switch persons in the U.S. The report stated:

^{Footnote 25}

The report also highlighted the potential safety implications of pairing inexperienced crew members together given the high level of turnover expected across the rail industry.^{Footnote 26}

In the past, many of the employees who were initially trained in the use of RCLS technology had significant railway experience to draw on. Experienced employees were familiar with railroad safety, operating rules, and the intricacies of working within busy classification yards.^{Footnote 27}

The potential for an operator to perform in high-demand situations is dependent on the amount of attentional resources available to perform the work. For example, preparing and planning switching movements and engaging in RCLS operations, while coordinating and approving any movements through a PPZ, increase workload and demands on attention, which reduces the available capacity for other tasks. If an operator is required to perform multiple tasks that require sequential and focused attention, and one task suddenly requires more attention, performance on the remaining tasks could be hampered.^{Footnote 28}

In May 2006, the FRA published the Final Report: A Comparative Risk Assessment of Remote Control Locomotive Operations versus Conventional Yard Switching Operations. The objective of this study was to obtain a better understanding of remote control locomotive operations and its relative safety compared to conventional yard switching operations. The study focused only on yard switching operations and did not address remote control locomotive operations on main tracks, spur/industrial tracks, or sidings. The report noted that the FRA had only begun to collect accident data for remote control operations and that the data collection process would require several years before sufficient data are available to analyze.

1.19 Best practices in developing competence

The Rail Safety and Standards Board in the United Kingdom published a guidance document entitled Good Practice Guide on Competence Development. The guide, developed in consultation with the railway industry, was intended to provide best practices with respect to developing comprehensive systems to manage competence rather than simply ensuring compliance with regulations.^{Footnote 29}

Competence refers to the overall ability to function effectively in a position and results from the combination of functional, technical and non-technical skills. According to the guide, non-technical skills include the ability to maintain situational awareness, decision making and workload management, which have been shown to play a key role in incidents and accidents.^{Footnote 30}

When learning a role, competence will develop along a continuum from novice, not yet competent, proficient and expert.^{Footnote 31} In moving across this continuum, learners proceed through a series of predictable stages. When a minimal level of competence is attained, learners can be described as being "consciously competent" or at a stage where tasks may be performed effectively but require a significant level of attentional resources. As learners become proficient or expert, tasks become more automatic and require fewer attentional resources.^{Footnote 32}

1.20 TSB occurrence statistics involving unplanned/uncontrolled movements

From 2008 to 2017, there were 541 occurrences^{Footnote 33} reported to the TSB related to unplanned/uncontrolled movements among all railways in Canada (Table 1).

Table 1. TSB occurrences involving unplanned/uncontrolled movements between 2008 and 2017

Uncontrolled movement due to	2008	2009	2010	2011	2012	2013	2014	2015	2016	2017	Total
Loss of control	6	0	2	3	0	3	0	1	4	2	21
Switching without air	17	14	10	16	12	24	21	22	18	21	175
Securement	25	37	25	32	43	42	38	35	29	39	345
Total	48	51	37	51	55	69	59	58	51	62	541

Uncontrolled movements generally fall into 1 of 3 causal categories:

1. Loss of control – When available air brakes or locomotive systems are unable to hold a train left standing while attended or when an LE or a Beltpack operator cannot control a train when using the available air brakes.
2. Switching without air – When a movement is switching with only the use of the locomotive air brakes (i.e., no air brakes are available on the cars being switched). When an uncontrolled movement occurs, these situations can result in the cars exiting a yard, siding or customer track and entering onto the main track.
3. Securement – When a car, a cut of cars or a train is left unattended and begins to roll away uncontrolled, usually due to
   • no hand brake applied or insufficient number of hand brakes applied; and/or
   • a car (or cars) is equipped with faulty or ineffective hand brakes; and/or
   • the train air brakes release for various reasons.

Table 2 provides a breakdown of the occurrences by consequences.

Table 2. Consequences of uncontrolled movements

Consequence	2008	2009	2010	2011	2012	2013	2014	2015	2016	2017	Total
Derailment of 1 to 5 cars	23	29	18	22	26	26	28	28	27	28	255
Derailment of more than 5 cars	5	1	0	0	2	2	0	1	2	1	14
Collision	24	30	24	32	28	40	35	32	23	34	302
Affected the main track*	9	4	4	7	7	10	6	4	5	5	61
Involved dangerous goods	16	12	8	10	7	14	17	14	9	18	125
Injuries or fatalities	1	1	0	0	2	49	0	0	1	1	55

* Originated on the main track, moved onto the main track, or fouled the main track.

Of the 541 occurrences:

• Loss of control was the primary factor in 21 (4%) of the occurrences.
• Switching without air, as was the case in this occurrence, was the primary factor in 175 (32%) of the occurrences.
• Insufficient securement was the primary factor in 345 (64%) of the occurrences.
• There were 302 unplanned/uncontrolled movements (56%) that resulted in a collision.
• There were 61 unplanned/uncontrolled movements (11%) that affected the main track.

Since 1994, the TSB has investigated 27 other occurrences that involved uncontrolled movements (Appendix E). The most significant of these occurrences was the 2013 Lac-Mégantic accident.

1.21 Other occurrences involving uncontrolled movements at Sutherland Yard

Between 1995 and 2005, there were 5 occurrences involving uncontrolled movements at Sutherland Yard as follows:

• R95W0321 – While a CP train was switching out the fourth locomotive to enable the third locomotive to be set off, the brakes released on the fourth locomotive, which rolled into the lead locomotive of that train. The locomotives sustained minor damage. There was no derailment and no injuries.
• R98W0097 – A CP crew on a yard assignment had just set off a loaded car of fuel oil (UN 1202) on track F5 and was proceeding to track F4. The set-off car ran uncontrolled out of track F5 and sideswiped another car from the same assignment. The cars sustained minor damage. There was no derailment, no loss of product and no injuries.
• R98W0182 – An RCLS assignment left a car at the east end of Sutherland Yard on track C1. A short time later, the crew noticed that the car was missing from the spotting location. The car had run uncontrolled and came to rest at the Central Avenue switch, a distance of approximately 50 car lengths. There was no derailment, no collision and no injuries.
• R02W0118 – While switching on the lead track at Sutherland Yard, an assignment was struck by a cut of 19 empty cars that had run uncontrolled from track F7. The locomotive sustained minor damage. There were no dangerous goods involved and no injuries.
• R05W0095 – During switching operations on track F6 in Sutherland Yard, a car rolled uncontrolled and derailed at the F6 switch. There were no dangerous goods involved and no injuries.

In each of the 5 occurrences, the rolling stock had rolled uncontrolled westward. In 4 of these occurrences, the uncontrolled movement occurred after the locomotive/cars had been left standing and then began to move due to gravity when the brakes released.

At some point after 2005, yard crews at Sutherland Yard began switching primarily using the train automatic brakes on all cars. When train automatic brakes are used, if a car separates from a movement, the air brakes on the car automatically apply. Between 2005 and 2015, there were no reported occurrences involving uncontrolled movements at Sutherland Yard.

1.22 Other TSB investigations involving remote control locomotive system switching operations

Since 2007, the TSB has investigated 4 other occurrences involving RCLS switching operations. A review of these investigations revealed that, in 3 of the 4 cases, operating crew inexperience played some role in the occurrence:

• TSB investigation R07T0270 determined that crew inexperience and inadequate training contributed to the occurrence.
• TSB investigation R07V0213 determined that management crew inexperience, inadequate management crew training and the implementation of an operational change related to RCLS switching operations contributed to the accident. Although a risk assessment had been conducted for the change involved, it was inadequate to identify all the hazards and mitigate the risks of switching long, heavy cuts of cars on a descending grade.
• TSB investigation R07W0042 determined that crew inexperience, inadequate training and some form of distraction that occurred during RCLS switching operations contributed to the accident.

1.23 TSB investigation into the Lac-Mégantic accident and Board recommendation R14-04

On 06 July 2013, shortly before 0100 Eastern Daylight Time, eastbound Montreal, Maine & Atlantic Railway freight train MMA-002, which had been parked unattended for the night on the main track at Nantes, Quebec, Mile 7.40 of the Sherbrooke Subdivision, started to roll. The train travelled about 7.2 miles, reaching a speed of 65 mph. At about 0115, while approaching the centre of the town of Lac-Mégantic, Quebec, 63 tank cars carrying petroleum crude oil, UN 1267, and 2 box cars derailed. As a result of the derailment, about
6 million litres of petroleum crude oil spilled. There were fires and explosions, which destroyed 40 buildings, 53 vehicles, and the railway tracks at the west end of Megantic Yard. A total of 47 people were fatally injured, and there was environmental contamination of the downtown area, and the adjacent river and lake.

Since 1996, the TSB has pointed out the need for robust defences to prevent runaways, and since then, runaways have continued to occur in Canada. While equipment runaways are generally considered low frequency, they can also be high-risk events and have extreme consequences, particularly if they involve dangerous goods, as demonstrated by the Lac-Mégantic occurrence. For this reason, the Board recommended that

1.23.1 Actions by Transport Canada and industry following TSB Recommendation R14-04

On 29 October 2014, TC issued its emergency directive on additional physical defences for trains with operating locomotives to be left on the main track. It stated the following:

4a) Ensure that when equipment or movement [sic] are left unattended on main track, in addition to any securement requirements in Rule 112 of the CROR, at least one additional physical securement measure or mechanism is also used. The additional physical securement measures or mechanisms must prevent equipment from uncontrolled motion and must be one or more of the following:

• Permanent derails used within their design specifications;
• Mechanical emergency devices;
• Mechanical lock parking brake once approved by the Association of American Railroads (AAR);
• Reset Safety Control (RSC) with roll-away protection where air pressure is maintained or auto start is provided;
• Moving the equipment to a track protected with derails or bowled terrain verified by survey or track profile; or
• Other appropriate physical securement device accepted by Transport Canada.^{Footnote 34}

TC also required railway companies to formulate rules to address the securement of railway equipment. Following extensive consultations with the industry, the newly revised CROR Rule 112 was approved by the Minister of Transport and came into effect on 15 October 2015. The revised CROR Rule 112, Leaving Unattended Equipment, included 7 control measures that could be used as a secondary means of physical securement in an effort to reduce the risk of uncontrolled movements.

1.23.2 Board reassessment of Transport Canada's response to TSB Recommendation R14-04 (March 2017)

In March 2017, the Board reassessed TC's response to Recommendation R14-04 and acknowledged the effort TC made in revising CROR Rule 112. However, despite the actions taken, the number of uncontrolled movement occurrences remained the same in the past year (i.e., 42 occurrences in 2016 and 2015 and a five-year average of 39).^{Footnote 35} The Board reiterated that physical defences should not rely on air brakes due to their lack of reliability. As air brakes are known to leak and the rate of leakage is generally unpredictable, this defence would not be a sufficient backup to the hand brakes.

The reassessment indicated the following:

Satisfactory in Part.

1.24 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Safety management and oversight is a Watchlist 2016 issue. As this occurrence demonstrates, all potential hazards involving operational changes must be identified during risk assessments to ensure that appropriate mitigation strategies are developed and implemented to reduce the risk of uncontrolled movements.

There were no equipment defects or track defects that were considered contributory to this occurrence. The analysis will focus on the uncontrolled movement, the use of derails, regulatory oversight of training and qualifications, operating employee experience, risk assessments, and crossing protection.

2.1 The occurrence

The incident occurred when the west-end car (EFCX 604991) of Canadian Pacific Railway (CP) 2300 remote control locomotive system training yard assignment (the assignment) rolled uncontrolled westward out of track F6 at Sutherland Yard.

The foreman was in charge of the assignment switching activities and was also required to control all other train movements through the point protection zone (PPZ) at the east end of F-yard, which had been placed under the foreman's control earlier in the shift. The foreman was preparing to set out the west-end car, EFCX 604991, the 16th of the assignment.

After the assignment stopped with car EFCX 604991 located on the east end of track F6 and the remainder of the assignment occupying the east-end F-yard lead track, the foreman applied the hand brake on car EFCX 604991, tested the hand brake effectiveness, and lifted the uncoupling lever to prepare for uncoupling, as was the normal procedure.

At the same time, the crew on CP potash unit train 602 (train 602) called the foreman on the radio and requested permission to enter the east-end F-yard lead track within the PPZ in order to bring the locomotives to the shop track. The foreman was aware that, once train 602's locomotives were parked at the shop track, there would be no more interruptions for the rest of the evening and subsequently permitted train 602 to enter the PPZ.

To clear the east-end F-yard lead track to permit train 602 to pass through the PPZ, the foreman decided to shove the entire assignment westward into track F6. In preparation for shoving the assignment westward into track F6, the foreman released the hand brake on car EFCX 604991, but did not re-engage the coupling before commencing the movement. The assignment shoved westward and, as it stopped, car EFCX 604991, with its knuckle already released, uncoupled from the assignment and rolled uncontrolled through the yard. With no derail in place on the west-end F-yard lead track, the car continued to roll uncontrolled onto the main track, west of Sutherland Yard.

After accessing the main track, the car continued westward and traversed 2 public crossings equipped with grade crossing warning systems (GCWS), located at Mile 109.78 and Mile 109.88 respectively, before coming to a stop within cautionary limits at Mile 110.5.

Occupancy control system territory does not have signals that can alert an oncoming train of occupancy in the track ahead. Neither the crew nor the assistant trainmaster (ATM) working in the yard office realized that the car had exited the yard and entered the main track within cautionary limits. Another crew, arriving at the yard office, alerted the ATM about a car rolling uncontrolled. Had the car not been noticed leaving the yard, it would likely have remained at Mile 110.5, protected by cautionary limit rules, which require trains to be approaching at a speed that allows them to stop within half the range of vision of equipment. If uncontrolled movements can enter the main track undetected, approaching trains or movements might not be warned in a timely manner and might not be able to take appropriate action, increasing the risk of collisions.

2.2 Task interruption during switching operations

In this occurrence, the foreman modified the switching plan to accommodate a request from another train to pass through the PPZ. The original plan was to move a cut of cars to the east end of track F6, set off the tail-end car and leave it on track F6 to be moved later in the shift. The foreman had begun to execute this plan and had stopped the movement on track F6, applied a hand brake on the last car and lifted its uncoupling lever when the foreman received the request from train 602 to pass through the PPZ.

Given that it would be more efficient to allow train 602 to pass through the PPZ as soon as possible, the foreman developed a new plan to shove the assignment clear into track F6 to allow train 602 to proceed to the shop track. To execute this plan, the foreman would have had to re-engage the coupling by leaving the hand brake applied on the car, separate the tail-end car from the movement, shove back to re-couple, test the coupling to ensure that it was engaged, and then release the hand brake before shoving into track F6 at 10 mph. When the switching task was interrupted by the request by the crew of train 602 for permission to enter the PPZ, the foreman did not recall that the uncoupling lever had been lifted and that car EFCX 604991 was effectively uncoupled.

2.3 Additional tasks and slips of attention

Among the errors most frequently associated with routine, well-practiced tasks are slips of attention. These occur when a check on the progress of a task sequence is mistimed or does not occur because the operator's attention is focused on another aspect of the task or some other preoccupation. Because these errors typically occur in routine, well-practiced tasks, they are common for both novice employees and experienced employees.

A necessary condition for these errors to occur is the presence of attentional capture, where the operator's attention is focused on another aspect of the task. Given that operators who are learning new tasks, or new aspects of a familiar task, will require more attention on these new unpracticed elements of their roles, these increased demands on attention will create more opportunity for attentional capture errors.^{Footnote 36}

In this occurrence, the assignment crew had been employed by the railway for about 9 months and had qualified as conductors about 3 months before the occurrence. They were relatively inexperienced and had not yet completed their remote control locomotive system (RCLS) training.

The recent operational changes at Sutherland Yard (i.e., reduction in yard crews, switching operations without the use of air brakes, re-introduction of RCLS operations and implementation of a PPZ) introduced new task demands on yard crews. In addition to the normal conductor duties of planning and preparing switching movements, yard crews were also required to execute the movements while the foreman assumed the additional responsibility for coordinating and approving any movements through the PPZ. As such, more of the foreman's attentional resources were required to attend to the new aspects of the task that were being learned and fewer attentional resources were available to monitor the switching task. The combination of learning the additional tasks associated with RCLS operations and managing the PPZ, combined with the relative inexperience of the yard foreman, increased the likelihood of the slip of attention about the uncoupling that led to the uncontrolled movement.

2.4 Assignment crew experience

The assignment crew were the 2 most junior and least experienced employees working at Sutherland Yard at that time. Once qualified as a conductor in January 2016, the foreman had been immediately set up as a foreman in a three-person crew. As such, the foreman worked for the first month or so with an experienced locomotive engineer (LE) and took the opportunity to receive guidance from a more experienced crew member when required. This changed once RCLS operations were re-introduced and two-person yard crews were established.

The assignment crew had commenced RCLS classroom training on 29 February 2016. Once the crew had completed the classroom training, they were assigned to an on-job RCLS training assignment that replaced a regular yard assignment. After the assignment crew had completed the 2 weeks of RCLS practical training, CP determined that they required an additional (third) week of practical training. The assignment crew was scheduled to complete the extra week of RCLS practical training on 28 March 2016. The incident occurred on 27 March 2016. Despite a low level of experience, the foreman was designated in that role because the foreman was the most senior member of the assignment crew. In addition, there is no regulatory requirement or guidance outlining the time or experience a conductor requires before commencing RCLS training or assuming the role of yard foreman in RCLS operations. Given that yard positions are typically assigned to operating employees with the least seniority, it is not uncommon for a yard crew operating an RCLS to comprise 2 conductors with little operational and RCLS experience.

2.5 Pairing of inexperienced operators

Experiential learning is an important component of an overall training program. Effective experiential learning enhances a person's judgement, skills and ability to work safely. As a person gains experience, tasks become familiar and practiced, thereby decreasing the demands for attention toward aspects of the tasks that were previously new, and decreasing the potential for attentional capture errors.

In its review of RCLS operations, the Federal Railroad Administration identified as a concern the increased potential for channelized attention when relatively inexperienced crews learn RCLS operations in addition to their existing tasks. These problems can be exacerbated if inexperienced operators are paired together in a crew. Several TSB railway investigations have identified the inexperience of the operating crew (management and unionized) as a factor that contributed to several incidents and accidents. The challenges of pairing inexperienced crew members together also occur in other transportation industries.

Newly qualified operating employees, who may also be learning new tasks and procedures, need to work under the guidance of experienced employees for a period of time to gain sufficient operational experience to work independently and safely, particularly in an active rail yard environment. In this occurrence, both operating crew members were inexperienced and were still learning new tasks, yet they were paired together to work as the assignment crew. If the experience of operating employees is not considered when pairing operating crews, there is an increased risk for operational errors and accidents to occur.

2.6 Regulatory oversight of railway operating employee qualification and training

Historically, conductors were required to gain experience as brakemen prior to being trained as conductors while trainees and brakemen benefitted from the experience of working with more senior conductors and LEs. This more graduated approach to operating crew qualification presented more opportunities for mentoring as new operating employees worked with more senior employees and gained experience. Over time, practices have evolved, and new hires and managers can be trained as conductors, and in some cases as LEs, through an accelerated training process without always having previous operational experience.

Since the Railway Employee Qualification Standards Regulations (the regulations) came into force 30 years ago, there have been significant operational changes within the rail industry, including the following:

• The size of crews has been reduced.
• RCLS operations have been widely implemented across the country.
• Accelerated training programs have been introduced.
• The periodic use of management crews has become more widely implemented at both CP and the Canadian National Railway Company.

Despite these significant changes in railway operations, the regulations have not kept pace with the railway operating environment as it evolved. With regard to the current operating environment, the regulations have significant gaps in the following areas:

• qualification standards,
• graduated qualification,
• RCLS operations,
• management crews, and
• training and regulatory oversight.

If the current regulations are not updated, gaps will remain and Transport Canada (TC) will not be able to conduct effective regulatory oversight and enforcement of training programs for management and unionized operating crews, RCLS operators, rail traffic controllers, and contractor trainers, perpetuating the risk of unsafe train operations.

2.6.1 Safety management systems

In addition to the Railway Employee Qualification Standards Regulations, sections 25 to 27 of the Railway Safety Management System Regulations (SMS Regulations) require a railway to have a process for managing knowledge that includes training and qualifications of operating employees. With regards to managing knowledge, CP had a detailed list of essential duties for LEs and conductors, and a process for ensuring and verifying the required skills and qualifications for the performance of their duties essential to safe railway operations. However, CP did not have the same list or process for RCLS operators and related Beltpack operations. While CP conducts RCLS efficiency testing in an effort to ensure that employees have the requisite skills, qualifications and knowledge for safe operations, CP does not consider RCLS to be an essential service and it is not contained in CP's safety management system (SMS) plan for managing knowledge.

2.7 Unplanned/uncontrolled movement statistics

Not all uncontrolled movements have major consequences, such as at Lac-Mégantic. Uncontrolled movements can occur for a variety of reasons. Therefore, different mitigation strategies will be required. There are administrative defences (e.g., Canadian Rail Operating Rules [CROR] and company operating instructions) and physical defences (e.g., derails and wheel chocks) to protect against the risk of an uncontrolled movement. However, these defences have not always been consistently applied.

Between 2008 and 2017 inclusively, 32% (175/541) of all uncontrolled movements in Canada were directly related to switching without air, as in this occurrence. Of the 541 occurrences, 56% (302/541) resulted in a collision while, as in this occurrence, 11% (61/541) affected the main track. While the number of occurrences involving uncontrolled movements decreased to 51 in 2016, it increased to 62 in 2017. The five-year average (2013-2017) of 59.8 was about 10% higher than the ten-year average (2008-2017) of 54.1.

As a result of the TSB investigation into the Lac-Mégantic accident, the Board recommended that TC require Canadian railways to put in place additional physical defences to prevent runaway equipment (Recommendation R14-04). In response, TC implemented a number of initiatives, including a strengthened CROR Rule 112 and a comprehensive oversight plan for the new rule. While the TSB was encouraged by the TC initiatives, the Board noted that the desired outcome of significantly reducing the number of uncontrolled movements has not yet been achieved. The number of occurrences involving uncontrolled movements (i.e., runaway rolling stock) increased by about 10% in the past 5 years, as compared to the ten-year average.

2.8 Protection of the main track against uncontrolled movements

The TC-approved Rules Respecting Track Safety (TSR) require a derail to be installed when there is a possibility of equipment that has been left standing on tracks other than main tracks or sidings being moved by gravity so as to obstruct a main track or siding. While there are other methods of protecting against an uncontrolled movement rolling out onto main track, none of the methods were in place at the time of the occurrence.

As demonstrated by this occurrence, gravity is not the only condition under which a car may roll uncontrolled out onto a main track. Flat switching is the primary method for assembling trains. During flat switching, cars can be shoved or kicked into tracks to build trains. Cars may not always couple successfully and some can occasionally roll away uncontrolled despite the prevailing track profile. By only requiring derails to be installed at locations where equipment left standing can be moved by gravity, the main track is not protected against uncontrolled movements in all circumstances. If railways do not protect the main track against uncontrolled movements in all circumstances, equipment that inadvertently rolls uncontrolled during switching activities might be able to access and/or foul the main track, increasing the risk of collisions.

2.8.1 Protecting the main track at Sutherland Yard

At Sutherland Yard, the track profile at the east end of the yard crests at about Mile 109.05. From the crest, there is an average westward descending grade of about 0.25%, with the steepest grade (0.40%) located near the west yard switch (Mile 109.83). Due to the grade, derails were installed to protect the west end of the C-yard and tracks G5 to G7. However, at the lower west end of the yard, a number of tracks, including track D1, the F-yard lead track, and tracks F1 to F13 and G1 to G4, were not equipped with derails.

At Sutherland Yard, despite an average westward descending grade of 0.25%, despite previous uncontrolled movements of rolling stock that had been left standing then moved by gravity, and despite a TSR requirement to install a derail in these circumstances, no derails were in place at the west end of the F-yard lead track and other portions of the G-yard to protect against uncontrolled movements accessing the main track.

2.9 Crossing protection for uncontrolled movements

Once car EFCX 604991 accessed the main track, it travelled over 2 public crossings west of Sutherland Yard that were both protected by GCWS. The first crossing encountered was at Central Avenue (Mile 109.78) and the second crossing was at 115th Street (Mile 109.88).

The short approach to the Central Avenue crossing was designed to provide 32 seconds of warning for trains travelling at 5 mph. To ensure sufficient warning for roadway traffic was provided at that crossing, CP required that movements on the F-yard lead track not foul the Central Avenue crossing until the crossing gates were horizontal.

In this occurrence, the Central Avenue crossing protection was activated for only 10 seconds and the crossing gates were not fully horizontal before car EFCX 604991 occupied the crossing (Figure 3). Given the traffic volume for the crossing, this situation presented a significant risk to roadway traffic. If an uncontrolled movement can enter a crossing before the GCWS is fully deployed, there is greater risk of a crossing accident.

In general, GCWS are designed for the intended use of the crossing and provide sufficient warning times for the expected road and rail speeds. While the Central Avenue crossing met the design plan and regulatory requirements, it was not designed to protect against uncontrolled movements entering the main track from Sutherland Yard. Consequently, the GCWS protection for the F-yard lead track at the Central Avenue crossing did not provide sufficient warning time to protect the public against uncontrolled movements.

2.10 Risk assessments

The 2016 TSB Watchlist emphasized the need for SMS to be implemented effectively in order to ensure that hazards are proactively identified and that risks are maintained at an acceptable level. The SMS Regulations require that a company conduct a risk assessment when it proposes a change to its operations that may affect the safety of the public or personnel or the protection of property or the environment.

Such changes include but are not limited to

• the introduction or elimination of a technology, or a change to a technology,
• a change affecting personnel, including an increase or decrease in the number of employees or a change in their responsibilities or duties.

Between 1995 and 2005, there were 5 occurrences involving movements that rolled uncontrolled westward at Sutherland Yard. In 4 of these occurrences, the uncontrolled movement occurred after the locomotive/cars had been left standing and began to move due to gravity when the brakes released. After 2005, CP yard crews began switching in Sutherland Yard primarily with the train automatic brakes on all cars. When train automatic brakes are used, if a car separates from a movement, the air brakes on the car automatically apply and stop the car. Between 2005 and 2015, there were no uncontrolled movements reported at Sutherland Yard.

In early 2016, several operational changes were implemented by CP at Sutherland Yard. The operational changes prompted CP to complete a combined risk assessment in accordance with the SMS Regulations. The risk assessment covered RCLS operations and the introduction of a PPZ. However, the risk assessment did not consider the impact of reducing the number of train crews or the change in local practice to primarily switching without air.

The risk assessment identified a number of potential hazards associated with the proposed changes, 1 of which was task overload for operators. The risk assessment also identified a number of potential undesired events or consequences as potential outcomes from these hazards. Task overload for operators was listed as a hazard for 5 of the 6 potential undesired events. However, the risk assessment did not specifically identify a potential hazard related to crew inexperience or the potential consequence of an uncontrolled movement.

Therefore, remedial action to address a potential uncontrolled movement, such as the installation of a derail, was not considered or implemented to protect against uncontrolled movements while switching without air. This represents a gap in CP's SMS with regards to risk assessments associated with operational changes. If adverse outcomes, such as uncontrolled movements, are not identified, there is a risk that mitigation strategies might not be implemented.

3.1 Findings as to causes and contributing factors

1. The incident occurred when the west-end car (EFCX 604991) of Canadian Pacific Railway 2300 remote control locomotive system training yard assignment (the assignment) rolled uncontrolled westward out of track F6 at Sutherland Yard.
2. After the assignment stopped with car EFCX 604991 located on the east end of track F6 and the remainder of the assignment occupying the east-end F-yard lead track, the foreman applied the hand brake on car EFCX 604991, tested the hand brake effectiveness, and lifted the uncoupling lever to prepare for uncoupling, as was the normal procedure.
3. To clear the east-end F-yard lead track to permit Canadian Pacific Railway potash unit train 602 to pass through the point protection zone, the foreman decided to shove the entire assignment westward into track F6.
4. In preparation for shoving the assignment westward into track F6, the foreman released the hand brake on car EFCX 604991, but did not re-engage the coupling before commencing the movement.
5. The assignment shoved westward and, as it stopped, car EFCX 604991, with its knuckle already released, uncoupled from the assignment and rolled uncontrolled through the yard.
6. With no derail in place on the west-end F-yard lead, the car continued to roll uncontrolled onto the main track, west of Sutherland Yard.
7. When the switching task was interrupted by the request by the crew of Canadian Pacific Railway potash unit train 602 for permission to enter the point protection zone, the foreman did not recall that the uncoupling lever had been lifted and that car EFCX 604991 was effectively uncoupled.
8. The combination of learning the additional tasks associated with remote control locomotive system operations and managing the point protection zone, combined with the relative inexperience of the yard foreman, increased the likelihood of the slip of attention about the uncoupling that led to the uncontrolled movement.
9. At Sutherland Yard, despite an average westward descending grade of 0.25%, despite previous uncontrolled movements of rolling stock that had been left standing then moved by gravity, and despite a Railway Track Safety Rules requirement to install a derail in these circumstances, no derails were in place at the west end of the F-yard lead track and other portions of the G-yard to protect against uncontrolled movements accessing the main track.

3.2 Findings as to risk

1. If uncontrolled movements can enter the main track undetected, approaching trains or movements might not be warned in a timely manner and might not be able to take appropriate action, increasing the risk of collisions.
2. If the experience of operating employees is not considered when pairing operating crews, there is an increased risk for operational errors and accidents to occur.
3. If the current regulations are not updated, gaps will remain and Transport Canada will not be able to conduct effective regulatory oversight and enforcement of training programs for management and unionized operating crews, remote control locomotive system operators, rail traffic controllers, and contractor trainers, perpetuating the risk of unsafe train operations.
4. If railways do not protect the main track against uncontrolled movements in all circumstances, equipment that inadvertently rolls uncontrolled during switching activities might be able to access and/or foul the main track, increasing the risk of collisions.
5. If an uncontrolled movement can enter a crossing before the grade crossing warning system is fully deployed, there is a greater risk of a crossing accident.
6. If adverse outcomes, such as uncontrolled movements, are not identified, there is a risk that mitigation strategies might not be implemented.

3.3 Other findings

1. Given that yard positions are typically assigned to operating employees with the least seniority, it is not uncommon for a yard crew operating a remote control locomotive system to comprise 2 conductors with little operational and remote control locomotive system experience.
2. While Canadian Pacific Railway (CP) conducts remote control locomotive system (RCLS) efficiency testing in an effort to ensure that employees have the requisite skills, qualifications and knowledge for safe operations, CP does not consider RCLS to be an essential service and it is not contained in CP's safety management system plan for managing knowledge.
3. The number of occurrences involving uncontrolled movements (i.e., runaway rolling stock) increased by about 10% in the past 5 years, as compared to the ten-year average.
4. The grade crossing warning system protection for the F-yard lead track at the Central Avenue crossing did not provide sufficient warning time to protect the public against uncontrolled movements.

4.1 Safety action taken

4.1.1 Transportation Safety Board of Canada

On 26 April 2016, the Transportation Safety Board of Canada issued Rail Safety Advisory (RSA) 09/16 to Transport Canada (TC) concerning the protection of the main track against uncontrolled movements at Canadian Pacific Railway's (CP) Sutherland Yard. The RSA indicated that, despite operational changes at Sutherland Yard, no derail was installed at the west end of the yard to protect against potential uncontrolled movements. It further stated that, given the potential dangers of runaway equipment, TC may want to review how the main track is protected at CP's Sutherland Yard to ensure that the risks and consequences of uncontrolled movements are minimized.

In response to the RSA, TC indicated that it believed that the use of the remote control locomotive system did not contribute to the cause of this incident. More specifically, TC indicated (in part):

• The car was part of a movement that was shoved within the yard, but because a crew member had forgotten that the uncoupling lever had been lifted, the single car moved uncontrolled onto the main track. Given that the equipment was not left standing and did not move exclusively by gravity, there was no non-compliance to TC's Rules Respecting Track Safety. However, CP has indicated it implemented individual corrective action with the employee involved.
• TC contacted CP to request a review and assessment for derail requirements in Sutherland Yard. CP informed TC that a review had been done and that the installation of derails would not positively affect safety or provide additional protection due to the lack of plausible locations to install such derails, as well as the nature of the operation at that location.

4.1.2 Canadian Pacific Railway

Following the occurrence, CP switching operations in Sutherland Yard returned to being performed with air applied on the rail cars. At the time this report was issued, remote control locomotives were no longer being used for switching operations. Switching was again being performed with conventional (three-person) crews.

CP has made the following changes to its internal Risk Assessment Policy and Procedure:

• The risk assessment procedure has been revised to ensure that roles and responsibilities are clearly defined and that steps for evaluating effectiveness of remedial actions have been clarified.
• Operational changes that require a risk assessment and ministerial notification have been clarified.
• An online risk assessment training program that clearly outlines procedural expectations has been developed and rolled out to all operation managers in Canada.
• The risk assessment e-tool that CP uses as a framework and to document risk assessments has been revised.

4.2 Safety concern

4.2.1 Uncontrolled movements

Uncontrolled movements can occur as a result of loss of control, switching without air or insufficient securement. In this occurrence, the Canadian Pacific Railway 2300 remote control locomotive system training yard assignment (the assignment) was switching without air while shoving a cut of cars into track F6 in Sutherland Yard in Saskatoon, Saskatchewan. As the assignment was brought to a stop, an empty car uncoupled from the train and was unnoticed by the crew. The car rolled uncontrolled through the yard and onto the main track within cautionary limits of the Sutherland Subdivision. The car travelled about 1 mile and over 2 public crossings equipped with automated grade crossing warning systems before coming to a stop on its own.

Among all federally regulated railways, between 2008 and 2017, 541 unplanned/ uncontrolled movements were reported to the TSB. As in this occurrence, 32% (175/541) of the uncontrolled movements were directly related to switching without air. Of the 541 occurrences, 56% (302/541) resulted in a collision and, as in this occurrence, 11% (61/541) affected the main track.

Since 1994, the TSB has investigated 27 other occurrences that involved uncontrolled movements. The TSB has pointed to the need for robust defences to prevent uncontrolled movements since the mid-1990s.^{Footnote 37} The most significant of the uncontrolled movements investigated by the TSB was the 2013 Lac-Mégantic accident.^{Footnote 38}

Uncontrolled movements can be categorized as low frequency–high-risk events. In particular, uncontrolled movements that affect the main track present the greatest risk for an adverse outcome. These types of occurrences can have severe consequences, particularly if dangerous goods are involved. As demonstrated in Lac-Mégantic, the cost to human life and our communities can be incalculable. For this reason, the Board recommended that

In response to the TSB recommendation, Transport Canada (TC) issued an emergency directive on additional physical defences for trains with operating locomotives left on the main track. TC also required railway companies to formulate rules to address the securement of railway equipment. Following extensive consultations with the industry, the newly revised Canadian Rail Operating Rules (CROR) Rule 112 was approved by the Minister of Transport and came into effect on 15 October 2015. The revised CROR Rule 112, Leaving Unattended Equipment, included 7 control measures that could be used as a secondary means of physical securement in an effort to reduce the risk of uncontrolled movements.

In March 2017, the Board reassessed TC's response to Recommendation R14-04 and acknowledged the effort TC made in revising CROR Rule 112. The reassessment indicated that

Satisfactory in Part.

The Board recognizes that not all uncontrolled movements have major consequences, such as in Lac-Mégantic. Uncontrolled movements may occur for a variety of reasons and, therefore, different mitigation strategies will be required.

There are administrative defences (e.g., CROR and company operating instructions) and physical defences (e.g., derails and wheel chocks) to protect against the risk of an uncontrolled movement. However, these defences are not always consistently applied.

In this occurrence, Sutherland Yard had an average westward descending grade of 0.25% and a previous history of uncontrolled movements that had been left standing unattended, then moved by gravity. Despite a requirement in the TC-approved Rules Respecting Track Safety to install a derail in those circumstances, no derails were in place at the west end of the F-yard lead track to protect against an uncontrolled movement accessing the main track.

Although the number of occurrences involving uncontrolled movements decreased to 51 in 2016, it increased to 62 in 2017. When compared to the ten-year average (2008-2017) of 54.1 uncontrolled movements per year, the average number of occurrences involving uncontrolled movements for the most recent 5 years (2013-2017) increased by 10% to 59.8, with 2017 having the second-highest number of uncontrolled movements (62). Uncontrolled movements continue to pose a risk to the rail transportation system and can result in an adverse outcome. Therefore, the Board is concerned that the current defences are not sufficient to reduce the number of uncontrolled movements and improve safety.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. the Board authorized the release of this report on 28 February 2018. It was officially released on 20 March 2018.

Appendix A - Canadian Pacific Railway existing and proposed remote control locomotive system locations

Location	Number of remote control locomotive system locomotives	Type of service
Bredenbury	3	Industrial
Coquitlam	8	Yard
Calgary	6	Yard
Edmonton	5	Yard/Industrial
Hamilton	1	Industrial
Lethbridge	3	Yard
London	1	Industrial
Montréal	4	Yard
Moose Jaw	5	Yard
Regina	1	Yard
Sutherland	2	Yard
Thunder Bay	1	Yard
Toronto	2	Industrial
Welland	1	Industrial
Winnipeg	4	Yard

Appendix B – Railway Safety Management System Regulations, 2015

Section 5 of the Railway Safety Management System Regulations, 2015 (SMS Regulations) states the following:

A railway company must develop and implement a safety management system that includes

1. a process for accountability;
2. a process with respect to a safety policy;
3. a process for ensuring compliance with regulations, rules and other instruments;
4. a process for managing railway occurrences;
5. a process for identifying safety concerns;
6. a risk assessment process;
7. a process for implementing and evaluating remedial action;
8. a process for establishing targets and developing initiatives;
9. a process for reporting contraventions and safety hazards;
10. a process for managing knowledge;
11. a process with respect to scheduling; and
12. a process for continual improvement of the safety management system.

Section 15 of the SMS Regulations states the following:

Risk Assessment Process

1. (1) A railway company must conduct a risk assessment in the following circumstances:
   1. when it identifies a safety concern in its railway operations as a result of the analyses conducted under section 13;
   2. when it proposes to begin transporting dangerous goods, or to begin transporting dangerous goods different from those it already transports; or
   3. when a proposed change to its railway operations, including a change set out below, may affect the safety of the public or personnel or the protection of property or the environment:
      1. the introduction or elimination of a technology, or a change to a technology,
      2. the addition or elimination of a railway work, or a change to a railway work,
      3. an increase in the volume of dangerous goods it transports,
      4. a change to the route on which dangerous goods are transported, or
      5. a change affecting personnel, including an increase or decrease in the number of employees or a change in their responsibilities or duties.

Components

1. The risk assessment must
   1. describe the circumstances that triggered the requirement to conduct the risk assessment;
   2. identify and describe the risks associated with those circumstances;
   3. identify the factors taken into account in the risk assessment, including the persons who may be affected and whether property or the environment is affected;
   4. indicate, for each risk, the likelihood that the risk will occur and the severity of its consequences;
   5. identify the risks that require remedial action; and
   6. identify the remedial action for each of those risks.

Sections 25 to 27 of the SMS Regulations state the following:

Process for Managing Knowledge

List

1. (1) A railway company must establish a list setting out
   1. the duties that are essential to safe railway operations;
   2. the positions in the railway company that have responsibility for the performance of each of those duties; and
   3. the skills and qualifications required to perform each of those duties safely.

Employees — skills and qualifications

1. The railway company must ensure that an employee who performs any of the duties referred to in paragraph (1)(a) has the skills and qualifications referred to in paragraph (1)(c).

Employees — knowledge

1. The railway company must ensure that an employee who performs any of the duties referred to in paragraph (1)(a) has knowledge of
   1. the requirements of the instruments referred to in subsection 10(1) that the employee needs to know to carry out his or her duties safely;
   2. any federal legislation that may affect railway safety and that the employee needs to know to carry out his or her duties safely; and
   3. any of the railway company's procedures — including any procedure referred to in this Part — standards, instructions, bulletins or other internal documents that may affect railway safety and that the employee needs to know to carry out his or her duties safely.

Other persons

1. A railway company must ensure that any person, other than an employee, who is authorized by the railway company to access the railway and whose activities may affect the safety of railway operations has knowledge of
   1. the requirements of the instruments referred to in subsection 10(1) that the person needs to know to carry out his or her activities safely;
   2. any federal legislation that may affect railway safety and that the person needs to know to carry out his or her activities safely; and
   3. any of the railway company's procedures — including any procedure referred to in this Part — standards, instructions, bulletins or other internal documents that may affect railway safety and that the person needs to know to carry out his or her activities safely.

Plan and methods

1. A railway company must include, in its safety management system,
   1. a plan for ensuring that an employee who performs any of the duties referred to in paragraph 25(1)(a) has the skills and qualifications referred to in paragraph 25(1)(c) and the knowledge referred to in subsection 25(3);
   2. a method for verifying that an employee who performs any of the duties referred to in paragraph 25(1)(a) has the skills and qualifications referred to in paragraph 25(1)(c) and the knowledge referred to in subsection 25(3);
   3. a method for supervising an employee who performs any of the duties referred to in paragraph25(1)(a); and
   4. a method for verifying that a person referred to in section 26 has the knowledge referred to in that section.^{Footnote 39}

Appendix C - Railway Employee Qualification Standards Regulations

The Railway Employee Qualification Standards Regulations state, in part:

General

1. A railway company shall provide employee training necessary for the purposes of these Regulations.
2. (1) No railway company shall permit any employee to work as a locomotive engineer, conductor, or yard foreman unless the employee,
   1. has qualified for that occupational category in accordance with section 14; and
   2. in the case of a locomotive engineer or transfer hostler, has received a passing mark for on-job training in that occupational category.
   […]
3. A railway company shall provide to its locomotive engineer candidates and transfer hostler candidates sufficient on-job training in respect of the required subjects to enable them to demonstrate to instructors and examiners that they are competent to perform their required duties.
4. No examiner shall issue a passing mark for on-job training to a locomotive engineer candidate or transfer hostler candidate unless the examiner
   1. is satisfied that the candidate is competent to perform his required duties by
      1. obtaining an evaluation of the candidate's competency from the locomotive engineer or transfer hostler with whom the candidate has made student on-job training trips, and
      2. assessing the candidate's competency in actual locomotive or train operation, or both, depending on the requirements of the occupational category for which the candidate is being examined; and
   2. has completed, signed and placed on the candidate's personnel file a document indicating that the candidate has passed the on-job training.
5. An examiner shall determine the overall mark for a candidate based on written or oral classroom examinations, or both, dealing with the required subjects.
6. An employee undergoing on-job training in order to qualify as a locomotive engineer or transfer hostler may perform the duties of the occupational category for which he is a candidate under the direction of an on-job training instructor for the duration of the employee's training period.
7. 1. A railway company shall, at intervals of not more than three years, have each employee in an occupational category re-examined on the required subjects.
   2. The overall pass mark for re-examination is 80 per cent.
   […]

1. 1. Within 90 days after the coming into force of these Regulations, a railway company shall file with the Committee two copies of each type of classroom examination and two copies of a detailed description of each method of assessing on-job competence used by the company.
   2. A railway company shall notify the Committee of a change to a type of classroom examination format or method of assessing on-job competence within 90 days after implementing the change.
   […]

Qualification Standards for Candidates

1. 1. The subjects required for a person to qualify for an occupational category are the subjects listed in those items of the schedule marked with an "X" under the heading that corresponds to the occupational category, excluding those subjects or portions of subjects dealing with equipment that is not used by the railway company that employs the person.
   2. No railway company shall qualify a person for an occupational category unless the person obtains an overall mark of at least 80 per cent in the required subjects.

Qualification Standards for On-job Training Instructors

1. No railway company shall qualify a person as an on-job training instructor for the occupational category of locomotive engineer unless the person
   1. meets the qualification requirements for a locomotive engineer with an overall mark of at least 90 percent; and
   2. completes not less than two years service as a locomotive engineer, including at least three months service in the area where the locomotive engineer is to give the on-job training.
2. No railway company shall qualify a person as an on-job training instructor for the occupational category of transfer hostler unless the person
   1. meets the qualification requirements for a transfer hostler with an overall mark of at least 90 per cent; and
   2. completes not less than one year of service as a transfer hostler, including at least three months service in the area where the transfer hostler is to give the on-job training.

Qualification Standards for Classroom Training Instructors

1. No railway company shall qualify as a classroom training instructor for a required subject a person who has not obtained a mark of at least 90 per cent in a written examination on that subject.

Qualification Standards for Examiners

1. An employee or officer of a railway company who is an on-job training instructor or a classroom training instructor is qualified to act as an examiner on the subjects on which the employee or officer is qualified to give instruction.

Training Programs and Consultation

1. 1. A railway company shall establish employee training programs for each occupational category.
   2. A railway company shall establish and modify its employee training programs in consultation with the trade unions representing its employees in the occupational categories.
   3. Within 90 days after the coming into force of these Regulations, a railway company shall file with the Committee a description of all employee training programs relating to each occupational category.
   4. Within 90 days after any change is made to an employee training program required by subsection (1), a railway company shall file with the Committee a description of the change.

Reporting

• 20 (1) For each calendar year a railway company shall submit to the Committee, not later than March 31 of the following year, a comprehensive report on its employee training programs.
•      (2) A report referred to in subsection (1) shall specify
  1. the total number of employees in each occupational category;
  2. the total number of employees who received training in each occupational category;
  3. the number of employees who received training and met the training requirements for each category and the number who failed to meet the training requirements; and
  4. any new or improved techniques or devices adopted in the company's employee training programs.^{Footnote 40}

Appendix D - Summary of U.S. Department of Transportation Federal Railroad Administration Code of Federal Regulations, Title 49, Part 240 and Part 242 – Training program certification requirements

As indicated in the Code of Federal Regulations (CFR), Title 49, Part 240 and Part 242:

• A railway must submit its training programs for locomotive engineers (LEs) and conductors to the Federal Railroad Administration (FRA) for certification. The FRA will review the course material. If the course material does not meet regulatory criteria, the FRA will provide feedback and require the railway to re-submit the material for approval.
• Once the training program for operating employees has been approved by the FRA, the railroad is permitted to certify its employees once they successfully complete the training program.
• When submitting its training programs to the FRA for certification, the railway submission must cover the following sections detailed in Appendix B of CFR 49 Part 240 and Part 242:
  1. General information;
  2. Selection of supervisors of LEs (CFR 49, Part 240 for LEs only);
  3. Training persons previously certified;
  4. Testing and evaluating persons previously certified;
  5. Training, testing and evaluating persons not previously certified;
  6. Monitoring operational performance by certified engineers; and
  7. Procedures for routine administration of certification programs.
• Training must be modified whenever there are changes in technology (e.g., the use of dynamic brake, RCLS [remote control locomotive system], etc.), changes in operating rules (e.g., train securement) or changes in regulatory requirements (e.g., risk assessments). In addition, any revised course material must be re-submitted, reviewed and approved by the FRA.
• Driving convictions or infractions on the driver's license for a prospective operating employee must be considered when determining suitability for employment (Prior Safety Conduct). Failure to meet eligibility requirements for prior safety conduct, reported substance abuse disorders or documented rules compliance issues can result in the rejection of a prospective employee.
• Once employed by a railway, an employee must continue to meet eligibility requirements. Any non-compliance, such as a suspension of the employee's driver's license, can result in revocation of the employee's railway certification.
• Operating personnel must re-qualify every 3 years.
• There is no requirement to work 2 years as a conductor prior to commencing training as an LE.
• LEs must pass a practical examination to be certified or re-certified.
• Only certified LEs can operate RCLS equipment.
• Familiarization training is provided for new employees. When an operating employee returns to work after an extended period of absence for any reason, familiarization training is also required.
• All written tests are conducted without open reference books or other materials, except when being tested on the ability to use such reference books or materials.
• Managers must have the same certification and training as unionized staff to work as conductors or LEs.

Appendix E – Transportation Safety Board of Canada investigations involving uncontrolled movements

No.	Occurrence number	Date	Description	Location
1	R16W0059	2016-03-01	Uncontrolled movement of railway equipment, Cando Rail Services, 2200 Co‑op Refinery Complex assignment, Mile 91.10, Quappelle Subdivision	Regina, Saskatchewan
2	R15D0103	2015-10-29	Runaway and derailment of cars on non-main track, Canadian Pacific Railway, Stored cut of cars, Mile 2.24, Outremont Spur	Montréal, Quebec
3	R15T0173	2015-07-29	Non-main track runaway, collision and derailment, Canadian National Railway Company, Mile 0.0, Halton Subdivision	Concord, Ontario
4	R13D0054	2013-07-06	Runaway and main-track derailment, Montreal, Maine & Atlantic Railway, Freight train MMA-002, Mile 0.23, Sherbrooke Subdivision	Lac-Mégantic, Quebec
5	R12E0004	2012-01-18	Main-track collision, Canadian National Railway Company, Runaway rolling stock and train A45951-16, Mile 44.5, Grande Cache Subdivision	Hanlon, Alberta
6	R11Q0056	2011-12-11	Runaway train, Quebec North Shore and Labrador Railway, Freight train LIM-55, Mile 67.20, Wacouna Subdivision	Dorée, Quebec
7	R09D0053	2009-09-09	Non-main-track collision, VIA Rail Canada Inc., Locomotive 6425, VIA Rail Canada Inc. Montréal Maintenance Centre	Montréal, Quebec
8	R09T0057	2009-02-11	Runaway and non-main-track train derailment, Southern Ontario Railway, 0900 Hagersville Switcher, Mile 0.10 and Mile 1.9 of the Hydro Spur	Nanticoke, Ontario
9	R08V0270	2008-12-29	Non-main-track train runaway and collision, Kettle Falls International Railway, Waneta Turn Assignment, Mile 141.20, Kettle Falls Subdivision	Waneta, British Columbia
10	R07H0015	2007-07-04	Runaway rolling stock, Canadian Pacific Railway, Runaway cut of cars, Mile 119.5, Winchester Subdivision	Smiths Falls, Ontario
11	R07V0109	2007-04-23	Non-main-track train derailment, Kootenay Valley Railway, 0700 Trail yard assignment, Mile 19.0, Rossland Subdivision	Trail, British Columbia
12	R06V0183	2006-09-03	Runaway and derailment, White Pass and Yukon Railway, Work train 114, Mile 36.5, Canadian Subdivision	Log Cabin, British Columbia
13	R06V0136	2006-06-29	Runaway and derailment, Canadian National Railway Company, Freight train L-567-51-29, Mile 184.8, Lillooet Subdivision	Near Lillooet, British Columbia
14	R05H0011	2005-05-02	Runaway and main-track train collision, Ottawa Central Railway, Freight train 441, Mile 34.69, Alexandria Subdivision	Maxville, Ontario
15	R04V0100	2004-07-08	Uncontrolled movement of railway rolling stock, Canadian National Railway Company, Train M-359-51-07, Mile 57.7, Fraser Subdivision	Bend, British Columbia
16	R03T0026	2003-01-21	Yard collision, Canadian Pacific Railway, Car HOKX 111044, Mile 197.0, Belleville Subdivision, Toronto Yard	Agincourt, Ontario
17	R03T0047	2003-01-22	Yard collision, Canadian National Railway Company, Tank Car PROX 77811, Mile 25.0, York Subdivision	Toronto, Ontario
18	R99D0159	1999-08-27	Runaway cars, Canadian National Railway Company, Mile 69.4, Kingston Subdivision, Wesco Spur	Cornwall, Ontario
19	R98M0029	1998-09-24	Main-track runaway, collision and derailment, Canadian National Railway Company train A402-21-24, Mile 105.4, Matapédia Railway Mont-Joli Subdivision	Mont-Joli, Quebec
20	R98M0020	1998-07-31	Main-track runaway and collision, VIA Rail Canada Inc. passenger train 14 and an uncontrolled five-pak movement, Mile 105.7, Matapédia Railway Mont-Joli Subdivision	Mont-Joli, Quebec
21	R97C0147	1997-12-02	Runaway and derailment, Canadian Pacific Railway, Train 353-946, Laggan Subdivision	Field, British Columbia
22	R96C0172	1996-08-12	Main-track collision, Canadian National Railway Company, Train 117 and an uncontrolled movement of 20 cars, Mile 122.9, Edson Subdivision	Near Edson, Alberta
23	R96C0209	1996-10-09	Runaway cars, Canadian Pacific Railway, CP 0700 yard assignment, Mile 166.2, Willingdon Subdivision, Clover Bar exchange track	Edmonton, Alberta
24	R96T0137	1996-04-24	Runaway of five tank cars, Canadian National Railway Company, Mile 0.0, Hagersville Subdivision	Nanticoke, Ontario
25	R96C0086	1996-04-13	Runaway train, Canadian Pacific Railway, Freight train 607-042, Mile 133.0, Laggan Subdivision	Field, British Columbia
26	R95M0072	1995-12-14	Runaway cars, Canadian National Railway Company, Train 130-13, Mile 0.0, Pelletier Subdivision	Edmundston, New Brunswick
27	R94V0006	1994-01-18	Runaway train, Canadian National Railway Company, Mile 175, Grande Cache Subdivision	Latornell, Alberta