Railway Investigation Report R16T0162

On 21 August 2016, at approximately 0517 Eastern Daylight Time, Canadian Pacific Railway freight train 118-18 was crossing from the north to the south track at approximately Mile 3.3 on the North Toronto Subdivision in Toronto, Ontario. Freight train 235-21, proceeding westward with 2 locomotives only, collided with the tail end of train 118-18. Four of train 118-18's intermodal cars (10 platforms) were struck and damaged. Four of the platforms derailed upright. The 2 locomotives of train 235-21 derailed upright. The fuel tank on train 7235-21's lead locomotive was punctured, resulting in the release of about 2500 litres of diesel fuel. A number of small fires were extinguished. The conductor of train 235-21 sustained injuries.

Le présent rapport est également disponible en français.

1.1 The accident

On 21 August 2016, the crew of Canadian Pacific Railway (CP) train 235-21 (train 235) was ordered at Toronto Yard, Mile 197.0 on the Belleville Subdivision, for 0445.^{Footnote 1} The crew consisted of a locomotive engineer (LE) and a conductor. Both crew members were qualified for their respective positions and were considered familiar with the subdivision. The crew members considered themselves to be rested and fit for duty in accordance with the Transport Canada–approved Work/Rest Rules for Railway Operating Employees. The conductor arrived at about 0400 to prepare the paperwork and to review the operating bulletins.

Train 235, which consisted of 2 locomotives, was destined for Spence, Ontario (Mile 41.6 on the MacTier Subdivision). The crew took control of the train at about 0500 and departed Toronto Yard with the conductor positioned outside the cab on the point of the lead locomotive.

Once the train was out of the yard, the conductor resumed position within the cab of the locomotive. Train 235 continued westward on the Belleville Subdivision and then onto the north track of the North Toronto Subdivision (Figure 1).

Shortly thereafter, train 235 received a radio broadcast from the train ahead about a trespasser on the railway right-of-way west of Howland. During the trip, the LE controlled the speed of the train using throttle manipulation and dynamic braking. When transitioning from power to braking, the LE would ensure that there was a pause of at least 10 seconds. The conductor frequently referred to the timetable containing signal locations to verify the train's location along the route.

At 0514, while travelling at about 48 mph near Howland, train 235 passed advance signal^{Footnote 2} 15‑2 without responding to its clear-to-stop indication. Then, rounding a right-hand curve onto the stretch of tangent track approaching controlled signal^{Footnote 3} 33-2, the train encountered eastbound freight train 118-18 (train 118) with its head end operating on the south track. In accordance with the Canadian Rail Operating Rules (CROR), the LEs dimmed the headlights of their respective trains.^{Footnote 4}

Train 118 consisted of 2 locomotives and 24 loaded cars. It weighed approximately 3175 tons and was about 3080 feet long. The train crew consisted of an LE and a conductor. Both crew members were familiar with the subdivisions, met fitness and rest standards, and were qualified for their respective positions.

After passing the head end of train 118 and while operating at 46 mph, the LE of train 235 restored the headlights back to full power. Shortly thereafter, as the crew of train 235 observed the side of train 118 and searched for a possible trespasser, the LE noticed that signal 33‑2, ahead, was displaying a stop indication. The LE immediately placed the train into emergency. The crew of train 235 then noticed that train 118 was operating over the crossover at Mile 3.3 with its tail end still occupying the north track. At 0516, the lead locomotive of train 235 struck the 4 tail-end cars of train 118 (involving 10 platforms), starting at the fouling point of the crossover switch (Figure 2).

The 2 locomotives on train 235 derailed upright. After the train came to a stop, the LE followed the emergency procedures and made the required radio broadcasts. Despite injuries sustained during the accident, the conductor of train 235 detrained, performed a damage assessment, and extinguished a number of small fires involving spilled locomotive fuel.

1.2 Site examination

The lead locomotive (CP 8849) of train 235 came to rest straddling the non-main track adjacent to the north track, west of the crossover. The locomotive's south side had sustained impact damage and scrape marks from the pilot to the fuel tank and the rear stairway. The front corner of the fuel tank was crumpled and breached, releasing about 2500 litres of diesel fuel.

Still coupled to the lead locomotive, the 2nd locomotive (CP 9617) came to rest with all wheels derailed. It also sustained impact damage and scrape marks along its south side. The stairs and walkway on the leading corner were crumpled, and the front truck was damaged.

Ten platforms of the tail-end 4 cars on train 118 were damaged. Scrape marks were present on the north side of each platform. In addition, some of the ladders and trucks on the platforms were damaged.

The cars remained coupled together and came to rest on the south track. Four of the platforms had derailed and were leaning upright and straddling the north rail (Figure 3). One platform of the first of the 4 cars, DTTX 788542, was derailed. Three platforms of the last car, DTTX 743830, were also derailed.

Platform D of DTTX 743830 was transporting containers, some carrying dangerous goods (UN3164, UN1066, UN1950). None of these containers was damaged. Platform E of DTTX 743830 was transporting alcoholic beverages (UN3065) in 2 containers. The jackets on both containers were torn, but no product was released.

The fuel tank from locomotive CP 8849 was sent to the TSB Engineering Laboratory for detailed examination.

1.3 Weather

At the time of the accident, the sky was clear. The temperature was 24°C.

1.4 Locomotive event recorder

Information from the locomotive event recorder (LER) on locomotive CP 8849 was reviewed. Table 1 provides further details on the events of the occurrence, including crew actions.

Table 1. Occurrence sequence of events and train 235 crew actions

Time	Event / train crew actions
0514:26	Train 235 arrived at Mile 1.5 on the North Toronto Subdivision (location of advance signal 15-2) while travelling at 47.8 mph.
0514:26 to 0516:20	The train speed was fluctuating between 45 mph and 49 mph. The throttle and dynamic brake handle were being operated between throttle position 1 and dynamic brake 1.4. The train brakes and the independent brakes were in the released position.
0515:49	At Mile 2.73, the headlights were dimmed and the ditch lights were extinguished.
0516:12	At Mile 3.03, the headlights were returned to full power and the ditch lights were turned back on.
0516:20	At Mile 3.13, the emergency brake application was initiated while the train was travelling at 46 mph.
0516:30	At Mile 3.2 (the location of controlled signal 33-2), the train was travelling at 35 mph.
0516:37	At Mile 3.3, while the train was travelling at 26.1 mph, there was another, sudden decrease in speed.
0516:47	At Mile 3.33 (about 250 feet west of signal 33-2), the train came to a stop, after travelling 1058 feet following the emergency brake application (i.e., coming to rest about 800 feet past the signal).

1.5 Stopping distance calculations

The deceleration profile of a similar train when placed into emergency was calculated in order to verify the braking function of train 235.

It was determined that the brakes on train 235 had functioned as expected. As well, when placed into emergency at the same location and initial speed of train 235, the train would have decreased to 26 mph at Mile 3.3 (i.e., the collision location).

1.6 Examination of the fuel tank from locomotive CP 8849

A detailed examination of the punctured fuel tank from locomotive CP 8849 determined the following:

• The breach occurred in the left side leading edge of the tank.
• The fracture surfaces were inclined and had a fibrous appearance, which is consistent with fresh ductile overload failure.
• The deformations associated with the fractures indicate the tank was torn open by a concentrated impact load.
• The breached area included the weld joining the side plate to the end plate of the fuel tank.

Two samples of the fuel tank were cut out near the breach for metallurgical examination: one from the end plate and one from the side plate. It was determined that

• The fuel tank met the required structural strength requirements of the American Association of Railroads (AAR) performance standard (AAR S5506) applicable at the time of manufacture.
• The fuel tank was breached due to ductile overload failure caused by a concentrated impact load during the collision.

1.7 North Toronto Subdivision

The North Toronto Subdivision consists of double main track between Mile 0.0 (Leaside) and Mile 5.9 (West Toronto). Train movements on this subdivision are governed by the centralized traffic control (CTC) method of train control, as authorized by the Canadian Rail Operating Rules (CROR), and are supervised by a rail traffic controller (RTC) located in Calgary, Alberta.

In the vicinity of the occurrence, the timetable speed for freight trains was 50 mph. At the time of the occurrence, there were no temporary slow orders in the immediate area.

The North Toronto Subdivision runs east to west. Westbound trains approach signal 15-2 (Mile 1.5) on a short stretch of tangent track after rounding a right-hand curve. At this location, the sightline to the signal mast is about 860 feet.

In the vicinity of the occurrence, the track grade increases slightly toward the west at 0.1%. For westbound trains approaching controlled signal 33-2 (Mile 3.3), the track is tangent with a sightline of about 2850 feet to the signal mast.

Just west of signal 33-2 is a set of crossover tracks with a maximum speed of 30 mph. These crossover tracks provide access for trains operating in either direction to the other track (i.e., between the north and south tracks).

1.8 Train crew information

The LE for train 235 was hired by CP in June 1997 and had initially worked as a conductor before qualifying as an LE in December 2007. The LE then worked out of Hamilton, Ontario, and Toronto as both a conductor and an LE. In January 2011, the LE was qualified to operate on the North Toronto Subdivision. As of the date of the occurrence, the LE had worked 86 tours of duty as an LE and 220 tours of duty as a conductor on the North Toronto Subdivision.

The employment history of the conductor is summarized in Table 2.

Table 2. Train 235 conductor employment history

Date	Employment details
June 2012	Hired by CP to work in Smiths Falls, Ontario.
October 2012	Qualified as a conductor.
November 2012	Laid off.
17 November 2014	Rehired on a temporary relocation to Toronto.
09 January 2015	Recertified as a conductor after completing a number of mandatory training programs and 33 familiarization trips, including 5 on the North Toronto Subdivision.
18 February 2015	Laid off. Temporary relocation ends.
01 March 2015	Rehired on another temporary relocation to Toronto.
01 June 2015	Permanently transferred to Toronto.
08 June 2015	Laid off.
21 March 2016	Rehired to work in Toronto. Started a program of mandatory training, which included 15 familiarization trips, all of them in yards.
18 July 2016	Laid off.
20 August 2016	Rehired to work in Toronto.

From November 2014 to August 2016, the conductor had worked in Toronto for about 10 months intermittently. During this period, the conductor had worked 23 tours of duty on the North Toronto Subdivision: 9 for training and 14 as a qualified conductor.

Between March 2016 and August 2016, the conductor had worked 44 shifts, with 26 of the shifts in a yard. The remaining 18 shifts were on various CP subdivisions, including the North Toronto Subdivision. The shift on the date of the occurrence (21 August 2016) was the conductor's first following a 5-week lay-off. To convey his lack of experience to fellow crew members, the conductor wore a green vest when on duty.^{Footnote 5}

1.9 Training for locomotive engineers and conductors

At CP, candidates for the LE and conductor positions must first be medically qualified, CROR‑qualified (through classroom instruction followed by an exam), and security‑screened.

Once these requirements are met, the training program for LEs at CP includes classroom training followed by a week of one-on-one instruction in the field with a qualified LE. Upon completing the field instruction, trainees start on-the-job training, which lasts up to 18 months. During this period, trainees complete a number of training trips on various subdivisions with a supervising LE until they are proficient at train handling. These trips also help familiarize trainees with the subdivisions of their territory.

Within 3 months after the on‑the‑job training is completed, trainees undergo a mandatory evaluation test, performing LE duties while a qualified company officer rides in the cab of the locomotive. Upon successfully completing this trip, trainees are qualified as LEs.

The training program for conductors at CP includes classroom training followed by a week of one-on-one instruction in the field with a qualified conductor. Upon completing the field instruction, trainees begin on-the-job training, which lasts about 4 months. During this period, trainees complete a number of training trips on various subdivisions while accompanied by a qualified conductor. These trips also help familiarize trainees with the subdivisions and yards of their territory.

Within 3 months after the on-the-job training is completed, trainees undergo a mandatory evaluation test, performing conductor duties while a qualified company officer rides in the cab of the locomotive. Upon successfully completing this trip, trainees are qualified as conductors and are permitted to work without the supervision of another conductor.

At CP, crew members who are absent from service for an extended period must comply with the CP Return to Work Policy, including the following requirements:

• For absences longer than 3 months, the crew member must be medically requalified, CROR requalified, and security-screened.
• For absences longer than 12 months, the crew member must also complete a number of familiarization trips (subject to the discretion of the superintendent) and complete a mandatory evaluation ride accompanied by a qualified company officer.
• For absences greater than 18 months, the crew member must also pass all examinations required for the position. In addition, the crew member must requalify while working the position, on each subdivision within the assigned territory.

1.10 Subdivision familiarization

LEs and conductors are required to make at least one familiarization trip on each subdivision for which they are regularly subject to call. Familiarization trips involve riding with a qualified crew over the subdivision. Upon completion of the required trips and confirmation that the employee is comfortable with operating on the subdivision, the employee is considered familiar with the subdivision. If the employee feels that more trips are required to become familiar with the subdivision, the employee can meet with a company officer to determine the steps to become sufficiently familiar. These steps could include making additional trips on the subdivision with a qualified crew.

Employee familiarization with the subdivision can be evaluated on an ad hoc basis through train rides during proficiency testing.

Over the course of employment at CP, the occurrence conductor had requested additional familiarization trips on 2 occasions. After encountering resistance to these requests, the conductor escalated the requests through the union and was then provided with the additional familiarization trips.

On 06 August 2016, after being called back from lay-off status, the conductor enquired with the crew office (not a company officer) about obtaining additional familiarization trips. It was indicated that, after a 5-week lay-off, these would not likely be provided. The conductor did not escalate this request to the union or a company officer.

1.11 Proficiency testing

CP regularly conducts proficiency testing on its train crew members to evaluate their skills in train operation and their adherence to rules. These tests can be conducted in many ways, including observations during rides with the crew member in the locomotive cab, observations from the ground, evaluation of event recorder downloads, monitoring of radio communications, and radar speed measurements.

From January 2015 to August 2016, the LE was evaluated 80 times and achieved the necessary standard for 79 of these tests. During this same period, the conductor was evaluated 24 times and achieved the necessary standard for 23 of these tests. Neither of the 2 evaluations involving a fail rating was related to rules compliance while operating a train on the main track.

For evaluations conducted while operating on the main track and with a company officer riding in the cab of the locomotive, the LE had 5 tests and the conductor had 1 test. During these tests, the supervisor had the opportunity to evaluate the crew member's rules compliance and familiarity with the subdivision.

One such rule that was required to be evaluated is CROR Rule 34(b), "Fixed Signal Recognition and Compliance," which states in part,

The crew members achieved the necessary standard for these tests.

1.12 Visual perception and compliance with signals

Crew members' accurate and timely visual perception of signals is essential for compliance. The visual perception of signals and the associated crew action is a sequential process involving the following steps: detect and see, identify and call, confirm indication between crew members, and adjust train speed accordingly.

Familiarity with a territory improves crew members' knowledge of signal locations and enables them to take forward-planning (proactive) measures to detect and see signals. The knowledge of signal locations in a specific territory increases with the frequency of trips. When less familiar with a territory, crew members can refer to the track schematics, in a timetable, which identify the location of each signal. However, frequent reference to track schematics would reduce the amount of time spent observing outside and forward during the operation of the train. Alternatively, signals can be detected without prior knowledge of their locations; this is considered reactive, as opposed to proactive, detection.

1.13 Situational awareness

Situational awareness can be defined as perception, comprehension, and projection. The awareness of signal indications relies, as a first step, on visual detection. Several factors can affect detection and lead to inaccurate or incomplete situational awareness. These factors include, but are not limited to, channelling of visual attention on certain aspects of the environment to the detriment of other aspects or expectations.

When people shift their attention among different information sources, the accuracy of their situational awareness may be severely affected, and they may become trapped in a phenomenon called "attention narrowing" or "channelling." When succumbing to channelling, people lock in on certain cues or features of the environment they are trying to process and either intentionally or inadvertently drop their scanning behaviour. In these situations, people believe that the limited focus is sufficient because the situation they are attending to is most important in their minds at that time.

In other situations, people may fixate on certain information and forget to reinstate their information scan. These situations can also result in inaccurate situational awareness. Therefore, maintaining at least a high-level, overall understanding of events in the environment is essential for determining which factors are most important. Otherwise, it is often the neglected aspects of the situation that prove to be the key factors in loss of situational awareness.^{Footnote 6}

1.14 Centralized traffic control systems

Signal indications tell the crew how to control their train. Train crews are required to understand the signal indication, communicate their understanding of the signals to those within hearing distance, and take appropriate action to comply with the indication. According to CROR Rule 34, if there is uncertainty, the crew must take immediate action to ensure the safety of the movement, including stopping it in emergency if required.

Train control systems provide for safety during the operation of trains, during track work, and during maintenance on one or more main tracks. For main track in Canada, CTC is the most advanced method of rail traffic control used by railways. At each signal location, CTC track circuitry and associated systems allow for the display of a variety of signal aspects. In the field, the CTC system displays a combination of red, yellow, and green signal aspects to train crews.

The signal aspects convey to the train crew information about the speed and other limits within which the train may operate. The signal aspect also indicates whether the block^{Footnote 7} ahead is occupied by another movement.^{Footnote 8} Signal indications are progressive: the preceding signal can indicate what the next signal will display.

Signals are displayed on the RTC screen either as a stop or as a permissive indication,^{Footnote 9} and the CTC system allows the RTC to monitor a train's progress along blocks in a subdivision. However, the train's exact location within a block is not displayed on the RTC screen. Only the block that the train is in would be known. In addition, if a train is about to pass beyond an authorized point, the CTC system does not provide any indication to the train or to the RTC.

The CTC system has several types of signals, including controlled signals and advance signals.

Controlled signals are fixed signal installations situated at the entrance to a block to govern a movement entering or using that block. These signals display a stop aspect until requested to display a less restrictive aspect by the RTC. The signal system determines how permissive each signal will be.^{Footnote 10}

Advance signals are fixed signal installations used in connection with one or more other signals to govern the approach of a movement to that signal. If the advance signal is an advance clear-to-stop signal, it is, in effect, informing train crews of the next 2 signals.

1.15 Signal system information

In the vicinity of Howland, for westbound trains on the north track, there are 3 signals governing movements:

• Controlled signal 2063-2 (Mile 206.3 on the Belleville Subdivision), which governs movements approaching signal 15-2 (Mile 1.5 on the North Toronto Subdivision);
• Advance signal 15-2, which governs movements approaching controlled signal 33-2 (Mile 3.3 on the North Toronto Subdivision); and
• Controlled signal 33-2, which governs movements through this location, including the crossover tracks immediately to the west.

In this occurrence, controlled signal 2063-2 was displaying a green/red/red aspect (clear) as train 235 passed^{Footnote 11} (Table 3). Advance signal 15-2 was displaying a yellow/red aspect (clear to stop). Controlled signal 33-2 was displaying a red/red/red aspect (stop).

Signal 34-2 (Mile 3.4) was displaying a red/green/red aspect (medium to clear) as eastbound train 118 passed.

Table 3. Signal aspects

Signal aspect	Signal name	Train-handling requirement
Image	Clear	Proceed
Image	Clear to stop	Proceed, preparing to stop at next signal
Image	Stop	Stop
Image	Medium to clear	Proceed, medium* speed passing signal and through turnouts

* The "Definitions" section (p. 12) of the CROR specifies that medium speed is "[a] speed not exceeding 30 miles per hour."

1.16 Defences for train control systems

Strict compliance with rules is required during train operation: train crews are expected to react to the progression of wayside signal indications. However, in a complex system, such as rail transportation, even the most rigorous set of rules may not cover every possible event. In addition, even motivated and experienced employees are subject to the normal slips, lapses, and mistakes that characterize human behaviour. The defence in-depth philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors.

Following the TSB's investigation into the August 1998 train collision involving 2 CP trains near Notch Hill, British Columbia,^{Footnote 12} the Board identified safety deficiencies related to ensuring accurate signal interpretation by operating crew members. The Board recommended that

Following the investigation into the February 2012 derailment of a VIA Rail Canada Inc. passenger train near Burlington, Ontario,^{Footnote 13} the Board determined that, in the absence of additional physical fail-safe safety defences to reduce the consequences of inevitable human errors in signalled territory, the risk of collisions and derailments persists. The Board recommended that

Both recommendations are related to the TSB Watchlist issue "Following signal indications," which highlights the risk of serious train collision or derailment if railway signals are not consistently recognized and followed. In March 2017, the Board assessed the responses of Transport Canada (TC) and the Railway Association of Canada to recommendations R00-04 and R13-01 as follows:

The [Advisory Council on Railway Safety] Working Group concluded its mandate and presented its findings on train control technologies to the Advisory Council on Railway Safety (ACRS) on 20 September 2016. The final report of the Working Group recommended a targeted, risk-based and corridor-specific implementation of enhanced train control (ETC) technologies as the best option for Canada. On 25 January 2017, TC and the RAC hosted a workshop that was focused on understanding ETC systems and on the status of existing ETC implementations. The workshop brought together experts from Canada and the United States.

Building on the output of the Working Group, TC has scoped out the next phase of work which will be conducted by the Canadian Rail Research Laboratory (CaRRL). This work will include more in-depth analysis of relevant occurrence data, development of a methodology for risk prioritization and ranking corridors in the Canadian rail network and a case study to apply the methodology on a particular rail corridor.

The Board is encouraged that VIA has successfully completed a proof of concept system (GPStrain) that demonstrates the effectiveness of this technology to mitigate human factors. In addition, the Board is encouraged that TC will continue working with stakeholders in industry and labour to further study options to define an ETC implementation concept for Canada, taking into consideration the conclusions and recommendations of the Working Group report. However, despite the significant work on these research initiatives, there still remains no short-term plan to address the risk of train collision or derailment in the absence of additional backup safety defences.

With respect to LVVR [locomotive voice and video recorder] technology, the Board cautions that any defence in-depth concept of system safety design cannot be satisfied solely through additional layers of crew monitoring. Additional layers of physical defences are still required so that the risk of serious train collision or derailment can be effectively mitigated.

The Board considers the response to the recommendation to be Satisfactory in Part.

1.17 Technologies for ensuring signals are followed

The railway industry has developed various technologies to address the risk of crews misinterpreting or not following signal indications. The technologies in use or being developed on North American railways include physical defences, such as cab-signalling systems and positive train control.

1.17.1 Cab-signalling systems

Cab signalling is a communications system that provides track status information to a display device mounted inside the locomotive cab. The simplest systems display the wayside signal indication, while more advanced systems also display maximum permissible speeds. The cab‑signalling system can be combined with automatic train control systems to warn operating crews of their proximity to points of restriction and to initiate enforcement action to slow or stop a train.^{Footnote 14} Cab signals can reduce the risk associated with signal recognition errors.

In 1922, the U.S. Interstate Commerce Commission ruled that U.S. railroads must install some form of train control systems in one full passenger division by 1925. In response to this ruling, the first cab-signalling systems were developed and implemented in the United States.^{Footnote 15} Cab‑signalling systems have evolved and are now integrated into an automatic train control system that monitors signal indications and enforces associated speed restrictions. These systems remain in use in some U.S. passenger train corridors. In Canada, there is no cab‑signalling system in use by freight or passenger railways.

1.17.2 Positive train control

Positive train control (PTC) is an emerging train control technology that is designed to prevent

• train-to-train collisions;
• over-speed derailments;
• incursions into work zones; and
• movement of a train through a switch left in the wrong position.

If the operating crew does not initiate an adequate response, the PTC system is intended to automatically slow or stop the train. In the U.S., PTC technology has been under development for many years.

The September 2008 collision between a Metrolink passenger train and a Union Pacific freight train in Chatsworth, California, prompted the passage of the U.S. Rail Safety Improvement Act of 2008. This legislation mandated that, by 2015, PTC be installed on the higher-risk rail lines in the United States. However, due to a number of technical challenges, the deadline for implementing PTC was extended, from 31 December 2015 to 31 December 2018, with the possibility of a further 2-year extension on a railroad-by-railroad basis.

In Canada, there are no PTC systems in use by freight or passenger railways, and there are no planned PTC installations. Any application of PTC in Canada likely would not occur until a number of years after the U.S. implementation is complete. However, to meet the PTC requirements for U.S. operations, both Canadian National Railway Company (CN) and CP have PTC implementation plans. As part of CP's implementation plan, 505 locomotives are intended to be equipped with the required on-board systems. CP plans to install PTC on approximately 2112 miles of track in the United States. CN plans to equip 586 locomotives with the required on-board systems and install PTC on approximately 3563 route miles of track in the United States.

For both CN and CP, the PTC system will be based on the Interoperable Electronic Train Management System (I-ETMS). CN will install it on 39 subdivisions, and CP will install it on 22 subdivisions, corresponding to 62% and 89% of their total U.S. route miles (excluding yard limits), respectively. I-ETMS is a locomotive-centric train control system using a combination of locomotive, office, and wayside data that is integrated using a radio network. This system has the following functions:

• Alerting train crews to pending authority and speed limit violations, including passing a stop signal.
• Stopping trains before exceeding authority and speed limits, including stop signals.
• Interrogating upcoming wayside signals and switches in a train route when operating in I-ETMS territory.
• Protecting work zone limits by enforcing compliance with work zone restrictions.

This system is under development and is awaiting U.S. Federal Railroad Administration certification for use in revenue service.

1.18 Other occurrences involving inappropriate crew responses to signal indications

Between January 2007 and December 2016, there were 344 occurrences (Figure 4) where trains exceeded their limits of authority as a result of inappropriate crew responses to signal indications displayed in the field. Since 1998, the TSB has investigated 13 occurrences where a train exceeded its limits of authority, of which 11 resulted in a collision or a derailment (Appendix A). In each of these investigations, an operating crew member's misperception of wayside signal indications was determined to be a cause or a contributing factor.

1.19 Work/Rest Rules for Railway Operating Employees

Section 2.2 of the Transport Canada–approved Work/Rest Rules for Railway Operating Employees (the Work/Rest Rules) states the following:

2.2 Railway companies shall establish and maintain working conditions that allow:

1. operating employees sufficient opportunity to obtain adequate rest between tours of duty; and
2. alertness to be sustained throughout the duty period.

Section 2.3 of the Work/Rest Rules states, "Operating employees have a responsibility to report for work rested and fit for duty."

Section 6 (Fatigue Management Plans) of the Work/Rest Rules includes the following requirements:

6.1.1. Railway companies will implement fatigue management plans.

6.1.2. Fatigue management plans shall be designed to reduce fatigue and improve on-duty alertness of operating employees.

1.20 Train crew work schedule and rest history

Although CP operates trains according to a schedule, external factors (crew availability, other operational factors, weather, etc.) can result in freight trains operating at unscheduled times. Crews are called for trips as required. Trips are assigned to crew members from subdivision pools^{Footnote 16} that operate on a first-in, first-out basis. When the subdivision pool is exhausted, other pools are used to fill the vacancy. Initially, the spare board is used, followed by any other available pool, including the yard foreman board. When crew members finish a trip, or are unable to accept the trip, their names are repositioned to the bottom of their respective pools for reassignment.

In this occurrence, the LE of train 235 was assigned to the spare board. The conductor was assigned to the yard foreman board. This meant that the crew members could be ordered out of Toronto for any assignment working in the yard or on the main line and for any assignment over a subdivision on which they were qualified.

On 20 August 2016, the LE went off duty at 1300, obtaining some sleep during the day. That evening, the LE checked the train lineup,^{Footnote 17} which had last been updated at 1830 and indicated that train 235 was estimated to be ordered for about midnight. The LE was to be back on duty at 2300 and would therefore be eligible to crew any train after 0100. The LE noted that the first train after 0100 was likely scheduled for 0700, and went to bed at about 2215, expecting to be ordered for this train. The LE requested that the call be placed about 1.5 hours prior to the ordered time, instead of the standard 2 hours.

However, because there was difficulty crewing train 235, its departure was delayed until 0445, when the LE was on duty. The LE was called at 0315 for train 235.

The LE's work–rest schedule for the 7 days preceding the occurrence is summarized in Table 4.

Table 4. Work–rest schedule leading up to the occurrence for locomotive engineer of train 235
LE's work–rest schedule

Date	Time called	Time ordered	Time off duty	Sleep history
15 August 2016	No work shift			Slept at home for about 8 hours.
16 August 2016	No work shift			Slept at home for about 8 hours.
17 August 2016		1600	0028 (18 August)	Slept at home for about 8 hours.
18 August 2016	No work shift			Slept at home for about 8 hours.
19 August 2016	0500	0635	1300	Slept in a motel from 1500 to 1800 and from 2200 to 0430.
20 August 2016	0430	0505	1300	Had some sleep during the day and slept at home from 2215 to 0330.
21 August 2016 (occurrence)	0315	0445

The conductor had been laid off for the 5 weeks preceding the occurrence and was living in Smiths Falls, Ontario. On 06 August 2016, the conductor was called back to work and advised to book on for duty in Toronto any time before 2359 on 20 August 2016.

The conductor travelled to Toronto 5 days prior to the occurrence to arrange living accommodations. For several nights preceding the occurrence, the conductor slept in his car. Having initial difficulty finding living accommodations, the conductor requested a later start date, but was refused.

On the morning of 20 August 2016, the conductor found living accommodations. At 2356 that evening, the conductor booked on. Checking the lineup shortly after booking on, the conductor determined that he would not likely be scheduled for any road work. At 0215 on 21 August 2016, the conductor received a call from the crew office and accepted the call for train 235, which was ordered at 0445.

The conductor's rest history^{Footnote 18} is summarized as follows:

• On 19 August 2016, the conductor had the opportunity to sleep in his car between 2345 and 0700 the next day.
• On 20 August 2016, the conductor had the opportunity to sleep in his car between 0745 and 0945, and between 1945 and 2110.
• On 20 August 2016, the conductor booked on just before midnight, then had the opportunity to sleep, and likely slept, between 0030 and 0220.

When the crew came on duty at 0445, both crew members considered themselves to be rested and fit for duty according to the Work/Rest Rules.

1.21 Fatigue

Unpredictable estimated times for the train lineup can make it difficult for crew members to anticipate a work call and to plan for and obtain good-quality sleep. To help crew members obtain adequate rest, railways have implemented strategies such as improved access to train lineup information.

Sleep-related fatigue or sleepiness increases the likelihood of execution or planning errors. TC's guidelines have identified several risk factors that can increase the likelihood of operator impairment due to lack of sleep.^{Footnote 19} Table 5 summarizes the risk factors and indicates whether each factor was present for each of the crew members.

Table 5. Fatigue risk factors for train 235 crew members

Fatigue risk factor*	LE	Conductor
The total length of the work shift exceeding 14–16 hours	No	No
Continuous hours of wakefulness beyond 19 hours	No	No
Working between the hours of 0000 and 0600	Yes	Yes
Obtaining less than 6 hours of continuous sleep in a 24‑hour period**	Yes	Yes
Break times that do not permit reasonable recuperative times (<8 hours)	No	No
Continuous work beyond 64 hours in a 7-day period	No	No
Less than 2 consecutive nights of recuperative sleep	No	Possibly***
Continuous work for over 5 hours without at least a 30‑minute break	No	No
Undiagnosed, untreated medical conditions that may affect fatigue	No	No
Differences in ability to sleep and respond to conditions (age, etc.)	No	No
Quality of sleep	No	Possibly***

* Exceeding the risk factors will not automatically lead to an accident. These risk factors were based on the best judgment of the science available. There was not necessarily a one-to-one causal relationship between these factors and the occurrence of accidents and injuries.

** This risk refers to a minimum of 6 hours of sleep per day.

*** The conductor slept several consecutive nights in a car.

The call for duty had come earlier than anticipated, so the LE rose earlier than anticipated, resulting in a sleep debt of about 3 hours. The conductor had been sleeping in a car for several consecutive nights, potentially affecting the quality and quantity of sleep. Therefore, the conductor likely had a sleep debt.

1.22 Locomotive voice and video recorders

In January 1999, a VIA passenger train, travelling at 97 mph, passed a stop signal near Trenton, Ontario (TSB Railway Investigation Report R99T0017). Following an emergency brake application, the train came to a stop. There were no injuries to passengers or crew members. The investigation determined that the crew members had been engaged in conversations just before the occurrence. This distraction had likely contributed to the incident. Had the controlling locomotive cab been equipped with a voice recorder, it may have been possible to determine more definitively the effectiveness of the crew's communications as they approached the occurrence location. In July 2003, the TSB recommended that

In February 2012, a VIA passenger train entered a crossover near Burlington, Ontario, while travelling at about 67 mph (TSB Railway Investigation Report R12T0038). The crossover had an authorized speed of 15 mph. The locomotive and all 5 passenger coach cars derailed. The operating crew members were fatally injured, and 45 people sustained various injuries. The investigation report stated that, in the absence of voice and video recorders, it was difficult to identify with certainty the human factors that had contributed to the inappropriate crew response to the signal indications displayed. In addition, the dynamics and interaction between the 3 operating crew members could not be accurately determined. In June 2013, the TSB recommended that

In March 2017, the Board assessed TC's responses to recommendations R03-02 and R13-02 as follows:

This recommendation is related to the TSB Watchlist issue of "On-board voice and video recorders". Without a requirement for on-board voice and video recorders on locomotives, key information to advance railway safety may not always be available. [...]

In September 2016, the Transportation Safety Board released its safety study report on LVVR. This safety study, which included participation from TC and key rail stakeholders (i.e., railways and unions), identified some best practices, identified and evaluated implementation issues, examined potential safety benefits of the expanded use of on-board recorders, and collected background information for the development of an action plan to implement LVVR. The report also highlighted that LVVR could support proactive safety management by railway companies, as well as post-accident investigations.

On 03 November 2016, the Minister of Transport publicly announced a commitment to mandate in Canada the installation and use of voice and video recorders in locomotive cabs. Following this announcement, TC is developing legislation and regulations to not only require installation and use of this technology for proactive safety management, but to protect the privacy of employees to the extent possible.

The Board considers the response to the recommendation to have Satisfactory Intent.

Other TSB investigation reports have reiterated the above recommendations.^{Footnote 20}

The results of these investigations suggest that the use of LVVRs is the only objective and reliable method to more definitively determine the influence of human factors—such as employee communications, distractions, fatigue, and training—on a railway occurrence. When causal links and related safety deficiencies can be confirmed, any resulting recommendations can be better tailored to address the underlying issues and to maximize rail safety improvements.

The TSB's September 2016 Railway Safety Issues Investigation Report R16H0002, Expanding the use of locomotive voice and video recorders in Canada, determined that there was no disagreement that LVVRs can lead to safety benefits. However, stakeholders had differences of opinion about appropriately using on‑board recordings while protecting the rights and obligations of all involved. Once these differing perspectives are reconciled, implementation of this technology will result in considerable safety benefits to the railway industry.

On 16 May 2017, the Minister of Transport introduced a bill in the House of Commons proposing amendments to the Railway Safety Act and the Canadian Transportation Accident Investigation and Safety Board Act to begin the process of installing LVVRs in the cabs of lead locomotives.

1.23 TSB Watchlist

The safety issues in this occurrence are related to three issues on the 2016 Watchlist. The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

• Following railway signal indications: accidents resulting from errors when following signal indications continue to occur.
• On-board voice and video recorders: valuable data is going unrecorded, hindering the progress of TSB safety investigations and affecting the capability of railways to improve safety management systems.
• Fatigue management systems for train crews: accidents involving fatigue continue to occur.

1.24 TSB laboratory report

The TSB completed the following laboratory report in support of this investigation:

• LP213/2016 – Locomotive Fuel Tank Examination

There were no mechanical deficiencies with the locomotives or with the signal system that contributed to the accident. The analysis will focus on the factors affecting signal recognition by the train crew, including distraction, situational awareness, and subdivision familiarization. The analysis will also include sleep debt, locomotive voice and video recorders (LVVRs), and the integrity of locomotive fuel tanks.

2.1 The accident

At the time of the occurrence, the signal system was functioning as designed. Eastbound train 118 was operating in accordance with the signal indications, but westbound train 235 was not. The collision occurred when train 235 was operated past controlled signal 33‑2, which was displaying a stop indication, and train 235 then struck the side of train 118, which was operating through the crossover from the north to the south track.

Just prior to the occurrence, train 235 was operated past advance signal 15-2, which was displaying a clear-to-stop indication, without slowing or preparing to stop at controlled signal 33-2. Braking was not initiated until it was too late to safely stop the train. The manner in which the train was being operated was consistent with the train crew not observing the advance signal, and then observing controlled signal 33‑2 too late.

To ensure that trains are operated in a safe manner and in accordance with the train control system, crew members are required to identify the signal indications and verbally communicate the indications to each other within the locomotive cab. Following this procedure would ensure a common understanding of the signal's aspect and of the necessary train-handling actions, minimizing the potential for signal recognition errors.

In this occurrence, the locomotive engineer (LE) did not observe advance signal 15-2. Although controlled signal 33-2 (stop) was visible from 2850 feet away, the LE only noticed it when the train was about 800 feet away, and it was then that the emergency brake was applied. The requirement to call signal indications within the cab should have alerted the LE to the train‑handling restrictions ahead. However, the investigation could not determine why the crew of train 235 did not establish a common understanding of the signal indication at advance signal 15-2 or a sufficiently early common understanding at controlled signal 33‑2.

2.2 Missed signal indication at advance signal 15-2

Two factors contributed to the crew of train 235 missing the signal indication at advance signal 15-2: lack of planning and distraction.

2.2.1 Lack of planning before approaching signal 15-2

The sightline distance for westbound trains leading up to advance signal 15-2 was about 860 feet. After the train had rounded the right-hand curve, while travelling at about 48 mph, the train crew would have had about 12 seconds at this sightline distance to observe the signal indication. Crew inattention during this period could also result in signals being missed altogether.

To support safe train operation, railways ensure that crew members are familiar with the subdivision and that they possess the relevant documents, including signal locations, that help crew members guard against the challenges posed by sightline distances. With this experience and information, train crews can be proactive by planning ahead to help ensure that they are prepared to observe each signal indication. Planning did not occur for signal 15‑2, resulting in a missed opportunity for the crew to prepare themselves to observe the signal.

2.2.2 Distraction and situational awareness

Leading up to advance signal 15-2, the LE was overly focused on manipulating the throttle and dynamic brake controls in accordance with company rules, in order to operate as close to the speed limit as possible without exceeding it.

Although considered familiar with the North Toronto Subdivision, the conductor was still referring to the subdivision documents on a regular basis to determine the train's location.

As train 235 approached signal 33-2, the crew had about 42 seconds to view the signal. During this time, in addition to operating the train and reviewing the timetable, the crew members were focused on observing train 118 on the adjacent track and searching for a possible trespasser. With a number of ongoing tasks being performed, the train crew's situational awareness was likely diminished. The crew's attention was being diverted from the high-priority task of signal recognition, resulting in the crew neither observing nor calling the 2 signals.

2.3 Crew member sleep debt

On the night of 20 August 2016, the LE had planned to sleep for at least 7 hours. The LE believed that train 235 would depart by midnight on 20 August and that he would likely be ordered for a train scheduled for 0700 on 21 August. However, due to difficulty crewing train 235, its departure was delayed until 0445 on 21 August. The LE was called at 0315 for this train, resulting in a sleep debt that morning of about 3 hours.

Just prior to midnight, the conductor had returned from lay-off and booked on. At 0215 on 21 August, the conductor was called for train 235. Prior to the call, the conductor had likely slept for a short period between 0030 and 0215. Over the previous few days, the conductor had had several opportunities to obtain rest. However, the quality of this rest was not ideal, as the conductor was sleeping in his car. With the short period of sleep in the early morning of 21 August 2016, combined with the poor quality of rest during the previous few days, the conductor likely had a sleep debt at the time of the occurrence.

The crew members' sleep debt would have made each of them more susceptible to fatigue. Moreover, as the train was being operated during a time of day that is associated with low circadian rhythms, the crew members' susceptibility to fatigue would have been further increased.

However, the restorative effects of sleep duration and sleep quality vary for each individual. In addition, the crew were only 15 minutes into their journey, which would have lessened the likelihood of fatigue affecting the crew's performance at the time of the occurrence. Therefore, although both crew members carried a sleep debt and the train was being operated during a period of low circadian rhythm, it could not be determined whether fatigue affected the crew members' performance relating to signal recognition.

2.4 Safety defences against signal recognition errors

Rail transportation is a complex system. The defence in-depth philosophy advocated by safety specialists for complex systems seeks multiple and diverse lines of defence to mitigate the risks of normal human errors. Wherever possible, a combination of rules-based (i.e., administrative) defences and physical defences should be implemented to address normal slips, lapses, and mistakes that characterize human behaviour.

In this occurrence, there were safety defences in place on the North Toronto Subdivision to help prevent an accident of this type. Some of these defences were associated with the train control system and some were associated with rules and procedures, including the Canadian Rail Operating Rules and General Operating Instructions. However, these defences are administrative in nature. For example, even the train control system (based on wayside signals) had the administrative requirement for train crews to follow the signal indication. Specifically, this defence relies on train crews observing each signal indication and then taking the appropriate actions. If the crew does not correctly observe the signal indication or does not take the appropriate action, the defence as a whole fails. Physical fail-safe technologies are in use or being developed on North American railways that address the risk of crews misinterpreting or not following signal indications.

Over the last 10 years, 344 occurrences have been reported to the TSB in which the train exceeded its limits of authority after an inappropriate crew response to the signal indications displayed in the field. Moreover, the TSB has investigated 11 occurrences since 1998 where a collision or a derailment resulted from an operating crew member's misperception of wayside signal indications. These occurrences demonstrate that wayside signals and administrative defences, although usually effective, are not always consistently applied. If train control systems rely only on administrative defences rather than physical defences to ensure the safe operation of trains, signal recognition errors may not be adequately mitigated, increasing the risk of train collisions and derailments.

2.5 Familiarization trips following absences from the workplace

Despite having worked at Canadian Pacific Railway (CP) for 4 years, the conductor had only accumulated 15 months of operational experience. For 5 of those 15 months, the conductor was working in Smiths Falls, and was stationed in Toronto Yard for the remaining 10 months. While stationed in Toronto Yard, the conductor had been working intermittently over a 21-month period, due to a number of lay‑offs. As a qualified conductor, the conductor spent approximately one third of the time in road service. The other two thirds were spent in yard service. Due to this discontinuous work history focused primarily on yard service, the conductor did not believe that he had mastered all the skills required for the position. Consequently, he continued to wear a green vest when on duty to inform other operating crew members of his level of experience.

CP guards against the risks presented by qualified crew members from operating in territory that they do not feel familiar with by allowing them to request additional familiarization trips. In addition, CP guidelines allow familiarization trips for employees who have been absent from the workplace for at least 12 months. Any other familiarization trips are at the discretion of a company officer.

After returning from a 9-month lay-off in March 2016, the conductor requested and received a number of familiarization trips. Although these trips were granted, all took place in yards. The conductor had not operated on the North Toronto Subdivison for more than 9 months, and the familiarization trips given did not aid in improving his familiarization.

As well, after returning from a lay-off on 20 August 2016, the conductor was advised by a crew dispatcher that it was unlikely the company would grant additional familiarization trips after a lay-off of only 5 weeks. Because of the difficulty he had experienced obtaining familiarization trips in the past, the conductor did not request further trips from his manager immediately upon his return, despite not being fully comfortable operating on the North Toronto Subdivision.

Following extended workplace absences, if additional familiarization trips are not made available to operating employees to ensure that they are fully comfortable with their designated territory, crew members may not be sufficiently prepared, increasing the risk of train accidents.

2.6 Locomotive voice and video recorders

In this occurrence, many aspects of the dynamics and interaction between the crew members of train 235 could not be determined with certainty. The absence of this information left a number of important questions partially answered:

• Were all signals correctly identified?
• Were all signals called?
• Were all signals acknowledged by the other crew member?
• What impact did the distractions in the locomotive cab have with respect to signal recognition?

These types of questions are typically examined during investigations of occurrences related to missed signals. The answers to these questions eliminate extraneous factors that were not pertinent, allowing the investigation to quickly focus on the hazards or causal elements. Accident investigators would benefit from the more efficient, timely, and accurate collection, assimilation, and analysis of this type of information.

The use of locomotive voice and video recorders (LVVRs) is an objective and reliable method of more definitively determining the role that human factors (e.g., crew communications, distraction, fatigue) play in a railway occurrence. When causal links and related safety deficiencies can be confirmed, the resulting findings and any recommendations can be better tailored to address the underlying issues and maximize rail safety improvements. This also results in the timely communication of safety deficiencies.

However, in this occurrence, without audio or visual recordings, it could not be determined with certainty whether the dynamics and interaction between the crew members, including potential distractions, contributed to the crew's signal recognition errors. If locomotive in‑cab voice and video recorders are not installed on lead locomotives, there is a risk that valuable information that can lead to the identification and elimination of safety deficiencies will continue to be unavailable.

2.7 Integrity of locomotive fuel tank

The examination of the locomotive fuel tank determined that the fuel tank had breached due to ductile overload failure caused by a concentrated impact load during the collision. The damage that occurred as a result of the accident was the only anomaly noted on the fuel tank.

The locomotive fuel tank met the structural strength requirements of the American Association of Railroads Standard S-5506 that was applicable at the time of manufacture. Despite the rupture due to a concentrated impact load during the collision, the locomotive fuel tank and associated materials performed as designed.

3.1 Findings as to causes and contributing factors

1. The collision occurred when train 235 was operated past controlled signal 33-2, which was displaying a stop indication, and train 235 then struck the side of train 118, which was operating through the crossover from the north to the south track.
2. Train 235 was operated past advance signal 15-2, which was displaying a clear‑to‑stop indication, without slowing or preparing to stop at controlled signal 33-2.
3. The crew's inadequate planning for signal 15-2 resulted in a missed opportunity for the crew to prepare themselves to observe the signal.
4. Braking was not initiated until it was too late to safely stop the train. The manner in which the train was being operated was consistent with the train crew not observing advance signal 15-2, and then observing controlled signal 33-2 too late.
5. With a number of ongoing tasks being performed, the train crew's situational awareness was likely diminished. The crew's attention was being diverted from the high‑priority task of signal recognition, resulting in the crew neither observing nor calling the 2 signals.

3.2 Findings as to risk

1. If locomotive in-cab voice and video recorders are not installed on lead locomotives, there is a risk that valuable information that can lead to the identification and elimination of safety deficiencies will continue to be unavailable.
2. If train control systems rely only on administrative defences rather than physical defences to ensure the safe operation of trains, signal recognition errors may not be adequately mitigated, increasing the risk of train collisions and derailments.
3. Following extended workplace absences, if additional familiarization trips are not made available to operating employees to ensure that they are fully comfortable with their designated territory, crew members may not be sufficiently prepared, increasing the risk of train accidents.

3.3 Other findings

1. The investigation could not determine why the crew of train 235 did not establish a common understanding of the signal indication at advance signal 15-2 or a sufficiently early common understanding at controlled signal 33-2.
2. Although both crew members carried a sleep debt and the train was being operated during a period of low circadian rhythm, it could not be determined whether fatigue affected the crew members' performance relating to signal recognition.
3. Without audio or visual recordings, it could not be determined with certainty whether the dynamics and interaction between the crew members, including potential distractions, contributed to the crew's signal recognition errors.
4. Despite the rupture due to a concentrated impact load during the collision, the locomotive fuel tank and associated materials performed as designed.

4.1 Safety action taken

4.1.1 Canadian Pacific Railway

On 21 August 2016, Canadian Pacific Railway (CP) issued a system bulletin amending Item 19.3 of its Rule Book for Train and Engine Employees. The "Clear to Stop" signal instruction was revised from "Proceed, preparing to stop at next signal"to read

On 25 August 2016, CP issued another system bulletin revising the "Limited to Stop" signal instruction from "Proceed, LIMITED speed passing signal and through turnouts, preparing to stop at next signal"to read

CP added the following special instruction to Rule 411 (Clear to Stop) and Rule 421 (Limited to Stop) in its CROR manual: "Movements must reduce to a speed not exceeding 30 MPH (40 MPH passenger). Reduction in speed must commence before passing signal."

CP issued a system bulletin requiring that CROR Rule 578(a) be applied on both single- and multi-track territory:

CP also reissued Rule of the Week 022, which reminds employees of the actions to take when signals are not positively identified, and issued Rule of the Week 028 requiring that CROR Rule 578(a) be applied on both single- and multi-track territory.

4.1.2 Transport Canada

Transport Canada conducted an administrative investigation into this occurrence and 2 other alleged Rule 439 violations by CP crews in Ontario between 21 August 2016 and 24 October 2016. On 14 March 2017, Transport Canada issued an administrative monetary penalty to CP, stating in part,

Canadian Rail Operating Rules Railway Safety Act ^{Footnote 21}

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. The Board authorized the release of this report on 27 June 2017. It was officially released on 01 August 2017.

Appendix A – Similar past occurrences

Since 1998, the TSB has investigated 13 similar occurrences.

R16T0162 (Montréal) – On 11 December 2015, at approximately 0925 Eastern Standard Time, VIA Rail Canada Inc. (VIA) passenger train No. 605, carrying 14 passengers, was travelling west on the north track of Canadian National's Montreal Subdivision. At Mile 6.30, the train derailed while negotiating a crossover at 55 mph, where the authorized speed was 15 mph. About 1600 feet of railway track was damaged. An on-board service employee sustained minor injuries. The investigation determined that if other physical defence methods for controlling trains in signalled territory are not in place, the risks of collision and derailment are increased when signal indications are not correctly recognized or followed.

R15V0183 (Beavermouth) – On 06 September 2015, CP train 602-242 collided with westbound CP train 113-01, which was entering the siding track near Beavermouth, British Columbia. As a result of the collision, 2 locomotives and the first car behind the locomotives derailed on train 602-242 as well as one set of trucks on the 64th car on train 113‑01. The conductor sustained a serious injury. No dangerous goods were released. The investigation determined that if existing signal systems are not enhanced to include physical fail-safe capabilities, signal indications will continue not to be followed, increasing the risk of train collisions and derailments.

R14T0294 (Newtonville) – On 28 October 2014, at about 1015 Eastern Daylight Time, VIA train 62 (coupled to train 52's equipment), proceeding east on the Kingston Subdivision at 85 mph with a permissive signal indication, approached signal 2784S, which was displaying a stop indication. The crew applied emergency brakes and passed the signal, coming to a stop approximately ¼ mile ahead. There were no injuries or conflicting movements. The investigation determined that if additional physical fail-safe train control defences in signalled territory are not available when signal indications are not correctly identified and followed, train movements will not be adequately protected, increasing the risk of collisions and derailments.

R13C0049 (Dunmore) – On 18 May 2013, at about 1330 Mountain Daylight Time, CP train 351 was operating westward on the north main track of the Maple Creek Subdivision. Approaching Dunmore, Alberta, the train struck the side of eastbound CP train 100, which was departing Dunmore from the north main track through the crossover onto the Depot 1 track. As a result of the collision, the 2 lead locomotives and the following 2 cars on train 351 derailed. On train 100, 2 cars derailed and several other cars sustained damage. The conductor of train 351 sustained minor injuries and was taken to hospital. The investigation determined that if existing centralized traffic control systems are not enhanced to include physical fail-safe capabilities, signal recognition errors will remain undetected, increasing the risk of train collisions and derailments.

R13Q0001 (Mai) – On 11 January 2013, at approximately 0018 Eastern Standard Time, Quebec North Shore and Labrador Railway (QNS&L) freight train FCN 05 collided with the rear end of iron ore train BNL 005 at Mile 124.2 on the QNS&L Wacouna Subdivision, near Mai, Quebec. The first locomotive on train FCN 05 was destroyed and the second locomotive derailed. Eight cars on train BNL 005 derailed. The crew members on train FCN 05 sustained minor injuries. Approximately 40 feet of track were damaged. The investigation determined that in the absence of additional physical fail-safe train controls in signalled territory, the existing defences proved inadequate to prevent the collision.

R12T0038 (Aldershot) – On 26 February 2012, VIA train No. 92 (VIA 92) travelled east from Niagara Falls to Toronto, Ontario, on track 2 of the CN Oakville Subdivision. Beyond the stop at Aldershot Station, the track switches were lined to route the train from track 2 to track 3. The last signal required the train to proceed at 15 mph. VIA 92 entered the crossover at about 67 mph, causing the locomotive and all 5 coaches to derail. The operating crew was killed; 44 passengers and the VIA service manager were injured. About 4300 litres of diesel fuel spilled from the locomotive fuel tank. As a result of the investigation, the TSB recommended that Transport Canada require major Canadian passenger and freight railways to implement physical fail-safe train controls, beginning with Canada's high-speed rail corridors (TSB Recommendation R13-01).

R11E0063 (Bailey) – On 23 June 2011, at approximately 0625 Mountain Daylight Time, CN freight train Q10131-21, proceeding westward at 25 mph on the Wainwright Subdivision, collided with the tail end of CN freight train A41751-23 at Mile 262.30. As a result of the collision, 2 intermodal flat cars derailed (3 car bodies) and locomotive CN 2234 was damaged. The investigation determined that, in the absence of additional back-up safety defences in signalled territory, when signal indications are not correctly identified or followed, existing defences may not be adequate to reduce the risk of collision and derailment.

R10Q0011 (Saint-Charles-de-Bellechasse) – On 25 February 2010, VIA train No. 15 was proceeding westward from Halifax, Nova Scotia, to Montréal, Quebec. At approximately 0425 Eastern Standard Time, near Saint-Charles-de-Bellechasse, Quebec (Mile 100.78 of the CN Montmagny Subdivision), the train entered a siding switch, which had an authorized speed of 15 mph, while travelling at approximately 64 mph. Two locomotives and 6 passenger cars derailed. Two locomotive engineers and 5 passengers were injured. In this accident, advance knowledge of the location of an opposing CN train influenced the crew's expectation that they would not be taking the siding. The investigation determined that existing defences, such as 2‑person crews and the centralized traffic control system, do not ensure that signal indications will always be followed. In the absence of additional defences, the risk of serious train collisions or derailments remains.

R10V0038 (KC Junction) – On 03 March 2010, at about 1410 Pacific Standard Time, CP train 300-02, operating eastward on the north track of the Mountain Subdivision approaching KC Junction, British Columbia, collided with the side of westbound CP train 671‑037 when it was departing Golden from the north track through the crossovers onto the south track. As a result of the collision, 3 locomotives and 26 cars derailed. The crew members of train 300-02 were transported to hospital for observation. The investigation determined that, in the absence of enhanced protection against signal recognition errors, such as that provided by cab signalling systems or positive train control (PTC), CTC and its current defences do not always adequately ensure that the requirements of signals are followed.

R09V0230 (Redgrave) – On 30 October 2009 at about 2225 Pacific Daylight Time, CP train 355‑429, operating westward on the signalled siding track at Redgrave, British Columbia (Mountain Subdivision), collided with the side of eastbound CP train 110‑30, which had stopped on the main track. As a result of the collision, 2 locomotives and 6 cars derailed. The investigation determined that intervention from a system such as PTC may have been able to compensate for the signal misidentification and prevent the collision.

R07E0129 (Peers) – On 27 October 2007, a collision between CN trains 417 and 342 at Peers, Alberta, derailed 1 locomotive and 27 cars and damaged an additional 14 cars. There were no serious injuries. The TSB investigation determined that intervention from a PTC-type system may have been able to compensate for the locomotive engineer's loss of situational awareness and prevent the collision.

R99T0017 (Trenton Junction) – On 19 January 1999, VIA Rail Canada Inc. train No. 52 travelled east passed signal No. 2328S at Mile 232.8 of the CN Kingston Subdivision at the Trenton Junction Station while the signal was indicating "stop." The train subsequently passed through a main-track switch, which was in the reverse position in a trailing movement direction, and came to a full stop at Mile 232.17. There were no injuries, and there was no derailment or damage to property other than the switch that was forced open by the train wheels as it passed. In the "Action Required" section of the report, and as a result of the Notch Hill accident, the TSB safety recommendation indicated that the Department of Transport and railway industry should implement additional backup safety defences to help ensure that signal indications are consistently recognized and followed (TSB Recommendation R00-04).

R98V0148 (Notch Hill) – On 11 August 1998, CP train 463-11 collided with the rear end of Pacific Railway train No. 839-020 at Mile 78.0 of the CP Railway Shuswap Subdivision, near Notch Hill, British Columbia. One car on train 463-11 and 2 cars on train 839-020 derailed. There were no injuries. The TSB identified 2 safety deficiencies related to the backup safety defences for signal communication and the impact of noise on the communications of safety‑critical information between crew members on locomotive cabs.