Thursday, February 19, 2015

TRANSPORTATION SAFETY BOARD ASSESSES TRANSPORT CANADA’S RESPONSE TO LAC-MÉGANTIC INVESTIGATION RECOMMENDATIONS: SIGNIFICANT PROGRESS MADE, MORE WORK REQUIRED





28 JANUARY 2015

GATINEAU, QUEBEC

While recognizing significant positive action taken by the regulator, the Transportation Safety Board of Canada (TSB) remains concerned about Transport Canada’s (TC) response to outstanding recommendations stemming from its investigation into the Montreal, Maine & Atlantic Railway (MMA) train that derailed on 6 July 2013 in Lac-Mégantic, Quebec.
“Transport Canada continues to take important steps to address the rail safety deficiencies we identified in our Lac-Mégantic investigation,” said Kathy Fox, Chair of the TSB. “With respect to preventing runaway trains, TC has introduced multiple layers of defenses that, if fully implemented, will significantly reduce risks. But with respect to TC auditing and oversight activities, we are concerned that the department has not yet put in place an effective oversight regime that guarantees all railways will be audited in sufficient breadth and frequency to ensure safety issues are addressed in a timely manner.”

Prevention of runaway trains: Unattended equipment (R14-04)
The investigation determined that more robust defenses are required to prevent runaways. Even if they have a low probability of occurrence, these events can have extreme consequences, particularly if they involve dangerous goods—as was seen in Lac-Mégantic. For this reason, the Board recommended that TC require Canadian railways to implement additional physical defenses to prevent runaway equipment.

In October 2014, TC issued an Emergency Directive (which expires 29 April 2015) that addresses many of the weaknesses in the Canadian Rail Operating Rules pertaining to the securement of equipment. Along with a standardized hand brake chart and explicit instructions for hand brake effectiveness testing, additional physical securement measures must be used. TC also said it will hire additional specialized staff to strengthen oversight related to train securement and to monitor compliance with these additional levels of defense to prevent runaways. If the proposed measures are fully implemented on a permanent basis, the risk of runaway equipment will be significantly reduced; therefore, the Board assesses the response as having Satisfactory Intent.

Safety management systems audits and essential follow-up (R14-05)
Until Canada's railways make the cultural shift to safety management systems (SMS), and TC makes sure they have effectively implemented SMS, the safety benefits will not be fully realized. For this reason, the Board recommended that TC audit the SMS of railways in sufficient depth and frequency to confirm that the required processes are effective, and that corrective actions are implemented to improve safety.

TC has committed to bringing into force additional regulations and enforcement capabilities, hiring more auditors and strengthening its training programs. While significant progress has been made, TC has not yet demonstrated that it has implemented an effective oversight regime to ensure all railways will be adequately audited. Furthermore, TC has not committed to auditing every SMS component within a given time period. As a result, deficiencies within a railway's SMS may not be identified and addressed in a timely manner; therefore, the Board assesses the response as being Satisfactory in Part.

This issue has been identified as one of the key risks to the transportation system and it is included on the TSB's 2014 Watchlist.

“The Minister of Transport and the department have taken strong action to improve rail safety in the wake of the Lac-Mégantic tragedy, but more work needs to be done,” added Ms Fox. “We will continue to monitor the department and rail industry's progress in implementing new regulations and procedures introduced by TC. Canadians deserve no less than the safest transportation system.”


ASSESSMENT OF THE RESPONSE TO RAIL SAFETY RECOMMENDATION R14-04
Physical defenses to prevent runaway equipment

Background

On 06 July 2013, shortly before 0100 Eastern Daylight Time, eastward Montreal, Maine & Atlantic Railway freight train MMA-002, which had been parked unattended for the night on the main track at Nantes, Quebec, Mile 7.40 of the Sherbrooke Subdivision, started to roll. The train travelled about 7.2 miles, reaching a speed of 65 mph. At about 0115, while approaching the centre of the town of Lac-Mégantic, Quebec, 63 tank cars carrying petroleum crude oil, UN 1267, and 2 box cars derailed. As a result of the derailment, about 6 million litres of petroleum crude oil spilled. There were fires and explosions, which destroyed 40 buildings, 53 vehicles, and the railway tracks at the west end of Megantic Yard. A total of 47 people were fatally injured, and there was environmental contamination of the downtown area, and the adjacent river and lake.

In this accident, the train was secured at Nantes both with hand brakes and locomotive air brakes. However, a proper hand brake effectiveness test had not been conducted to ensure that the hand brakes alone would hold the train. When the locomotive supplying air pressure to the train was shut down, the air brake system leaked off in less than 1 hour. The force from the hand brakes was not sufficient to secure the train, and the train rolled away.

Both air brake and hand brake systems are subject to failure, as the technology is not fail-proof. For example, air brake systems are prone to leakage and suffer from limitations in maintaining brake cylinder pressure. Furthermore, when brake pressure is low, its ability to generate an emergency brake application is compromised. Hand brake devices also have significant limitations, in that they do not provide feedback to the operator about the force applied, and often do not provide the required braking force due to their design and other mechanical and physical factors.

Within the railway industry, these limitations in technology are addressed with the expectation that there will always be strict compliance with the operating rules. For equipment securement, reliance is placed on Canadian Rail Operating Rules (CROR) 112, company special instructions and training. However, TSB investigations into runaways revealed that the sequence of events very often included a mis-application of the rule, such as an improper hand brake effectiveness test or the application of an insufficient number of hand brakes. 

This means that no matter how well the rule is worded, it will not always be strictly complied with, thereby introducing vulnerability into the safety system.
Rules are administrative defenses and, invariably, there will be instances where practices in the field will deviate from written rules and procedures. Even with clear and comprehensive rules, it has been demonstrated over the years that depending solely on the correct application of rules is not sufficient to maintain safety in a complex transportation system. The concept of “defense in depth” has shaped the thinking in the safety world for many years. Layers of defenses, or safety redundancy, have proven to be a successful approach in many industries, to ensure that a single-point failure does not lead to catastrophic consequences.

There are physical defenses to protect against the risk of runaway equipment, and these include derails, wheel chocks, mechanical emergency devices, and locomotive auto-start systems to maintain air pressure. New technology is available, such as GPS-equipped devices that can be applied to a hand brake chain, allowing for the remote monitoring of the hand brake status. In addition, some existing technology, such as reset safety controls and sense and braking units, with minor programming changes, can offer additional protection.

Advanced air brake control valves, such as electronically controlled pneumatic (ECP) brakes, can provide added protection by overcoming some of the inherent limitations of the traditional air brake systems. In addition to other operational benefits, ECP brakes protect against brake cylinder leakage, and will monitor brake pipe pressure and automatically generate an emergency brake application if the brake pipe pressure gets low. With ECP brakes, the brake pipe is solely dedicated to continuously supplying air, to keep all of the reservoirs charged on the train.

The National Transportation Safety Board (NTSB) recently made a recommendation to address the need for redundant protection, such as wheel chocks and derails, to protect against runaway trains (NTSB Recommendation R-14-03 Urgent). The recommendation is derived from the NTSB's investigation into the collision between 2 Chicago Transit Authority trains that occurred on 30 September 2013, in Forest Park, Illinois.

The TSB has pointed out the need for robust defenses to prevent runaways since 1996 (TSB Railway Investigation Report R96C0172). From that time, there have been over 120 runaways in Canada that have affected main-track operations. Equipment runaways are low-probability events, but as this accident demonstrates, they can have extreme consequences, particularly if they involve dangerous goods. As demonstrated in Lac-Mégantic, the cost to human life and our communities can be incalculable. For this reason, the Board recommended that:

The Department of Transport require Canadian railways to put in place additional physical defenses to prevent runaway equipment. 

/_____________________________________________/
TSB Recommendation R14-04
Response from Transport Canada (29 October 2014)
Transport Canada (TC) will fully implement this recommendation.
On 29 October 2014, TC issued an Emergency Directive pursuant to Section 33 of the Railway Safety Act, requiring railways to improve their operating practices with respect to the securement of railway equipment. Specifically, railways were ordered (in part) to
1.   use standardized hand brake charts;
2.   ensure the adequacy of hand brake applications through hand brake effectiveness testing;
3.   use additional physical securement mechanisms/measures (a list was provided);
4.   apply hand brakes to the locomotive(s) in addition to those on the cars;
5.   use air brakes in addition to hand brakes on trains or equipment left unattended on the main track; and
6.   verify every 2 hours by a qualified employee the securement of cars left unattended on the main track during switching, picking up or setting off enroute.

TC will be developing monitoring procedures to ensure operators adhere to the outlined requirements.

Also on 29 October 2014, TC issued a Ministerial Order, pursuant to Section 19(1)(a) of the Railway Safety Act, requiring companies to formulate rules to address the provisions of the Emergency Directive permanently. The rules are to be filed with TC within 180 days of the issuance of the order. TC will continue to work with the railway industry to identify and address any possible residual risks well in advance of the rule submission deadline. Should any unforeseen vulnerabilities be identified that are not addressed sufficiently in the Rule proposed by industry, TC would issue an amended Emergency Directive to immediately address any such issues.

TC will hire additional specialized staff to strengthen oversight related to train securement and to monitor compliance with these additional levels of defense to prevent runaways. Rail Safety personnel will

  1. develop and implement targeted oversight requirements related to new rule(s) focused directly on securing trains; and
  2. identify and challenge any technical gaps in railways' risk assessments and provide technical advice/direction on new securement rules, special instructions, and daily bulletins/safety issues identified by inspectors in the field.

Furthermore, as of 01 April 2015, enforcement action for any instances of non-compliance will include the option of issuing fines in the event of contraventions to the Railway Safety Act, and its rules and regulations.

Recognizing that technological solutions may provide for additional improvements to mitigate risks of runaway trains in the coming years, TC will intensify its collaboration with industry through the Railway Research Advisory Board to help lead the implementation of technologies to enhance railway safety. In July 2014, TC signed a Memorandum of Cooperation with the U.S. Federal Railroad Administration to facilitate further information exchange, and to help in identifying technical cooperation projects. TC will also initiate a strategic research initiative program to investigate alternatives that would enhance brake system performance, focusing on braking systems and train securement technologies. Such technologies will be developed under, but not limited to, the following themes: remote brake application systems, wayside temperature detectors, and hand brake monitoring devices.

Through these measures, TC will provide for multiple layers of defense for securement to prevent runaway trains.

Board assessment of response to R14-04 (January 2014)

TC has accepted the TSB recommendation.

The Emergency Directive issued in October 2014 (expiring 29 April 2015) addresses many of the weaknesses in the CROR rules pertaining to the securement of equipment. For example, the Emergency Directive mandates the use of a hand brake chart specifying the minimum number of hand brakes required, taking into consideration the tonnage of the train and the grade of the track. In addition, train securement must be confirmed by a hand brake effectiveness test, followed by the application of the hand brakes on the lead locomotives and air brakes on the entire train, adding additional levels of defense. Moreover, the required use of both air brakes and hand brakes on standing equipment while switching, and verification of its status every 2 hours, further reduces the risk of runaway equipment in those situations. The Emergency Directive also mandates the use of additional physical defenses, such as derails, mechanical emergency devices, and mechanical lock parking brakes in addition to the existing defenses. These additional measures strengthen the existing rules for securement of equipment.

The Ministerial Order issued in October 2014 requires railways to submit for approval new rules respecting the securement of railway equipment. The new rules are intended to address the provisions of the Emergency Directive on a permanent basis. It is anticipated that further improvements will be made during the final rule making process to ensure it is clearly written to enhance correct application and to ensure that any gaps identified in the current hand brake chart are addressed. It is clear that TC requires any rules submitted to contain specific provisions to enhance safety, such as enhanced securement practices and the use of additional physical defenses.

The Board acknowledges the industry concerns with using additional physical defenses on main track, including the possibility of introducing new risks. However, the TSB recommendation does not prescribe a specific solution. We believe that a one-size fits all approach may not be suitable and that different solutions may be required in different operating environments (e.g. main track, sidings, rail yards, etc.). As part of the rule making process, it is up to industry, in collaboration with TC, to consider potential risks and to determine the most appropriate solutions to be used under different circumstances.

TC has also committed to taking a number of additional measures, such as hiring more staff to enhance monitoring and inspection activities, and using administrative monetary penalties to strengthen enforcement activities when there is non-compliance. Through the Railway Research Advisory Board, TC stated it will also help lead the implementation of technologies to enhance railway safety, and will initiate a strategic research initiative program to investigate alternatives that would enhance brake system performance, focusing on braking systems and train securement technologies.

The Board is pleased with the safety action taken to date and with the accelerated pace of the proposed safety action. These actions include multiple layers of defense such as clarifying the rules for securement, physical defenses and enhanced monitoring. If the proposed measures are fully implemented, the risk of runaway equipment will be significantly reduced. As the proposed rules have not yet been developed, and the changes in regulatory oversight (staffing levels, activities, enforcement, and research) are ongoing, some of which will not take place until 2015 or later, the outcome cannot be known until the process is finalized. Therefore, the Board assesses the response to Recommendation R14-04 as having Satisfactory Intent.


/______________________________________________/

RAIL RECOMMENDATION R14-05
ASSESSMENT OF THE RESPONSE TO RAIL SAFETY RECOMMENDATION R14-05
.
Auditing of safety management systems
Background
On 06 July 2013, shortly before 0100 Eastern Daylight Time, eastward Montreal, Maine & Atlantic Railway (MMA) freight train MMA-002, which had been parked unattended for the night on the main track at Nantes, Quebec, Mile 7.40 of the Sherbrooke Subdivision, started to roll. The train travelled about 7.2 miles, reaching a speed of 65 mph. At about 0115, while approaching the centre of the town of Lac-Mégantic, Quebec, 63 tank cars carrying petroleum crude oil, UN 1267, and 2 box cars derailed. As a result of the derailment, about 6 million litres of petroleum crude oil spilled. There were fires and explosions, which destroyed 40 buildings, 53 vehicles and the railway tracks at the west end of Megantic Yard. A total of 47 people were fatally injured, and there was environmental contamination of the downtown area, and the adjacent river and lake.

Transport Canada (TC) had identified a number of recurring problems at MMA. Due to MMA's weak safety culture and poorly implemented safety management system (SMS), the systemic causes of these problems were not being effectively analyzed and rectified. Regulatory audits assessing the effectiveness of the SMS processes should have uncovered this deficiency. However, the time between audits, their limited scope, and the lack of regulatory follow-up on audit findings meant that the regulator remained unaware of the extent of the weaknesses in MMA's SMS.

In its 2013 report on rail safety oversight, the Office of the Auditor General (OAG) concluded that TC did not have the assurance that federal railways have implemented adequate and effective SMS. The OAG recommended, among other things, that TC have its inspectors assess the quality and effectiveness of the railways' SMS.

In the spring of 2014, TC began the process of bringing into force 2 new regulations, the Railway Operating Certificate Regulations and the Railway Safety Administrative Monetary Penalty Regulations, that, when adopted, will strengthen the Minister's enforcement powers.

Furthermore, proposed new SMS Regulations, if adopted, will provide greater accountability for SMS implementation, and make it easier to assess a company's SMS against the regulatory requirements. With the adoption of the new regulations, TC will have a legal and conceptual framework to require SMS implementation, but equally important is how the regulator uses these tools and what action it takes in the coming years. It is crucial that TC follow up on its commitments relating to SMS audits, and on ensuring that railways have an SMS in place that is capable of identifying risks and managing them to prevent accidents.

Until Canada's railways make the cultural shift to SMS, and TC makes sure that they have effectively implemented SMS, the safety benefits from SMS will not be realized. Therefore, the Board recommended that:

The Department of Transport audit the safety management systems of railways in sufficient depth and frequency to confirm that the required processes are effective and that corrective actions are implemented to improve safety. 

TSB Recommendation R14-05

Response from Transport Canada (29 October 2014)

TC will fully implement this recommendation.

Proposed Railway Operating Certificate Regulations were published in the Canada Gazette, Part I, on 15 March 2014. A target date of 01 April 2015 has been set by which these regulations will be brought into force. These proposed regulations provide for the suspension or cancellation of the Railway Operating Certificate for non-compliance with safety requirements or SMS Regulations.
TC also proposed changes to its Railway Safety Management Systems Regulations and published them in the Canada Gazette, Part I, on 05 July 2014. 

TC has plans to bring them into force in the fall of 2015. The proposed changes improve how railway companies develop, implement, and assess their SMS. These changes include more detailed requirements for each SMS component. 

For example, the risk assessment component now prescribes specific circumstances used to trigger a risk assessment; lists those elements to be included in each risk assessment; and includes a requirement that remedial action be taken to mitigate identified risks and the results be evaluated for effectiveness. Another SMS component specifies that railways continually evaluate their SMS procedures to ensure that they remain effective and prescribes elements to be included in the evaluation plan. Moreover, risk assessments supporting significant operational changes, at the request of the Minister, must be filed with TC. Beginning in fall 2015, each risk assessment will be subjected to a more rigorous review, and TC will follow up on any resulting risk mitigation measures. This risk information will be incorporated into industry risk profiles and used to adjust priorities for inspections and audits.

TC is in the process of bringing into force additional enforcement capabilities. The Railway Safety Administrative Monetary Penalties Regulations were published in the Canada Gazette, Part II, on 22 October 2014, and come into force 01 April 2015. These regulations introduce fines as an additional enforcement tool to improve railway safety. Under the authority of the Railway Safety Act, TC will be able to fine railways for contraventions of the Act, or regulations or rules made under the Act.

Because the revised regulations are more prescriptive than the original ones, TC will be able to more easily take regulatory action should a railway be in non-compliance with the regulations.

TC has reassessed the required number of inspections and audits. The number of planned inspections will remain relatively stable, while the number of planned audits will increase. Audits will now be completed on at least a 3- to 5-year cycle based on risk. In support of the revised auditing plan, additional auditors with specialized training will be recruited by June 2015. TC will be developing training for auditors on several key factors of the new SMS Regulations, including the revised audit requirements, more stringent follow-up procedures and the use of new enforcement provisions (including administrative monetary penalties), by summer 2015. TC is currently developing a standardized auditing tool (SMS Compliance Assessment Tool) to improve the quality and consistency of the audits, which should be completed by spring 2015. As well, TC has developed, and is implementing, a Management Action Plan to improve its oversight of railway safety, including SMS.

Regional risk information will be shared with relevant internal stakeholders and, beginning in 2016, new safety data from leading indicators will be incorporated into departmental systems to ensure the department stays ahead of trends and relevant operational changes in the industry. A national review process to closely monitor all operators with compliance or on-going safety issues has also been established.

These actions will support TC in conducting more frequent and thorough SMS audits. Audits will now involve more rigorous review and timely follow-up tied to enforceable penalties for non-compliance. However, TC does not intend to increase the scope of audits conducted every 3 to 5 years.

Board assessment of response to R14-05 (January 2015)
TC has accepted the recommendation and is bringing into force additional regulations and enforcement capabilities. The Railway Operating Certificate Regulations are planned to come into force on 01 April 2015. Revised SMS Regulations that better describe the processes that are to be included in a railway SMS are planned for the fall of 2015. These include explicit expectations that the effectiveness of those processes in advancing safety will be monitored by the railways and continually improved. In addition, the new Railway Safety Administrative Monetary Penalties Regulations, to be in force on 01 April 2015, will enable TC to more easily take enforcement action in the event of non-compliance with the SMS Regulations.

TC has modified its oversight regime to include minimum requirements regarding SMS audit frequency and has developed plans to use data submitted by the railways to adjust its inspection and audit schedule as risks become better understood. TC is also hiring more auditors and strengthening its training programs. These actions may address many of the deficiencies that were noted in its inspection and audit programs.

TC has not committed to auditing every SMS component within a given time period. If a company does not do something to trigger a focussed audit, TC may only conduct an audit once every 3 to 5 years based on risk. In such circumstances, the audit may be of very limited scope which would not cover every component of a railway's SMS.

While significant progress has been made, TC has not yet demonstrated that it has put in place an effective oversight regime that ensures that all railways are audited with sufficient scope and at a frequency to confirm that the required processes are effective and that corrective actions are implemented to improve safety. As a result, deficiencies within a railway's SMS may not be identified and addressed in a timely manner. Therefore, the Board assesses the response to Recommendation R14-05 as being Satisfactory in Part.