28 JANUARY 2015
GATINEAU, QUEBEC
While recognizing
significant positive action taken by the regulator, the Transportation Safety
Board of Canada (TSB) remains concerned about Transport Canada’s (TC) response
to outstanding recommendations stemming from its investigation into the
Montreal, Maine & Atlantic Railway (MMA) train that derailed on 6 July 2013
in Lac-Mégantic, Quebec.
“Transport Canada
continues to take important steps to address the rail safety deficiencies we
identified in our Lac-Mégantic investigation,” said Kathy Fox, Chair of the
TSB. “With respect to preventing runaway trains, TC has introduced multiple
layers of defenses that, if fully implemented, will significantly reduce risks.
But with respect to TC auditing and oversight activities, we are concerned that
the department has not yet put in place an effective oversight regime that
guarantees all railways will be audited in sufficient breadth and frequency to
ensure safety issues are addressed in a timely manner.”
Prevention of
runaway trains: Unattended equipment (R14-04)
The investigation
determined that more robust defenses are required to prevent runaways. Even if
they have a low probability of occurrence, these events can have extreme
consequences, particularly if they involve dangerous goods—as was seen in
Lac-Mégantic. For this reason, the Board recommended that TC require Canadian
railways to implement additional physical defenses to prevent runaway
equipment.
In October 2014, TC
issued an Emergency Directive (which expires 29 April 2015) that
addresses many of the weaknesses in the Canadian Rail Operating Rules
pertaining to the securement of equipment. Along with a standardized hand brake
chart and explicit instructions for hand brake effectiveness testing,
additional physical securement measures must be used. TC also said it will hire
additional specialized staff to strengthen oversight related to train
securement and to monitor compliance with these additional levels of defense to
prevent runaways. If the proposed measures are fully implemented on a permanent
basis, the risk of runaway equipment will be significantly reduced; therefore,
the Board assesses the response as having Satisfactory Intent.
Safety management
systems audits and essential follow-up (R14-05)
Until Canada's
railways make the cultural shift to safety management systems (SMS), and TC
makes sure they have effectively implemented SMS, the safety benefits will not
be fully realized. For this reason, the Board recommended that TC audit the SMS
of railways in sufficient depth and frequency to confirm that the required
processes are effective, and that corrective actions are implemented to improve
safety.
TC has committed to
bringing into force additional regulations and enforcement capabilities, hiring
more auditors and strengthening its training programs. While significant
progress has been made, TC has not yet demonstrated that it has implemented an
effective oversight regime to ensure all railways will be adequately audited.
Furthermore, TC has not committed to auditing every SMS component within a
given time period. As a result, deficiencies within a railway's SMS may not be
identified and addressed in a timely manner; therefore, the Board assesses the
response as being Satisfactory in Part.
This issue has been
identified as one of the key risks to the transportation system and it is
included on the TSB's 2014 Watchlist.
“The Minister of
Transport and the department have taken strong action to improve rail safety in
the wake of the Lac-Mégantic tragedy, but more work needs to be done,” added Ms
Fox. “We will continue to monitor the department and rail industry's progress
in implementing new regulations and procedures introduced by TC. Canadians
deserve no less than the safest transportation system.”
ASSESSMENT OF THE
RESPONSE TO RAIL SAFETY RECOMMENDATION R14-04
Physical defenses to
prevent runaway equipment
Background
On 06 July 2013,
shortly before 0100 Eastern Daylight Time, eastward Montreal, Maine &
Atlantic Railway freight train MMA-002, which had been parked unattended for
the night on the main track at Nantes, Quebec, Mile 7.40 of the Sherbrooke
Subdivision, started to roll. The train travelled about 7.2 miles, reaching a
speed of 65 mph. At about 0115, while approaching the centre of the town of
Lac-Mégantic, Quebec, 63 tank cars carrying petroleum crude oil, UN 1267, and 2
box cars derailed. As a result of the derailment, about 6 million litres of
petroleum crude oil spilled. There were fires and explosions, which destroyed
40 buildings, 53 vehicles, and the railway tracks at the west end of Megantic
Yard. A total of 47 people were fatally injured, and there was environmental
contamination of the downtown area, and the adjacent river and lake.
In this accident,
the train was secured at Nantes both with hand brakes and locomotive air
brakes. However, a proper hand brake effectiveness test had not been conducted
to ensure that the hand brakes alone would hold the train. When the locomotive
supplying air pressure to the train was shut down, the air brake system leaked
off in less than 1 hour. The force from the hand brakes was not sufficient to
secure the train, and the train rolled away.
Both air brake and
hand brake systems are subject to failure, as the technology is not fail-proof.
For example, air brake systems are prone to leakage and suffer from limitations
in maintaining brake cylinder pressure. Furthermore, when brake pressure is
low, its ability to generate an emergency brake application is compromised.
Hand brake devices also have significant limitations, in that they do not
provide feedback to the operator about the force applied, and often do not
provide the required braking force due to their design and other mechanical and
physical factors.
Within the railway
industry, these limitations in technology are addressed with the expectation
that there will always be strict compliance with the operating rules. For
equipment securement, reliance is placed on Canadian Rail Operating Rules (CROR)
112, company special instructions and training. However, TSB investigations
into runaways revealed that the sequence of events very often included a
mis-application of the rule, such as an improper hand brake effectiveness test
or the application of an insufficient number of hand brakes.
This means that no
matter how well the rule is worded, it will not always be strictly complied
with, thereby introducing vulnerability into the safety system.
Rules are
administrative defenses and, invariably, there will be instances where
practices in the field will deviate from written rules and procedures. Even
with clear and comprehensive rules, it has been demonstrated over the years
that depending solely on the correct application of rules is not sufficient to
maintain safety in a complex transportation system. The concept of “defense in
depth” has shaped the thinking in the safety world for many years. Layers of defenses,
or safety redundancy, have proven to be a successful approach in many
industries, to ensure that a single-point failure does not lead to catastrophic
consequences.
There are physical defenses
to protect against the risk of runaway equipment, and these include derails,
wheel chocks, mechanical emergency devices, and locomotive auto-start systems
to maintain air pressure. New technology is available, such as GPS-equipped
devices that can be applied to a hand brake chain, allowing for the remote
monitoring of the hand brake status. In addition, some existing technology,
such as reset safety controls and sense and braking units, with minor
programming changes, can offer additional protection.
Advanced air brake
control valves, such as electronically controlled pneumatic (ECP) brakes, can
provide added protection by overcoming some of the inherent limitations of the
traditional air brake systems. In addition to other operational benefits, ECP
brakes protect against brake cylinder leakage, and will monitor brake pipe
pressure and automatically generate an emergency brake application if the brake
pipe pressure gets low. With ECP brakes, the brake pipe is solely dedicated to
continuously supplying air, to keep all of the reservoirs charged on the train.
The National
Transportation Safety Board (NTSB) recently made a recommendation to
address the need for redundant protection, such as wheel chocks and derails, to
protect against runaway trains (NTSB Recommendation R-14-03 Urgent). The
recommendation is derived from the NTSB's investigation into the collision
between 2 Chicago Transit Authority trains that occurred on 30 September 2013,
in Forest Park, Illinois.
The TSB has pointed
out the need for robust defenses to prevent runaways since 1996 (TSB Railway
Investigation Report R96C0172). From that time, there have been over 120
runaways in Canada that have affected main-track operations. Equipment runaways
are low-probability events, but as this accident demonstrates, they can have
extreme consequences, particularly if they involve dangerous goods. As
demonstrated in Lac-Mégantic, the cost to human life and our communities can be
incalculable. For this reason, the Board recommended that:
The Department of
Transport require Canadian railways to put in place additional physical defenses
to prevent runaway equipment.
/_____________________________________________/
TSB Recommendation R14-04
Response from
Transport Canada (29 October 2014)
Transport
Canada (TC) will fully implement this recommendation.
On 29 October 2014,
TC issued an Emergency Directive pursuant to Section 33 of the Railway
Safety Act, requiring railways to improve their operating practices
with respect to the securement of railway equipment. Specifically, railways
were ordered (in part) to
1.
use
standardized hand brake charts;
2.
ensure
the adequacy of hand brake applications through hand brake effectiveness
testing;
3.
use
additional physical securement mechanisms/measures (a list was provided);
4.
apply
hand brakes to the locomotive(s) in addition to those on the cars;
5.
use air
brakes in addition to hand brakes on trains or equipment left unattended on the
main track; and
6.
verify
every 2 hours by a qualified employee the securement of cars left unattended on
the main track during switching, picking up or setting off enroute.
TC will be
developing monitoring procedures to ensure operators adhere to the outlined
requirements.
Also on 29 October
2014, TC issued a Ministerial Order, pursuant to Section 19(1)(a) of the Railway
Safety Act, requiring companies to formulate rules to address the
provisions of the Emergency Directive permanently. The rules are to be filed
with TC within 180 days of the issuance of the order. TC will continue to work
with the railway industry to identify and address any possible residual risks
well in advance of the rule submission deadline. Should any unforeseen
vulnerabilities be identified that are not addressed sufficiently in the Rule
proposed by industry, TC would issue an amended Emergency Directive to
immediately address any such issues.
TC will hire
additional specialized staff to strengthen oversight related to train
securement and to monitor compliance with these additional levels of defense to
prevent runaways. Rail Safety personnel will
- develop and implement targeted oversight requirements related to new rule(s) focused directly on securing trains; and
- identify and challenge any technical gaps in railways' risk assessments and provide technical advice/direction on new securement rules, special instructions, and daily bulletins/safety issues identified by inspectors in the field.
Furthermore, as of
01 April 2015, enforcement action for any instances of non-compliance will
include the option of issuing fines in the event of contraventions to the Railway
Safety Act, and its rules and regulations.
Recognizing that
technological solutions may provide for additional improvements to mitigate
risks of runaway trains in the coming years, TC will intensify its
collaboration with industry through the Railway Research Advisory Board to help
lead the implementation of technologies to enhance railway safety. In July
2014, TC signed a Memorandum of Cooperation with the U.S. Federal Railroad
Administration to facilitate further information exchange, and to help in
identifying technical cooperation projects. TC will also initiate a strategic
research initiative program to investigate alternatives that would enhance
brake system performance, focusing on braking systems and train securement
technologies. Such technologies will be developed under, but not limited to,
the following themes: remote brake application systems, wayside temperature
detectors, and hand brake monitoring devices.
Through these
measures, TC will provide for multiple layers of defense for securement to
prevent runaway trains.
Board assessment of
response to R14-04 (January 2014)
TC has accepted the
TSB recommendation.
The Emergency
Directive issued in October 2014 (expiring 29 April 2015) addresses many of the
weaknesses in the CROR rules pertaining to the securement of equipment. For
example, the Emergency Directive mandates the use of a hand brake chart
specifying the minimum number of hand brakes required, taking into
consideration the tonnage of the train and the grade of the track. In addition,
train securement must be confirmed by a hand brake effectiveness test, followed
by the application of the hand brakes on the lead locomotives and air brakes on
the entire train, adding additional levels of defense. Moreover, the required
use of both air brakes and hand brakes on standing equipment while switching,
and verification of its status every 2 hours, further reduces the risk of
runaway equipment in those situations. The Emergency Directive also mandates
the use of additional physical defenses, such as derails, mechanical emergency
devices, and mechanical lock parking brakes in addition to the existing defenses.
These additional measures strengthen the existing rules for securement of
equipment.
The Ministerial
Order issued in October 2014 requires railways to submit for approval new rules
respecting the securement of railway equipment. The new rules are intended to
address the provisions of the Emergency Directive on a permanent basis. It is
anticipated that further improvements will be made during the final rule making
process to ensure it is clearly written to enhance correct application and to
ensure that any gaps identified in the current hand brake chart are addressed.
It is clear that TC requires any rules submitted to contain specific provisions
to enhance safety, such as enhanced securement practices and the use of
additional physical defenses.
The Board
acknowledges the industry concerns with using additional physical defenses on
main track, including the possibility of introducing new risks. However, the
TSB recommendation does not prescribe a specific solution. We believe that a
one-size fits all approach may not be suitable and that different solutions may
be required in different operating environments (e.g. main track, sidings, rail
yards, etc.). As part of the rule making process, it is up to industry, in
collaboration with TC, to consider potential risks and to determine the most
appropriate solutions to be used under different circumstances.
TC has also
committed to taking a number of additional measures, such as hiring more staff
to enhance monitoring and inspection activities, and using administrative
monetary penalties to strengthen enforcement activities when there is
non-compliance. Through the Railway Research Advisory Board, TC stated it will
also help lead the implementation of technologies to enhance railway safety,
and will initiate a strategic research initiative program to investigate
alternatives that would enhance brake system performance, focusing on braking
systems and train securement technologies.
The Board is pleased
with the safety action taken to date and with the accelerated pace of the
proposed safety action. These actions include multiple layers of defense such
as clarifying the rules for securement, physical defenses and enhanced
monitoring. If the proposed measures are fully implemented, the risk of runaway
equipment will be significantly reduced. As the proposed rules have not yet
been developed, and the changes in regulatory oversight (staffing levels,
activities, enforcement, and research) are ongoing, some of which will not take
place until 2015 or later, the outcome cannot be known until the process is
finalized. Therefore, the Board assesses the response to Recommendation R14-04
as having Satisfactory Intent.
/______________________________________________/
RAIL RECOMMENDATION R14-05
ASSESSMENT OF THE RESPONSE TO RAIL SAFETY
RECOMMENDATION R14-05
.
Auditing of safety management systems
Background
On 06 July 2013,
shortly before 0100 Eastern Daylight Time, eastward Montreal, Maine &
Atlantic Railway (MMA) freight train MMA-002, which had been parked
unattended for the night on the main track at Nantes, Quebec, Mile 7.40 of the
Sherbrooke Subdivision, started to roll. The train travelled about 7.2 miles,
reaching a speed of 65 mph. At about 0115, while approaching the centre of the
town of Lac-Mégantic, Quebec, 63 tank cars carrying petroleum crude oil, UN
1267, and 2 box cars derailed. As a result of the derailment, about 6 million
litres of petroleum crude oil spilled. There were fires and explosions, which
destroyed 40 buildings, 53 vehicles and the railway tracks at the west end of
Megantic Yard. A total of 47 people were fatally injured, and there was
environmental contamination of the downtown area, and the adjacent river and
lake.
Transport Canada
(TC) had identified a number of recurring problems at MMA. Due to MMA's weak
safety culture and poorly implemented safety management system (SMS), the
systemic causes of these problems were not being effectively analyzed and
rectified. Regulatory audits assessing the effectiveness of the SMS processes
should have uncovered this deficiency. However, the time between audits, their
limited scope, and the lack of regulatory follow-up on audit findings meant
that the regulator remained unaware of the extent of the weaknesses in MMA's SMS.
In its 2013 report
on rail safety oversight, the Office of the Auditor General (OAG) concluded
that TC did not have the assurance that federal railways have implemented
adequate and effective SMS. The OAG recommended, among other things, that TC
have its inspectors assess the quality and effectiveness of the railways' SMS.
In the spring of
2014, TC began the process of bringing into force 2 new regulations, the Railway
Operating Certificate Regulations and the Railway
Safety Administrative Monetary Penalty Regulations, that, when
adopted, will strengthen the Minister's enforcement powers.
Furthermore,
proposed new SMS Regulations, if adopted, will provide greater accountability
for SMS implementation, and make it easier to assess a company's SMS against the
regulatory requirements. With the adoption of the new regulations, TC will have
a legal and conceptual framework to require SMS implementation, but equally
important is how the regulator uses these tools and what action it takes in the
coming years. It is crucial that TC follow up on its commitments relating to
SMS audits, and on ensuring that railways have an SMS in place that is capable
of identifying risks and managing them to prevent accidents.
Until Canada's
railways make the cultural shift to SMS, and TC makes sure that they have
effectively implemented SMS, the safety benefits from SMS will not be realized.
Therefore, the Board recommended that:
The Department of
Transport audit the safety management systems of railways in sufficient depth
and frequency to confirm that the required processes are effective and that
corrective actions are implemented to improve safety.
TSB Recommendation R14-05
Response from
Transport Canada (29 October 2014)
TC will fully
implement this recommendation.
Proposed Railway
Operating Certificate Regulations were published in the Canada
Gazette, Part I, on 15 March 2014. A target date of 01 April 2015
has been set by which these regulations will be brought into force. These
proposed regulations provide for the suspension or cancellation of the Railway
Operating Certificate for non-compliance with safety requirements or SMS
Regulations.
TC also proposed
changes to its Railway Safety Management Systems Regulations and published
them in the Canada Gazette, Part I, on 05 July 2014.
TC has plans to
bring them into force in the fall of 2015. The proposed changes improve how
railway companies develop, implement, and assess their SMS. These changes
include more detailed requirements for each SMS component.
For example, the
risk assessment component now prescribes specific circumstances used to trigger
a risk assessment; lists those elements to be included in each risk assessment;
and includes a requirement that remedial action be taken to mitigate identified
risks and the results be evaluated for effectiveness. Another SMS component
specifies that railways continually evaluate their SMS procedures to ensure
that they remain effective and prescribes elements to be included in the
evaluation plan. Moreover, risk assessments supporting significant operational
changes, at the request of the Minister, must be filed with TC. Beginning in
fall 2015, each risk assessment will be subjected to a more rigorous review,
and TC will follow up on any resulting risk mitigation measures. This risk information
will be incorporated into industry risk profiles and used to adjust priorities
for inspections and audits.
TC is in the process
of bringing into force additional enforcement capabilities. The Railway
Safety Administrative Monetary Penalties Regulations were published
in the Canada Gazette, Part II, on 22 October 2014, and come into
force 01 April 2015. These regulations introduce fines as an additional
enforcement tool to improve railway safety. Under the authority of the Railway
Safety Act, TC will be able to fine railways for contraventions of
the Act, or regulations or rules made under the Act.
Because the revised
regulations are more prescriptive than the original ones, TC will be able to
more easily take regulatory action should a railway be in non-compliance with
the regulations.
TC has reassessed
the required number of inspections and audits. The number of planned
inspections will remain relatively stable, while the number of planned audits
will increase. Audits will now be completed on at least a 3- to 5-year cycle
based on risk. In support of the revised auditing plan, additional auditors
with specialized training will be recruited by June 2015. TC will be developing
training for auditors on several key factors of the new SMS Regulations, including
the revised audit requirements, more stringent follow-up procedures and the use
of new enforcement provisions (including administrative monetary penalties), by
summer 2015. TC is currently developing a standardized auditing tool (SMS
Compliance Assessment Tool) to improve the quality and consistency of the
audits, which should be completed by spring 2015. As well, TC has developed,
and is implementing, a Management Action Plan to improve its oversight of
railway safety, including SMS.
Regional risk information
will be shared with relevant internal stakeholders and, beginning in 2016, new
safety data from leading indicators will be incorporated into departmental
systems to ensure the department stays ahead of trends and relevant operational
changes in the industry. A national review process to closely monitor all
operators with compliance or on-going safety issues has also been established.
These actions will
support TC in conducting more frequent and thorough SMS audits. Audits will now
involve more rigorous review and timely follow-up tied to enforceable penalties
for non-compliance. However, TC does not intend to increase the scope of audits
conducted every 3 to 5 years.
Board assessment of response to R14-05
(January 2015)
TC has accepted the
recommendation and is bringing into force additional regulations and
enforcement capabilities. The Railway Operating Certificate Regulations
are planned to come into force on 01 April 2015. Revised SMS Regulations that
better describe the processes that are to be included in a railway SMS are
planned for the fall of 2015. These include explicit expectations that the
effectiveness of those processes in advancing safety will be monitored by the
railways and continually improved. In addition, the new Railway
Safety Administrative Monetary Penalties Regulations, to be in
force on 01 April 2015, will enable TC to more easily take enforcement action
in the event of non-compliance with the SMS Regulations.
TC has modified its
oversight regime to include minimum requirements regarding SMS audit frequency
and has developed plans to use data submitted by the railways to adjust its
inspection and audit schedule as risks become better understood. TC is also
hiring more auditors and strengthening its training programs. These actions may
address many of the deficiencies that were noted in its inspection and audit
programs.
TC has not committed
to auditing every SMS component within a given time period. If a company does
not do something to trigger a focussed audit, TC may only conduct an audit once
every 3 to 5 years based on risk. In such circumstances, the audit may be of
very limited scope which would not cover every component of a railway's SMS.
While significant
progress has been made, TC has not yet demonstrated that it has put in place an
effective oversight regime that ensures that all railways are audited with
sufficient scope and at a frequency to confirm that the required processes are
effective and that corrective actions are implemented to improve safety. As a
result, deficiencies within a railway's SMS may not be identified and addressed
in a timely manner. Therefore, the Board assesses the response to
Recommendation R14-05 as being Satisfactory in Part.