On June 12, 2020, there was a “near miss” incident where two trains could have, but did not, have a sideswipe collision just south of Osgoode Station. The was first reported in the Toronto Star by Ben Spurr on June 4, 2021 (the linked article is behind the Star’s paywall).
Immediately this spurred several questions including “how could this happen” and “why did the TTC Board only learn of this through the newspapers almost a year after the fact”.
TTC management launched an external review of the incident, and the report from it is dated February 3, 2021. Management planned to bring a report to the Board in September 2021. A partly redacted version of the external review has been published by the TTC. Portions are omitted for reasons of confidentiality as permitted by the City of Toronto Act.
This report is about labour relations or employee negotiations.
This report is about litigation or potential litigation, including matters before administrative tribunals.
Osgoode Interlocking Incident Report, p. 1
What Happened?
A northbound train (run 114) at St. Andrew Station was held due to an on-board emergency. In order to maintain service on the University-Spadina leg of Line 1, the TTC directed a southbound train (run 123) at Osgoode to short turn via the pocket track south of the station.
Although this track is not often used, this type of move is common at several locations on the subway network during emergency turnbacks or when a line is split for construction projects.
An important distinction with Osgoode pocket track is that it ends in a blank wall north of St. Andrew Station. Unlike other locations with centre tracks such as the one between St. Andrew and Union, or those on Line 2 between Broadview and Chester, or beween Ossington and Christie, this track dead ends and can only be entered from one direction.
For reasons that are not yet clear, the Automatic Train Control system (ATC) (which had already been operational in this part of Line 1 for a few months) did not work, or was not used by trains entering the pocket track, and they did so under manual control.
The correct operating procedure was for a train leaving the pocket to switch back to ATC mode so that its move onto the mainline would be managed and protected by the signal system. This was not done, and when run 123 left northbound under manual control there was a conflicting move by train 114 which had by then left St. Andrew Station under ATC. There was no mechanism for the ATC system to detect the potential conflict between the trains.
The guard at the rear end of run 123 saw run 114 passing by on the mainline, and alerted the operator at the head of the train. He stopped run 123 5.8 metres away from run 114.
This incident arose through a combination of events and design:
- ATC either did not work, or was not routinely activate for movements into the pocket track.
- Manual operation of trains in ATC territory is very rare and should be done with maximum supervision to ensure there are no conflicting movements. When there is an emergency, supervisory attention could be divided among multiple activities.
- The train stopped in the pocket track clear of the switches, but the signal indicating if a route out of the pocket was clear was beside the train and not visible to the operator.
- There was confusion by the operator of the train about whether he had clearance to proceed out of the pocket track. Line 1 is in transition between operating modes with different indications by signals and console displays depending on the location and whether a train is in manual or automatic mode.
- The track layout makes it possible for a train to drive manually out of the pocket toward the northbound platform even though the route was not actually clear.
The diagram below (excerpted from the external report) shows the track layout for a train moving into the pocket. Switches 5B and 5A are aligned for movement between the southbound platform and the pocket. There is a sign at the south end of the pocket track indicating where trains should stop, but it is possible to be clear of the 5A switches without reaching this point. However, if the train stops north of that sign, signal X8 could be beside the north end of the train rather than in front of it.
Once run 123 pulled into the pocket, the 5A/5B switches realigned to their normal position for through service southbound. However, this creates a problem on the northbound side as illustrated below. The 5A switch is set for a move out of the pocket to the northbound track, but the 7A switch is aligned for through northbound moves from St. Andrew Station.
This is an inevitable result of a three-into-two track arrangement because under normal operations, both 5B and 7A will be set to the straight for regular operations. Switch 5A will direct an outbound train from the pocket onto one of the mainline tracks unless that move is blocked by some other means through the signal system.
In the pre-ATC system, the train would have been stopped by a “trip arm” at signal X8 that would have tripped emergency brakes. (In the Russell Hill crash in 1995, a trip arm failure contributed to the disaster.) In the ATC system, protection depends on the train being in ATC mode, or if in manual, the movement being carefully managed to avoid conflicts.
One method to protect this track configuration is used at a few exits from pocket tracks, but not all. The south end of the pocket between Lawrence West and Glencairn Stations illustrates this. There are two separate crossovers and switches leading from the pocket track, one each to the northbound and southbound main lines. Each set of switches operates as a pair. During normal mainline operations, both of these would be set leading into a dead-end track in case a train were to move south without being stopped at a signal.
At the north end of this pocket track, there is no comparable setup, and the track arrangement is the same as at Osgoode.
Implementing a dead end track such as at the south end of Lawrence pocket track is difficult to retrofit because there is usually something in the way. This sort of thing must be designed into lines when they are built.
Much of the discussion of this report was in camera and that took roughly an hour and 40 minutes. When the Board returned to public session, it passed two motions. The first was to have a public presentation of the investigation’s findings and the corrective actions taken over the past year at the July 7, 2021 Board meeting. The second was a clear direction that management should inform the Board about serious events at the time they occur.
Chair Jaye Robinson moved “that the TTC Board direct the Chief Executive Officer to alert the Board when an incident meeting the identified thresholds for escalation occurs and subsequently report to the Board once a comprehensive review or investigation has been completed”.
During the Covid era, there has been a gradual slippage of responsibilities from the Board to management as those at the political level have been pre-occupied with city-wide issues. The Board is there to provide oversight and direction, not simply to receive “good news” reports.
Postscript
Ben Spurr’s article on the Board’s actions is here (paywalled).
Steve Munro 
The Star article states that TTC blamed “Operator error”. ATU 113 union leader denies this and declared the employee was “heroic” in stopping the train. There was a video showing the near-collision of two trains.
I would say it was clearly Operator error. Before moving out of the dead-end spur towards the main track the Operator should not only have had a clear understanding if approaching trains were stopped he should have observed if the switch points on the main track were properly aligned. Plan and simple, no excuse. As for the “heroic” Guard, this is nonsense. One is only heroic when you put your life in danger when saving someone else. All he did was call out “STOP”. As the guard he is expected to look out for any danger to his train. Plain and simple. Perhaps he should have helped matters by assisting in this unusual move to make sure nothing else was moving towards them.
Steve: From the point where the operator was in the pocket track, it would not have been easy to verify the position of the trailing switch. If you watch the video in the Star article, you will see that the lie of the trailing switch is very hard to see until the train is part way into the crossover.
As for the guard, the only visibility he would have to the adjacent track is through the occasional gaps in the tunnel wall. It’s not as if this was is a wide open area. Before you start blaming the operator have a look at conditions before pontificating.
LikeLike
It is absolutely incorrect to blame the near miss on operator error. To be clear, it is irrelevant whether or not the operator made an error. The cause of the near miss is an insufficient signalling system combined with incorrect operating policies. Any transit manager who is on record blaming operator error should be fired and banned from the railway industry entirely. They can apply their careless management techniques to areas where they won’t someday kill somebody.
The fundamental purpose of railway signalling systems, since over 100 years, is to eliminate operator error as a cause of collisions. On systems without trip mechanisms there is a reliance on operators at least not passing danger signals; on systems with trip mechanisms there is not supposed to be even this reliance.
In this case, I can think of several relevant points. First, operating on manual should not be normal procedure. It’s perfectly possible to operate on manual occasionally, just as on those rare occasions when I go up on my house roof I don’t tie off. This is done by being extremely slow and careful about every operation. But if it is done regularly, eventually somebody will start rushing, make a mistake, and either crash a train or fall off the roof.
Next, even when on manual, the train should be visible to the ATC system. In this case, the train did not clear the interlocking. As a result, it should have been impossible for the switches to return to the normal position until it moved further down the pocket track. As a result, the driver would have seen the red signal.
Similarly, even when on manual, the trip mechanism should still work. If a train needs to pass a red signal, use a key-by procedure at each signal. However, this procedure doesn’t apply if the signal is protecting a trailing point switch set for the other route, since the switch must be changed first, no matter what, even in manual operation.
This could have been a lot worse: if the train in the pocket track had started moving just a bit earlier and reached the switch, the in-service train could have hit it at significant speed (whatever speed remained after the operator hit the emergency brake upon seeing the train come out of the pocket track ahead of them), very possibly killing the operator and maybe even passengers near the front of the train.
I’m concerned there may be a systemic problem in modern rail transit signalling culture. Apparently on the O-Train if there are enough door failures in a row, the train has to be moved back to the storage yard using written train orders because the ATC system enforces train “suitability” rigidly with no concept of either locking out a specific door or of being able to tell the system a train is out of service and is just being moved to the yard. What we need is fewer Web programmers and more 1950s greybeards.
Finally, just a comment about the dead-end at the end of the Lawrence West/Glencairn pocket track: I believe that is at the downhill end of the track. To my knowledge, the rest of the pocket tracks in the system are all level and have no dead-end at either end. So just based on logic, not any specific knowledge, I believe that dead-end is there to deal with the case of a train’s brakes failing and it starting to roll. I seem to recall that a mainline railway had a little problem with that happening at a nice place called Lac Megantic in the last few years. The case of powered movement should be able to be handled by the signalling system.
PS I just waited 5 minutes after writing before submitting to make sure I still believed what I said about firing and banning managers in the first paragraph, and I do. That behaviour is absolutely unacceptable from a railway manager. It is obviously OK to discipline an employee for making a mistake but obviously not OK to cite the mistake as “the” cause of a collision.
Steve: I believe that there are one or two more locations where there is an overrun track like the one at Lawrence, but it has the advantage of being visible in satellite views. Another approach is to use a switch that has a “safe” position leading straight ahead into a forced derailment, and is only set for a move to the mainline when that route is clear.
One point about the “correct” lie of that switch. It would be valid to move out of the pocket track onto the southbound platform, and the setting of the switch immaterial to whether the route is clear. The issue is the setting of the mainline switch and clearance over the track to either platform.
As for level pocket tracks, the prime counter example is at York Mills where there is a gate at the north end of the track that can be closed to ensure a disabled train cannot roll out onto the main line. Whether this device is still operational I do not know.
LikeLiked by 1 person
As for the overrun dead-end tracks on storage tracks, I believe there are overrun tracks at the north-end of both the St. Clair West and Finch West storage tracks (but not at either of their south ends). Also, there are no overrun tracks at either of the (south end of the) Eglinton and Finch pocket tracks. And there are also no overrun tracks at either end of the Islington storage tracks (same as Ossington and Chester).
LikeLike
> What we need is fewer Web programmers and more 1950s greybeards.
In what way is this comment not the equivalent of blaming a train operator? Programmers should write what the specs say, and if the specs didn’t envision a repeated door failure, programmers should not be adding that handling in – web or greybeards. Who wrote that spec and who approved it? It’s at least a business analyst or a project manager these days.
LikeLike
Is the probable fault that the train was not pulled fully all the way in to the end of the pocket track? This should have left the front of the train where the X8 signal would have been fully visible to the operator prior to exiting the track.
Additionally, leaving the pocket track prior to “permission” – either control centre verbally or signalized, would have left the 7A switch set for mainline operation, and possible derailment as the exiting train hit it, or severe switch damage, requiring the line to be shut down. Blame being in manual operation all you want, but not being able to see the signal due to insufficent “drive in depth” to the pocket seems to me to be the base cause. Having had a chance to read the TTC Subway Rule book a few years back (operator friend loaned to to me for an evening) the guiding principle is when in doubt about your signal, or track configuration – FIND OUT BEFORE MOVING.
Steve: It would be interesting to know whether the new ATC X8 signal was further into the pocket than the old block signal that it replaced. Some of the new signals are further away from the points they protect than the old ones were. One of many issues here could be poor design that depends on driving right to the end of the track. Also there are ways to design ATC to take trains at low speed into dead end locations like this thereby avoiding the need for manual operation.
There are too many variables here to point the finger at a single failure. It may well be that the operator should “find out before moving”, but the report is fairly clear that he might have erroneously thought that he had clearance to proceed. Systems should be designed so that this type of human error is minimized. That includes signal placement, the use of trap tracks, good training and operating procedures that are absolutely tight when manual operation is needed.
LikeLike
Thanks for the pocket track information. I wish I could see a photo of that gate device at York Mills. I’ve never heard of a device like that. I’m familiar with derails and other incursion prevention devices. Sadly unless there has been some fairly dangerous “urban exploration” there likely won’t be railfan pictures.
Steve: Years ago I saw a photo from Ted Wickson of “the clasp”, but that’s the only one and it does not appear to be online.
This is true, but in the situation at hand the train would be going back exactly where it just came from, which isn’t useful. In a situation where the train actually meant to go to the southbound platform, it would have to have cleared the interlocking when it entered the pocket track. If the switches had remained lined as they were and the train started moving in error, the worst that could happen would be a low-speed collision between it and a train parked in the station. The train in the station wouldn’t be able to leave the station due to the interlocking still being fouled by the pocket track train (under my proposal), and even at worst the pocket track train couldn’t attain much speed before entering the station and colliding. Most likely it would have hit the brakes as soon as it realized it was going the wrong way without actually fouling the main at all. They would then ask control what’s going on at which point control would say, “Um, you haven’t finished entering the pocket track”.
Steve: My point was that as a matter of general design, both routes are “legal” and the signals have to deal with that. More to the point, it should not have been necessary to drive into the pocket in manual mode in the first place. Any design should work at eliminating points of risk, not count on procedural stuff to shift the blame onto people who may be making an unusual move during an emergency when they are pressed for time and attention to detail. “Blame” is worthless if the system can be defeated by human error.
By the way, I wrote “brogrammers”, not “programmers”, quite deliberately. The word is meant to suggest a programming team which is in a narrow sense very talented and may be able to crank out lots of code but doesn’t have a professional attitude to safety, correctness, and reliability. Somebody else suggested that it seems I’m effectlvely “blaming the driver” in my complaint about the Ottawa signalling system. To be clear, I mean the whole organization responsible for the signalling system, not necessarily the person who literally writes the individual lines of code. Somebody should have realized that a door failure should not prevent a train from being operated under normal signalling procedures.
LikeLike
This extremely serious accident happened on June 12 of last year and you are reporting it on June 16 of this year, well over an year late. Why should I read your blog?
Steve: You dumb twit! That accident was not reported by the TTC even internally to its own Board, but the story was broken by Ben Spurr in the Star on June 4 this year. The TTC’s report on the event was not released until their June 16, 2021 Board meeting, the same day I published my article.
You might ask why you should believe anything the TTC tells you about its concern for “safety”. Management’s ass-covering appears to rank higher.
You should read my blog to get the details on transit stories that are not reported in depth elsewhere.
Now go back to your troll hole and find yet another fictitious name to post under.
LikeLike
A lot of British Rail passing sidings have a switch at the end of the siding that leads to a short piece of straight track the dumps the train onto the ballast beside the mainline so if you don’t stop you don’t foul the mail line.
LikeLike