Language selection

Railway Investigation Report R99T0031

Derailment
Canadian National
train No. CN M-304-41-05
mile 255.1, Ruel Subdivision
Neswabin, Ontario
06 February 1999

The Transportation Safety Board of Canada (TSB) investigated this occurrence for the purpose of advancing transportation safety. It is not the function of the Board to assign fault or determine civil or criminal liability. This report is not created for use in the context of legal, disciplinary or other proceedings. See Ownership and use of content.

Summary

On 06 February 1999, at approximately 1628 eastern standard time, Canadian National eastward freight train No. M-304-41-05, travelling from Hornepayne, Ontario, to Toronto, Ontario, derailed 20 cars at Mile 248.5 of the Ruel Subdivision. The derailed cars (the 21st to the 40th behind the locomotives) included a loaded tank car of liquefied petroleum gas and two tank cars loaded with a flammable liquid mixture. Benzene was the main component of the flammable mixture, while dicyclopentadiene was the second main ingredient. One of the tank cars of the benzene mixture was punctured during the derailment resulting in a fire and a total loss of product. The liquid benzene and some lumber that was strewn about the derailment site fuelled a fire that burned for several days. One of the other derailed cars was subsequently found to have a burnt-off axle journal bearing. The remote location of the accident site minimized the risks to the public. There were no injuries.

Ce rapport est également disponible en français.

1.0 Factual Information

1.1 The Accident

At approximately 1615 eastern standard time (EST)Footnote 1, Canadian National (CN) freight train M-304-41-05 (train 304) was proceeding eastward from Hornepayne, Ontario, to Toronto, Ontario. As the train passed by the Wayside Inspection System (WIS) site at Mile 255.1 of the Ruel Subdivision near Oba, Ontario, the WIS detected several abnormal conditions around the 95th and 96th axles on the train, including hot bearings, hot wheels and dragging equipment. The dragging equipment detector (DED) feature of the WIS had been declared out of service more than 12 hours beforeFootnote 2. Figure 1 shows a schematic of the track in the area around Oba.

Figure 1. Basic track layout, train direction and accident location
Basic track layout, train direction and accident location

The location of the detected conditions (95th and 96th axles) coincided with the trailing truck on a bulkhead flat car, CN 604697 (21st car), loaded with packaged lumber products. A radio message was transmitted directly to the train crew from the WIS site ("talker"), verbally advising the crew of "dragging equipment," followed by radio messages of "multiple alarms." Intermittent audible tones were also provided to the train crew indicating the detection of multiple alarms. The crew was unaware of the specific defective conditions detected by the WIS, and the audible tones provided to the crew did not differentiate between a hot box or dragging equipment problem, as both were potentially serious conditions requiring prompt attention.

The crew members proceeded to slow their train, preparing to stop and make a visual inspection. As they were slowing, they radioed the rail traffic controller (RTC) in Toronto to advise of their situation and also to make the RTC aware that they had been stopped by an alarm at the same site during their previous trip. They requested direction from the RTC as to what they should do. The RTC stated that the DED was now out of service; however, he would consult with the hot box operator (HBO) in Edmonton, Alberta, for guidanceFootnote 3.

Once contacted by the RTC in Toronto, the HBO in Edmonton consulted with the rail traffic control mechanical service representative (RTC Mech), who worked in the same office, about the conditions on the tape at Oba. The RTC Mech concluded that the tape produced from the scan at Oba was "faulty."Footnote 4 The RTC subsequently instructed the train to proceed. No restrictions were issued to the crew.

At approximately 1628, when the train was passing the east switch at Neswabin, at Mile 248.5, the crew members experienced a train-initiated emergency brake application. After the train stopped, the crew members heard a loud noise and saw behind them, about 20 car lengths away, a cloud of smoke blowing towards them in an easterly direction (see Figure 2). The train was carrying 20 tank cars of seven different dangerous goods intermixed through the consist. The crew members immediately made a radio broadcast to the RTC in Toronto advising of the accident. The crew members did not know what, if any, dangerous goods were involved at that time, nor the number of cars derailed, but were able to describe to the RTC the noises they heard and the smoke and fire they could observe from their location. They disconnected the two locomotives from the rest of the train and proceeded eastward to what they considered to be a safe location, at approximately Mile 239.

Figure 2. Aerial photograph of accident site
Aerial photograph of accident site

The RTC immediately initiated the emergency response. The emergency response was multi-disciplined, including police, fire, railway, shipper, and private contractor emergency response teams, as well as various provincial and federal regulatory agencies.

A subsequent aerial inspection of the train revealed that 20 cars had derailed: the 21st to the 40th behind the locomotives. The bulkhead flat car, CN 604697, was found to have a burnt-off axle journal (BOJ)Footnote 5, later determined to have been located at the L-3 position, which was adjacent to the lead wheel of the trailing truck on the south rail (95th axle). The derailed cars included a loaded tank car of liquefied petroleum gas (LPG) and two tank cars of benzene, a flammable liquid mixture (see section 1.3). One of the tank cars of benzene, AGEX 1001, was badly damaged resulting in a total loss of product. The liquid benzene and some lumber that was strewn about the accident site from some bulkhead flat cars that were destroyed in the accident fuelled a large fire that burned for several days. The jacket of the loaded tank car of LPG, CGTX 63501, was scorched by the heat from the fire; however, there was no release of product (see Figure 3). The emergency response procedures were carried out in a timely and effective manner.

Figure 3. Fire-damaged jacket of loaded tank car of LPG (CGTX 63501)
Fire-damaged jacket of loaded tank car of LPG (CGTX 63501)

1.2 Injuries

There were no injuries as a result of this derailment.

1.3 Dangerous Goods

1.3.1 Flammable Liquid Mixture

Tank cars AGEX 1001 and PROX 41841 contained a mixture of flammable liquids with benzene being the main component. According to the shipping document, the product was shipped as "flammable liquids, n.o.s. (benzene), Class 3, PG I, UN 1993." The second main ingredient was dicyclopentadiene. In addition to the two main ingredients, there were more than 10 other aromatic compounds included in the mixture.

Benzene, the main constituent of the flammable mixture, is a flammable toxic liquid whose vapours may cause a flash fire (Class 3, UN 1993). The lower explosive limit (LEL)Footnote 6 of benzene is 1.2 per cent and its upper explosive limit (UEL) is 7.8 per cent; both values are concentrations by volume of product in air. The flash point of benzene is 12 degrees Fahrenheit (F). The toxicity of benzene affects the central nervous system, respiratory system, blood and bone marrow (e.g. leukemia). The primary routes of entry are inhalation and absorption through the skin. It is a known human carcinogen with poor olfactory warning properties. The current maximum exposure limit for benzene is 0.1 part per million (ppm) as set by the National Institute for Occupational Safety and Health (NIOSH), and 0.5 ppm as set by the American Conference of Governmental Industrial Hygienists (ACGIH). The short-term exposure limit (15 minutes) is set at 1 ppm by the NIOSH and at 2.5 ppm by ACGIH. Canadian Standards Association tests show that an average person is able to detect the odour of benzene at concentrations of 4.68 ppm or higher depending on the individual and test conditions. Concentrations at these levels exceed maximum permissible limits. Vapour pressure of benzene is 75 mm at 68°F.

Industrial hygienists with a private contractor monitored the site, and employees working at the site were advised when benzene levels required the wearing of specialized personal protective equipment, such as protective clothing and self-contained breathing apparatus. Ontario Ministry of Environment officials oversaw the clean-up and remediation efforts in the derailment area.

Dicyclopentadiene is a flammable, toxic solid with a camphor-like odour and a melting point of 91°F. The vapour pressure of dicyclopentadiene is 1.4 mm at 68°F. Because of these characteristics, it is usually transported in solution with benzene. The flammability limits are 0.8 per cent by volume LEL and 6.3 per cent by volume UEL. The flash point of dicyclopentadiene is 90°F. It is quite reactive and can polymerize (undergo a chemical reaction where molecules combine) explosively as well as depolymerize. It is considered moderately toxic by inhalation and mildly toxic by skin contact. Maximum exposure limit is set at 5 ppm by both the ACGIH and the NIOSH. The organs affected by exposure to dicyclopentadiene are the kidneys, central nervous system, and respiratory system. In the United States, it is part of the Genetic Toxicology Program, administered by the Environmental Protection Agency (EPA), which is evaluating its links to genetic mutations and other detrimental genetic effects.

1.3.2 Liquefied Petroleum Gas (LPG)

Propane, as transported in tank cars, is a flammable colourless liquefied gas (i.e. shipped under pressure). Its flammability limits are 2.4 per cent by volume LEL and 9.5 per cent by volume UEL. The flash point of propane is minus 156°F. The permissible exposure limit is 1,000 ppm. It is a highly dangerous fire hazard when exposed to a source of ignition, or if the tank is subjected to heat or flame. Propane can react vigorously or explosively with any oxidizer. It is toxic to the central nervous system at high concentrations, and can also act as an asphyxiant.

1.4 Damage to Equipment

Sixteen of the twenty derailed cars from train 304 were destroyed, including three tank cars that were involved in the post-derailment fire. Four cars experienced minor damage and were repaired and returned to service.

The car with the BOJ, CN 604697, was slightly damaged. The car was examined after the accident. No signs of roller bearing grease were noted on the truck and underframe area of the car immediately above the roller bearing where the BOJ was located (the L-3 position).

The tank cars of benzene, AGEX 1001 and PROX 41841, were built to specification DOT-111A100W1. Car AGEX 1001 was badly damaged during the derailment sequence and lost its entire contents (see Figure 4). The susceptibility of minimum standard Class 111A cars to experience damage during a derailment has been known throughout the North American railway industry, including railway safety regulators, for a considerable time.

Figure 4. Damaged benzene tank car (AGEX 1001)
Damaged benzene tank car (AGEX 1001)

The tank car of LPG, CGTX 63501, was built to specification DOT-112J340W. The tank car was heavily damaged but experienced no loss of product.

TSB personnel examined three of the more seriously damaged tank cars and the detailed results of this examination are contained in Appendix A.

1.5 Other Damage

The first marks on the railway ties were noted approximately 200 feet before the WIS at Mile 255.1. The derailed wheel set of car CN 604697 caused minor damage to 6.75 miles of track. There was substantial damage to the hot box detector (HBD) at Mile 255.1, and to the west power switch to the Neswabin Siding, at Mile 249.8. The east power switch and dwarf signal at Neswabin, Mile 248.5, and 500 feet of track immediately east of the east power switch were destroyed. In the main derailment area, a total of four telephone poles and all associated hardware were destroyed. Total property damage exceeded $1.5 million.

1.6 Personnel Information

The operating crew consisted of a locomotive engineer, a conductor and an assistant conductor. They were qualified for their respective positions and met fitness and rest standards.

1.7 Train Information

Train 304 consisted of 2 locomotives and 71 cars: 57 loads, 13 empties and 1 residue. The train was carrying a variety of dangerous goods as follows:

The train was approximately 4,850 feet in length and weighed about 7,000 tons.

1.8 Occurrence Site Information

The subdivision was single main track in the derailment area, and handled both passenger and freight traffic. The track structure consisted of 136-pound continuous welded rail (CWR) rolled in 1992 and laid in 1993. The ties were No. 1 hardwood. The rail was secured with six spikes per tie on 14-inch double-shouldered tie plates, anchored every second tie with improved Fair anchors. The ballast consisted of slag on a full crib and was in good condition. The roadbed was elevated approximately 10 to 15 feet above the surrounding ground level.

The authorized time table speeds between Mile 245.5 and Mile 252.2 on the Ruel Subdivision were 55 mph for passenger trains and 45 mph for freight trains.

1.9 Method of Train Control

Train operations from Mile 1.6 to Mile 295.6 on the Ruel Subdivision were controlled by the Centralized Traffic Control System authorized by the Canadian Rail Operating Rules (CROR) and supervised by an RTC located in Toronto.

1.10 Weather

The temperature at the time of derailment was approximately minus 10 degrees Celsius, and wind was from the north-west at approximately 15 km/h. Precipitation was nil; however, there were blowing snow conditions around passing trains due to recent snow accumulations.

1.11 Recorded Information

1.11.1 Locomotive

The event recorder transcript indicated that the emergency brake application occurred at 1628:28. At that time, the train speed was 42 mph, with the throttle in the No. 8 position. At 1629:16, the train speed was registered as 0 mph.

1.11.2 Wayside Inspection System (WIS)

A review of recorded data from WIS sites located at Mile 282.3, Mile 268.7, and Mile 255.1 of the Ruel Subdivision revealed the following:

1.12 Inspections

1.12.1 Engineering Inspections

A rail TEST car (Pandrol Jackson) last tested the Ruel Subdivision on 15 and 16 January 1999, and no defects that required immediate attention were noted in the area of the derailment. In May 1998, maintenance-of-way extra gangs completed a tie-replacement program between Mile 268 and Mile 295.6. The track was last inspected by a track supervisor on 04 February 1999, and no irregularities were noted. The local snow protection track maintenance foreman and a signal maintainer passed over the track in a Hi-rail vehicle between 1000 and 1400 on the day of the accident, and again no exceptions were noted.

1.12.2 Safety Inspection of Car CN 604697

Car CN 604697, carrying a load of lumber, originated in northern British Columbia and was destined to a customer in the eastern United States. The repair record shows that the No. 3 wheel set (the third axle from the B-end of the car) was last replaced in 1995 at a U.S. repair location. The car had travelled 132,000 miles since the wheel set was replaced. The load of lumber that it was carrying was distributed evenly over the length of the car.

Before the eastward departure of the car from CN's Prince George Yard, the car had received an initial safety inspectionFootnote 9 by a certified car inspector, and no defects were noted. Car CN 604697 had previously been on a train that was involved in a collision on 31 January 1999, in Jasper, Alberta. Nine of the head-end cars at Jasper either derailed or showed signs of being subjected to severe compressive loads. Car CN 604697 was located in the 30th position in that consist and did not derail. The car was inspected by certified car inspectors at the site after the accidentFootnote 10. With no obvious signs of derailment damage nor signs of being subjected to severe compressive loads, the car was determined to be fit to return to service. Subsequent to this derailment, repair records for the first 25 non-derailed cars from the Jasper collision were reviewed to see if any of the wheel sets had experienced premature roller bearing failure, and none had.

Subsequent safety inspections of car CN 604697 were conducted en route at Edmonton and Winnipeg; again, no defects were noted. Weigh scales in Winnipeg Yard recorded the total weight of the car and it was found to be within allowable limits.

1.12.3 En Route Inspections

Before the WIS at Oba, the train had passed over two WIS sites (Shekak, Mile 282.3, and MacDuff, Mile 268.7), and no alarms were communicated to the crew by the advance warning alarm (AWA) system (the talker) at either of these two sites. However, the display screen at Edmonton was showing a warm bearing (yellow) indication at Mile 268.7 to the HBO.

Between the initial terminal of Hornepayne and the point of derailment, a distance of approximately 41 miles, train 304 had been inspected by the crew members of three other trains that were passed at the three sidings preceding the point of derailment (see Figure 5). Train 304 was inspected on the north side only at these three locations. Due to heavy snow conditions, there were few safe areas for employees to position themselves to inspect a passing train on the south side. No defects were noted during these inspections.

Figure 5. Simplified sketch showing pull-by inspection and WIS locations relative to the accident location (Note: not to scale)
Simplified sketch showing pull-by inspection and WIS locations relative to the accident location (Note: not to scale)

1.12.4 Other Information--Roller Bearings and Burnt-off Journals (BOJs)

Roller bearings are pressed onto the ends of railway axles adjacent to the wheel plate area. There are typically eight roller bearings per car, one on each end of the four axles. Roller bearings are normally of a tapered design, and support and transfer the weight of the rail car and its contents onto the axles and through the wheels to the rails. The bearing is positioned within a pedestal jaw of a truck side frame. The moving parts of the roller bearing allow the solid wheel/axle combination to which it is attached to rotate with little friction (see Figures 6 and 7). General roller bearing information can be found in Appendix B.

Figure 6. Side view of roller bearing and truck side frame
Side view of roller bearing and truck side frame
Figure 7. End view of roller bearing and truck side frame
End view of roller bearing and truck side frame

Overheated roller bearings occur when inadequate lubrication or mechanical flaws result in an increase in bearing friction. This phenomenon is called a "hot box" in railway jargon. The bearing temperature can continue to rise and lead to complete failure of the axle, commonly referred to as a "burnt-off journal" (see Figures 8, 9, and 10).

Figure 8. View of end cap from L-3 location of car CN 604697
View of end cap from L-3 location of car CN 604697
Figure 9. View of End Cap and Remaining Portion of Axle Stub
View of end cap and remaining portion of axle stub
Figure 10. Pieces of internal roller bearing parts
Pieces of internal roller bearing parts

A BOJ normally results in the derailment of the car on which it occurs. Should axle failure happen while the train is proceeding at a high speed, the derailment frequently results in multiple cars derailed and/or damaged. Figure 11 shows the total number of BOJs since 1994 provided to the TSB during the investigation by the three Class 1 Canadian railways.

Figure 11. Number of burnt-off journals (1994-2000*) on Class 1 Canadian railways (*for year 2000, data represents six months for CPR and ten months for CN)
Number of burnt-off journals (1994-2000*) on Class 1 Canadian railways (*for year 2000, data represents six months for CPR and ten months for CN)

A hot box condition on roller bearing-equipped rail cars can elevate quickly and become a BOJ within a few miles. A review of 47 derailments following a BOJ that happened between 1992 and 1996 showed that 22 of the derailments occurred within five miles after passing an operative HBD without an alarm conditionFootnote 11. The HBD spacing on some core routes is 25 to 30 miles, as that was a common distance that the now prohibited plain bearing could travel if it overheated without resulting in a BOJ. Advancements in roller bearing technology have led to the replacement of plain bearings on all interchange rail cars.

1.13 WIS Technology

1.13.1 Background Information

Over the last 25 to 30 years, many North American railways have implemented large numbers of HBDs and DEDs as an integral part of their railway infrastructure. This technology assisted railway personnel in the identification of operating problems that posed a risk to safe train operations.

Subsequent to the 1979 Mississauga train derailment, "gateway" locations were identified entering densely populated areas. Before entering such areas, trains carrying dangerous goods were required to be inspected. Within these areas, trains were subject to certain operating restrictions to enhance the safety of their operations. Railways could satisfy the inspection requirement if the train had a successful inspection by a hot box and dragging equipment detector. Without such technology, other measures had to be taken, such as having the trains stop and be inspected by the train crews or by other railway employees.

Later, some HBDs were further enhanced with the addition of hot wheel detectors (HWDs) and significant improvements to the hardware; e.g., analog to digital, improved infrared scanner technology and, more recently, sophisticated computer hardware. As user confidence grew with the technology and the railways realized improved safety to their operations, more and more HBDs, HWDs, and DEDs were added to their fixed infrastructure and the sites became known as Wayside Inspection Systems (WISs).

Figure 12. WIS site equipped with dragging equipment detector and hot wheel detector
WIS site equipped with dragging equipment detector and hot wheel detector

CN's WIS of today is a distributed system comprising sensors in the field, coupled with office computers (located in Edmonton, Toronto, and Montréal) and a network of personnel from various departments within CN (Signals and Communications, Mechanical, and Operations) who perform functions from testing to reading and interpreting the WIS data.

1.13.2 General Description

The HBD senses radiant infrared heat energy emitted from the bearing as it passes the detector. The heat energy is converted to an electrical output proportional to the amount of heat and relative to the ambient temperature. Ambient temperature is determined by scanning the bottoms of the rail cars as they pass. The electrical output is fed to a data processing unit (DPU) in an adjacent bungalow, which is a structure that encloses various electrical and electronic equipment necessary to operate the railway system. When the train has passed the site, all the data are sent to the office for interpretation, with hot wheel and dragging equipment indications flagged in the data. All data are sent in as raw "uninterpreted" data for office analysis at warm and hot levels. If the amount of energy sensed by the HBD exceeds preset values, then the appropriate indication is generated. Such an indication is immediately relayed to the HBO (where it is displayed in graph form measured in millimetres) and to the train crew by the AWA through a radio ("talker") system (see Figure 13).

Figure 13. Typical CN WIS configuration (Note: not to scale)
Typical CN WIS configuration (Note: not to scale)

Today, HBDs are strategically placed throughout the core network of most major railways. The principal target of the detectors is freight car bearings (which comprise about 97 per cent of all axles). CN has 68 subdivisions protected by HBDs, representing over 97.9 per cent of CN's traffic. Of the remaining 48 subdivisions, 11 are under 20 miles in length and account for 0.4 per cent of traffic. The remaining 37 subdivisions which are not equipped with HBDs carry 1.7 per cent of CN's traffic. Typical spacings of HBDs on main corridor routes of both CN and Canadian Pacific Railway (CPR) seldom exceed 30 miles. After a five-year major capital program west of Capreol, the spacings in many areas on CN core routes were reduced to 12 to 15 miles. Locations where the risks were low, such as subdivisions with low gross ton-miles or no dangerous goods traffic, were frequently not targeted for the installation of HBDs. CN continues to invest in additional HBDs to progressively reduce spacing distance on core mainlines and achieve further improvements in roller bearing performance.

1.13.3 Hot Wheel Detector (HWD)

The HWD is similar to the HBD in that it senses radiant heat energy. However, the target in this instance is the wheel plate area near the tread, approximately 2 1/2 inches above the rail. CN's HWDs include an "M"-shape filter which eliminates elevated wheel tread readings due to momentary application of train brakes. Some systems use an HWD scanner on both sides of the track, but most use only one scanner on one side of the track. When only one HWD scanner is used to scan wheels on both the near and far rail, it is normally set at an angle to the track. The outboard wheel plate surface of a wheel on the near rail can be scanned, as can the inboard wheel plate surface of a wheel on the far rail. A reference temperature is established by placing a white board on the far side of the track opposite the HWD scanner. The reference board is used as a base value in order to produce semi-absolute wheel plate temperature readings. The data are transmitted to the DPU in the bungalow and compared to preset alarm thresholds. As with the HBD, alarms are relayed to the HBO and to the train crew by the AWA through the "talker" system.

1.13.4 Dragging Equipment Detector (DED)

The DEDs were of two different designs; paddle (mechanical) or impactor (electronic) style. The paddle style (see Figure 14) consisted of strike plates, both inboard and outboard of the rails, attached to a shaft with a cam-operated switch and a return spring. An object striking the paddles in either direction would rotate the shaft, momentarily opening the switch contacts. An open circuit would trigger an alarm. The impactor style (see Figure 15) was designed to alleviate the problems associated with the paddle style under deep snow conditions and has no moving parts. Stationary strike plates between and outboard of the rails are fitted with accelerometers which detect impact energy. Sufficient impact energy creates an electrical output recognized by the DPU and generates an alarm. DED alarms are always relayed to the train crew by the "talker" system, and to the HBO by modem.

Figure 14. Paddle style of dragging equipment detector
Paddle style of dragging equipment detector
Figure 15. End view of impactor style of DED showing location of one of the accelerometers on the underside of the strike plate
End view of impactor style of DED showing location of one of the accelerometers on the underside of the strike plate

1.13.5 Limitations of the System Hardware

The HBDs are rated to work in ambient temperatures ranging from minus 40°F to plus 160°F. Rated speeds are up to 120 mph. Severe environmental conditions, such as snow storms and blowing snow conditions, heavy rain and ice, can affect the quality of the scan data. The type of housing used for the roller bearings within the truck assembly can have an impact on the ability of the scanners to sense infrared heat energy. Although most freight cars are equipped with standard freight car trucks which are easily scanned, equipment with unusual, heavy, or complicated truck assemblies (e.g. locomotives, specially equipped freight cars and passenger cars) can interfere with the radiant heat being sensed by the HBD scanners. Some passenger cars (e.g. Light, Rapid, Comfortable (LRC) coaches) have no external bearings and are therefore equipped with an on-board heat detection system. The on-board system continually monitors the condition of the internal roller bearings which are not scanned by conventional HBD scanners.

The following VIA Rail Canada Inc. (VIA) equipment has wheel bearings external to the wheels:

Equipment Number of Cars/Locomotives
HEP I cars (head-end electrical power stainless steel Budd cars, transcontinental service 180 cars
HEP II cars (stainless steel Budd cars, corridor service) 33 cars
F40 locomotives (GM, corridor and transcontinental service) 58 locomotives
GPA-418 locomotives (GM, other service__Northern Quebec and Manitoba) 7 locomotives
MPA-27 locomotives (Bombardier, LRC corridor service) 7 locomotives

The current maximum rated speeds of each type of equipment is:

Type of Equipment Maximum Rated Speeds
HEP I cars 90 mph
HEP II cars 95 mph
LRC cars 100 mph
F40 locomotives 95 mph
GPA-418 locomotives 89 mph
MPA-27 locomotives 100 mph

Only the LRC car fleet (98 cars) has inboard bearings and all these cars are equipped with on-board monitoring equipment. A few VIA locomotivesFootnote 12 have on-board journal bearing heat monitoring. CN and CPR locomotives are not normally equipped with this type of on-board electronic monitoring. Locomotives without an on-board journal bearing heat detection device rely on the WIS to detect journal bearings that are in a state of distress.

Both Southern Technologies Corporation (STC)Footnote 13 and Harmon IndustriesFootnote 14, the two major suppliers of HBDs in North America, stated that, even in favourable environmental conditions, some bearings on locomotives cannot be accurately scanned. The HBD functions as intended; however, there are mechanical parts located between the bearing and the scanner which can obscure the view of the bearing as it passes the HBD (see Figures 16 and 17). These mechanical parts differ by axle size and by locomotive type. Locomotives represent a small percentage of all axles scanned; however, unlike freight equipment, many locomotives are manned.

Figure 16. Side views of locomotive roller bearing housing (Note: bottom tie strap under bearing)
Side views of locomotive roller bearing housing (Note: bottom tie strap under bearing)
Figure 17. End view of roller bearing housing on railiner
End view of roller bearing housing on railiner

1.13.6 Office Computer

Data from the DPU in the track side bungalow are received at a central office computer where they are processed by computer software (Devtronics). The Devtronics software is also used by the operator to view the information in the form of an "analog" chart displayed on a video display. If the WIS values are within normal operating parameters, the operator is not actively notified of the train inspection, though the information is displayed on the operator's screen in the form of a green message line in a status window. If the values meet TP-105 criteriaFootnote 15 or other criteria defined in the computer software (e.g. car-side average or train-side average which are further explained in section 1.15.4), then the data are presented to the operator in the form of an analog tape displayed on the computer screen. If there is more than one tape to be examined, the first is displayed and all others are placed into a queue and a visible alarm and an audible alarm are generated to alert the operator (see Figure 18).

Figure 18. Devtronics screen display for HBOs and RTC Mechs showing the location of some of the prompts
Devtronics screen display for HBOs and RTC Mechs showing the location of some of the prompts

A train is not normally displayed on the screen in its entirety (e.g. typically 35 cars to a display screen) because of the size of the analog tape. In order to view the complete tape, the HBO must scroll from one direction to another (see Figure 19). When the "high" reading is identified, the operator can obtain more detailed information by clicking on the relevant portion of the tape. Once the tape is examined, the operator has a choice of either acknowledging having viewed and interpreted the tape or placing the tape back into the queue for later reference.

Figure 19 - Actual computer screen displays used by HBOs and RTC Mechs (Note electronic version of analog tape displayed on the bottom of the screen on the right)

1.14 Maintainers, Technicians, and Operators

1.14.1 Signals and Communications (S&C) Maintainers

Signals and Communications (S&C) maintainers report to a signal supervisor within the S&C Department. They are responsible for performing monthly tests on the WIS sites. A device supplied by the manufacturer for this purpose known as the function simulator is used to simulate an overheating bearing. The temperature setting used in the test procedure is 135°F above the ambient temperature. The WIS system alarm threshold temperature setting is 180°F above ambient. Interviews with S&C maintainers revealed that training associated with the testing of WIS sites consisted basically of on-the-job training through observing others doing the monthly tests.

The S&C maintainers also respond to trouble calls as required. At the time of the occurrence, they did not have an easy way in the field to identify problems with the various components of the WIS, particularly the DED, and repairs of a highly technical nature frequently required the assistance of technicians. Numerous sites in the northern areas were only accessible by Hi-rail vehicle. This restriction affected the amount of time that a site would be out of service compared to sites in urban areas where access was usually easier (e.g. road).

The primary goal of an S&C employee when responding to trouble calls involving the WIS was to restore it to correct operating condition. The main complaint presented to S&C maintainers from the operating employees (train crews, RTCs, etc.) was that the WIS was stopping trains unnecessarily (false alarms); therefore, one of their routine tasks was to make the WIS stop sending alarm messages when there was no defect. To ensure the field repairs corrected the problem with a WIS, an informal practice had evolved of allowing four trains (which provided normal indications on previous sites) to go over a site without generating alarms before certifying the site as repaired.

1.14.2 S&C Technicians (Office and Field)

The S&C technicians who worked in the offices associated with the WIS were located in Montréal, Toronto and Edmonton in the rail traffic control centres. However, they reported directly to a signal supervisor within the S&C Department.

With respect to the WIS, the primary role of the S&C office technicians was to read and interpret test tapes generated by S&C maintainers in the field, record trouble calls associated with the WIS sites, dispatch personnel to ensure proper operation of the sites, and read and interpret test tapes generated by the CN TEST car. Some of the office technicians indicated that they had no formal training on interpreting test tapes, other than the information provided in manuals, and from observing others doing the job.

The S&C technicians who worked in the field inspecting and maintaining the WIS field sites were normally based at radio shops or field offices located strategically along the right-of-way throughout the CN system. There were fewer technicians than signal maintainers. A signal technician would typically cover the territory of several maintainers. S&C technicians performed more in-depth technical work due to their more extensive technical training and were usually called out in cases where S&C maintainers needed more detailed technical assistance. S&C technicians worked under the auspices of a signal supervisor located in the field.

1.14.3 TEST Car Operators

CN currently has two dedicated track geometry cars (TEST cars) for the purposes of measuring track conditions. Both TEST cars are accompanied by an operator who ensures the on-board computerized track geometry equipment is functioning as designed. Only one of these TEST cars is capable of dynamically testing the HBDs. This car last travelled over the major corridor routes in eastern Canada, including the Ruel Subdivision, in September 1995. CN did experiment with equipping one of its TEST cars with hot wheel simulators but the modification was unsuccessful because of problems related to track clearance, and the technology was removed due to repetitive damage in service. Neither TEST car had been equipped to test DEDs.

No other Canadian railway is known to have a car capable of dynamically testing any aspect of WIS sites.

A TEST car is coupled to a highly instrumented box car and then pulled by a freight locomotive (see Figure 20); therefore, the maximum operating speed of the TEST train is limited to subdivision zone speed for freight trains (typically 60 mph), any temporary or permanent slow orders, or other restrictions that may be in effect (e.g. on a General Bulletin Order).

Maximum passenger train speeds on CN subdivisions are typically 70 or 80 mph, but can be up to 100 mph on corridor service routes for LRC passenger trains (Québec to Windsor). The maximum permissible speed for freight trains is typically 60 mph, but 65 mph is allowed for designated trains (e.g. high-speed intermodal). CN states that, since the principal target of the WIS system is freight car bearings (which comprise about 97 per cent of all axles) and since eastern corridor passenger cars (comprising many of VIA's high-speed passenger car-miles) are equipped with inside bearings and on-board sensors, the TEST car process is matched to the statistical need.

The computer on board the TEST car will see a slow down of data processing if operated at a speed of 65 mph for extended periods of time. The data are not lost, only delayed due to the time required for processing.

Figure 20. Typical CN TEST train configuration showing freight locomotive, a highly instrumented box car and a dedicated track geometry car
Typical CN TEST train configuration showing freight locomotive, a highly instrumented box car and a dedicated track geometry car

1.14.4 Hot Box Operators (HBOs)

The HBOs are unionized employees who report to the Operations Group and come under the auspices of the Edmonton rail traffic control centre manager. The primary goal of the HBO is to examine WIS tapes to identify dragging equipment and possible hot boxes and to detect conditions which may indicate a malfunctioning detector. Before the introduction of the RTC Mech, the HBO also stopped trains in response to alarms for hot wheel conditions.

Training for HBOs consists of one day of classroom instruction, including an examination, followed by a minimum of four days of on-the-job training with a more experienced HBO. The on-the-job training can be extended as required at the supervisor's discretion. Refresher training may also be given to employees who are trained, but have not worked in the position for six months. After not working in the position for 12 months, an employee must undergo refresher training. Refresher training may consist of one or more of the following: "sitting-in" for a number of assignments with an experienced HBO, classroom instruction, and an examination.

Company policy states that, when new, revised or supplementary instructions are introduced (depending on the extent of the changes), refresher training may be deemed necessary for all employees affected. With respect to the Devtronics software, the HBOs were provided with instructions on its use, and were allowed a transition period of several months where both the new computer system and the older CN office computer were operated side by side. The HBOs were also given the opportunity to provide design recommendations based on their experience during this phase-in period.

1.14.5 Rail Traffic Control Mechanical Service Representatives (RTC Mechs)

The RTC Mechs are management level positions reporting to the Director of Mechanical Services, West. They are formally trained to work within the operating guidelines of TP-105. The remainder of their tape reading and interpretation skills have been derived experientially.

The RTC Mech positions were established in response to a study group which examined "Why Wheels Fail." As part of this study, it was determined that proactive monitoring and action might prevent wheel failures associated with sticking brakes. When the RTC Mechs were first established as a group, this was accomplished by taking action based on the monitoring of HWD data. As the RTC Mechs became experienced at interpreting the hot wheel data, they began to expand their role and became more involved with hot bearing data. Through this experiential learning process, involving the examination of both hot wheel and hot bearing tapes in unison, they developed strategies to better discern whether the data indicated a hot wheel due to a sticking brake, or a hot bearing due to a failing journal.

In addition to these duties, the RTC Mechs attempted to reduce unnecessary on-line train stops.

1.15 Hot Bearing Detection Task and Workload

1.15.1 Hot Bearing Detection Task

Different criteria are used to identify different levels of bearing state and associated alarm conditions. The following table (see Figure 21) and sections describe in more detail the different alarm settings and associated criteria for the varying equipment and systems monitored by the WIS.Footnote 16

Bearing State Criteria
Absolute Deflection (mm) Differential (mm)
Advance warning alarm (AWA) 17 10
Hot bearing (HB and HD) 15 8
Warm bearing (WB and WD) 12 6
Warm bearing (W2) double slope pulse to train-side average based on a comparison of each pulse on a particular side of a train with the average of ALL pulses on that side of the train
Warm bearing (W3) double slope pulse to car-side average based on a ratio of the highest pulse recorded on each side of every individual car to the average remaining pulses on that side of the car

Figure 21 - CN alarm roller bearing temperature monitoring criteria

1.15.2 Advance Warning Alarm (AWA) Criteria for Hot Bearing

The AWA was designed to alert a train crew should an alarm condition, such as a hot bearing, a hot wheel, or dragging equipment, be detected. For hot bearings, if HBD criteria met or exceeded 17 mm absolute deflection or 10 mm differential from one side of the axle to the other, the WIS immediately initiated a double audible tone followed by a message(s) on the designated end-to-end radio standby channel (advising the crew of an alarm condition, identifying the axle number and side of the train). If other hot bearing or dragging equipment defects were detected on the same train, double tones would be broadcast as the defects were encountered, and the final message after the train had completely passed the WIS would indicate ". . . multiple alarms, repeat, multiple alarms. . . ." The Devtronics system would also report AWAs to the Edmonton HBO/RTC Mech office. Once the train passed the WIS site, a tape could then be interpreted (normally by the HBO), and the location of the hot bearing would be passed onto the train crew members who then physically inspected the stopped train.

CN General Operating Instructions (GOIs) required that "the train . . . must stop immediately, consistent with good train handling practices advising the RTC the location where the engine came to a stop." The crew member performing the inspection would proceed to the identified car and inspect all journals. If all journals appeared to be normal, inspection had to be made of all journals on at least three cars ahead and behind the identified car. The crew member was required to use a temperature-indicating crayon ("tempilstik") to aid in determining if the bearing was dangerously overheated.Footnote 17 Melting of the tempilstik was intended to indicate that the car had to be "set off" for repairs.

In addition to the use of a tempilstik on a suspect journal, a visual inspection was required to determine if there were any other defects present. A review of data pertaining to CN train stops from 1995 to 1999 revealed that, between 30 and 40 per cent of the time, train crew members could not find a defect when instructed to stop and inspect a particular car.

Rule 36 E.1. of the Association of American Railroads (AAR) Field Manual of the A.A.R. Interchange Rules states "To check bearing for overheated condition, use of a temperature indicating crayon (200 degrees F) or other temperature measurement device on outside of cup is required." Use of a tempilstik provided both confirmation that the bearing was hot, and that it was physically inspected at the time the car was set off.

1.15.3 TP-105 Criteria

CN's use of TP-105 criteria predates its use of AWAs using a talker system. It also distinguishes CN as one of the few railways in North America that attempts to use operator judgement to supplement the use of technological equipment. TP-105 criteria incorporate a more restrictive threshold than that used by the AWA system. Operators use these more restrictive criteria to help them identify bearings as potentially being in the early signs of distress. TP-105 criteria include provisions for the early detection of bearings for the following conditions, each of which is further explained later in this section:

When a scanned bearing met TP-105 criteria for a hot bearing (15 mm absolute deflection or 8 mm differential), the HBO was presented with an electronic tape, and a red message was placed on a status window on a computer monitor at the HBO workstation. The WIS would not broadcast a message in the field unless the AWA criteria (which were higher) had been exceeded. It was up to the HBO to examine the tape and confirm if TP-105 criteria had been exceeded. If they were, then the HBO was required to contact the train crew through the appropriate RTC and stop the train, providing the crew members with the location of the potentially hot bearing on their train for inspection.

In the event that a warm bearing was detected (based on TP-105 criteria of 12 mm absolute deflection or 6 mm differential), then the operator was again presented with a tape, and a yellow message was displayed in the status window. When a warm bearing was detected, the HBO was expected to make a comparison of this tape with the tape of the same train obtained at the previous detector site. The HBO was then expected to pay close attention to the suspected car, as it moved over subsequent detectors, to determine if the bearing was overheating, maintaining its temperature, or cooling down.

As per system design, no information about the warm bearing alarms was normally conveyed to the train crews or the RTCs.

Examining the tape of a train from a previous site involved determining the direction of the train, the number of axles on the train (to help in identifying the train at the previous site), and the axle number which was heating up. With this information and a knowledge of train routings and track layout, the operator could then determine the location where the train was last inspected by a WIS. To determine the last site where a train was inspected required performing a few functions using the Devtronics software (searching through a few "window"-type computer screen displays). A window showing the previous site was opened and the status screen for the site was examined to locate a train with a similar number of axles, having very recently gone over the site. The tape for this train could then be called up and examined.

The method used to monitor a train as it moved over subsequent detectors was much the same. It involved manually identifying the direction of the train, and then opening up a window which allowed selection of the following site. The system was then configured to display the tapes of all trains passing over this site, regardless of the temperatures detected by the sensors. It was up to the HBO to determine which tape was associated with the suspect bearing. There was no special message brought to the HBO's attention signifying that the subsequent site was flagged at "operator request" as opposed to a tape generated during regular operations. A test performed during the investigation revealed that an HBO could flag the wrong subsequent scanner in an area where trains diverge from one subdivision to another. This was particularly true if the HBO was not intimately familiar with the track layout and train routing practices in a specific area.

1.15.4 Car-Side and Train-Side Averages

The Devtronics software also identified two other types of potentially warm bearings; those based on a car-side average, and those based on a train-side average. These were displayed to the operator in the same manner as the warm bearings, identified on the basis of absolute deflection (WB) or differential (WD). The only distinguishing feature was that they were labelled W2 and W3 on the status screen as opposed to WB or WD. When a warm bearing was detected, it was categorized into one of the four types, depending on severity, with the following priority; WB, WD, W2 and W3 (highest to lowest).

Some HBOs and RTC Mechs did not differentiate the W2 or W3 indications from the WB or WD indications. W2 or W3 data represent special circumstances where an axle may be starting to overheat, but does not meet the strict 12 mm absolute deflection for WB or 6 mm differential criteria for WD. Several HBOs explained that they would examine W2 and W3 tapes looking for values that exceeded the 12 mm absolute deflection or the 6 mm differential. Such employees were therefore spending time examining W2 and W3 tapes looking for values that, by definition, would only be present in WB or WD indications.

1.15.5 Faulty Tapes

The HBOs and RTC Mechs also examined tapes in order to identify indications of a malfunctioning detector. Based upon their instruction, HBOs and RTC Mechs looked for the following anomalies to identify malfunctioning detectors:

Specifically relating to this occurrence, when the train went over the MacDuff WIS, a warm bearing differential (WD) alarm for the 95th axle was generated. The HBO did not examine the previous site the train had passed over, nor did he flag the next site (Oba) so that a comparison could be made between the two readings to determine if the bearing was becoming progressively warmer. When the train passed over the WIS at Oba, it generated an electronic tape which depicted a multiple alarm tape, including hot wheel, dragging equipment, and hot bearing at or near the 95th axle. There were also pedestal pulse readings (which can indicate the absence of heat readings) on the north rail subsequent to the 95th axle and anomalous spikes on the south rail.

The HBO indicated that he initially thought that this looked like a faulty tape. Then, the HBO, as a result of the hot wheel indication, requested clarification from the RTC Mech regarding the hot wheel tape. The RTC Mech was aware that the DED at this site had previously been taken out of service, and based on his observation of the hot wheel and hot bearing tape, interpreted the results to be a "faulty tape." This information was relayed to the RTC who had contacted the HBO for directions, and the train was allowed to proceed.

The two employees had performed their assessments in an independent manner, with little exchange of information between them about the results of their analysis of the tapes for which each was responsible. Subsequently, the HBO examined the tape from the MacDuff detector and identified the warm bearing at the 95th axle. Based upon this "new information," the HBO began to question the determination of "faulty tape." The HBO had previously encountered a situation where a train had a BOJ and derailed, destroying the scanner on one side of the track. Reportedly, the output tape in that occurrence was similar to the tape at Oba in this occurrence. Unable to convince the RTC Mech of his concerns, the HBO made numerous calls to the RTC and to the S&C personnel in Toronto hoping to obtain verification of his fears regarding the status of the train. It was during this exchange that the train went into emergency.

1.15.6 Workload

On an average day, there were approximately 6,200 WIS site inspections (one complete train scan per WIS site inspection) during a 24-hour period. In roughly 1,100 of these events, the HBO was required to visually inspect a "tape" presented on a screen and acknowledge having done so. Averaged out over a day, this amounted to 45 tapes to examine per hour; roughly one or more tapes to inspect and acknowledge per minute during peak travel periods. Each of those tape inspections took between 5 and 10 seconds to perform. For those tapes that met WB criteria, the HBO was also expected to research the train's previous readings and monitor future readings, which could take an additional 10 to 15 seconds. HBOs reported that this happened on the average about 10 times per shift.

In the month preceding the occurrence, the Edmonton office acquired responsibility for monitoring the sites previously monitored in Toronto and Montréal. The number of sites handled by the Edmonton office increased from approximately 200 to 400. Management indicated that, for a period of time before the centralization of the WIS data, the RTC Mechs attempted to monitor and track trains which showed signs of potential bearing failure. During this trial, they found that it was very difficult to accomplish this while also performing their other duties.

Figure 22 illustrates one of the three monitors in the Edmonton office showing the status of the WIS sites. Each rectangular box represents one WIS site and in total nearly 200 sites are monitored on this screen. Different colours are used to convey information about each site, such as a scan in progress, a site under repair, or a loss of data communication.

Figure 22.
Actual screen display used by HBOs and RTC Mechs to monitor the status of some of the WIS sites

The RTC Mech's responsibilities included monitoring the wheel impact load detector (WILD) system for identifying cars that had exceeded certain impact thresholds. This included managing the two-strike system whereby cars that have encountered two WILD detections within a 30-day period are recorded for tracking purposes. During the peak winter months of January and February, when the number of WILD alarms is significantly higher, the RTC Mechs can have 2,000 to 3,000 WILD messages to handle in a month. This number reduces to a few hundred per month in the balance of the year.

RTC Mechs maintained databases for such things as all train stops, air brake hose separations on line, and cars set off on line for any reason. These tasks were in addition to their duties associated with monitoring warm and hot wheels, or assisting the HBO in monitoring overheating roller bearings and dragging equipment. They also acted as a contact point for the Mechanical Department when derailments occurred, and were a resource to train crews and RTCs for other mechanical information. The busy season for RTC Mech activities was normally mid-December to the end of March.

1.15.7 Source of Bearings Set-off in 1999

A review of 130 cars set off CN trains for hot bearings in 1999 revealed that:

CN advised that the percentage of hot bearings identified by RTC Mechs/HBOs in the above data is higher than usual, and that for 316 set-offs in 1999, 106 (or about 33 per cent) were as a result of judgements made by RTC Mechs/HBOs.

1.16 Examination of Axle Components

The recovered pieces from the failed axle on car CN 604697 were examined (see Appendix E), as well as a wheel set from the non-derailed end of the same car. Damage to the axle pieces in the area of the burn-off precluded detailed examinationFootnote 19.

The mate bearing on the failed axle was examined by sectioning away the cup and cages from the remainder of the bearing. Localized hardening of the metal (brinelling)Footnote 20 was observed on the outboard race of the cup adjacent to secondary impact markings observed on its outer surface. There was noticeably less grease on the inboard cone when compared with that on the outboard cone. The rollers and cages were in good condition. The cones were in good condition apart from some secondary oxidation on the race of the outer cone adjacent to the end cap impact area. The front and rear seals appeared to be in good working order.

The examination of the non-derailed wheel set revealed that both bearings were in good condition. The wheels on both axles were examined and determined to be within specifications. There was no sign of any previous damage to the internal components of the R-3 roller bearing, as might have occurred to this wheel set during the Jasper collision (see section 1.12.2).

1.17 Management and Supervision

1.17.1 Background Information

The work of the RTC Mechs and HBOs was performed by a relatively small number of persons (minimum two per shift) on an "around-the-clock" operation. The work they performed had evolved over the years with the advent of other technological equipment installed at wayside locations, such as automatic equipment identification (AEI) readers, WILDs and cold wheel detectors. They continuously looked for ways to improve their use of the available data to enhance the safety of train operations. The offices where they were located were adjacent to the rail traffic control centre in Edmonton.

The supervisor of the HBOs was located in the same building, allowing for frequent direct supervision of the HBOs. The supervisor of the RTC Mechs was located in another building several miles away from their office.

1.17.2 Responsibilities and Reporting Structure in the Edmonton WIS Office

As the role of the RTC Mechs evolved to include the closer scrutiny of hot box tapes, management became aware that there were problems evident with the interface between the RTC Mechs and the HBOs. There was some discussion on whether or not to have the HBOs report directly to the RTC Mechs. However, this reporting structure was not formalized. With the expanding roles of the RTC Mechs, management questioned the need for maintaining both positions (HBOs and RTC Mechs) and discussions were held to find further efficiencies in this area.

In the year preceding this accident, the union challenged the railway company to maintain the positions of HBOs. In subsequent meetings, the union view was accepted. Due to technological improvements (e.g. Devtronics software), in 1999, the activities pertaining to HBOs and RTC Mechs were downsized and centralized at the Edmonton rail traffic control centre. All WIS (and WILD) data across Canada (except for several stand-alone WIS sites, mainly in Manitoba) were then routed to this location. At this time, there was no further delineation of the reporting structure between the RTC Mechs and the HBOs.

Management for the RTC Mechs believed that its staff was responsible for all aspects of the office in Edmonton, comprising final determination of data, including hot bearing tapes. In contrast, Operations management stated that the HBOs had full autonomy with regard to all applications of TP-105 criteria (dragging equipment and hot bearing detection), and that the RTC Mechs would have complete authority over hot wheel, cold wheel, and WILD sites.

1.17.3 Quality Management

CN's S&C had a Quality Control (QC) Group whose purpose among other things was to perform some of the periodic tests required by the S&C Department. The QC Group did not verify the ongoing quality of installation, maintenance or testing of WIS components. It was left to the discretion of the local S&C supervisor to ensure/enforce/verify that the proper tests were performed. In 1995, CN assembled a Quality Action team to develop "best practices" to ensure the proper calibration of WIS devices on a system-wide basis. The information obtained through the efforts of this team were widely disseminated within the S&C Department.

During its investigation, the TSB examined several configurations (e.g. Servo vs Sentry; paddle vs electronic style of DEDs; with and without HWDs) of WIS on five CN subdivisions across Canada. Differences in procedures, local practices and systems knowledge by S&C personnel were noted as summarized below:

Procedures:

Practices:

Systems Knowledge:

Variability in procedures and practices was noted to result in different output values from site to site for a known input. A TSB review of output tapes generated by a CN TEST car showed that a computer controlled and recorded input heat, resulting in different output values from site to site. Many of the variances were noted to be biased towards over-sensitization of the system (i.e. a condition where a bearing is identified as overheated when its actual bearing temperature is less than the threshold value).

There was no nationwide overview of TEST car data to measure WIS site performance. TEST car operators were only capable of listening for an audible alarm indicating that the alarm threshold was exceeded. They were not given immediate feedback in terms of output from the WIS site.

Discrepancies were noted with the various manuals provided to the different user groups. For example, the TP-105 manual contained information showing the different criteria to be applied for various types of equipment or bearings (such as locomotives, passenger cars, plain bearings); yet, the system did not prompt the operators who were expected to apply these criteria. Some reference manuals specified different criteria when referring to identical items or conditions. Appendix C contains a comparison of selected topics for some of the more common manuals issued to the different user groups.

Some training manuals had not been revised for four to five years, and did not contain information on some of the newer technology on the system, such as the Devtronics software.

The TP-105 manual also described a number of conditions where a tape could be ruled as "faulty"; e.g., a tape that "loses heat on one or both rails is to be considered as a sign of a faulty tape." No mention was made in the manual of what an output tape may look like if a detector was damaged, possibly due to a derailed car, while a train was passing over a WIS site.

1.18 Regulatory Overview

Canadian Rail Operating Rules (CROR) were filed with Transport Canada (TC) for approval as per the requirements of the Railway Safety Act (RSA) by the Railway Association of Canada (RAC) acting on behalf of its member companies. These rules were approved by the Minister of Transport on 16 January 1990 under the authority of the RSA to be used on federally regulated railways and apply to all railway companies under federal jurisdiction. Under the RSA, these rules have the force of regulations.

CROR rules 110 and 111 state (relevant portions quoted):

  1. INSPECTING PASSING TRAINS
  1. When duties and terrain permit, at least two crew members of a standing train and other employees at wayside, must position themselves on the ground on both sides of the track to inspect the condition of the equipment in passing trains. When performing a train inspection, the locomotive engineer will inspect the near side of such train. When a group of wayside employees is present, at least two employees must inspect the passing train.

EXCEPTION: Crew members of passenger trains are exempted from the above requirements except when standing at meeting points in single track territory. However, every effort must be made to stop a train when a dangerous condition is noted.

  1. TRAIN INSPECTION
  1. The train and engine crew must know that equipment in their train is in good order before starting and inspect it whenever they have an opportunity to do so. Equipment added to a train enroute must be examined with extra care to ensure it is in good order.
  2. When crew members are on the rear of a moving train they must inspect, at every opportunity, the track to the rear for evidence of dragging or derailed equipment.
  3. All crew members on a moving train must make frequent inspections of both sides of their train to ensure that it is in order.

Before cabooseless trains began operations in Canada in 1987, the Canadian Transport Commission conducted an extensive study of train operations and included "tests, conducted to evaluate the reliability of the end-of-train unit and associated devices and to evaluate the risks associated with train operation without rear train crew. . . ."Footnote 21 This study resulted in an order (R-41300) issued by the Railway Transport Committee to CN and CPR dated 14 December 1987 requiring that certain safety conditions be adhered to before commencing cabooseless train operations. This order was included in a manual entitled A decision pertaining to cabooseless train operations on Canadian National and Canadian Pacific Railways. This order included 38 clauses CN and CPR had to adhere to in order to operate trains without a caboose. Some of these clauses, relevant to this occurrence, are quoted below:

  • 1.3 No cabooseless train shall be operated for a distance in excess of 60 miles without having passed an operational hot box and dragging equipment detector or without having been inspected on each side of the train by employees referred to in item 1.11Footnote 22, or without having been stopped and inspected.
  • 1.4 Prior to operation of any cabooseless train all gateway hot box and dragging equipment detectors shall be equipped with hot wheel detectors.
  • 1.22 On arrival at crew change points, two members of the inbound crew of a cabooseless train shall respectively position themselves on each side of the track on which that cabooseless train is moving and shall inspect that train while moving outbound for defects and dangerous conditions and shall report by radio any defects or dangerous conditions to the crew of that outbound train upon completion of the inspection.

The RAC conducted a review of order R-41300 in 1994 which listed the instructions that CN and CPR had in place to comply with each of the requirements of the order. Some of the requirements had been implemented, others had been complied with by the issuance of GOIs by the railways, and others had been revoked. GOIs are instructions issued by the railway companies to guide their employees in respect to internal procedures to be followed. They are not submitted or approved by the regulator and can be taken out of the railways' operating manuals without notification to the regulator.

Following this review by the RAC, all aspects of the order were considered to be covered by the railways' internal documents, collective agreements, or were replaced by ministerially approved rules (such as the Railway Freight Car Inspection and Safety Rules, the Railway Freight and Passenger Train Brakes Rules, or the CROR). TC was satisfied with the level of safety indicated by the RAC analysis and revoked order R-41300 on 11 August 1995. Provisions were maintained for inspections at crew change points (provision 1.22 in the original order) and that trains be equipped with an end-of-train information system (provision 1.1 in the original order). There are no minimum regulatory guidelines for the direction of railways pertaining to the installation, inspection, calibration, alarm levels, and quality management of WISs. There is no existing regulatory requirement for any federally regulated railway to be equipped with WISs, or any other wayside inspection system.

TC did not have a program to monitor or audit WISs in order to ensure that they function properly or that they were tested, adjusted/calibrated in such a way to ensure consistent safe operation.Footnote 23 As part of TC's national signals program, some regional TC inspectors monitored some of the WIS sites for obvious signs of damage which could have been caused by an object dragging from a train striking a component of the WIS. The number of such sites to be inspected was at the discretion of each region. The TC inspector was normally accompanied by a railway S&C maintainer, who among other things, took the voltage readings. Some TC inspectors used a form to record their findings which prompted them to verify mostly the appearance of the components, but not to test whether they met pre-approved railway or manufacturer standards.

1.19 Observations of WISs on Some Other Canadian Railways

TSB investigators visited a number of WIS sites across Canada accompanied by railway personnel (WIS sites in Quebec, Ontario and Alberta were included). The railways involved, in addition to CN, were CPR, VIA and Quebec North Shore and Labrador (QNS&L). After reviewing the different WIS installations, it became apparent that there were differences in the manner in which protection against overheated bearings was provided on each railway. There were also many locations in Canada where there was no HBD protection. Some of these subdivisions carried scheduled passenger trains and/or shipments of dangerous goods. Other subdivisions that were equipped with HBDs had them spaced in excess of 25 miles of each other. The tables contained in Appendices D and E show some of these areas, as well as a comparison of some of the different criteria that were noted.

2.0 Analysis

The inspection of the derailed rolling stock, subsequent to the accident, revealed a BOJ at the No. 3 wheel on car CN 604697. The mode of failure of BOJs is well known throughout the railway industry. As the roller bearing at the L-3 location overheated and seized, the axle extruded, causing a reduction in cross-sectional thickness. After sufficient thinning occurred, the overheated axle could no longer support the weight of the loaded car and complete axle fracture ensued. The marks on the track indicate that the location where the truck side of the car dropped to the track as a result of the axle fracture was approximately 200 feet before the WIS at Mile 255.1. The train continued in a derailed state which damaged the HBD at that location as it passed over it. When the train reached the east switch at Neswabin, approximately seven miles later, the main derailment occurred.

The analysis will focus on the roller bearing failure, inspections used to protect against roller bearing failure (both physical and electronic inspections), related management and supervision issues, as well as regulatory overview.

The train crew members' reaction to the information from the WIS at Mile 255.2, near Oba, was influenced by their experience at that same site on their previous trip. (On the evening before the accident, the crew members were stopped by an audible "dragging equipment" alarm, and they had walked the length of their train and had found nothing wrong. Subsequently, the DED was declared out of service, although the talker system continued to deliver messages to passing train crews relating to the DED when activated.)

On the day of the accident, as the train proceeded over the WIS at Oba, the train crew members received a talker message, warning them of "dragging equipment, dragging equipment, multiple alarms, multiple alarms." The hot bearing and hot wheel indications were immediately identified by repetitive and similar audible tones, by system design, as the train was proceeding over the detector. With the information provided, the crew interpreted that the multiple alarms made reference to the dragging equipment component of the WIS site, rather than a variety of problems, including an overheated bearing.

The train crew members believed that there was no dragging equipment on their train, and considered the information received from the WIS to be inaccurate in consideration of:

The train crew members contacted the RTC to inform him that they were stopping due to the WIS alarm as per instructions and to make him aware of their experience with the DED at that same site on the previous trip.

The RTC knew that the DED at that location had been out of service, and the train crew had not reported any prior operating problems since leaving Hornepayne. He offered to contact the HBO office in Edmonton to obtain further advice. Both the train crew and the RTC were unaware that the train had triggered a warm bearing "yellow" indicator on the Devtronics screen at the same part of the train (around the 95th axle) at MacDuff, as this information was not provided to them.

In Edmonton, the company protocol as established by TP-105 (requiring cars with warm bearings to be tracked and subsequent inspections monitored) was not followed. This resulted in employees in Edmonton initially reviewing the data from the site at Oba in isolation, and making decisions without the benefit of the earlier scan at MacDuff, some 13.6 miles previous. Without the benefit of the earlier data, and because the RTC Mech did not identify the WIS output tape as one produced by a scanner damaged by a derailed car, the RTC Mech incorrectly concluded that the tape was faulty. The RTC Mech's decision was accepted because of the perceived line of authority between the RTC Mech and the HBO.

Company training programs did not instruct employees how to identify or recognize a tape indicating a site damaged by a derailed wheel. The operating manual also did not instruct employees how to specifically deal with an abnormal scan at a site subsequent to a warm reading. The graphic examples in the operating manual, showing a similar pattern as the Oba tape identified as defective, only served to reinforce the RTC Mech's initial assessment. An experienced operator may make the possible connection, as the HBO eventually did, that the "faulty" scan beginning at the same part of the train where the warm bearing was previously identified may be two related events of a safety problem.

2.1 Roller Bearing

The nature of the failure that led to the overheating of the roller bearing could not be determined due to the amount of damage. The weight of the loaded car was within allowable limits, and the load was equally distributed over the length of the car body. Therefore, the axle load would have been equally shared and is not considered to have contributed to the overheat condition.

The wheel had travelled less than half the number of miles expected for a requalified roller bearing to travel before requiring replacement. Therefore, the number of miles travelled by the wheel set was not considered to be a significant risk factor.

The condition of the car as examined after the accident (e.g. no grease on the floor underframe area immediately above the roller bearing location) indicates that there were no obvious signs of the car having had a bearing problem that should have been identified during safety inspections or wayside inspections performed by employees while the car was en route. This was further supported by the successful safety inspections of the roller bearing at numerous WIS sites between the origin of the car in Prince George and Neswabin.

The investigation did not determine what effect, if any, the prior collision at Jasper might have had on the performance of the L-3 bearing from car CN 604697. It is possible, although unlikely, that the bearing experienced collision damage in Jasper that precipitated its subsequent failure given the following:

2.2 Inspections

2.2.1 Electronic Monitoring

Axle failure and subsequent derailment may occur if developing problems on axle bearings go undetected. Electronic monitoring, by either wayside or on-board journal bearing detection devices, can reduce the risk of catastrophic axle failure due to unsatisfactory bearing performance. However, there is equipment operating in Canada that cannot be reliably monitored electronically by wayside scanners. It was noted that:

Experience has shown that the design of passenger and locomotive roller journal bearings, combined with their relatively frequent inspection schedules, serves to reduce the incidence of bearing failure. Although the railway's detector networks have detected overheated roller journal bearings on both passenger cars and locomotives, the system is designed to give an optimal scan for conventional freight car trucks. In other words, the variety of bearing designs and housings affects the results of the heat scan, with some bearings reflecting values much less than actual, and even nil readings. The safety of train movements is dependent on consistent and accurate scanning of all actual bearing temperatures. As the WIS cannot reliably scan all varieties of bearings in use, it cannot be considered a reliable defence to assess all adverse bearing conditions.

2.2.2 Physical Inspections

In areas where no electronic monitoring is available, physical inspections are relied upon to detect defective bearings before they result in complete axle failure. While there is no need to elaborate on the merits of inspections by certified car inspectors, the ability to fulfill this goal is limited by several factors:

2.2.3 Tempilstik

Because train crews have relatively little technical expertise in the identification of distressed bearings, they frequently have to make judgements outside their area of expertise. Unless the identified condition is somewhat obvious, this task can be challenging, even to a person with more in-depth mechanical knowledge. As a result, CN train crews are normally provided with an AAR-approved tempilstik as the tool to use to help them determine whether a bearing is overheating. Such an instrument does not seem well suited to the task. Frequently, train crews are advised that the car which must be inspected is a significant distance away (behind the locomotives), sometimes more than one mile. Receiving an alarm, bringing the train to a stop, verifying with the RTC the car in their consist which has to be inspected, and donning the proper clothing to perform the task in winter months take time. The time interval may allow a bearing in the early stages of distress to cool below the temperature required to melt the tempilstik before a crew member has a chance to inspect it, thereby increasing the risk of missing detection.

In sub-zero temperatures, the task of identifying an overheating bearing with a tempilstik becomes even more difficult. For example, because the CN HBD system is designed to detect a bearing that is running 180°F or more above ambient, if the ambient temperature is minus 40°F, a bearing will exceed the alarm threshold if it is running at 140°F or warmer. A crew member will be unable to identify a bearing operating at 140°F as overheated when using a tempilstik which only melts at 200°F. This may explain why, frequently, train crew members find no defects when stopped for a possible hot box inspection.

In consideration of the above, a train crew member performing an inspection for possible bearing distress cannot reliably identify a developing problem due to the tools, ambient temperatures, and time factors involved. In addition, wayside inspections by employees and static inspections by car inspectors in train yards cannot reliably detect or predict bearing failure. Finally, inspection of stationary cars by certified car inspectors in train yards is not likely to identify a roller bearing that is going to fail because most of the bearing parts are internal and not visible. Many places in Canada rely mainly on these type of inspections to identify roller bearing defects.

2.3 Wayside Inspection System (WIS)

2.3.1 General

The CN WIS includes three lines of defence associated with the identification of, and protection against, bearing failures. The first is the advance warning alarm (AWA) in the field. The second is an operator using the lower TP-105 criteria to screen out hot boxes (advising the train crews through the RTC). The third line of defence is the earlier detection of potential failing bearings by identifying warm boxes at an even lower criterion.

The first two defences are related to safety, while the third defence is related to both safety and company efficiency. With CN, the first line of defence is more stringent than on other railway companies. The second and third lines of defence provide additional levels of protection which most other railways do not have. By comparison to other Class 1 railways, CN has designed a well-defended system (i.e. with multiple levels of defence). However, as with any complicated safety system, a thorough review can reveal deficiencies and opportunities for improvement with the components of the system and the procedures and practices of the people who use them. The TSB investigation, although not an exhaustive technical review, has identified several items pertaining to WIS testing that appear to warrant further attention.

2.3.2 Monthly Testing

Monthly testing of the WIS at CN and some other Canadian railways was performed using a function simulator. By electronically simulating a passing train with bearings at a preset temperature, the ability of the system to accurately read a known input temperature was tested. The temperature setting used in the function simulator test procedure was 135°F above ambient. However, the WIS alarm threshold temperature setting was 180°F above ambient. Therefore, because the monthly test was not conducted at the actual alarm threshold, the test was verifying that the scanner was correctly reading at the test temperature. However, it was not verifying that the AWA and "talker" would activate at the minimum critical bearing temperatures.

2.3.3 Dynamic Testing

CN is the only federally regulated Canadian railway known to have a car capable of dynamically testing the HBD component of its WIS sites. It only had one car that was so equipped, and because of its busy schedule, it could not regularly test all CN WIS sites. WIS sites in eastern Canada were not dynamically tested for several years because this car was based in western Canada. Also, because the speed of the TEST train is limited to maximum freight speed, typically 60 mph, the dynamic testing in some places is conducted at less than maximum operating speeds (e.g. the heavily used Kingston Subdivision with daily 95 to 100 mph passenger trains). CN relied on the HBD manufacturers to measure the response of scanners to speed in a laboratory environment, and to build the equipment to respond to these specifications. However, dynamically testing the operation of the WIS in its actual environment at speeds much less than the maximum track speed does not ensure that the alarm system will operate as intended at those elevated speeds.

No federally regulated Canadian railway is presently dynamically testing HWDs and DEDs which, together with HBDs, are essential components of a sophisticated wayside inspection safety system.

Although the railway matched the TEST car process to the design of the primary type of traffic (i.e. freight car bearings), this affords little protection to those railway operations that are not covered by these parameters.

2.4 Management/Supervision

2.4.1 Roles and Responsibilities in the WIS Office

Due to the pioneering efforts associated with the small number of personnel who work in the field of monitoring "hot bearing" and "hot wheel" conditions, management has typically allowed those employees to operate in a "hands-off" learning and experiential environment. This lack of direct involvement in day-to-day activities has allowed employees to come up with many safety improvements in the use of the technology. However, there have been some negative effects from this indirect style of supervision.

The RTC Mech positions were management level positions and frequently RTC Mechs exercised discretion as to the application of TP-105 criteria (e.g. when or how cars identified by the system would be handled). The roles and responsibilities of the RTC Mechs evolved from a focus on hot wheel tapes to a more global approach involving examination of hot bearing tapes, when warranted. By examining both the hot wheel and the hot bearing detector tapes, the RTC Mechs believed that they were in a position to "overrule" the HBO if they felt that the readings reflected a "sticking brake" as opposed to a bearing failure. As part of management, the RTC Mechs felt empowered to exercise their discretion with regards to TP-105 criteria.

The HBO positions allowed them no flexibility to adapt company policy; therefore, some frustration was created by the different methods of responding to cars with similar stimuli. The overruling of the HBO decisions by the RTC Mech tended to erode the clear distinction of responsibilities assigned to the HBO by management. With time, the perception of both the RTC Mechs and the HBOs was that the RTC Mechs had the final authority on office matters, given the fact that they were management and that they had the ability to "overrule" the HBOs.

The differences of opinion between HBOs and RTC Mechs and perspective on their roles and responsibilities had led to previous conflicts, and there was some residual tension between certain members of the two groups subsequent to the reorganization and related arbitration case. While there had been some discussion by management regarding having the HBOs report directly to the RTC Mechs, this was never formally implemented. Conflicting views were espoused by both Mechanical and Operations management regarding responsibilities of the WIS office personnel.

There were instructions for the HBOs and the RTC Mechs to discuss any circumstances where hot wheels and hot bearings did not meet TP-105 criteria and either felt a train stop was necessary. However, no clear procedure was in place as to who had the final authority, or how to resolve potential conflict. Given the perceptions of the office personnel, the final decision would go to the RTC Mech.

In this occurrence, when the RTC Mech declared that there was a faulty tape, the HBO accepted his decision allowing the train to proceed, even though he was not certain that this was the appropriate action. It was not until the train was allowed to proceed that the tape from the previous WIS site (MacDuff) was checked. Once a link was made between the readings of the two sites, the HBO began to look for confirmation of his suspicions by contacting others. Rather than speaking with his direct supervisor to resolve his concerns, the HBO made numerous calls to the RTC and the S&C personnel in Toronto hoping to obtain verification of his concerns regarding the status of the train. It was during one of these exchanges that the train went into emergency.

Misconceptions between the two key users of the WIS data (HBO and RTC Mech) about their specific responsibilities and lines of authority, combined with communication difficulties, precluded a highly cooperative analytical environment. This resulted in the train not being stopped once the HBO realized that it was possible that the WIS indications reflected a safety problem. This occurred despite the fact that both the HBD and DED had correctly indicated that something was wrong.

2.4.2 Systems Knowledge

In order for a distributed system, such as the WIS, to operate effectively, the various components must be properly integrated. For employees, this involves ensuring that each has an adequate systems knowledge to understand the effect of their decisions and actions on other components of the system.

Some of the employees interviewed received little formal training and did not clearly understand their responsibilities. Employees in charge of reviewing safety critical information, such as the integrity of wheels and bearings on a passenger train, need to clearly understand what they are monitoring and clearly know what their authority is if they notice a problem (e.g. order a train to stop immediately). In this accident, the experienced HBO was not comfortable that everything was normal with the train; however, he did not feel that he had the authority to stop the train and advise the crew members to inspect their equipment. Management's protocol did not clearly state that anything less than an acceptable scan should be cause for a precautionary mode of operation, even if the train crew members were to be informed as to the possible existence of a defective condition on their train. It is unknown whether the decision reached by the crew (to continue without inspecting their train) would have been different had the HBO called the train crew, rather than the other way around, and informed the crew of the information he had from the last two WIS sites.

Other examples of key people not having a good understanding of the overall system were in the area of the computer software (e.g. the algorithm calculations that the Devtronics software performs on a scanned train). The codes for W2 and W3 alarms were not well understood by some of the operators; yet, these warning alarms were meant to initiate a safety monitoring response from the RTC Mechs and HBOs. Without a good understanding of the basis for these alarms, some of these primary users were not able to properly analyze the information provided by the system.

In essence, the HBOs were taking the time to examine these tapes with the intent of finding a high deflection, when in fact they never would. The value of these tapes was in the ability to identify a potentially warm or hot bearing amidst a very low overall detector reading. Their normal reaction was to respond to TP-105 criteria for maximum values or differentials. This way of working did not take into account the ability of the computer software to highlight a car with possible developing problems, regardless of whether the field equipment was calibrated correctly or not. Responding to safety messages in this manner nullified some of the sophisticated safety features built into the system. Other users of the Devtronics software use the algorithms to directly advise the train crews of potential hot boxes, rather than use the data to determine whether an HBO should examine a train chart for defects.

The differing levels of employee awareness of company protocol and systems knowledge (regarding the WIS) demonstrate that either some employees did not understand their roles and responsibilities, or the method used to train and ensure retention was inadequate.

2.4.3 Workload

As stated earlier, the CN WIS included three lines of defence associated with the identification of, and protection against, bearing failures. The first two lines of defence each identified hot boxes, and involved a message being communicated to the train crew (either by the RTC, or the talker of the AWA). The third line of defence was the real-time trend monitoring by the HBOs in Edmonton, who were to identify and track warm boxes at a lower criterion leading to the earlier detection of potential failing bearings. This latter defence, which results in the application of stricter WIS criteria than other railways, has increased safety potential but can be labour-intensive.

The set-up of the system required the HBOs and RTC Mechs to perform a number of manual tasks dependent on differing criteria that the operators had to track mentally. This added to their workload and was subject to potential operator error. The computer software as installed did not assist them in identifying key information, such as the number of the rolling stock involved, the train, the location of the next HBD site in the direction of travel, and the information from the previous HBD site. Keeping track of this information mentally may have been possible when the WIS sites were distributed in multiple offices (lower number of sites). The centralization of monitoring increased the number of WIS sites from 100 to 200 in the Western region, then added in nearly 200 more sites from Toronto and Montréal. This became a daunting task to monitor during periods of peak activity, particularly when train routings and track layouts were unfamiliar to the operators (e.g. a train leaving one subdivision to go to another subdivision before reaching the end of the first one). This could be further exacerbated when some sites generated more alarms because their calibration was over-sensitive.

Given the workload associated with the HBOs' tasks and the need for the HBOs to prioritize activities, the HBOs adapted their task to the changes in workload by focussing on the second line of defence items (those bearings identified as hot by TP-105 criteria), even though the lower-level readings are an integral part of the third line of defence. Automation of the real-time trending process in the future could assist in making even better use of these data.

The amalgamation of the monitoring for all WIS sites into one office, combined with the number of non-automated computer tasks, made it difficult for HBOs/RTC Mechs to follow all TP-105 requirements. Without following the TP-105 requirement, the potential for early detection of distressed bearings was reduced.

2.4.4 Impact of Variable Output on Workload

Variances in the acceptable output of each WIS lowered the quality of the data and, thereby, the safety afforded by the system. Although the HBOs were required to track cars identified with early indications of overheating bearings over several sites, their efforts were sometimes hampered by the quality of the data from the system.

Variable outputs made comparative analysis from site to site difficult. When the output from site to site for a constant input was varied, an operator's ability to make meaningful use of the WIS data and make informed decisions about whether a bearing was warming up or cooling down was diminished.

Outputs from WIS sites that were over-sensitive led to an increase in workload of HBOs, and increased the false alarm rate. This also affected user confidence in the overall system, and prompted users of the data to consider that the system was faulty, rather than the train. The rate of false alarms within the system and a lack of meaningful feedback that field repairs actually corrected the original problem contributed to the maintenance practice of allowing four trains to operate over a site before certifying the WIS site as repaired. While, on the surface, testing the proper functioning of the WIS in this manner appears practical, this method is subject to error.

The repair validation objectives (see Figure 23) should actually be to ensure that trains which are defective generate an alarm by the WIS (box C), and trains which are not defective do not (box B). Coupled with this is the need to minimize two types of error--the error associated with a non-defective bearing generating an alarm (false positive, box D) and the error associated with a defective bearing not generating an alarm (false negative, box A).

The validation scheme employed at the time of the occurrence (see Figure 24), testing for the absence of alarms, does not ensure that a defective bearing will in fact trigger an alarm (box A). While the probability is relatively low, it does leave the system vulnerable to allowing a train with a defect properly identified by the WIS from being stopped while validation is being performed (box C). Should one of the four trains initiate an alarm, the test would be treated as a failure and the WIS would be identified as requiring further repairs by an S&C technician. Furthermore, validating a WIS site after repairs have been performed based on the absence of alarms does not ensure that a true alarm state will be detected.

Figure 23. Desired validation objectives
Desired validation objectives
Figure 24. Actual validation results
Actual validation results

2.4.5 Tape Interpretation

The impact of not tracking trains which meet warm box criteria over the previous and next WIS sites in accordance with CN TP-105 protocol is that a WIS tape may be judged "faulty" when examined in isolation and that a developing bearing problem may not be proactively identified.

The unusual spikes on the accident-related WIS tape made it immediately evident that there was a problem, either with the WIS or the train. On its own, the loss of heat on one rail subsequent to the 95th axle might suggest that a "faulty" tape had been transmitted. When this information is examined, in combination with the tape generated as the train passed over the previous site at MacDuff (which showed that there was a warm bearing at the 95th axle), one might conclude that something catastrophic occurred at the 95th axle. In fact, subsequent to the initial determination of a "faulty" tape, the HBO examined the WIS tape from the previous site (MacDuff), and recalling a similar event from the past, he suspected that the train had derailed and damaged the HBD at Oba. The HBO was unable to convey his concerns in time to reduce the impact of the derailment.

Because the HBO and the RTC Mech did not initially use all the information available to them and did not work collaboratively to exchange critical pieces of information, the safest course of action (to stop and inspect the train) was not taken.

2.4.6 Quality Management

Although management had some elements of a quality assurance program, the program was largely in place in theory only and delivered in practice mainly within the S&C Department. The program did not oversee that the entire safety systems were functioning as designed. Management and supervision did not coordinate with all parties involved (Transportation, Equipment and Engineering) to provide a systems approach to quality management. Although the number of axle failures due to BOJs is relatively low, the adverse consequences of such occurrences warrant serious attention.

Communication failures were noted between some of the key people involved (e.g. the RTC Mech and the HBO). Written materials provided to the employees within the Signals Group were noted to be inconsistent with local instructions to their field staff, typically in the form of e-mails (e.g. different acceptable limits for the maximum and minimum values for test tapes, and the number of degrees above ambient heat for the input when calibrating the system). Variances in procedures, practices, and systems knowledge in both the field and office activities are indicative of an inconsistent application of a quality management program.

Without a comprehensive quality management program in place, inconsistencies were introduced into the HBD system which created system performance variances and made comparative analysis of the WIS data from site to site difficult.

2.5 Regulatory Overview

TC inspectors are required to fulfill the goal of the Railway Safety Act, which is An Act to ensure the safe operation of railways and to amend certain other Acts in consequence thereof.

In achieving this goal, the Rail Safety Directorate has a number of regulatory programs that the regional inspectors are required to deliver, but the regional inspection programs do not include a formal WIS inspection program. Although TC inspectors visit some WIS sites and complete an inspection form to note deficiencies which they then submit to the railway for corrective action, these inspections are not required in a documented regulatory program. The form contains the items that an inspector should inspect while on site. Most of the items are cosmetic in nature (such as paint on the apparatus, cleanliness of mirrors). Without regulatory requirements, the inspectors are limited in what items they inspect during visits at WIS sites.

Although there are rules to ensure that some types of inspections are performed on a train while en route, these are performed by employees infrequently (when passing other trains and performing running inspections of their own train) and these types of inspections would only likely reveal a very advanced condition. A visual inspection from the ground of a passing train would rarely reveal a developing problem with a bearing if that problem had not yet significantly progressed, and an inspection performed by a crew member from a locomotive while the train was running would only reveal problems which display significant visual signs (which would mean the defect was already at an advanced state).

With the RAC review of order R-41300 and with TC adhering to the federal government's deregulatory approach, the order was revoked as the review demonstrated that both CN and CPR had provisions in place to comply with the order. It is important to note that order R-41300 only applied to CN and CPR and no other railway was ever legally required to comply with it. Compliance with order R-41300 by other railways was encouraged by TC and the RAC, as it was considered a "best practice" approach to operating cabooseless trains. When TC revoked the order, it relied in part on the railways' instructions at the time of revocation to ensure and maintain the level of safety provided by order R-41300.

In accordance with federal regulatory requirements, railway companies do not have to request permission from, nor advise, TC when they wish to modify or remove an instruction from their set of operating procedures. In revoking order R-41300, TC removed the only regulatory reference to hot box and dragging equipment detectors and the maximum distance between inspections while the trains are en route (clause 1.3 of order R-41300 which stated 60 miles). Presently, railway companies can operate trains for significant distances without effective inspections which would provide reliable early detection of developing bearing problems.

It is acknowledged that most railways have installed WISs to enhance the safety of their operations. However, TC does not have regulatory requirements for such systems to be installed, or for minimum distances between WIS sites. TC has not provided requirements or guidelines for the method of installation, inspection, calibration, alarm levels and some system to ensure the correct functioning of such technologies. These provisions are left to the railway companies in conjunction with the manufacturers of the technology and have resulted in the variety of installations and operations identified in this investigation.

3.0 Findings

3.1 Findings as to Causes and Contributing Factors

  1. The roller bearing at the L-3 location on the south side of car CN 604697 overheated and seized, resulting in a burnt-off axle journal and the derailment of 21 cars.
  2. The definition of "faulty tape" allowed rail traffic control mechanical service representatives (RTC Mechs) and hot box operators (HBOs) to disregard scans which met or exceeded TP-105 criteria. They believed that the information on the tape did not represent actual train conditions. This resulted in a train with a defect being allowed to proceed.
  3. Unclear lines of authority and communication difficulties precluded a highly cooperative analytical environment. This resulted in the train not being stopped once the HBO realized that it was possible that the Wayside Inspection System (WIS) indications reflected a safety problem.
  4. The train crew members did not perform a walking inspection of their stationary train after having been provided with multiple audible alarms of possible defective conditions; therefore, they did not detect the single derailed car at the Oba location, missing an opportunity to greatly reduce the consequences of the overheated roller bearing.
  5. Company procedures (TP-105) regarding the monitoring of the bearings identified as "warm" subsequent to the scan at MacDuff located 13.6 miles before the WIS at Oba were not followed. This resulted in the information from the Oba site being interpreted in isolation.

3.2 Findings as to Risk

  1. A train crew member performing an inspection for possible bearing distress, after having been stopped by a WIS, may not reliably identify a developing problem due to the tools, ambient temperature and time factors involved in performing the inspection. Therefore, a defective bearing may go undetected and remain in service.
  2. Other types of physical inspections performed by train crews either from the locomotive or on the ground observing a passing train, or pull-by inspections by wayside employees and car inspectors in train yards, cannot reliably detect a bearing failure or identify a developing bearing failure.
  3. Safety inspections of stationary cars by certified car inspectors in train yards cannot ensure the future condition of the bearing from origin to destination, and railways can operate trains for significant distances after performing such inspections.
  4. There are subdivisions not equipped with WISs where railways rely on physical inspections (i.e. safety inspections, wayside inspections, passing trains, and train crews) to ensure the safe mechanical condition of the bearings on their trains.
  5. Because journal bearings on some types of equipment are not accurately scanned by wayside hot box detectors (HBDs), and since most equipment including some used on high-speed passenger trains do not have on-board journal bearing heat detection, axle failure and subsequent derailment may occur when developing problems on bearings go undetected.
  6. Monthly testing of the HBDs and hot wheel detectors (HWDs) at Canadian National (CN) and some other Canadian railways is not performed at the alarm threshold levels; therefore, it is not known if the alarm system will activate at the minimum threshold levels.
  7. CN had one TEST car that was capable of dynamically testing the HBDs and it had not travelled in eastern Canada for a period of over three years. The car did not dynamically test HWDs or dragging equipment detectors (DEDs). No Canadian railway other than CN is known to be dynamically testing its WIS sites.
  8. CN dynamically tested its HBDs at speeds typically no greater than 60 mph; therefore, it is not known if the alarm system will activate as intended at maximum passenger train speeds.
  9. The number of WIS sites to be monitored, combined with the task-intensive and memory-reliant nature of the HBO's duties, made it difficult for the HBO to follow all TP-105 tracking requirements, reducing the potential for early detection of distressed bearings.
  10. Communication failures between key users of the system, combined with differences in procedures, practices and systems knowledge, indicate that there was no consistent systems approach to quality management for the WIS safety devices.
  11. There is currently no regulatory requirement for a railway company to have safety devices such as the WIS in place despite the risks that may exist in its railway operations (e.g. high-speed passenger travel and dangerous goods).
  12. There are no minimum regulatory guidelines for the direction of railways pertaining to installation, inspection, calibration, alarm levels, and quality management of the WIS.
  13. Transport Canada has no national program to audit and monitor WISs, to ensure the safety of operating trains as it relates to failing bearings, wheels, and dragging equipment while travelling on territories equipped with WISs.

4.0 Safety Action

4.1 Action Taken

4.1.1 WIS Improvements

Subsequent to the accident, a large number of safety initiatives were undertaken by Canadian National (CN) to address the safety deficiencies identified in the areas of reference manuals, work procedures, job aids, and supervision relating to the activities of the rail traffic control mechanical service representatives (RTC Mechs) and hot box operators (HBOs) as follows:

CN has dedicated considerable capital and operating funds to the further expansion of its hot box detector (HBD) network. Main route HBD spacings continue to be reduced. Further, in April 2000, CN lowered the "alarm" threshold for TP-105 hot alarms on 20 branchline subdivisions that have HBDs spaced 40 miles apart or more.

4.1.2 Regulatory Action

Transport Canada (TC) has issued a guideline with respect to the recently amended Section 11 of the Railway Safety Act (RSA) relating to engineering works. The intent of the guideline is to clarify for all parties what is required by Section 11 of the amended RSA. A multi-party committee, including representatives of the railway industry, consulting engineers, governments, utilities, and professional engineering associations, developed this guideline. It is incumbent upon each railway to ensure that, for all equipment used on their tracks, including WISs, they have the proper documentation to support the variety of equipment and that the employees are properly trained for inspecting and maintaining the equipment. TC is moving towards monitoring the railway companies for compliance to Section 11 of the RSA.

4.2 Action Required

As an ongoing safety initiative, CN has developed a unique real-time trend monitoring system which incorporates continuous learning into the process. The system would be enhanced if it included a more comprehensive form of quality management so that, as new opportunities are realized within the system, the appropriate procedures are put in place, the associated training is provided, and best work practices are adopted.

During this investigation, a number of issues emerged which, if addressed, may enhance both the efficiency and safety afforded by the existing system. CN may wish to give consideration to:

4.3 Safety Concern

It is recognized that the majority of railway operations in Canada are monitored by advanced technological means, such as WISs, and that the railways continue to make significant monetary investments to improve their existing systems. However, there still are subdivisions where WISs are installed at intervals in excess of 25 miles, thereby reducing the probability that distressed axle journal bearings will be detected before failure. There are also locations where axle bearing temperatures on passenger trains and/or shipments of dangerous goods are not monitored by WISs at all. Notwithstanding the foregoing, some equipment by its design is ill-suited for bearing temperature detection by WISs, irrespective of the detector spacing. Although axle failures are rare, there can be severe adverse consequences associated with such an event resulting in a risk to persons, property, and the environment. The Board is concerned that, without an industry standard that will detail the frequency and adequacy of roller bearing inspections, there may be less-than-adequate protection against the catastrophic failure of railway axles in some operational settings.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on .

Appendices

Appendix A— Examination of Tank Cars Involved in Fire

Three of the tank cars involved in the post-derailment fire arrived at Procor in Sarnia, Ontario, on Wednesday, 30 March 1999. On Tuesday, 06 April 1999, the cars were examined by TSB personnel in Canadian National's Sarnia Yard and the following was noted:

Car CN 668016 (an 89-foot flat car) loaded with tank car AGEX 1001:

Tank car damage:

Car CN 668189 loaded with tank car PROX 41841:

Tank car damage:

Car CN 639954 loaded with tank car ACFX 71216:

Tank car damage:

Appendix B— General Roller Bearing Information

Roller bearings are pressed onto the ends of railway axles outside of the wheel plate area. There are typically eight roller bearings per car, one on each end of the four axles. Roller bearings are of a tapered design and support the weight of the rail car and its contents on the rail. The bearing is positioned within a pedestal jaw of a truck side frame. The moving parts of the roller bearing allow the solid wheel/axle combination to which it is attached to rotate with little friction.

The Association of American Railroads (AAR) requires new roller bearings to be built with an L10 lifeFootnote 24 of 1,000,000 miles. Bearing manufacturers typically warrant their new bearings from an initial application to between 500,000 and 600,000 miles. Roller bearings are requalified at AAR-certified wheel shops during their life. As a wheel profile either wears out or experiences some type of defect every 200,000 to 300,000 miles, the roller bearings are inspected and can be requalified and returned to service several times before their internal parts are no longer serviceable. Disregarding special or severe service applications, it is not uncommon for a roller bearing to last 15 years without service problems, and 30 years when spanning multiple axle applications.

Roller bearings typically run at a temperature of 40°F above ambient during the winter, and 60°F above ambient during the summer (120°F to 160°F absolute). Bearings on many locomotives typically run 20°F hotter, mainly due to truck design. Standard freight and passenger locomotives often use either Class GG tapered roller bearings or Hyatt cylindrical roller bearings. These bearings are specially designed for locomotive use and incorporate high load-rated components due to the additional forces involved.

A steady state temperature in excess of 160°F is considered to reduce the overall life of a bearing due to grease degradation. Continuous operation at high temperatures over 200°F reportedly causes premature aging of the rubber sealing elements, and oxidation of the lubricant; at 240°F, grease breakdown and seal elastomer degradation occurs. In general, the life of a bearing will be diminished with increased operating temperature. This is due to the reduction in oil viscosity, and consequently, the reduction in film strength of the lubricant.

Conversely, severe cold can delay the ability of a bearing to reach the operating temperature. Some greases can become stiff at sub-zero temperatures, to the point that the grease does not migrate through the bearing and provide critical initial lubrication. Depending on the mechanical properties of the grease, the minimum temperature recommended for bearing startup by roller bearing manufacturers is approximately minus 40°F.

Two of the major roller bearing manufacturers were asked to provide the recommended temperature settings at which they would want their bearings identified by a hot box detector (HBD) as overheating. One stated 195°F absolute, while the other stated 180°F to 190°F absolute.

Appendix C— Comparison of Various Reference Manuals Relating to the WIS

Source Date Text Rolling Stock Type Maximum Absolute Maximum Differential
TP-105 1993 Hot Bearing Criteria Locomotives 15 mm 7 mm
Passenger Cars 15 mm not calculated
Roller Bearings 15 mm 8 mm
Plain Bearings 8 mm 4 mm
Warm Bearing Criteria Locomotives 12 mm 5 mm
Passenger Cars 12 mm not calculated
Roller Bearings 12 mm 6 mm
Plain Bearings 6 mm 2.5 mm
WIS Manual
(Servo)
May 1995
pages 2 to 30
Advance
Warning
Alarm
Roller Bearings 17 mm 10 mm
Plain Bearings 11 mm 9 mm
Devtronics Hot Bearing Roller Bearings 15 mm 10 mmFootnote 25
Plain Bearings 15 mm 10 mm
Warm Bearing Roller Bearings 12 mm 6 mm
Plain Bearings 12 mm 6 mm
Internal S&C
Directive
October 1998 Hot Bearing Roller Bearings 15 mm 8 mm
Warm Bearing Roller Bearings 12 mm 6 mm
WIS Manual
(Servo)
May 1995
pages 7 to 22
HBD
Calibration
Values
Temperature of function
simulator__130°F +/− 3°F
Should
produce
desired output
of 12 mm
S&C WIS
Manual
May 1995
pages 5 to 10
HBD
Calibration
Values
Set the function simulator to
135°F above ambient
Heat received
on both rails
should be
10 mm to
12 mm

Appendix D— Examples of Subdivisions with Passenger Train Service and HBD Spacing Exceeding 25 Miles

Note: Subdivisions shown do not all belong to CN

Province Subdivision Spacings in
Excess of
25 Miles
Total
HBDs
Total Miles Passenger
Service
Nova Scotia and
New Brunswick
Bedford and Springhill 2 HBDs spaced
31.8 and 29 miles
apart
7 190 6 days a week
Quebec Wacouna and Northern
Land - Quebec North
Shore and Labrador
(QNS&L)
4 spaced 30 miles
apart
10 260.8 twice weekly
Menehek - QNS&L not applicable No HBDs 135.2 once a week
La Tuque 2 HBDs for
125 miles
2 125.4 6 days a week
Saint-Maurice 4 HBDs for
256 miles
4 256 6 days a week
Lac-Saint-Jean 4 HBDs for
201 miles
4 201 6 days a week
Mont-Joli - Chemin de
fer de la Matapédia et
du Golfe (CFMG)
not applicable No HBDs 188.8 6 days a week
Chandler and
Cascapédia -
Corporation des
Chemins de fer de la
Gaspésie (CCFG) and
Chemin de fer Baie des
Chaleurs (CFBC)
not applicable No HBDs 130 4 days a week
Drummondville 2 HBDs (one
26.4 miles and
one 25.5 miles
apart)
5 125.1 numerous high-speed trains daily
Kingston 5 HBDs spaced
between 25 and
30 miles between
Coteau and
Kingston
15 333.8 numerous high-speed trains daily
Ontario Chatham 1 HBD for
70.5 miles and 1
for 28 miles
1 70.5 daily service
Newmarket 1 HBD located
near Trout Creek
1 233.4 commuter service between Toronto and Bradford
Uxbridge not applicable No HBDs 20 commuter service
Brockville - Canadian
Pacific Railway (CPR)
not applicable No HBDs 27 daily LRC service
Guelph - Goderich &
Exeter Railway (GEXR)
1 spaced
46.3 miles apart
3 89.9 daily LRC service
Manitoba Rivers 3 spaced 28.9,
28.9 and 26.8 miles apart
14 280.3 6 days a week
Watrous 4 HBDs (spaced
between 26.9
and 27.8 miles
apart)
11 247.3 6 days a week
Gladstone 2 HBDs (one 27.4
and one
59.0 miles apart)
3 121.7 6 days a week
Togo 2 HBDs (one 28.9
and one
58.9 miles apart)
3 124.9 6 days a week
Assiniboine not applicable No HBDs 92.2 6 days a week
Turnberry not applicable No HBDs 83.4 6 days a week
Wekusko - Hudson Bay
Railway (HBR)
not applicable No HBDs 136.4 6 days a week
Thicket - HBR not applicable No HBDs 189.7 6 days a week
Herchmer - HBR not applicable No HBDs 175.7 6 days a week
Flin Flon - HBR not applicable No HBDs 87.3 4 days a week
Sherridon - HBR not applicable No HBDs 184.8 4 days a week
Alberta/
Saskatchewan
Wainwright 5 HBDs (4
spaced 29.4 and
29.6 miles apart)
10 266.3 6 days a week
British Columbia Fraser all greater than
25 miles apart
5 146.1 6 days a week
Nechako 1 spaced
27.2 miles apart
5 115.4 6 days a week
Telkwa 1 spaced
27.3 miles apart
4 125.2 6 days a week
Bulkley 2 HBDs spaced
27.1 miles apart
5 131.9 6 days a week
Skeena 2 HBDs spaced
28.9 and
29.3 miles apart
3 94.6 6 days a week
Mountain - CPR 1 spaced
25.1 miles apart
6 125.7 6 days a week
Cascade - CPR 1 spaced
25.2 miles apart
5 124.1 6 days a week
New Westminster -
Burlington Northern
Santa Fe Corporation
(BNSF)
not applicable No HBDs 35.7 daily service

Other areas of interest are the mileages between the last HBD on one subdivision, and the first HBD on the next subdivision. In some places, these distances also exceed 25 miles and there are no longer any train stops for the passenger trains at the station separating the two subdivisions. In other areas, passenger trains operate over portions of several subdivisions and can travel considerable distances before being inspected by an HBD; e.g., VIA Rail Canada Inc. and the Great Canadian Railway Company (Rocky Mountaineer) operate over portions of subdivisions on three different railways as they depart the Vancouver area travelling eastward. These trains travel a distance of 30.7 miles between HBD inspections.

Appendix E— Observations of WIS Equipment on Other Railways

To acquire a better understanding of Canadian National's (CN) Wayside Inspection System (WIS) as compared to other railway installations, a brief review was made of WIS equipment on Canadian Pacific Railway (CPR), Quebec North Shore and Labrador (QNS&L), and VIA Rail Canada Inc. (VIA), which included site visits in Quebec, Ontario, and Alberta. As a result of these visits, the following observations were made:

CPR

QNS&L

VIA

As a result of the differences noted with the different Canadian railway systems (i.e. the hardware used, and how it is set up, maintained and tested), the TSB review was extended to some of the other major Class 1 carriers in the U.S. (Burlington Northern Santa Fe Corporation (BNSF), Union Pacific/Southern Pacific (UPSP), CSX Corporation (CSX)). The following table shows the results of the TSB observations, and highlights some of the differences noted with the various installations of WISs.

The railways have similar operating environments (allowances made for passenger or freight service, or extreme differences in gross ton-miles, etc.). Each railway designs its HBD system to protect against the same problem (i.e. complete axle failure); however, as can be seen from the data in the following table, the manner in which each does so differs.

Other Class 1 Railways (U.S. and Canada) Class 1 - A Class 1 - B Class 1 - C Class 1 - D CN
Typical Spacings on Core Routes 20 miles +/- 5 miles 20 miles 25 miles 25-30 miles 15-20 miles
Basic Set-up Stand Alone Stand Alone and Central Monitoring Stand Alone Stand Alone Stand Alone and Central Monitoring
Alarm Criteria: - HBD Absolute (Above Ambient) Differential
Car/Car Side
(Ratio) HWD (Above Ambient)


180°F

120°F

1.60

650°F


180°F

117°F

2.00

800°F


195°F

135°F

1.3

None


130°F

120°F

N/A

600°F


170°F (180°F
Sentry)
100°F (120°F
Sentry)
Devtronics

558°FFootnote 27
HBDs Tested Dynamically No Yes Yes, with TEST car No Yes, with 210°F
and 170°F
Calibration Temperatures Servo
130°>ambient
Sentry
180°>ambient
Servo
126°>ambient
Sentry
180°>ambient
Servo
130°>ambient
Sentry
N/A
Servo
130°>ambient
Sentry
N/A
Servo
135°>ambient
Sentry
135°>ambient

Appendix F— List of Supporting Reports

The following TSB Engineering Branch Report was completed:

This report is available upon request from the Transportation Safety Board of Canada.

Appendix G— Glossary

AAR
Association of American Railroads
ACGIH
American Conference of Governmental Industrial Hygienists
AEI
automatic equipment identification
AWA
advance warning alarm
BNSF
Burlington Northern Santa Fe Corporation
BOJ
burnt-off journal
CCFG
Corporation des Chemins de fer de la Gaspésie
CFBC
Chemin de fer Baie des Chaleurs
CFMG
Chemin de fer de la Matapédia et du Golfe
CN
Canadian National
CPR
Canadian Pacific Railway
CROR
Canadian Rail Operating Rules
CSX
CSX Corporation
CWR
continuous welded rail
DED
dragging equipment detector
DOB
Daily Operating Bulletin
DPU
data processing unit
EPA
Environmental Protection Agency
EST
eastern standard time
F
Fahrenheit
GEXR
Goderich & Exeter Railway
GM
General Motors
GOI
General Operating Instructions
HB
hot bearing absolute deflection
HBD
hot box detector
HBO
hot box operator
HBR
Hudson Bay Railway
HD
hot bearing differential
HEP
head-end power
HWD
hot wheel detector
JAWS
journal advance warning signal
km/h
kilometre per hour
LEL
lower explosive limit
LPG
liquefied petroleum gas
LRC
Light, Rapid, Comfortable
mm
millimetre
mph
mile per hour
NIOSH
National Institute for Occupational Safety and Health
ppm
part per million
psi
pound per square inch
QC
Quality Control
QNS&L
Quebec North Shore and Labrador
RAC
Railway Association of Canada
RSA
Railway Safety Act
RTC
rail traffic controller
RTC Mech
rail traffic control mechanical service representative
S&C
Signals and Communications
STC
Southern Technologies Corporation
TC
Transport Canada
TSB
Transportation Safety Board of Canada
UEL
upper explosive limit
UPSP
Union Pacific/Southern Pacific
U.S.
United States
VIA
VIA Rail Canada Inc.
WB
warm bearing absolute deflection
WD
warm bearing differential
WILD
wheel impact load detector
WIS
Wayside Inspection System
W2
warm bearing based on a comparison of each pulse on a particular side of a train with the average of all pulses on that side of the train
W3
warm bearing based on a ratio of the highest pulse recorded on each side of every individual car to the average remaining pulses on that side of the car
°
degree