Railway Investigation Report R15H0013

On 14 February 2015, at about 2335 Eastern Standard Time, Canadian National Railway Company (CN) crude oil unit train U70451-10 was proceeding eastward at about 38 mph on CN's Ruel Subdivision when it experienced a train-initiated emergency brake application at Mile 111.7, at Gladwick, near Gogama, Ontario. A subsequent inspection determined that the 7th through 35th cars (29 cars in total) had derailed. Nineteen of the tank cars were breached, and about 1.7 million litres of petroleum crude oil were released to either atmosphere or surface. The released product ignited, and the fires burned for 5 days. About 900 feet of mainline track was destroyed. There was no evacuation, and there were no injuries.

Le présent rapport est également disponible en français.

1.1 The accident

On 10 February 2015, Canadian National Railway Company (CN) crude oil unit train U70451-10 (the train) departed eastward from Edmonton, Alberta, destined for the Valero Energy Corporation (Valero) refinery located at Lévis, Quebec.

The train consisted of 2 head-end locomotives and 100 tank cars loaded with dangerous goods (DGs). Of these 100 cars, 68 were loaded with petroleum crude oil (UN 1267), and 32 were loaded with petroleum distillates (UN 1268). The train was 6089 feet long and weighed 14 355 tons. The train was designated as a key train^{Footnote 1} operating on a key route.^{Footnote 2}

On 14 February, a regular crew change was made at Hornepayne, Ontario, located at Mile 296.2 of CN's Ruel Subdivision.^{Footnote 3} The outbound train crew consisted of a locomotive engineer and a conductor. Both were familiar with the territory, met fitness and rest requirements, and were qualified for their positions. The train departed eastward on the subdivision at about 2015.^{Footnote 4}

At about 2335, while proceeding at about 38 mph, the train experienced a train-initiated emergency brake application at Mile 111.7 at Gladwick, near Gogama, Ontario (Figure 1). The train crew looked back and observed a large explosion and ensuing fire. They followed the emergency procedures and made the necessary radio broadcast. After the train came to rest, the crew disconnected the locomotives and the first 6 cars from the train, and travelled to a safe location east of the fire. There were no injuries, and there was no evacuation.

1.2 Site examination

The 7th through 35th tank cars had derailed (Figure 2). The 7th and 8th cars from the head end (VMSX 310740 and VMSX 311903) came to rest on their side at the east end of the derailment site, south of, and roughly parallel to, the track structure. Both cars had sustained minor damage and had separated from their trucks, but neither car released product. A gap of about 200 feet separated the 8th car and the 9th car.

The 9th to the 12th cars came to rest to the south of the track, roughly parallel to the track structure, where melting snow and product had pooled to form a small pond. The 13th to 33rd cars sustained more significant damage and came to rest in various positions west of the pond in a pileup that extended westward for about 700 feet. The last 2 derailed cars, the 34th and 35th cars from the head-end, were derailed but were not damaged, and had remained upright near the track at the west end of the derailment. About 900 feet of mainline track was destroyed.

Nineteen of the tank cars released petroleum crude oil (UN 1267). During the derailment, 14 of the tank cars (13th to 16th, 18th to 21st, and 23rd to 28th cars) were breached and released product that pooled on both sides of the track. The pooled product ignited; the ensuing fire engulfed 5 additional tank cars, which sustained thermal tears. The 14th and 21st tank cars sustained both breaches and thermal tears. Approximately 1.7 million litres of product were released to either atmosphere or surface, and the fire burned for 5 days.

The leading L1 wheel tread of the 8th car (VMSX 311903) exhibited impact marks that were consistent with contact with an exposed rail end. Circumferential abrasion marks were observed on the outboard rim face of the trailing L4 wheel, indicating that the wheel had dropped into gauge.

Approaching the derailment site from the west, no impact marks were observed on the track infrastructure. At the west end of the derailment site, a broken insulated joint was observed in the south rail, near the signal mast at Mile 111.7 (Photo 1).

Both joint bars had broken into 2 pieces. The east portion of the joint assembly was not located, while the west portion of the joint bars remained attached to the rail. Rail end batter (REB) was observed on the head of the portion of rail that remained within the joint. The top of each remaining portion of joint bar exhibited beach marks, which are indicative of fatigue failure. Information written on the web of the rail indicated that a Sperry rail flaw test, conducted on 18 January, had identified a 3.5 mm REB condition at Mile 111.7.

The rail components were sent to the Transportation Safety Board of Canada (TSB) Laboratory for further analysis.

1.3 Weather

The temperature at the time of derailment was −31 °C. Weather in the 7 days following the derailment remained very cold (Appendix A).

1.4 Dangerous goods

The transportation of DGs^{Footnote 5} is governed by federal regulations in Canada^{Footnote 6} and in the United States (U.S.).^{Footnote 7} These regulations are based on the United Nations Recommendations on the Transport of Dangerous Goods.

The products being transported in this occurrence were petroleum crude oil (UN 1267) and petroleum distillates (UN 1268). These products were both listed as Class 3 flammable liquids, packing group (PG) I, which is the most hazardous group of products in this class.

1.4.1 Class 3 flammable liquids

Class 3 flammable liquids are DGs whose vapours can form an ignitable mixture with air at or below a temperature of 60 °C. These liquids can pose serious hazards due to their volatility and flammability, which are determined by the initial boiling point^{Footnote 8} and the flash point, respectively.^{Footnote 9}

Because the volatility and flammability of flammable liquids vary widely, Class 3 products are grouped together based on these characteristics so that different requirements, including packaging, storage, handling, and transportation, can be established. According to the Transportation of Dangerous Goods Regulations, Class 3 flammable liquids are divided into 3 PGs, ranging from PG I (highest hazard) to PG III (lowest hazard). The specific criteria for these PGs are:

• PG I, if the flammable liquid has an initial boiling point of 35 °C or less at an absolute pressure of 101.3 kPa and any flash point.
• PG II, if the flammable liquid has an initial boiling point greater than 35 °C at an absolute pressure of 101.3 kPa and a flash point less than 23 °C.
• PG III, if the criteria for inclusion in PG I or PG II are not met.

1.4.2 Petroleum crude oil

Petroleum crude oil has a wide range of flammability and volatility characteristics. The product is usually qualified in terms of sulphur content (low sulphur being "sweet" and high sulphur being "sour") and density (light to heavy). The density of petroleum crude oil is described in terms of its American Petroleum Institute (API) gravity^{Footnote 10} (expressed in degrees), where a higher number indicates lower density. The thresholds defining "light," "medium," and "heavy" crude oil vary depending on the product's region of origin and the organization making the determination.^{Footnote 11}

According to the train consist, all of the derailed cars in the occurrence were transporting petroleum crude oil (UN 1267).

1.4.3 Emergency response procedures for petroleum crude oil

Guide 128 of the Emergency Response Guidebook^{Footnote 12} identifies the potential hazards of petroleum crude oil products, which include petroleum distillates. Guidance is provided for emergency response and for ensuring public safety.

Under the "Potential Hazards" heading,^{Footnote 13} the guide states that

• These products are lighter than water, are highly flammable, and will be easily ignited by heat, sparks or flames.
• The product vapours are heavier than air; they will spread along the ground and collect in low or confined areas (e.g., sewers, basements or tanks). These vapours may form explosive mixtures with air, and may travel to a source of ignition and flash back.
• These products are associated with a vapour explosion hazard indoors, outdoors or in sewers, and their containers may explode when heated.

Under the "Emergency Response"^{Footnote 14} and "Public Safety"^{Footnote 15} headings, the guide states that

• Water spray, fog or regular foam should be used to fight fire, but not straight streams of water. Because these products have a very low flash point, water spray may be inefficient; it may be necessary to use vapour-suppressing foam to reduce vapours.
• An initial downwind evacuation for at least 300 metres (1000 feet) should be considered.
• All ignition sources must be eliminated.
• All equipment used when handling the product must be grounded.
• Responders must not touch or walk through spilled material.
• The leak should be stopped if it can be done without risk.
• Entry into waterways, sewers, basements or confined areas should be prevented.
• Spilled product should be absorbed or covered with dry earth, sand or other non-combustible material, and transferred to containers.
• Clean, non-sparking tools should be used to collect absorbed material.

1.5 National Fire Protection Association 472 Standard

The National Fire Protection Association 472 Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents (NFPA 472) is the standard for emergency response agencies throughout North America.

NFPA 472 specifies the minimum level of competencies required by responders to emergencies involving hazardous materials^{Footnote 16} (HAZMAT) and weapons of mass destruction (WMD). These competencies are necessary for ensuring an effective risk-based response to these types of incidents. The standard includes competencies for

• awareness level personnel;
• operations level responders;
• HAZMAT technicians;
• incident commanders;
• HAZMAT safety officers; and
• other specialist employees.^{Footnote 17}

HAZMAT technicians and incident commanders have similar required competencies, including the abilities to

1. analyze HAZMAT/WMD incidents to determine the complexity of the problem and potential outcomes;
2. plan a response within the capabilities of available personnel;
3. implement the planned response consistent with the standard operating procedures and the site safety and control plan;
4. evaluate the progress of the planned response and modify the plan if necessary;
5. terminate the incident by assisting in an incident debriefing and critique.^{Footnote 18}

1.6 Approach to the management of occurrences involving dangerous goods at Canadian National Railway Company

CN had implemented a DG management and response system under the direction of its vice-president safety and sustainability. Reporting to the vice-president safety and sustainability is an assistant vice-president safety and emergency response (AVP). The AVP leads a team of 3 senior DGOs who are responsible for oversight within their assigned regions: Western Canada, Eastern Canada, and U.S. Within each region, a team of DGOs reports to the senior DGOs.

DGOs are stationed at most major terminals throughout CN territory with other staff at each terminal also trained to assist in the responses. The entire team is trained on the requisite NFPA 472 competencies for their positions. Recurrent training occurs every 3 years at the Association of American Railroads (AAR) Transportation Technology Center Incorporated Security and Emergency Response Training Centre in Pueblo, Colorado, U.S.

In 2006, the assistant vice-president safety and emergency response, who was already recognized as an expert in the field of emergency response involving DG, was recruited by CN and was tasked with developing the CN DG team, the CN emergency response plan, and the company-wide railway emergency response course. Each of these initiatives was based on established emergency response practices, company guidance and NFPA 472.

At CN, the DGOs were equipped with:

• hard copy reference material such as the Emergency Response Guidebook, the National Institute for Occupational Safety and Health manual, and various conversion charts;
• fire turnout gear;
• fire-retardant clothing;
• self-contained breathing apparatus;
• a multi-gas detector (lower explosive limit, oxygen, carbon monoxide and carbon dioxide); and
• colorimetric tubes for sampling products that cannot be sampled using the multi-gas detector.

CN DGOs were also equipped with a portable weather monitoring device capable of detecting wind speed and direction. This information can be useful for determining the direction in which the emergency responders should approach the accident site. In this occurrence, CN did not record any weather monitoring information.

1.7 Incident command

When dealing with Class 3 flammable liquid products in an emergency response situation, industry best practice requires a formalized incident command (IC) structure to be established to manage the response.

Since March 1990,^{Footnote 19} when IC was incorporated into law in the U.S., this formal structure has been used extensively by the military, firefighters, police services, and HAZMAT emergency response teams. IC was developed to organize people, equipment, and resources to respond to any emergency situation, including incidents that involve fire and DGs. In Canada, when IC is established for fire and HAZMAT incidents, the local fire chief or provincial official will normally be the authority having jurisdiction and will typically assume the role of incident commander. For railway accidents, if no other agencies respond, the senior railway company officer on site will implement IC to manage the emergency response and the related remediation activities.

An effective IC will typically include, but is not limited to:

• an incident commander who is responsible for overview of the incident;
• IC staff with clear lines of responsibility and consisting of a public information officer, site safety officer, logistics and planning officer, and other positions, depending on the size and complexity of the incident;
• a site perimeter with adequate security to control access;
• a dedicated command post to facilitate meetings and briefings;
• a controlled site entry access point;
• a site access control system, with sign-in/sign-out sheets and tags to keep track of all personnel on site and coordinate activities;
• oversight of all interventions to ensure that they are appropriate and use equipment that is compatible with the product involved (in the case of flammable liquids, this would include use of non-sparking tools, intrinsically safe electronics and grounded equipment to prevent igniting a flare-up); and
• oversight of mitigation activities to ensure that they are properly coordinated, documented and supervised for safety.

1.8 Emergency response

The accident occurred in a remote location about 90 km south of Timmins, Ontario. As the site was initially accessible only by rail (locomotive or hi-rail vehicle), access to the site and mitigation activities were hindered. The extreme cold and severe winter conditions, combined with the remoteness of the location, presented a number of challenges throughout the response. These challenges included:

• access to the accident site (access improved once a road was cut into the site, providing access to vehicle traffic)
• deployment of equipment for firefighting and site remediation
• operation of equipment, and equipment freeze-up
• access to shelter and recovery areas for response personnel
• communications being limited to satellite phone.

In this occurrence, CN, as the primary response agency, implemented its incident command system. The CN senior vice-president, Eastern operations (SVPE), was the incident commander and was supported by the assistant vice-president safety and emergency response, DGOs, and other CN staff and contractors.

1.8.1 Incident command documentation

By their nature, responses to derailments involving DGs can be dynamic and fluid, as situations can change at any time. After arriving at the occurrence site, it still takes some time to secure the site, set up an IC structure, get HAZMAT technicians on site, conduct initial reconnaissance activities, and plan and commence site mitigation activities.

For each incident, CN protocols require that a detailed emergency response IC logbook be maintained to document the various site activities. The CN logbook was well structured and provided useful information and guidance for its completion. For example, guidance provided in the logbook indicated that all meetings were to be documented. CN risk-management personnel were tasked with completing the logbook.

Once CN established the IC, the focus turned to constructing road access to the site and mobilizing response personnel and resources to help minimize environmental damage, control the pool fires, and begin track restoration. These activities would normally be documented in the logbook. However, for this occurrence, there were no logbook entries. As a result, there was little to no documentation of regular safety briefings to outline progress and challenges, or documentation of safe work plans to outline site mitigation activities during the entire response. Specifically, there were no detailed records of:

• site entry or monitoring of the affected cars;
• wrecking activities;
• any internal meetings or decisions; or
• any meetings with or briefings provided to external parties.

1.8.2 Accident site monitoring

Immediately following the derailment, fire erupted and engulfed many of the tank cars that had been breached. As the fire continued to burn, 7 tank cars ruptured (due to thermal tears) and released more crude oil to the environment (Photo 2).

On 15 February, a CN portable command centre was dispatched to the site from Sudbury, Ontario. Once on site, it provided support for external satellite phone communication and a central meeting point for organizational planning. It also served to protect responders from the harsh elements and frigid temperatures. On 16 February, a second portable command centre arrived and was placed into service as site mitigation activities expanded.

CN initially attempted to establish a formal sign-in/sign-out protocol for all personnel at the occurrence site. However, the process was not consistently adhered to, partly due to the remoteness of the location and the difficulty with entering and exiting the site. While the sign-in process improved somewhat after roadway access to the site was built and it was no longer necessary to transport all personnel to the site by locomotive or hi-rail, there was still no accurate record of who was physically on or off site.

Dense smoke swirled throughout the area as the product continued to burn and site mitigation activities progressed. While DG protocols require responders to approach a DG site from an upwind position, no wind monitoring devices were being used.

Initially, many employees did not wear face masks or respirators to protect against airborne particulates from the fire or vapours from volatile organic compounds (VOCs)^{Footnote 20} in the product (e.g., benzene). As a result, exposed skin, including the mouth and nose areas, on these employees was covered in soot by the end of their shift. Later in the response, dust masks were provided to employees to protect against particulates.

Due to the nature of the released product, the site was monitored for VOC lower explosive limit^{Footnote 21} and hydrogen sulfide. CN DGOs and contractors also monitored benzene levels at the site every 30 minutes. However, the benzene level monitoring was valid only for the precise location at which it was recorded. The maximum recorded benzene level was reported to be 0.46 parts per million, which was well within the established short-term exposure limit^{Footnote 22} of 5 parts per million as averaged over a 15-minute period.^{Footnote 23} However, half- or full-face cartridge-type respirators were not provided to employees to guard against potential repeated cumulative exposure to benzene during extended site mitigation activities.

1.9 Environmental impact

1.9.1 Site description

The derailment occurred within a low-lying wetland area to the west and a forested area with a stream and lower-lying areas to the east. A small stream conveyed water from the western low-lying area to the east through a 40-inch culvert located beneath the tracks in the vicinity of the derailment. The stream tracked northward to the edge of the derailment area, then turned to the west past the site and eventually discharged into a pond that leads to Upper Kasasway Lake.

The area of the derailment was covered with snow. The ground consisted of unconsolidated sand that was permeable to base rock. The water table was about 6 to 10 feet below ground surface. Subsequent to the derailment, a large pond of oil and water formed to the south side of the track where the culvert was blocked. CN's environmental plan focused on surface runoff containment, because the product was assumed to be lighter than water.

1.9.2 Surface water monitoring program

Impacted surface water was limited to areas where crude oil came in contact with the surface. A surface water sampling program was begun in the vicinity of the derailment, including the channel leading towards Upper Kasasway Lake and several locations within Upper Kasasway Lake.

Initially, daily observations were made at each location to check for any visual or olfactory impacts. Following consecutive rounds of sampling with no impacts found, sampling frequency was reduced to twice per week until the late fall of 2015. Surface water monitoring resumed in the spring of 2016 and, as of 01 July 2016, will continue on a quarterly basis for an indefinite period.

1.9.3 Wastewater treatment and water diversion activities

Mobile wastewater treatment units (MTUs) were sent to the accident site. All MTUs, which were provincially governed and approved, were operated under a mobile Certificate of Approval or Environmental Compliance Approval. The containment sampling requirements and discharge criteria had been strictly adhered to before the treated water was discharged. A total of 3 MTUs were installed in series, and all recovered impacted water was treated. The treated water was then discharged back into the natural environment.

1.9.4 Groundwater monitoring program

A total of 17 groundwater monitoring wells were installed to verify the direction of groundwater flow and groundwater depth, and to determine if groundwater had been impacted. Groundwater depth was about 2.5 m to 3.5 m below ground surface. Impacted groundwater was limited to areas where crude oil surfaced on ground water. Contaminants were successfully removed during soil remediation in the areas east and west of the track bed.

Groundwater monitoring was completed for the winter in November 2015. By that time, there was no further detection of crude oil contaminants in the groundwater. In the spring of 2016, the groundwater monitoring resumed. As of 01 July 2016, no negative environmental impact to the ground water had been detected.

1.9.5 Soil excavation and containment

A significant volume of contaminated soil had to be removed from the derailment site by truck. This activity was hampered by limited roadway access to the site and the limited number of local landfill facilities that were able to accept waste soil.

Subsequently, a total of 13 lined soil containment cells were constructed to store contaminated soil until it could be transported to an approved landfill site. Each containment cell held about 2500 tons (5000 m³) of soil. In the spring of 2016, the Ontario Ministry of Environment and Climate Change designated the soil as non-hazardous waste; all excavated soil was removed from the accident site and transported by truck to approved landfill sites.

1.9.6 Site restoration

CN submitted a detailed restoration plan to all regulatory agencies and the Mattagami First Nation for consideration and comment. Forest restoration, which included a diverse planting program to return the lost vegetation species that were native to the area, was completed with the assistance of the local Mattagami First Nation in the spring of 2016.

On 27 May 2016, CN submitted an environmental closure report to the Ontario Ministry of the Environment and Climate Change as part of the approval process for site closure. Contingent upon the results of a final round of water testing, scheduled for the fall of 2016, site closure was expected to be granted. However, the 17 groundwater wells installed at the accident site will continue to be monitored quarterly for an indefinite period.

1.10 Class of track

All railway lines are defined as a particular class of track that is related to the condition or maintenance level of the track. The Transport Canada (TC)–approved Rules Respecting Track Safety, also known as the Track Safety Rules (TSR), define classes of track and the associated maximum permitted train speeds for each class. Under the TSR, the lowest class of track is Class 1, which restricts freight train speed to a maximum of 10 mph, and the highest class of track is Class 5, which has a maximum permitted freight train speed of 80 mph.

1.11 Subdivision information

CN's Ruel Subdivision consists of a single main track that extends westward from Capreol, Ontario (Mile 0.0), to Hornepayne, Ontario (Mile 296.2). Train movements on the subdivision are governed by centralized traffic control, as authorized by the Canadian Rail Operating Rules (CROR), and supervised by a rail traffic controller located in Toronto, Ontario.

In the vicinity of the derailment, the track is Class 3. The authorized track speed is 40 mph for freight trains and 45 mph for passenger trains. Traffic on the Ruel Subdivision consisted, on average, of 18 freight trains per day. A VIA Rail Inc. passenger train operated westbound on Wednesdays and Sundays, and eastbound on Wednesdays and Fridays.

The track throughout the derailment area is tangent single mainline generally oriented in an east-west direction. It consists of 136-pound continuous welded rail (CWR) manufactured by Sydney in 1996. Rail wear was measured at 6 mm, which was less than 75% of the vertical condemning limit. The rail was laid on 14-inch double-shoulder tie plates and anchored to concrete ties with Pandrol clip fasteners. The ballast was crushed rock. The shoulders were about 16 inches wide, and the cribs were full.

Between 2010 and 2014, rail freight traffic on the Ruel Subdivision had increased from 32.8 million gross ton-miles per mile (MGTM/M) to 47.1 MGTM/M (Table 1). During the same period, the number of carloads of petroleum crude oil had increased from 62 to 75 186.

1.12 Rail joints

Rail joints secured with joint bars are a track surface discontinuity that can result in excessive dynamic loads at the joint due to wheel impact if the joint is not properly supported or maintained. A properly maintained joint would be firmly supported on sound ties sitting on well-tamped, free-draining, clean ballast. If joints are not properly supported or maintained, higher wheel impact forces can be generated. This can lead to increased vertical rail deflection, loosening and deterioration of the joint assembly, REB, and degradation of the ties, ballast, and subgrade under the joint.

Insulated joints are a type of rail joint installed at track circuit limits to electrically isolate sections of track (blocks) in signaled track. These joints are typically assembled in a factory by bolting together 2 pieces of rail with joint bars. The rails and joint bars are isolated by positioning an epoxied insulating material between them. Insulated fiber bushings and washer plates are used to isolate the bolts from the bars.

Insulated joint failures are typically electrical failures caused by glue de-bonding, insulator failures from component breakage and wear, or mechanical failures resulting from the failure of the joint bars caused by dynamic loading.

1.13 Rail end batter and localized surface collapse

REB occurs at a rail joint when the ends of the rail heads within the joint are mismatched or the gap between the rail ends is too large. REB is indicative of degrading joint support that can result in excessive joint movement. Poor joint support, which usually occurs due to fouled ballast, deteriorated ties or loose fastening, is the primary cause of joint failure. The average life of an insulated joint in North America is about 200 million gross tons (MGT).^{Footnote 24} This service life is lower than that of most of the other running surface components of the track infrastructure.

A localized surface collapse (LSC) in a rail is characterized by plastic metal flow, leading to the flattening out and deformation of the rail head above the plane of the rail head/web fillet. LSCs are normally caused by mechanical interaction from repetitive wheel loadings. As an LSC becomes more severe and vertical wear of the rail head increases, wheel impact forces also increase. This can result in high contact stresses and lead to the development of other rail defects. In particular, LSC and REB conditions commonly develop as a result of poor track support (low spots or low surface); this contributes to increased wheel impacts, which can lead to potentially catastrophic rail component fatigue defects.

The TSR contains no guidance or condemning criteria with regards to REB or LSC. In Canada, these are categorized as rail surface conditions rather than rail defects. While they are not considered as service failures, these rail surface conditions are indicative of potential emerging rail defects.

As specified in CN Engineering Track Standards (ETS), track standard (TS) 1.7 – Rail Testing and Remedial Action for Broken Rail:

• Item 10a requires the monitoring of LSC conditions that are less than 5 mm in depth, on rail worn to less than 75% of the vertical rail wear condemning limit.
• Item 10b outlines the limits for REB in the winter months:

During the winter months (as determined by the Regional Chief Engineer), the following applies to in-track rail joints in Class 3 track and greater with annual MGT's of 10 or greater.

If joint rail end batter is found to be it. [sic]

The depth of an LSC or REB is measured using a straight edge, as shown in Figure 3.

1.14 Track inspection

For federally regulated track, the minimum regulatory requirements for track inspection are set out in the TSR. Where track is identified as not meeting the track safety rules, the railway company must immediately bring the track into compliance or halt operations over that line of track.^{Footnote 25}

1.14.1 Track geometry inspection

According to the TSR, for Class 3 track with more than 35 MGT of annual traffic, a track geometry inspection must be performed at least 2 times a year. The TSR indicate that any deviation from uniform profile on either rail at the mid-ordinate of a 62-foot chord may not be more than 2¼ inches.

As specified in CN ETS, TS 7.1 – Track Geometry:

1. Deviations exceeding Transport Canada Track Safety Rules […] for track geometry are defined as "URGENT" defects.^{Footnote 26}

TS 7.1 further indicates:

1. Where a portion of the track exceeds the limits defined as "URGENT", one of the following actions must be immediately taken before the operation of the next train over the defect(s):
   1. the defect(s) must be repaired to within the allowable tolerance;
   2. […] if the defect is a speed-related type, a temporary slow order (TSO) must be placed restricting trains to a maximum speed which is within the track class allowed for the severity of the defect(s) […]; or
   3. operation over the track must be halted.^{Footnote 27}

Deviations approaching track geometry limits specified in the TSR are defined as "near-urgent" conditions. CN TS 7.1, Item 3 states that:

1. NEAR-URGENT conditions will be identified by the Geometry Car and must be inspected within 72 hours and remedial action must be taken within 30 days.^{Footnote 28}

TS 7.1 further states that:

4. Deviations exceeding CN recommended maintenance tolerances are defined as "PRIORITY" conditions.
   1. Where a portion of track exceeds the limits defined as priority, the condition must be monitored until it is repaired to ensure it does not escalate to an "URGENT" defect.^{Footnote 29}

Priority surface conditions are defined in TS 7.1, according to which the deviation from uniform profile on either rail at the mid-ordinate of a 62-foot chord may not be more than 1¼ inches for Class 3 track.^{Footnote 30}

Table 2 provides a summary of CN priority, near-urgent, and urgent geometry defects on the Ruel Subdivision from 2011 to 2014.

On the Ruel Subdivision, track geometry testing was carried out 4 to 6 times per year.^{Footnote 31} The most recent track geometry car inspection had been completed on 02 November 2014, about 3 months before the derailment. During this inspection, a 1-inch surface low spot was identified on the south rail at the insulated joint, at Mile 111.7. However, no action was taken to address the track condition, nor was any action required to be taken, because it did not exceed the TSR urgent criteria (2¼ inches) or CN's priority criteria (1¼ inches).

1.14.2 Rail flaw inspection

According to the TSR, on Class 3 track with more than 35 MGT of annual traffic, a rail flaw inspection must be performed at least 2 times a year. Inspection equipment must be capable of detecting rail defects in the area enclosed by the joint bars. The TSR does not identify REB as a rail defect.

CN performs rail flaw inspections on the Ruel Subdivision approximately every 20 days throughout the winter months, and every 37 days throughout all other seasons.^{Footnote 32} The 2 most recent rail flaw inspections had been completed on 18 January 2015 and on 07 February 2015. The 18 January 2015 inspection identified a 3.5 mm REB condition at the insulated joint in the south rail, at Mile 111.7. The 07 February 2015 test did not identify any defects in the area.

The REB condition was not yet at a limit that required monitoring according to the CN ETS. However, as a precaution, the assistant track supervisor (ATS) responsible for the territory began monitoring the REB condition twice weekly. As this condition had previously been detected, documented, and marked on the rail, the REB condition was not included in the 07 February 2015 rail flaw inspection report.^{Footnote 33}

Between January 2014 and March 2015, rail flaw testing on the Ruel Subdivision identified 570 flaws (Table 3), which included 332 LSCs, 87 REBs, and 19 crushed heads. These rail surface conditions required a significant amount of monitoring, repair work, or both, for inspectors and maintenance crews.

1.14.3 Visual inspection

1.14.3.1 Track

According to the TSR and CN ETS TS 7.0 – Track Inspection Guidelines,^{Footnote 34} on Class 3 track with more than 35 MGT, a visual track inspection must be performed at least 2 times a week. However, during the winter of 2015, CN instituted a requirement for daily track inspections in the Northern Ontario Zone, because of the temperature and snow conditions.

The most recent visual track inspection had been completed by the ATS on 12 February 2015. During this inspection, the REB at the insulated joint at Mile 111.7 was visually inspected, but not measured, and was found to not be progressing. The REB was last measured at 3.5 mm on 07 February 2015, during the rail flaw inspection. No records of the REB measurements at this joint during visual inspections were kept, nor were they required to be.

1.14.3.2 Joint inspection requirements under the Track Safety Rules

Subpart D - Track Structure, Section V - Rail Joints, states that

1. Each rail joint, insulated joint, and compromise joint must be of the proper design and dimensions for the rail on which it is applied.
2. If a joint bar on Classes 3 through 5 track is cracked, broken, or because of wear allows vertical movement of either rail when all bolts are tight, it must be replaced.
3. If a joint bar is cracked or broken between the middle two bolt holes it must be replaced.^{Footnote 35}

Subpart F – Inspection, Section 2. Track – Inspections, Item 2.5 Walking Track Inspection provides the following:

1. A Walking Track Inspection must be completed on all jointed tracks and concrete tie tracks where curvature is 4 degrees or greater. If joint bars are inspected electronically including the use of camera or other technology capable of detecting joint bar defects, a Walking Track Inspection of tangent track and curves less than 4-degree curvature in jointed track territory is not required; however, a Walking Track Inspection on all tracks with curves of 4 degrees or greater must be completed.^{Footnote 36}

1.14.3.3 Joint inspection requirements at Canadian National Railway Company

Item 6 of the CN ETS TS 7.0 – Track Inspection Guidelines states (in part) that

^{Footnote 37}

For Class 3 track with more than 40 MGT to 60 MGT, the rail joints must be inspected twice annually. There was no record of any yearly on-foot joint inspection in the vicinity of the insulated joint.

The same standards provide guidance on what action to take when a track condition is noted at a joint in CWR that does not require regulatory action.

Item 8 of the CN ETS TS 7.0 – Track Inspection Guidelines states (in part):^{Footnote 38}

If any of the following conditions […] are found at a joint in CWR and are not a regulatory defect and cannot be corrected immediately, on foot follow up inspections will be required until such time as the condition is corrected.

The ATS reportedly carried out a visual inspection of the REB within the joint on 12 February 2015 as part of the regular twice-weekly visual inspections from a hi-rail vehicle.

1.14.4 Track inspection guidelines at Canadian National Railway Company

CN's Track Inspection Guidelines course 00022E, Track Inspection, Module 5, instructs employees in:

• assembly of rail joints;
• minimum number of bolts for a rail joint;
• rail end mismatch;
• REB requirements;
• geometry defects due to low joints; and
• requirements of CN ETS TS 7.0 - Track Inspection Guidelines.

The Track Inspection Guidelines and CN ETS TS 7.0 discuss remedial action for various joint conditions. Joints with fouled ballast in conjunction with vertical movement (profile) that exceeds 75% of the allowable threshold for the designated class of track must be surfaced. The guidelines do not discuss surfacing of joints with vertical movement less than 75% of the allowable threshold for the designated class of track (i.e., a 1-inch low spot), even though low joints are usually the underlying cause of more serious joint defects.

1.14.5 Joint bar inspection systems

A machine vision–based system for joint bar inspection that uses high-speed cameras at speeds of up to 70 mph has been developed by the Federal Railroad Administration Office of Research and Development and ENSCO, Inc. The system features 4 linescan cameras mounted on a hi-rail or rail-bound vehicle that continuously capture high-resolution images from both sides of each rail. An on-board computer system automatically saves each joint bar image and analyzes it for visible fatigue cracks. The images can also be analyzed for missing bolts and other visible joint bar and rail defects. However, only cracks that extend to the outside (exposed) surface of the joint bars are visible to the cameras.

When a potential defect is detected, the system provides an audio warning, tags the image with a global positioning system (GPS) position, and displays the joint bar image with the defect highlighted on the screen. An operator then confirms or rejects the defect. At the end of the inspection, a report can be generated with the joint bar GPS location and related defects. Herzog Services Inc. (Herzog) and Sperry Rail Service^{Footnote 40} have equipped some of their rail flaw (ultrasonic/induction) testing vehicles with this system.

In addition, the Transportation Technology Center Inc. and Herzog have developed a non-destructive ultrasonic inspection system to detect joint bar flaws in the area of the joint bar that is masked by the railhead to web radius and cannot be inspected by visual or optically aided inspection techniques.^{Footnote 41} This system uses ultrasonic transducers mounted into a sliding fixture or roller search unit to scan along the outside of a joint bar while introducing pulsed sound waves across the bar in order to detect flaws and cracks located at the top inside surface of the joint bar. This makes it possible to detect cracks located on the top inside surface of the middle portion of the joint bar, where 95% of fatigue cracks initiate.^{Footnote 42}

At the time of the occurrence, CN was using neither the machine vision nor the ultrasonic joint bar inspection technologies.

1.15 Impact of cold weather on track infrastructure

During periods of severe cold temperatures, the track and infrastructure are less able to endure in-service forces, withstand damage and avoid breakage.

Rail and joint bar steel is known to have reduced fracture toughness and ductility at low temperatures, particularly when defects are present or when rail joints are subjected to significant stress due to contraction of CWR in cold weather. To minimize the effects of cold weather damage to track infrastructure, CN developed an extreme cold weather inspection policy. Specifically, CN ETS TS 7.0, Track Inspection Guidelines, item 34, states:^{Footnote 43}

CN has also established a cold weather temporary speed restriction. Item 37 of the CN ETS TS 7.0 ‑ Track Inspection Guidelines states:

In areas identified as having rail with a history of frequent defects (a list of such areas will be generated by headquarters engineering each year) the following cold weather temporary speed restrictions will be put in place:

When temperature is below −25°C in Canada or −10°F in the U.S. all freight trains shall be restricted to a speed or 40 mph or track speed whichever is more restrictive […]^{Footnote 45}

At the time of the derailment, the daily cold weather inspections had been conducted, train speed was restricted to 40 mph, and train length was restricted to 10 000 feet.

1.16 Canadian National Railway Company Engineering Notice 2015-E-01

On 15 January 2015, in response to the number of crushed rail heads, LSC and REB conditions identified through rail flaw testing, CN's Eastern Regional Chief of Engineering issued Notice 2015-E-01 (Appendix B). The notice required that all crushed heads, LSCs and REB conditions over 3 mm be measured and inspected within 96 hours, and a list sent to the assistant chief engineering and the regional chief engineering by 20 January 2015. The notice required remedial action in accordance with the winter standards outlined in TS 1.7. The notice emphasized that the use of slow orders should be seen as a last resort in addressing these types of defects, stating:

^{Footnote 46}

CN reported that the directive was not prompted by any particular concern about increased REB or rough spots. Rather, it was intended to help stay ahead of any potential acceleration of rail surface conditions.

1.17 Employee development

CN had recently experienced a large turnover in personnel. Approximately 50% of CN's 25 000 employees had been hired within the previous 5 years.^{Footnote 47} In 2014, CN opened 2 new training centres to deal with the transition to a younger, more diverse workforce. A training centre for Canadian employees was located in Winnipeg, Manitoba, and a training centre for American employees was located in Homewood, Illinois. Each training centre offered courses for new and seasoned railroaders in trades such as locomotive engineers, conductors, car mechanics, track maintainers, track inspectors, and signal maintainers. Employees received hands-on training in modern indoor laboratories with up-to-date equipment and modern teaching techniques. About 3000 employees per year were being trained at these new centres.

1.17.1 Engineering employee development and training path

Unionized engineering employees were initially hired as track maintainers. Track maintainer training consisted of a 3-week course at CN's training centre in Winnipeg. The first week covered general introductory topics related to working for CN, the second week was specific to the role of a track maintainer, and the third week was devoted to CROR training.

Candidates were required to pass an exam related to track maintenance at the end of the second week to be allowed to continue with rules training. There were very few failures at this stage of the training. An exam related to the CROR was administered at the end of the third week. About 75% of the candidates successfully passed the rules exam on their first attempt. Candidates who were unsuccessful could attempt the test a second time after 90 days of field experience. The success rate on the second attempt was approximately 95%.

Once qualified as track maintainers, employees could bid to become a track foreman (TF). The TF course was a 10-day course that incorporated a number of mandatory courses, including track inspection guideline training and CWR training. TFs were required to renew their track inspection guideline and CWR training every 3 years; this was tracked through CN's training management system.

The ATS position was the first level of management within CN's engineering organization. About 50% of the candidates for training as an ATS were drawn from the ranks of unionized employees. The remaining 50% were external, newly hired candidates from outside CN. Although previous experience in track or supervisory positions was preferred, ATS candidate profiles varied.

ATS candidates were enrolled in a training program for up to 52 weeks. The training consisted of 7 instructional blocks of 10 to 13 days each, which were delivered at the Winnipeg training centre. These instructional blocks were interspersed with blocks of on-the-job training (OJT). Overall, the training program included about 14 weeks of classroom training and about 36 weeks of OJT, although the length of OJT could vary. When candidates had completed the training, they would have had the 1 year of experience required to qualify as a track inspector. Table 4 provides a general outline of the ATS training program.

During the blocks of OJT, ATS candidates were provided with a checklist that included 16 track-inspection skills and 8 job skills on which they were to try to gain experience. There were also a number of activities that the candidates were to try to observe by the end of the training program. However, the onus was on the candidates to seek opportunities for exposure to these items during their time in the field. There was no formal review or assessment of candidate performance on the skills listed in the checklist during the OJT.

An ATS usually reports to a track supervisor (TSPVR). TSPVRs are usually promoted from within the ranks of the ATS, and the training requirements are the same for both.

1.17.2 Assistant track supervisor mentoring

Even an inexperienced ATS must be able to assess combinations of conditions and defects in order to appreciate the overall effect on the track structure and to anticipate how those elements may contribute to bigger problems if left unattended. While individual defects can be assessed against set track criteria, managing combinations of conditions and emerging defects (i.e., priority and near-urgent) requires greater experience and judgment.

One of the challenges in training ATS candidates with little railway experience was helping them obtain the experience and judgment necessary to assess track conditions and defects. To help them gain this experience, and to augment the ATS classroom and OJT programs, CN had a mentoring program in place, in which CN TSPVRs and senior manager engineering (SME) personnel were expected to mentor the employees who reported to them, in addition to their track maintenance duties.

Since 2013, CN had been delivering a communication and leadership program entitled LEAD to front-line supervisors and mid-level managers. The full LEAD program, which included some mentoring, consisted of 4 days of supervisory training that emphasized positive relationships and communication styles to involve and engage employees. At the time of the accident, neither the TSVPR nor the ATS had received this training.

1.17.3 Effective mentoring for developing expertise

Research on the development of proficiency in situations requiring judgment and the management of complex problems has highlighted the importance of mentoring in providing feedback to novices as they deal with increasingly complex situations. The keys to effective mentoring have been shown to include the ability to

• develop with the learner a positive relationship that encourages learning;
• understand the reasons for learner difficulties; and
• tailor the learning approach to suit the learner.

A mentor's ability to cultivate an appropriate environment for learning requires the organization's commitment to provide the resources and skills necessary for effective mentoring.^{Footnote 48}

1.18 Track maintenance on the Ruel Subdivision

CN's Ruel Subdivision extends westward for 296.2 miles from Capreol (Mile 0.0) to Hornepayne (Mile 296.2). To facilitate track maintenance activities, the subdivision is divided into an eastern portion (from Mile 0.0 to Mile 183.2) and a western portion (from Mile 183.2 to Mile 296.2). On the eastern portion of the Ruel Subdivision, a TSPVR and 2 ATSs were responsible for all maintenance activities, including the supervision of all related engineering maintenance personnel. One ATS was responsible for about 87 miles at the east end of the eastern portion, and the other ATS was responsible for about 97 miles at the west end of the eastern portion. Track maintenance personnel consisted of about 18 to 24 permanent employees during the summer. About 34 temporary employees were added during the winter.

The TSPVR reported to the SME for the Northern Ontario Zone. The SME was 1 of 4 CN SMEs within the province of Ontario. The SME was responsible for a territory that included parts of the Bala, Caramat, and Newmarket Subdivisions, as well as all of the Ruel and Soo Subdivisions. The SME reported to 1 of 2 assistant chief engineers for CN's eastern region, who in turn reported to the eastern regional chief, engineering.

1.18.1 Senior manager engineering

The SME in place at the time of the derailment had begun working for CN in 1979, and moved into a management position in 2009 as a construction supervisor. In late 2009, the SME was promoted to the position of production manager, and in December 2014, was promoted to the SME position.

The previous SME had begun working for CN as a trackman in 1981 and had served 21 years as a gang foreman. In 2005, he became a TSPVR, and in 2008 was promoted to the SME position.

1.18.2 Track supervisor

The TSPVR had begun working for CN as an ATS in southern Ontario in May 2007. On 15 October 2013, he was promoted to TSPVR for the eastern portion of the Ruel Subdivision, based out of Foleyet, Ontario (Mile 148.3). Before the occurrence, there had been no performance- or competence-based issues identified in relation to the TSPVR's work.

Given the high workload on the Ruel Subdivision, there was little time and few opportunities for the TSPVR to properly instruct and mentor the ATS.

1.18.3 Assistant track supervisor

The ATS had begun working for CN in February 2013 as an assistant track foreman. In May 2014, he was promoted to ATS on the Ruel Subdivision based out of Foleyet, Ontario, and began the CN ATS training program. Between May 2014 and February 2015, the ATS carried out the duties of his position while completing the OJT blocks of the ATS training program. During that time, the ATS frequently returned to CN's training centre in Winnipeg, Manitoba, to complete the classroom blocks of the training.

From May 2014 to December 2014, the ATS worked for the previous SME. During this time, the ATS had little contact with the SME. Starting in December 2014, following the change in SME, the ATS had more contact with the SME, who was generally more responsive to his workload and resource concerns. While the ATS was identified as having potential to advance within management, the ATS resigned shortly after the occurrence and returned to the unionized ranks of CN. The demands of the ATS position, combined with a lack of adequate mentoring and support, contributed to the decision.

1.18.4 Track maintenance challenges on the Ruel Subdivision

CN identifies train velocity^{Footnote 49} as an issue having a significant influence on the use of assets and cost control, 2 of CN's 5 strategic business pillars.^{Footnote 50} All engineering employees understand the sense of urgency to move trains as quickly and as safely as possible. Train delays that affect velocity create inter-functional pressures within the company. These pressures can sometimes create conflict between track maintenance decisions and train operations. Due to the importance of keeping trains moving, it can be challenging for track maintenance personnel to obtain adequate track time to conduct the required track inspections, maintenance and repairs. An employee who is relatively new to front-line management can be particularly influenced by this level of pressure, recognizing that it is driven from the highest operating levels within the company.

In this occurrence, the SME regularly inspected the Ruel Subdivision by hi-rail every 2 to 3 weeks. The overall assessment of the track by the SME and by the previous SME was that the track was in reasonably good shape. Both also considered the number of defects to be decreasing, and that the track and surface were in good condition.

When the incoming SME arrived in December 2014, the SME had implemented a work reporting system to get a better appreciation of the operating challenges on the territory. After reviewing these work reports, the SME identified that engineering personnel had been having difficulty getting enough track time to complete patrols and to conduct necessary track work.

The TSPVR had worked on the territory since October 2013 and also believed that the overall condition of the territory was improving, particularly after the installation of 860 new concrete ties the previous year. However, given the large number of track geometry defects, the focus had been on remediating the urgent and near-urgent defects, and it was difficult to address priority defects. In the months before the derailment, the large number of LSC and REB conditions that had been identified through rail flaw testing and required monitoring made it difficult to keep up with regular maintenance throughout much of the eastern portion of the Ruel Subdivision.

The ATS was required to inspect and maintain about 62 miles of track between Gogama, Ontario (Mile 86.6), and Foleyet, Ontario (Mile 148.3). Due to the time required for the track maintenance work and the difficulties in obtaining track time, the ATS found it challenging to complete the required track inspections. Because this was the ATS's first winter working in northern Ontario, the ATS had no frame of reference for the workload and the related challenges from previous years.

Most of the track inspections were conducted by the ATS directly rather than the ATS delegating them to a qualified TF, because the TFs were more urgently required for completing track work and maintenance duties. In early 2015, during periods of severe cold, the ATS was sometimes required to perform track inspections every day of the week for extended periods. In addition to the cold weather track inspections, the ATS had to monitor a high number of rail defects and rail surface conditions. With the challenges in obtaining track time, a track inspection could take up to 16 hours to cover the 62 miles of track. The ATS also had difficulty getting repairs completed, as the need for maintenance crew overtime was not supported by the TSPVR.

The ATS planned to have the REB condition within the insulated joint at Mile 111.7 temporarily repaired by welding, and to change out the insulated joint at a later date. At various times in December 2014 and January 2015, the ATS tried to schedule a weld repair at the insulated joint. However, attempts to have this work completed were unsuccessful, reportedly due to the welder not being available and the welder's vehicle being unserviceable.

The ATS attributed a large portion of the heavy workload to the fact that a large number of joints left in the track had not been welded the previous summer. The ATS had spoken to the incoming SME about the challenges on the Ruel Subdivision and was provided with additional personnel and support. While the ATS still had difficulty keeping up, there was general reluctance to place slow orders on the track that would affect train velocity. Senior management, meanwhile, viewed the absence of slow orders as a sign that staffing and maintenance was adequate.

1.19 Regulatory oversight

TC promotes safe and secure transportation systems in the air, marine, rail, and road modes, as well as the safe transportation of DGs. To do so, TC develops safety regulations and standards, and in the case of railways, it facilitates the development of rules by the rail industry. Once the rules are approved, TC is then responsible for enforcing the rules through a number of inspection programs to monitor compliance with rules and regulations. Track inspections are targeted using a risk-based approach. TC also has a national inspection program that randomly selects track segments to be inspected every year. Primary traffic corridors usually receive more attention than secondary main lines.

Rail safety is governed by the Railway Safety Act, the objectives of which are to:

1. promote and provide for the safety and security of the public and personnel, and the protection of property and the environment, in railway operations;
2. encourage the collaboration and participation of interested parties in improving railway safety and security;
3. recognize the responsibility of companies to demonstrate, by using safety management systems and other means at their disposal, that they continuously manage risks related to safety matters; and
4. facilitate a modern, flexible and efficient regulatory scheme that will ensure the continuing enhancement of railway safety and security.^{Footnote 51}

TC has also developed regulations on safety management systems (SMS), under which railways are responsible for managing their safety risks.

1.19.1 Transport Canada regulatory track inspections

As part of TC's oversight responsibilities, TC rail safety inspectors are tasked with conducting railway infrastructure inspections across Canada. Although railway subdivisions are not subject to regular TC inspections, TC uses a risk-based approach that considers various factors to identify areas of subdivisions requiring targeted inspection. While a significant increase in overall freight or DG traffic may be considered, it does not necessarily influence which subdivisions are scheduled for inspection. TC prioritizes inspections by considering different operational factors including but not limited to rail defects, geometry defects, passenger trains, high operating speeds, and tonnage. Table 5 provides a summary of track inspections conducted by TC on the Ruel Subdivision since 2005.

TC had not performed any inspections on the Ruel Subdivision since 2012. Between 15 March 2015 and 19 March 2015, TC inspected the entire subdivision. The TC inspection noted a total of 67 non-compliant conditions that required repair and 59 other concerns and observations.

1.20 Railway Safety Management System Regulations

An SMS is "a systematic, explicit and comprehensive process for managing safety risks."^{Footnote 52} It is a means to ensure that the railway has the processes in place to identify the hazards in its operation and mitigate the risks. SMS was designed around evolving concepts about safety that are believed to offer great potential for more effective risk management. SMS was progressively introduced in the Canadian transportation industry because this approach to regulatory oversight, which seeks to ensure that organizations have processes in place to manage risks systematically, when combined with inspections and enforcement, is considered to be more effective in reducing accident rates.

Section 2 of the TC Safety Management System Regulations (2001) (the SMS Regulations), which were in force at the time of the accident,^{Footnote 53} states:

2. A railway company shall implement and maintain a safety management system that includes, at a minimum, the following components:

1. the railway company safety policy and annual safety performance targets and the associated safety initiatives to achieve the targets, approved by a senior company officer and communicated to employees;
2. clear authorities, responsibilities and accountabilities for safety at all levels in the railway company;
3. a system for involving employees and their representatives in the development and implementation of the railway company's safety management system;
4. systems for identifying applicable
   1. railway safety regulations, rules, standards and orders, and the procedures for demonstrating compliance with them, and
   2. exemptions and the procedures for demonstrating compliance with the terms or conditions specified in the notice of exemption;
5. a process for
   1. identifying safety issues and concerns, including those associated with human factors, third-parties and significant changes to railway operations, and
   2. evaluating and classifying risks by means of a risk assessment;
6. risk control strategies;
7. systems for accident and incident reporting, investigation, analysis and corrective action;
8. systems for ensuring that employees and any other persons to whom the railway company grants access to its property, have appropriate skills and training and adequate supervision to ensure that they comply with all safety requirements;
9. procedures for the collection and analysis of data for assessing the safety performance of the railway company;
10. procedures for periodic internal safety audits, reviews by management, monitoring and evaluations of the safety management system;
11. systems for monitoring management-approved corrective actions resulting from the systems and processes required under paragraphs (d) to (j); and
12. consolidated documentation describing the systems for each component of the safety management system.^{Footnote 54}

The SMS Regulations also require railway companies to

• maintain records to permit the assessment of safety performance (subsection 3(1));
• submit documentation and records to the Minister that demonstrate compliance with the regulations (subsection 4(1)); and
• produce safety management documentation upon request (section 6).

1.21 Canadian National Railway's safety management system

In accordance with the SMS Regulations, CN had developed and implemented a detailed SMS. Since 2008, CN's SMS had been enhanced each year and had been integrated into most facets of its operations. The SMS described company initiatives that correlate to the requirements of Section 2 of the SMS Regulations.

With regard to paragraph 2(e) of the SMS Regulations that were in force at the time of the occurrence, CN had implemented systems for:

• identifying safety issues and concerns, including those associated with human factors, third-parties and significant changes to railway operations;
• evaluating and classifying risks by means of a risk assessment; and
• identifying and implementing risk control strategies.

Specific actions included the following:

• Safety issues and concerns were flagged to CN management through hazard forms, health and safety committees, CN's Ombudsman and CN's Prevent Hotline (a joint venture with St. Mary's University, Halifax, Nova Scotia), as well as through audits and trend analyses.
• CN had a formal risk assessment process that was used to evaluate and classify risks, including those associated with significant changes in railway operations, such as the opening of new yards and facilities, railway acquisitions, introduction of new technology, significant changes in business (volumes or product), and changes in personal protective equipment.
• Special corridor risk assessments were being carried out to assess and reduce risk in locations with high populations, waterways, or other environmental or topographical characteristics.
• Training was being provided to employees who performed risk assessments.

When human factors may have played a role in an accident, CN required further investigation before formulating corrective action, and the following was typically considered:

• Was the work properly planned, organized and supervised?
• Was the employee properly trained and equipped?
• Did the employee have the opportunity for sufficient rest?
• Was the rule or work procedure well understood?^{Footnote 55,Footnote 56}

Despite having a formal risk assessment process, CN perceived the increased tonnage of crude oil shipments on the Ruel Subdivision during 2014 as a normal operating parameter. The increase in tonnage did not trigger CN to conduct a risk assessment or to review an existing one.

1.22 Safety culture

Safety culture can be defined as "shared values (what is important) and beliefs (how things work) that interact with an organization's structures and control systems to produce behavioural norms."^{Footnote 57} Safety culture is critical to effective safety management, because safety management processes will be ineffective in a culture that does not support the proactive sharing of safety information. Where a safety culture exists to support effective safety management, information pertaining to safety will be actively sought; employees will be trained to recognize hazards and rewarded for sharing safety concerns. In such a culture, failures will be scrutinized as an opportunity to learn, and new ideas will be welcomed.^{Footnote 58} An effective safety culture is critical to the processes required by an SMS that support the development of a resilient organization.

TC's SMS guidance document Rail Safety Management Systems Guide: A Guide for Developing, Implementing and Enhancing Railway Safety Management Systems states that

An effective safety culture in a railway company can reduce public and employee fatalities and injuries, property damage resulting from railway accidents, and the impact of accidents on the environment.

In simple terms, an organization's safety culture is demonstrated by the way people do their jobs—their decisions, actions and behaviours define the culture of an organization.

The safety culture of an organization is the result of individual and group values, attitudes, perceptions, competencies and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organization's health and safety management system.

Organizations with a positive safety culture are characterized by communications from various stakeholders founded on mutual trust, by shared perceptions of the importance of safety and by confidence in the efficacy of preventive measures.^{Footnote 59}

The relationship between safety culture and safety management is reflected in part by the beliefs, attitudes and behaviours of a company's management.

An effective safety culture includes proactive actions to identify and manage operational risk. It is characterized by an informed culture where people understand the hazards and risks involved in their own operation and work continuously to identify and overcome threats to safety. It is a just culture, where the workforce knows and agrees on what is acceptable and unacceptable. It is a reporting culture, where safety concerns are reported and analyzed and where appropriate action is taken. Finally, it is a learning culture, where safety is enhanced from lessons learned.^{Footnote 60}

A company's policies determine how safety objectives will be met by clearly defining responsibilities; by developing processes, structures and objectives to incorporate safety into all aspects of the operation; and by developing the skills and knowledge of personnel. Procedures are directives for employees and communicate management's instructions. Practices are what really happens on the job, which can differ from procedures and, in some cases, increase threats to safety.

1.23 Safety culture at Canadian National Railway

In parallel with implementing SMS, CN had recognized the importance of building an effective safety culture which the company considers essential for SMS. To help strengthen its safety culture, CN has invested in training, coaching, and employee recognition and involvement.

In October 2014, CN co-hosted a safety culture symposium in Halifax, Nova Scotia, during which participants discussed and shared information on safety culture. CN also hosted a number of safety summits throughout its regions to promote two-way communication and best safety practices.

In 2014, among other initiatives, CN developed and implemented Looking Out for Each Other, a strategy that has become an integral part of CN's safety culture. The peer-to-peer engagement strategy was designed to

• raise awareness among employees of the top causes of incidents and injuries;
• identify and review safe work procedures;
• train employees to be aware of their surroundings and to recognize potential at-risk work practices or situations in the field;
• teach employees how to provide constructive feedback to peers; and
• learn from past incidents to prevent a reoccurrence of the same event and help each other stay safe.^{Footnote 61}

1.24 Resilience: The safe operating envelope and requisite imagination

Resilience is generally defined as the ability to "withstand or recover quickly from difficult conditions."^{Footnote 62} A resilient organization or system is defined as being "able to effectively adjust its functioning prior to, during or following changes and disturbances, so that it can continue to perform as required after a disruption or a major mishap, and in the presence of continuous stresses."^{Footnote 63}

Four cornerstones common to resilient organizations have been identified. The ability to adjust and adapt requires the organization to respond to events, monitor key change indicators, anticipate long-term challenges, and learn from experience. With these cornerstones in place, a resilient organization will:

• know what to do (how to respond to regular events);
• know what to look for (how to monitor for potential problems);
• know what to expect (anticipating potential threats);
• know what has happened (having the right indicators to learn from experience).^{Footnote 64}

These abilities help organizations balance potentially competing safety, efficiency, and workload pressures relevant to the operating environment.

An organization that is effectively monitoring, anticipating, and learning through proactive safety management processes and leading safety indicators will be able to respond to competing pressures and maintain an acceptable level of risk. Being poorly equipped to detect and understand the significance of small changes in the operating environment will increase risk until lagging indicators, such as accidents or serious incidents, provide clear indications that the system is out of balance.

One of the challenges is that safety reserves, procedures and practices that help maintain an acceptable margin of safety, can experience pressure from competing demands to increase efficiency. Mistaking safety reserves for inefficiencies will undermine safety goals.^{Footnote 65} Balancing competing demands is a challenge for individuals at all levels of an organization, because safety issues can emerge slowly and be difficult to detect. The human capability to appreciate the significance of information and events and to anticipate their impact on safety has been termed "requisite imagination."

Developing requisite imagination relies on individuals within the organization having:

• expert track knowledge allowing anticipation and judgement of defect conditions;
• the will to think critically about the functioning of the system;
• effective training to develop these capabilities;
• sufficient spare capacity to respond to events; and
• a clear flow of information throughout the organization.^{Footnote 66}

A comprehensive SMS would help an organization develop requisite imagination by ensuring that it has processes in place to support the 4 cornerstones of resilience, including:

• effective procedures for normal and abnormal situations (responding);
• safety reporting and trend analysis (monitoring);
• risk identification and assessment (anticipating);
• incident investigation (learning).

"Proactive safety management helps organizations look ahead to notice the signs that risks are changing or increasing despite past records of success and increasing pressures for short term performance."^{Footnote 67} An effective safety culture is essential in order to realize the benefits of requisite imagination. The safety culture of an organization will largely determine the type and amount of information fed into safety management processes, and how such information will be received and addressed.

1.25 Significant accidents involving Class 111 tank car releases

There have been a number of occurrences in Canada and the U.S. during which product was released from Class 111 tank cars following a collision, impact or fire (Appendix C). These occurrences highlight the vulnerability of Class 111 tank cars to accident damage and product release. As of June 2015, about 270 000 Class 111 tank cars were in service in North America, of which about 141 000 were being used to transport DGs.

1.26 The Lac-Mégantic accident

On 05 July 2013, at about 2250 Eastern Daylight Time, Montreal, Maine & Atlantic Railway (MMA) freight train MMA-002, en route from Montréal, Quebec, to Saint John, New Brunswick, was stopped at Nantes (Mile 7.40 of the Sherbrooke Subdivision), Quebec, the designated MMA crew-change point. The train, consisting of 5 head-end locomotives,1 VB car (i.e., special-purpose caboose), 1 box car, and 72 Class 111 tank cars carrying flammable liquids (petroleum crude oil, UN 1267, Class 3), was then secured on the main track and left unattended on a descending grade.

Shortly before 0100 on 06 July 2013, the unattended train started to move, and gathered speed as it rolled, uncontrolled, down the descending grade toward the town of Lac-Mégantic, Quebec. After reaching a speed of 65 mph, 63 Class 111 tank cars and a box car derailed near the centre of the town. The derailed cars released approximately 5.98 million litres of product due to tank car damage. The released product ignited almost immediately, resulting in a large pool fire that burned for more than a day. Forty-seven people were fatally injured.

Many buildings, vehicles, and the railway tracks were destroyed. About 2000 people were initially evacuated from the surrounding area.

As part of the Lac-Mégantic investigation,^{Footnote 68} the TSB highlighted the vulnerabilities of Class 111 tank cars and recommended that:

The Department of Transport and the Pipeline and Hazardous Materials Safety Administration require that all Class 111 tank cars used to transport flammable liquids meet enhanced protection standards that significantly reduce the risk of product loss when these cars are involved in accidents.
Transportation Safety Recommendation R14-01

1.27 Response from Transport Canada to TSB Recommendation R14-01 (January 2016)

On 23 April 2014, TC announced a 3-year phase-out of older, less crash-resistant Class 111 tank cars. On 02 July 2014, the TP 14877 standard was adopted by reference in the Transportation of Dangerous Goods Regulations, aligning Canadian regulations with the 2011 AAR CPC-1232 standard.

In May 2015, TC published in the Canada Gazette, Part II, the Regulations Amending the Transportation of Dangerous Goods Regulations (TC 117 Tank Cars). These regulations established the requirements for a new flammable liquid tank car standard (TC-117), as well as retrofit requirements for older DOT-111 and CPC-1232 tank cars in flammable liquid service. They also established implementation timelines to modernize the Canadian tank car fleet. The standards and timelines were generally harmonized with the U.S. regulators, Pipeline and Hazardous Materials Safety Administration, the Federal Railroad Administration and the Department of Transportation. With the coming into force of its recent Fixing America's Surface Transportation (FAST) Act, the U.S. has further harmonized with the Canadian requirements.

The Canadian regulations require that all new tank cars built for the transport of flammable liquids be constructed using thicker and more impact-resistant steel, and be equipped with jacketed thermal protection, full-height head shields, top fittings protection, improved bottom outlet valves, and appropriate pressure relief devices.

TC continues to work with the Canadian railway industry to consider braking provisions, such as electronically controlled pneumatic (ECP) brakes, in train operating rules rather than considering such braking provisions within the requirements of the TC-117 tank car standard. TC is also closely following the new requirements brought forward by the U.S. FAST Act, which imposed new research requirements before ECP braking can be brought into effect in the U.S.

With the ongoing low world demand for crude oil, and its associated low world price, the transport of crude oil by rail has slowed, and consequently, so has tank car demand. Shippers and builders have used this low-demand cycle to better assess fleet usage, tank car demand, and retrofit requirements. With the coming into force of the U.S. FAST Act, which brings U.S. requirements further in line with Canadian requirements, industry has begun to ramp up the retrofitting of DOT-111 tank cars in flammable liquid service.

On 24 July 2016, TC issued Protective Direction No. 38, which moved ahead the date of compliance for limiting the use of legacy DOT‑111 tank cars as outlined in Regulations Amending the Transportation of Dangerous Goods Regulations (TC 117 Tank Cars). The date that both unjacketed and jacketed legacy DOT‑111 tank cars will be phased out was moved ahead to 01 November 2016 from 01 May 2017 and 01 March 2018 respectively. Protective Direction No. 38 applies only to crude oil defined within the protective direction as:

• Petroleum crude oil (UN 1267)
• Petroleum distillates N.O.S., or Petroleum products N.O.S. that is crude oil (UN 1268)
• Petroleum sour crude oil, flammable, toxic (UN 3494)

1.28 Board assessment of Transport Canada's response to TSB Recommendation R14-01 (March 2016)

In March 2016, the Board assessed TC's response to Recommendation R14-01. The Board acknowledged TC's commitment and progress made on the publication of the new tank car standards and the updating of TP 14877. The Board noted the progress made on the construction of new TC-117 tank cars and the retrofitting of older flammable liquid tank cars. Given TC's progress made on this issue, its ongoing monitoring, and its intention to fully enforce the phase-out retrofit timelines, the Board reassessed the response to Recommendation R14-01 as having Satisfactory Intent.

However, until all flammable liquids are transported in tank cars built sufficiently robust to prevent catastrophic failure when involved in an accident, the risk will remain high. Therefore, the Board called upon TC to ensure that risk control measures during the transition are managed effectively.

1.29 Association of American Railroads Circular OT-55-N and TSB Recommendation R14-02

In January 1990, based on recommendations of the Inter-Industry Task Force on the Safe Transportation of Hazardous Materials by Rail, the AAR issued Circular OT-55 (OT-55), entitled Recommended Railroad Operating Practices for Transportation of Hazardous Materials. OT‑55 provided the rail industry with routing guidance for selected DGs, including poisonous-by-inhalation (PIH) and toxic-by-inhalation (TIH) products. Radioactive materials were added to OT-55 in August 2001. In addition, OT-55 identified the technical and handling requirements for key trains and key routes.

Following the Lac-Mégantic accident, the definition of a key train was revised^{Footnote 69} within OT‑55‑N to include any train containing 1 or more cars of PIH or TIH material, such as anhydrous ammonia, ammonia solutions, spent nuclear fuel or high-level radioactive waste, or containing 20 carloads or intermodal tank loads of any combination of other HAZMAT.

Although OT-55-N was not applicable in Canada, CN extended these measures to its Canadian operations, in August 2013. As part of a company initiative, CN conducted risk assessments for subdivisions within corridors identified as key routes.

As part of the investigation into the Lac-Mégantic accident, the TSB indicated that a similar approach based on OT-55-N, strengthened with a requirement to conduct route planning and analysis, would be a positive step to improve the safety of transporting DG by rail for all railways in Canada. On 23 January 2014, the Board recommended that:

The Department of Transport set stringent criteria for the operation of trains carrying dangerous goods, and require railway companies to conduct route planning and analysis as well as perform periodic risk assessments to ensure that risk control measures work.
Transportation Safety Recommendation R14-02

1.30 Response from Transport Canada to TSB Recommendation R14-02 (January 2016)

On 23 April 2014, TC issued Ministerial Order (MO) 14-01 requiring all railway companies and local railway companies to formulate and revise rules respecting the transportation of DGs. The rules were to be filed with the Minister of Transport no later than 23 October 2014.

At the same time, TC issued an Emergency Directive requiring railways carrying DGs to implement minimum operating practices for key trains to address the Board's recommendation, and to manage the immediate safety issue by, among other things, implementing speed restrictions for trains carrying DGs, expanding the inspection requirements on restricted rail routes, and completing risk assessments for key routes. The emergency directive was put in place for 6 months, and was renewed every 6 months to allow further consultation with stakeholders, which included unions and the Federation of Canadian Municipalities, and to reflect consideration of any additional U.S. requirements that may be established.

With respect to the 10 000-carload threshold, it was adopted based on the criteria outlined in the AAR Circular OT‑55‑N, which was also adopted by U.S. railways. TC recognizes that further analysis must be performed to determine a carload threshold that would optimize the safe transportation of DGs, which may lead to more stringent criteria for key routes. TC has contracted a third-party expert to conduct the necessary analysis to determine the appropriate threshold criteria. The project, which is led by TC's Transportation Development Centre,  will determine the appropriate threshold criteria for key routes. The Transportation Development Centre completed the project in December 2016, and TC is currently reviewing the results.

TC is also considering whether to expand the current criteria that define key trains by introducing requirements for technology that could enhance braking capability. Moreover, through the Risk-Based Planning process, TC will review all federally regulated railways to identify those that transport crude oil, but did not meet the 10 000-tank car threshold on their routes. Through this risk-based approach, TC has assigned appropriate resources to further monitor these railway operators.

The Railway Safety Management System Regulations, 2015, published in the Canada Gazette, Part II, on 25 February 2015 and in force on 01 April 2015, contain requirements for a risk assessment process. Under Section 15 of the regulations, a railway company must conduct a risk assessment when it proposes to begin transporting DGs, or to begin transporting DGs different from those it already transports, or when there is a proposed change to its railway operations. Changes in railway operations include a change that may affect the safety of the public or personnel, or the protection of property or the environment, such as an increase in the volume of DGs it transports and a change to the route on which DGs are transported.

1.31 Board assessment of Transport Canada's response to TSB Recommendation R14-02 (March 2016)

In March 2016, the Board assessed TC's response to Recommendation R14-02. The Board noted that TC has made progress on this issue, including more stringent risk assessment criteria for railways handling DGs, the ongoing analysis to determine the appropriate threshold criteria on key routes, and the recent promulgation of Rules Respecting Key Trains and Key Routes. Given this progress, the Board considers the risks associated with a catastrophic DG release or explosion to have been reduced. While some progress has been made on the railways that have identified key routes, analysis of the appropriate threshold criteria for key routes must still be performed. Therefore, the Board reassessed the response to Recommendation R14-02 as having Satisfactory Intent.

1.32 Rules Respecting Key Trains and Key Routes

In response to TSB Recommendation R14-02, in April 2014, TC issued MO 14-01, which defined criteria used for identifying key trains and key routes. MO 14‑01 required railways to

• formulate rules respecting the safe and secure operations of trains carrying certain dangerous goods and flammable liquids
• govern the route and speed of any Key Train to 50 mph or lower, including but not limited to a further speed restriction to 40 mph or lower for any Key Train transporting one or more Class 111 loaded tank cars containing a number of selected DGs, which included petroleum crude oil and petroleum distillates, in areas identified as higher risk through a risk assessment process
• conduct risk assessments and periodic updates based on significant change to determine the level of risk associated with each Key Route over which a Key Train is operated.^{Footnote 70}

The MO was re-issued a number of times to provide time for consultation and the development of industry rules. Once the rules were finalized, the MO was lifted. The Rules Respecting Key Trains and Key Routes were approved by TC, and came into effect in February 2016. Subsections 4.1 and 4.2 of the rules read as follows:

• 4.1 Companies must restrict Key Trains to a maximum speed of 50 miles per hour (MPH). Companies must further restrict Key Trains to a maximum speed of 40 MPH within the core and secondary core of Census Metropolitan Areas (CMA).[^{Footnote 71}]
• 4.2 Companies must restrict Key Trains transporting one or more DOT-111 loaded tank cars containing UN1170 ETHANOL, UN1202 DIESEL FUEL, UN1203 GASOLINE, UN 1267 PETROLEUM CRUDE OIL, UN 1268 PETROLEUM DISTILLATES, N.O.S., UN1863 FUEL, AVIATION, TURBINE ENGINE, UN1993 FLAMMABLE LIQUID, N.O.S., UN3295 HYDROCARBONS, LIQUID, N.O.S., UN1987 ALCOHOLS N.O.S., UN3494 PETROLEUM SOUR CRUDE OIL, FLAMMABLE, TOXIC or UN3475 ETHANOL AND GASOLINE MIXTURE to a maximum speed of 40 MPH in areas identified as higher risk through the risk assessment process as required under item 6 of this Rule. The DOT-111 tank cars include those that are CPC-1232 specification.[^{Footnote 72}]

With respect to the speed restriction of 40 mph for a unit train hauling Class 3 flammable liquids, no detailed engineering analysis had been performed to assess the effect of the speed reduction on the severity of a derailment.

1.33 Canadian National Railway corridor risk assessment

On 23 June 2014, in compliance with MO 14-01, CN submitted a risk assessment to TC for the transport of DGs on the Winnipeg–Toronto key route. The risk assessment evaluated each subdivision on the territory to assess areas of vulnerability in terms of

• the measures in place to prevent an occurrence (i.e., coverage of wayside inspection systems);
• the potential consequences associated with an occurrence (i.e. proximity to population centres and environmentally sensitive areas); and
• the ability to respond to an occurrence (i.e., locations of personnel and materials to respond to a spill).

With respect to the Ruel Subdivision, most of the required mitigations identified by the corridor risk assessment were related to the ability to respond to an emergency involving DGs, such as the need for caches of response equipment on the territory, and the need to evaluate contractor coverage for emergency response.

Similarly, the risk assessment factored key trains that haul Class 2.3 DGs (toxic gases) into the assessment as well as train movements where 20 or more loaded tank cars or loaded intermodal tanks containing DGs are shipped.

The corridor risk assessment did not factor current or projected future track conditions into the risk assessment process. Furthermore, it did not anticipate the increase in the transport of crude oil or the impact of the increased tonnage on the ability to maintain adequate infrastructure safety margins.

1.34 Factors affecting the severity of derailment of tank cars carrying hazardous materials

A 1992 study entitled Hazardous Materials Car Placement in a Train Consist reviewed a number of National Transportation Safety Board (NTSB) derailment investigations and Federal Railroad Administration train accident data. At the time of the study, unit trains of Class 3 flammable liquid DGs were virtually non-existent, and Class 111 tank cars were limited to a gross rail load (GRL) capacity of 263 000 pounds. No unit DG trains were included in the study. The study concluded (in part) that

2. Railroad accident data confirms that, on the average, more cars are derailed in longer trains. To enhance hazmat transportation safety, hazmat cars should therefore be handled in somewhat shorter trains, even though it is recognized that this will result in more trains and possibly increased exposure. Exposure is, of course, route dependent and must be assessed accordingly.
3. Railroad accident data also confirm that, on the average, more cars are derailed in trains at higher speeds. Hazmat cars should therefore be handled at somewhat more restricted speeds. Modest speed reductions may not necessarily result in increased exposure. This is again route dependent.^{Footnote 73}

While not referenced specifically in the study, the weight of the cars involved in any derailment would also contribute to the severity of the accident.

Other more recent studies, summarized in 2014,^{Footnote 74} have shown that the number of cars derailed is influenced by accident cause, train speed, train length, and point of derailment within a train. Specifically, broken rails result in more cars derailing than any other accident cause; higher-speed derailments result in more cars derailed; longer trains have more cars derail; and the closer a derailment occurs to the front of a train, the more cars derail.

1.35 TSB Laboratory examination of the failed insulated joint

The failed insulated joint was sent to the TSB Laboratory for detailed examination. It was determined that:

• The running surface of the parent rail showed REB with an average depth of 2.4 mm, with the deepest region approximately 4.4 mm below the running surface of the rail (Figure 4).
• Visual examination of the fractures showed fatigue cracking initiating at the upper fishing surface (the mating surface between the top of the joint bars and the underside of the rail head) on the top of both joint bars.
• Fatigue cracking propagated vertically downward for approximately 20% of the joint bar cross-sectional area before transitioning to overstress rupture (Figure 5).
• Corrosion pits were also observed on the fishing surfaces along the top edge of the joint bars adjacent to the fracture initiation sites.
• The fatigue fracture origins coincided with corrosion pitting observed on the outer surfaces.

Image

Image

• Little if any of the insulating glue remained between the top of the joint bars and the underside of the rail head.
• Secondary cracks were observed at the bottom of each joint bar below the bolt hole closest to the fracture, and on the gauge-side joint bar at the outboard lower corner of the bar. The secondary cracks displayed fatigue cracking.
• The rail head had also showed crushing, primarily to the field side, for approximately 200 mm from the rail end.
• The joint bar material met the specified strength requirements.

1.36 TSB testing of crude oil samples

Table 6 provides a summary of the shipping information on the transportation of DGs pertinent to the tank cars in the occurrence train.

Table 6. Tank car lading information

Tank car location in train	Shipping description under the Transportation of Dangerous Goods Act				Information on safety data sheet
	Product identification number	Proper shipping name	Hazard class	Packing group	Product name	Synonyms	Manufacturer
1 to 58 71 to 80	UN 1267	Petroleum Crude Oil	3	I	Horizon Sweet Light Oil	Synthetic crude oil distillate; Sweet light oil	Canadian Natural Resources Ltd., Calgary AB
59 to 70 81 to 100	UN 1268	Petroleum Distillates N.O.S. (Syncrude SYN)	3	I	Synthetic Crude Oil	Syncrude Sweet Premium; SSB; SSP; SYN; Syncrude sample tag #200000	Canadian Oil Sands Partnership #1, Calgary AB

Product samples (Photo 3) were taken from 3 representative non-derailed tank cars.

Image

The samples were collected on 23 February 2015 at the Valero refinery in Lévis, Quebec, under the direction of a TSB investigator. Prior to the collection of samples, the respective tank car hatches were opened and a gas test was performed in the work environment around the hatch of each car using a portable multi-gas detector, able to detect 6 gases. The test results indicated that the work environment was adequate to work in without respiratory protection.

All crude oil samples were collected at atmospheric pressure. The samples were tested for characteristics relevant to the classification of the petroleum crude oil and to its behaviour and effects during the post-accident spill and fire. The product samples were split and sent to 2 accredited external laboratories for testing. Table 7 lists the tests performed on each sample.

Table 7. Tests performed on crude oil samples

Parameter	Test method
Flash point temperature	ASTM D3828-12a Standard Test Methods for Flash Point by Small Scale Closed Cup Tester - Method B
Boiling point distribution	ASTM D2887-14 Standard Test Method for Boiling Range Distribution of Petroleum Fractions by Gas Chromatography
	ASTM D86-12 Standard Test Method for Distillation of Petroleum Products at Atmospheric Pressure
Density	ASTM D5002-13 Standard Test Method for Density and Relative Density of Crude Oils by Digital Density Analyzer
Reid vapour pressure	ASTM D323-15a Standard Test Method for Vapor Pressure of Petroleum Products (Reid Method)
Sulphur content	ASTM D4294-10 Standard Test Method for Sulfur in Petroleum and Petroleum Products by Energy Dispersive X-ray Fluorescence Spectrometry
Viscosity	ASTM D7042-14 Standard Test Method for Dynamic Viscosity and Density of Liquids by Stabinger Viscometer (and the Calculation of Kinematic Viscosity)

The material safety data sheet (MSDS) for synthetic crude oil describes this product as a low sulphur blend of treated naphtha (16% to 20%), light gas oil (34% to 48%) and heavy gas oil (30% to 45%) petroleum fractions derived from bitumen, with a boiling range of −20 °C to 560 °C and a flash point of less than 20 °C. The MSDS for Horizon sweet light crude oil described the product as a complex mixture of hydrocarbons derived from primary distillation of petroleum crude oil with an initial boiling point of less than 35 °C and flash point of less than −20 °C.

The test results obtained for the occurrence products were compared with published values for various other petroleum products (able 8). These published values were taken from the 2014 Crude Characteristics Booklet,^{Footnote 75} which contained a summary of selected properties of petroleum products moved in the Enbridge Pipelines/Enbridge Energy Partners system. Representative test results for the Bakken crude oil involved in the Lac-Mégantic derailment (TSB Investigation Report R13D0054) were also included for comparison purposes.

Table 8. Comparison of occurrence product sample test results and published oil properties

Source	Product identifier	Total sulphur (mass %)	Reid vapour pressure (kPa)	Density (kg/m3)	Viscosity (cSt) at temperature
					20 °C	30 °C	40 °C
Occurrence test results*	Horizon Sweet Light Oil (VMSX 310192)	0.081	24.2	846.9	3.616	2.968	2.419
	Synthetic Crude Oil (VMSX 310351)	0.157	31.6	867.3	7.899	5.914	4.544
2014 Crude Characteristics Booklet	CNS**	0.03	31.4	841.5	3.39	2.73	2.26
	SP***	0.17	28.6	860.4	8.34	6.12	4.69
	WCB (Western Canada Blend)****	3.03	32.1	927.5	155	88.3	54.8
Lac-Mégantic (R13D0054) test results*****	PROX44211-C-TOP	0.117	62.3	821.9	3.259	2.665	2.230
*   For simplicity, only sample VMSX 310192 is shown in Table 8 because sample VMSX 310187 gave similar results. **   CNS is the product identifier for light sweet synthetic Crude oil produced from the Canadian Natural Resources Ltd. Horizon Project. ***   SP is the product identifier for Syncrude Sweet Premium produced from the Syncrude Canada Project. ****   The National Energy Board Act Part IV (Oil and Gas) Regulations define "heavy crude oil" as oil that has a density greater than 875.7 kg/m³. *****   TSB Engineering Report LP148/2013 Analysis of Crude Oil Samples.

The product testing and comparisons revealed the following:

• Despite the minor differences in test results, it was considered that the products had similar chemical and physical properties.
• The test results were consistent with the product information provided in the MSDS and industry-published values for each type of products.
• The products were appropriately classified.
• As was expected, the density and viscosity of the products were significantly lower than those of heavy crude oils, such as the WCB product.
• The products exhibited somewhat lower vapour pressure than but similar density, viscosity and volatility to that of the Bakken Shale crude oil involved in the Lac-Mégantic occurrence.
• The large quantities of spilled product, the rapid rate of release of the product, and the high volatility and low viscosity of both products were major contributors to the large post-derailment pool fires.

1.37 Tank car information

Historically, most legacy Class 111 tank cars were built with a GRL capacity of 263 000 pounds. In the mid-1990s, the industry began moving towards a Class 111 tank car with a GRL capacity of 286 000 pounds.

In the late 1990s, TC, the DOT, and the AAR established a number of requirements for tank car GRL to be increased to 286 000 pounds. The requirements included increased puncture resistance for the tank heads and shells, increased design loads, and enhanced protection of service equipment. These requirements were further incorporated into TC and AAR standards for tank cars with a GRL of 286 000 pounds. However, these requirements did not apply to the majority of Class 111 tank cars at the time, which had a GRL of 263 000 pounds. The next step was to address the cars with a GRL of 263 000 pounds.

In 2011, the AAR CPC-1232 tank car standards were established. These standards incorporated a number of enhancements to all Class 111 tank cars built after 01 October 2011 for the transportation of petroleum crude oil and ethanol (Class 3 PG I or PG II). These enhancements included the construction of tank cars to 286 000 pound standards, protection of the service equipment on the top shell, the use of reclosing pressure relief devices (PRD), the use of normalized steel for tank shells and tank heads, an increased minimum thickness for all tank cars that were not jacketed and insulated, and at least ½ inch thick half-head shields.

For Canada, the specifications applicable to tank cars built before December 2013 were listed in TC safety standard CAN/CGSB-43.147.^{Footnote 76} For tank cars built after December 2013, TC TDG tank specification TP 14877 applied.^{Footnote 77} Other applicable specifications were the Code of Federal Regulations Title 49 (49 CFR), paragraph 179.200^{Footnote 78} for the U.S., and the industry Casualty Prevention Circular No. CPC-1232 (CPC-1232) standard.^{Footnote 79}

TC later incorporated these requirements into the Regulations Amending the Transportation of Dangerous Goods Regulations (TC-117 Tank Cars) which allowed Class 111 tank cars constructed to CPC-1232 requirements to be used in the interim to transport flammable liquids until the TC-117 tank car became mandatory.

Following the Lac-Mégantic derailment (TSB Railway Investigation Report R13D0054), the rail industry believed that Class 111 tank cars constructed to the CPC-1232 standard would provide enhanced protection for Class 3 products compared to legacy Class 111 tank cars.^{Footnote 80}

Current crude oil unit train tank cars are usually all loaded to 286 000 pounds. In comparison, mixed merchandise and intermodal trains generally transport freight cars that have a lower GRL capacity. In 2014, the average crude oil unit train measured approximately 6000 feet in length and weighed about 13 000 tons, which is considered a very heavy train relative to its length. In comparison, a 13 000 ton mixed merchandise or intermodal train would typically range from about 9000 feet to 12 000 feet in length.

Figure 6 identifies the primary components on a Class 111 tank car.

Image

All 100 tank cars in the occurrence train were constructed for and owned by Valero, which was also the product shipper and consignee. The tank cars were loaded at the Pembina Redwater terminal facility in Redwater, Alberta, and were carrying product destined for Valero's refinery in Lévis, Quebec. All of the derailed tank cars were built within 3 years prior to the accident by Trinity Tank Car Inc., manufactured to U.S. DOT specification 111A100W1, and compliant with the industry's CPC-1232 standard.

The tank car heads and shells were made of AAR TC-128 Grade B normalized steel.^{Footnote 81} All head shields were constructed of ½-inch thick ASTM A572 Grade 50 steel plate. The 15th (VMSX 5112) and the 18th (VMSX 280529) cars were equipped with full-height head shields, jackets and insulation. The remaining tank cars were non-jacketed and non-insulated, and equipped with trapezoidal half-head shields. All of the tank cars had type TRN 024 stub sills, except for the 15th tank car, which had a type TRN 023 stub sill.

The tank cars were equipped with a 4-inch bottom outlet valve (BOV), top fittings (vacuum relief, 2-inch, and 3-inch ball valves) within a protective 20-inch multi-housing assembly, a hinged and bolted manway and a PRD. The PRD was fitted within the multi-housing assembly.

Table 9 summarizes some of the pertinent construction details for the 29 derailed tank cars.

Table 9. Information about the construction of the derailed tank cars

Car location in train from head-end*	Tank car number	Date certificate of construction approved	Head/shell thickness (inch)	Head shield	Jacket –insulation	Pressure relief device
						Start-to-discharge pressure (psig)	Actual flow capacity** (scfm)***
7	VMSX 310740	Jul 2014	1/2	Half shield	None	75	27 000
8	VMSX 311903	Feb 2013	1/2	Half shield	None	75	27 000
9	VMSX 310400	Jul 2014	1/2	Half shield	None	75	27 000
10	VMSX 311809	Jul 2014	1/2	Half shield	None	75	27 000
11	VMSX 310404	Jul 2014	1/2	Half shield	None	75	27 000
12	VMSX 310872	Jul 2014	1/2	Half shield	None	75	27 000
13	VMSX 311626	Jul 2014	1/2	Half shield	None	75	27 000
14	VMSX 310095	Feb 2013	1/2	Half shield	None	165	35 608
15	VMSX 5112	Aug 2013	7/16	Full shield	Steel – 4‑inch glass wool	165	2329
16	VMSX 310838	Jul 2014	1/2	Half shield	None	75	27 000
17	VMSX 311634	Jul 2014	1/2	Half shield	None	75	27 000
18	VMSX 280529	Sep 2014	7/16	Full shield	Steel – 4‑inch glass wool	165	2 329
19	VMSX 310274	Jul 2014	1/2	Half shield	None	75	27 000
20	VMSX 311644	Jul 2014	1/2	Half shield	None	75	27 000
21	VMSX 311725	Jul 2014	1/2	Half shield	None	75	27 000
22	VMSX 311643	Jul 2014	1/2	Half shield	None	75	27 000
23	VMSX 310432	Jul 2014	1/2	Half shield	None	75	27 000
24	VMSX 310438	Jul 2014	1/2	Half shield	None	75	27 000
25	VMSX 310486	Jul 2014	1/2	Half shield	None	75	27 000
26	VMSX 311851	Jul 2014	1/2	Half shield	None	75	27 000
27	VMSX 311824	Jul 2014	1/2	Half shield	None	75	27 000
28	VMSX 310054	Feb 2013	1/2	Half shield	None	165	35 608
29	VMSX 311892	Jul 2014	1/2	Half shield	None	75	27 000
30	VMSX 310173	Feb 2013	1/2	Half shield	None	165	35 608
31	VMSX 311629	Jul 2014	1/2	Half shield	None	75	27 000
32	VMSX 310767	Jul 2014	1/2	Half shield	None	75	27 000
33	VMSX 310091	Feb 2013	1/2	Half shield	None	165	35 608
34	VMSX 311962	Feb 2013	1/2	Half shield	None	75	27 000
35	VMSX 311906	Feb 2013	1/2	Half shield	None	75	27 000
*   Throughout the report, tank cars are identified by their position in consist number. **   Note that the required flow capacity differs for non-insulated, insulated, or thermally protected tank cars. ***   Standard cubic feet per minute.

1.38 Site examination of derailed tank cars

Aerial photo-documentation of the derailment zone was performed before the post-derailment fire had been extinguished. Consequently, some of the derailment zone was obscured by smoke, which increased the difficulty of documenting the site through aerial photographs. However, TSB investigators were able to examine the site and photograph most of the tank cars in situ while emergency responders dealt with the fire.

Once the fire was extinguished, the remaining product was removed from the tank cars. The tank cars were then moved to a staging area for cleaning and purging, in preparation for site examination. Tank car examination was conducted by CN, the TSB, and representatives of the tank car manufacturer.

All of the derailed tank cars were in compliance with specification requirement CPC-1232 that was in effect at the time of their approval and construction. During the site examination, test coupons of tank car material were collected from selected tank cars for metallurgical examination. The test coupons were sent to the TSB Laboratory for detailed examination.

1.38.1 Tank car breaches

Table 10 provides a summary of the types of breaches observed on each derailed tank car.

Table 10. Breaches observed on each tank car

Car location in train from head-end	Tank car number	Type of breach
		Head	Shell	Top fittings and pressure relief devices	Manway	Bottom outlet valve	Thermal tear
7	VMSX 310740
8	VMSX 311903
9	VMSX 310400
10	VMSX 311809						Breach
11	VMSX 310404						Breach
12	VMSX 310872						Breach
13	VMSX 311626		Split in 2
14	VMSX 310095	Breach					Breach
15	VMSX 5112 Insulated		Breach
16	VMSX 310838				Breach	Breach
17	VMSX 311634						Breach
18	VMSX 280529 Insulated					Breach
19	VMSX 310274			Breach
20	VMSX 311644		Breach
21	VMSX 311725		Breach				Breach
22	VMSX 311643						Breach
23	VMSX 310432		Split in 2
24	VMSX 310438		Breach			Breach
25	VMSX 310486		Breach	Breach
26	VMSX 311851		Split in 2
27	VMSX 311824					Breach
28	VMSX 310054	Breach	Breach
29	VMSX 311892
30	VMSX 310173
31	VMSX 311629
32	VMSX 310767
33	VMSX 310091
34	VMSX 311962
35	VMSX 311906

With regard to tank car breaches, the following general observations were made:

• Of the 29 derailed tank cars, 19 (66%) were breached and released various amounts of product.
• Three of the tank cars (the 13th, 23rd and 26th cars) had separated completely into 2 portions. The fractures of these 3 tank cars exhibited brittle characteristics.
• Of the 19 damaged tank cars, 6 sustained more than 1 type of breach.
• Product release from the smaller breaches, while not instantaneous, helped feed the pool fire and contributed to spillage of product after the fire was extinguished.

1.38.2 Damage to tank car shell

Nine tank cars released product as a result of shell breaches caused by collision damage. Of the 9 shell breaches, 8 (89%) were of medium to large size, which facilitated the rapid release of a large volume of product and subsequent pool fire. Consequently, the shell breaches were the most important contributor to the release of product in terms of their size and the number of cars affected.

Since only 2 of the subject cars were jacketed and insulated, most tank car shells were exposed directly to some form of impact. Consequently,  all of the derailed tank car shells, with the exception of the 9th, 10th, 11th, 34th, and 35th cars, exhibited some form of impact damage. The damage observed ranged from minor dents and scratches to deep localized dents and large-scale transverse buckling and crushing. The impact damage was considered indicative of collisions with objects ranging from small, relatively sharp objects (couplers, trucks) to large, blunt objects (the head of another car).

1.38.3 Thermal damage

Thermal damage occurs when a tank car is exposed to a post-derailment fire. Heat-induced (thermal) tears usually occur in loaded tank cars when they are exposed to a fire and the PRD or other tank breaches are unable to vent the rising internal pressure. This can result in an energetic rupture of the tank. When Class 3 flammable liquids are involved, the sudden release of the pent-up pressure usually results in the loss of lading as a large fireball and subsequent fire within the tank that often burns off remaining product to atmosphere. Tank ruptures caused by overheating generally fracture longitudinally along an axis that is perpendicular to the hoop stress in the tank shell.

Of the 27 tank cars inspected by the TSB, 21 (78%) exhibited damage indicating that they were exposed to the post-derailment fire. The fire damage ranged from scorched paint to changes in surface carbon content and external oxidation, consistent with exposure to crude oil and air at elevated temperature. No perforation caused by fire damage (burn-through) was observed in any of the subject cars.

The examination revealed the following:

• Seven tank cars sustained breaches due to thermal tears resulting from exposure to post-derailment fires.
• Of the 7 tank cars with thermal tears, 5 (the 10th, 11th, 12th, 17th, and 22nd cars) had no other breaches that might have contributed to the release of internal pressure.
• Of the 7 tank cars with thermal tears, 2 (the 14th and 21st cars) had additional breaches: a head breach and a shell breach, respectively.
• The thermal tears ranged in size from less than 1 foot to 16 feet. It was reported that all of the tank cars with thermal tears had lost their entire load, except for the 14th car, which had a thermal tear in its B-end head.
• After shell breaches, thermal tears were the second most important contributor to the release of product in terms of their size and number of cars affected.
• It has been suggested previously that PRDs with higher start-to-discharge pressure might pose a risk of building up excessive internal pressure during a fire, thus resulting in more energetic thermal tears. On tank cars equipped with a PRD of 75 pounds per square inch gauge (psig), thermal tear length ranged from less than 1 foot to 16 feet, while a 4-foot-long thermal tear was observed in the 14th car, which had a 165-psig PRD. Therefore, there was no evidence to support the hypothesis that PRDs with higher start-to-discharge pressure resulted in more energetic (larger) thermal tears.
• The 15th and 18th cars were fitted with a jacket and 4-inch-thick glass wool insulation. Neither of the 2 jacketed/insulated cars sustained a thermal tear, although both were exposed to the post-derailment fire. However, both of these cars had other breaches, which likely provided a release for the internal pressure in these cars. Consequently, the extent to which the jacket and insulation were effective in delaying the internal build-up of pressure could not be determined.

1.38.4 Damage to head shield and tank head

Of the 27 derailed tank cars inspected by the TSB:

• 23 (85%) had some form of collision damage to their head shields.
• 8 (30%) were missing one head shield and 3 (11%) tank cars had lost both head shields. Most head shields separated due to broken attachment brackets.
• 17 (63%) exhibited dents in one or both tank heads.
• 2 cars (the 14th and 28th cars) sustained a breached head due to impact damage.

The examination results suggest that the trapezoidal half-head shields and full-height head shields fitted on the CPC-1232 tank cars were generally effective in protecting the heads against impact punctures during the derailment.

1.38.5 Damage to top fittings and pressure relief devices

About half of the tank cars exhibited some form of impact damage to their protective housing. The protective housing on 2 of the cars (the 19th and 25th cars) was missing, and all of the fittings and PRD were sheared off. More specifically:

• The 19th car did not exhibit any other breach. While its orientation in the pileup was unknown, this tank car reportedly lost its entire load. Given the circumstances, it is likely that the car was oriented in such a way that product flowed from the damaged top fittings and PRD to feed the pool fire.
• The 25th car came to rest upright with a large shell puncture near the top fitting nozzle, and the car reportedly lost part of its load. It is likely that the product loss resulted from the combined release from the breached shell, top fittings, and PRD.

1.38.6 Damage to manways

The derailed cars were equipped with hinged and bolted manway covers. On most tank cars, the manway cover was closed, and no impact damage was observed on the hinge or eyebolts. None of the manway covers had separated as a result of impact.

The manway covers of the 25th and 26th tank cars were open, with some eyebolts missing or broken. These cars also each had a large shell breach, which indicated that they had experienced large collision forces during the accident. It was not determined whether the manway covers were opened during the accident or during site remediation operations.

The manway cover of the 16th car was closed but the hinge was broken, the nozzle was cracked, and several eyebolts were disengaged. Burnt product residue was observed in the gap between the cover and the nozzle. Because this tank car came to rest on its left side, product likely flowed from the breached manway. This car also had a breached BOV, and reportedly lost part of its load.

1.38.7 Damage to skid protection and bottom outlet valves

The BOV skid protection on 8 cars had experienced some form of impact damage. This ranged from deformation of the skid assembly caused by impact or crushing, to a broken skid or separated skid-to-shell welds, or a combination of both. Overall, the tank cars with damaged skids also had extensive shell deformation in the vicinity of the skid, indicating that they had been subjected to large collision forces.

The AAR requires that "bottom outlet valve handles, unless stowed separately, […] be designed to either bend or break free on impact, or the handle in the closed position must be located above the bottom surface of the skid."^{Footnote 82} In this occurrence, the BOV handle assembly and securement mechanism of 13 tank cars experienced some form of impact damage. This damage ranged from impact-related deformation to complete separation of the handle assembly and securement mechanism.

The BOV adaptor was sheared off at the mounting flange (the intended breaking point) of 9 cars (the 13th, 16th, 18th, 19th, 21st, 24th, 26th, 27th and 28th cars) which caused their BOV ball to be exposed. With the exception of the 13th and 28th cars, these cars also had impact-damaged or missing BOV handles.

The 16th, 18th, 24th, and 27th tank cars were breached from impact-damaged BOVs. On 3 of these 4 tank cars (the 16th, 18th and 24th cars), the exposed BOV ball was partially open or visibly leaking product. If the top fittings and the BOV are compromised, the fitting that comes to rest in the highest position can act as a vent, which greatly increases the rate of flow from the other compromised appurtenance.

Two of the 4 tank cars also had another type of breach: for example, o the 16th car had a manway breach. Three of the cars released product as a result of BOV handle movement, which likely occurred during the derailment or site remediation. Specifically:

• The BOV adaptor on the 16th tank car (VMSX 310838) was sheared off, exposing the BOV ball. The BOV was leaking product. The BOV operating handle assembly and securement mechanism were deformed and pushed against the tank. The BOV ball had no fire damage, which suggests the adaptor was sheared off during remediation operations. The manway of this car was also leaking.
• The BOV adaptor on the 18th tank car (VMSX 280529) was sheared off. The BOV operating handle assembly had no visible impact damage, but it was unsecured, as the securement mechanism had separated. The exposed BOV ball was oxidized and partially open. The handle assembly had separated completely during site remediation, and the BOV ball was free to rotate. Although the BOV ball's original position after the derailment was not determined, it is considered most probable that product was released from the compromised BOV.
• The BOV adaptor on the 27th tank car (VMSX 311824) was sheared off. The BOV operating handle securement mechanism was extensively deformed from impact and the handle was unsecured. The condition of the exposed ball valve when the car came to rest could not be precisely determined. However, this car was positioned with the BOV pointing upwards during site remediation, and it was reported to have released some of its load during the derailment. This suggests that the release likely originated from the BOV.

The investigation into a 2013 derailment in White River, Ontario, involving pre–CPC-1232 Class 111 tank cars (TSB Investigation Report R13T0060) had previously identified this issue. TSB Rail Safety Advisory 15/13 was issued to TC to communicate the risk of product loss through BOV handles that are damaged during derailments. This risk was also identified during the investigation into the 2013 derailment of 63 Class 111 tank cars in Lac-Mégantic (TSB Investigation Report R13D0054).

1.38.7.1 National Transportation Safety Board recommendation regarding bottom outlet valves

Following an investigation into the 2009 derailment of a CN freight train Cherry Valley, Illinois (2009), the NTSB determined that "existing standards and regulations for the protection of bottom outlet valves on tank cars do not address the valves' operating mechanisms and therefore are insufficient to ensure that the valves remain closed during accidents."^{Footnote 83} The NTSB recommended that the Pipeline and Hazardous Materials Safety Administration:

Require that all bottom outlet valves used on newly manufactured and existing non-pressure tank cars are designed to remain closed during accidents in which the valve and operating handle are subjected to impact forces. (R12-6)^{Footnote 84}

1.38.8 Damage to stub sill

Tank car stub sills are prohibited from being attached directly to the tank shell. The AAR requires that reinforcement pads be attached to the tank shell and that the stub sills be attached to the reinforcement pads. The AAR also requires that the reinforcement pad be extended on either side of the sill attachment and at the head brace attachment.^{Footnote 85,Footnote 86} These requirements are intended to prevent product release by ensuring that, if a stub sill is overloaded, the separation occurs between the sill and the reinforcement pad, and does not propagate into the tank shell.

The majority of the derailed tank cars had at least 1 damaged stub sill or coupler assembly. The 23rd and 28th tank cars had stub sill damage that extended into the tank. Detailed examination revealed that:

• The 23rd tank car had a small crack that had started in the head brace-to-stub sill attachment weld, propagated into the front sill pad-to-head weld and subsequently into the A-end tank head. However, the small head crack is considered to be an insignificant source of release when compared to the large shell breach sustained by this tank car, as it had separated into 2 portions.
• The 28th tank car was breached as a result of impact-damaged A-end stub sill attachments. Test coupons were taken from the damaged stub sill areas for detailed examination at the TSB Laboratory to validate the stub sill design, and the following observations were made:
  • The A-end of the tank car experienced multiple elevated impacts during the accident.
  • A front sill pad had fractured and separated from the A-end tank head.
  • The fracture initiated in the front part of the sill pad in a ductile overstress mode and propagated through fillet welds that joined the sill pad to the tank head.
  • The fracture then propagated inboard through the fillet welds until it reached the longitudinal welds that join the bolster pads to the front sill pad.
  • The fracture then propagated into the tank shell, which resulted in a breach on both sides.
  • The shell and head fractures had a mostly brittle appearance.
  • The elevated multidirectional loading associated with the impacts likely exceeded the stub sill design criteria and caused the cracks to propagate from the front sill pad attachment welds into the shell and head in a low-energy (brittle) manner.

1.38.9 Tank shell material properties

Metallurgical testing was conducted on coupons taken from the 29th tank car (VMSX 311892), which was made of AAR TC128 Grade B normalized steel plates of the same vintage as the other derailed tank cars. It was determined that:

• The head and shell coupons met the applicable requirements for chemical composition and tensile properties.
• Because none of the derailed tank cars were specified for low-temperature service, there were no applicable impact energy absorption material requirements.
• Notwithstanding, Charpy V-notch impact energy results obtained for specimens tested at −45.6 °C (50 °F) indicate that the material satisfied the AAR's impact energy requirements for low-temperature service.
• Some tank cars exhibited ductile punctures, whereas others sustained brittle fractures consistent with low-energy crack propagation.
• During a collision, the strain rate and degree of stress triaxiality^{Footnote 87} prevalent at the fracture location can vary significantly depending on factors such as collision force, impact orientation and speed, and tank internal pressure.^{Footnote 88} It is well known that the tendency for brittle fracture of steel increases with an increase in the strain rate or in the degree of stress triaxiality.^{Footnote 89} Thus severe collision conditions that result in high strain rate or stress triaxiality may cause the tank material to behave in a more brittle manner than would be expected from the Charpy V-notch results.

1.38.9.1 Summary of tank car examination

The examination results determined that:

• The tank car head and shell material met the requirements for chemical composition and tensile properties of the specified AAR TC128 Grade B normalized steel.
• The head shields and top fitting protection on the CPC-1232 tank cars were generally effective in protecting the heads and appurtenances during the derailment.
• Some tank cars exhibited ductile punctures, whereas others sustained brittle fractures consistent with low-energy crack propagation.
• It is likely that the combined effects of the low ambient temperature and collision conditions produced a high strain rate and high degree of stress triaxiality at the fracture locations, which resulted in the brittle tank fractures observed.
• The performance of the Class 111 tank cars constructed to the CPC-1232 standard was considered to be similar to that of the legacy Class 111 tank cars examined during the TSB Lac-Mégantic investigation.^{Footnote 90}

1.38.9.2 Dangerous goods placards

The Transportation of Dangerous Goods Regulations require the class placard and UN identification number for the DGs contained in a tank car to be displayed on each side and on each end of the tank car.

All of the derailed tank cars were loaded with petroleum crude oil product (UN 1267). While most tank cars displayed the appropriate UN 1267 placard, placards on the 31st and 34th tank cars displayed UN 1268 (petroleum distillates). The DG safety marks displayed on these 2  cars did not meet federal regulations, as they incorrectly identified the product. In addition, 1 tank car displayed placards with mismatched UN numbers.

1.39 TSB safety issues investigations

In response to a series of train derailments on secondary main lines involving broken rails in the winter of 2003–2004, the TSB carried out a safety issues investigation.^{Footnote 91} The study established a significant relationship between rail defects and the level of bulk unit train traffic and found that the effect of increasing bulk train traffic had not been accommodated through regular maintenance. The same circumstances could also apply to mainline track. The study also identified that:

• Railways recognized that the rate of track degradation was accelerated with increases in bulk unit train tonnage. However, an appropriate balance between increased track degradation and timely infrastructure maintenance and/or renewal was not always achieved.
• Compliance with the TSR in and of itself was insufficient to ensure safety since it did not provide a means to anticipate changing conditions such as increased traffic over the long term.
• There was a need for more proactive SMS processes to anticipate operational conditions which could lead to a degradation of safety margins.

1.40 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

1.40.1 Safety management and oversight

Transportation companies have a responsibility to manage safety risks in their operations. SMS provides a framework to achieve this end, and many companies implement a formal SMS either voluntarily or to comply with TC's SMS Regulations. Even small companies need to have some safety processes in place to manage risk.

Some companies consider safety to be adequate as long as they are in compliance with regulatory requirements, but regulations alone cannot foresee all risks unique to a particular operation. That is why the TSB has repeatedly emphasized the advantages of SMS, an internationally recognized framework to allow companies to effectively manage risk and make operations safer.

The move toward an SMS regime must be supported by appropriate regulatory oversight. Given that regulators will encounter companies with varying degrees of ability or commitment to effectively manage risk, this oversight must be balanced. It needs to include proactive auditing of companies' safety management processes, ongoing education and training, and traditional inspections to ensure compliance with existing regulations.

Moving forward, 3 elements are key: a clear regulatory framework requiring companies to implement an SMS appropriate to the scope and size of its operations; SMS that are effective in identifying hazards and mitigating risks; and balanced regulatory oversight.

Previous TSB investigations have revealed some problems:

• Although all rail operators in Canada are required to have an SMS, the TSB has identified instances where SMS processes were weak or not used, resulting in hazards going unidentified and risk mitigations not being put in place.^{Footnote 92}
• With respect to TC regulatory oversight, 2 problems have been observed: a failure to identify companies' ineffective processes, and an imbalance between auditing processes versus traditional inspections.

To resolve these problems, companies that do have an SMS must demonstrate that it is working (i.e., that hazards are being identified and effective risk mitigation measures are being implemented). When companies are unable to effectively manage safety, TC must not only intervene, but do so in a manner that succeeds in changing unsafe operating practices.

1.40.2 Transportation of flammable liquids by rail

In November 2014, the TSB added "Transportation of flammable liquids by rail" to its Watchlist issues. This issue remained on TSB's Watchlist in 2016.

The transportation of crude oil by rail across North America increased exponentially starting in 2009, peaking in 2014 at 238 000 carloads in Canada^{Footnote 93} and 500 000 carloads in the United States.^{Footnote 94} Ethanol shipments, meanwhile, were relatively stable, with an average of 76 250 carloads per year in Canada and 331 000 carloads per year in the United States.^{Footnote 95} Despite recent downward trends, the volume of flammable liquids being transported by rail is expected to remain significant.

The TSB is concerned that current railway operating practices, combined with the vulnerability of older tank cars used to transport crude oil and other flammable liquids, are not adequate to mitigate effectively the risk posed by the transportation of large quantities of such dangerous goods by rail.

The vulnerability of Class 111 tank cars has been recognized for years.^{Footnote 96} The Board has called for tougher standards for all Class 111 tank cars^{Footnote 97}—not just new ones—to reduce the likelihood of product being released during accidents. A number of accidents investigated in the U.S. by the NTSB have also highlighted the vulnerability of Class 111 tank cars.^{Footnote 98}

The TSB is encouraged that federal regulators in Canada and the U.S. have taken considerable action to address the situation, including the promulgation of a more robust tank car standard (Class 117), retrofit provisions, implementation timelines, and regulatory monitoring and enforcement. The actions to date by the federal regulators and the railway industry have contributed to a significant decline in the use of legacy Class 111 tank cars to transport crude oil since 2014.

Although the federal regulators and the railway industry have taken actions with respect to tank car safety, federal regulations nonetheless allow Class 111 tank cars to be used for the transport of certain flammable liquids until mid-2025. Consequently, until all higher-risk flammable liquids in North America are transported in more robust tank cars with enhanced protection, an elevated risk will remain.

Since the Lac-Mégantic derailment in July 2013 (TSB Railway Investigation Report R13D0054), other recent derailments in Canada,^{Footnote 99} including this occurrence, have demonstrated that there can be significant risk to people, property, and the environment when trains carrying large volumes of flammable liquids derail.

These recent occurrences highlight the need for strategic route planning and safer operations of all trains carrying dangerous goods in Canada. Railways must carefully choose the routes on which crude oil and other flammable liquids are to be carried, and ensure that train operations over those routes will be safe. These risks must be dealt with as a North American transportation issue, because these products are transported across borders by rail operators.

To resolve these issues, railway companies must conduct thorough route planning and analysis, and perform risk assessments to ensure that risk-control measures are effective. Additionally, flammable liquids must be shipped in more robust tank cars to reduce the likelihood of a dangerous goods release during accidents.

1.41 TSB laboratory reports

The following TSB laboratory reports were completed in support of this investigation:

• LP 055/2015 – Examination of Rail Joint and Pieces
• LP 056/2015 – Examination of Tank Cars
• LP 057/2015 – Analysis of Crude Oil Samples
• LP 146/2015 – Examination of Tank Car Coupons

2.0 Analysis

The train was operated in accordance with company and regulatory requirements. The rolling stock was maintained in good condition, and there were no defects observed that could be considered contributory to this occurrence. The analysis will focus on the joint bar failure, assistant track supervisor (ATS) training and mentoring, tank car performance, crude oil properties, speed of key trains, Canadian National Railway's (CN's) safety management system (SMS) and corridor risk assessment, CN's incident command and emergency response, regulatory overview, and environmental impact.

2.1 The accident

In this occurrence, a CN crude oil unit train was proceeding eastward at about 38 mph on the Ruel Subdivision when it experienced a train-initiated emergency brake application at Mile 111.7, near Gladwick, Ontario. Twenty-nine CPC-1232 compliant Class 111 tank cars derailed; 19 tank cars were breached, and about 1.7 million litres of product were released to either surface or atmosphere. The product ignited, and fires burned for 5 days. There was no evacuation, and there were no injuries.

The leading L1 wheel tread of the 8th car (VMSX 311903) exhibited impact marks that were consistent with having impacted an exposed rail end. Circumferential abrasion marks were observed on the outboard rim face of the trailing L4 wheel, indicating that the wheel had dropped into gauge. Approaching the derailment site from the west, no impact marks were observed on the track infrastructure. A broken insulated joint was observed in the south rail, near the signal mast at Mile 111.7.

The absence of marks on the infrastructure approaching the broken insulated joint at Mile 111.7, the impact marks on the L1 wheel of the 8th car, and abrasion on the rim face of the L4 wheel on the 8th car were each significant. Based on these observations, the derailment occurred when the insulated rail joint in the south rail at Mile 111.7 failed beneath the head-end of the train and allowed the trailing L4 wheel of the 8th car to drop into gauge, which spread the rails and caused the trailing cars to derail.

2.2 Joint bar failure

The joint bars met material requirements. Detailed examination of the failed joint bar revealed that the fracture surfaces exhibited beach marks, which were typical of fatigue cracking. The fractures initiated at the upper fishing surface (the mating surface between the top of the joint bars and the underside of the rail head) on the top of both joint bars. The fatigue fracture origins were coincident with corrosion pitting observed on the outer surfaces of the joint bars. The fatigue cracking propagated vertically downward for approximately 20% of the joint bar cross-sectional area before transitioning to an overstress (brittle) rupture. The failure of the insulated joint bars was caused by the overstress (brittle) extension of corrosion-initiated reverse bending fatigue cracks, which initiated at the upper mating surface between the top of the joint bars and the underside of the rail head.

2.3 Effect of cold weather

The temperature at the time of the accident was −31 °C. Rail steel and joint bar steel are both known to have reduced fracture toughness and ductility at low temperatures, particularly when fatigue defects are already present in the joint bars and the rail joints are subjected to significant stress due to contraction of continuous welded rail (CWR) in cold weather. Stress can also be imparted into the track infrastructure as a result of repeated wheel impacts caused by damaged wheel treads, out-of-round wheels, or track surface conditions such as rail end batter (REB) or localized surface collapse (LSC).

The insulated joint was subjected to repeated wheel impacts or deflections while in service for at least 3 months before the failure. Such impacts would contribute to the growth of any fatigue cracks present and would impart elevated stresses into the track structure, particularly during periods of severe cold. The cold temperature at the time of the occurrence made the joint bar material more susceptible to brittle failure. Once the joint bar fatigue cracks reached a critical size, the bars could no longer sustain service loads, and subsequently failed.

2.4 Rail end batter and joint bar cracks

REB will occur at a rail joint when the ends of the rail heads within the joint are mismatched or the gap between the rail ends is too large. REB is indicative of a degrading joint support that can result in excessive joint movement. If joints are not properly supported, wheel impact forces can lead to increased vertical rail deflections; loosening and deterioration of the joint assembly; REB; degradation of the ties, ballast, and subgrade; and ultimately, rail or joint failure.

Typically, fatigue cracks take time to develop. In this occurrence, the joint bar fatigue cracks extended to the outer surface of each joint bar just under the rail head. This suggests that they were likely visible for some time before the failure, and may have been present when the REB was initially detected.

When cracks are detected in joint bars, the Transport Canada (TC)—approved Rules Respecting Track Safety, also known as the Track Safety Rules (TSR), and CN protocols require that the bars be replaced immediately. If the joint bars cannot be replaced immediately, as can be the case with bonded insulated joints, a slow order must be placed on the track, or the track must be removed from service. However, in this occurrence, the joint bar fatigue cracks were not detected, and there was no apparent awareness that the REB conditions would increase stress on the joint bars. Had this relationship been understood, it may have also prompted closer inspection of the joint bars when the REB was being monitored. Since the joint bar fatigue cracks extended to the outer surface of each joint bar just under the rail head, the cracks had likely been visible for some period of time prior to failure, yet were undetected despite numerous CN inspections.

2.5 Monitoring of rail end batter condition and joint bar inspection

The ATS had begun working for CN in February 2013 as an assistant track foreman. In May 2014, he was promoted to ATS on the Ruel Subdivision based out of Foleyet, Ontario, and began the CN ATS training program. Between May 2014 and February 2015, the ATS carried out his duties while completing the on-the-job training (OJT) blocks of the ATS training program as he gained additional experience.

The recorded 1-inch low spot within the insulated joint at Mile 111.7, which also contained the REB condition, indicated that joint support was within limits, but was deteriorating. The ATS was aware of the conditions and had planned to have the REB condition temporarily repaired by welding at various times during December 2014 and January 2015. However, attempts to have this repair work completed were unsuccessful. Instead, the ATS visually monitored the REB condition, and at times took rail surface measurements. The measurements were not recorded, nor were they required to be. Because the REB condition and the corresponding low spot did not exceed the limits set out in the TSR or CN Engineering Track Standards (ETS), no action was immediately required to be taken, and there was no urgency to make the repair.

The ATS was relatively new to the rail industry and the ATS position, had not yet completed the ATS training program, and had received little supervision during the OJT portion of the training. Moreover, the section of track for which the ATS was responsible had a number of rail defects and rail surface conditions that required monitoring in addition to track inspection duties. At times, these factors, combined with limited track time, extended the ATS's work day up to 16 hours for consecutive days.

In fulfilling track inspection and maintenance duties, the ATS was primarily concerned with monitoring the REB condition within the insulated joint at Mile 111.7. The ATS lacked sufficient experience to recognize the 1-inch low spot as being indicative of degrading joint support, the effect of repeated wheel impacts on the degrading joint support, and the need to closely inspect the joint bars for cracks when monitoring the REB condition.

2.5.1 Canadian National Railway's track inspection guidelines

CN track inspection guidelines for joint inspection did not make reference to the fact that poor joint support is often at the root of REB, joint bar fatigue, bolt hole cracking and, ultimately, joint assembly failure. The remedy for REB is not limited to welding the rail head. The joint must also be lifted and the ballast tamped to ensure that the joint is properly supported. Welding alone will temporarily fix REB, but it will only delay the development of further REB degradation unless the underlying support conditions are properly addressed. While this may be intuitive for experienced track inspectors, it may not be so for newly hired and promoted ATSs.

The CN track inspection guidelines did not make reference to the potential causal link between poor joint support and joint assembly defects. Consequently, training for CN ATSs related to REB, joint bar fatigue, bolt hole cracking, and joint assembly failure was insufficient to enable the ATS to understand the relationship between an unsupported joint and the development of joint defects. If the training program does not reference key remedial measures for maintaining rail joints, new track engineering personnel may not fully understand the available mitigation strategies, increasing the risk that track conditions will not be addressed in an effective and timely manner.

2.5.2 Canadian National Railway Company Engineering Track Standards

The TSR contain no guidance or condemning criteria related to REB conditions, which are categorized as rail surface conditions rather than rail defects. While REB conditions are not considered to be service failures, they are considered indicators of potential emerging rail defects. CN has recognized that emerging conditions can lead to rail or joint failure and has put measures in place to mitigate these risks. For example, CN ETS track standard (TS) 1.7 – Rail Testing and Remedial Action for Broken Rail requires that during winter months, the REB condition be measured twice a week if joint REB is found to be greater than 3.5 mm. In this occurrence, while the REB condition was not yet at the 3.5 mm limit, as a precaution, the ATS was monitoring the condition twice weekly.

However, there was no further guidance in CN ETS TS 1.7 to indicate that the joint bars should be inspected for cracks at the same time that the REB was being measured. While inspecting the joint bars for cracks may be intuitive to an experienced employee, it may not necessarily be the case for an inexperienced track maintenance employee such as the ATS. The lack of specific guidance may become even more problematic, as many of CN's newly hired ATSs do not have significant experience in the railway industry. If company standards for monitoring REB conditions do not include guidance to inspect joint bars for cracks at the same time the REB is measured, joint bar cracks may not be detected in a timely manner, increasing the risk of rail joint failures.

2.5.3 Emerging joint bar inspection technology

The TSR indicate that "[i]f joint bars are inspected electronically including the use of camera or other technology capable of detecting joint bar defects, a Walking Track Inspection […] is not required."^{Footnote 100} A walking track inspection must be completed on all track with curves of 4 degrees or greater. Alternate forms of technology to detect joint bar cracks that can be used instead of walking joint inspections are emerging, including high‑speed cameras and ultrasonic inspection systems.

A machine vision-based system for joint bar inspection uses high-speed cameras and can inspect at speeds of up to 70 mph. The system features 4 line-scan cameras mounted on a hi-rail or rail-bound vehicle that continuously capture high-resolution images from both sides of each rail. An on-board computer system automatically saves each joint bar image and analyzes it for visible fatigue cracks. The images can be analyzed for missing bolts and other visible joint bar and rail defects. However, only cracks and defects that are visible to the outside surface (exposed) of the joint bars are visible to the cameras.

In comparison, the ultrasonic inspection system can detect joint bar cracks in the area of the joint bar that cannot be inspected by visual or optically aided inspection techniques. This approach allows for better detection of cracks located on the top inside surface of the middle portion of the joint bar, which is where most joint bar fatigue cracks initiate.

Both systems can provide improvements in productivity and worker safety. They inspect the joint bars from a moving vehicle instead of having inspectors walk along an active railway track, allowing the proactive detection of joint bar defects before they fail. While new technology for inspecting joint bars appears promising, unlike track geometry inspection and rail flaw testing, the use of high-speed cameras and ultrasonic testing to inspect joint bars is not required by regulation, and is not yet widespread throughout the industry.

2.6 Assistant track supervisor training and mentoring at Canadian National Railway Company

The ability to think ahead and anticipate potential risks is termed "requisite imagination." The development of requisite imagination, and by extension, the ability to participate effectively in safety improvement, requires personnel to have the experience, training and spare capacity to understand and respond to hazards. In this occurrence, weaknesses in CN's development and mentoring of an inexperienced ATS limited the ATS's ability to perform effectively in a challenging, safety-critical role.

CN identifies train velocity as an issue that drives business. All engineering employees understand the sense of urgency to move trains as quickly and as safely as possible. Train delays that impact velocity create internal pressures that can sometimes create conflict between track maintenance decisions and train operations. Relatively new front-line management can be particularly affected by this pressure. Because it is important to keep trains moving, it is sometimes challenging for track maintenance personnel to get adequate blocks of track time to conduct the required track inspections, maintenance, and repairs.

The ATS was a relatively new front-line engineering supervisor for the territory, and was responsible for conducting track inspections and monitoring track conditions, as well as prioritizing and scheduling track work. Although the ATS had difficulty keeping up with the high workload, every effort was made to address track defects before issuing a temporary slow order that would affect train velocity. Because the ATS was successful in maintaining the minimum track standards, there were few slow orders or other indicators to alert senior managers to the challenges on the Ruel Subdivision. Senior management viewed the absence of slow orders as a sign that staffing and maintenance were adequate.

Since 2013, CN had been delivering a 4-day communication and leadership program entitled LEAD to front-line supervisors and mid-level managers which included some mentoring. However, at the time of the accident, neither the track supervisor nor the ATS had received this training.

The ATS had limited experience, having begun performing the job while still completing the last 5 months of the 12-month ATS training program. During the OJT portion of the ATS training, the ATS worked independently with little mentoring and minimal support from either the track supervisor or the senior manager engineering (SME), both of whom also had limited time to spend with the ATS due to the work demands of their positions.

CN had developed a training program for ATS candidates that covered the knowledge and skills required of the ATS position. However, there were gaps within the training. During the OJT portion of their training, ATS candidates were not assigned a specific mentor or trainer, yet they were responsible for completing their own checklist as they were exposed to certain track maintenance skills and activities. The OJT process was generally informal, with no direct supervision or feedback to reinforce positive behaviour or correct misperceptions. As a result, CN's ATS training program provided little mentoring or support to ATS candidates during the on-the-job field portion of their training to help them develop the competencies required to be effective in a highly demanding and challenging safety-critical position.

CN had some difficulty retaining employees in the ATS position. The previous ATS candidate on this territory had resigned after completing the training program. The ATS at the time of the occurrence had been in the position for less than 1 year.

The ATS at the time of the occurrence had the confidence of CN management and had been identified as having the potential to be a good supervisor. However, the demands of the job, combined with a lack of adequate mentoring and a lack of track supervisor support, made it difficult for the ATS to continue to develop in that position. Following the occurrence, the ATS resigned from his position and voluntarily returned to the unionized ranks.

An ATS is a highly demanding position which can sometimes lead to staff turnover. On the Ruel Subdivision, at the time of the occurrence, the level of track expertise that was available to manage track infrastructure and maintenance crews, perform track inspections, anticipate and plan to mitigate potential problems, and monitor combinations of various emerging track defects and track conditions was sparse, and the territory was large. As a result, the demands placed on remaining CN engineering staff, including the newly hired ATS working as a fully qualified ATS, left portions of the Ruel Subdivision vulnerable. If ATS candidates do not receive adequate mentoring and support during the on-the-job portion of their training, there is an increased risk that ATSs will lack the necessary expertise in this safety critical position, despite completing the ATS training program.

2.7 Petroleum crude oil sample analysis

The laboratory analysis of the product samples determined that both products had similar chemical and physical properties and were consistent with those of a light, sweet crude oil. The test results were also consistent with the product information provided in the material safety data sheets (MSDS), and the products were appropriately classified. The products exhibited somewhat lower vapour pressure than but similar density, viscosity and volatility to that of the Bakken Shale crude oil involved in the Lac-Mégantic occurrence (TSB Railway Investigation Report R13D0054).

The low flash point of the petroleum crude oil explains why it ignited so quickly once the tank cars were breached. The large quantities of spilled product and the product's rapid rate of release, high volatility, and low viscosity contributed to the ignition of large post-derailment fires and the pool fire.

2.7.1 Dangerous goods placards on tank cars

All of the derailed tank cars were loaded with petroleum crude oil product (UN 1267). While most tank cars displayed the appropriate UN 1267 placard, placards on the 31st and 34th tank cars displayed UN 1268 (petroleum distillates).

The dangerous goods safety marks displayed on these derailed tank cars did not meet federal regulations; they displayed UN 1268 placards, whereas their lading was classified as UN 1267. In this occurrence, the discrepancy did not represent a significant risk to safety, as both products had similar properties, and the emergency response procedures required were the same for both products. However, under different circumstances, the discrepancy between shipping information and the placard displayed on the tank car could have been confusing and could have placed emergency responders at risk. If the placards displayed on a tank car do not match the shipping information, emergency responders will not be fully aware of the tank car contents and may unknowingly place themselves in a vulnerable situation, increasing the risk of injuries.

2.8 Tank car performance

Historically, legacy Class 111 tank cars were built with a gross rail load (GRL) capacity of 263 000 pounds. In the mid-1990s, the industry began moving towards a Class 111 tank car with a GRL capacity of 286 000 pounds.

In the late 1990s, TC, the U.S. Department of Transportation (DOT), and the American Association of Railroads (AAR) established a number of requirements for tank car GRL to be increased to 286 000 pounds. The requirements included increased puncture resistance for the tank heads and shells, increased design loads and enhanced protection of service equipment. These requirements were further incorporated into TC and AAR standards for tank cars with a GRL of 286 000 pounds but did not apply to the majority of Class 111 tank cars at the time which had a GRL of 263 000 pounds. The next step was to address the cars with a GRL of 263 000 pounds.

For its part, the AAR issued CPC-1232, the requirements of which were similar to those for 286 000 pound GRL cars. CPC-1232 incorporated a number of enhancements and applied to all newly constructed Class 111 tank cars (ordered since October 2011) used for the transport of dangerous goods (DG) Class 3 flammable liquids (Packing Group I and II) such as crude oil, ethanol, and methanol. The CPC-1232 safety enhancements included:

• additional top fitting protection;
• use of reclosing pressure relief devices (PRDs);
• use of normalized steel for tank shells and tank heads;
• increased minimum material thickness (½-inch) for all tank cars that were not jacketed and insulated; and
• ½-inch thick half-head shields.

In April 2014, in response to TSB Recommendation R14-01, TC announced a 3-year phase-out of older, less crash-resistant legacy Class 111 tank cars. In July 2014, the TP 14877 standard was adopted by reference in the TC Transportation of Dangerous Goods Regulations (the TDG Regulations), which aligned federal regulations with the 2011 AAR CPC-1232 standard.

All tank cars involved in this occurrence were CPC-1232 compliant.

2.8.1 Shell breaches

Of the 29 derailed tank cars, 19 (66%) were breached and released various amounts of product. Nine of the cars released product as a result of breached shells. These shell breaches were caused by a collision sustained during the derailment. Of the 9 shell breaches, 8 (89%) were of medium to large size. Three of the 8 tank cars had separated completely into 2 sections. These failures facilitated the rapid release of a large volume of product and subsequent pool fire. Release from the smaller breaches, while not instantaneous, also contributed to feeding the pool fire and to spillage of product after the fire was extinguished.

Thus, shell breaches were the most important contributors to the release of product in terms of the size of the breach and the number of cars affected. Eight of the 29 derailed tank cars sustained medium to large shell breaches during the derailment, immediately releasing their lading, which ignited and resulted in a large pool fire.

2.8.2 Breaches caused by thermal tears

Of the 27 tank cars inspected by the TSB, 21 (78%) exhibited damage indicating that they were exposed to the post-derailment fire. Only 2 of the 21 tank cars exposed to fire were jacketed and insulated. Thus, for 19 of the tank cars exposed to post–accident fire, the fire impinged directly on the tank shell surface, which in turn would have rapidly heated the product inside the car. The fire damage ranged from scorched paint to changes in surface carbon content and external oxidation consistent with exposure to crude oil and air at elevated temperature. There was no other perforation (burn-through) observed in any of the subject cars.

Seven tank cars sustained breaches caused by thermal tears, which resulted from exposure to the post-derailment pool fire. The released product also ignited and further fed the fire. The tank cars with thermal tears had lost their entire load, except for the 14th car, which had a thermal tear in its B-end head. Thus, thermal tears were the second most important contributor to the release of product in terms of their size and the number of cars affected.

None of the 7 tank cars that were breached from thermal tears were equipped with jackets or thermal protection. While 5 of the 7 tank cars exhibited no other breaches that might have contributed to the release of internal pressure, 2 tank cars (the 14th and 21st cars) also sustained a head breach and a shell breach, respectively. The absence of tank-car thermal protection likely increased the severity of the product release and further fueled the fire, as 7 tank cars sustained thermal tears after exposure to the pool fire.

Neither of the 2 jacketed and insulated cars sustained a thermal tear, although both were exposed to the post-derailment fire. However, both of these cars also sustained other breaches, which likely provided a release for the internal pressure in these cars. Consequently, the extent to which the jacket and insulation were effective in delaying the internal build-up of pressure could not be determined. Although the 15th and 18th tank cars were jacketed, insulated and exposed to the pool fire, the cars had sustained other breaches. Since these other breaches likely released internal pressure, the effect that the jacket and insulation had in delaying the internal build-up of pressure could not be determined.

It has been suggested previously that PRDs with higher start-to-discharge pressure might pose a risk of building up excessive internal pressure during a fire, thus resulting in more energetic thermal tears. Of the 7 tank cars with thermal tears, 6 were equipped with a PRD of 75 pounds per square inch gauge (psig). Thermal tear length on these cars ranged from less than 1 foot to 16 feet. In comparison, a 4-foot-long thermal tear was observed in the 14th car, which had a PRD of 165 psig. Therefore, for the 7 tank cars that exhibited thermal tears, there was no evidence to support the hypothesis that PRDs with higher start-to-discharge pressure result in more energetic (larger) thermal tears.

2.8.3 Head and head shield damage

Of the 27 derailed tank cars inspected, 23 (85%) had some form of collision damage to their head shields and 17 (63%) of the cars had dented heads. Eight (27%) of the tank cars were missing 1 head shield, and 3 (11%) of the tank cars had lost both. Most head shields separated due to broken attachment brackets. Only 2 (7%) tank cars (14th and 28th) sustained a head breach due to impact damage. The results of the examination suggest that, in this occurrence, the trapezoidal half-head shields and full-height head shields fitted on the CPC-1232 compliant tank cars were generally effective in protecting the heads against impact punctures during the derailment.

2.8.4 Manway, top fitting, and pressure relief device damage

The manway cover of the 16th tank car had a broken hinge, while the nozzle was cracked and several eyebolts were disengaged. Burnt product residue was observed in the gap between the cover and nozzle. Because this tank car came to rest on its left side, product likely flowed from the breached manway.

About half of the tank cars exhibited some form of impact damage to their protective housing. The protective housing was missing, and all of the fittings and the PRD were sheared off from 2 tank cars (the 19th and 25th cars). The small number of tank cars with breached manways, top fittings, and PRDs suggests that the features incorporated for top- mounted appurtenances were generally effective in reducing the release of product.

2.8.5 Bottom outlet valve damage

If a loaded tank car comes to rest in an inverted position after the top fittings have been compromised during a derailment, product leakage can occur from the top fittings. Similarly, if a tank car comes to rest in an upright position and the bottom outlet valve (BOV) has been compromised, product can be released from the BOV. If the top fittings and the BOV are compromised, the fitting that comes to rest in the highest position can act as a vent, which can greatly increase the rate of flow from the other compromised appurtenance. To minimize and mitigate product release during a derailment, protection of both the top fittings and the BOV is necessary.

Four of the tank cars (the 16th, 18th, 24th, and 27th cars) were breached from impact-damaged BOVs. On 3 of these 4 tank cars (the 16th, 18th, and 24th cars), the exposed BOV ball was partially open or visibly leaking product. In each of these 3 cases, the BOV operating handle was either deformed or had separated from the car. This highlights the need for a better BOV design for ball valves equipped with handles.

TSB Rail Safety Advisory 15/13 and 2 previous TSB investigations (R13T0060 and R13D0054) had identified this issue. In these occurrences, the tank car BOV handle design for the Class 111 tank cars was insufficient to protect the ball valve from being actuated when the handle was broken off, deformed, or otherwise unintentionally moved during the derailment or site remediation.

Problems with BOV handles have been previously identified in other accident investigation reports. In 2012, the National Transportation Safety Board (NTSB) recommended design changes to ensure that BOVs remain closed during derailments. However, at the time of car construction, the recommended changes had not been made. Without modifications to the handle design, these types of releases have continued to occur during derailments. In this occurrence, although the BOV handle designs met the AAR standards, the handles were exposed and moved during either the accident or site remediation, which resulted in the release of product. The design of the tank car BOV handle was inadequate to protect against product release during the derailment, and contributed to the severity of the release. If BOV handles continue to be exposed without adequate protection, there is an increased risk of product release in the event of a derailment and during subsequent site remediation.

2.8.6 Stub sill damage

The 28th tank car was breached as a result of impact damage sustained by the A-end stub sill attachments. The examination concluded that the A-end of the tank car had experienced multiple elevated impacts during the accident. As a result, the front sill pad fractured and separated from the A-end tank head. The fracture then propagated into the tank shell on each side, which caused 2 shell breaches despite AAR design requirements that should prevent such shell breaches from occurring. The shell and head fractures had a mostly brittle appearance. The severity of the multidirectional impacts sustained by the A-end of the 28th tank car had likely exceeded the stub sill design criteria and caused the cracks to propagate from the front sill pad attachment welds into the shell and head in a low-energy (brittle) manner.

2.9 Tank car material properties

The tank car head and shell material met the applicable requirements for chemical composition and tensile properties. Although not required for these cars, the material satisfied the AAR's impact energy requirements for low-temperature service. In general terms, this means that the tank car material should have been more resistant to brittle fractures at low temperatures. However, some tank cars exhibited brittle fractures consistent with low-energy crack propagation, which led to a rapid release of product. With a temperature of −31 °C at the time of the accident, it is likely that the severity of the collisions, which produced a high strain rate and high degree of stress triaxiality at the fracture locations, combined with the low ambient temperature, contributed to the brittle tank fractures observed.

Despite design enhancements, it would appear that the Class 111 CPC-1232 compliant tank cars involved in this occurrence did not perform much better than the legacy Class 111 tanks cars involved in the Lac-Mégantic accident. Although the CPC-1232 standard is an improvement over the legacy Class 111 tank cars, this standard does not seem to be sufficiently robust to ensure the safe transportation of Class 3  Packing Group I and Packing Group II products, when these tank cars are involved in high speed derailments.

In this occurrence, the severity of the tank car impact and thermal damage, the subsequent release of product and post-derailment fire, as well as the damage to the environment, reinforce the ongoing TSB concern relating to trains carrying large volumes of flammable liquids. If flammable liquids continue to be transported in tank cars that are not sufficiently robust to prevent catastrophic failure when involved in an accident, the risk of DG release during a derailment will remain high.

2.10 New regulations for tank cars in flammable liquids service

In May 2015, TC published in the Canada Gazette, Part II, amendments to the TDG Regulations. These amendments established requirements for a new flammable liquids tank car standard (TC-117), retrofit requirements for older tank cars in flammable liquids service, and implementation timelines to modernize the Canadian tank car fleet. TC is also updating standard TP14877, Containers for Transport of Dangerous Goods by Rail, December 2013, which is the Canadian standard referenced in the TDG Regulations concerning the construction of TC-117 tank cars. The standards and timelines were generally harmonized with the U.S. regulators, the Pipeline and Hazardous Materials Safety Administration and the Federal Railroad Administration. With the coming into force in the U.S. of the recent Fixing America's Surface Transportation (FAST) Act, the U.S. has further harmonized with the Canadian requirements.

The new regulations require that all new tank cars built for transporting flammable liquids be constructed using even thicker and more impact-resistant steel, and that they be equipped with jacketed thermal protection, full-height head shields, top fittings protection, improved bottom outlet valves, and appropriate pressure relief devices. The Railway Association of Canada (RAC) and industry continue to support improvement in tank car standards.

However, transitioning to the new TC-117 and retrofitted tank cars with further enhanced protection, that are now required by regulation to transport a number of Class 3 flammable liquids by rail, will take some time. In light of a number of significant derailments that resulted in the release of flammable liquids, loss of life and damage to the environment, if the new tank car standards are not fully implemented in a timely manner, there is a continued risk of product loss and associated consequences when tank cars carrying flammable liquids are involved in a derailment.

In the meantime, as the industry works through the transition to the new TC-117 and retrofitted tank cars, risk control measures, such as speed reduction for key trains and risk assessments for key routes, need to be managed effectively.

2.11 Key train speed

The occurrence train was hauling 100 Class 111 tank cars loaded with Class 3 flammable liquids. Each car was built in compliance with the CPC-1232 standard and had a GRL capacity of 286 000 pounds. Sixty-eight of the cars were loaded with petroleum crude oil (UN 1267) and 32 were loaded with petroleum distillates (UN 1268). The train was 6089 feet long and weighed 14 355 tons. The train was designated as a key train and was operating on a key route. At the time of the accident, the train was travelling at 38 mph.

Kinetic energy is a function of mass times speed squared. During a derailment, a train loses kinetic energy as the energy is consumed by the forces involved in the derailment and as the train comes to a stop. A heavier train (e.g., a crude oil unit train) has greater momentum and requires more energy to slow down and more distance to stop, in comparison to a lighter train. It is well understood in the industry that when train speed is increased, more cars will derail when the train is involved in a derailment.

While train speed is a primary factor in the severity of the outcome of a derailment, the weight of the cars involved also plays a role, as heavier cars will gain more momentum when train speed increases and will take more effort to stop. When heavier tank cars are loaded with DGs, the risk of a release and the potential consequences resulting from a derailment are also elevated. All of these factors were present in this accident. Given the circumstances in this occurrence, the speed of the petroleum crude oil unit train increased the severity of the outcome.

Regulators have recognized the role that speed plays in the severity of outcomes during a derailment and have put measures in place to limit the speed of key trains under certain conditions. Following the Lac-Mégantic accident, on 23 April 2014, TC issued Ministerial Order (MO) 14-01, requiring railways to limit key train speed and perform risk assessments for key routes. The MO continued to be re-issued until February 2016, when the TC-approved Rules Respecting Key Trains and Key Routes came into force.

The Rules Respecting Key Trains and Key Routes require railways to restrict key trains to a maximum speed of 50 mph, and further restrict key trains to a maximum speed of 40 mph within the core and secondary core of census metropolitan areas. The rules further require railways to restrict key trains transporting 1 or more DOT-111 loaded tank cars containing a number of Class 3 flammable liquids to a maximum speed of 40 mph in areas identified as higher risk through the risk assessment process that is also required by the rules. The DOT-111 tank cars also include those that were constructed to the CPC-1232 specification, such as the cars transported by the occurrence train. Despite the speed restriction of 40 mph for a unit train hauling Class 3 flammable liquids, no detailed engineering analysis had been performed to assess the effect of the speed reduction on the severity of a derailment.

The occurrence train was travelling at 38 mph at the time of the accident, which resulted in the derailment of 29 DG tank cars. Nineteen of the tank cars were breached, and about 1.7 million litres of product were released to either atmosphere or surface. The product ignited, and fires burned for 5 days. Although the accident occurred in a remote area and there were no injuries, the accident impacted the environment and required significant post-accident restoration work. As has been seen in the past, if the accident had occurred within a town, city, or metropolitan area, the outcome could have been even more severe. Because the accident occurred at 38 mph, the severity of its outcome suggests that a speed restriction of 40 mph, as outlined in TC's MO in place at the time of the accident and in the current Rules Respecting Key Trains and Key Routes, is not sufficient for unit trains transporting Class 3 flammable liquids.

General merchandise trains, which often transport DG tank cars dispersed throughout the train, are generally exposed to less risk in a derailment because the derailment may occur in an area of the train that either is not transporting DG tank cars or is transporting only a few of them. Unit trains of DG tank cars transporting Class 3 flammable liquids, meanwhile, have a different risk profile. When a derailment that occurs at or near track speed involves a unit train transporting Class 3 flammable liquids, the risk of release and adverse consequences is high no matter where the derailment occurs within the train, because all of the cars are carrying Class 3 flammable liquids. If train speed is not adequately restricted for unit trains transporting Class 3 flammable liquids, there is an increased risk of product release and adverse consequence when the train is involved in a derailment.

2.12 Canadian National Railway Company corridor risk assessment

In Safety Issues Investigation SII R05-01, the TSB studied a series of occurrences and identified an imbalance between infrastructure maintenance and increases in the volume of bulk traffic. The study determined that, although railways recognize that the rate of track degradation was accelerated with increases in bulk unit train tonnage, an appropriate balance between increased track degradation and timely infrastructure maintenance or renewal was not always achieved. The study highlighted that compliance with the TSR alone was not sufficient to ensure safety, and emphasized the need for proactive SMS processes to anticipate operational conditions that could lead to a degradation of safety margins. The TSB Watchlist has also emphasized the need for SMS to be implemented effectively in order to ensure that hazards are proactively identified and that risks are maintained at an acceptable level.

Between 2010 and 2014, rail traffic tonnage on the Ruel Subdivision increased by 44%. During that same period, the transport of petroleum crude oil by rail increased dramatically, accounting for 46% of the rail traffic tonnage increase. Much of the petroleum crude oil was being transported in bulk unit trains equipped with Class 111 tank cars that were built to the CPC-1232 standard and had a GRL capacity of 286 000 pounds. Although the track in the vicinity of the derailment was continually maintained to Class 3 standards, the potential for more rapid degradation of track infrastructure due to a 44% increase in traffic tonnage, much of which was transported in heavier rail cars, was not immediately recognized.

While CN's SMS called for risk assessments in response to significant changes in business, including changes in traffic volumes or types of product, no definition of "significant change" was provided. The scope of CN's risk assessment examined the hazards associated with the transportation of DGs between Winnipeg and Toronto, and identified the need for increased emergency response supplies on the Ruel Subdivision. However, CN did not anticipate the impact of the increased traffic and tonnage or the ability to maintain adequate track safety margins on the Ruel Subdivision. These increases did not prompt a proactive review of the April 2014 CN risk assessment.

The risk assessment did not identify mitigation strategies to assist in meeting increased track maintenance demands resulting from increased traffic and tonnage or to assess the impacts of these demands. This left CN to manage the balance between increased traffic and maintenance activities through lagging indicators such as inspections, track testing, implementation of slow orders, incidents, and accidents. CN did not have a clear definition of what constituted a significant change in business, such as volumes and products transported, that would prompt a review of the risk assessment. Consequently, CN's SMS relied on reactive indicators and did not anticipate the need for increased track maintenance in light of significant increases in DG volumes and traffic tonnage.

Freight cars are typically equipped with 8 wheels (4 wheel set assemblies containing 2 wheels each). For a loaded freight car with a GRL capacity of 263 000 pounds, such as a legacy Class 111 tank car, each wheel will carry 32 875 pounds. In comparison, for a loaded tank car with a 286 000 pound GRL capacity, such as a Class 111 tank car built to the CPC‑1232 standard, each wheel will carry 35 750 pounds (i.e., about 2875 pounds more per wheel than a car with 263 000 pound GRL capacity). To put this in perspective, the 286 000 pound GRL capacity tank cars of the occurrence train would impart about 1 150 000 pounds more weight on to the south rail (2875 pounds × 4 wheels × 100 cars) than a similar train transporting loaded tank cars with a GRL capacity of 263 000 pounds.

The additional weight of cars with a GRL capacity of 286 000 pounds would also lead to more rapid deterioration of track infrastructure, due to the higher wheel impacts and greater deflection in areas where REB conditions or poorly supported joints are present. In this occurrence, all of these elements were present. If risk assessments do not adequately consider increases in traffic tonnage, the use of heavier rail cars and the potential for more rapidly degrading track structure, regular track maintenance activities may no longer be sufficient to maintain track to the required standards, increasing the risk of track infrastructure failures.

2.13 Regulatory oversight for the Ruel Subdivision

In conjunction with its responsibilities of oversight for regulatory compliance, TC rail safety inspectors are tasked with conducting railway infrastructure inspections across Canada. Subdivisions are not subject to regular TC inspections. TC uses a risk-based approach that considers various factors to identify areas requiring targeted inspection. In this occurrence, a significant increase in overall tonnage and DG traffic did not result in the Ruel Subdivision being selected for more frequent targeted inspections, despite it being one of CN's primary rail corridors.

Before the accident, TC's last visual track inspection in the vicinity of the derailment was conducted in 2012, and prior to that, in 2010. Between 2012 and 2014, rail traffic tonnage on the subdivision increased by 28%. During that same time, the transport of petroleum crude oil by rail increased dramatically and accounted for 48% of the rail traffic tonnage increase. Since 2012, TC had not performed any track inspections on the Ruel Subdivision until after the accident. In mid-March 2015, TC inspected the entire subdivision, and identified a total of 67 non-compliant conditions that required repair as well as 59 other concerns and observations.

Maintenance programs must be implemented in a timely manner to ensure that risks are adequately mitigated. Regulatory inspections are equally important to ensure compliance. While the Railway Safety Management System Regulations call for companies to perform risk assessments in response to significant changes in business (volumes or product), the same changes in business do not necessarily prompt a TC review of subdivision condition or the need for additional regulatory inspections. If TC's risk-based approach for identifying targeted regulatory inspections does not consider all relevant operational factors, such as increases in rail traffic tonnage and the DG volumes transported on primary rail corridors, the targeted track inspections may not be well focused, increasing the risk that degrading track conditions will go undetected by the regulator.

2.14 Emergency response

The accident occurred in a remote location. The site was initially accessible only by rail (using a locomotive or hi-rail vehicle), which hindered access and mitigation activities. Access improved once CN cut a road into the site, providing access to vehicle traffic. The remoteness of the location, extreme cold, and severe winter conditions presented significant challenges to responders throughout the emergency response and site mitigation activities.

2.14.1 Site access control

CN initially attempted to establish site access control with a formal sign-in/sign-out protocol. However, the process was not consistently adhered to, partly due to the remoteness of the location and the difficulty with entering and exiting the site. The process improved after roadway access to the site was established, but there was still no accurate record of who was physically on or off site. It could be argued that, due to the limited site access, the use of a sign-in/sign-out protocol was not absolutely necessary, as only authorized personnel would be accessing the site. However, the primary reason for having a site sign-in/sign-out protocol is to keep accurate records of who is physically on site, so that everyone can be accounted for in the event of an emergency evacuation. For this reason, it may be even more important to maintain an accurate sign-in/sign-out protocol when working in a remote location. If accurate sign-in/sign-out records are not maintained for accident sites involving DGs, incident command may not be aware of all personnel on site, increasing the risk that all personnel will not be accounted for in the event of an emergency evacuation.

2.14.2 Safety management system and Canadian National Railway Company incident command documentation

TC SMS Regulations require a company to have:

• systems for accident and incident reporting, investigation, analysis and corrective action;
• systems for ensuring that employees and any other persons to whom the railway company grants access to its property, have appropriate skills and training and adequate supervision to ensure that they comply with all safety requirements; and
• procedures for the collection and analysis of data for assessing the safety performance of the railway company.

In this occurrence, CN was the primary response agency and implemented its incident command system. The CN Senior Vice-President, Eastern Operations, acted as the incident commander, supported by the Assistant Vice-President Safety and Emergency Response and CN DGOs as well as other CN staff and contractors. CN protocols required that a detailed emergency response incident command logbook be maintained. CN guidance requires that the logbook be completed and that all meetings be documented by CN risk management personnel.

Once CN established the incident command, the focus quickly turned to constructing road access to the site and mobilizing response personnel and resources to help minimize environmental damage, control the pool fires, and begin track restoration. All associated activities would normally be documented in the logbook. However, in this case, there were no entries.

In accordance with the SMS Regulations, CN had developed and implemented a detailed SMS. Since 2008, CN's SMS had been enhanced each year and had been integrated into most facets of its operations. In parallel with implementing SMS, CN recognized the importance of building an effective safety culture and had made strides in that area. An effective SMS ensures that activities are documented so that a company can identify successes as well as gaps in processes that need to be improved to enhance safety. Despite its SMS, CN did not follow its own guidance, as there were no entries recorded in its logbook. The absence of documentation for CN emergency response activities highlights a gap in reporting and/or procedures within CN's SMS.

2.14.3 Site monitoring and respiratory protection

Dense smoke swirled throughout the area as the product continued to burn and site mitigation activities progressed. While DG protocols require responders to approach a DG site from an upwind position, there was no wind monitoring device in place. If wind direction is not monitored and planned activities are not modified to correspond with changes in wind direction, emergency responders may be subjected to unnecessary DG exposure, increasing the risk of injuries to the responders.

Initially, many employees did not wear dust masks or respirators to protect against airborne particulates from the fire or vapours from volatile organic compounds (VOC) in the product (e.g., benzene). Due to the nature of the released product, the site was monitored for VOC lower explosive limit and hydrogen sulfide. In addition, the site was monitored for benzene levels every 30 minutes to ensure that they were within the established short-term exposure limit of 5 parts per million as averaged over a 15-minute period. However, because the benzene-specific monitoring was only valid for the precise location at which it was recorded, the cumulative effect of repeated exposures throughout the site could not be determined accurately. CN employees were not provided with cartridge-type respirators to protect against benzene vapours.

Many of the on-site personnel worked without wearing dust masks to protect against particulates, and any exposed skin (including the mouth and nose areas) was covered in soot by the end of a shift. Although CN provided dust masks later in the response, the use of half- or full-face cartridge-type respirators to protect against particulates and benzene would have provided superior respiratory protection. If adequate respiratory protection is not provided to personnel on a DG accident site, exposure to airborne particulates and chemicals may occur, increasing the risk of cumulative adverse long-term health effects.

2.15 Environmental impact

A surface water sampling program was initiated in the vicinity of the derailment, which included the channel leading toward Upper Kasasway Lake and several locations within Upper Kasasway Lake. Mobile wastewater treatment units were sent to the site to treat all recovered impacted water. The treated water was then safely discharged back into the natural environment. Following consecutive rounds of sampling with no impacts found, sampling frequency was reduced to twice per week until the winter of 2015.

A total of 17 groundwater monitoring wells were installed to verify the direction of groundwater flow and groundwater depth, and to determine whether the groundwater was affected. Site monitoring was completed for the winter by November 2015. By that time, no crude oil was detected in the groundwater. As of 01 July 2016, no negative environmental impact to the surface or groundwater was present. Going forward, surface water and groundwater will continue to be monitored quarterly for an indefinite period of time.

A significant volume of soil was removed from the derailment site by truck. In the spring of 2016, the Ontario Ministry of Environment and Climate Change designated the soil as non-hazardous waste, and all excavated soil was removed from the accident site and transported by truck to approved landfill sites. Forest restoration, which included a planting program to return the vegetation species that were native to the area, was completed in the spring of 2016 with the assistance of the local Mattagami First Nation. The environmental plan was comprehensive, and it would appear that appropriate mitigating strategies were put in place for site restoration.

3.0 Findings

3.1 Findings as to causes and contributing factors

1. The derailment occurred when the insulated rail joint in the south rail at Mile 111.7 failed beneath the head-end of the train and allowed the trailing L4 wheel of the 8th car to drop into gauge, which spread the rails and caused the trailing cars to derail.
2. The failure of the insulated joint bars was caused by the overstress (brittle) extension of corrosion-initiated reverse bending fatigue cracks, which initiated at the upper mating surface between the top of the joint bars and the underside of the rail head.
3. The cold temperature at the time of the occurrence made the joint bar material more susceptible to brittle failure. Once the joint bar fatigue cracks reached a critical size, the bars could no longer sustain service loads, and subsequently failed.
4. Since the joint bar fatigue cracks extended to the outer surface of each joint bar just under the rail head, the cracks had likely been visible for some period of time prior to failure, yet were undetected despite numerous inspections by the Canadian National Railway Company.
5. The assistant track supervisor lacked sufficient experience to recognize the 1-inch low spot as being indicative of degrading joint support, the effect of repeated wheel impacts on the degrading joint support, and the need to closely inspect the joint bars for cracks when monitoring the rail end batter condition.
6. Training for Canadian National Railway Company assistant track supervisors (ATSs) related to rail end batter, joint bar fatigue, bolt hole cracking and joint assembly failure was insufficient to enable the ATS to understand the relationship between an unsupported joint and the development of joint defects.
7. The Canadian National Railway Company's assistant track supervisor (ATS) training program provided little mentoring or support to ATS candidates during the on-the-job field portion of their training to assist in developing the competencies required to be effective in a highly demanding and challenging safety-critical position.
8. Of the 29 derailed tank cars, 8 sustained medium to large shell breaches during the derailment, immediately releasing their lading, which ignited and resulted in a large pool fire.
9. The absence of tank-car thermal protection likely increased the severity of the product release and further fueled the fire, as 7 tank cars sustained thermal tears after exposure to the pool fire.
10. The tank car bottom outlet valve handle design was inadequate to protect against product release during the derailment, and contributed to the severity of the release.
11. The large quantities of spilled product, the rapid rate of release of the product, as well as the product's high volatility and low viscosity contributed to the ignition of large post-derailment fires and the pool fire.
12. It is likely that the severity of the collisions, which produced a high strain rate and high degree of stress triaxiality at the fracture locations, combined with the low ambient temperature, contributed to the brittle tank fractures observed.
13. Given the circumstances in this occurrence, the speed of the train increased the severity of the outcome.
14. Since the accident occurred at 38 mph, the severity of its outcome suggests that a speed restriction of 40 mph, as outlined in Transport Canada's ministerial order in place at the time of the accident and in the current Rules Respecting Key Trains and Key Routes, is not sufficient for unit trains transporting Class 3 flammable liquids.

3.2 Findings as to risk

1. If the training program does not reference key remedial measures for maintaining rail joints, new track engineering personnel may not fully understand the available mitigation strategies, increasing the risk that track conditions will not be addressed in an effective and timely manner.
2. If company standards for monitoring rail end batter (REB) conditions do not include guidance to inspect joint bars for cracks at the same time the REB is measured, joint bar cracks may not be detected in a timely manner, increasing the risk of rail joint failures.
3. If assistant track supervisor (ATS) candidates do not receive adequate mentoring and support during the on-the-job portion of their training, there is an increased risk that ATSs will lack the necessary expertise in this safety-critical position, despite completing the ATS training program.
4. If bottom outlet valve handles continue to be exposed without adequate protection, there is an increased risk of product release in the event of a derailment and during subsequent site remediation.
5. If the placards displayed on a tank car do not match the shipping information, emergency responders will not be fully aware of the tank car contents and may unknowingly place themselves in a vulnerable situation, increasing the risk of injuries.
6. If flammable liquids continue to be transported in tank cars that are not sufficiently robust to prevent catastrophic failure when involved in an accident, the risk of release of dangerous goods during a derailment will remain high.
7. If the new tank car standards are not fully implemented in a timely manner, there is a continued risk of product loss and associated consequences when tank cars carrying flammable liquids are involved in a derailment.
8. If train speed is not adequately restricted for unit trains transporting Class 3 flammable liquids, there is an increased risk of product release and adverse consequence when the train is involved in a derailment.
9. If risk assessments do not adequately consider increases in traffic tonnage, the use of heavier rail cars and the potential for more rapidly degrading track structure, regular track maintenance activities may no longer be sufficient to maintain track to the required standards, increasing the risk of track infrastructure failures.
10. If Transport Canada's risk-based approach for identifying targeted regulatory inspections does not consider all relevant operational factors, such as increases in rail traffic tonnage and the volumes of dangerous goods transported on primary rail corridors, the targeted track inspections may not be well focused, increasing the risk that degrading track conditions will go undetected by the regulator.
11. If accurate sign-in/sign-out records are not maintained for accident sites involving dangerous goods, incident command may not be aware of all personnel on site, increasing the risk that all personnel will not be accounted for in the event of an emergency evacuation.
12. If wind direction is not monitored and planned activities are not modified to correspond with changes in wind direction, emergency responders may be subjected to unnecessary exposure to dangerous goods, increasing the risk of injuries to the responders.
13. If adequate respiratory protection is not provided to personnel on the site of an accident involving dangerous goods, exposure to airborne particulates and chemicals may occur, increasing the risk of cumulative adverse long-term health effects.

3.3 Other findings

1. While new technology for inspecting joint bars appears promising, unlike geometry inspection and rail flaw testing, the use of high-speed cameras and ultrasonic testing to inspect joint bars is not required by regulation, and is not yet widespread throughout the industry.
2. Although the 15th and 18th tank cars were jacketed, insulated and exposed to the pool fire, the cars had sustained other breaches. Since these other breaches likely released internal pressure, the effect that the jacket and insulation had in delaying the internal build-up of pressure could not be determined.
3. For the 7 tank cars that exhibited thermal tears, there was no evidence to support the hypothesis that pressure relief devices with higher start-to-discharge pressure result in more energetic (larger size) thermal tears.
4. In this occurrence, the trapezoidal half-head shields and full-height head shields fitted on the CPC-1232 compliant tank cars were generally effective in protecting the heads against impact punctures during the derailment.
5. The small number of tank cars with breached manways, top fittings and pressure relief devices suggests that the features incorporated for top mounted appurtenances were generally effective in reducing the release of product.
6. The severity of the multidirectional impacts sustained by the A-end of the 28th tank car had likely exceeded the stub sill design criteria and caused the cracks to propagate from the front sill pad attachment welds into the shell and head in a low energy (brittle) manner.
7. The Canadian National Railway Company's safety management system relied on reactive indicators, and did not anticipate the need for increased track maintenance in light of significant increases in volumes of dangerous goods and traffic tonnage.
8. The absence of documentation for Canadian National Railway Company's (CN's) emergency response activities highlights a gap in reporting and/or procedures within CN's safety management system.
9. The environmental plan was comprehensive, and it would appear that appropriate mitigating strategies were put in place for site restoration.

4.0 Safety action

4.1 Safety action taken

4.1.1 Transportation Safety Board of Canada

On 17 March 2015, the Transportation Safety Board of Canada (TSB) issued rail safety advisory (RSA) letter 04/15 regarding the condition of track infrastructure on Canadian National Railway Company's (CN's) Ruel Subdivision.

The RSA suggested that, given the potential damage and consequences of a train derailment, particularly when petroleum crude oil unit trains are involved, Transport Canada (TC) should review the risk assessments conducted for the Ruel Subdivision, assess the track infrastructure condition, and determine whether additional risk control measures are required when operating a "key train" on this "key route."

4.1.2 Transport Canada

TC took the following action:

On 12 March 2015, TC issued a Notice to CN, as per the requirements of Section 31 of the Railway Safety Act, raising concerns about the track condition on the Ruel Subdivision.

With respect to the track infrastructure, pursuant to a third derailment, TC's Ontario Regional Office requested track inspection records from CN, and also inspected the entire Ruel Subdivision between 15 March and 19 March 2015. A report summarizing the inspection findings was provided to CN. The TC inspection noted a total of 67 non-compliant conditions that required repair, as well as 59 other concerns and observations.

On 30 March 2015, CN responded to TC's Notice, with a description of the action plan the company implemented. The plan included operating at a reduced speed on the subdivision, performing supplementary inspections, and having additional analysis undertaken by experts outside the company on the possibility of distributed power reducing derailment severity, and conducting a review of train-track forces associated with unit trains of crude oil.

On 07 May 2015, TC sent a Letter for Insufficient Action Taken to CN stating that after the review and evaluation of the corrective measures outlined in the 30 March 2015 correspondence, TC was not satisfied that the action taken had addressed the hazard or condition posing the threat to safe railway operations. TC requested updates and additional information on CN's findings and plans with respect to the recent derailments.

On 21 May 2015, CN responded to TC's Letter for Insufficient Action Taken, providing the requested information, in particular: the results of work that CN undertook to determine the root causes of the derailments, the conclusions from the analysis of distributed power benefits, measures taken to address turnout maintenance concerns, and CN's analysis of adequacy of track time provided to employees for maintenance and inspection activities on the Ruel Subdivision. CN also included the status of risk mitigation actions and additional actions and results of associated analyses.

On 22 May 2015, CN advised TC that the temporary speed restriction of 35 mph across the Redditt, Allanwater, Carmat, and Ruel Subdivisions (i.e., the Winnipeg to Capreol rail corridor) put in place immediately after the derailments would be lifted on 23 May 2015. CN indicated that the restriction was no longer required due to the measures taken within the first 60 days of the derailment.

On 02 June 2015, TC sent a letter to CN, indicating that TC officials would meet with CN officials to inspect the Ruel Subdivision and review the implementation, effectiveness, and adequacy of CN's response to the Letter for Insufficient Action Taken.

4.1.3 Canadian National Railway Company

CN used this occurrence as a lessons-learned opportunity and strengthened its data collection processes.

Shortly after this derailment, CN experienced 2 other significant track-related derailments on the Ruel Subdivision. Subsequent to the third derailment, which occurred on 07 March 2015, CN immediately implemented the following measures:

Operating restrictions

• A 35 mph temporary (60-day) speed restriction for key trains operating between Winnipeg and Capreol was introduced and subsequently lifted.
• Although train speed through a census metropolitan area (CMA)^{Footnote 101} is restricted to 40 mph by regulation, CN has further restricted Key Trains to 35 mph through a CMA.

Mechanical actions

• Qualified mechanical personnel performed roll-by inspections of loaded crude oil trains at Hornepayne, Ontario, for 60 days following the occurrence.

Engineering actions

• The frequency of rail flaw ultrasonic track testing for the Ruel Subdivision was increased to once every 14 days from the previous winter interval of 20 days. A subsequent review of the test results indicated that the Ruel Subdivision had similar defect volume per mile tested ratios as compared with other Winnipeg-to-Toronto corridor subdivisions. Consequently, the testing interval later reverted back to 20 days.
• CN and Sperry Rail Service carried out a review of rail flaw detector (RFD) tapes for those inspections performed immediately following the derailment. Thirty-seven tape-indicated locations from several RFD tapes were hand tested. The results indicated that the RFD equipment was performing as expected.
• Localized surface collapse (LSC) and rail end batter (REB) criteria contained in CN Engineering Track Standards TS 1.7 (10a) and (10b) were superseded by the more restrictive CN Amalgamated Ruel Subdivision Action Plan dated 12 March 2015.
• Additional off-territory management was mobilized to the Northern Ontario Zone to review the territory and evaluate areas of opportunity for enhancing the skillsets of track personnel that perform inspections.
• Investment in rail, ties and surfacing was increased in 2015 from $10 million to $20 million. Capital track maintenance work programs began throughout the spring and summer of 2015. Two complete mainline turnouts were installed. Seventeen mainline switch points and stock rails, and 27 mainline frogs were changed out. Approximately 44 miles of new rail was laid and 216 miles of track was re-surfaced. Approximately 30 miles of track was re-gauged with wood plugs or concrete insulators, 773 butt welds were installed to eliminate joints, and about 37 000 concrete or wood ties were installed.

CN modified its track inspection guidelines (TIG) course to include conditions that could contribute to REB and conditions that could result from REB.

In 2015, CN updated its Network Operations emergency response plan (ERP), incident command logbook and supervisor job aid, including electronic forms of command documentation. All CN Transportation, Engineering, Mechanical and Risk Management managers (up to vice-president) were required to complete the CN Railroad Emergency Response (RER) course, ERP training and incident command structure (ICS) 100 training. Support functions such as the CN Environmental Department and CN Police also participated in similar training.

Risk management officers in Canada and safety officers in the United States completed training in site safety and on the completion of the incident command logbook documentation.

In late 2016, CN implemented quarterly evaluations and conference calls for all assistant track supervisor (ATS) candidates. The conference calls will be extended to all future ATS classes. The January 2017 ATS class will have a first formal review and conference call during the second quarter of 2017.

CN established permanent internal mentors with 1 permanent mentor per region. Senior engineering managers now work with regional chiefs to be available for mentoring in the field. Mentors use a checklist for each supervisor and inspector they spend time with and provide the employee as well as the regional management team with a full report. Regional managers will follow up on areas of concern and development required with the employees. The majority of the time is spent in the field in the new supervisor's territory, focusing on the following activities:

• quality inspection;
• applying Engineering Track Standards;
• arranging for repairs; and
• follow-up on completion and sign-off.

Subsequent to the occurrence, CN purchased 2 hi-rail vehicles in 2015 that are capable of performing electronic joint bar inspections. These vehicles are focused on inspections in Canada. CN also worked with Sperry Rail Service to implement joint bar inspections on specific trucks that work across Canada.

CN modified its ATS program to include an "Advanced Track Inspection" course. The course is specifically designed to provide engineering management detailed knowledge on defect development and analytical tools. The course includes the following topics:

• Rail metallurgy, defect causes and failure mechanisms;
• Bolted vs all-welded turnout geometry and its impact on in-track speed and dynamic forces;
• Types of lubrication strategies and their impact on wear and track forces;
• Proper interpretation of TEST car graphs in identifying defects and potential problem areas; and
• Use of CN analytical systems to proactively identify problem areas and identify defect trends.

4.2 Safety concern

4.2.1 Speed of unit trains transporting Class 3 flammable liquids

Kinetic energy is a function of mass times speed squared. When a derailment occurs, a train loses kinetic energy as the energy is consumed by the forces involved in the derailment and as the train comes to a stop. A heavier train (e.g., crude oil unit train made up of tank cars with a capacity of 286 000 GRL, or gross rail load) has greater momentum, must dissipate more energy to slow down, and requires a greater distance to stop, in comparison to a lighter train. In addition, derailments that occur near the front of a train may derail more cars as the weight of the following cars may affect the derailment dynamics.^{Footnote 102}

It is well understood in the industry that, when a train derails, the number of derailed cars and the severity of the outcome will increase as the speed of the train increases. It is also understood that the severity of a derailment varies by accident cause, with broken rails generally causing more cars to derail in comparison to other accident causes.^{Footnote 103} Recent examples of unit trains of Class 3 flammable liquids derailing as a result of track failure include:

• In the Lynchburg, Virginia accident, eastbound CSX Transportation (CSXT) unit train K08227 was transporting 104 Class 111 tank cars loaded with petroleum crude oil (UN 1267) when 17 of the cars derailed. The train was 6426 feet long, weighed 14 107 tons and was traveling at 24 mph at the time of the accident. One of the cars was breached and released about 29 868 U.S. gallons (113 000 litres) of petroleum crude oil into the river, some of which caught fire.
• In the Mount Carbon, West Virginia accident, eastbound CSXT unit train K08014 was transporting 107 Class 111 tank cars loaded with petroleum crude oil when 27 of the cars derailed. The train was 6721 feet long, weighed 15 261 tons and was traveling at 33 mph at the time of the accident. Of the 27 tank cars that derailed, 19 cars were involved in a pileup and a post-derailment pool fire. Two tank cars were punctured during the derailment and released product, 4 other cars released product from either top or bottom fittings. The pool fire caused thermal tank shell failures on 13 tank cars that had initially survived the accident. A total of approximately 378 000 U.S. gallons (1.43 million litres) of product was released.
• In this occurrence, eastbound CN unit train U70451-10 was transporting 100 Class 111 tank cars when 29 of the cars derailed. Sixty-eight cars were loaded with petroleum crude oil (UN 1267) and 32 were loaded with petroleum distillates (UN 1268). The train was 6089 feet long, weighed 14 355 tons and was traveling at 38 mph at the time of the accident. Nineteen cars were breached, and about 1.7 million litres of product were released.

While train speed is a primary factor in the severity of the outcome of a derailment, the weight of the cars involved also plays a role, as heavier cars will gain momentum when speed increases and will take more effort to stop. When heavier tank cars are loaded with dangerous goods (DG), the risk of a release and the potential consequences resulting from a derailment are also elevated. Given the circumstances in this occurrence, the speed of the petroleum crude oil unit train increased the severity of the outcome.

On 23 April 2014, following the Lac-Mégantic accident, TC issued Ministerial Order (MO) 14-01 requiring railways to limit key train^{Footnote 104} speed and perform risk assessments for key routes. The MO continued to be re-issued until February 2016, when the TC-approved Rules Respecting Key Trains and Key Routes came into force. The rules require railways to restrict key trains to a maximum speed of 50 mph, and further restrict key trains to a maximum speed of 40 mph within the core and secondary core of CMAs.

The occurrence train was travelling at 38 mph at the time of the accident. Of the 29 derailed DG tank cars, 19 were breached and about 1.7 million litres of product were released to either atmosphere or surface. The product ignited, and fires burned for 5 days. Although the derailment occurred in a remote area and there were no injuries, the accident impacted the environment and required significant post-accident restoration work. Had the accident occurred within a village, town, or CMA, the outcome could have been more severe.

The derailment occurred at a speed that was less than the 40 mph speed restriction required by TC's ministerial order in place at the time of the accident and by the current Rules Respecting Key Trains and Key Routes. Given the severity of the outcome in this and other occurrences, the Board is concerned that a speed restriction of 40 mph may not be sufficient for some key trains, particularly unit trains transporting Class 3 flammable liquids in tank cars that do not meet the TC-117 standard.

4.3 Safety action required

4.3.1 Validation of maximum speed for trains transporting dangerous goods

The severity of the outcome in any derailment is directly related to train speed and other factors. One of the ways that the rail industry manages the risk of derailment is through the reduction of train speed. Train speed is restricted based on the class and the condition of the track. When additional track maintenance is required on the track, slow orders can be implemented to further restrict train speed. This is a regular practice in the industry.

While train speed contributes to the severity of outcome in any derailment, other factors also play a role including train length, the cause of the derailment, the position of the first car(s) derailed, the position of the tank cars in the train and tank car safety design.^{Footnote 105} Although managing train speed based on the condition of the track will help minimize the severity of outcome in the event of a derailment, the risk profile of each train should also be considered. For example:

• "Non-key" mixed merchandise trains which transport few or no DGs and unit trains transporting non-DG commodities (i.e., grain, potash, coal) have the lowest risk profile.
• "Key" mixed merchandise trains transporting the minimum number of DG tank cars which are dispersed throughout the train are exposed to less risk in a derailment since the derailment could occur in an area of the train that is either not transporting DG tank cars or is only transporting a few.
• Similarly, "Key" mixed merchandise trains which transport larger blocks of DG tank cars are exposed to more risk in the event of a derailment.
• "Key" unit trains of DG tank cars transporting Class 3 flammable liquids have the highest risk profile. When a derailment occurs that involves a unit train transporting Class 3 flammable liquids, the risk of release and adverse consequence is high no matter where the derailment occurs within the train, because all cars are carrying Class 3 flammable liquids.

To some extent, TC has recognized the role that train speed and train risk profile plays in severity of the outcome of a derailment, and has put some measures in place to limit the speed of "key trains" under certain conditions. The TC-approved Rules Respecting Key Trains and Key Routes restrict "key trains" to a maximum speed of 40 mph within the core and secondary core of CMAs. Although the restrictions contained in the rules were a step forward at the time issued, the current maximum speed of 40 mph was selected without being validated by any engineering analysis.

Furthermore, the fact that the new tank car standards (TC-117) will not be fully implemented before 2025 means that less robust tank cars, such as those involved in this occurrence, will continue to transport Class 3 flammable liquids. In its reassessment of TC's response to Recommendation R14-01, the Board stated that, until flammable liquids are transported in tank cars built sufficiently robust to prevent catastrophic failure when involved in an accident, the risk will remain high. Therefore, the Board called upon TC and industry to ensure that risk control measures during the transition are effectively managed.

As outlined in section 4.2.1, the Board is concerned that the associated train speed and residual risk may be too high for some "key trains." Therefore, the Board recommends that:

The Department of Transport conduct a study on the factors that increase the severity of the outcomes for derailments involving dangerous goods, identify appropriate mitigating strategies including train speeds for various train risk profiles and amend the Rules Respecting Key Trains and Key Routes accordingly.
Transportation Safety Recommendation R17-01

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on 23 January 2017. It was officially released on 16 February 2017.

Appendices

Appendix A – Weather data from 14 February to 21 February 2015

Date	Time	High/low	Temp. (°C)	Wind dir. (x 10=deg)	Wind speed (km/h)	Visibility (km)	Weather
14 Feb 2015	0001	High	−17	12	13	3.2	Snow
	2300	Low	−31	33	22	19	Ice crystals
15 Feb 2015	0800	Low	−36	30	9	24	Ice crystals
	1600	High	−22	27	12	24	Clear
16 Feb 2015	0200	Low	−37	18	4	24	Clear
	1600	High	−14	18	18	24	Clear
17 Feb 2015	1400	High	−13	36	2	5	Snow
	2300	Low	−21	35	13	24	Snow
18 Feb 2015	0800	Low	−27	33	10	24	Clear
	1500	High	−20	35	18	16	Cloudy
19 Feb 2015	0700	Low	−36	30	11	24	Ice crystals
	1600	High	−23	32	20	16	Ice crystals
20 Feb 2015	0500	Low	−39	18	6	24	Ice crystals
	2100	High	−15	20	16	8	Snow
21 Feb 2015	1400	High	−8	23	15	16	Snow
	2300	Low	−19	33	18	13	Blowing snow

Appendix B – Canadian National Railway Company Engineering Notice No. 2015‑E‑01, Regional Chief Engineering to All Engineering Employees Eastern Region (15 January 2015)

Canadian National Eastern Region- Engineering NOTICE NO: 2015-E-01 DATE: January 15, 2015 Subject: Crushed Heads, Rail Joints, Insulated Glued Joints. To: All Engineering Employees in Eastern Region.

EFFECTIVE IMMEDIATELY – EASTERN CANADA, on all Class 5 Track, Toronto to Winnipeg Corridor, Drummondville, Montmagny, Pelletier and Napadogan subs,

The following will apply to the Eastern Region and will supplement the Track Standards.

This will also apply to crushed heads, rail joints including insulated glued joints.

• Within the next 96 hours all crushed heads and rail joints that are suspected to be over 3mm will be re-measured for crush and rail batter depth. On all joints a cross-level measurements taken to ensure a profile or warp situation is not evident. These lists (crushed heads, rail end batter with profile) are to be sent to each of the Asst Chiefs and myself by Tuesday January 20 at noon. If a profile or warp condition is found to be close to urgent conditions, the condition must be protected as per track standards.
• If a crushed head or rail joint end batter is found to be > 4mm it will have to be changed out within 48 hours. If this cannot be done it will require a 40 mph TSO to be placed immediately until it is changed out.
• If a crushed head or rail joint end batter is found to be >= 5mm it will require a 30mph (slow order) as per the track standards, however we will have only 48 hours to change this out with no exceptions.
• Crushed heads and joints that are over 3.5 mm batter will be measured twice a week.

**Under no circumstances will we compromise Safety and the integrity of our track, however all attempts must be made to remove rail and/or geometry conditions prior to putting on a TS0 (Temporary Slow Order).

SME's, make sure this gets the widest distribution and communication amongst the track people.

This Eastern Region Policy will be in effect until cancelled by the Regional Chief Eastern Region.

[Original Signed Regional Chief Engineering Eastern Region]

Appendix C – National Transportation Safety Board reports involving crude oil trains

National Transportation Safety Board railroad accident brief relating to CSX Transportation Petroleum Crude Oil Train Derailment and Hazardous Materials Release at Lynchburg, Virginia^{Footnote 106}

On 30 April 2014, eastbound CSX Transportation (CSXT) petroleum crude oil unit train K08227 derailed 17 Class 111 tank cars at Mile 146.45 on main track 2 of the CSXT James River Subdivision in Lynchburg, Virginia, as a result of a defective rail. The train consisted of 2 locomotives, one buffer car, and 104 tank cars loaded with petroleum crude oil. It was 6426 feet long and weighed 14 107 tons. Due to track curvature in the area, a permanent maximum authorized speed limit of 25 mph was in place. The train was traveling at 24 mph at the time of the accident.

Three of the derailed cars were partially submerged in the James River. One was breached and released about 29 868 gallons of crude oil into the river, some of which caught fire. No injuries to the public or crew were reported. At the time of the accident, it was cloudy and raining lightly; the temperature was 53 °F.

National Transportation Safety Board factual report relating to CSX Transportation derailment at Mount Carbon, West Virginia^{Footnote 107}

On 16 February 2015, eastbound CSXT petroleum crude oil unit train K08014 derailed 27 loaded tank cars in Mount Carbon, West Virginia, as a result of a broken rail. The train consisted of 2 locomotives followed by a buffer car, 107 tank cars, and a tail end buffer car. The train was 6721 feet long and weighed 15 261 tons. The train was transporting about 3.1 million gallons of Bakken petroleum crude oil (UN 1267, Class 3, Packing Group I) from Manitou, North Dakota, and was destined for Yorktown, Virginia. At the time of the accident, CSXT had implemented a temporary 40 mph speed restriction on the territory due to cold weather. The train was proceeding at 33 mph at the time of the accident. The temperature was 15 °F and there was 8 inches of recent snow.

Of the 27 tank cars that derailed, 19 cars were involved in a pileup and a post-derailment pool fire. Two tank cars were punctured during the derailment and released product, 4 other cars released product from either top or bottom fittings. The pool fire caused thermal tank shell failures on 13 tank cars that had initially survived the accident. A total of approximately 378 000 U.S. gallons (1.43 million litres) of product was released.

All tank cars involved in this accident were specification DOT-111A100W1 built to the Association of American Railroads (AAR) CPC-1232 industry standard. At the time of this accident, neither the DOT-111 tank cars nor those manufactured to the AAR CPC-1232 standard were required to be equipped with thermal protection systems to protect the tank from exposure to pool or torch fire conditions that can occur in accidents.^{Footnote 108}

None of the tank cars had thermal protection. During the derailment sequence, 2 tank cars were punctured, and released more than 50 000 gallons of crude oil. Of the 27 tank cars that derailed, 19 cars were involved in a pileup and the post-derailment pool fire. The pool fire caused thermal tank shell failures on 13 tank cars that had initially survived the accident. Only 1 tank car at the edge of the pool fire survived without release. The other 8 derailed tank cars, which were positioned on either side of the pool fire, were not significantly damaged and did not release product.

On 12 April 2015, the National Transportation Safety Board issued to the Pipeline and Hazardous Materials Safety Administration 4 urgent safety recommendations that address the retrofitting of thermal protection systems for DOT-111 tank cars used to transport Class 3 flammable liquids. The recommendations included:

Require that all new and existing tank cars used to transport all Class 3 flammable liquids be equipped with thermal protection systems that meet or exceed the thermal performance standards outlined in Title 49 Code of Federal Regulations 179.18(a) and are appropriately qualified for the tank car configuration and the commodity transported.^{Footnote 109}

In conjunction with thermal protection systems called for in safety recommendation R-15-14, require that all new and existing tank cars used to transport all Class 3 flammable liquids be equipped with appropriately sized pressure relief devices that allow the release of pressure under fire conditions to ensure thermal performance that meets or exceeds the requirements of Title 49 Code of Federal Regulations 179.18(a), and that minimizes the likelihood of energetic thermal ruptures.^{Footnote 110}

Require an aggressive, intermediate progress milestone schedule, such as a 20 percent yearly completion metric over a 5-year implementation period, for the replacement or retrofitting of legacy DOT-111 and CPC-1232 tank cars to appropriate tank car performance standards, that includes equipping these tank cars with jackets, thermal protection, and appropriately sized pressure relief devices.^{Footnote 111}

Establish a publically available reporting mechanism that reports at least annually, progress on retrofitting and replacing tank cars subject to thermal protection system performance standards as recommended in safety recommendation R-15-16.^{Footnote 112}