Railway Investigation Report R99T0031

On 06 February 1999, at approximately 1628 eastern standard time, Canadian National eastward freight train No. M-304-41-05, travelling from Hornepayne, Ontario, to Toronto, Ontario, derailed 20 cars at Mile 248.5 of the Ruel Subdivision. The derailed cars (the 21st to the 40th behind the locomotives) included a loaded tank car of liquefied petroleum gas and two tank cars loaded with a flammable liquid mixture. Benzene was the main component of the flammable mixture, while dicyclopentadiene was the second main ingredient. One of the tank cars of the benzene mixture was punctured during the derailment resulting in a fire and a total loss of product. The liquid benzene and some lumber that was strewn about the derailment site fuelled a fire that burned for several days. One of the other derailed cars was subsequently found to have a burnt-off axle journal bearing. The remote location of the accident site minimized the risks to the public. There were no injuries.

Ce rapport est également disponible en français.

1.1 The Accident

At approximately 1615 eastern standard time (EST)^{Footnote 1}, Canadian National (CN) freight train M-304-41-05 (train 304) was proceeding eastward from Hornepayne, Ontario, to Toronto, Ontario. As the train passed by the Wayside Inspection System (WIS) site at Mile 255.1 of the Ruel Subdivision near Oba, Ontario, the WIS detected several abnormal conditions around the 95th and 96th axles on the train, including hot bearings, hot wheels and dragging equipment. The dragging equipment detector (DED) feature of the WIS had been declared out of service more than 12 hours before^{Footnote 2}. Figure 1 shows a schematic of the track in the area around Oba.

The location of the detected conditions (95th and 96th axles) coincided with the trailing truck on a bulkhead flat car, CN 604697 (21st car), loaded with packaged lumber products. A radio message was transmitted directly to the train crew from the WIS site ("talker"), verbally advising the crew of "dragging equipment," followed by radio messages of "multiple alarms." Intermittent audible tones were also provided to the train crew indicating the detection of multiple alarms. The crew was unaware of the specific defective conditions detected by the WIS, and the audible tones provided to the crew did not differentiate between a hot box or dragging equipment problem, as both were potentially serious conditions requiring prompt attention.

The crew members proceeded to slow their train, preparing to stop and make a visual inspection. As they were slowing, they radioed the rail traffic controller (RTC) in Toronto to advise of their situation and also to make the RTC aware that they had been stopped by an alarm at the same site during their previous trip. They requested direction from the RTC as to what they should do. The RTC stated that the DED was now out of service; however, he would consult with the hot box operator (HBO) in Edmonton, Alberta, for guidance^{Footnote 3}.

Once contacted by the RTC in Toronto, the HBO in Edmonton consulted with the rail traffic control mechanical service representative (RTC Mech), who worked in the same office, about the conditions on the tape at Oba. The RTC Mech concluded that the tape produced from the scan at Oba was "faulty."^{Footnote 4} The RTC subsequently instructed the train to proceed. No restrictions were issued to the crew.

At approximately 1628, when the train was passing the east switch at Neswabin, at Mile 248.5, the crew members experienced a train-initiated emergency brake application. After the train stopped, the crew members heard a loud noise and saw behind them, about 20 car lengths away, a cloud of smoke blowing towards them in an easterly direction (see Figure 2). The train was carrying 20 tank cars of seven different dangerous goods intermixed through the consist. The crew members immediately made a radio broadcast to the RTC in Toronto advising of the accident. The crew members did not know what, if any, dangerous goods were involved at that time, nor the number of cars derailed, but were able to describe to the RTC the noises they heard and the smoke and fire they could observe from their location. They disconnected the two locomotives from the rest of the train and proceeded eastward to what they considered to be a safe location, at approximately Mile 239.

The RTC immediately initiated the emergency response. The emergency response was multi-disciplined, including police, fire, railway, shipper, and private contractor emergency response teams, as well as various provincial and federal regulatory agencies.

A subsequent aerial inspection of the train revealed that 20 cars had derailed: the 21st to the 40th behind the locomotives. The bulkhead flat car, CN 604697, was found to have a burnt-off axle journal (BOJ)^{Footnote 5}, later determined to have been located at the L-3 position, which was adjacent to the lead wheel of the trailing truck on the south rail (95th axle). The derailed cars included a loaded tank car of liquefied petroleum gas (LPG) and two tank cars of benzene, a flammable liquid mixture (see section 1.3). One of the tank cars of benzene, AGEX 1001, was badly damaged resulting in a total loss of product. The liquid benzene and some lumber that was strewn about the accident site from some bulkhead flat cars that were destroyed in the accident fuelled a large fire that burned for several days. The jacket of the loaded tank car of LPG, CGTX 63501, was scorched by the heat from the fire; however, there was no release of product (see Figure 3). The emergency response procedures were carried out in a timely and effective manner.

1.2 Injuries

There were no injuries as a result of this derailment.

1.3 Dangerous Goods

1.3.1 Flammable Liquid Mixture

Tank cars AGEX 1001 and PROX 41841 contained a mixture of flammable liquids with benzene being the main component. According to the shipping document, the product was shipped as "flammable liquids, n.o.s. (benzene), Class 3, PG I, UN 1993." The second main ingredient was dicyclopentadiene. In addition to the two main ingredients, there were more than 10 other aromatic compounds included in the mixture.

Benzene, the main constituent of the flammable mixture, is a flammable toxic liquid whose vapours may cause a flash fire (Class 3, UN 1993). The lower explosive limit (LEL)^{Footnote 6} of benzene is 1.2 per cent and its upper explosive limit (UEL) is 7.8 per cent; both values are concentrations by volume of product in air. The flash point of benzene is 12 degrees Fahrenheit (F). The toxicity of benzene affects the central nervous system, respiratory system, blood and bone marrow (e.g. leukemia). The primary routes of entry are inhalation and absorption through the skin. It is a known human carcinogen with poor olfactory warning properties. The current maximum exposure limit for benzene is 0.1 part per million (ppm) as set by the National Institute for Occupational Safety and Health (NIOSH), and 0.5 ppm as set by the American Conference of Governmental Industrial Hygienists (ACGIH). The short-term exposure limit (15 minutes) is set at 1 ppm by the NIOSH and at 2.5 ppm by ACGIH. Canadian Standards Association tests show that an average person is able to detect the odour of benzene at concentrations of 4.68 ppm or higher depending on the individual and test conditions. Concentrations at these levels exceed maximum permissible limits. Vapour pressure of benzene is 75 mm at 68°F.

Industrial hygienists with a private contractor monitored the site, and employees working at the site were advised when benzene levels required the wearing of specialized personal protective equipment, such as protective clothing and self-contained breathing apparatus. Ontario Ministry of Environment officials oversaw the clean-up and remediation efforts in the derailment area.

Dicyclopentadiene is a flammable, toxic solid with a camphor-like odour and a melting point of 91°F. The vapour pressure of dicyclopentadiene is 1.4 mm at 68°F. Because of these characteristics, it is usually transported in solution with benzene. The flammability limits are 0.8 per cent by volume LEL and 6.3 per cent by volume UEL. The flash point of dicyclopentadiene is 90°F. It is quite reactive and can polymerize (undergo a chemical reaction where molecules combine) explosively as well as depolymerize. It is considered moderately toxic by inhalation and mildly toxic by skin contact. Maximum exposure limit is set at 5 ppm by both the ACGIH and the NIOSH. The organs affected by exposure to dicyclopentadiene are the kidneys, central nervous system, and respiratory system. In the United States, it is part of the Genetic Toxicology Program, administered by the Environmental Protection Agency (EPA), which is evaluating its links to genetic mutations and other detrimental genetic effects.

1.3.2 Liquefied Petroleum Gas (LPG)

Propane, as transported in tank cars, is a flammable colourless liquefied gas (i.e. shipped under pressure). Its flammability limits are 2.4 per cent by volume LEL and 9.5 per cent by volume UEL. The flash point of propane is minus 156°F. The permissible exposure limit is 1,000 ppm. It is a highly dangerous fire hazard when exposed to a source of ignition, or if the tank is subjected to heat or flame. Propane can react vigorously or explosively with any oxidizer. It is toxic to the central nervous system at high concentrations, and can also act as an asphyxiant.

1.4 Damage to Equipment

Sixteen of the twenty derailed cars from train 304 were destroyed, including three tank cars that were involved in the post-derailment fire. Four cars experienced minor damage and were repaired and returned to service.

The car with the BOJ, CN 604697, was slightly damaged. The car was examined after the accident. No signs of roller bearing grease were noted on the truck and underframe area of the car immediately above the roller bearing where the BOJ was located (the L-3 position).

The tank cars of benzene, AGEX 1001 and PROX 41841, were built to specification DOT-111A100W1. Car AGEX 1001 was badly damaged during the derailment sequence and lost its entire contents (see Figure 4). The susceptibility of minimum standard Class 111A cars to experience damage during a derailment has been known throughout the North American railway industry, including railway safety regulators, for a considerable time.

The tank car of LPG, CGTX 63501, was built to specification DOT-112J340W. The tank car was heavily damaged but experienced no loss of product.

TSB personnel examined three of the more seriously damaged tank cars and the detailed results of this examination are contained in Appendix A.

1.5 Other Damage

The first marks on the railway ties were noted approximately 200 feet before the WIS at Mile 255.1. The derailed wheel set of car CN 604697 caused minor damage to 6.75 miles of track. There was substantial damage to the hot box detector (HBD) at Mile 255.1, and to the west power switch to the Neswabin Siding, at Mile 249.8. The east power switch and dwarf signal at Neswabin, Mile 248.5, and 500 feet of track immediately east of the east power switch were destroyed. In the main derailment area, a total of four telephone poles and all associated hardware were destroyed. Total property damage exceeded $1.5 million.

1.6 Personnel Information

The operating crew consisted of a locomotive engineer, a conductor and an assistant conductor. They were qualified for their respective positions and met fitness and rest standards.

1.7 Train Information

Train 304 consisted of 2 locomotives and 71 cars: 57 loads, 13 empties and 1 residue. The train was carrying a variety of dangerous goods as follows:

• 1 load of LPG, Class 2.1, UN 1075
• 10 loads of vinyl chloride, Class 2.1, UN 1086
• 2 loads of benzene/dicyclopentadiene, Class 3, UN 1993
• 3 loads of anhydrous ammonia, Class 2.4, UN 1005
• 2 loads of methanol, Class 3, UN 1230
• 1 load of ethylene glycol, Class 9, NA 3082
• 1 residue of N-dimethylformamide, Class 3, UN 2265

The train was approximately 4,850 feet in length and weighed about 7,000 tons.

1.8 Occurrence Site Information

The subdivision was single main track in the derailment area, and handled both passenger and freight traffic. The track structure consisted of 136-pound continuous welded rail (CWR) rolled in 1992 and laid in 1993. The ties were No. 1 hardwood. The rail was secured with six spikes per tie on 14-inch double-shouldered tie plates, anchored every second tie with improved Fair anchors. The ballast consisted of slag on a full crib and was in good condition. The roadbed was elevated approximately 10 to 15 feet above the surrounding ground level.

The authorized time table speeds between Mile 245.5 and Mile 252.2 on the Ruel Subdivision were 55 mph for passenger trains and 45 mph for freight trains.

1.9 Method of Train Control

Train operations from Mile 1.6 to Mile 295.6 on the Ruel Subdivision were controlled by the Centralized Traffic Control System authorized by the Canadian Rail Operating Rules (CROR) and supervised by an RTC located in Toronto.

1.10 Weather

The temperature at the time of derailment was approximately minus 10 degrees Celsius, and wind was from the north-west at approximately 15 km/h. Precipitation was nil; however, there were blowing snow conditions around passing trains due to recent snow accumulations.

1.11 Recorded Information

1.11.1 Locomotive

The event recorder transcript indicated that the emergency brake application occurred at 1628:28. At that time, the train speed was 42 mph, with the throttle in the No. 8 position. At 1629:16, the train speed was registered as 0 mph.

1.11.2 Wayside Inspection System (WIS)

A review of recorded data from WIS sites located at Mile 282.3, Mile 268.7, and Mile 255.1 of the Ruel Subdivision revealed the following:

• No abnormal roller bearing temperatures or dragging equipment were detected as the train passed the site at Shekak, Mile 282.3.
• The WIS at MacDuff, Mile 268.7, generated a warm bearing indication in Edmonton for the 95th axle due to the differential of temperatures between the north and south rail bearings. The reading on the scanner printout for the north rail was 1.8 mm (a "pedestal pulse"^{Footnote 7}) and the reading on the south rail was 8.2 mm, a differential of 6.4 mm between the north rail and south rail. CN system procedures require train crews to be advised of an overheating bearing once the differential exceeds 8 mm^{Footnote 8}.
• As noted previously (section 1.1), the talker device of the WIS at Oba, Mile 255.1, communicated a number of alarms, including hot bearings, hot wheels and dragging equipment. It did not convey any information to the train crew that the WIS had been rendered inoperative, or damaged, by the passing train.

1.12 Inspections

1.12.1 Engineering Inspections

A rail TEST car (Pandrol Jackson) last tested the Ruel Subdivision on 15 and 16 January 1999, and no defects that required immediate attention were noted in the area of the derailment. In May 1998, maintenance-of-way extra gangs completed a tie-replacement program between Mile 268 and Mile 295.6. The track was last inspected by a track supervisor on 04 February 1999, and no irregularities were noted. The local snow protection track maintenance foreman and a signal maintainer passed over the track in a Hi-rail vehicle between 1000 and 1400 on the day of the accident, and again no exceptions were noted.

1.12.2 Safety Inspection of Car CN 604697

Car CN 604697, carrying a load of lumber, originated in northern British Columbia and was destined to a customer in the eastern United States. The repair record shows that the No. 3 wheel set (the third axle from the B-end of the car) was last replaced in 1995 at a U.S. repair location. The car had travelled 132,000 miles since the wheel set was replaced. The load of lumber that it was carrying was distributed evenly over the length of the car.

Before the eastward departure of the car from CN's Prince George Yard, the car had received an initial safety inspection^{Footnote 9} by a certified car inspector, and no defects were noted. Car CN 604697 had previously been on a train that was involved in a collision on 31 January 1999, in Jasper, Alberta. Nine of the head-end cars at Jasper either derailed or showed signs of being subjected to severe compressive loads. Car CN 604697 was located in the 30th position in that consist and did not derail. The car was inspected by certified car inspectors at the site after the accident^{Footnote 10}. With no obvious signs of derailment damage nor signs of being subjected to severe compressive loads, the car was determined to be fit to return to service. Subsequent to this derailment, repair records for the first 25 non-derailed cars from the Jasper collision were reviewed to see if any of the wheel sets had experienced premature roller bearing failure, and none had.

Subsequent safety inspections of car CN 604697 were conducted en route at Edmonton and Winnipeg; again, no defects were noted. Weigh scales in Winnipeg Yard recorded the total weight of the car and it was found to be within allowable limits.

1.12.3 En Route Inspections

Before the WIS at Oba, the train had passed over two WIS sites (Shekak, Mile 282.3, and MacDuff, Mile 268.7), and no alarms were communicated to the crew by the advance warning alarm (AWA) system (the talker) at either of these two sites. However, the display screen at Edmonton was showing a warm bearing (yellow) indication at Mile 268.7 to the HBO.

Between the initial terminal of Hornepayne and the point of derailment, a distance of approximately 41 miles, train 304 had been inspected by the crew members of three other trains that were passed at the three sidings preceding the point of derailment (see Figure 5). Train 304 was inspected on the north side only at these three locations. Due to heavy snow conditions, there were few safe areas for employees to position themselves to inspect a passing train on the south side. No defects were noted during these inspections.

1.12.4 Other Information--Roller Bearings and Burnt-off Journals (BOJs)

Roller bearings are pressed onto the ends of railway axles adjacent to the wheel plate area. There are typically eight roller bearings per car, one on each end of the four axles. Roller bearings are normally of a tapered design, and support and transfer the weight of the rail car and its contents onto the axles and through the wheels to the rails. The bearing is positioned within a pedestal jaw of a truck side frame. The moving parts of the roller bearing allow the solid wheel/axle combination to which it is attached to rotate with little friction (see Figures 6 and 7). General roller bearing information can be found in Appendix B.

Overheated roller bearings occur when inadequate lubrication or mechanical flaws result in an increase in bearing friction. This phenomenon is called a "hot box" in railway jargon. The bearing temperature can continue to rise and lead to complete failure of the axle, commonly referred to as a "burnt-off journal" (see Figures 8, 9, and 10).

A BOJ normally results in the derailment of the car on which it occurs. Should axle failure happen while the train is proceeding at a high speed, the derailment frequently results in multiple cars derailed and/or damaged. Figure 11 shows the total number of BOJs since 1994 provided to the TSB during the investigation by the three Class 1 Canadian railways.

A hot box condition on roller bearing-equipped rail cars can elevate quickly and become a BOJ within a few miles. A review of 47 derailments following a BOJ that happened between 1992 and 1996 showed that 22 of the derailments occurred within five miles after passing an operative HBD without an alarm condition^{Footnote 11}. The HBD spacing on some core routes is 25 to 30 miles, as that was a common distance that the now prohibited plain bearing could travel if it overheated without resulting in a BOJ. Advancements in roller bearing technology have led to the replacement of plain bearings on all interchange rail cars.

1.13 WIS Technology

1.13.1 Background Information

Over the last 25 to 30 years, many North American railways have implemented large numbers of HBDs and DEDs as an integral part of their railway infrastructure. This technology assisted railway personnel in the identification of operating problems that posed a risk to safe train operations.

Subsequent to the 1979 Mississauga train derailment, "gateway" locations were identified entering densely populated areas. Before entering such areas, trains carrying dangerous goods were required to be inspected. Within these areas, trains were subject to certain operating restrictions to enhance the safety of their operations. Railways could satisfy the inspection requirement if the train had a successful inspection by a hot box and dragging equipment detector. Without such technology, other measures had to be taken, such as having the trains stop and be inspected by the train crews or by other railway employees.

Later, some HBDs were further enhanced with the addition of hot wheel detectors (HWDs) and significant improvements to the hardware; e.g., analog to digital, improved infrared scanner technology and, more recently, sophisticated computer hardware. As user confidence grew with the technology and the railways realized improved safety to their operations, more and more HBDs, HWDs, and DEDs were added to their fixed infrastructure and the sites became known as Wayside Inspection Systems (WISs).

CN's WIS of today is a distributed system comprising sensors in the field, coupled with office computers (located in Edmonton, Toronto, and Montréal) and a network of personnel from various departments within CN (Signals and Communications, Mechanical, and Operations) who perform functions from testing to reading and interpreting the WIS data.

1.13.2 General Description

The HBD senses radiant infrared heat energy emitted from the bearing as it passes the detector. The heat energy is converted to an electrical output proportional to the amount of heat and relative to the ambient temperature. Ambient temperature is determined by scanning the bottoms of the rail cars as they pass. The electrical output is fed to a data processing unit (DPU) in an adjacent bungalow, which is a structure that encloses various electrical and electronic equipment necessary to operate the railway system. When the train has passed the site, all the data are sent to the office for interpretation, with hot wheel and dragging equipment indications flagged in the data. All data are sent in as raw "uninterpreted" data for office analysis at warm and hot levels. If the amount of energy sensed by the HBD exceeds preset values, then the appropriate indication is generated. Such an indication is immediately relayed to the HBO (where it is displayed in graph form measured in millimetres) and to the train crew by the AWA through a radio ("talker") system (see Figure 13).

Today, HBDs are strategically placed throughout the core network of most major railways. The principal target of the detectors is freight car bearings (which comprise about 97 per cent of all axles). CN has 68 subdivisions protected by HBDs, representing over 97.9 per cent of CN's traffic. Of the remaining 48 subdivisions, 11 are under 20 miles in length and account for 0.4 per cent of traffic. The remaining 37 subdivisions which are not equipped with HBDs carry 1.7 per cent of CN's traffic. Typical spacings of HBDs on main corridor routes of both CN and Canadian Pacific Railway (CPR) seldom exceed 30 miles. After a five-year major capital program west of Capreol, the spacings in many areas on CN core routes were reduced to 12 to 15 miles. Locations where the risks were low, such as subdivisions with low gross ton-miles or no dangerous goods traffic, were frequently not targeted for the installation of HBDs. CN continues to invest in additional HBDs to progressively reduce spacing distance on core mainlines and achieve further improvements in roller bearing performance.

1.13.3 Hot Wheel Detector (HWD)

The HWD is similar to the HBD in that it senses radiant heat energy. However, the target in this instance is the wheel plate area near the tread, approximately 2 1/2 inches above the rail. CN's HWDs include an "M"-shape filter which eliminates elevated wheel tread readings due to momentary application of train brakes. Some systems use an HWD scanner on both sides of the track, but most use only one scanner on one side of the track. When only one HWD scanner is used to scan wheels on both the near and far rail, it is normally set at an angle to the track. The outboard wheel plate surface of a wheel on the near rail can be scanned, as can the inboard wheel plate surface of a wheel on the far rail. A reference temperature is established by placing a white board on the far side of the track opposite the HWD scanner. The reference board is used as a base value in order to produce semi-absolute wheel plate temperature readings. The data are transmitted to the DPU in the bungalow and compared to preset alarm thresholds. As with the HBD, alarms are relayed to the HBO and to the train crew by the AWA through the "talker" system.

1.13.4 Dragging Equipment Detector (DED)

The DEDs were of two different designs; paddle (mechanical) or impactor (electronic) style. The paddle style (see Figure 14) consisted of strike plates, both inboard and outboard of the rails, attached to a shaft with a cam-operated switch and a return spring. An object striking the paddles in either direction would rotate the shaft, momentarily opening the switch contacts. An open circuit would trigger an alarm. The impactor style (see Figure 15) was designed to alleviate the problems associated with the paddle style under deep snow conditions and has no moving parts. Stationary strike plates between and outboard of the rails are fitted with accelerometers which detect impact energy. Sufficient impact energy creates an electrical output recognized by the DPU and generates an alarm. DED alarms are always relayed to the train crew by the "talker" system, and to the HBO by modem.

1.13.5 Limitations of the System Hardware

The HBDs are rated to work in ambient temperatures ranging from minus 40°F to plus 160°F. Rated speeds are up to 120 mph. Severe environmental conditions, such as snow storms and blowing snow conditions, heavy rain and ice, can affect the quality of the scan data. The type of housing used for the roller bearings within the truck assembly can have an impact on the ability of the scanners to sense infrared heat energy. Although most freight cars are equipped with standard freight car trucks which are easily scanned, equipment with unusual, heavy, or complicated truck assemblies (e.g. locomotives, specially equipped freight cars and passenger cars) can interfere with the radiant heat being sensed by the HBD scanners. Some passenger cars (e.g. Light, Rapid, Comfortable (LRC) coaches) have no external bearings and are therefore equipped with an on-board heat detection system. The on-board system continually monitors the condition of the internal roller bearings which are not scanned by conventional HBD scanners.

The following VIA Rail Canada Inc. (VIA) equipment has wheel bearings external to the wheels:

The current maximum rated speeds of each type of equipment is:

Only the LRC car fleet (98 cars) has inboard bearings and all these cars are equipped with on-board monitoring equipment. A few VIA locomotives^{Footnote 12} have on-board journal bearing heat monitoring. CN and CPR locomotives are not normally equipped with this type of on-board electronic monitoring. Locomotives without an on-board journal bearing heat detection device rely on the WIS to detect journal bearings that are in a state of distress.

Both Southern Technologies Corporation (STC)^{Footnote 13} and Harmon Industries^{Footnote 14}, the two major suppliers of HBDs in North America, stated that, even in favourable environmental conditions, some bearings on locomotives cannot be accurately scanned. The HBD functions as intended; however, there are mechanical parts located between the bearing and the scanner which can obscure the view of the bearing as it passes the HBD (see Figures 16 and 17). These mechanical parts differ by axle size and by locomotive type. Locomotives represent a small percentage of all axles scanned; however, unlike freight equipment, many locomotives are manned.

1.13.6 Office Computer

Data from the DPU in the track side bungalow are received at a central office computer where they are processed by computer software (Devtronics). The Devtronics software is also used by the operator to view the information in the form of an "analog" chart displayed on a video display. If the WIS values are within normal operating parameters, the operator is not actively notified of the train inspection, though the information is displayed on the operator's screen in the form of a green message line in a status window. If the values meet TP-105 criteria^{Footnote 15} or other criteria defined in the computer software (e.g. car-side average or train-side average which are further explained in section 1.15.4), then the data are presented to the operator in the form of an analog tape displayed on the computer screen. If there is more than one tape to be examined, the first is displayed and all others are placed into a queue and a visible alarm and an audible alarm are generated to alert the operator (see Figure 18).

A train is not normally displayed on the screen in its entirety (e.g. typically 35 cars to a display screen) because of the size of the analog tape. In order to view the complete tape, the HBO must scroll from one direction to another (see Figure 19). When the "high" reading is identified, the operator can obtain more detailed information by clicking on the relevant portion of the tape. Once the tape is examined, the operator has a choice of either acknowledging having viewed and interpreted the tape or placing the tape back into the queue for later reference.

1.14 Maintainers, Technicians, and Operators

1.14.1 Signals and Communications (S&C) Maintainers

Signals and Communications (S&C) maintainers report to a signal supervisor within the S&C Department. They are responsible for performing monthly tests on the WIS sites. A device supplied by the manufacturer for this purpose known as the function simulator is used to simulate an overheating bearing. The temperature setting used in the test procedure is 135°F above the ambient temperature. The WIS system alarm threshold temperature setting is 180°F above ambient. Interviews with S&C maintainers revealed that training associated with the testing of WIS sites consisted basically of on-the-job training through observing others doing the monthly tests.

The S&C maintainers also respond to trouble calls as required. At the time of the occurrence, they did not have an easy way in the field to identify problems with the various components of the WIS, particularly the DED, and repairs of a highly technical nature frequently required the assistance of technicians. Numerous sites in the northern areas were only accessible by Hi-rail vehicle. This restriction affected the amount of time that a site would be out of service compared to sites in urban areas where access was usually easier (e.g. road).

The primary goal of an S&C employee when responding to trouble calls involving the WIS was to restore it to correct operating condition. The main complaint presented to S&C maintainers from the operating employees (train crews, RTCs, etc.) was that the WIS was stopping trains unnecessarily (false alarms); therefore, one of their routine tasks was to make the WIS stop sending alarm messages when there was no defect. To ensure the field repairs corrected the problem with a WIS, an informal practice had evolved of allowing four trains (which provided normal indications on previous sites) to go over a site without generating alarms before certifying the site as repaired.

1.14.2 S&C Technicians (Office and Field)

The S&C technicians who worked in the offices associated with the WIS were located in Montréal, Toronto and Edmonton in the rail traffic control centres. However, they reported directly to a signal supervisor within the S&C Department.

With respect to the WIS, the primary role of the S&C office technicians was to read and interpret test tapes generated by S&C maintainers in the field, record trouble calls associated with the WIS sites, dispatch personnel to ensure proper operation of the sites, and read and interpret test tapes generated by the CN TEST car. Some of the office technicians indicated that they had no formal training on interpreting test tapes, other than the information provided in manuals, and from observing others doing the job.

The S&C technicians who worked in the field inspecting and maintaining the WIS field sites were normally based at radio shops or field offices located strategically along the right-of-way throughout the CN system. There were fewer technicians than signal maintainers. A signal technician would typically cover the territory of several maintainers. S&C technicians performed more in-depth technical work due to their more extensive technical training and were usually called out in cases where S&C maintainers needed more detailed technical assistance. S&C technicians worked under the auspices of a signal supervisor located in the field.

1.14.3 TEST Car Operators

CN currently has two dedicated track geometry cars (TEST cars) for the purposes of measuring track conditions. Both TEST cars are accompanied by an operator who ensures the on-board computerized track geometry equipment is functioning as designed. Only one of these TEST cars is capable of dynamically testing the HBDs. This car last travelled over the major corridor routes in eastern Canada, including the Ruel Subdivision, in September 1995. CN did experiment with equipping one of its TEST cars with hot wheel simulators but the modification was unsuccessful because of problems related to track clearance, and the technology was removed due to repetitive damage in service. Neither TEST car had been equipped to test DEDs.

No other Canadian railway is known to have a car capable of dynamically testing any aspect of WIS sites.

A TEST car is coupled to a highly instrumented box car and then pulled by a freight locomotive (see Figure 20); therefore, the maximum operating speed of the TEST train is limited to subdivision zone speed for freight trains (typically 60 mph), any temporary or permanent slow orders, or other restrictions that may be in effect (e.g. on a General Bulletin Order).

Maximum passenger train speeds on CN subdivisions are typically 70 or 80 mph, but can be up to 100 mph on corridor service routes for LRC passenger trains (Québec to Windsor). The maximum permissible speed for freight trains is typically 60 mph, but 65 mph is allowed for designated trains (e.g. high-speed intermodal). CN states that, since the principal target of the WIS system is freight car bearings (which comprise about 97 per cent of all axles) and since eastern corridor passenger cars (comprising many of VIA's high-speed passenger car-miles) are equipped with inside bearings and on-board sensors, the TEST car process is matched to the statistical need.

The computer on board the TEST car will see a slow down of data processing if operated at a speed of 65 mph for extended periods of time. The data are not lost, only delayed due to the time required for processing.

1.14.4 Hot Box Operators (HBOs)

The HBOs are unionized employees who report to the Operations Group and come under the auspices of the Edmonton rail traffic control centre manager. The primary goal of the HBO is to examine WIS tapes to identify dragging equipment and possible hot boxes and to detect conditions which may indicate a malfunctioning detector. Before the introduction of the RTC Mech, the HBO also stopped trains in response to alarms for hot wheel conditions.

Training for HBOs consists of one day of classroom instruction, including an examination, followed by a minimum of four days of on-the-job training with a more experienced HBO. The on-the-job training can be extended as required at the supervisor's discretion. Refresher training may also be given to employees who are trained, but have not worked in the position for six months. After not working in the position for 12 months, an employee must undergo refresher training. Refresher training may consist of one or more of the following: "sitting-in" for a number of assignments with an experienced HBO, classroom instruction, and an examination.

Company policy states that, when new, revised or supplementary instructions are introduced (depending on the extent of the changes), refresher training may be deemed necessary for all employees affected. With respect to the Devtronics software, the HBOs were provided with instructions on its use, and were allowed a transition period of several months where both the new computer system and the older CN office computer were operated side by side. The HBOs were also given the opportunity to provide design recommendations based on their experience during this phase-in period.

1.14.5 Rail Traffic Control Mechanical Service Representatives (RTC Mechs)

The RTC Mechs are management level positions reporting to the Director of Mechanical Services, West. They are formally trained to work within the operating guidelines of TP-105. The remainder of their tape reading and interpretation skills have been derived experientially.

The RTC Mech positions were established in response to a study group which examined "Why Wheels Fail." As part of this study, it was determined that proactive monitoring and action might prevent wheel failures associated with sticking brakes. When the RTC Mechs were first established as a group, this was accomplished by taking action based on the monitoring of HWD data. As the RTC Mechs became experienced at interpreting the hot wheel data, they began to expand their role and became more involved with hot bearing data. Through this experiential learning process, involving the examination of both hot wheel and hot bearing tapes in unison, they developed strategies to better discern whether the data indicated a hot wheel due to a sticking brake, or a hot bearing due to a failing journal.

In addition to these duties, the RTC Mechs attempted to reduce unnecessary on-line train stops.

1.15 Hot Bearing Detection Task and Workload

1.15.1 Hot Bearing Detection Task

Different criteria are used to identify different levels of bearing state and associated alarm conditions. The following table (see Figure 21) and sections describe in more detail the different alarm settings and associated criteria for the varying equipment and systems monitored by the WIS.^{Footnote 16}

1.15.2 Advance Warning Alarm (AWA) Criteria for Hot Bearing

The AWA was designed to alert a train crew should an alarm condition, such as a hot bearing, a hot wheel, or dragging equipment, be detected. For hot bearings, if HBD criteria met or exceeded 17 mm absolute deflection or 10 mm differential from one side of the axle to the other, the WIS immediately initiated a double audible tone followed by a message(s) on the designated end-to-end radio standby channel (advising the crew of an alarm condition, identifying the axle number and side of the train). If other hot bearing or dragging equipment defects were detected on the same train, double tones would be broadcast as the defects were encountered, and the final message after the train had completely passed the WIS would indicate ". . . multiple alarms, repeat, multiple alarms. . . ." The Devtronics system would also report AWAs to the Edmonton HBO/RTC Mech office. Once the train passed the WIS site, a tape could then be interpreted (normally by the HBO), and the location of the hot bearing would be passed onto the train crew members who then physically inspected the stopped train.

CN General Operating Instructions (GOIs) required that "the train . . . must stop immediately, consistent with good train handling practices advising the RTC the location where the engine came to a stop." The crew member performing the inspection would proceed to the identified car and inspect all journals. If all journals appeared to be normal, inspection had to be made of all journals on at least three cars ahead and behind the identified car. The crew member was required to use a temperature-indicating crayon ("tempilstik") to aid in determining if the bearing was dangerously overheated.^{Footnote 17} Melting of the tempilstik was intended to indicate that the car had to be "set off" for repairs.

In addition to the use of a tempilstik on a suspect journal, a visual inspection was required to determine if there were any other defects present. A review of data pertaining to CN train stops from 1995 to 1999 revealed that, between 30 and 40 per cent of the time, train crew members could not find a defect when instructed to stop and inspect a particular car.

Rule 36 E.1. of the Association of American Railroads (AAR) Field Manual of the A.A.R. Interchange Rules states "To check bearing for overheated condition, use of a temperature indicating crayon (200 degrees F) or other temperature measurement device on outside of cup is required." Use of a tempilstik provided both confirmation that the bearing was hot, and that it was physically inspected at the time the car was set off.

1.15.3 TP-105 Criteria

CN's use of TP-105 criteria predates its use of AWAs using a talker system. It also distinguishes CN as one of the few railways in North America that attempts to use operator judgement to supplement the use of technological equipment. TP-105 criteria incorporate a more restrictive threshold than that used by the AWA system. Operators use these more restrictive criteria to help them identify bearings as potentially being in the early signs of distress. TP-105 criteria include provisions for the early detection of bearings for the following conditions, each of which is further explained later in this section:

• hot bearing absolute deflection
• hot bearing differential
• warm bearing absolute deflection
• warm bearing differential

When a scanned bearing met TP-105 criteria for a hot bearing (15 mm absolute deflection or 8 mm differential), the HBO was presented with an electronic tape, and a red message was placed on a status window on a computer monitor at the HBO workstation. The WIS would not broadcast a message in the field unless the AWA criteria (which were higher) had been exceeded. It was up to the HBO to examine the tape and confirm if TP-105 criteria had been exceeded. If they were, then the HBO was required to contact the train crew through the appropriate RTC and stop the train, providing the crew members with the location of the potentially hot bearing on their train for inspection.

In the event that a warm bearing was detected (based on TP-105 criteria of 12 mm absolute deflection or 6 mm differential), then the operator was again presented with a tape, and a yellow message was displayed in the status window. When a warm bearing was detected, the HBO was expected to make a comparison of this tape with the tape of the same train obtained at the previous detector site. The HBO was then expected to pay close attention to the suspected car, as it moved over subsequent detectors, to determine if the bearing was overheating, maintaining its temperature, or cooling down.

As per system design, no information about the warm bearing alarms was normally conveyed to the train crews or the RTCs.

Examining the tape of a train from a previous site involved determining the direction of the train, the number of axles on the train (to help in identifying the train at the previous site), and the axle number which was heating up. With this information and a knowledge of train routings and track layout, the operator could then determine the location where the train was last inspected by a WIS. To determine the last site where a train was inspected required performing a few functions using the Devtronics software (searching through a few "window"-type computer screen displays). A window showing the previous site was opened and the status screen for the site was examined to locate a train with a similar number of axles, having very recently gone over the site. The tape for this train could then be called up and examined.

The method used to monitor a train as it moved over subsequent detectors was much the same. It involved manually identifying the direction of the train, and then opening up a window which allowed selection of the following site. The system was then configured to display the tapes of all trains passing over this site, regardless of the temperatures detected by the sensors. It was up to the HBO to determine which tape was associated with the suspect bearing. There was no special message brought to the HBO's attention signifying that the subsequent site was flagged at "operator request" as opposed to a tape generated during regular operations. A test performed during the investigation revealed that an HBO could flag the wrong subsequent scanner in an area where trains diverge from one subdivision to another. This was particularly true if the HBO was not intimately familiar with the track layout and train routing practices in a specific area.

1.15.4 Car-Side and Train-Side Averages

The Devtronics software also identified two other types of potentially warm bearings; those based on a car-side average, and those based on a train-side average. These were displayed to the operator in the same manner as the warm bearings, identified on the basis of absolute deflection (WB) or differential (WD). The only distinguishing feature was that they were labelled W2 and W3 on the status screen as opposed to WB or WD. When a warm bearing was detected, it was categorized into one of the four types, depending on severity, with the following priority; WB, WD, W2 and W3 (highest to lowest).

Some HBOs and RTC Mechs did not differentiate the W2 or W3 indications from the WB or WD indications. W2 or W3 data represent special circumstances where an axle may be starting to overheat, but does not meet the strict 12 mm absolute deflection for WB or 6 mm differential criteria for WD. Several HBOs explained that they would examine W2 and W3 tapes looking for values that exceeded the 12 mm absolute deflection or the 6 mm differential. Such employees were therefore spending time examining W2 and W3 tapes looking for values that, by definition, would only be present in WB or WD indications.

1.15.5 Faulty Tapes

The HBOs and RTC Mechs also examined tapes in order to identify indications of a malfunctioning detector. Based upon their instruction, HBOs and RTC Mechs looked for the following anomalies to identify malfunctioning detectors:

• loss of heat readings or no heat on one or both rails (graphic sample tapes were included in TP-105)
• absence of normal roller bearing indications on trains known to have this equipment
• erratic traces such as noise spikes and weather disturbances
• wave patterns (i.e. voltage variations)
• very high readings due to a miscalibrated scanner
• when one or more bad frames (i.e. missing or corrupt data) remain on the electronic tape after an attempt to retransmit the data from the site
• when one of the following alarms is presented "CHK TRN LENG" or "DO AN RXT . . ." "TOO LONG TRN"^{Footnote 18}

Specifically relating to this occurrence, when the train went over the MacDuff WIS, a warm bearing differential (WD) alarm for the 95th axle was generated. The HBO did not examine the previous site the train had passed over, nor did he flag the next site (Oba) so that a comparison could be made between the two readings to determine if the bearing was becoming progressively warmer. When the train passed over the WIS at Oba, it generated an electronic tape which depicted a multiple alarm tape, including hot wheel, dragging equipment, and hot bearing at or near the 95th axle. There were also pedestal pulse readings (which can indicate the absence of heat readings) on the north rail subsequent to the 95th axle and anomalous spikes on the south rail.

The HBO indicated that he initially thought that this looked like a faulty tape. Then, the HBO, as a result of the hot wheel indication, requested clarification from the RTC Mech regarding the hot wheel tape. The RTC Mech was aware that the DED at this site had previously been taken out of service, and based on his observation of the hot wheel and hot bearing tape, interpreted the results to be a "faulty tape." This information was relayed to the RTC who had contacted the HBO for directions, and the train was allowed to proceed.

The two employees had performed their assessments in an independent manner, with little exchange of information between them about the results of their analysis of the tapes for which each was responsible. Subsequently, the HBO examined the tape from the MacDuff detector and identified the warm bearing at the 95th axle. Based upon this "new information," the HBO began to question the determination of "faulty tape." The HBO had previously encountered a situation where a train had a BOJ and derailed, destroying the scanner on one side of the track. Reportedly, the output tape in that occurrence was similar to the tape at Oba in this occurrence. Unable to convince the RTC Mech of his concerns, the HBO made numerous calls to the RTC and to the S&C personnel in Toronto hoping to obtain verification of his fears regarding the status of the train. It was during this exchange that the train went into emergency.

1.15.6 Workload

On an average day, there were approximately 6,200 WIS site inspections (one complete train scan per WIS site inspection) during a 24-hour period. In roughly 1,100 of these events, the HBO was required to visually inspect a "tape" presented on a screen and acknowledge having done so. Averaged out over a day, this amounted to 45 tapes to examine per hour; roughly one or more tapes to inspect and acknowledge per minute during peak travel periods. Each of those tape inspections took between 5 and 10 seconds to perform. For those tapes that met WB criteria, the HBO was also expected to research the train's previous readings and monitor future readings, which could take an additional 10 to 15 seconds. HBOs reported that this happened on the average about 10 times per shift.

In the month preceding the occurrence, the Edmonton office acquired responsibility for monitoring the sites previously monitored in Toronto and Montréal. The number of sites handled by the Edmonton office increased from approximately 200 to 400. Management indicated that, for a period of time before the centralization of the WIS data, the RTC Mechs attempted to monitor and track trains which showed signs of potential bearing failure. During this trial, they found that it was very difficult to accomplish this while also performing their other duties.

Figure 22 illustrates one of the three monitors in the Edmonton office showing the status of the WIS sites. Each rectangular box represents one WIS site and in total nearly 200 sites are monitored on this screen. Different colours are used to convey information about each site, such as a scan in progress, a site under repair, or a loss of data communication.

The RTC Mech's responsibilities included monitoring the wheel impact load detector (WILD) system for identifying cars that had exceeded certain impact thresholds. This included managing the two-strike system whereby cars that have encountered two WILD detections within a 30-day period are recorded for tracking purposes. During the peak winter months of January and February, when the number of WILD alarms is significantly higher, the RTC Mechs can have 2,000 to 3,000 WILD messages to handle in a month. This number reduces to a few hundred per month in the balance of the year.

RTC Mechs maintained databases for such things as all train stops, air brake hose separations on line, and cars set off on line for any reason. These tasks were in addition to their duties associated with monitoring warm and hot wheels, or assisting the HBO in monitoring overheating roller bearings and dragging equipment. They also acted as a contact point for the Mechanical Department when derailments occurred, and were a resource to train crews and RTCs for other mechanical information. The busy season for RTC Mech activities was normally mid-December to the end of March.

1.15.7 Source of Bearings Set-off in 1999

A review of 130 cars set off CN trains for hot bearings in 1999 revealed that:

• 51 were identified as hot bearings by the AWA;
• 14 were identified as hot bearings by TP-105 criteria; and
• 65 were identified as hot bearings by judgements made by the HBO/RTC Mech.

CN advised that the percentage of hot bearings identified by RTC Mechs/HBOs in the above data is higher than usual, and that for 316 set-offs in 1999, 106 (or about 33 per cent) were as a result of judgements made by RTC Mechs/HBOs.

1.16 Examination of Axle Components

The recovered pieces from the failed axle on car CN 604697 were examined (see Appendix E), as well as a wheel set from the non-derailed end of the same car. Damage to the axle pieces in the area of the burn-off precluded detailed examination^{Footnote 19}.

The mate bearing on the failed axle was examined by sectioning away the cup and cages from the remainder of the bearing. Localized hardening of the metal (brinelling)^{Footnote 20} was observed on the outboard race of the cup adjacent to secondary impact markings observed on its outer surface. There was noticeably less grease on the inboard cone when compared with that on the outboard cone. The rollers and cages were in good condition. The cones were in good condition apart from some secondary oxidation on the race of the outer cone adjacent to the end cap impact area. The front and rear seals appeared to be in good working order.

The examination of the non-derailed wheel set revealed that both bearings were in good condition. The wheels on both axles were examined and determined to be within specifications. There was no sign of any previous damage to the internal components of the R-3 roller bearing, as might have occurred to this wheel set during the Jasper collision (see section 1.12.2).

1.17 Management and Supervision

1.17.1 Background Information

The work of the RTC Mechs and HBOs was performed by a relatively small number of persons (minimum two per shift) on an "around-the-clock" operation. The work they performed had evolved over the years with the advent of other technological equipment installed at wayside locations, such as automatic equipment identification (AEI) readers, WILDs and cold wheel detectors. They continuously looked for ways to improve their use of the available data to enhance the safety of train operations. The offices where they were located were adjacent to the rail traffic control centre in Edmonton.

The supervisor of the HBOs was located in the same building, allowing for frequent direct supervision of the HBOs. The supervisor of the RTC Mechs was located in another building several miles away from their office.

1.17.2 Responsibilities and Reporting Structure in the Edmonton WIS Office

As the role of the RTC Mechs evolved to include the closer scrutiny of hot box tapes, management became aware that there were problems evident with the interface between the RTC Mechs and the HBOs. There was some discussion on whether or not to have the HBOs report directly to the RTC Mechs. However, this reporting structure was not formalized. With the expanding roles of the RTC Mechs, management questioned the need for maintaining both positions (HBOs and RTC Mechs) and discussions were held to find further efficiencies in this area.

In the year preceding this accident, the union challenged the railway company to maintain the positions of HBOs. In subsequent meetings, the union view was accepted. Due to technological improvements (e.g. Devtronics software), in 1999, the activities pertaining to HBOs and RTC Mechs were downsized and centralized at the Edmonton rail traffic control centre. All WIS (and WILD) data across Canada (except for several stand-alone WIS sites, mainly in Manitoba) were then routed to this location. At this time, there was no further delineation of the reporting structure between the RTC Mechs and the HBOs.

Management for the RTC Mechs believed that its staff was responsible for all aspects of the office in Edmonton, comprising final determination of data, including hot bearing tapes. In contrast, Operations management stated that the HBOs had full autonomy with regard to all applications of TP-105 criteria (dragging equipment and hot bearing detection), and that the RTC Mechs would have complete authority over hot wheel, cold wheel, and WILD sites.

1.17.3 Quality Management

CN's S&C had a Quality Control (QC) Group whose purpose among other things was to perform some of the periodic tests required by the S&C Department. The QC Group did not verify the ongoing quality of installation, maintenance or testing of WIS components. It was left to the discretion of the local S&C supervisor to ensure/enforce/verify that the proper tests were performed. In 1995, CN assembled a Quality Action team to develop "best practices" to ensure the proper calibration of WIS devices on a system-wide basis. The information obtained through the efforts of this team were widely disseminated within the S&C Department.

During its investigation, the TSB examined several configurations (e.g. Servo vs Sentry; paddle vs electronic style of DEDs; with and without HWDs) of WIS on five CN subdivisions across Canada. Differences in procedures, local practices and systems knowledge by S&C personnel were noted as summarized below:

Procedures:

• non-standard forms were being used to record similar maintenance activities (such as monthly checks)
• instructions to S&C personnel contained regional variances

Practices:

• the input temperature was being increased or decreased to obtain the appropriate output reading, as opposed to proper calibration
• differing techniques were used for function simulator (such as overheating the flywheel, and climatizing the temperature of the simulator before and during use; e.g., removing it from direct sunlight and placing it in a shaded area or removing it from its stored location during winter and placing it in a heated area before use)
• different tools were used (e.g. thermometers, hammer for testing DEDs, and spray cleaners)
• the testing sequence differed from site to site (e.g. number of DED hits, order of detectors tested, and number of accelerometers tested)
• different testing thresholds were accepted by S&C technicians in the office

Systems Knowledge:

• some S&C maintainers had different criteria for determining what was an acceptable output
• a site with the same function simulator was repeatedly tested until an acceptable output tape was produced (calibration)
• the calibration of the function simulator could not be verified immediately before testing

Variability in procedures and practices was noted to result in different output values from site to site for a known input. A TSB review of output tapes generated by a CN TEST car showed that a computer controlled and recorded input heat, resulting in different output values from site to site. Many of the variances were noted to be biased towards over-sensitization of the system (i.e. a condition where a bearing is identified as overheated when its actual bearing temperature is less than the threshold value).

There was no nationwide overview of TEST car data to measure WIS site performance. TEST car operators were only capable of listening for an audible alarm indicating that the alarm threshold was exceeded. They were not given immediate feedback in terms of output from the WIS site.

Discrepancies were noted with the various manuals provided to the different user groups. For example, the TP-105 manual contained information showing the different criteria to be applied for various types of equipment or bearings (such as locomotives, passenger cars, plain bearings); yet, the system did not prompt the operators who were expected to apply these criteria. Some reference manuals specified different criteria when referring to identical items or conditions. Appendix C contains a comparison of selected topics for some of the more common manuals issued to the different user groups.

Some training manuals had not been revised for four to five years, and did not contain information on some of the newer technology on the system, such as the Devtronics software.

The TP-105 manual also described a number of conditions where a tape could be ruled as "faulty"; e.g., a tape that "loses heat on one or both rails is to be considered as a sign of a faulty tape." No mention was made in the manual of what an output tape may look like if a detector was damaged, possibly due to a derailed car, while a train was passing over a WIS site.

1.18 Regulatory Overview

Canadian Rail Operating Rules (CROR) were filed with Transport Canada (TC) for approval as per the requirements of the Railway Safety Act (RSA) by the Railway Association of Canada (RAC) acting on behalf of its member companies. These rules were approved by the Minister of Transport on 16 January 1990 under the authority of the RSA to be used on federally regulated railways and apply to all railway companies under federal jurisdiction. Under the RSA, these rules have the force of regulations.

CROR rules 110 and 111 state (relevant portions quoted):

110. INSPECTING PASSING TRAINS

1. When duties and terrain permit, at least two crew members of a standing train and other employees at wayside, must position themselves on the ground on both sides of the track to inspect the condition of the equipment in passing trains. When performing a train inspection, the locomotive engineer will inspect the near side of such train. When a group of wayside employees is present, at least two employees must inspect the passing train.

EXCEPTION: Crew members of passenger trains are exempted from the above requirements except when standing at meeting points in single track territory. However, every effort must be made to stop a train when a dangerous condition is noted.

111. TRAIN INSPECTION

1. The train and engine crew must know that equipment in their train is in good order before starting and inspect it whenever they have an opportunity to do so. Equipment added to a train enroute must be examined with extra care to ensure it is in good order.
2. When crew members are on the rear of a moving train they must inspect, at every opportunity, the track to the rear for evidence of dragging or derailed equipment.
3. All crew members on a moving train must make frequent inspections of both sides of their train to ensure that it is in order.

Before cabooseless trains began operations in Canada in 1987, the Canadian Transport Commission conducted an extensive study of train operations and included "tests, conducted to evaluate the reliability of the end-of-train unit and associated devices and to evaluate the risks associated with train operation without rear train crew. . . ."^{Footnote 21} This study resulted in an order (R-41300) issued by the Railway Transport Committee to CN and CPR dated 14 December 1987 requiring that certain safety conditions be adhered to before commencing cabooseless train operations. This order was included in a manual entitled A decision pertaining to cabooseless train operations on Canadian National and Canadian Pacific Railways. This order included 38 clauses CN and CPR had to adhere to in order to operate trains without a caboose. Some of these clauses, relevant to this occurrence, are quoted below:

• 1.3 No cabooseless train shall be operated for a distance in excess of 60 miles without having passed an operational hot box and dragging equipment detector or without having been inspected on each side of the train by employees referred to in item 1.11^{Footnote 22}, or without having been stopped and inspected.
• 1.4 Prior to operation of any cabooseless train all gateway hot box and dragging equipment detectors shall be equipped with hot wheel detectors.
• 1.22 On arrival at crew change points, two members of the inbound crew of a cabooseless train shall respectively position themselves on each side of the track on which that cabooseless train is moving and shall inspect that train while moving outbound for defects and dangerous conditions and shall report by radio any defects or dangerous conditions to the crew of that outbound train upon completion of the inspection.

The RAC conducted a review of order R-41300 in 1994 which listed the instructions that CN and CPR had in place to comply with each of the requirements of the order. Some of the requirements had been implemented, others had been complied with by the issuance of GOIs by the railways, and others had been revoked. GOIs are instructions issued by the railway companies to guide their employees in respect to internal procedures to be followed. They are not submitted or approved by the regulator and can be taken out of the railways' operating manuals without notification to the regulator.

Following this review by the RAC, all aspects of the order were considered to be covered by the railways' internal documents, collective agreements, or were replaced by ministerially approved rules (such as the Railway Freight Car Inspection and Safety Rules, the Railway Freight and Passenger Train Brakes Rules, or the CROR). TC was satisfied with the level of safety indicated by the RAC analysis and revoked order R-41300 on 11 August 1995. Provisions were maintained for inspections at crew change points (provision 1.22 in the original order) and that trains be equipped with an end-of-train information system (provision 1.1 in the original order). There are no minimum regulatory guidelines for the direction of railways pertaining to the installation, inspection, calibration, alarm levels, and quality management of WISs. There is no existing regulatory requirement for any federally regulated railway to be equipped with WISs, or any other wayside inspection system.

TC did not have a program to monitor or audit WISs in order to ensure that they function properly or that they were tested, adjusted/calibrated in such a way to ensure consistent safe operation.^{Footnote 23} As part of TC's national signals program, some regional TC inspectors monitored some of the WIS sites for obvious signs of damage which could have been caused by an object dragging from a train striking a component of the WIS. The number of such sites to be inspected was at the discretion of each region. The TC inspector was normally accompanied by a railway S&C maintainer, who among other things, took the voltage readings. Some TC inspectors used a form to record their findings which prompted them to verify mostly the appearance of the components, but not to test whether they met pre-approved railway or manufacturer standards.

1.19 Observations of WISs on Some Other Canadian Railways

TSB investigators visited a number of WIS sites across Canada accompanied by railway personnel (WIS sites in Quebec, Ontario and Alberta were included). The railways involved, in addition to CN, were CPR, VIA and Quebec North Shore and Labrador (QNS&L). After reviewing the different WIS installations, it became apparent that there were differences in the manner in which protection against overheated bearings was provided on each railway. There were also many locations in Canada where there was no HBD protection. Some of these subdivisions carried scheduled passenger trains and/or shipments of dangerous goods. Other subdivisions that were equipped with HBDs had them spaced in excess of 25 miles of each other. The tables contained in Appendices D and E show some of these areas, as well as a comparison of some of the different criteria that were noted.

The inspection of the derailed rolling stock, subsequent to the accident, revealed a BOJ at the No. 3 wheel on car CN 604697. The mode of failure of BOJs is well known throughout the railway industry. As the roller bearing at the L-3 location overheated and seized, the axle extruded, causing a reduction in cross-sectional thickness. After sufficient thinning occurred, the overheated axle could no longer support the weight of the loaded car and complete axle fracture ensued. The marks on the track indicate that the location where the truck side of the car dropped to the track as a result of the axle fracture was approximately 200 feet before the WIS at Mile 255.1. The train continued in a derailed state which damaged the HBD at that location as it passed over it. When the train reached the east switch at Neswabin, approximately seven miles later, the main derailment occurred.

The analysis will focus on the roller bearing failure, inspections used to protect against roller bearing failure (both physical and electronic inspections), related management and supervision issues, as well as regulatory overview.

The train crew members' reaction to the information from the WIS at Mile 255.2, near Oba, was influenced by their experience at that same site on their previous trip. (On the evening before the accident, the crew members were stopped by an audible "dragging equipment" alarm, and they had walked the length of their train and had found nothing wrong. Subsequently, the DED was declared out of service, although the talker system continued to deliver messages to passing train crews relating to the DED when activated.)

On the day of the accident, as the train proceeded over the WIS at Oba, the train crew members received a talker message, warning them of "dragging equipment, dragging equipment, multiple alarms, multiple alarms." The hot bearing and hot wheel indications were immediately identified by repetitive and similar audible tones, by system design, as the train was proceeding over the detector. With the information provided, the crew interpreted that the multiple alarms made reference to the dragging equipment component of the WIS site, rather than a variety of problems, including an overheated bearing.

The train crew members believed that there was no dragging equipment on their train, and considered the information received from the WIS to be inaccurate in consideration of:

• the crew's experience the previous night with the same DED;
• the crew's belief that the DED was not working properly;
• the crew's understanding that the train had been inspected uneventfully by all WIS components at the two previous sites (Shekak and MacDuff); and
• the three separate wayside inspections the train received en route towards Oba.

The train crew members contacted the RTC to inform him that they were stopping due to the WIS alarm as per instructions and to make him aware of their experience with the DED at that same site on the previous trip.

The RTC knew that the DED at that location had been out of service, and the train crew had not reported any prior operating problems since leaving Hornepayne. He offered to contact the HBO office in Edmonton to obtain further advice. Both the train crew and the RTC were unaware that the train had triggered a warm bearing "yellow" indicator on the Devtronics screen at the same part of the train (around the 95th axle) at MacDuff, as this information was not provided to them.

In Edmonton, the company protocol as established by TP-105 (requiring cars with warm bearings to be tracked and subsequent inspections monitored) was not followed. This resulted in employees in Edmonton initially reviewing the data from the site at Oba in isolation, and making decisions without the benefit of the earlier scan at MacDuff, some 13.6 miles previous. Without the benefit of the earlier data, and because the RTC Mech did not identify the WIS output tape as one produced by a scanner damaged by a derailed car, the RTC Mech incorrectly concluded that the tape was faulty. The RTC Mech's decision was accepted because of the perceived line of authority between the RTC Mech and the HBO.

Company training programs did not instruct employees how to identify or recognize a tape indicating a site damaged by a derailed wheel. The operating manual also did not instruct employees how to specifically deal with an abnormal scan at a site subsequent to a warm reading. The graphic examples in the operating manual, showing a similar pattern as the Oba tape identified as defective, only served to reinforce the RTC Mech's initial assessment. An experienced operator may make the possible connection, as the HBO eventually did, that the "faulty" scan beginning at the same part of the train where the warm bearing was previously identified may be two related events of a safety problem.

2.1 Roller Bearing

The nature of the failure that led to the overheating of the roller bearing could not be determined due to the amount of damage. The weight of the loaded car was within allowable limits, and the load was equally distributed over the length of the car body. Therefore, the axle load would have been equally shared and is not considered to have contributed to the overheat condition.

The wheel had travelled less than half the number of miles expected for a requalified roller bearing to travel before requiring replacement. Therefore, the number of miles travelled by the wheel set was not considered to be a significant risk factor.

The condition of the car as examined after the accident (e.g. no grease on the floor underframe area immediately above the roller bearing location) indicates that there were no obvious signs of the car having had a bearing problem that should have been identified during safety inspections or wayside inspections performed by employees while the car was en route. This was further supported by the successful safety inspections of the roller bearing at numerous WIS sites between the origin of the car in Prince George and Neswabin.

The investigation did not determine what effect, if any, the prior collision at Jasper might have had on the performance of the L-3 bearing from car CN 604697. It is possible, although unlikely, that the bearing experienced collision damage in Jasper that precipitated its subsequent failure given the following:

• the satisfactory inspection of the mate bearings from the same car;
• the successful performance of the other wheel sets in the cars involved in the Jasper collision; and
• the distance that car CN 604697 was from the head end of the Jasper train.

2.2 Inspections

2.2.1 Electronic Monitoring

Axle failure and subsequent derailment may occur if developing problems on axle bearings go undetected. Electronic monitoring, by either wayside or on-board journal bearing detection devices, can reduce the risk of catastrophic axle failure due to unsatisfactory bearing performance. However, there is equipment operating in Canada that cannot be reliably monitored electronically by wayside scanners. It was noted that:

• most locomotives, including those in passenger service in Canada, have no on-board HBD devices;
• twenty-five per cent of the passenger cars used in corridor service and all transcontinental stainless steel cars have external journal bearings and no on-board heat monitoring; and
• some equipment, such as specially equipped freight cars, passenger cars and locomotives, may not be accurately scanned by wayside HBD equipment (due to mechanical parts between the bearing and the scanner that can obscure the view of the bearing). Some of these locomotives are used on high-speed passenger trains, and regularly travel at speeds of up to 95 mph.

Experience has shown that the design of passenger and locomotive roller journal bearings, combined with their relatively frequent inspection schedules, serves to reduce the incidence of bearing failure. Although the railway's detector networks have detected overheated roller journal bearings on both passenger cars and locomotives, the system is designed to give an optimal scan for conventional freight car trucks. In other words, the variety of bearing designs and housings affects the results of the heat scan, with some bearings reflecting values much less than actual, and even nil readings. The safety of train movements is dependent on consistent and accurate scanning of all actual bearing temperatures. As the WIS cannot reliably scan all varieties of bearings in use, it cannot be considered a reliable defence to assess all adverse bearing conditions.

2.2.2 Physical Inspections

In areas where no electronic monitoring is available, physical inspections are relied upon to detect defective bearings before they result in complete axle failure. While there is no need to elaborate on the merits of inspections by certified car inspectors, the ability to fulfill this goal is limited by several factors:

• The condition of the internal parts of the bearing cannot be reliably detected by inspecting the visible portions of the external parts (e.g. outer race, grease seals, backing ring and end cap). Furthermore, some external parts are not in plain view (e.g. locomotive journal bearings). The external parts are poor indicators as to the condition of the internal parts.
• Safety inspections performed while cars are stationary in main departure terminals, typically after the cars have been at rest for several hours and bearing temperatures are close to ambient, do not facilitate the identification of poor performing bearings. It is also not possible during these stationary inspections to predict future bearing performance. As shown in Appendix D, there are many locations (the majority of which have low traffic densities) where there are no HBDs and railways are largely dependent on the limited ability of these physical inspections to provide a level of safety to their operations.
• Once a train is in motion, wayside inspections on both sides of a train are not always performed, as demonstrated in this occurrence. The three train crews that met train 304 between Hornepayne and Neswabin all inspected the train on the north side only and did not detect an overheating bearing on the south side of car CN 604697. When wayside inspections are performed on both sides, a car journal bearing that is in the initial stages of failure is not likely to be detected until there is some obvious sign of distress, such as smoke, fire or unusual noise.
• A tempilstik cannot always aid a person performing physical inspections to identify bearings in the early stages of distress, as described in further detail below.

2.2.3 Tempilstik

Because train crews have relatively little technical expertise in the identification of distressed bearings, they frequently have to make judgements outside their area of expertise. Unless the identified condition is somewhat obvious, this task can be challenging, even to a person with more in-depth mechanical knowledge. As a result, CN train crews are normally provided with an AAR-approved tempilstik as the tool to use to help them determine whether a bearing is overheating. Such an instrument does not seem well suited to the task. Frequently, train crews are advised that the car which must be inspected is a significant distance away (behind the locomotives), sometimes more than one mile. Receiving an alarm, bringing the train to a stop, verifying with the RTC the car in their consist which has to be inspected, and donning the proper clothing to perform the task in winter months take time. The time interval may allow a bearing in the early stages of distress to cool below the temperature required to melt the tempilstik before a crew member has a chance to inspect it, thereby increasing the risk of missing detection.

In sub-zero temperatures, the task of identifying an overheating bearing with a tempilstik becomes even more difficult. For example, because the CN HBD system is designed to detect a bearing that is running 180°F or more above ambient, if the ambient temperature is minus 40°F, a bearing will exceed the alarm threshold if it is running at 140°F or warmer. A crew member will be unable to identify a bearing operating at 140°F as overheated when using a tempilstik which only melts at 200°F. This may explain why, frequently, train crew members find no defects when stopped for a possible hot box inspection.

In consideration of the above, a train crew member performing an inspection for possible bearing distress cannot reliably identify a developing problem due to the tools, ambient temperatures, and time factors involved. In addition, wayside inspections by employees and static inspections by car inspectors in train yards cannot reliably detect or predict bearing failure. Finally, inspection of stationary cars by certified car inspectors in train yards is not likely to identify a roller bearing that is going to fail because most of the bearing parts are internal and not visible. Many places in Canada rely mainly on these type of inspections to identify roller bearing defects.

2.3 Wayside Inspection System (WIS)

2.3.1 General

The CN WIS includes three lines of defence associated with the identification of, and protection against, bearing failures. The first is the advance warning alarm (AWA) in the field. The second is an operator using the lower TP-105 criteria to screen out hot boxes (advising the train crews through the RTC). The third line of defence is the earlier detection of potential failing bearings by identifying warm boxes at an even lower criterion.

The first two defences are related to safety, while the third defence is related to both safety and company efficiency. With CN, the first line of defence is more stringent than on other railway companies. The second and third lines of defence provide additional levels of protection which most other railways do not have. By comparison to other Class 1 railways, CN has designed a well-defended system (i.e. with multiple levels of defence). However, as with any complicated safety system, a thorough review can reveal deficiencies and opportunities for improvement with the components of the system and the procedures and practices of the people who use them. The TSB investigation, although not an exhaustive technical review, has identified several items pertaining to WIS testing that appear to warrant further attention.

2.3.2 Monthly Testing

Monthly testing of the WIS at CN and some other Canadian railways was performed using a function simulator. By electronically simulating a passing train with bearings at a preset temperature, the ability of the system to accurately read a known input temperature was tested. The temperature setting used in the function simulator test procedure was 135°F above ambient. However, the WIS alarm threshold temperature setting was 180°F above ambient. Therefore, because the monthly test was not conducted at the actual alarm threshold, the test was verifying that the scanner was correctly reading at the test temperature. However, it was not verifying that the AWA and "talker" would activate at the minimum critical bearing temperatures.

2.3.3 Dynamic Testing

CN is the only federally regulated Canadian railway known to have a car capable of dynamically testing the HBD component of its WIS sites. It only had one car that was so equipped, and because of its busy schedule, it could not regularly test all CN WIS sites. WIS sites in eastern Canada were not dynamically tested for several years because this car was based in western Canada. Also, because the speed of the TEST train is limited to maximum freight speed, typically 60 mph, the dynamic testing in some places is conducted at less than maximum operating speeds (e.g. the heavily used Kingston Subdivision with daily 95 to 100 mph passenger trains). CN relied on the HBD manufacturers to measure the response of scanners to speed in a laboratory environment, and to build the equipment to respond to these specifications. However, dynamically testing the operation of the WIS in its actual environment at speeds much less than the maximum track speed does not ensure that the alarm system will operate as intended at those elevated speeds.

No federally regulated Canadian railway is presently dynamically testing HWDs and DEDs which, together with HBDs, are essential components of a sophisticated wayside inspection safety system.

Although the railway matched the TEST car process to the design of the primary type of traffic (i.e. freight car bearings), this affords little protection to those railway operations that are not covered by these parameters.

2.4 Management/Supervision

2.4.1 Roles and Responsibilities in the WIS Office

Due to the pioneering efforts associated with the small number of personnel who work in the field of monitoring "hot bearing" and "hot wheel" conditions, management has typically allowed those employees to operate in a "hands-off" learning and experiential environment. This lack of direct involvement in day-to-day activities has allowed employees to come up with many safety improvements in the use of the technology. However, there have been some negative effects from this indirect style of supervision.

The RTC Mech positions were management level positions and frequently RTC Mechs exercised discretion as to the application of TP-105 criteria (e.g. when or how cars identified by the system would be handled). The roles and responsibilities of the RTC Mechs evolved from a focus on hot wheel tapes to a more global approach involving examination of hot bearing tapes, when warranted. By examining both the hot wheel and the hot bearing detector tapes, the RTC Mechs believed that they were in a position to "overrule" the HBO if they felt that the readings reflected a "sticking brake" as opposed to a bearing failure. As part of management, the RTC Mechs felt empowered to exercise their discretion with regards to TP-105 criteria.

The HBO positions allowed them no flexibility to adapt company policy; therefore, some frustration was created by the different methods of responding to cars with similar stimuli. The overruling of the HBO decisions by the RTC Mech tended to erode the clear distinction of responsibilities assigned to the HBO by management. With time, the perception of both the RTC Mechs and the HBOs was that the RTC Mechs had the final authority on office matters, given the fact that they were management and that they had the ability to "overrule" the HBOs.

The differences of opinion between HBOs and RTC Mechs and perspective on their roles and responsibilities had led to previous conflicts, and there was some residual tension between certain members of the two groups subsequent to the reorganization and related arbitration case. While there had been some discussion by management regarding having the HBOs report directly to the RTC Mechs, this was never formally implemented. Conflicting views were espoused by both Mechanical and Operations management regarding responsibilities of the WIS office personnel.

There were instructions for the HBOs and the RTC Mechs to discuss any circumstances where hot wheels and hot bearings did not meet TP-105 criteria and either felt a train stop was necessary. However, no clear procedure was in place as to who had the final authority, or how to resolve potential conflict. Given the perceptions of the office personnel, the final decision would go to the RTC Mech.

In this occurrence, when the RTC Mech declared that there was a faulty tape, the HBO accepted his decision allowing the train to proceed, even though he was not certain that this was the appropriate action. It was not until the train was allowed to proceed that the tape from the previous WIS site (MacDuff) was checked. Once a link was made between the readings of the two sites, the HBO began to look for confirmation of his suspicions by contacting others. Rather than speaking with his direct supervisor to resolve his concerns, the HBO made numerous calls to the RTC and the S&C personnel in Toronto hoping to obtain verification of his concerns regarding the status of the train. It was during one of these exchanges that the train went into emergency.

Misconceptions between the two key users of the WIS data (HBO and RTC Mech) about their specific responsibilities and lines of authority, combined with communication difficulties, precluded a highly cooperative analytical environment. This resulted in the train not being stopped once the HBO realized that it was possible that the WIS indications reflected a safety problem. This occurred despite the fact that both the HBD and DED had correctly indicated that something was wrong.

2.4.2 Systems Knowledge

In order for a distributed system, such as the WIS, to operate effectively, the various components must be properly integrated. For employees, this involves ensuring that each has an adequate systems knowledge to understand the effect of their decisions and actions on other components of the system.

Some of the employees interviewed received little formal training and did not clearly understand their responsibilities. Employees in charge of reviewing safety critical information, such as the integrity of wheels and bearings on a passenger train, need to clearly understand what they are monitoring and clearly know what their authority is if they notice a problem (e.g. order a train to stop immediately). In this accident, the experienced HBO was not comfortable that everything was normal with the train; however, he did not feel that he had the authority to stop the train and advise the crew members to inspect their equipment. Management's protocol did not clearly state that anything less than an acceptable scan should be cause for a precautionary mode of operation, even if the train crew members were to be informed as to the possible existence of a defective condition on their train. It is unknown whether the decision reached by the crew (to continue without inspecting their train) would have been different had the HBO called the train crew, rather than the other way around, and informed the crew of the information he had from the last two WIS sites.

Other examples of key people not having a good understanding of the overall system were in the area of the computer software (e.g. the algorithm calculations that the Devtronics software performs on a scanned train). The codes for W2 and W3 alarms were not well understood by some of the operators; yet, these warning alarms were meant to initiate a safety monitoring response from the RTC Mechs and HBOs. Without a good understanding of the basis for these alarms, some of these primary users were not able to properly analyze the information provided by the system.

In essence, the HBOs were taking the time to examine these tapes with the intent of finding a high deflection, when in fact they never would. The value of these tapes was in the ability to identify a potentially warm or hot bearing amidst a very low overall detector reading. Their normal reaction was to respond to TP-105 criteria for maximum values or differentials. This way of working did not take into account the ability of the computer software to highlight a car with possible developing problems, regardless of whether the field equipment was calibrated correctly or not. Responding to safety messages in this manner nullified some of the sophisticated safety features built into the system. Other users of the Devtronics software use the algorithms to directly advise the train crews of potential hot boxes, rather than use the data to determine whether an HBO should examine a train chart for defects.

The differing levels of employee awareness of company protocol and systems knowledge (regarding the WIS) demonstrate that either some employees did not understand their roles and responsibilities, or the method used to train and ensure retention was inadequate.

2.4.3 Workload

As stated earlier, the CN WIS included three lines of defence associated with the identification of, and protection against, bearing failures. The first two lines of defence each identified hot boxes, and involved a message being communicated to the train crew (either by the RTC, or the talker of the AWA). The third line of defence was the real-time trend monitoring by the HBOs in Edmonton, who were to identify and track warm boxes at a lower criterion leading to the earlier detection of potential failing bearings. This latter defence, which results in the application of stricter WIS criteria than other railways, has increased safety potential but can be labour-intensive.

The set-up of the system required the HBOs and RTC Mechs to perform a number of manual tasks dependent on differing criteria that the operators had to track mentally. This added to their workload and was subject to potential operator error. The computer software as installed did not assist them in identifying key information, such as the number of the rolling stock involved, the train, the location of the next HBD site in the direction of travel, and the information from the previous HBD site. Keeping track of this information mentally may have been possible when the WIS sites were distributed in multiple offices (lower number of sites). The centralization of monitoring increased the number of WIS sites from 100 to 200 in the Western region, then added in nearly 200 more sites from Toronto and Montréal. This became a daunting task to monitor during periods of peak activity, particularly when train routings and track layouts were unfamiliar to the operators (e.g. a train leaving one subdivision to go to another subdivision before reaching the end of the first one). This could be further exacerbated when some sites generated more alarms because their calibration was over-sensitive.

Given the workload associated with the HBOs' tasks and the need for the HBOs to prioritize activities, the HBOs adapted their task to the changes in workload by focussing on the second line of defence items (those bearings identified as hot by TP-105 criteria), even though the lower-level readings are an integral part of the third line of defence. Automation of the real-time trending process in the future could assist in making even better use of these data.

The amalgamation of the monitoring for all WIS sites into one office, combined with the number of non-automated computer tasks, made it difficult for HBOs/RTC Mechs to follow all TP-105 requirements. Without following the TP-105 requirement, the potential for early detection of distressed bearings was reduced.

2.4.4 Impact of Variable Output on Workload

Variances in the acceptable output of each WIS lowered the quality of the data and, thereby, the safety afforded by the system. Although the HBOs were required to track cars identified with early indications of overheating bearings over several sites, their efforts were sometimes hampered by the quality of the data from the system.

Variable outputs made comparative analysis from site to site difficult. When the output from site to site for a constant input was varied, an operator's ability to make meaningful use of the WIS data and make informed decisions about whether a bearing was warming up or cooling down was diminished.

Outputs from WIS sites that were over-sensitive led to an increase in workload of HBOs, and increased the false alarm rate. This also affected user confidence in the overall system, and prompted users of the data to consider that the system was faulty, rather than the train. The rate of false alarms within the system and a lack of meaningful feedback that field repairs actually corrected the original problem contributed to the maintenance practice of allowing four trains to operate over a site before certifying the WIS site as repaired. While, on the surface, testing the proper functioning of the WIS in this manner appears practical, this method is subject to error.

The repair validation objectives (see Figure 23) should actually be to ensure that trains which are defective generate an alarm by the WIS (box C), and trains which are not defective do not (box B). Coupled with this is the need to minimize two types of error--the error associated with a non-defective bearing generating an alarm (false positive, box D) and the error associated with a defective bearing not generating an alarm (false negative, box A).

The validation scheme employed at the time of the occurrence (see Figure 24), testing for the absence of alarms, does not ensure that a defective bearing will in fact trigger an alarm (box A). While the probability is relatively low, it does leave the system vulnerable to allowing a train with a defect properly identified by the WIS from being stopped while validation is being performed (box C). Should one of the four trains initiate an alarm, the test would be treated as a failure and the WIS would be identified as requiring further repairs by an S&C technician. Furthermore, validating a WIS site after repairs have been performed based on the absence of alarms does not ensure that a true alarm state will be detected.

2.4.5 Tape Interpretation

The impact of not tracking trains which meet warm box criteria over the previous and next WIS sites in accordance with CN TP-105 protocol is that a WIS tape may be judged "faulty" when examined in isolation and that a developing bearing problem may not be proactively identified.

The unusual spikes on the accident-related WIS tape made it immediately evident that there was a problem, either with the WIS or the train. On its own, the loss of heat on one rail subsequent to the 95th axle might suggest that a "faulty" tape had been transmitted. When this information is examined, in combination with the tape generated as the train passed over the previous site at MacDuff (which showed that there was a warm bearing at the 95th axle), one might conclude that something catastrophic occurred at the 95th axle. In fact, subsequent to the initial determination of a "faulty" tape, the HBO examined the WIS tape from the previous site (MacDuff), and recalling a similar event from the past, he suspected that the train had derailed and damaged the HBD at Oba. The HBO was unable to convey his concerns in time to reduce the impact of the derailment.

Because the HBO and the RTC Mech did not initially use all the information available to them and did not work collaboratively to exchange critical pieces of information, the safest course of action (to stop and inspect the train) was not taken.

2.4.6 Quality Management

Although management had some elements of a quality assurance program, the program was largely in place in theory only and delivered in practice mainly within the S&C Department. The program did not oversee that the entire safety systems were functioning as designed. Management and supervision did not coordinate with all parties involved (Transportation, Equipment and Engineering) to provide a systems approach to quality management. Although the number of axle failures due to BOJs is relatively low, the adverse consequences of such occurrences warrant serious attention.

Communication failures were noted between some of the key people involved (e.g. the RTC Mech and the HBO). Written materials provided to the employees within the Signals Group were noted to be inconsistent with local instructions to their field staff, typically in the form of e-mails (e.g. different acceptable limits for the maximum and minimum values for test tapes, and the number of degrees above ambient heat for the input when calibrating the system). Variances in procedures, practices, and systems knowledge in both the field and office activities are indicative of an inconsistent application of a quality management program.

Without a comprehensive quality management program in place, inconsistencies were introduced into the HBD system which created system performance variances and made comparative analysis of the WIS data from site to site difficult.

2.5 Regulatory Overview

TC inspectors are required to fulfill the goal of the Railway Safety Act, which is An Act to ensure the safe operation of railways and to amend certain other Acts in consequence thereof.

In achieving this goal, the Rail Safety Directorate has a number of regulatory programs that the regional inspectors are required to deliver, but the regional inspection programs do not include a formal WIS inspection program. Although TC inspectors visit some WIS sites and complete an inspection form to note deficiencies which they then submit to the railway for corrective action, these inspections are not required in a documented regulatory program. The form contains the items that an inspector should inspect while on site. Most of the items are cosmetic in nature (such as paint on the apparatus, cleanliness of mirrors). Without regulatory requirements, the inspectors are limited in what items they inspect during visits at WIS sites.

Although there are rules to ensure that some types of inspections are performed on a train while en route, these are performed by employees infrequently (when passing other trains and performing running inspections of their own train) and these types of inspections would only likely reveal a very advanced condition. A visual inspection from the ground of a passing train would rarely reveal a developing problem with a bearing if that problem had not yet significantly progressed, and an inspection performed by a crew member from a locomotive while the train was running would only reveal problems which display significant visual signs (which would mean the defect was already at an advanced state).

With the RAC review of order R-41300 and with TC adhering to the federal government's deregulatory approach, the order was revoked as the review demonstrated that both CN and CPR had provisions in place to comply with the order. It is important to note that order R-41300 only applied to CN and CPR and no other railway was ever legally required to comply with it. Compliance with order R-41300 by other railways was encouraged by TC and the RAC, as it was considered a "best practice" approach to operating cabooseless trains. When TC revoked the order, it relied in part on the railways' instructions at the time of revocation to ensure and maintain the level of safety provided by order R-41300.

In accordance with federal regulatory requirements, railway companies do not have to request permission from, nor advise, TC when they wish to modify or remove an instruction from their set of operating procedures. In revoking order R-41300, TC removed the only regulatory reference to hot box and dragging equipment detectors and the maximum distance between inspections while the trains are en route (clause 1.3 of order R-41300 which stated 60 miles). Presently, railway companies can operate trains for significant distances without effective inspections which would provide reliable early detection of developing bearing problems.

It is acknowledged that most railways have installed WISs to enhance the safety of their operations. However, TC does not have regulatory requirements for such systems to be installed, or for minimum distances between WIS sites. TC has not provided requirements or guidelines for the method of installation, inspection, calibration, alarm levels and some system to ensure the correct functioning of such technologies. These provisions are left to the railway companies in conjunction with the manufacturers of the technology and have resulted in the variety of installations and operations identified in this investigation.

3.1 Findings as to Causes and Contributing Factors

1. The roller bearing at the L-3 location on the south side of car CN 604697 overheated and seized, resulting in a burnt-off axle journal and the derailment of 21 cars.
2. The definition of "faulty tape" allowed rail traffic control mechanical service representatives (RTC Mechs) and hot box operators (HBOs) to disregard scans which met or exceeded TP-105 criteria. They believed that the information on the tape did not represent actual train conditions. This resulted in a train with a defect being allowed to proceed.
3. Unclear lines of authority and communication difficulties precluded a highly cooperative analytical environment. This resulted in the train not being stopped once the HBO realized that it was possible that the Wayside Inspection System (WIS) indications reflected a safety problem.
4. The train crew members did not perform a walking inspection of their stationary train after having been provided with multiple audible alarms of possible defective conditions; therefore, they did not detect the single derailed car at the Oba location, missing an opportunity to greatly reduce the consequences of the overheated roller bearing.
5. Company procedures (TP-105) regarding the monitoring of the bearings identified as "warm" subsequent to the scan at MacDuff located 13.6 miles before the WIS at Oba were not followed. This resulted in the information from the Oba site being interpreted in isolation.

3.2 Findings as to Risk

1. A train crew member performing an inspection for possible bearing distress, after having been stopped by a WIS, may not reliably identify a developing problem due to the tools, ambient temperature and time factors involved in performing the inspection. Therefore, a defective bearing may go undetected and remain in service.
2. Other types of physical inspections performed by train crews either from the locomotive or on the ground observing a passing train, or pull-by inspections by wayside employees and car inspectors in train yards, cannot reliably detect a bearing failure or identify a developing bearing failure.
3. Safety inspections of stationary cars by certified car inspectors in train yards cannot ensure the future condition of the bearing from origin to destination, and railways can operate trains for significant distances after performing such inspections.
4. There are subdivisions not equipped with WISs where railways rely on physical inspections (i.e. safety inspections, wayside inspections, passing trains, and train crews) to ensure the safe mechanical condition of the bearings on their trains.
5. Because journal bearings on some types of equipment are not accurately scanned by wayside hot box detectors (HBDs), and since most equipment including some used on high-speed passenger trains do not have on-board journal bearing heat detection, axle failure and subsequent derailment may occur when developing problems on bearings go undetected.
6. Monthly testing of the HBDs and hot wheel detectors (HWDs) at Canadian National (CN) and some other Canadian railways is not performed at the alarm threshold levels; therefore, it is not known if the alarm system will activate at the minimum threshold levels.
7. CN had one TEST car that was capable of dynamically testing the HBDs and it had not travelled in eastern Canada for a period of over three years. The car did not dynamically test HWDs or dragging equipment detectors (DEDs). No Canadian railway other than CN is known to be dynamically testing its WIS sites.
8. CN dynamically tested its HBDs at speeds typically no greater than 60 mph; therefore, it is not known if the alarm system will activate as intended at maximum passenger train speeds.
9. The number of WIS sites to be monitored, combined with the task-intensive and memory-reliant nature of the HBO's duties, made it difficult for the HBO to follow all TP-105 tracking requirements, reducing the potential for early detection of distressed bearings.
10. Communication failures between key users of the system, combined with differences in procedures, practices and systems knowledge, indicate that there was no consistent systems approach to quality management for the WIS safety devices.
11. There is currently no regulatory requirement for a railway company to have safety devices such as the WIS in place despite the risks that may exist in its railway operations (e.g. high-speed passenger travel and dangerous goods).
12. There are no minimum regulatory guidelines for the direction of railways pertaining to installation, inspection, calibration, alarm levels, and quality management of the WIS.
13. Transport Canada has no national program to audit and monitor WISs, to ensure the safety of operating trains as it relates to failing bearings, wheels, and dragging equipment while travelling on territories equipped with WISs.

4.1 Action Taken

4.1.1 WIS Improvements

Subsequent to the accident, a large number of safety initiatives were undertaken by Canadian National (CN) to address the safety deficiencies identified in the areas of reference manuals, work procedures, job aids, and supervision relating to the activities of the rail traffic control mechanical service representatives (RTC Mechs) and hot box operators (HBOs) as follows:

• CN has issued a document titled Wayside Inspection Systems Chart Handling Procedures which is considered to be a supplement to TP-105. The stated goal of this document, issued in April 1999 and re-issued in January 2000, is ". . . to provide definite processes for chart reading and understanding roles and responsibilities of the RTC Mech and HBO," and training was provided to HBOs and RTC Mechs on the changes. The document contains descriptions of faulty tapes, including signs of possible derailment, and the actions that should be taken by specific parties.
• CN states that it has now ensured that, when the Wayside Inspection System (WIS) issues an alarm directly to a train, this alarm takes precedence. CN further explained that no amount of experience, judgment or feeling on the part of the HBO or the RTC Mech can override such an alarm.
• The RTC Mech is no longer allowed to override the HBO's decision regarding TP-105 decisions. CN states that TP-105 is now applied strictly and is covered in paragraph 3(c) of the above-mentioned document.
• The faulty tape criterion has been tightened up. CN is considering to make it an absolute stop of the train when a chart is deemed to be "faulty." CN stated that some charts which could be deemed faulty are now being read as a potential derailment due to the Neswabin occurrence.
• CN has put system maps on the HBOs' desks to help them conceptualize the various subdivisions.
• Series of "team building" sessions were provided to all RTC Mechs and HBOs, including the spares who normally work the HBO job. The training was provided by Grant MacEwen College in Edmonton and was comprised of 2 two-day sessions. The curriculum consisted of:
  • communications
  • conflict management
  • stress management
  • focus on performance
• CN has now ensured that its supervisory program will include the HBOs. It has implemented the following:
  • audits of the journal advance warning signal (JAWS) and other reports which are completed by the HBO;
  • more direct contact with the supervisors; and
  • operator training which stressed the point of more communication between HBOs and their supervisors.

CN has dedicated considerable capital and operating funds to the further expansion of its hot box detector (HBD) network. Main route HBD spacings continue to be reduced. Further, in April 2000, CN lowered the "alarm" threshold for TP-105 hot alarms on 20 branchline subdivisions that have HBDs spaced 40 miles apart or more.

4.1.2 Regulatory Action

Transport Canada (TC) has issued a guideline with respect to the recently amended Section 11 of the Railway Safety Act (RSA) relating to engineering works. The intent of the guideline is to clarify for all parties what is required by Section 11 of the amended RSA. A multi-party committee, including representatives of the railway industry, consulting engineers, governments, utilities, and professional engineering associations, developed this guideline. It is incumbent upon each railway to ensure that, for all equipment used on their tracks, including WISs, they have the proper documentation to support the variety of equipment and that the employees are properly trained for inspecting and maintaining the equipment. TC is moving towards monitoring the railway companies for compliance to Section 11 of the RSA.

4.2 Action Required

As an ongoing safety initiative, CN has developed a unique real-time trend monitoring system which incorporates continuous learning into the process. The system would be enhanced if it included a more comprehensive form of quality management so that, as new opportunities are realized within the system, the appropriate procedures are put in place, the associated training is provided, and best work practices are adopted.

During this investigation, a number of issues emerged which, if addressed, may enhance both the efficiency and safety afforded by the existing system. CN may wish to give consideration to:

• Systems Knowledge and Workload
  When operating in an exploratory manner, systems knowledge of all employees involved is important. Without a solid understanding of the complete system, employees may take action unaware of the detrimental effect that it may have on other aspects of the system. Specifically, slight over-sensitization of HBDs may seem like a very reasonable option to Signals and Communications (S&C) technicians since, from their perspective, they are increasing the safety margin of the system. However, this action can result in unwarranted alarms to HBOs and train crews, increasing their workload and reducing their trust in the system. Also contributing to the workload of the HBO is the interface for the Devtronics system, which currently does not take into consideration all the task requirements of the HBO (i.e., the number of WIS sites to be monitored, tracking of trains over previous and subsequent WIS sites, identification of car numbers). Further automation of this process in the future could assist in making even better use of WIS data, while reducing employee workload.
• Testing
  The WIS system is designed to detect distressed bearings and wheels by measuring their temperature as they pass by the scanner at train speed and to identify dragging equipment. If the heat level exceeds a pre-determined threshold, an alarm is activated. CN tests its systems monthly in a static state and at a temperature well below the alarm threshold level, with the understanding that, if the system is set up at the testing temperature, it will detect an overheated bearing at the alarm threshold level under the dynamic condition of a passing train. Static testing of the dragging equipment detector (DED) involves a pass/fail functionality test. Dynamic testing is typically conducted semi-annually; however, it does not test DEDs nor does it test at maximum train speeds. In the absence of dynamic testing procedures which incorporate maximum train speeds, the threshold heat levels, and simulation of dragging equipment, there is a risk that the system will not function accurately under all conditions.
• Field Detection of Emerging Bearing Failures
  The Association of American Railroads (AAR)-approved tempilstik normally provided to train crews to aid them in their determination of an overheat condition has significant limitations. This is further compounded by such things as cold ambient conditions (if it is extremely cold or raining) and the time it may take before the task can be performed (if the car is near the end of the train). There presently exist other tools which can assist train crews in this task and provide them meaningful information about bearing temperature. For example, in cases where the suspect bearing is not readily apparent (e.g. a temperature is insufficient to melt the tempilstik), the train crew using a remote (hand-held) infrared temperature gun could perform a comparative analysis in the field (i.e. a train-side or car-side average) even if the bearing had cooled down below the melting threshold of the tempilstik. In this way, relative temperatures may indicate which bearing is giving a problem.

4.3 Safety Concern

It is recognized that the majority of railway operations in Canada are monitored by advanced technological means, such as WISs, and that the railways continue to make significant monetary investments to improve their existing systems. However, there still are subdivisions where WISs are installed at intervals in excess of 25 miles, thereby reducing the probability that distressed axle journal bearings will be detected before failure. There are also locations where axle bearing temperatures on passenger trains and/or shipments of dangerous goods are not monitored by WISs at all. Notwithstanding the foregoing, some equipment by its design is ill-suited for bearing temperature detection by WISs, irrespective of the detector spacing. Although axle failures are rare, there can be severe adverse consequences associated with such an event resulting in a risk to persons, property, and the environment. The Board is concerned that, without an industry standard that will detail the frequency and adequacy of roller bearing inspections, there may be less-than-adequate protection against the catastrophic failure of railway axles in some operational settings.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 26 March 2001.

Appendix A— Examination of Tank Cars Involved in Fire

Three of the tank cars involved in the post-derailment fire arrived at Procor in Sarnia, Ontario, on Wednesday, 30 March 1999. On Tuesday, 06 April 1999, the cars were examined by TSB personnel in Canadian National's Sarnia Yard and the following was noted:

Car CN 668016 (an 89-foot flat car) loaded with tank car AGEX 1001:

• residue car, last contained benzene, UN 1993, presently empty clean car
• built date, new 09/81
• emergency response phone number: 1-800-561-6682
• DOT-111A100W-1
• safety valve tested in 1991, due in 2001 at 75 pounds
• tank tested in 1998, due in 2003 at 100 pounds per square inch (psi)

Tank car damage:

• B-end stub sill heavily damaged, bent upwards and twisted
• bolster on the right side collapsed, crushed and torn
• bolster on the left side bent and twisted
• A-end stub sill missing
• bolster on the right side bent, twisted and torn
• bolster on the left side missing
• end framing on A-end and B-end missing (hand rails, crossovers, sill steps, etc.)
• tank head on the left side of the B-end dented inwards approximately 24 inches deep by 4 feet 7 inches long by 5 feet wide
• tank head on the right side of the B-end dented inwards approximately 16 inches deep by 6 feet 4 inches long by 3 feet wide
  • Inside the dented area, there appears to have heavy scrape marks starting from the head centre to the outer side dimension of the head. At this point, contact was made with the weld joining the head to the tank shell, tearing a hole in the side of the tank shell approximately 18 inches long by 5 inches wide. This hole appears to be the result of tearing the side shell away from the head as opposed to a puncture. The metal is piled up and outwards from the hole as opposed to shoved inwards as you would expect from a puncture. The gouges in the dented diameter of the head vary from 4 inches to 6 inches apart and are possibly caused by a rail.
• the tank head on the left side of the A-end and along the side of the shell dented inwards approximately 16 inches deep by 4 feet 6 inches long by 2 feet 8 inches wide
  • A hole inside this dent approximately 2 feet long by 1 foot wide is triangular in shape and appears to be that of a puncture. The metal from around the circumference of the hole is pushed inwards into the body of the tank shell.
• the entire car was mostly void of paint as a result of being engulfed in flames
• trucks, wheels and brake rigging were missing

Car CN 668189 loaded with tank car PROX 41841:

Tank car damage:

• A-end stub sill missing
• bolsters on the right and left sides of the A-end bent and twisted
• bolsters on the right and left sides of the B-end bent, twisted and torn
• heavy denting 10 inches deep along the whole left side of tank shell
• fire impingement at the right side of the A-end and at car centre upwards towards the top of the car
• end framing bent, twisted and torn
• tank shell dented inwards along the right side through the entire length of the tank shell
• brake rigging destroyed
• trucks, wheels and brake rigging missing

Car CN 639954 loaded with tank car ACFX 71216:

Tank car damage:

• stub sill twisted at the B-end
• end framing bent and twisted
• bolsters at the right and left sides of the B-end twisted and bent
• heavy fire impingement along the right and left sides of the A-end and A-end head
• end framing at the A-end bent
• brake rigging destroyed
• heavy denting in tank head at the A-end
• trucks, wheels and brake rigging missing

Appendix B— General Roller Bearing Information

Roller bearings are pressed onto the ends of railway axles outside of the wheel plate area. There are typically eight roller bearings per car, one on each end of the four axles. Roller bearings are of a tapered design and support the weight of the rail car and its contents on the rail. The bearing is positioned within a pedestal jaw of a truck side frame. The moving parts of the roller bearing allow the solid wheel/axle combination to which it is attached to rotate with little friction.

The Association of American Railroads (AAR) requires new roller bearings to be built with an L10 life^{Footnote 24} of 1,000,000 miles. Bearing manufacturers typically warrant their new bearings from an initial application to between 500,000 and 600,000 miles. Roller bearings are requalified at AAR-certified wheel shops during their life. As a wheel profile either wears out or experiences some type of defect every 200,000 to 300,000 miles, the roller bearings are inspected and can be requalified and returned to service several times before their internal parts are no longer serviceable. Disregarding special or severe service applications, it is not uncommon for a roller bearing to last 15 years without service problems, and 30 years when spanning multiple axle applications.

Roller bearings typically run at a temperature of 40°F above ambient during the winter, and 60°F above ambient during the summer (120°F to 160°F absolute). Bearings on many locomotives typically run 20°F hotter, mainly due to truck design. Standard freight and passenger locomotives often use either Class GG tapered roller bearings or Hyatt cylindrical roller bearings. These bearings are specially designed for locomotive use and incorporate high load-rated components due to the additional forces involved.

A steady state temperature in excess of 160°F is considered to reduce the overall life of a bearing due to grease degradation. Continuous operation at high temperatures over 200°F reportedly causes premature aging of the rubber sealing elements, and oxidation of the lubricant; at 240°F, grease breakdown and seal elastomer degradation occurs. In general, the life of a bearing will be diminished with increased operating temperature. This is due to the reduction in oil viscosity, and consequently, the reduction in film strength of the lubricant.

Conversely, severe cold can delay the ability of a bearing to reach the operating temperature. Some greases can become stiff at sub-zero temperatures, to the point that the grease does not migrate through the bearing and provide critical initial lubrication. Depending on the mechanical properties of the grease, the minimum temperature recommended for bearing startup by roller bearing manufacturers is approximately minus 40°F.

Two of the major roller bearing manufacturers were asked to provide the recommended temperature settings at which they would want their bearings identified by a hot box detector (HBD) as overheating. One stated 195°F absolute, while the other stated 180°F to 190°F absolute.

Appendix C— Comparison of Various Reference Manuals Relating to the WIS

Appendix D— Examples of Subdivisions with Passenger Train Service and HBD Spacing Exceeding 25 Miles

Note: Subdivisions shown do not all belong to CN

Other areas of interest are the mileages between the last HBD on one subdivision, and the first HBD on the next subdivision. In some places, these distances also exceed 25 miles and there are no longer any train stops for the passenger trains at the station separating the two subdivisions. In other areas, passenger trains operate over portions of several subdivisions and can travel considerable distances before being inspected by an HBD; e.g., VIA Rail Canada Inc. and the Great Canadian Railway Company (Rocky Mountaineer) operate over portions of subdivisions on three different railways as they depart the Vancouver area travelling eastward. These trains travel a distance of 30.7 miles between HBD inspections.

Appendix E— Observations of WIS Equipment on Other Railways

To acquire a better understanding of Canadian National's (CN) Wayside Inspection System (WIS) as compared to other railway installations, a brief review was made of WIS equipment on Canadian Pacific Railway (CPR), Quebec North Shore and Labrador (QNS&L), and VIA Rail Canada Inc. (VIA), which included site visits in Quebec, Ontario, and Alberta. As a result of these visits, the following observations were made:

CPR

• CPR does not test its hot box detectors (HBDs) dynamically.
• CPR has a higher alarm threshold criterion.
• CPR does not use multiple alarm thresholds.
• CPR has integrity check capability on its HBDs which verifies integrity after every scan.
• CPR has newer Servo hardware than CN.
• CPR does not have a journal advance warning signal (JAWS) system where it captures previous HBD history and compares it to the car repair record history.
• CPR has a more homogenous and simpler system.
• CPR tests its HBD system at alarm criteria.
• CPR has undergone a program to re-align its hot wheel detectors (HWDs) so that they scan 90 degrees to the rail, with the intent of alternating the location of the scanner from the north rail to the south rail. Scanning at 90 degrees to the rail as opposed to 45 degrees reduces the chance that the scanner will incorrectly read elevated temperatures from the wheel tread area as the wheel rolls into and out of view. When positioned this way, one HWD can only scan those wheels on the closest rail to the scanner (as opposed to scanning wheels on both rails with a 45-degree set-up).

QNS&L

• QNS&L uses a variety of Servo and Sentry equipment. It has one Cyberscan site under test.
• QNS&L has more than twice the number of dragging equipment detectors (DEDs) and HBDs, and has the DEDs set up separately from the HBD sites (at other locations).
• Most of QNS&L's WIS sites are equipped with automatic equipment identification (AEI) readers for accurate car identification.
• The HBD sites communicate directly to the train crew through a talker system, and directly to the rail traffic controller (RTC) in paper format. A printed "exception" form automatically prints in the rail traffic control and maintenance offices when an alarm threshold is exceeded.

VIA

• VIA contracts out all its track and signal work to Rail Term, a Montréal-based company.
• Rail Term employs two Signals and Communications (S&C) maintainers who perform most of VIA's signal- and WIS-related inspection and maintenance work for the three WIS sites and 76 crossing systems on the VIA-owned Alexandria and Smiths Falls subdivisions (from Coteau, near Montréal, to Ottawa, and Ottawa to Smiths Falls).
• One of the two S&C maintainers had not received a training course specific to HBDs. This maintainer was responsible for inspecting and maintaining two of the three WIS sites on VIA's Alexandria Subdivision, which handles approximately eight passenger and two freight trains most days of the week.
• Rail Term S&C employees did not understand well how the different components of the WIS system worked; i.e., HBDs, HWDs, and DEDs. They did not know the alarm levels, and did not have a good understanding of how the overall system functioned, or all the consequences with any changes they may make between sites.
• There are no HBDs on the Smiths Falls Subdivision, which handles approximately eight passenger trains most days of the week.
• None of the VIA passenger car equipment that is equipped with journal bearings (which is more than half its total fleet) is equipped with an on-board heat detection equipment. VIA relies on the WIS sites on the railways where it operates, where so equipped, to detect overheating bearings.
• Subsequent to the axle failure involved in the VIA derailment at Biggar, Saskatchewan, VIA removed, in 1998, all journal hot bearing sensors from its General Motors locomotives that were so equipped. The decision was based partially on the belief that the removal poses no greater threat to safety than that presented by the other half of its fleet that never had these sensors, and virtually all the freight locomotives that do not have them. Only the seven remaining Bombardier locomotives which are rated for 100 mph are equipped with on-board heat detection equipment for journal bearings.
• VIA passenger trains had two hot boxes on the Kingston Subdivision in 1999; one on the journal of a Light, Rapid, Comfortable (LRC) locomotive; the other on the journal of a coach car. Examination of the axles at the VIA maintenance centre revealed that both hot box indications were genuine. According to VIA, for one of the occurrences, "Catastrophic failure of the #4R journal bearing was narrowly averted."
• In 1996, a head-end power (HEP) car experienced a bearing failure just after passing a CN HBD with no warning. When examined later by VIA officials, it was noted that the stink bomb had not gone off completely; yet, the bearing had completely melted away.
• A number of VIA train tapes were run for the two operative WIS sites visited on the Alexandria Subdivision. It was observed on a couple of the tapes that the locomotive journal bearings were showing no heat, similar to the pedestal pulses on the LRC cars^{Footnote 26}.
• One of the three WIS sites on the Alexandria Subdivision was out of service for approximately two months waiting for parts. (The Moose Creek site was equipped with an HBD, an HWD, and a DED and was out of service for June and July.) On 08 June 1999, the Rail Term RTC in Outremont, Quebec, issued a Daily Operating Bulletin (DOB) to railway crews advising them that the HBD was out of service. On 24 June 1999, one day after the TSB visit to the Alexandria Subdivision, another DOB was issued advising train crews that both the HBD and DED were out of service. Neither bulletin advised train crews that the HWD was also not in service.

As a result of the differences noted with the different Canadian railway systems (i.e. the hardware used, and how it is set up, maintained and tested), the TSB review was extended to some of the other major Class 1 carriers in the U.S. (Burlington Northern Santa Fe Corporation (BNSF), Union Pacific/Southern Pacific (UPSP), CSX Corporation (CSX)). The following table shows the results of the TSB observations, and highlights some of the differences noted with the various installations of WISs.

The railways have similar operating environments (allowances made for passenger or freight service, or extreme differences in gross ton-miles, etc.). Each railway designs its HBD system to protect against the same problem (i.e. complete axle failure); however, as can be seen from the data in the following table, the manner in which each does so differs.

Appendix F— List of Supporting Reports

The following TSB Engineering Branch Report was completed:

• LP 109/99 - Wheels/Axles and Bearing Examination - R99T0031

This report is available upon request from the Transportation Safety Board of Canada.

Appendix G— Glossary

AAR

Association of American Railroads

ACGIH

American Conference of Governmental Industrial Hygienists

AEI

automatic equipment identification

AWA

advance warning alarm

BNSF

Burlington Northern Santa Fe Corporation

BOJ

burnt-off journal

CCFG

Corporation des Chemins de fer de la Gaspésie

CFBC

Chemin de fer Baie des Chaleurs

CFMG

Chemin de fer de la Matapédia et du Golfe

CN

Canadian National

CPR

Canadian Pacific Railway

CROR

Canadian Rail Operating Rules

CSX

CSX Corporation

CWR

continuous welded rail

DED

dragging equipment detector

DOB

Daily Operating Bulletin

DPU

data processing unit

EPA

Environmental Protection Agency

EST

eastern standard time

F

Fahrenheit

GEXR

Goderich & Exeter Railway

GM

General Motors

GOI

General Operating Instructions

HB

hot bearing absolute deflection

HBD

hot box detector

HBO

hot box operator

HBR

Hudson Bay Railway

HD

hot bearing differential

HEP

head-end power

HWD

hot wheel detector

JAWS

journal advance warning signal

km/h

kilometre per hour

LEL

lower explosive limit

LPG

liquefied petroleum gas

LRC

Light, Rapid, Comfortable

mm

millimetre

mph

mile per hour

NIOSH

National Institute for Occupational Safety and Health

ppm

part per million

psi

pound per square inch

QC

Quality Control

QNS&L

Quebec North Shore and Labrador

RAC

Railway Association of Canada

RSA

Railway Safety Act

RTC

rail traffic controller

RTC Mech

rail traffic control mechanical service representative

S&C

Signals and Communications

STC

Southern Technologies Corporation

TC

Transport Canada

TSB

Transportation Safety Board of Canada

UEL

upper explosive limit

UPSP

Union Pacific/Southern Pacific

U.S.

United States

VIA

VIA Rail Canada Inc.

WB

warm bearing absolute deflection

WD

warm bearing differential

WILD

wheel impact load detector

WIS

Wayside Inspection System

W2

warm bearing based on a comparison of each pulse on a particular side of a train with the average of all pulses on that side of the train

W3

warm bearing based on a ratio of the highest pulse recorded on each side of every individual car to the average remaining pulses on that side of the car

°

degree