Railway Investigation Report R99T0256

At 1311 eastern daylight time on 23 September 1999, Canadian National freight train M304-41-21, destined for Toronto, Ontario, derailed 26 cars, the 56^th to the 81^st behind the locomotives, near the north siding switch at Mowat, near Britt, Ontario. The derailed equipment included 14 residue tank cars last containing liquefied petroleum gas (LPG), 1 tank car loaded with LPG and 3 tank cars loaded with anhydrous ammonia. The loaded LPG car and one of the loaded anhydrous ammonia cars were breached, each releasing product and igniting, causing several fires. At 1348, 37 minutes after an emergency brake application occurred, the loaded car of LPG exploded, projecting pieces of its tank and jacket in all directions. Approximately 127 000 pounds of LPG and 158 000 pounds of anhydrous ammonia were released. All the LPG and a large amount of the anhydrous ammonia were consumed by fire. The train crew was not injured; however, an Ontario Provincial Police officer, a local woodcutter, and two firemen suffered minor injuries as a result of contact with ammonia vapours.

Ce rapport est également disponible en français.

1.1 The Accident

On 23 September 1999, Canadian National (CN) freight train M304-41-21 (the train) was proceeding southward towards Toronto, Ontario, at a speed of approximately 35 mph. The train was made up of 94 cars, 54 of which were tank cars of various products (41 of the 54 were carrying or last carried dangerous goods). At 1311 eastern daylight time (EDT),^{Footnote 1} at Mowat, near Britt, Ontario, the crew members experienced a train-initiated emergency brake application. Subsequent inspection of their train revealed that a major derailment had occurred. The crew radioed the rail traffic controller (RTC) in Toronto who initiated CN's emergency response (ER) including dispatch of the CN police. The first non-railway responders that arrived on the scene were the Ontario Provincial Police (OPP) who arrived at 1348, and the Britt Volunteer Fire Department who arrived at 1400. Other emergency responders included the liquefied petroleum gas (LPG) and anhydrous ammonia ER teams, and Ministry of the Environment (MOE) of Ontario, Emergency Medical Services, and Transport Canada (TC) officials.

A total of 26 cars derailed. The derailed cars were located the 56^th to the 81^st in the train consist and included 19 tank cars, 2 box cars and 5 hopper cars. Of the 19 tank cars involved

• 1 was a load of LPG (UN 1075, Class 2.1);
• 14 were LPG residues;
• 1 was empty (cleaned and purged); and
• 3 were loads of anhydrous ammonia (UN 1005, Class 2.4).

The conductor and a maintenance-of-way employee (who was with a work gang whose boarding cars were located in a back track off the siding at Mowat) travelled by truck on an adjacent access road to the rear of the train where they saw fire and smoke. Approximately one-half hour after the derailment, they heard a loud explosion and, at the same time, the RTC in Toronto experienced a loss of the Centralized Traffic Control System signal from Ardbeg, Ontario, north to Capreol, Ontario. An OPP officer on the scene recorded the time of the explosion as 1348. Another CN maintenance-of-way employee recalled hearing two explosions, at around 1320 and 1345. Detailed examination after the accident revealed that the tank car loaded with LPG (PROX 81552) had exploded. Pieces of the tank shell and jacket were projected in all directions. The larger pieces of tank car wreckage are identified on the derailment schematic in Figure 2.

A crater in the right-of-way measuring approximately 2 m deep, 3 m wide and 15 m long was created by the LPG fire and subsequent violent rupture of the tank, which destroyed the roadbed and altered the physical state of the soils and other materials in the area. A box car immediately west of the LPG tank was crushed and bent 90 degrees. The main track and adjacent siding track were moved laterally and destroyed. Debris of demolished rail cars was strewn about the derailment. The adjacent trees and earth were scorched black for a radius of approximately 200 feet. Aerial photographs show the effect that the ensuing fireball and chemical release had on the vegetation surrounding the derailment location (see Figure 3).

In addition to the release from the ruptured LPG tank car, one of the three loaded tank cars of anhydrous ammonia (PROX 81179) was found to have a hole measuring 15 cm by 10 cm (6 inches by 4 inches) in the tank shell resulting in a near complete loss of product. A magnetic patch in combination with silicone sealant was used to cover the hole to help minimize the impact of the residual vapours on site workers. Residual amounts of product were later flared off by ER personnel. Although tank car PROX 81179 was ruptured during the derailment, no ammonia fumes were reported by first responders on the scene until after the LPG explosion.

In addition to the dangers presented by the commodities on the train, there was a 2 000-litre propane fuel tank at the north siding switch which was undamaged, but estimated to be 80 per cent full. There was also a 7 200-volt power line buried adjacent to the derailment area. A signal maintainer went to Cranberry, Mile 205, to shut off the power.

The occurrence happened several kilometres away from the villages of Britt and Still River. Because of the wind conditions, the residents were crosswind and upwind of the accident site and did not require evacuation, although municipal officials were ready to do so if conditions changed.

CN maintenance-of-way employees in the siding at Mowat, as well as three local woodcutters and two hunters located downwind of the accident site, were evacuated by the OPP.

Canadian Pacific Railway (CPR) ceased operations on the main track (situated between the CN main track and provincial Highway 69) between 1520 and 2034 until satisfied that the accident posed no threat to the safety of its operations.

1.2 Injuries

The train crew was not injured; however, an OPP officer was taken to hospital (Parry Sound General) and a woodcutter was examined for exposure to anhydrous ammonia fumes during the evacuation of the surrounding area. Two fire-fighters experienced minor skin irritation from contact with ammonia vapours during the initial derailment clearing activities.

1.3 Damage to Equipment

Eighteen of the derailed cars received minor damage. Eight cars were destroyed. The destroyed cars included two dangerous goods tank cars (an LPG car and an anhydrous ammonia car), four hopper cars, and two box cars.

1.4 Other Damage

Approximately 600 feet of main track and siding were destroyed at Mile 199.50. The turnout for the siding at Mowat required extensive repairs. The public crossing at Mile 199.57 required minor repairs.

1.5 Dangerous Goods

1.5.1 Anhydrous Ammonia

Car PROX 81179 was loaded with 158 480 pounds of liquefied anhydrous ammonia, most of which was lost in the fire. The train consist shows that the car was moving under the authority of Equivalent Level of Safety (ELS) permits SR 4651 and DOT E7616.^{Footnote 2} The shipper was Agrium Inc. of Fort Saskatchewan, Alberta, and the consignee was International Commodities Export of Calgary, Alberta.

Anhydrous ammonia is a pungent colourless gas which can be liquefied by compression. It is shipped in liquefied form and classified in Canada as a "corrosive gas," Class 2.4 (9.2), UN 1005, Standard Transportation Commodity Code (STCC) 4904210. It is poisonous by inhalation and ingestion.^{Footnote 3} In the United States, it is on the "Extremely Hazardous Substances List,"^{Footnote 4} on the "Community Right-to-Know List," and in the Toxic Substances Control Act inventory. The threshold limit values for anhydrous ammonia are as follows:

• time weighted average^__25 parts per million (ppm);
• short-term exposure limit^__35 ppm; and
• immediate danger to life and/or health^__300 ppm.^{Footnote 5}

Anhydrous ammonia is flammable with a lower explosive limit of 16 per cent and an upper explosive limit of 25 per cent.^{Footnote 6} Mixtures of anhydrous ammonia with air or other oxidizers can also detonate in a fire situation.

Guide 125, "Gases - Corrosive," of the 1996 North American Emergency Response Guidebook (NAERG), prepared in part by TC and applicable at the time, contained the ER information for anhydrous ammonia. The first line of the HEALTH section stated "TOXIC; may be fatal if inhaled." Furthermore, the first line of the FIRE OR EXPLOSION section stated "Some may burn, but none ignite readily."

The new version of the Transportation of Dangerous Goods Regulations which was published in the Canada Gazette, Part II, 15 August 2001, shows that ammonia has been re-classified to Class 2.2, Compressed Gas, with a subsidiary classification of Class 8, Corrosive. In section 2.14(b) of the regulations, Class 2.2 is described as "Non-flammable and Non-toxic Gases." Class 2.2 gases require a green placard, unlike the white background used for toxic and corrosive products (Classes 2.3, 6 and 8).

1.5.2 Propane

The train consist listed tank car PROX 81552 as being loaded with 127 560 pounds of LPG (propane). The shipper was Gulf Canada Resources Limited of Calgary and the consignee was Superior Propane Inc. of Humphrey, New Brunswick. The train consist showed that this car was also moving under ELS permit SR 4651.

Propane is a colourless gas which can be liquefied by compression. It has a very faint odour and is shipped in liquid form. It is classified as "flammable gas," Class 2.1, UN 1075, STCC 4905421. A large portion of the propane that is shipped is odourized by the addition of mercaptans in order to be able to detect any leaks by smell. It is a highly dangerous fire hazard. The lower explosive limit is 2.2 per cent, and the upper explosive limit is 9.5 per cent. The flash point of propane is minus 156 degrees Fahrenheit (minus 104 degrees Celsius). It is explosive when mixed with air or any oxidizer. At high concentrations, it affects the central nervous system and also acts as an asphyxiant. In the United States, it is reported in the Toxic Substances Control Act inventory.

1.6 Personnel Information

The operating crew consisted of a locomotive engineer and a conductor. They were qualified for their respective positions and met fitness and rest standards established to ensure the safe operation of trains.

1.7 Train Information

The train was powered by 2 locomotives and consisted of 37 loaded cars, 20 empty cars, and 37 dangerous goods residue cars. The train weighed approximately 7 050 tons and was about 5 900 feet in length.

1.8 Occurrence Site Information

The first set of derailed wheel marks were noted on the high rail of a curve approximately 44 feet south of a 65-foot through-plate girder bridge, located at Mile 203.0. Wheel marks on the ties between Mile 202.98 (point of derailment) and the road crossing at Mile 199.57 indicated that one set of wheels was derailed. The second set of wheels from the same truck derailed at the crossing and continued in the derailed position until it reached the switch at Mile 199.48 where the major derailment and pile-up occurred.

1.9 Particulars of the Track

The track was a single main track, rated as Class 3 in accordance with TC's Railway Track Safety Rules (TSR) which prescribe industry standards for classes of track and maximum operating speeds.

The rail was 136-pound continuous welded rail (CWR) laid on hardwood ties and fastened with double-shouldered plates and three spikes per tie plate. The ballast was crushed slag. The bridge ties and bridge approach ties were in poor condition and showed evidence of being spike-killed with a resultant lack of ability to hold proper gauge. Other track components were in good condition.

A joint track inspection was performed by the CN track supervisor and assistant track supervisor on 23 September 1999 before the derailment, and no deficiencies were noted. Track geometry was recorded by a track geometry car on 10 June 1999. Wide gauge of 7/8 inch was identified on the bridge and an 11/16 inch warp^{Footnote 7} was noted immediately north of the bridge. The same defects were noted on a test run on 13 May 1999.

The track alignment consisted of a reverse curve. The alignment from the north (the direction of travel) consisted of a five-degree left-hand curve, with approximately 200 feet of tangent track connecting to a five-degree right-hand curve. The right-hand curve commenced near the abutment of the bridge. The alignment of the track was poor with a short easement curve (spiral) connecting the tangent track to the full body of the curve. The designed spiral length was 196 feet and the actual length was approximately 39 feet starting at the south abutment of the bridge. The superelevation (banking) was, on average, 1 1/2 inches through the bridge and 3 inches through the main body of the curve south of the bridge. The ideal curve elevation for the five-degree curve should be 4 1/4 inches for an equilibrium speed^{Footnote 8} of 35 mph. CN's Standard Practice Circulars (SPCs) at the time of the derailment called for a maximum imbalance^{Footnote 9} of one inch. The SPCs have since been revised to accommodate a maximum imbalance of two inches for freight trains.

The cross-level variation approaching the bridge and immediately after the bridge showed a warp in the track. Between the south end of the bridge and the first set of wheel marks, there was a 1 1/8 inch deviation from the uniform profile. The track gauge was 1 1/8 inches wide at the beginning of the spiral and 1/8 inch tight in the area where the first wheel marks were noted. The variation in gauge was 1 1/4 inches in a distance of approximately 80 feet. The maximum allowable tolerances were

• wide gauge^__1 1/4 inches;
• tight gauge^__1/2 inch; and
• variation in gauge^__1 1/16 inches in 19.5 feet.

The field measurements for alignment, cross-level, warp and gauge were at the upper thresholds for the tolerances permitted by CN's SPCs and TC's TSR.

For ease of interpretation, Table 1 shows some of the actual field measurements compared to tolerances specified in the SPCs and the TSR. Priority defects^{Footnote 10} and urgent defects^{Footnote 11} are identified separately.

1.10 Method of Train Control

Train operations from Mile 2.0 to Mile 273.0 were controlled by the Centralized Traffic Control System authorized by the Canadian Rail Operating Rules and supervised by an RTC located in Toronto.

The authorized track speed for the Bala Subdivision between Mile 193.3 and Mile 205.6 is 40 mph for passenger trains and 35 mph for freight trains.

1.11 Weather

Atmospheric Environment Service advised that, at 1300 on 23 September 1999, the following readings were recorded at Britt:

• Pressure - 100.21 kPa
• Temperature - 18.2°C
• Visibility - 9 miles (14.4 km)
• Dewpoint - 14.3°C
• Wind - from 240 degrees (or from the southwest) at 6 to 17 knots
• Precipitation - Light scattered showers from 1030 to 2100

1.12 Recorded Information

The event recorder transcript indicated that, between 1304:12 and 1311:37, train speed varied from 35 mph to 37 mph with throttle positions ranging from position 8 (maximum) to idle. The train-initiated emergency brake application was recorded at a time of 1311:38 while the train was proceeding at 37 mph shortly after the throttle was moved to the idle position. At a time of 1312:01, the train speed was recorded as 0 mph.

1.13 Other Information

1.13.1 Emergency Response

Upon notification of the accident, a municipal emergency plan for Britt was implemented. The essential services of the municipality were coordinated through an ER centre set up at the local OPP detachment on Highway 69 close to the main access road to the derailment area. Their advance planning had prepared them for major potential problems, such as train accidents involving dangerous goods.

The railway set up its own ER centre adjacent to the OPP detachment to coordinate all the immediate technical and logistical needs of the agencies and ER teams responding to the accident site. There were no major problems overall, and the two command posts focussed on their respective roles. The municipality command post concentrated primarily on protecting the immediate safety of all its citizens, including the preparedness to evacuate all the citizens of Britt should the need arise, and the railway command post focussed primarily on addressing the dangerous goods-related aspects of the derailment, ensuring that the efforts of the first responders, dealing with assessing and mitigating the conditions at the scene, were properly coordinated.

Two TC-approved Emergency Response Assistance Plans (ERAPs) were activated shortly after the accident, as intended in such a situation. Shortly after, two chemical industry response teams arrived. After assessing the situation, they secured the tank cars, including examining the remains of the propane car and isolation of the anhydrous ammonia tank car. A hole in the latter car was patched and the remaining product was flared off.

The OPP officer who evacuated the local area was not familiar with the alignment of the local road north of the derailment site and unknowingly proceeded into a downwind area. He wanted to find the woodcutters and have them clear the area because of the potential hazards of a number of dangerous goods known to be involved in the derailment, but not identified at that time. The OPP officer had basic safety equipment in his assigned police vehicle; however, it did not include any equipment for protection against dangerous goods. He was successful in finding and removing or instructing the woodcutters to clear the area, but while doing so exposed himself to unknown concentrations of ammonia vapour. He experienced breathing difficulty, stomach pain, nausea and headaches. He radioed to his dispatch centre to advise of his symptoms and request assistance. An ambulance was immediately dispatched which met him at a safe distance away from the derailment site. The officer was taken to hospital in Parry Sound where he was checked and released within several hours, and has since experienced no further symptoms.

The OPP vehicle was not equipped with a computerized mapping system, nor traced by any type of electronic equipment, such as a global positioning system (GPS). When the officer initiated a request for assistance, there was immediate concern for his safety, particularly when neither he nor the dispatch centre could accurately describe his location on this remote rural road. Computerized mapping, guidance and positioning systems in vehicles have been available for several years.

ER personnel adjusted the boundaries of the safe working area as conditions warranted. Police and security personnel controlled access roads into the derailment site.

1.13.2 Site Conditions

The initial assessment of the extent to which any dangerous goods-related conditions at the scene existed were partially based on air sampling and pressure readings from the fittings on the tank cars conducted by trained first responders wearing protective clothing and self-contained breathing apparatus. Due to the hole in the anhydrous ammonia car, the pressure reading from the fitting on the tank was zero pounds per square inch (psi) and the car was thought to be empty. A number of smaller fires that were burning in and around the rail cars proved persistent, particularly box car CN 558474, a load of oriented strand board (chipboard plywood). The smoke and fumes from the fires further complicated the conditions at the scene.

The jacket of ammonia car PROX 81179 was badly scorched due to fire. Except for a residual amount (heel) of refrigerated product remaining in the car, the car lost most of its contents within eight hours of the derailment. The majority of the ammonia burned off rather than forming a gas cloud. Figures 4, 5 and 6 show some of the fire damage on the exterior of the tank and the frosting due to the refrigerated heel. Twelve hours after the derailment, there were about 10 inches of product left in the tank car as indicated by the frost line. In the bolster areas of the car, the frosting peaked at higher levels due to higher thermal conductivity in that zone.

As the derailment circumstances were further analyzed, it became apparent that car PROX 81179 was not completely empty and that it contained residual amounts of product. Liquid product sloshed out of the hole in the car during re-railing efforts, displacing the temporary magnetic patch that had to be resecured with silicone sealant.

After the anhydrous ammonia fire stopped burning, vapours continued to escape through the hole in the tank shell. Ammonia vapours alone are much lighter than air. However, the conditions observed at the site indicated that the anhydrous ammonia had reacted with moisture in the air to form ammonium hydroxide, a liquid material (mist) heavier than air. The mist slowly descended to low-lying areas, giving off ammonia vapours. Higher concentrations of ammonia vapours were noticed when the rail cars in the area of the release were moved and at other times when soil conditions were disturbed. The vapours of ammonia combined with sweat on the bodies of the first responders where ammonium hydroxide was once again formed which caused irritation and chemical burns to the skin. Two fire-fighters experienced this effect to a moderate extent and sought relief in the water of the adjacent Little Key River.

Within 48 hours of the initial spill, a series of containment dams were installed upstream and downstream across the Little Key River. The affected area was confined to a 100 m reach of river upstream and downstream of the derailment site. Four aeration lines were installed for water treatment.

On 30 September 1999, after 36 hours of continuous rain, the containment dams breached. Un-ionized ammonia concentrations in the river were 666 mg/L one-half hour after the containment breach. High levels of ammonia persisted for approximately 12 hours and then declined to less than the Provincial Water Quality Objectives (PWQO). On 02 October 1999, dead minnows were observed downstream some 5.6 km from the spill site.

Other containment dams and trenches were installed to isolate and treat the spill area and the seepage zone that discharges to the Little Key River water. Local waterways and soils were monitored for environmental contamination and treated where necessary.

1.13.3 Tank Car Information

1.13.3.1 Thermal and Head Protection Requirements

In 1981, as a result of public hearings, the Canadian Transport Commission (CTC), a former regulatory body, required that all Class 112 and Class 114 tank cars carrying dangerous goods be equipped with a thermal protection system^{Footnote 12} and a full head shield. Cars that were already retrofitted with thermal protection before the CTC order were exempted from the full head shield requirement. These additional safety features made the Canadian fleet of Class 112 and Class 114 tank cars better constructed than those of the U.S. fleet.

In the late 1980s, the regulatory mandate of the CTC was transferred to TC, and most of the CTC regulations were replaced with TC's Transportation of Dangerous Goods Regulations. The Transportation of Dangerous Goods Regulations did not contain tank car specifications but initially referenced the remaining CTC regulations with regard to packaging requirements.

TC subsequently established a Committee on Tank Car Tanks for Transportation of Dangerous Goods under the auspices of the Canadian General Standards Board (CGSB). In 1990, this committee published a standard for tank car tanks (CGSB 43-GP-147). The Transportation of Dangerous Goods Regulations refer to this standard as the containment standard for tank cars carrying dangerous goods in Canada. The standard had the same safeguards as previous CTC regulations.

The Transportation of Dangerous Goods Regulations were later changed to reference the 1992 edition of the CGSB standard. In the 1992 standard, the CTC requirement for full head shields was retained; however, the CGSB abandoned some of the measures introduced in 1981 by the CTC. In particular, the 1992 standard stated that all Class 112 and Class 114 cars carrying a flammable gas, such as propane, butane or vinyl chloride, be required to be equipped with a thermal protection system, whereas the earlier standard was not restricted to any particular type of compressed gas, and therefore would have included cars in anhydrous ammonia service.

In 1995, the U.S. Department of Transport (DOT) issued a notice of mandatory safety improvements to Class 112 tank cars similar to that introduced by the CTC in 1981. This notice contributed to the development of a new version of the CGSB standard in 1997 (CAN/CGSB-43.147-97).

In the 1997 version (the most recent amendment of the CGSB standard before the accident), the containment requirement for Class 112 and Class 114 cars was strengthened to require that, by 01 July 2006, all tank cars carrying Class 2 gases must be equipped with a thermal protection system; i.e., the same safety requirement that was originally introduced by the CTC some 16 years earlier. Part II, Subpart B, Section 73.31, of standard CAN/CGSB-43.147-97 states in part:

(4) Thermal Protection Requirements. The following tank cars shall have thermal protection that conforms to the requirements of § 79. 18 of Part I:

1. Tank cars transporting a Class 2 material, except for a Class 106, 107A, 110, and 113 tank car. A tank car equipped with a thermal protection system conforming to § 79.18 of this standard, or that has an insulation system having an overall thermal conductance of no more than 0.613 kJ/h·m²·°C (0.03Btu/h·ft²·°F) temperature differential, conforms to this requirement.
2. A tank car transporting a Class 2 material that was not required to have thermal protection prior to the adoption of this standard by the regulatory authority shall be equipped with thermal protection no later than July 1, 2006.^{Footnote 13}

Part I, Subpart A, Section 79.18 of the same standard says:

(a) Performance Standard. When this standard requires thermal protection on a tank car, it shall have sufficient thermal resistance so that there will be no release of any lading from within the tank car, except release through the pressure relief device, when subjected to:

1. A pool fire^{Footnote 14} for 100 min, and
2. A torch fire for 30 min.

Part I, Subpart F, Section 80.509 of the same standard says:

[. . .]

(l) Re-qualification Compliance Dates for Tank Cars

• (1) After July 1, 2000, each tank car with a metal jacket or with a thermal protection system shall have a re-qualification inspection and test conforming to this section no later than the date the tank car requires a periodic hydrostatic pressure test (i.e., the marked date on the tank car for the hydrostatic test).^{Footnote 15}

Regarding head protection, Part II, Subpart B, Section 73.31 states in part:

(3) Tank-head Puncture-resistance Requirements. The following tank cars shall have a tank-head puncture-resistance system that conforms to the requirements in § 79.16 of Part I, or to the corresponding requirements in effect at the time of installation.

1. Tank Cars Transporting a Class 2 Material. Specification 105 tank cars built with a test pressure of 3448 kPa (500 psi) or more meet tank-head puncture-resistance requirements.
2. Tank cars constructed from aluminum or nickel plate that are used to transport dangerous goods.
3. Except as provided in par. (b)(3)(iv) of this section, those tanks specified in (b)(3)(i) and (ii) of this section not requiring a tank-head puncture-resistance system prior to the adoption of this standard by the regulatory authority, shall have a tank-head puncture-resistance system installed no later than July 1, 2006.
4. Class 105 tank cars built prior to September 1, 1981, having a tank capacity less than 70 030 L (18 500 US gallons), and used to transport a Division 2.1 (flammable gas) material, shall have a tank-head puncture-resistance system installed no later than July 1, 2001.

The head protection system is intended to provide protection against penetration of the couplers of following or preceding cars or other objects into the head of the tank shell in case of a derailment.

1.13.3.2 Thermal Protection System Approval

Thermal protection is intended to provide additional time before tank failure in case the tank car is exposed to fire. The thermal protection systems for tank cars are approved on the basis of small scale tests of their thermal conductivity. The acceptance criteria were that the tank material not reach 800°F (427°C) when tested in conditions simulating two types of fire: a pool fire engulfing the whole tank, and a more intense torch fire impinging only on a part of the tank. In order to pass the test, the tank material critical temperature of 800°F (427°C) must not be reached before 30 minutes in the case of a torch fire and 100 minutes in the case of a pool fire. An additional requirement exists for either testing in full scale or simulating these fire conditions with the help of an approved algorithm.

1.13.3.3 Pool Fires / Torch Fires

A pool fire is when the fire envelops the tank or a large part of it. In a pool-type fire, the whole tank is being heated more or less evenly. A torch fire is more localized and typically causes much higher temperatures over the particular area of the tank where the torch fire is impinging. For example, if a safety valve opened on a car and this jet flame was hitting another car, it would be considered a torch fire. In this occurrence, the LPG car was subjected to pool fire conditions.

A large part of the gases which are liquefied in tanks by pressure will evaporate nearly instantly when the containment is breached and the pressure can no longer be sustained. The volume of vapours so released may be several hundred times larger than the original volume of liquid and further enlarges as it mixes with air. Such gas/air mixtures will quickly spread and often will ignite if they come into contact with an ignition source.

In order to ensure at least a limited fire survivability for any liquefied compressed gas in a tank, fire resistance is provided by a thermal protection system. It is important that all surfaces of the tank be so protected.

1.13.3.4 Boiling Liquid Expanding Vapour Explosion (BLEVE)

The book entitled Loss Prevention in the Process Industries^{Footnote 16} provides the following description of a BLEVE:

When a vessel containing a liquid under pressure is exposed to fire, the liquid heats up and the vapour pressure rises, increasing the pressure in the vessel. When this pressure reaches the set pressure of the pressure relief valve, the valve operates. The liquid level in the vessel falls as the vapour is released to the atmosphere. The liquid is effective in cooling that part of the vessel wall which is in contact with it, but the vapour is not. The proportion of the vessel wall which has the benefit of liquid cooling falls as the liquid vaporizes. After a time, metal which is not cooled by liquid becomes exposed to the fire; the metal becomes hot and then may rupture.

The ability of the tank car shell to safely contain the internal pressures, particularly if they are increasing due to an external heat source, is significantly decreased when the temperature of the steel in the tank shell increases. Steel loses approximately 30 per cent of its strength at 400°C (752°F), and approximately 90 per cent at 700°C (1 292°F).

The time to rupture depends on the rate of the heat transfer from the fire to the tank car tank. This main factor depends on a multitude of conditions, including the location, extent and temperature of the heat source, the presence or absence of thermal protection (which serves as a medium to slow the heat transfer rate), the degree to which the container is full, the position of the container on the ground, the thermo-physical characteristics of the product involved, the mechanical condition of the tank, and the operational readiness of the pressure relief devices.

1.13.4 Examination of Tank Cars and Safety Valves

1.13.4.1 PROX Tank Cars

Of the three anhydrous ammonia tank cars, two were re-railed without incident (PROX 37789 and PROX 89119). Car PROX 89119 was slightly damaged by the fire at one end; however, no loss of product occurred. The tank shell of car PROX 81179 was breached. The breach was approximately 15 cm by 10 cm (6 inches by 4 inches) in diameter (see Figure 7). There were corresponding marks on the corner of a box car (CN 558474) that was located immediately in front of it. (The puncture in the ammonia car showed a direct match with the frame of the box car.) The head shield was crushed and displaced longitudinally, allowing the corner of the frame of the box car access to the corner of the tank.

Another fire burned at car PROX 81552, containing LPG, at a location eight cars forward of car PROX 81179. Car PROX 81552 was next to the empty (purged and cleaned) tank car, car GATX 9368. The latter rolled over during the derailment, as did car PROX 81552. Both cars then scraped against a jagged rock cut alongside the right-of-way (see Figure 8). Gouges and scrape marks were observed on the right side of car GATX 9368. Longitudinal marks indicate that the train was still going forward while car GATX 9368 and car PROX 81552 got caught in the rock cut. Extreme longitudinal forces in the train lifted and derailed the 15 empty tank cars immediately ahead of the rock cut (derailing them to the inside of the curve, a phenomenon known as stringlining) and broke a coupler shank on car GATX 9425, located eight cars ahead of car PROX 81552 (see Figure 9).

Car PROX 81552 eventually exploded. Two of the cars between car PROX 81552 (the load of LPG) and the other fire at car PROX 81179 (the load of anhydrous ammonia) were undamaged by fire, indicating that there were two separate fires.

1.13.4.2 Construction Information

Car PROX 81179 was built on 25 October 1968 to carry LPG / anhydrous ammonia under the construction tank specification of DOT 112A340W. The car was later converted and stencilled as a DOT 112J340W. Car PROX 81552 was manufactured in 1966 and converted from a DOT 112A400W to a DOT 112J400W in 1981. Both cars were thermally protected by applying a 0.65 inch-thick (16.5 mm) blanket of spun ceramic fibre (Fiberfrax) over the shell and heads and covering the shell and top half of the heads with a gauge 11 steel jacket which is approximately 0.125 inch (3 mm) thick.

The head protection system fitted on both cars is a half head shield design, where only the lower half section (bottom) is made with thicker steel material. The material consists of a 0.5 inch-thick (13 mm) structural steel plate (American Society for Testing and Materials (ASTM) A36) that is shaped and fitted to cover the bottom half and the centre of the head. This half head shield is welded to the jacket covering the rest of the tank. This style of head shield covers the whole projection of the lower half of the head and almost touches the tank shell in the centre. Since it is not fully contoured to the head, a gap of 20 cm to 23 cm (8 to 9 inches) between the outside edge of the shield and the shell head exists both in the top and bottom areas. Cars built in the United States, where this head shield system was authorized, were accepted in Canada while in transit. Recently built head shields would generally be closely contoured to the head and extend further along the side of the tank head, ending closer to or at the shell-to-head weld joint, although it is not a regulatory requirement that the shield extend all the way to that joint.

The TSB Engineering Laboratory further examined the two cars that released product (the LPG car, PROX 81552, and the anhydrous ammonia car, PROX 81179) to determine the mode of failure, whether they had been built to specification, and whether their respective re-closing pressure relief valves (PRVs) were functioning properly at the time of the failure.

1.13.4.3 Safety Valve Examination

Car PROX 81552^__Load of LPG

The flap for the PRV and lid were both bent, but neither showed any signs of mechanical damage indicating that the lid was heated to red heat as the PRV operated to relieve pressure in the tank. The lid bulged to help relieve the pressure of the escaping gas and liquid trapped in the manway area.

The PRV identification tag indicated that it was built by Midland Manufacturing Corporation of Skokie, Illinois, Model A3200 XL7 66, Serial No. EE137, 300 psig (pounds per square inch gauge), 29 820 CFM (cubic feet per minute) at 33^oC psia (pounds per square inch absolute). Records indicated that the valve was last tested in 1996 in Edmonton, Alberta. This particular PRV requires re-qualification, inspection and testing at least once every 10 years.

Post-derailment testing was carried out with the PRV in its "as found" condition. A slow rate of pressure rise was applied using nitrogen gas. The valve started to leak at 10 psi, but the pressure continued to build up until the PRV opened at 290 psi. This was essentially within the allowable range of 300 psi ± 3 per cent, or 291 psi to 309 psi. The PRV then re-seated itself before it reached 240 psi, as required, but continued to leak.

Two new o-rings were installed and the test was repeated, again at a slow rate of pressure rise. The valve started to leak at 260 psi, opened at 292 psi and re-seated itself as the pressure was reduced down through 240 psi. The valve continued to leak slightly after closing, but this was attributed to an accumulation of dirt, since the valve had been tested in the "as recovered" condition. Examination of the original o-rings showed that they were hardened and no longer flexible. This was attributed to exposure to an abnormal environment during the occurrence. Therefore, the PRV was considered to have been functional at the time of the explosion.

Car PROX 81179^__Load of Anhydrous Ammonia

Despite the anhydrous ammonia fire under car PROX 81179, there was no indication that the PRV on this car operated. The jacket and thermal protection, coupled with the size of the hole, were apparently effective in controlling the internal pressure.

The PRV identification tag indicated that it was built by Midland Manufacturing Corporation of Skokie, Illinois, manufactured in July 1986, Model A3480, Serial No. GE 707, 280 psig, 36 640 CFM at 306 psig. Records indicated that the valve was last tested in 1997 in Joffre, Alberta. This particular PRV also requires re-qualification, inspection and testing at least once every 10 years.

The PRV was tested at the Procor tank car facility in Sarnia, Ontario. A slow rate of pressure increase was applied using nitrogen gas. Water was also used above the sealing surface to enable detection of leaks. During the first test, the PRV did not release at the specified pressure of 280.5 psi ± 3 per cent, and went beyond 300 psi, at which point the test was stopped. It was then observed that the top guide was slightly deformed around the four corner studs and the centre stem area. The top guide was removed and the test repeated without the top guide. During the second test, a leak was detected at 100 psi, but the pressure continued to build up, and the PRV opened at 280 psi. The top of the stem was found to be worn, indicating that there might have been some problems during a previous test. The problems experienced with the valve were not considered to have been caused by the derailment sequence and had no effect on the outcome of the derailment.

1.13.4.4 TSB Engineering Laboratory Examination and Analysis

Car PROX 81552 exploded into six main pieces surrounding the crater left by the explosion. (Figure 2 shows the location where the major pieces of the ruptured LPG car were found, and Appendix A shows the identified tank car fractures.) A major portion of the car struck box car CN 413849 as indicated by the impact damage to that car (see Figure 10). It then careened through the woods knocking down small trees and brush. It traversed a brook and struck a vertical rock face where the spent pressure vessel came to rest in several pieces, approximately 300 feet (91 m) from the point of detonation. The open end of the vessel showed fire damage as the last of the LPG product burned off. Including the length of the car and the fact that the car tracked west before turning north coming to rest 180 degrees opposite to its original direction, the total length of travel for the open end of the car exceeded 400 feet (122 m).

The main part of the "B" end of the car, including the head and a portion of approximately 16.5 feet (5 m) of the tank shell, was found on the opposite side of the railway right-of-way. Trees 60 feet (18 m) tall surrounding this location were not disturbed by the falling tank indicating that it dropped to this location from a much higher altitude. This section of the tank was facing east at the time of detonation, but was found about 340 feet (104 m) southwest of its origin. The piece was approximately 50 feet (15 m) from the right-of-way and about 92 feet (28 m) from the closest rail. The cylindrical portion of the tank was bent back on itself, a characteristic feature of a BLEVE (see Figure 11). This fact indicates that the initial failure of the tank was longitudinal, followed by a circumferential failure. The other half of the "B" end head was on the right-of-way next to a fibre-optic cable bungalow about 335 feet (102 m) west of the point of detonation.

The majority of the jacket was found about 300 feet (91 m) southwest of the point of detonation. Based on the sections of trees it struck and destroyed, it was approximately 75 feet (23 m) in the air at its highest point. The jacket was hot as it flew through the air. It scorched all the wood it came into contact with as well as the ground where it landed. Some parts of the jacket showed metal thinning and stretching at failure.

The head shield from the jacket was found east of the explosion, next to car GATX 9432, about 300 feet (91 m) east of the point of detonation. The "B" end ladder was thrown another 150 feet (46 m) east down the track, and had adopted the shape of a truck side frame on which it had landed, indicating that it was softened by heat exposure.

There was a tear in the non-head shield area at about the twelve o'clock position, tears and gouges at the nine o'clock position, and a circumferential tear in the top section of the button area separating the lower and upper parts of the head shield (see Appendix A). A heat line was also evident on the jacket consistent with the car being on its side with the lower portion of the jacket being protected by the ground. This was consistent with the trough made by the car at the point of detonation. There were dents and tears in the head shield portion of the jacket.

The "A" end jacket head was the closest major piece to the point of detonation. It was found about 100 feet (30 m) southwest at the tree line along the right-of-way. It showed mechanical damage with none of the heat-affected zones evident on other parts of the jacket, particularly around the manway and on the "B" end head.

As a result of this examination and analysis (TSB Engineering Laboratory report No. LP 112/99), the following conclusions were made:

Tank Car PROX 81552^__LPG

• Car PROX 81552, the LPG car, failed from a Boiling Liquid Expanding Vapour Explosion known as a BLEVE. A small section of the tank car shell where the BLEVE initiated was not recovered.
• The BLEVE occurred within 37 minutes after the application of the emergency brake. The derailment damage to the tank car and to the "B" end jacket and head shield weakened the tank and reduced the effectiveness of the thermal protection system. The regulations with regards to thermal protection systems require that the tank car not fail for 100 minutes in a pool fire and 30 minutes in a torch fire. However, this applies to a tank car meeting both the tank integrity requirements and the thermal protection system requirements and could not be expected for the subject car which was breached during the derailment.
• The requirement to construct the sill-to-pad weld such that it is weaker than the pad-to-tank weld came into effect in 1971.^{Footnote 17} Therefore, it was not in place when the subject car was built in 1966. In the subject car, the failure of the sill-to-pad weld to fracture cleanly likely resulted in the crack in the bottom shell at the "B" end. This crack allowed product to escape, leading to the fire and subsequent BLEVE.
• The PRV operated as specified.
• No material deficiencies which could have contributed to the BLEVE were found.

Tank Car PROX 81179^__Anhydrous Ammonia

• The breach in the shell of car PROX 81179, the anhydrous ammonia car, released product which ignited and burned on site. The breach might have been prevented by the use of a full wrap-around head shield that is now fitted on recently constructed cars. A head shield was not required at the time of construction of this car and the retrofitted half head shield installed in 1981 under regulatory requirements was not intended to provide protection in all conditions.
• The breach in the shell was sufficiently large for product to escape and feed a fire, and was also sufficiently large to prevent the internal pressure inside the tank from building, thus preventing the PRV from opening.
• During testing, the PRV was found to stick and did not release as specified with the top guide in place. However, testing was normal once the top guide was removed. The damage to the car was not in the area of the manway housing and should not have affected the functioning of this PRV. If this car had not been punctured, it is probable that the PRV would not have opened at the specified set pressure should the pressure in the car have exceeded this level.
• Evaluation of the effectiveness of the thermal protection system was not conclusive due to derailment damage and secondary water damage to the insulation material from the fire-fighting and subsequent steaming and purging for inspection.
• Polyethylene film was used to secure the insulation material to the heads. When jacket sections were cut from the car, the polyethylene film melted and caught fire, causing voids in the thermal protection system. Alternative methods for securing the insulation in place, such as wire, are being considered by the tank owner.

1.13.4.5 GATX Tank Cars

There were 15 GATX tank cars involved in the derailment, all of which were similar in design. Four cars were further examined for truck and car body conditions which may have influenced the cars negotiating the track structure at the initial point of derailment. Tank cars GATX 9367, 9368, 9362 and 9459 were examined for proper truck-to-car body relationships. The adherence to the design specifications of the builder of the cars (Trinity Industries, Inc.^__Railcar Division) was verified for both side bearing and body bolster-to-truck bolster clearances. Distinct wear patterns on the vertical surfaces of the body centre plates and truck bolster bowls were measured and used to calculate the clearances which existed before the derailment. It was noted that the general condition of the trucks was excellent with minimal wear on truck components. The measurements obtained confirmed that acceptable side bearing clearances and proper centre plate penetration into the bolster bowls existed on these cars before the derailment.

Car GATX 9367, which was located two cars ahead of car PROX 81552, had severe gouging on the "B" end bell crank bracket^{Footnote 18} located closest to the trailing wheel of the trailing truck. The shape and arced nature of the gouged marks were consistent with damage that would occur when the lead wheel of the same truck was derailed and the car continued to travel with the truck skewed to the north (see Figure 12).

1.13.4.6 Inspection of Thermal Protection System on Other PROX Tank Cars

Subsequent to the derailment, TC and Procor officials initiated an inspection of three other pressure tank cars (112J) to evaluate the degree to which any voids may exist in their insulation. Based on the results of these inspections, two additional cars were also evaluated. (Appendix B contains photographs of typical inspection locations and sample copies of the forms showing how the inspection results were captured.)

Table 2 summarizes the results of the five tank car inspections.

Of the 84 locations examined, 28 (or 33 per cent) were found to have missing or inadequate insulation. Subsequent to the examinations, Procor officials stated that there is a need to establish an industrial standard for evaluating and restoring the thermal protection system on 112J cars.

Pressure cars like anhydrous ammonia and LPG cars are subject to stub sill inspections. During these inspections, maintenance personnel have to remove portions of the jacket in several locations to ensure that an adequate examination can be made of the covered areas of the stub sill. Repairs requiring removal of all or part of the tank jacket, like stub sill inspections, disturb the original condition of the insulating material as it is applied between the jacket and the tank shell. Maintenance records showed that car PROX 81179 underwent a stub sill inspection in 1992.

2.1 Introduction

There was only one set of derailed wheel marks from the initial point of derailment at Mile 202.98 of the Bala Subdivision until the crossing at Mile 199.57. The distance this one set of derailed wheels travelled, as well as the minor tie and track damage it created on the right-of-way over this distance, indicates that the first derailed car was empty. The damage to the bell crank bracket on empty car GATX 9367 was sustained over a considerable distance, consistent with an empty car running partially derailed for a distance of approximately 3 1/2 miles. This car was also positioned in the derailment consist where the first derailed cars are usually located; i.e., within the first several cars of the major derailment location. All the other empty tank cars ahead of it were derailed due to stringlining, which is normally a condition associated with a symptom of a derailment, rather than the cause of one. The mechanical condition of the GATX cars was found to be within acceptable standards.

The overall information indicates that the leading wheel of the trailing truck of tank car GATX 9367 derailed to the east side, immediately south of the bridge and within the entry spiral of a five-degree right-hand curve. The car remained with one wheel derailed until the crossing at Mile 199.67 when the second wheel set from the same freight car truck also derailed. When the derailed wheel sets encountered the switch to the siding at Mowat, the derailed wheels were diverted to the north causing the car to go sideways, precipitating the derailment of the remaining cars.

The analysis will focus on the track conditions in the area where the initial derailment took place, the performance of the pressure tank cars that were involved in the release of two dangerous goods, and the subsequent emergency response.

2.2 Track Conditions

The design criteria for alignment and top of rail profiles for the five-degree curve south of the bridge specified a curve elevation of 3.0 inches (7.6 cm) and an easement curve (spiral) length of 195 feet (59 m). These criteria were not met as the length of easement curve was approximately 40 feet and the curve elevation was 1 1/2 inches (3.8 cm) through the bridge structure. The SPCs require that, if there is a fixed point such as a through-plate girder bridge, the minimum spiral length should be 75 per cent of the desired length, or 140 feet (42.7 m) in this case. Typically, the curve elevation should be run out through the length of spiral where practicable, or a minimum of 75 per cent with the remaining elevation run out on tangent. Because the bridge deck was constructed with a fixed elevation of 1 1/2 inches (3.8 cm) and the main body of the curve was elevated to 3.0 inches (7.6 cm), the run-off for the elevation was not consistent with the design criteria nor did it match the alignment. In addition, the variation in cross-level created a warp in the track. Even though the variation in gauge was within the maximum allowable tolerance, this condition also contributed to the initiation of the wheel climb.

Although the measurements taken by the track geometry car did not indicate that there were urgent defects at this location, the combination of deficiencies in gauge, alignment, cross-level and elevation were sufficient to cause the wheel of the rigid and empty tank car to climb the high rail of the curve. The combined effect of these track deficiencies would not be readily identifiable during a Hi-rail inspection. Consequently, corrective action would usually be taken in accordance with test results recorded by the track geometry car. The existing condition of the track did not meet the design requirements for the authorized operating speed of Class 3 track (maximum operating speed of 40 mph), and many of these deficiencies had remained uncorrected since the last two TEST car inspections (performed on 13 May and 10 June 1999). In the absence of substantive corrective action, the maximum authorized speed should have been reduced to be compatible with the conditions of the track.

2.3 Performance of Pressure Tank Cars

2.3.1 Car PROX 81552^__LPG

The LPG car which violently ruptured failed in a part of the tank shell in which construction specifications had changed since the car had been built. The sill-to-pad weld for new car construction is designed to fail before the pad-to-tank weld, thereby affording more protection to the integrity of the tank shell. This type of construction standard did not exist in 1966, at the time of manufacture of tank car PROX 81552. The car met the design and construction standards applicable to it at that time. TC does not preclude such cars from continuing in current dangerous goods service.

The PRV functioned as intended; therefore, it did not contribute to the catastrophic failure of the tank shell.

The fact that the tank shell was subjected to a pool fire and that it ruptured in less than 100 minutes indicates that its thermal protection system either did not conform to existing requirements or was compromised during the derailment sequence. The examination and analysis of the tank car determined that derailment damage to the tank car and to the "B" end jacket and head shield weakened the tank and reduced the effectiveness of the thermal protection system. Whether the thermal protection system was in conformance before that mechanical damage could not be determined. The performance of the car was understandable given the extent of the damage sustained to its shell, and the amount of heat that it was exposed to during the ensuing fire.

2.3.2 Car PROX 81179^__Anhydrous Ammonia

The anhydrous ammonia car was breached due to mechanical damage sustained during the derailment when it came into contact with the adjacent box car. The gouges and score marks on the head shield indicated that the side sill from the box car had slid against the thicker section of the head shield, pushing back the jacket on the side of the car, and penetrating the 0.75 inch (19 mm) shell just beyond the head shield. Because the half head shield covers only the frontal projection of the head, the protection plate falls short of the head-to-shell welded joint, immediately forward of the puncture location. A full wrap-around shield would have offered additional protection from this type of puncture. The requirement for full head shields and thermal protection on ammonia cars was abolished in 1992 only to be re-introduced in 1998. The current requirement makes the installation of full head shields mandatory on new car construction, and requires all cars carrying Class 2 dangerous goods (including anhydrous ammonia) to have a tank head puncture resistance system installed or re-installed no later than 01 July 2006.

The PRV on this car did not function during the derailment, nor would it have been capable of functioning normally had it been required. Although the improper condition of the PRV had no bearing on the outcome of the derailment, its less-than-adequate condition raises a concern over the degree of attention these important safety devices receive.

Another condition noted with the anhydrous ammonia car unrelated to the dangerous goods release was in the area of the thermal protection system (the insulation missing in the bottom area of the head at the "B" end). As the polyethylene film securing the insulation in place was flammable, it melted when portions of the jacket were removed by use of a cutting torch. In the absence of any other related repair history, the 1992 stub sill inspection was the most likely event that precipitated the damage to the insulation. The results of the inspections performed by Procor on five other 112J cars indicate a potential safety issue with many similar cars. Although tank cars with thermal protection systems are subject to a re-qualification inspection and test no later than the date the tank car requires a periodic hydrostatic pressure test, there is nothing in the standard specifying how that inspection should be carried out, and what the acceptable results should be. Therefore, there is a risk that some tank cars which have had portions of their jackets removed by cutting torches may have incurred detrimental effects to their thermal protection systems, and these defects may remain undetected during required re-qualification inspections.

2.3.3 Other Liquefied Compressed Gas Tank Cars

A BLEVE, as described in section 1.13.3.4, is a particular type of violent rupture of a tank car and can occur with any liquefied compressed gas, regardless of whether the product is flammable or not. This fact has been well recognized and it was for that reason that, shortly after the CTC decision in 1981, many U.S. companies began to apply thermal insulation to their cars even though the products were not classified as flammable gases.

The existing TC specification requirements for tank cars carrying pressure gases (e.g. Class 112 and Class 114) do not require all cars of anhydrous ammonia built before 1997 to be thermally protected until 01 July 2006. In the interim, there is a lesser ability of the tank car to withstand an external heat source. Excessive pressure in a car load of dangerous goods is a serious condition that can have a negative impact on the personnel first on the scene of an accident, such as emergency responders. Any compressed gas tank car not equipped with thermal protection that is involved in a fire situation is at risk of violently rupturing within minutes of a derailment. First responders and others close to the scene during the initial stages of a derailment may not be aware of all the products involved and their associated hazards at that time, and site control appropriate for the conditions may not yet be in place.

2.4 Emergency Response

The anhydrous ammonia escaping from punctured tank car PROX 81179 caught fire and burned even though it is not classified as a flammable gas in Canada. The most probable ignition sources were the multiple fires from the propane car, friction from the rocks of the rock cut, or contact with other rail cars and track components. The extent of the heat damage to the jacket indicates that it burned for a considerable length of time. Much of the leaking ammonia gas was burned at the site rather than moving downwind; this would account for the lack of significant discolouration seen on surrounding vegetation even though approximately 75 tons of ammonia was lost to atmosphere. It is likely that the fire was extinguished by the force of the explosion from the adjacent propane car approximately 37 minutes after the accident. This would also account for the detection of ammonia fumes by the OPP officer and the local woodcutters downwind of the accident site several hours after the initial accident.

The burning of ammonia from car PROX 81179 prevented the formation of a large ammonia cloud, which mitigated the risks for emergency responders and other persons within the area. Once the fire was extinguished, the detection of ammonia vapours may have been unexpected; however, it did not result in serious injury or worse to the people in the vicinity.

Police officers frequently are involved with dangerous goods in highway accidents. However, their experience with large train derailments and the volume of dangerous goods that freight trains may carry is relatively low. The police officer who was exposed to the ammonia fumes in this accident was assigned a typical police cruiser. This vehicle was not equipped, nor was it intended to be used, to deal with a major transportation accident relating to dangerous goods. The officer had very little dangerous goods training, and had limited information about the products involved in the derailment. These factors, combined with the lack of an on-board computerized guidance system illustrating the alignment of the rural road and the direction of the wind, may have contributed to his decision to travel downwind of the derailment site where he was exposed to ammonia fumes.

The local fire department showed considerable concern for the community by the number of hours each person expended in providing fire protection services. Because the local fire department was a volunteer force, its financial and human resources were limited. There were few additional resources to provide relief for fatigued fire-fighters as the hours of the derailment mounted. Some of the fire-fighters were on duty for nearly 40 continuous hours. Some had responded directly to the site after the accident, but they had little personal protective gear, such as steel toe boots and leather gloves. The fire chief was personally involved in the fire-fighting effort and therefore was not able to be present at the command post to be involved in coordination efforts for relief and other contingencies.

Without basic personal protective equipment, associated dangerous goods training, and sufficient rest, some emergency responders risked the consequences of unprotected exposure and fatigue as they endeavoured to perform their required duties.

2.5 Reclassification of Anhydrous Ammonia

The proposed change of classification for anhydrous ammonia raises ER issues since the actual risks might be less recognizable with the new classification and placard. Despite the warning in the current ER guide, several workers experienced minor injuries due to the hazardous properties of the ammonia vapours. Fire-fighters encountered the flammable and toxic nature of the product, despite its not being classified as a flammable or poisonous gas, even in the current regulations.

The planned reclassification of anhydrous ammonia from a corrosive gas, Class 2.4, to a non-flammable and non-toxic gas, Class 2.2, may obscure the risks that releases of large quantities of anhydrous ammonia pose to human health. Responders such as fire-fighters and police in small communities, with little exposure to dangerous goods, may make their first estimates of danger based in part on the colour and shape of a placard. The Class 2.2 placard is green in colour; a colour frequently interpreted to mean a product with lower risk. White-colour placards (current Class 2.3 and 2.4 placards) mean toxic or corrosive, and for responders, to be very careful.^{Footnote 19}

The recent trend for many ER personnel to rely on general ER guides, as opposed to the more product-specific ER information, places them at risk of not fully understanding and protecting themselves from some of the hazardous properties of this product; e.g., toxicity and flammability. This increases their risk of injury in future accidents, and may decrease the overall degree of caution exercised by ER personnel, particularly those with limited resources and training.

3.1 Findings as to Causes and Contributing Factors

1. The combination of deficiencies in variation of track gauge, cross-level, elevation, alignment and profile resulted in the leading wheel of the trailing truck of the rigid and empty tank car climbing the high rail and derailing as it was negotiating an entry spiral for a five-degree curve.
2. The condition of the track did not meet the design criteria required to operate freight trains at a speed of 35 mph. In the absence of substantive corrective action, the maximum authorized speed should have been reduced to be compatible with the condition of the track.
3. The damage observed on the remaining pieces of liquefied petroleum gas (LPG) car PROX 81552 indicates that the shell was breached and the thermal protection system compromised when the car contacted the rock cut; these two factors contributed to the Boiling Liquid Expanding Vapour Explosion (BLEVE).

3.2 Findings as to Risk

1. The LPG car ruptured due to a crack in the tank shell adjacent to the sill-to-pad weld. The weld was applied before the current standards. Current regulations allow existing pressure cars not built in accordance with these standards to continue in service.
2. The anhydrous ammonia car ruptured due to mechanical damage. The head shield was of an older design which did not afford any wrap-around protection to the welded area where the head connects to the tank cylinder.
3. When examined, the anhydrous ammonia car had a defective pressure relief valve and had voids in its thermal protection system. Random sampling of five other 112J cars determined that 33 per cent of the locations inspected had voids in their insulation, indicating that more pressure tanks cars may have inadequate thermal protection.
4. The Canadian General Standards Board packaging standard allows pressure tank cars already in service without thermal protection to remain in service until 01 July 2006. Approximately 3 500 pressure tank cars in North America are presently classified as having no thermal protection, and most of these cars are carrying liquefied compressed gases which can produce BLEVE-type failures.
5. The burning of the majority of the ammonia vapours from car PROX 81179 prevented the formation of a large ammonia cloud which otherwise might have further endangered emergency responders and other persons within the area.
6. Without sufficient personal protective equipment, associated dangerous goods training and adequate rest, some emergency responders risked the consequences of unprotected exposure and fatigue as they endeavoured to perform their duties.
7. Within the dangerous goods classification system, anhydrous ammonia is classified in a class and division which does not clearly identify the dangers posed by that product.

4.1 Action Taken

4.1.1 Combination Track Geometry Defects

To better understand the cumulative effect of combination track geometry defects, Canadian National (CN), Canadian Pacific Railway (CPR) and Transport Canada (TC) are currently collaborating on a joint research study targeted at characterizing the effect of combination geometry defects. TranSys Research Ltd., a transportation research and consulting group based in Kingston, Ontario, has been retained to provide technical expertise in conjunction with field-testing of instrumented rail cars. Measured car performance is being correlated with track geometry data to identify track locations that generate an inappropriate vehicle response for a specified car type.

Furthermore, in April 2000, CN amended Standard Practice Circular 3101, "Track Geometry Maintenance Standards," to clarify the required response by maintenance personnel to combination track geometry defects. Specifically, paragraph 1 (c), which addresses combination priority level defects, was changed to read:

Where a line of track exceeds the limits defined as "PRIORITY", the defect must be monitored until it is repaired to ensure it does not escalate to an "URGENT" condition. The following approach is to be used in responding to PRIORITY defects and combinations of PRIORITY defects;

1. address all defects which appear on the Geometry Car Priority Exception Report first (i.e. PRIORITY + 70% to URGENT),
2. address combination defects (i.e. defects within 100' of each other) in the following order):

1. combination defects on curve spirals;
2. combination defects on curve body;
3. combination defects near changes in track modulus (i.e. near bridges, crossings, turnouts, etc.);

3. address all other PRIORITY defects.

4.2 Action Required

4.2.1 Classification of Anhydrous Ammonia

The new classification system adopted by TC contains several inconsistencies regarding the classification of ammonia. Although the dangers of anhydrous ammonia are considerably greater than ammonia solutions in water (e.g. toxicity of pure ammonia is approximately three times higher than a 51 per cent ammonia solution), the Canadian regulations have recently reclassified anhydrous ammonia as a non-toxic and non-flammable gas, Class 2.2, UN 1005, while its solutions in water with more than 50 per cent ammonia were reclassified as toxic gas, Class 2.3, UN 3318. Furthermore, the United Nations system, to which most countries subscribe, classifies ammonia as a toxic gas.

In the U.S., the situation of both the classification and the transportation of ammonia is ambiguous. Ammonia is allowed to be transported domestically as a non-flammable gas, although several agencies call for additional precautions. For example, the National Institute for Occupational Safety and Health (U.S.) states clearly that, even when ammonia is transported as a non-flammable gas, it should be treated as flammable. The Federal Railroad Administration regulations require that each vehicle be marked on both sides with the words "INHALATION HAZARD" in letters at least four inches high. In addition, various U.S. safety agencies have warned users about the toxicity of ammonia, and the regulations state clearly that it must be classified as a toxic gas for international shipments. The National Fire Protection Association considers the health hazard of ammonia to be extreme while the fire hazard is considered to be slight. Nevertheless, at vapour concentrations greater than 15 per cent, ammonia gas can be explosive. The Canadian Centre for Occupational Health and Safety has reported that there have been several violent ammonia/air explosions in confined industrial settings in North America,^{Footnote 20} including a case in which ". . . fire fighters believed that they were dealing with stabilized conditions and that anhydrous ammonia gas was non-flammable."

Furthermore, the safety mark (i.e., green placard) presently required for bulk shipments of anhydrous ammonia can be misinterpreted, thus increasing the risk to the public. The green colour, which is used with products such as compressed air, is frequently interpreted to mean a product with lower risk, whereas the white colour, which was previously used for anhydrous ammonia, is associated with products that pose a higher risk. First responders such as fire-fighters and police in small communities, with little exposure to dangerous goods, may incorrectly make their first estimates of danger based in part on the colour and shape of a placard, instead of relying on the specific characteristics of the product. The Board therefore recommends that:

4.2.2 Thermal Protection on 112J Tank Cars

The visual inspection of car PROX 81179, the anhydrous ammonia car, as well as five other similar 112J tank cars, revealed that the thermal protection material has a tendency to shift over time. In the case of car PROX 81179, the shifting appeared to be particularly severe in the head area. Although the performance requirements for thermal protection systems require tank cars to withstand a pool fire for 100 minutes and a torch fire for 30 minutes, when thermal insulation shifts, relatively large areas of the tank can be left without protection, and the thermal resistance of any such car in a fire situation will be degraded.

At present, tank cars are subject to a re-qualification inspection which includes the thermal protection; however, the standards do not contain requirements on methods of inspection, nor the relationship between thermal protection degradation, such as shifts or voids in the insulation, and the actual thermal resistance of the cars. Where fire is present, there is a risk to the public that hazardous products may be prematurely released to the atmosphere in the time-critical initial stages of an emergency response, before proper isolation and evacuation procedures can be implemented. Therefore, the Board recommends that:

4.3 Safety Concern

4.3.1 Preparedness and Human Resource Management of Emergency Response Personnel

Even well-trained emergency first responders in small communities may have a much lower level of emergency preparedness due to their lower exposure rate to accidents involving dangerous goods relative to emergency first responders at large centres. For instance, the Ontario Provincial Police officer who was exposed to unknown concentrations of dangerous goods was not equipped to work in conditions involving large releases of multiple dangerous goods, and his fellow officers were unable to determine his specific location after they knew that he was experiencing adverse health effects. Some volunteer fire-fighters had little knowledge of dangerous goods or of the hazards they were confronting, and others did not have protective footwear or other basic protective equipment. They worked at the site for nearly 40 hours without sufficient rest or proper meals.

The Board is concerned that emergency response personnel in small communities may not be provided with the necessary tools, protective equipment, and training to be fully aware of and prepared for the risks associated with the dangerous goods being transported through their communities, nor provided with adequate human resource management to allow them to perform their oftentimes hazardous duties safely.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 09 April 2002.

Appendix A— Schematics of Major Fracture Locations on Tank Car PROX 81552

Appendix B— Evaluation of Thermal Protection Systems on PROX Tank Cars

Appendix C— List of Supporting Reports

The following TSB Engineering Laboratory report was completed:

• LP 112/99—Britt Derailment and BLEVE
       PROX 81552
       CN Bala Subdivision Mileage 202.98
       23 September 1999

This report is available upon request from the Transportation Safety Board of Canada.

Appendix D —Toxicity of Anhydrous Ammonia

The Agency for Toxic Substances and Disease Registry of the U.S. Department of Health and Human Services carried out a joint study of accidental releases of ammonia in the United States with participation of 14 state health departments. The detailed study covers the one-year period between 01 January and 31 December 1995. The data shown below were collected for the 14 participating states and, during that time period, there were 355 reported events of accidental ammonia releases, causing 4 deaths and 2 825 injuries. All four deaths were the result of one event and the victims were emergency responders. According to the study:

Ammonia releases were 1.85 times more likely to result in events with victims than all other [hazardous substances] releases (95 per cent confidence interval:1.31 - 2.61). The victims of ammonia releases were most frequently employees (63 per cent) and members of the general public (24 per cent). Thirteen per cent of victims were responders. Most victims were male (73 per cent). The mean age, known for 79 per cent, was 33 years (range 6 to 60 years).

The quantity of released ammonia was known in 89 per cent of the cases and ranged from 1 pound to more than 99 000 pounds, with a median of 200 pounds. Out of the 2 825 injuries, 493 were from transportation events, and 2 332 were from fixed facilities. The breakdown of the injuries was as follows:

• Respiratory irritation - 41 per cent
• Eye irritation - 21 per cent
• Nausea or vomiting - 9 per cent
• Chemical burns - 9 per cent
• Thermal burns - 5 per cent
• Trauma - 4 per cent
• Headache - 4 per cent
• Skin irritation - 3 per cent
• Dizziness / central nervous system symptoms - 2 per cent

There were 63 cases of trauma noted in transportation events, but only 19 cases of trauma were associated with fixed facilities.

According to the report, 74 per cent of the victims were transported to hospital for treatment but did not have to be admitted, 4 per cent of the victims were admitted to hospital and 10 per cent of the victims were treated at the scene. The report also points out that

. . . ammonia releases were nearly three times as likely to have resulted in evacuations as all other single chemical category releases (OR = 2.85; 95 per cent CI [confidence interval]: 2.17 - 3.74).

In the more recent one-year time period (28 September 1999 to 28 September 2000), the U.S. Chemical Safety and Hazard Investigation Board database contains 25 accidents involving ammonia, which caused 5 fatalities, 246 injuries and 6 evacuations involving 1 496 people. (The database contains data from the U.S. as well as from other countries, and is built mainly on the reports from press and news agencies.)

Apart from the above reports, there are a number of commonly used international references which point out the toxicity of anhydrous ammonia. Many of these references also show how ammonia is classified in other jurisdictions. For the sake of brevity, here are five such references representing more than several hundreds available:

1. RECOMMENDATIONS ON THE TRANSPORT OF DANGEROUS GOODS - MODEL REGULATIONS, United Nations, New York and Geneva, 1999.
2. EXTREMELY HAZARDOUS SUBSTANCES, Volume 1, A - L, Noyes Data Corporation, 1988.
3. HAZARDOUS CHEMICALS DESK REFERENCE, R. J. Lewis, Sr.,Van Nostrand Reinhold, New York, 1991.
4. NEUROTOXICITY GUIDEBOOK, R. M. Singer, Van Nostrand Reinhold, New York, 1990.
5. SAFE STORAGE AND HANDLING OF HIGH TOXIC HAZARD MATERIALS, Arthur D. Little, Inc and R. LeVine for American Institute of Chemical Engineers.

A well-documented example in Canada was a railway incident near Sainte-Rosalie, Quebec, on 24 May 1986 where about 1 100 people were evacuated as a result of a tank car intermittently leaking a relatively small amount of ammonia from the safety valve. The tank car was located about 1 km from the community. This leak also resulted in closure of the Trans-Canada Highway for several hours.

Appendix E— Glossary

AAR

Association of American Railroads

ASTM

American Society for Testing and Materials

BLEVE

Boiling Liquid Expanding Vapour Explosion

Btu/h

British thermal unit per hour

C

Celsius

CFM

cubic feet per minute

CGSB

Canadian General Standards Board

CI

confidence interval

cm

centimetre

CN

Canadian National

CPR

Canadian Pacific Railway

CTC

Canadian Transport Commission

CWR

continuous welded rail

DOT

Department of Transport

EDT

eastern daylight time

ELS

Equivalent Level of Safety

ER

emergency response

ERAP

Emergency Response Assistance Plan

F

Fahrenheit

ft²

square feet

GPS

global positioning system

kJ/h

kilojoule per hour

km

kilometre

kPa

kilopascal

L

litre

LPG

liquefied petroleum gas

m

metre

m²

square metre

mg/L

milligram per litre

min

minute

mm

millimetre

MOE

Ministry of the Environment

mph

mile per hour

NAERG

North American Emergency Response Guidebook

OPP

Ontario Provincial Police

par.

paragraph

ppm

parts per million

PRV

pressure relief valve

psi

pound per square inch

psia

pound per square inch absolute

psig

pound per square inch gauge

PWQO

Provincial Water Quality Objectives

RTC

rail traffic controller

SPC

Standard Practice Circular

STCC

Standard Transportation Commodity Code

TC

Transport Canada

TSB

Transportation Safety Board of Canada

TSR

Railway Track Safety Rules

UMLER

Universal Machine Language Equipment Register

U.S.

United States

UTC

Coordinated Universal Time

°

degree

'

feet

"

inch

§

section