Railway Investigation Report R00H0004

At approximately 0355 eastern daylight time on 20 June 2000, Ottawa Valley Railway train 556-17, proceeding eastward on the North Bay Subdivision, derailed 2 passenger cars and 11 freight cars at Mile 1.88 near Chalk River, Ontario. There were no injuries, and there were no dangerous goods released in the derailment.

Ce rapport est également disponible en français.

1.1 The occurrence

On 19 June 2000, at 1745 eastern daylight time (EDT)^{Footnote 1}, train 556-17 (the train) was received by the Ottawa Valley Railway (OVR)^{Footnote 2} from Canadian Pacific Railway (CPR) at Cartier, Ontario. The train was destined to travel eastward on the CPR Cartier Subdivision to Coniston, Ontario, where the OVR begins, and over the OVR North Bay and Chalk River subdivisions to Smiths Falls, Ontario, where the train was to be returned to CPR.

At 0354, on 20 June 2000, near Mile 1.7 of the North Bay Subdivision, a train-initiated undesired emergency brake application (UDE) occurred. After conducting the necessary emergency procedures, the train crew determined that 13 cars had derailed, including 2 unoccupied passenger cars and 11 freight cars. The cars were positioned 8^th to 20^th behind the locomotives. The two passenger cars remained upright and coupled to the front portion of the train. They came to rest approximately 68 m east of the other 11 derailed cars. The remaining derailed cars came to rest either on their sides or upright, and were jack knifed on the right-of-way. No dangerous goods were involved in the derailment. Two of the cars, loaded with lumber, came to rest on their sides over a TransCanada PipeLines Limited (TCPL) natural gas underground pipeline crossing. The train crew members had not noticed any unusual track conditions as they approached the derailment area.

1.2 Damage

Eleven freight cars were extensively damaged and two passenger cars were slightly damaged. Approximately 600 feet of track was destroyed. There was no damage to the pipelines.

1.3 Personnel information

The train crew members, consisting of a locomotive engineer and a conductor, were positioned in the lead locomotive. They were qualified for their respective positions and met regulatory requirements respecting mandatory time off duty and maximum hours of service.

1.4 Method of rrain control

Train movements on the North Bay Subdivision are controlled by the Occupancy Control System (OCS) method of train control, authorized by the Canadian Rail Operating Rules and supervised by a rail traffic controller (RTC) located in North Bay, Ontario. The OCS on the North Bay Subdivision is complemented by an Automatic Block Signal System (ABS). The OVR uses CPR's General Operating Instructions (GOI) when operating CPR trains.

1.5 Train information

The general freight train, consisting of 69 loaded cars and 12 empty cars, was approximately 5500 feet long and weighed about 9120 tons. It was powered by four 3000-horsepower locomotives. There were 2 loaded tank cars of special dangerous goods, and 8 other loaded cars of dangerous goods in the train.

1.6 Train operation eastward from Winnipeg

The train originated in Winnipeg, Manitoba, destined to Montréal, Quebec. The railway train service schedule^{Footnote 3} requires that a certified car inspection (CCI), including verification of the train air brake system, be conducted at Winnipeg. This verification is given to the train crew on a form known as Schedule "A". There was no other CCI prescribed for this train in the schedule.

The train proceeded eastward over the CPR Keewatin, Ignace and Kaministiqua subdivisions to Thunder Bay, Ontario, the next major railway terminal staffed with CCI and repair personnel. The CPR rail traffic control centre, in Calgary, Alberta, documented the train as first experiencing a UDE or "kicker"^{Footnote 4} on the Ignace Subdivision, approximately 900 miles before the derailment occurred. This information was recorded on the crew-to-crew form.

At Thunder Bay, cars were added to and removed from the train. Both the train crew and locomotive consist were changed. The Thunder Bay Mechanical Facility, Diesel and Car Daily Report documented the train as a "run-through" and it was not inspected by the Car Department. The cause of the previous UDE was not identified at Thunder Bay.

The train continued eastward over the CPR Nipigon, Heron Bay and White River subdivisions to Chapleau, Ontario, another railway terminal with CCI and repair personnel. The UDE problem was also not addressed at this terminal.

The train continued eastward from Chapleau over the CPR Nemegos Subdivision to Cartier where it was taken over by an OVR train crew.

When the train arrived at Cartier, the OVR crew members were advised by the incoming CPR crew members that they had experienced UDEs when arriving at Cartier and when stopping at Cartier Station, approximately one mile later. The OVR crew experienced a UDE when stopping at North Bay to change crews. At terminal crew change locations, the requirements of the No. 2 brake test would have been per Section 13, 8.0 No 2 Brake Test, of the GOI in effect at the time which, in part, prescribed: "Note: At a location where the locomotive engineer has been changed and the train consist does not change, it is acceptable for the inbound locomotive engineer to apply the train brakes and for the outbound locomotive engineer to release the train brakes." It was common practice to accept an undesired emergency application of the train brakes and subsequent release, to comply with this operating instruction. The outgoing crew members at North Bay were advised, both verbally and in writing on the crew-to-crew form, that crews had experienced a UDE every time the train service brake was used. The train was operated eastward from North Bay, with the locomotive engineer avoiding the use of the automatic air brakes and controlling the train speed using throttle modulation^{Footnote 5} and locomotive dynamic braking.^{Footnote 6}

While descending a 0.49 per cent grade at about 19 mph, with dynamic braking applied to control speed, the train experienced a UDE. The crew recalled feeling a tug back and surge immediately subsequent to the UDE. Computer simulations, using data from the locomotive event recorder (LER) and the subdivision track profile, indicated that significantly high in-train buff (compressive) forces would have developed throughout the train when the UDE occurred.

1.7 Traffic agreement

The OVR operates under a 20-year leasing agreement with CPR. CPR pays a contracted sum to OVR for handling the CPR trains between Cartier and Smiths Falls. The Ottawa Valley Railway was responsible for the track maintenance. The train service schedule for CPR trains travelling over the OVR is similar to that which existed before the creation of the OVR, with no designated inspection locations.

1.8 Recorded information

The Railway Locomotive Inspection and Safety Rules (TSR), approved by Transport Canada (TC), prescribe that:

• 12. EVENT RECORDERS
• 12.1 Controlling locomotives other than in designated and/or yard service, shall be equipped with an event recorder meeting the following design criteria:
  1. the event recorder shall record the time, the speed, the brake pipe pressure, the throttle position, the emergency brake application, the independent brake cylinder pressure, the horn signal and Reset Safety Control function;
  2. the event recorder shall retain a minimum of five minutes of data preceding a collision or derailment;
  3. the event recorder shall have suitable means to transfer the stored data to an external device for processing and analysis.

The OVR extracted the LER information from the lead locomotive, CP6053, on the morning of the occurrence. An early version of event recorder software, designed to meet the aforementioned basic requirements, was used. The basic parameters and a distance travelled reading, to enable location calculations, were downloaded. More detailed LER information was obtained by CPR on the evening of the occurrence, using a more modern version of software. In addition to the information downloaded by the early version software, the modern software extracted and displayed indications, including dynamic braking current, dynamic braking control position, rear end-of-train air brake pressure, acceleration, and low-pressure alarm from the end-of-train unit. This information was provided to the TSB, and subsequently used to analyse the events preceding the derailment (TSB Engineering Laboratory report LP 112/00).

Information from the LER on the lead locomotive indicated that, at 0344:56.1, the train was travelling at 25 mph. The throttle was placed into idle at 0345:02.1, and at 0345:05.3, about three seconds later, the locomotives were placed into dynamic braking. At 0345:08.3, the dynamic braking controller was advanced to position No. 6. At 0345:24.5, full dynamic brake was applied. Reductions in brake pipe pressure (bpp) recorded in the locomotive and at the sense and braking unit at the rear of the train, indicate that a train-initiated emergency brake application occurred. The reduction in bpp was first sensed at the front of the train at a recorded time of 0345:50.3 and at the rear at a recorded time of 0345:55.2, a difference of 4.9 seconds. Between 0345:52.2 and 0345:55.2 (3 seconds), the train decelerated approximately 3 mph, and then rapidly decelerated from 14 mph to 0 mph at 0346:19.

1.9 Occurrence site information

The train derailment area (see Figure 1) extended for approximately 850 feet. The two passenger cars, 8th and 9th behind the locomotive, were derailed in an upright position. The 10^th, 11^th and 12^th cars, flat cars loaded with packaged lumber, were coupled together and lying on their sides to the south of the track. The 14^th, 15^th and 16^th cars, centre beam flat cars loaded with lumber, and the 17^th car, an empty hopper car, were upright and jack knifed on the right-of-way. The 18^th, 19^th and 20^th cars, also flat cars loaded with packaged lumber, were lying on their sides to the north of the track. The 13^th car, an open top gondola car loaded with used railway ties, although upright, had the leading end of the car torn away. Two TCPL natural gas pipelines cross about 2 m underneath the railway where the 19^th and 20^th cars were lying on their sides. The top corners of the cars had penetrated the ground surface to an approximate depth of 75 cm.

The rails, crossties and roadbed at Mile 1.78 were substantially displaced both longitudinally and laterally. Wheel flange marks on the web of the rail indicated that the rail had rolled over and that loss of track gauge had occurred.

1.10 General operating instructions

CPR's GOI, Section 5, Item 15.0, prescribes the requirements for train inspection after a UDE (see Appendix A). There were no instructions on handling a train prone to UDEs and no instructions detailing how to eliminate a UDE condition.CPR's GOI, Section 16, Item 6.0, contains information on emergency and penalty brake applications indicating in part:

• 6.1 . . . Emergency valves are to be used only in cases of emergency. . . .
• 6.2 An EMERGENCY BRAKE APPLICATION must not be made unless it is necessary. . . .
• 6.4 In the event of a PENALTY or EMERGENCY BRAKE APPLICATION while moving, the locomotive engineer must, until the movement stops, regulate locomotive brake cylinder pressure to obtain the shortest possible stop required by the situation. Care and good judgement must be exercised to avoid locomotive wheel slide and severe in-train forces.

CPR's GOI, Section 16, Item 7.0, contains information on dynamic braking. The procedure governing the change from motoring (pulling) to dynamic braking is prescribed as follows:

• 7.2 When changing from motoring to dynamic braking when the train is in motion, pause for ten seconds with the throttle in IDLE.
• 7.3 When moving into the braking zone, pause at the minimum braking position long enough to adjust train slack, then move the handle slowly within the braking zone to obtain the desired braking effect.

1.11 Controlling an undesired emergency brake application (UDE) problematic train

During dynamic braking, retarding force is applied by the locomotives only, and buff (compressive) forces, proportional to the momentum of the rest of the train, increasingly oppose this retarding force as the train slack runs in.

The locomotive dynamic braking system is considered by CPR to be the preferred choice of retardation when slowing or stopping a train on any type of grade because it is very fuel efficient. However, the train air brakes are considered to be the primary braking system on all trains, regardless of grade. Under normal operating conditions, i.e. where the train is not prone to UDEs, the dynamic brake can be supplemented by the air brake system. This course is usually taken when dynamic brake force is insufficient to control train speed or when dynamic brake forces diminish at speeds above or below the speed at which optimum dynamic brake force is available.

The air brake system is designed to slow and/or stop a train using applications of the air brakes on the locomotives and cars throughout a train. Proper use of an operative air brake system usually results in a more even distribution of retarding force throughout the length of a train.

Common practice for a locomotive engineer to control the speed of a UDE problematic train is to avoid using the air brakes, unless absolutely necessary. Locomotive engineers will use a combination of throttle modulation, locomotive dynamic brakes and the locomotive independent brake.

1.12 Particulars of the track

The OVR North Bay Subdivision extends from North Bay, Mile 117.3, to Chalk River, Mile 0.0. The track from Mile 19.0 to Mile 0.0 was classified as Class 3 single track, with a maximum allowable speed of 40 mph. The permissible track speed, as prescribed in the OVR Time Table Subdivision Footnotes, was reduced to 30 mph. This reduction in track speed was implemented due to the track condition. On 20 June 2000, there was a 15 mph slow order in effect between Mile 0.0 and Mile 0.5 due to the crosstie condition. The tangent track in the derailment area consisted of various lengths of 100-pound rail, manufactured by Algoma Steel in 1939, joined by six-hole joint bars and laid on single-shouldered tie plates fastened to softwood ties with three spikes per tie plate and anchored every third tie. The crushed slag ballast contained fine granular materials with indications of pumping^{Footnote 7} at the rail joints. The track surface was irregular with low rail joints throughout.

Random sampling between Mile 0.5 and Mile 3.0 indicated that there were numerous rail joints with defective ties not meeting TC's TSR requirement for Class 3 track. The ties were split, severely plate cut and/or excessively adzed, and the spikes were loose with little or no restraining strength on many ties. In a survey of 500 feet of track immediately west of the derailment, the gauge side shoulder of 52 tie plates was broken.

The track was last inspected by an assistant track supervisor on the preceding day, 19 June 2000. No track safety deficiencies or defective tie conditions were noted in the vicinity of the derailment.

A rail flaw detection car tested the integrity of the rail on 05 May 2000. No defects were found in the derailment area during this test. The track geometry car last measured the track in this area on 08 November 1999, with no defects identified at the derailment location. Track geometry measurements, obtained from a post-derailment field survey of the track immediately preceding the derailment area, showed that surface, line and gauge were within the tolerances specified in the TSR. However, the elevation changed significantly at several consecutive rail joints immediately west of the derailment area; this would have contributed to car rocking and the resultant random lateral load oscillation from the north rail to the south rail.

1.12.1 Transport Canada's (TC) Railway Track Safety Rules (TSR)

TC's TSR require that each 39-foot segment of track shall have a sufficient number of crossties which in combination provide effective support that will:

• hold gauge within the prescribed limits;
• maintain surface within the prescribed limits;
• maintain alignment within the prescribed limits.

Each 39-foot segment of Class 3 track shall have a minimum of 10 non-defective crossties to be effectively distributed to support the entire 39-foot segment of track. Class 3 track shall have one crosstie whose centreline is within 18 inches of the rail joint location.

The characteristics of safe, non-defective crossties, as described by the TSR, must not be:

• broken through;
• split or otherwise impaired to the extent that the crossties will not hold spikes or rail fasteners;
• so deteriorated that the tie plate or base of rail can move laterally more than ½ inch relative to the crossties; or
• cut by the tie plate through more than 40 per cent of a tie's thickness.

1.13 Emergency response

After the derailment, the train conductor inspected the train looking for broken couplers, knuckles or separated air hoses between rail cars. After observing that cars were derailed, he advised the locomotive engineer to contact the RTC. The RTC initiated an emergency response notification at 0410. The RTC was not aware that the TCPL pipeline crossing was at this location. Neither the pipeline company nor the National Energy Board (the regulator for the pipeline industry) were notified of the occurrence. The conductor was unaware that there were two natural gas pipelines, measuring 36 and 40 inches in diameter, spaced approximately 30 feet (10 m) apart, crossing directly underneath the derailed train.

The conductor, assisted by the conductor of a westward train at Chalk River, who had become aware of the emergency stop and offered assistance, physically inspected the derailment site and informed the RTC of the extent of the derailment, but, despite the posted pipeline signage, did not note the presence of the pipelines. Railway engineering and operating supervisors who responded to the site and subsequently became aware of the presence of the pipelines were not aware of the potential hazards presented by the pipelines.

At approximately 0800, a TCPL employee travelling along an adjacent roadway noticed the derailment and, concerned that there might be possible damage to the high-pressure natural gas pipelines (in excess of 850 pounds per square inch [psi]), he immediately initiated the TCPL emergency response process. As a precautionary measure, the operating pressures of the pipelines were reduced during the removal of the railcars. TCPL personnel continuously monitored the area to check for leaking natural gas. The adjacent roadway was blocked off, and security guards were posted to restrict access to the area. The pipeline company performed an engineering analysis to determine the impact loads and identify potential areas for excavation and visual inspection for damage if required. After the analysis, the rail cars were removed from the crossing and one pipeline was excavated to check for possible damage. The excavation revealed that the encased pipeline was buried approximately 2 m down and had not been damaged by the forces of the derailment.

1.14 Information for train crews

Train crews receive information on their operating environment from a number of sources (i.e., clearances, operating manuals, GOI, Time Tables, General Bulletin Orders and bulletin books). Information from these sources prescribes the method of operation and provides necessary details for safe train operation. The location of restrictions to train operations, such as slow orders, special train handling requirements, operating clearances and/or hazards, is normally detailed in these sources of information. However, as is standard practice on Canadian railways, information on the location of below-ground pipeline crossings is not provided to train crews.

Train crews receive information about the train which they are operating from a computer-generated train consist list. The train consist list normally contains information, such as the shipper and consignee of a shipment, shipment routing, car and train lengths and weights, and any special information pertaining to each car, including movement restrictions or special handling features of the equipment. The railway obtains up-to-date information on rail cars registered for travel on the North American railway system from the Universal Machine Language Equipment Register (UMLER) database, maintained by the Association of American Railroads (AAR)^{Footnote 8}. The two passenger cars involved in this derailment were not registered on the UMLER and no movement restrictions appeared on the consist list automatically generated for those cars.

Traditionally, passenger equipment moving in a freight train is marshalled next to the rear of the train. The decision was made to marshal the cars at the 8^th and 9^th position behind the locomotives between Calgary and Montréal, and this authorization was included in the train consist list. The consist list for the train contained a number of errors and omissions with respect to these cars; i.e., the list indicated the presence of one passenger coach instead of two, the car weight was indicated to be 30 tons when the actual weight was 56 tons, no car length was shown for either car, and there was no notification that there were two hand brakes for each passenger coach. The incomplete information on the passenger cars was not computer-generated from the UMLER, but was manually entered in the train consist list. In the absence of computer-generated information on special shipments, it is common practice to have the information in an accompanying written instruction; however, there was none on this movement. Each derailed car and the commodities involved were determined from information contained in the train consist list. The location of the closest dangerous good car was incorrectly recorded as the 24^th car behind the locomotives, when it was actually the 25^th car.

1.15 Underground Pipeline Crossings

Construction standards and safety requirements for a pipeline crossing under the railway are contained in Canadian Standards Association (CSA) standard CSA Z662-99. Transport Canada introduced its latest version of the Pipeline Crossing Standards incorporating Standard Z662-99, by reference, but with some modifications, in May 2001. The depths were increased from 1.2 m and 2.0 m, at the time of pipeline construction, to 1.68 m and 3.05 m, for cased and uncased, respectively, oil, gas and hazardous gas pipelines. The pipelines met TC standards for minimum cover of cased and uncased pipes below the base of the rail, (1.68 m and 3.05 m respectively).

In addition to requirements for clearances, the standard prescribes that signs, 255 mm by 305 mm, be posted at railway rights-of-way and that the signs prominently display the word "Warning", "Caution", or "Danger" in 25 mm high bold lettering, along with "High-Pressure Natural Gas Pipeline" in 13 mm high bold lettering. There were two warning signs posted for the rail crossing and two warning signs posted for the adjacent roadway crossing. Since the adjacent roadway was in close proximity to the railway, one of the roadway warning signs was clearly visible at the accident site, along with the warning signs posted for the rail crossing.

1.16 Equipment

1.16.1 Single car testing

As a minimum requirement, the periodic testing of individual car air brakes is performed, by qualified railway Mechanical Department personnel, at a maximum of 96 months from the date built for new cars and at a maximum of 60 months for all other freight cars, as per Rule 3 of the Field Manual of the AAR Interchange Rules. The testing is performed as prescribed by the AAR Manual of Standards and Recommended Practices, Standard S-486-99, "CODE OF AIR BRAKE TESTS FOR FREIGHT EQUIPMENT", at a slightly higher air pressure (90 psi) than that of a normal train operation (CP GOI Section 13, Item 4.1 brake pipe pressure for freight service is 85 psi)^{Footnote 9}. After a single car test has been performed on a repair track, and a car is placed in general railway operation, the testing of train air brakes is prescribed by the operator's train service schedule. When air brake valves are manufactured or re-manufactured, they are tested at 110 psi on the AB rack, in accordance with AAR MSRP Standard S-466-91, to verify operational integrity, however, they are only tested at 90 psi thereafter in accordance with AAR S-486.

1.16.2 Regulatory requirements

Operating requirements applicable to the braking system of freight trains are prescribed in the Railway Freight and Passenger Train Brake Rules, which were approved by TC. These rules state, in part:

• 7.2 No freight train shall be operated with less than 85 per cent of the train brakes operative, except as provided in section 8.4.
• 3.12 "operative" means a brake that applies and releases and is in a suitable condition to retard and/or stop equipment;
• 21.1 All brake equipment shall be maintained in a safe and serviceable condition.
  1. car brakes shall be maintained according to AAR requirements and railway company procedures.

With reference to item 3.12, the requirements of an operative brake are explained in the publication entitled Modern Freight Car Air Brakes,^{Footnote 10} which indicates, in part, that:

• 8) The air brake must properly release from the service application.

However, as was indicated in the response to Rail Safety Advisory 02/00 (see section 4.1.4), TC does not consider it necessary for air brakes to properly release from a service brake application in order for them to be considered "operative".

The requirements of item 21.1 are prescribed in CPR's company procedures, as CCI and yard repair are performed in accordance with CPR's Freight Car Inspection handbook. The handbook, like the AAR requirements,^{Footnote 11} prescribes that any component of the air brake system which is broken or missing must be repaired before being released.

1.16.3 Train marshalling

At the originating station, freight trains are generally marshalled with concern for a number of factors (e.g., destination of shipments, weight distribution of individual cars and blocks of cars, dangerous goods regulations, multiple platform and non-standard car placement, and air brake requirements).

The marshalling of freight trains plays a critical role in enabling locomotive engineers to minimize slack action and in-train forces, particularly when ascending and descending grades and traversing undulating territory. The general rule is to marshal heavy cars near the front of the train and lighter cars towards the rear of the train. Longitudinal train forces can result in lateral track loading that may be significant, depending on the degree of curvature, type and length of coupled cars and track surface irregularities. Although marshalling for optimum weight distribution is preferable from a safety perspective, the desire for operational efficiency often results in other marshalling practices (e.g., marshalling based upon the destination of cars or blocks of cars).

Considerable study to identify the distinct problems that can arise from in-train forces due to undesirable train marshalling has been done by the AAR Research and Test Department, and documented in the AAR Train Makeup Manual, Report No. R-802,^{Footnote 12} which states, in part:

• 4.1.1 Train Separation: Excessively high draft forces^{Footnote 13} may exceed the strength of the materials used in the draft systems of cars, resulting in mechanical failure and subsequent train separation.
• 4.1.2 Stringlining: Draft forces tend to stretch a train into a straight line; hence the term "stringlining". Large lateral loads are transmitted to the track under these conditions. Cars with a high centre of gravity that are empty or lightly loaded may turn over.
• 4.1.3 Jackknifing: The opposite situation from section 4.1.2 (stringlining) occurs when the forces acting on a car are in the buff direction. Adjacent car bodies attempt to fold up similar to a jackknife when they are in this condition. Coupler angles create a lateral force similar to, but opposite in direction from, the stringlining case. The vehicle usually does not turn over but instead a wheel is induced to climb the rail or one rail will turn over. A jackknifing derailment is usually accompanied by couplers which are angled within the car striker to their coupler angling limit.
• 6.3 Cars With Increased Lateral Truck Clearances: Some cars are equipped with special trucks that allow larger lateral displacements of the truck bolster than are normally found in a standard three piece truck. These cars include some cabooses and single axle cars. This design improves the ride quality ofthe vehicle. These trucks can allow much larger coupler angles to develop in buff due to the increased car body angles allowed by these trucks. This makes the jackknifing situation much worse than the typical long car-short car case. It is recommended that cars equipped with this type of truck be entrained towards the rear. Also, cars so equipped should not be shoved against. . . .

CPR's GOI are generally silent about train marshalling of passenger equipment, such as the 8^th and 9^th cars on the train, which have trucks with increased lateral clearances. In the past, when CPR hauled passenger cars in freight trains more frequently, there were instructions which prescribed that they be placed at the rear of the train.

1.16.4 Passenger car components

Passenger cars involved in the derailment typically have trucks with much greater lateral freedom between the car body and the axles, as compared to standard freight cars. The purpose of this feature is to improve the ride quality of the car over track geometry irregularities. As a result of this increased mobility, much larger coupler angles can develop in buff. These cars also have a separate tread brake unit to apply each brake shoe against each of the eight wheels on .the car. There are hand brakes at each end of the car, which will each apply brake shoes against two wheels. Both the air brakes and the hand brake use a similar tread brake unit designated as a Wabco GB5.

It was noted that the R-4 brake shoe of car AMT922 was loosely applied against the wheel and was almost completely burnt away, leaving the brake head assembly discoloured from overheating. The other brake shoes of the cars were in relatively new condition. The R-4 Wabco GB5 tread brake unit was removed in its entirety for examination and analysis by the TSB Engineering Laboratory (report LP 100/00). Analysis revealed that the tread brake unit was operating as intended, and that the application of the brake shoe was the result of the hand brake being partially applied. Air brake testing performed on both passenger cars after the accident indicated that the brake systems were functioning as intended.

1.16.5 Freight car components

Freight car air brake control valves consist of two portion—sservice and emergency—both of which are attached to a pipe bracket, a universal mounting receptacle for AAR-approved air brake valves. The service valve portion primarily reacts to controlled changes in air bpp initiated by the locomotive engineer. The emergency valve portion primarily reacts to sudden reductions in air bpp, to propagate an emergency application of the air brakes, which may be either unintentional or crew-initiated.

The 10^th car, a centre beam flat car loaded with lumber, SRY 73013, was equipped with a type ABDX-L brake control valve, which was originally installed on the car for test purposes. The brake valve portions were obtained for examination and analysis by the TSB Engineering Laboratory (report LP 129/00). The ABDX-L valve portions were tested on an AAR-approved "AB" test rack at a certified air brake shop. The service valve portion passed all tests and was not disassembled for inspection.

The emergency valve portion failed the test due to internal leakage. The emergency valve portion was disassembled for analysis, which revealed that the slide valve, an internal component which directs the flow of air inside the valve, had an undefined deposit on its face. It is probable that this deposit caused the slide valve to lift off the valve seat, allowing for leakage detected on the "AB" test rack. This car was equipped with standard three-piece ride control freight car trucks which have minimal lateral play. The trucks were examined on site, and other than apparent derailment damage, no deficiencies were noted.

The 11^th car, a centre beam flat car loaded with lumber, SRY 873090, was equipped with an air brake control valve that was comprised of a type DB-10 service valve portion and a type ABDW emergency valve portion. The service portion was damaged beyond serviceability in the derailment, which precluded testing. Post-recovery examination of the service portion revealed that there were no internal defects. The valve had been installed as a reconditioned valve in March 2000. The car passed the single car test requirements at that time. The TSB Engineering Laboratory had the ABDW emergency portion of this valve tested on an AAR-approved AB test rack at a certified air brake shop (report LP 028/01). In addition to having severe leakage problems, the emergency portion failed several requirements of the AAR-prescribed AB rack testing, including having repetitive UDEs. The diaphragm, which seals the emergency piston in its operating chamber, was ruptured approximately one inch (see Figure 2). This rupture negated the buffering effect that the diaphragm is designed to have on minor pressure fluctuations and resulted in repeated UDEs.

The TSB Engineering Laboratory enlisted the services of the Quality Engineering Test Establishment (QETE) to undertake an investigation into the failure of the rubber diaphragm. The TSB supplied the emergency valve portion from this car, as well as three "in-service" emergency valve portions from sister cars, supplied by the car owner. A new diaphragm was also obtained from the air brake manufacturer for comparison purposes. The QETE report (TSB file No. LP 114/01) indicates that the diaphragms were made of neoprene rubber (polychloroprene). Neoprene rubber has a recommended shelf life of 5 to 10 years, during which the product is expected to retain its characteristics as originally specified or within allowable tolerances. The AAR Rules prescribe that newly installed diaphragms are to be within their diaphragm's shelf life to ensure the designed strengths exist when the valves are installed on rail cars. The service life is determined by the long-term effect of factors, such as applied stresses (static and dynamic) and environmental conditions, on the physical properties of the product; i.e., reduction in tensile strength, compression set, increase in hardness, reduction in flexibility, cracking/crazing, etc. When one or several of these physical properties deteriorate below a minimum accepted level, the article is considered as having reached the end of its service life.

QETE determined that all of the "in-service" diaphragms that were analyzed were permanently deformed in either a crimped or inverted position, reducing their buffering capability and making the valves prone to UDEs. In addition, there were a significant number of creases and cracks which could also lead to failure. Analysis of the diaphragm from the 11^th car determined that the tear followed a crease in the rubber coating that resulted from long-term compressive strain on the inside surface of the curve in this area. This resulted in cold flow of the rubber, and a reduction in the effective thickness at this location, predisposing the diaphragm to failure.

The service life, as opposed to shelf life, of the rubber diaphragms used in air brake valves has not been regarded as problematic and AAR rules, which once prescribed periodic renewal, have been discontinued. Current AAR requirements permit air brake control valves to remain in service until failure or for the life of a rail car—typically about 40 years. The actual service history of each of the diaphragms analysed could not be determined.

The 12^th car, SRY 73030, equipped with an ABDX-L air brake control valve, had its valve destroyed in the derailment.

The 13^th car, CP 343888, was equipped with a type AB air brake control valve, which had been reconditioned and installed on the car in 1991. The valve had received shop track air brake tests nine times between 1991 and the day of the derailment. It was obtained for analysis by the TSB Engineering Laboratory (report LP 090/00). The TSB analysis revealed that the vent protector, a metal casting assembled with a rubber flap designed to seal the vent hole in the emergency brake valve portion when not exhausting, was broken away from the valve. The part of the vent protector which had been broken off inside the valve was heavily rusted. The interior of the emergency portion of the brake valve was found to be contaminated by caked dust. There was also loose sand inside the valve at the vent protector opening. The valve was forwarded to the manufacturer for examination. The manufacturer concluded that, due to contamination, the emergency valve portion would have had defective operating characteristics. The AB valve, approved for railway use in 1933, is recognized by the railway industry as obsolete equipment which is prohibited^{Footnote 14} from being replaced in kind upon failure or removal from a car for any reason.

1.16.6 Service and emergency air brakes

During service brake applications, air is released from the brake pipe^{Footnote 15} at the front of a train, at a controlled rate. Air brake control valves sense the decrease in bpp at each successive car and cause stored air from each car's auxiliary reservoir to enter the car's brake cylinder(s). At the brake cylinder(s), a piston is forced out, moving a series of rods and levers that ultimately apply the brake shoes against the wheels of the car. A full service brake application will result in the full available volume of the auxiliary reservoir being applied to the car's brake cylinders. In an emergency brake application, control valves, sensing a more rapid reduction in bpp, allow the combined volumes of two reservoirs—the emergency and auxiliary—to be applied against brake cylinder(s) as quickly as possible. This results in a more rapid application of the brakes and with greater force, approximately 17 per cent higher than from a full-service brake application. When an emergency brake application occurs, the resulting in-train forces are considerably higher than those which occur during normal service brake application.

1.17 UDE research

During the 1980s, the AAR Research and Test Department, in cooperation with CPR, the Burlington Northern Santa Fe and the Chicago and North Western, performed extensive in-service testing on revenue trains, and suspect brake control valves were identified as UDE problematic. The AAR produced Report No. R-756^{Footnote 16} in August 1990, after over five years of concerted effort. The report, in part, documents how short-duration bpp reductions cause UDEs. Although most UDEs occurred subsequent to a service brake application, the report also concluded that slack action (draft and buff forces), accompanying or in the absence of a service brake application, may cause short-duration bpp reductions, leading to UDEs. The report included the following recommendations:

• reduce slack action in train operations which are prone to UDEs;
• slightly desensitize air brake control valves towards bpp fluctuations;
• on new cars, install control valves which have been designed to withstand bpp fluctuations.

In-train testing of brake control valves suspected of triggering UDEs was conducted by the AAR and is described in AAR Report No. R-761.^{Footnote 17} During this testing, it was demonstrated that severe slack action alone can produce sharp bpp reductions of up to 2 psi. Laboratory work also showed that control valves could respond to slack-induced bpp reductions and initiate a UDE.

1.18 Train dynamics analysis

The TSB Engineering Laboratory conducted an analysis of the derailment, including calculating in-train buff forces, based on data obtained from the LER, train consist information and the track profile. A static model of the transformation of longitudinal force into lateral force was developed, using specifications of the rail cars involved (TSB Engineering Laboratory report LP 112/00). The following are some of the more salient conclusions from that analysis:

• An in-train UDE started most likely at car No. 11 during dynamic braking.
• The 10^th car was the first car to derail.
• The buff forces induced by the UDE were sufficient to induce lateral forces which exceeded the lateral restraining ability of the track.
• The buff force was transformed into unusually high lateral forces that were doubled by the significant difference between the sideways freedom of the 10^th car and the 9^th car and applied to the front truck of the 10^th car.
• The poor track condition contributed to the derailment through larger geometric defects, weak track strength and low lateral track stiffness.

The report used end-of-train data and acceleration data to help determine the location of the initial UDE and the sequence of train activities in this investigation. The report also noted that there is no regulation regarding the accuracy and the time delay of radio transmissions from the end-of-train unit to the LER.

2.1 Introduction

The continued operation of a train repeatedly experiencing undesired emergency brake applications (UDE) exposes railway employees, the general public and the environment to the potential consequences of a derailment, such as personal injury and property damage. In this occurrence, a number of circumstances combined to increase that risk; i.e. the rapid application of the dynamic brakes by the locomotive engineer, the marshalling of passenger cars near the front of the train, and the weak track structure near Chalk River.

This analysis will focus on the following significant safety issues that have emerged from this investigation:

• the operation of trains known to be UDE problematic;
• track condition;
• regulatory requirements for locomotive event recorder (LER) information;
• train handling;
• information critical to safe train operation and emergency response;
• the condition of freight car air brake control valves; and
• the position of the passenger cars handled in freight trains.

2.2 The operation of trains known to be UDE problematic

The train continued to operate 900 miles after it was identified as UDE problematic. This is not an unusual railway practice. While there is much information to confirm that an emergency brake application, whether undesired or intentional, can result in very high dynamic forces, Canadian railways have generally chosen to accept the risk in the continued operation of such trains. Consequently, there is an expectation that train crews will continue to operate trains that are known to be susceptible to UDEs.

To operate a UDE problematic train, locomotive engineers must develop and implement operating strategies that avoid the use of the air brake system. Since the proper use of a train's brakes is the most effective way to control and distribute in-train forces, limiting the use of the air brakes only to emergencies can sometimes places locomotive engineers in a difficult position. Locomotive dynamic and independent brakes concentrate braking effort at the front of the train. In this occurrence, the UDE near the front of the train combined with the use of the dynamic brake to create very high buff forces. Most of the time, trains prone to UDEs arrive at destination safely. However, there are circumstances, such as this one, where operating trains without a fully functional air brake system is unsafe.

After the train was identified as UDE problematic, it passed through two locations where there were certified car inspectors on duty. These staff, who are specifically trained and experienced in inspection and maintenance of freight car air brake systems, were not tasked with rectifying the UDE problem on this train.

When the use of the air brake system is restricted to stopping a train only in an emergency because it is not capable of reliable service application, the significant in-train forces generated at that time may result in a derailment. Continuous operation of a train without a reliable service braking capability increases the likelihood of adverse consequences as duration of exposure to the risk is extended.

2.3 Track condition

Track structure (i.e. rail, ties, fasteners, tie plates, spikes, ballast, subgrade) is designed to support a train and absorb forces imposed by train movements. The condition of the track, maintained to a standard prescribed by TC's Railway Track Safety Rules (TSR), determines the class and maximum safe operating speed. In this case, the track was not maintained to the standard prescribed by the TSR for the authorized speed. The ties were deeply adzed or deteriorated, spikes were loose, and plates were broken, resulting in insufficient support of the rail at joint areas. The low joint condition prompted a dipping lateral motion of the rail cars and subsequent transfer of the lateral loading on the low joints. The lack of crosstie support, combined with excessive lateral loading from unusual in-train dynamic forces imposed on the track, resulted in the south rail rolling over and a loss of track gauge under the train.

Routine inspections performed by track maintenance personnel did not identify the potential risk presented by the deteriorated track condition at the rail joint locations. No track safety deficiencies were identified by the track geometry and flaw detection cars. Track geometry car testing, which does not identify weak ties, may have led to the erroneous conclusion that the entire track structure was safe, when in fact defective ties compromised the ability of the track to sustain lateral loading.

2.4 Regulatory requirements for locomotive event recorder information

The information obtained from the LER, using outdated software, was complete in the sense that it met all the basic requirements of the Railway Locomotive Inspection and Safety Rules. However, it did not enable the display of all of the parameters necessary for analysis of the operation of the train before the derailment. While the LER captured the necessary data, access to the additional information required to facilitate calculations and simulations of in-train forces, and calculation of the approximate location in the train of the kicker could only be gained with modern software.

The minimum number of parameters required by the current rules were established before technological advances were made in on-board data acquisition and recording. The Canadian railway industry has generally recognized the safety value of LER data and has expanded the data captured beyond what is required by regulation. However, because there is no requirement to include additional operating parameters on LERs, the identification of safety deficiencies in train operations is limited.

2.5 Locomotive operations

LER analysis indicated that only three seconds elapsed from when the locomotives were pulling the train until the train was moved into dynamic braking. Within three seconds of commencing dynamic braking, it was advanced to heavy dynamic braking, a practice inconsistent with CPR's General Operating Instructions (GOI). Application of heavy dynamic braking without allowing for the slack to adjust is likely to result in unnecessarily high concentrations of buff forces. Rapidly changing the locomotive consist from pulling to heavy dynamic braking resulted in a severe slack run in. This precipitated a UDE. Buff forces generated by the UDE that occurred near the front of the train, compounded with the buff forces of heavy dynamic braking, created lateral forces at the wheel/rail interface that exceeded the lateral restraining and absorbing capability of the weakened track structure, resulting in the rollover of the south rail and the subsequent derailment.

2.6 Emergency response

Effective emergency response is largely dependent upon the availability of accurate information. Train crew members, first responders and the public can be exposed to unnecessary risk when safety critical information, such as the location of dangerous goods cars in a train, is inaccurate. Immediately after this derailment, the location of the closest dangerous goods car was incorrectly identified due to errors in the train consist records. While the circumstances did not result in any additional hazard, inaccurate information concerning the location of dangerous goods cars in a train can create additional risk of exposure to the responders when a damaged rail car fails.

Although the rail traffic controller (RTC) is responsible to activate the emergency response to occurrences such as this derailment, the RTC function does not have readily available records of the location of all natural gas pipeline crossings, and was unable to provide this information to responders. Emergency response personnel, including those from the railway, were not immediately aware of the presence of the natural gas pipelines under the derailment wreckage. Even after they became aware of the presence of the pipelines, they did not recognize that the integrity of the pipelines may have been compromised by the derailment, until a pipeline employee arrived by chance and initiated a pipeline emergency response. Three of four warning signs were posted in clear view at the accident site. The primary purpose of the small signs, with small lettering, posted on the edge of the right-of-way, is to identify the presence of underground facilities, warning against unintentional excavation and damage to the pipelines, and to provide a telephone number to call, in case of an emergency. Although there were warning signs posted, neither the train crew or the other emergency responders recognized the presence of a potential hazard.

Although the weight and momentum of derailing rolling stock frequently results in severe ground penetrations, sometimes several metres deep, the uniformly loaded lumber cars did not penetrate the ground surface deep enough to damage the pipelines. Nevertheless, the momentum of derailed rail cars plowing into the ground could compromise the integrity of a natural gas pipeline, with potentially severe consequences. It is important that responders be fully informed of all potential hazards before entering an accident site. Given the potential consequences of pipeline damage by a derailing train, there may be a need for improved information to identify the location of a natural gas pipeline underground crossing, and awareness to recognize the hazard potential.

2.7 Equipment

Calculations, based on the propagation speed of the air brake signal in the brake pipe, the estimated length of the train brake pipe, and the 4.9-second difference between the UDE being recorded at the front and rear of the train, indicated that the UDE initiated most likely at the 10^th or 11^th car (see Appendix B — Determination of first car to go in emergency).

The brake valves of the passenger cars were functioning as intended and likely played no part in the UDE. The manufacturers' examination of the Wabco GB5 tread brake unit confirmed that it was in proper functioning condition. The automatic slack adjuster inside the GB5, designed to maintain the preset position of the brake shoe when the air brakes were released, was functioning as intended. It had been activated through normal application and release of the air brakes to maintain the set position of the brake shoe at the R-4 location. The overheated condition of the single brake shoe at this location resulted from the hand brake being left partially applied. A trainman, accustomed to ensuring that one hand brake is typically released on each car, would not necessarily be expecting to have to release two hand brakes on specially equipped cars. The absence of information to train service employees indicating that the passenger cars each had two hand brakes led to a risk that the release of both might be overlooked.

Examination of the brake control valve from the 10^th car revealed that the failure of the valve to pass the required Association of American Railroads (AAR) air brake testing was due to internal leakage of its emergency portion. The brake valve, however, functioned as intended. The extent of detected leakage was regarded as not having had any consequential effect because it was minimal.

In March 2000, the ABDW emergency valve portion from the 11th car had passed the single car test as required by the AAR rules. Testing was performed at 90 psi as required by the present AAR MSRP Standard S-486. Had the testing been performed at a pressure significantly higher than the normal operating pressure, as in MSRP Standard S-466, the weakened diaphragm might have been detected. The risk of the valve failing three months later in service due to a ruptured diaphragm could then have been removed. The ruptured diaphragm sensitized the emergency portion to small fluctuations in bpp, such as that experienced when the dynamic brake was applied rapidly on the train.

The results of the analysis of the emergency valve portion of the 11^th car, combined with the calculations of propagation of the emergency brake application, indicate that the UDE originated at the 11^th car. Material analysis of the neoprene diaphragm that failed determined that the tear followed a crease in the rubber coating that resulted from long-term compressive strain on the inside surface of the curve in this area. This resulted in cold flow of the rubber, and a reduction in the effective thickness at this location, predisposing the diaphragm to failure.

As most valve diaphragms do not fail in service, current equipment maintenance standards permit the valves that contain such diaphragms to remain in service until failure. Since the failure of this component can lead to UDEs and these events carry with them significant risks of derailment, a more realistic service life may need to be established. Without sufficiently stringent testing to verify integrity or identify pending failures, reasonable assuredness that the valves will continue to function properly until the next testing is not obtained. The number of cars in the North American fleet that have this specific type of component was not identified. However, the air brake valves which contain this component are in use system wide.

The emergency valve portion vent protector of the 13^th car had been broken off for a sufficient time for rust to accumulate on the exposed fracture surface. Without a vent protector to seal the exhaust vent, the valve interior was subject to contamination that would be conducive to defective valve operation. Given the accumulation of rust, it is likely that the broken vent protector was not discovered during the last CCI at Winnipeg, two days before.

The likelihood of en route air brake failures was increased when air brake testing, which is expected to identify pending failures before they occur, did not identify the deficiencies in the brake valves. The absence of a vent protector, which led to contamination of the emergency valve portion on the 13th car, was not identified during routine air brake tests performed in the months before the derailment. The pending failure of the 11^th car's emergency valve portion was not identified during single car testing performed only three months before failure in service. The UDE problem was not identified or corrected during brake tests at crew change locations as the train was en route eastward from Winnipeg.

When passenger cars that have trucks with increased lateral freedom are at the rear of a freight train, longitudinal forces acting upon the couplings between these cars and the freight cars are minimal. When this longitudinal force is transformed into lateral force at the wheel/rail interface, the forces are not generally excessive. The increased lateral freedom of the passenger car trucks does not adversely affect safety when these cars are at the rear of the train. However, when passenger cars are near the front of freight trains, particularly in circumstances when severe buff forces are generated, the longitudinal forces are much higher and the resultant lateral forces at the wheel/rail interface of adjacent freight cars can be excessive. On the train, the extreme buff forces, applied at the coupling between the 9^th and 10^th car behind the locomotives, resulted in a transformation of longitudinal force to lateral force, which exceeded the restraining ability of the weakened track structure.

3.1 Findings as to causes and contributing factors

1. The train, which had been identified as undesired emergency brake application (UDE) problematic, was allowed to operate for a considerable distance without the problem being rectified. There is an expectation that train crews will continue to operate trains that are known to be susceptible to UDEs.
2. Rapid transition from pulling to heavy dynamic braking resulted in high concentrations of buff forces towards the front of the train and likely precipitated the UDE.
3. High buff forces generated by the UDE, combined with the buff forces of heavy dynamic braking, were transferred to the rail. These forces were amplified at the coupling between the 9^th and 10^th car by the extra sideways clearance of the passenger car truck.
4. The lack of crosstie support combined with excessive lateral loading at the wheel/rail interface to the extent that the lateral restraining and absorbing capability of the weakened track structure was exceeded. This resulted in a loss of track gauge under the train, with the rail rolling over, and a subsequent derailment.
5. Routine inspections performed by track maintenance personnel did not identify the potential risk presented by track safety deficiencies at rail joint locations.
6. Marshalling of the passenger cars with trucks that had wide freedom of lateral motion near the front of the train contributed to the generation of excessive lateral forces on the rail.
7. Current equipment maintenance standards permitted an emergency brake valve piston diaphragm to remain in service for many years, without sufficiently stringent testing to verify integrity or identify pending failures, increasing the risk of derailment associated with a UDE.
8. Negative track geometry car test results, which did not include the identification of weak ties, may have led to the conclusion that the entire track structure was safe, when in fact defective ties compromised the ability of the track to sustain lateral loading.

3.2 Findings as to risk

1. Incorrect train consist information, particularly relating to the location of dangerous goods cars, increases the risk to safety, especially for first responders.
2. There is an absence of readily available information, above and beyond track-side posted warning signs, to the rail traffic controller and subsequently to railway employees, emergency responders and the public, to remotely identify the location of natural gas pipeline underground crossings.
3. The industry practice of continuous operation of a train without reliable service braking capability increases the likelihood of UDEs and the risk of excessive in-train forces, which can result in a derailment.

3.3 Other findings

1. Although additional operating parameters are captured by Canadian Pacific Railway's most recent locomotive event recorders, because of the absence of mandatory requirements to include additional operating parameters on locomotive event recorders, the identification of safety deficiencies in train operations is limited.

4.1 Action taken

4.1.1 General condition of the track

On 29 June 2000, the TSB issued a Rail Safety Advisory (01/00) to Transport Canada (TC), describing the deficiencies noted concerning the general condition of the track in the vicinity of the derailment area.

In response to the TSB Safety Advisory, TC Infrastructure officers inspected the Ottawa Valley Railway (OVR) North Bay and Chalk River subdivisions on 25, 26 and 27 July 2000, and advised the OVR that "Random sampling of cross tie conditions, at many locations, indicates defect rates of 50 to 55% as well as many instances where there are no effective cross ties within the prescribed distance from a joint." TC issued a notice to the OVR, under Section 31 of the Railway Safety Act, that the standard of maintenance posed a threat to safe railway operations due to the unacceptably high number of defective ties.

TC inspectors have recently conducted a compliance inspection on the OVR and reminded the railway company of the need to comply with the Railway Track Safety Rules (TSR).

4.1.2 Reclassification of track

As a result of the derailment, the OVR installed 1000 safety crossties at rail joints between Mile 0.0 and Mile 3.0 on the North Bay Subdivision. Subsequent to the Section 31 notice, the OVR purchased an additional 4000 ties to be installed at rail joints on the North Bay and Chalk River subdivisions to conform to TSR requirements for Class 2 track. The track speed was reduced accordingly to 25 mph.

A Canadian Pacific Railway (CPR) track evaluation and gauge restraint measurement test car subsequently tested the geometry of the track on 26 June 2000. No priority defects were identified at the derailment location during this test.

Subsequently, 45 000 ties were installed selectively along the line to bring the track to the standard required by the TSR.

4.1.3 Inaccurate train consist information

On 27 July 2000, the TSB issued a Rail Safety Information Letter (01/00) to TC identifying the risk presented by inaccurate information on the train consist list. TC responded that this issue has been addressed and that an action plan was implemented to correct this situation. As part of this action plan, a bulletin was issued to operating crews which reads in part:

Eastward trains will get a list of the cars they will lift at Coniston from the ATC^{Footnote 18} in Sudbury. In addition to the list they will also get a final consist of their train showing the total length of their train including engines and the 3% safety factor. Eastward trains approaching Romford must know the length of their lift and stop their train at the proper distance so that the head end of their train will stop clear of the circuit end sign.

TC believes that this action plan will go a long way to improving the accuracy of train consist information being provided to crews operating trains over RailAmerica, Inc./OVR. In addition, TC advised that inspectors from the Ontario Surface Region would monitor implementation of CPR's action plan with both CPR and RailAmerica, Inc./OVR to assess the level of improvement of train information accuracy being provided to crews from both railways. CPR has recently completed a major revision to the programs which generate train consists, primarily to comply with new TDG Clear Language Regulations, but believe that enhancements made to that software will reduce or eliminate the types of errors identified in this report. TC regional inspectors recently conducted a random survey of information being provided to train crews. The survey did not reveal any systemic problems with accuracy and completeness of the train information.

4.1.4 Operative service braking capability

On 28 August 2000, the TSB issued a Rail Safety Advisory (02/00) to TC, identifying the risk presented by the continuous operation of a train without an operative service braking capability and excessive in-train forces from an undesired emergency brake application (UDE), thereby increasing the likelihood of a derailment. In its reply, TC quoted applicable rules and instructions from the industry and concluded that, "In this particular instance, while the emergency brake was undesired and occurred many times en route, it resulted in stopping the train safely over hundreds of miles prior to derailing."

4.1.5 Information on pipeline crossings

On 19 March 2001, the TSB issued a Rail Safety Advisory (01/01) to TC, identifying the risk associated with the lack of information available to train crews and emergency responders with respect to the location of dangerous commodity pipelines crossing railway rights-of-way. TC replied that the new Standards Respecting Pipeline Crossings Under Railways were approved by the Minister of Transport on 10 May 2001. Section 10.2.8.3, Signs, of the new standards reiterate the following requirements from the 1999 version of Z662:

Signs shall include the following information, printed on a background of sharply contrasting colour:

1. The word "Warning", "Caution", or "Danger" prominently displayed, for example, in 25 mm high bold lettering.
2. The type of pipeline system prominently displayed, for example, "High-Pressure Natural Gas Pipeline" in 13 mm high bold lettering.
3. The name of the operating Company and emergency notification information, preferably an emergency telephone number including area code where appropriate.

Note: It is recommended that

1. signs include a statement such as "Call before you dig" or "Call for locate", and
2. consideration be given to also including the required information in a language appropriate to the region in which the sign is located.

TransCanada Pipelines Limited (TCPL) has an Integrated Public Awareness Program to specifically target affected parties by:

1. identifying the presence and location of affected stakeholders;
2. identifying the presence and location of facilities;
3. identifying potential hazards and emergency situations that can occur;
4. identifying procedures and precautions to be followed in emergencies;
5. updating company records with respect to key community and landowner contacts;
6. providing company contact names and numbers to community and landowners;
7. providing relevant information about company operations and activities with affected stakeholders; and
8. discussing regulatory and safety issues with affected stakeholders.

TCPL has undertaken to reestablish communications with the rail companies emergency management divisions.

4.1.6 Broken or missing vent protectors

On 12 April 2001, the TSB issued a Rail Safety Information Letter (01/01) to TC, indicating that contamination had entered a brake valve from the train through missing or broken vent protectors on the emergency portions of air brake control valves. TC responded that the issue of missing or broken vent protectors would be placed on the next semi-annual meeting with the railways. TC has subsequently informed that the issue has been discussed with the railways at a semi-annual meeting held in May 2001. Railway inspectors are now required to identify a missing vent protector during safety inspections.

4.1.7 Air Brake valve malfunction

Subsequent to the TSB advising the car owner of a defect in the air brake control valve emergency portion in the ABDW control valve, the car owner initiated an assessment of this valve on sister cars to determine if the defect was present on similar cars. The car owner removed and forwarded three additional valves from sister cars to the TSB Engineering Laboratory. These valves were examined by the TSB Engineering Laboratory and the Quality Engineering Test Establishment (TSB Engineering Laboratory report LP 114/01).

4.1.8 Administrative safety action

Safety actions taken by CPR subsequent to the accident include a safety blitz, new requirements in their General Operating Instructions (GOI) pertaining to brake tests, and a clearer format for procedures following an UDE. CPR has completed a video on Train Handling and Track/Train Dynamics for training and safety programs. The safety blitz material and the updated GOI prescribe that "if an emergency brake application occurs while performing the brake test, then consider the test unsuccessful. The brake test must be repeated until the brake applies properly (without going into emergency)."

4.2 Action required

4.2.1 Elimination of UDEs

Continuous operation of UDE problematic trains has been recognized as presenting an increased level of risk of excessive in-train forces and possible derailment. CPR's GOI governing train brake tests have been amended to prescribe that a service application and release of the train air brakes must be obtained without a UDE occurrence. The testing is considered successful once one, of an unlimited number of air brake tests, does not result in a UDE. Subsequent to any one successful train air brake test, the occurrence of a UDE may be dismissed without taking any steps to identify and eliminate the source of the UDE. As a result, there is no restriction on the operation of a UDE problematic train. It is clear that, if a UDE prone car in a train can be readily found, it would be in the best interests of safety and traffic expedition, to identify and eliminate the problem. The Board is concerned that the increased risk associated.with operating a UDE problematic train has not been adequately mitigated by the industry. Therefore the Board recommends that:

4.3 Safety concerns

4.3.1 Hazard awareness

The first responders at the accident site had not been forewarned that there was a natural gas pipeline underneath the derailed train wreckage, nor was the train crew aware that the derailment occurred in the vicinity of this utility crossing, prior to responding at the site. When first responders became aware of the presence of the pipeline crossing, neither the appropriate sense of urgency nor the potential for hazard was recognized until a pipelines employee initiated an emergency response. The Board is concerned that, under circumstances where the pipeline would have been damaged, serious consequences may have occurred as a result of first responders arriving on site with no awareness of this situation.

4.3.2 Testing of air brakes

The Association of American Railroads Field Manual of the Interchange Rules, governing the safety and operation of freight cars through prescribed rules and standards, has relaxed the requirements of maintenance on air brake systems. Air brake valves used to be subject to Periodic Attention COT&S (clean, oil, test and stencil) (Rule 2 deleted). The air brake valves of freight cars now remain in service for the lifetime of the car or until such time as they fail in service or during periodic testing (Rule 3). In this occurrence, the valve identified as originating the UDE passed the periodic testing conducted as prescribed in AAR Standard S-486-02, with a testing pressure of 90 psi, 5 psi above normal operating pressure, only a few months before a diaphragm failure in service. The purpose of periodic testing is to verify that the air brake valves perform as intended and give reasonable assurance of that integrity until the next periodic testing. The performance testing procedures for freight brake single car test rack for individual valve portions (AAR Standard S-466-91) prescribes testing at 70 psi and at 110 psi.

The purpose of the test procedure is to provide a series of tests to evaluate the performance of a control valve operating with a carset of brake equipment as applied to a brake single car rack. In consideration that testing at 90 psi did not identify the pending diaphragm failure of this occurrence, the Board is concerned that the testing pressure prescribed in S-486-02 (90 psi) may not be sufficiently stringent to identify pending failure of air brake valves.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 18 December 2002.

Appendix A - Canadian Pacific Railway's General Operating Instructions, Section 5

• 15.0 Inspection Required Following an Emergency Brake Application. Note: This instruction does not relieve crews from the requirements of all CROR Operating Rules, especially Rule 102.
  1. Passenger Trains
     1. Stopped by any emergency brake application: before the movement resumes each car must be inspected to ensure all brakes are released. A pull-by inspection of the train must also be made for indications of skidded wheels.
  2. For All Other Trains
     1. Stopped by an Emergency Brake Application: after the brakes are released, a pull-by inspection must be conducted on at least one side of the train to check for evidence of defective or derailed equipment. The results of the pull-by inspection and the location at which the emergency brake application occurred must be recorded on a Crew to Crew Form. This form must remain with the train to its final destination.
     2. At locations where a pull-by inspection cannot be made, the train may proceed at SLOW speed to the first location where a pull-by inspection can be made.
     3. In all cases, whenever a train is moved after any emergency brake application, crew members must pay extraordinary attention to running inspection of the train. If there is evidence of derailed equipment, or if there is unusual train action, the train must be stopped immediately and the cause determined.
     4. The pull-by inspection referred to in clause i) is not required provided ALL of the following conditions are met:
        1. The emergency brake application is not the first occurrence for that train consist as indicated by a Crew to Crew Form;
        2. train tonnage (EGT) is less than 6,000 tons; or train tonnage (EGT) is 6,000 tons or more and each car, except a caboose if provided, exceeds 100 gross tons. If a caboose is provided, it must be marshalled as the last car of the train;
        3. speed at the time of the emergency brake application was greater than 25 mph;
        4. the emergency brake application occurs within 15 seconds of initiating a service brake application;
        5. no unusual slack action is noted during the stop;
        6. when the brakes are released, the air flow indicator and rear car brake pipe pressure readings indicate no loss of air pressure; and
        7. the train is carrying no SPECIAL dangerous commodities.
     5. Trains carrying SPECIAL dangerous commodities: After conditions 1 through 6 in clause iv) have been met, the train must be given a pull-by inspection from the leading locomotive to the last car containing SPECIAL dangerous commodities. Record must be made on a Crew to Crew Form.
     6. The pull-by inspection referred to in clause i) may be performed by the following employees, who must be radio equipped and alerted to the situation:
        • crew members of the train itself;
        • crew members of a stopped train;
        • other employees on the right of way.

Appendix B - Determination of first car to go in emergency

Based on TSB Engineering Laboratory Report LP 112/00

Locomotive Event Recorder Recorded Times and Propagation of Undesired Emergency Brake Application

1. A deceleration change from -0.14 to -0.33 mph/s and a brake pipe pressure reduction recorded simultaneously at 0345:50.3 (lead locomotive at Mile 1.681) indicated that an in-train undesired emergency brake application (UDE) occurred and propagated to the locomotive along the air brake pipe. Considering the UDE propagation time (see calculations later) of about one second to arrive at the locomotive event recorder (LER), the UDE most likely occurred between 0345:49.2 (the last recorded moment without brake pipe pressure dropping) and 0345:50.3.
2. An end-of-train (EOT) initial drop of 2 psi was recorded at 0345:55.2. According to the LER manufacturer, the initial in-train UDE propagated along the air brake pipe through the cars until it arrived at the pressure sensors on the locomotive and the end-of-train device respectively. Then, the signal at the locomotive propagated to the LER through an electronic wire (very little propagation delay). The signal at the EOT was transmitted to the LER through a radio transmission. The LER recorded both signals as they arrived at the LER on the locomotive. The difference between the arrivals was 4.9 seconds (0345:55.2 - 0345:50.3).
3. A radio transmission delay may be considered and included in the difference in addition to the propagation time along the air brake pipe. For normal commercial cell phone systems, the delay time could be 80 to 250 milliseconds (ms) (0 ms, 150 ms and 250 ms are used in the calculations to assess the effect on the results).

Calculation Procedure

1. Some symbols and parameters required for the calculations are defined as follows:

Symbols:

EOT:

end of train

UDE:

initial in-train undesired emergency brake application

LL:

lead locomotive

TL:

trailing locomotive

LER:

locomotive event recorder on the lead locomotive

Variables and Parameters:

Ll:

length of locomotives, 4 x 69 = 276 feet

Lc:

length of cars behind the locomotive, 5513 - 276 = 5237 feet

D:

the distance from the initial UDE location to the locomotive, feet

T1:

time for the UDE signal to propagate along the air brake pipe over the distance D, seconds

T2:

time for the UDE signal to propagate along the air brake pipe to the EOT, seconds

T0:

time for the UDE signal to propagate through the electronic wire on the locomotive the LER on the LL, 0 second

T3:

time for the UDE signal to be transferred from the EOT to the LER on the LL through a radio transmission, seconds

ΔT:

time difference between the arrivals at the LER of the UDE signal through the EOT and directly along the air brake pipe over D, 4.9 seconds

S:

propagation speed of the UDE signal along the air brake pipe, 940~980 feet/second

k:

ratio of the air brake pipe length to the corresponding train straight length, 1.05~1.20.

From the above conditions and figure:

T1 =

D x k / S

T2 =

(Lc - D) x k / S

ΔT =

(T2 + T3) - (T1 + T0) = T2 + T3 - T1= 4.9

Combining the above three equations:

k (Lc - D) / S + T3 - k D / S = ΔT

Solving this equation and applying the known parameter values:

k Lc - 2 k D = (ΔT - T3) S

Therefore, the location of the initial UDE should be D feet behind the trailing locomotive, where

D = [k Lc - (ΔT - T3) S] / (2 k) = 2618.5 - (4.9 - T3) S / (2 k)

Calculation Results

1. Here is a list of a series of calculations with different combinations of parameters that were carried out:

Case	S (feet/second)	k	T3 (seconds)	D (feet)	Pointed to Car No.	Comment
1	980	1.05	0	332	6	very small k/T3
2	940	1.05	0	425	7	very small k/T3
3	980	1.1	0	436	7	fast S / T3 = 0
4	940	1.1	0	525	9	some likely practical
5	960	1.1	0.15	546	9	likely practical
6	940	1.1	0.15	589	9	likely practical
7	940	1.1	0.25	632	10	likely practical
8	980	1.15	0.15	595	9	likely practical
9	940	1.15	0	616	10	likely practical
10	940	1.15	0.15	677	10	likely practical
11	960	1.15	0.15	636	10	likely practical
12	980	1.15	0.25	637	10	likely practical
13	960	1.15	0.25	678	10	likely practical
14	940	1.15	0.25	718	11	likely practical
15	980	1.2	0.15	679	10	likely practical
16	980	1.2	0.25	720	11	likely practical
17	940	1.2	0	699	11	likely practical
18	940	1.2	0.15	758	11	likely practical
19	940	1.25	0.25	870	13	very big k / max T3
20	980	1.25	0.25	796	12	fast S / very big k / max T3

2. Conclusion: The most practical parameter combinations result in the most likely location of the initial UDE pointing to either commuter coach No. 9, centre beam flat car No. 10 or centre beam flat car No. 11.

Appendix C - List of Supporting Reports

The following TSB Engineering Laboratory reports were completed:

• LP 090/00 Air Brake Control Valve–Gondola Rail Car CP 343888
• LP 100/00 Railway Brake Valve Examination–Montreal Commuter Railway Car
• LP 112/00 Derailment Analysis–Chalk River, North Bay Subdivision
• LP 129/00 Air Brake Control Valve Examination–Centre Beam Flat Car SRY 73013
• LP 028/01 Functional Analysis of Air Brake Portions–Centre Beam Flat Car
• SRY 873090 LP 114/01 Failure Analysis of the Emergency Brake Valve Piston Diaphragm

These reports are available from the Transportation Safety Board of Canada upon request.

Appendix D - Glossary

AAR

Association of American Railroads

ABS

Automatic Block Signal System

ATC

assistant terminal coordinator

bpp

brake pipe pressure

CCI

certified car inspection

cm

centimetre

CPR

Canadian Pacific Railway

CROR

Canadian Rail Operating Rules

CSA

Canadian Standards Association

EDT

eastern daylight time

EOT

end of train

GOI

General Operating Instructions

LER

locomotive event recorder

m

metre

mm

millimetre

mph

mile per hour

mph/s

mile per hour per second

ms

millisecond

OCS

Occupancy Control System

OVR

Ottawa Valley Railway

psi

pound per square inch

QETE

Quality Engineering Test Establishment

RTC

rail traffic controller

TC

Transport Canada

TCPL

TransCanada PipeLines Limited

TDG

transportation of dangerous goods

TSB

Transportation Safety Board of Canada

TSR

Railway Track Safety Rules

UDE

undesired emergency brake application

UMLER

Universal Machine Language Equipment Register

UTC

Coordinated Universal TimeG1