Railway Investigation Report R03T0080

On 21 February 2003, at approximately 0540 eastern standard time, Canadian Pacific Railway (CPR) freight train 410-16, travelling eastward at 42 miles per hour, derailed 21 cars at Mile 80.5 on the main track of CPR's Belleville Subdivision. Seven of the derailed cars contained liquefied petroleum gas, some of which collided with the lead locomotive of CPR train 251-19 waiting in the siding at Lonsdale. The tank car shells were breached, and the cars subsequently exploded.

Approximately 635 feet of main track, the signals and switch heaters near Mile 80.5 were destroyed. Sixteen cars from train 410 and the lead locomotives of train 251 were extensively damaged, and 1600 feet of fencing and pole line were destroyed and burned. The fire burned for three days. Smoke plumes from the fires and the burning propane caused some concern for the air quality in the immediate area. About 300 residents were evacuated as a safety precaution. Both crew members of train 251-19 suffered burns from the fireballs of the punctured tank cars. The crew of train 410-16 were not injured.

Ce rapport est également disponible en français.

1.1 The accident

On 21 February 2003, Canadian Pacific Railway (CPR) train 410-16 (train 410) was proceeding eastward on the main track of CPR's Belleville Subdivision. At approximately 0536 eastern standard time,^{Footnote 1} the train passed through a hot box and dragging equipment detector (the scanner) at Mile 82.1, where wheels and axles are monitored. An alarm tone was generated when heat was detected from one of the axle bearings on the train. Once the entire train cleared the scanner, an automated voice communication was broadcast, advising the train crew that a hot bearing had been detected approximately 122 axles behind the lead locomotive. The message also advised the train crew to stop the train for an inspection. Approximately two miles further down the track, train 251-19 (train 251) was standing at Mile 80.5 in the Lonsdale Siding, clear of the main-track switch.

At approximately 0540, a wheel set on the 27th car of train 410 derailed to the south side of the main track at Mile 80.9. The derailed car continued eastward towards the switch point at Mile 80.5, where it took the diverging route into the Lonsdale Siding. The 27th car (SOO 18748, a loaded box car of lentils) then struck the side of the first locomotive (CP 8654) on train 251. The following two cars from train 410, the 28th and 29th cars, which were loaded with agricultural products, ran in behind and derailed to the north side of the track. The next seven cars of train 410, the 30th to 36th cars, were tank cars loaded with liquefied petroleum gas (LPG). The first loaded tank car derailed and struck the right front corner of the first locomotive of train 251 and exploded on impact. The second tank car also derailed and then exploded after heavy impact damage. This sequence was followed by explosions of the third and fifth LPG tank cars within 15 minutes of sustaining severe damage from derailed cars piling in from behind. Shortly after, the remaining three loaded LPG tank cars ruptured as a result of impact damage, failed safety appliances, and intense heat from the fire. The contents of the seven LPG tank cars were consumed in the fire (see Photo 1).

A total of 21 cars derailed on train 410, including 9 tank cars with regulated products, 2 tank cars with unregulated products, 2 refrigerated (cryogenic) box cars, 4 box cars of agricultural products, 2 flat cars of lumber products, and 2 container cars of consumer goods. On train 251, the first and second cars behind the locomotives, both empty covered hopper cars, derailed but remained upright.

1.2 Weather

At the time of the accident, there were clear skies, with winds from the southwest at 22 km/h. The ambient air temperature was -2.5°C. The ground was snow covered.

1.3 Train information

1.3.1 Train 410

Train 410, which consisted of 65 loaded rail cars and 12 empty rail cars, was 5356 feet long and weighed approximately 8268 tons. It was powered by two 4400-horsepower GE AC4400 locomotives. These locomotives are capable of producing 98 000 pounds of dynamic brake retarding force per locomotive. There were 11 loaded tank cars of regulated dangerous goods, and two loaded refrigerated box cars (cryogenic refrigerant) on the train.

The train originated at CPR's Toronto Yard, Ontario, and was destined for Montréal, Quebec.

1.3.2 Train 251

Train 251, which consisted of 2 locomotives, 39 loaded cars, and 55 empty cars, was approximately 6021 feet long and weighed about 6966 tons. There were 9 residue cars of regulated dangerous goods.

The train originated at Montréal and was destined for Toronto.

1.4 Personnel information

The operating crews of train 410 and train 251 each consisted of one locomotive engineer and one conductor. The crew members were qualified for their respective positions and met company and regulatory fitness and rest standards.

1.5 Damage to Equipment

1.5.1 Train 410

On train 410, a total of 21 rail cars, the 24th to 44th cars, derailed. Sixteen of the 21 cars sustained considerable damage and were destroyed at the site. Four cars received minor damage and were re-railed and sent to the repair shop. One derailed tank car, which had no notable car damage, was re-railed and sent to an inspection location before being released back to service.

1.5.2 Train 251

The lead locomotive on train 251 was extensively damaged. The trailing locomotive sustained considerable damage and required extensive repairs. The first two cars behind the locomotives derailed as a result of the collision and sustained minor damage.

1.6 Belleville subdivision

Train movements on the Belleville Subdivision are governed by the Centralized Traffic Control System (CTC) authorized by the Canadian Rail Operating Rules (CROR), and are supervised by a rail traffic controller located in Montréal. A post-accident examination determined that the CTC signals were functioning as designed. No defective conditions had been reported for signal and wayside equipment in the vicinity of the accident.

1.7 Particulars of the Track

1.7.1 General track, roadbed and geometry information

The Belleville Subdivision extends from Mile 0.0 at Smith Falls to Mile 211.5 at Toronto (see Figure 1). From Mile 0.0 to Mile 2.0 (Smith Falls West), the track is double main track. The track continues as single main track from Mile 2.0 to Mile 195.9 (Neilsons), where it reverts back to double main track until Mile 209.4. The maximum authorized speed is 60 mph. In the vicinity of the derailment, trains are authorized to travel at the maximum speed.

The track consisted of 132-pound continuous welded rail manufactured by Algoma Steel in 1975 and laid in 1975. Standard 14-inch double-shouldered tie plates were secured by three six-inch spikes. Treated hardwood ties were laid with approximately 60 ties per 100 feet. The rail was anchored every tie. The track structure rested on a three-foot subgrade fill topped with crushed slag ballast.

Train movements travelling eastward through the derailment area must negotiate an ascending grade of 0.4 per cent from Mile 83.5 to Mile 81.8, followed by a descending grade of 0.8 per cent from Mile 81.6 to Mile 80.9. The grade then changes back to an ascending grade of 0.7 per cent from Mile 80.6 to Mile 80.1, at which point the track levels out to a slight 0.1 per cent ascending grade.

1.7.2 Track inspections

Track inspection programs are carried out to detect irregularities in the track structure and to help plan track maintenance to ensure safe train operations. These inspection programs will normally include track geometry car inspections, rail defect testing using ultrasonic detection equipment, annual walking inspections, monthly train-based inspections, and twice-weekly visual inspections.

On the Belleville Subdivision, visual inspections are performed by the assistant track supervisor from a Hi-rail vehicle. The last inspection prior to the accident was performed on 17 February 2003. No major defects were noted in the vicinity of the accident during this inspection. The track geometry was checked on 06 February 2003, using CPR's track geometry car. No urgent defects requiring immediate attention were detected in the vicinity of the accident. The last rail flaw detection test prior to the accident was performed on 23 January 2002. During this inspection, a defective field weld was identified at Mile 87.4 and was corrected the same day.

On 28 February 2003, while examining track in the vicinity of the derailment, TSB investigators noted that the ties were in varying degrees of deterioration, with approximately 34 defective ties over a track distance of 100 ties. The tie defects included wood decay, plate cutting, split ties, and spike-killed ties.

There were no slow orders in effect for the derailment area at the time of the occurrence.

1.7.3 Particulars of the siding

Lonsdale Siding is located on the south side of the main track, extending from Mile 80.5 to Mile 79.1. Trains travelling in the eastward direction are governed by Signal 806. As an eastward movement, train 410 encountered a facing-point switch as it approached the siding.

The siding track was last inspected on 17 February 2003, and no major defects were noted.

1.8 Damage

1.8.1 Damage to the main track

Approximately 635 feet of main track were destroyed. There was minor damage to the switch leading into the adjacent siding. In addition, there was minor damage to rail anchors, ties, and spikes, which occurred when the first derailed car was dragged along the south rail eastward from Mile 80.9 to the switch.

1.8.2 Damage to the Siding Track

Approximately 420 feet of the siding were destroyed.

1.8.3 Other infrastructure damage

The intermediate signal, one dwarf signal, and switch heater ducts near Mile 80.5 were destroyed. There was also minor damage to the switch guard rails.

1.8.4 Damage to private property

Approximately 1600 feet of fencing were destroyed and 1600 feet of pole line burned. Some trees on adjacent private property were severely burned or were damaged from flying debris. During clean-up, minor damage to adjacent farm fields occurred due to heavy equipment. The fire burned for approximately three days. Smoke plumes from the fire caused some concerns for the air quality in the immediate area. Due to smoke, fire and the presence of the LPG products, approximately 300 residents in the immediate area were evacuated. The immediate and surrounding areas were monitored for changes in air quality. The air quality remained well above the provincial Ministry of Environment standards.

1.9 Dangerous goods information

1.9.1 Train 410

Train 410 contained a number of rail cars carrying regulated dangerous goods, including nine loaded tank cars of LPG (UN 1075), two loaded tank cars of anhydrous ammonia (UN 1005), and two loaded refrigerated box cars carrying cryogenic refrigerant shipments. Seven of the LPG cars and the two cryogenic cars were involved in the derailment and subsequent fire. Approximately 407 000 kg (896 915 pounds) of LPG was burned in this accident.

One of the anhydrous ammonia tank cars derailed within several hundred feet of the main derailment area. However, this tank car was not seriously damaged by the fire and explosions.

1.9.2 Train 251

Train 251 contained a number of rail cars carrying regulated dangerous goods, including six residue tank cars last containing caustic soda solution (UN 1824), two residue tank cars last containing molten phenol (UN 2312), one residue tank car last containing molten naphthalene (UN 2304), and one residue tank car last containing vinyl acetate inhibited (UN 1301). None of these tank cars were involved in the derailment or fire.

After the lead locomotive was damaged by the impact and fire, approximately 3000 gallons of diesel fuel from the lead locomotive was consumed in the fire.

1.10 Recorded information

1.10.1 Event recorder - Train 410

Data from the locomotive event recorder of the lead locomotive were analyzed. At 0530:11, train 410 was travelling at approximately 35 mph in throttle position 8 (maximum throttle) as it approached the scanner at Mile 82.1. At 0535:37, while travelling at 42 mph, the throttle was reduced to position 6. At 0535:49, the independent brake was bailed off while in throttle position 6 and with the speed constant at 42 mph. At 0536:04, an in-train emergency brake application was recorded. The train stopped approximately 47 seconds later.

1.10.2 Event recorder - Train 251

The event recorder from the lead locomotive of train 251 was removed for analysis. However, due to extensive fire and heat damage, data from this recorder could not be recovered. Electrical connections had melted, and electronic cards and cabling in the recorder had been destroyed.

Following a train collision on the Drummondville Subdivision on 15 February 1986, the Canadian Transport Commission had ordered all federally regulated railways to install event recorders in locomotives that operate on main track. Although this Order (R-40339), dated 19 February 1987, identified information that locomotive event recorders should capture, it did not specify any design standards or performance criteria for recorders. Consequently, the survivability of locomotive event recorders under extreme conditions such as fire, impact, or water immersion have not been addressed. In contrast, in the air and marine industries, event recorders have been designed using performance standards to maximize their survivability in an accident.

Since 1990, the TSB has investigated six other rail accidents involving crew member injuries or fatalities. In five of these accidents (R92T0183, R96C0172, R97V0063, R99H0010, and R03V0083), the data in the locomotive event recorders were lost due to fire exposure or water contamination.

• R92T0183 (19 July 1992): Canadian National (CN) train 309 proceeding westward encountered a washout at Mile 133.5 of CN's Caramat Subdivision (Exton, Ontario). All four locomotives derailed and fell into the adjacent lake.
• R96C0172 (12 August 1996): CN train 117 proceeding westward collided with 20 rail cars rolling uncontrolled in the eastward direction at Mile 122.9 of CN's Edson Subdivision (Yates, Alberta). Three locomotives derailed and burned.
• R97V0063 (26 March 1997): CN train 102 derailed into a washout at Mile 106.15 of CN's Ashcroft Subdivision (Conrad, British Columbia). Both locomotives slid into the washout and burned in the ensuing fire.
• R99H0010 (30 December 1999): CN train 783 proceeding westward on the north track struck a derailed car on CN train 306, which was proceeding eastward on the south track at Mile 50.84 of CN's Saint-Hyacinthe Subdivision (Mont-Saint-Hilaire, Quebec). Both locomotives burned in the resulting fire.
• R03V0083 (14 May 2003): CN train 356 derailed both locomotives and six cars at a wooden trestle bridge at Mile 7.2 of CN's Fraser Subdivision. The derailed equipment fell from the caved-in bridge and burned in the ensuing fire.

1.11 Canadian rail operating rules

CROR are operating rules that help to ensure the safe movement of trains in Canada. In this occurrence, the train crew had copies of these rules.

CROR specify the minimum standards required for railways operating within Canada. However, there are no instructions or rules governing the use, location, or operation of hot box detectors (HBDs) (scanners) and other wayside detection systems.

The railways must meet CROR requirements, but they can also require train crews to meet additional company-specific requirements. These additional requirements are defined in the railway's General Operating Instructions (GOI).

1.12 General operating instructions

CPR's GOI in effect at the time of the derailment were issued on 01 March 2002. Section 5, Part I of the GOI refers to train inspections. Part II of the GOI provides instructions related to HBDs. In this occurrence, the March 2002 version was being used by the operating crew.

1.12.1 Train inspections

Section 5, Part I, Train Inspections, Item 5.1 of the GOI indicates:

No train may be operated in excess of 60 miles, or move past two (2) consecutive non-operational hot box detectors without having been inspected on each side of the entire train. These inspections must be performed by:

1. hot box and dragging equipment detectors; or
2. pull-by inspection by crew members of the train; or
3. passing train inspection by:
   • wayside employees, or
   • crew members of other trains.
     
     Note: Passing train inspections must be conducted by 2 employees on opposite sides of the train, within 1 train length of each other.
     
     The inspection results must be conveyed to the train crew to be considered an inspection.

1.12.2 Hot Box Detector Instructions

Specific instructions are provided to the train crew to ensure that appropriate action is taken when the train approaches a scanner, passes through a scanner, or generates an alarm at a scanner.

Section 5, Part II, Hot Box Detector Instructions, Item 1.2 of CPR's GOI refers to "Operating At or Near Hot Box Detectors." The specific instructions are:

1. To avoid abnormal heat indication from a source other than defective equipment, the locomotive engineer should avoid:
   • prolonged use of train brakes approaching a detector;
   • any application of brakes while a portion of the train is passing the detector location.
2. At hot box detector locations, crew members should avoid use of the radio system:
   • while the train is passing over the detector site;
   • until they have heard the report from the talker as to the results of the inspection.

As the train passes the detector, each time an alarm sounds (when the pre-set heat differential between opposite bearings of the same axle is reached), a one-second alert tone is transmitted over the radio. Once the rear of the train is clear of the detector, a two-second alert tone is transmitted followed by an automated voice message containing the details for each alarm.

When an alarm message is broadcast, the train crew must:

• If the inspection point is designated as IMMEDIATE or if no inspection point is designated for the scanner location, then the train crew must STOP the train immediately to perform the inspection.
  
  EXCEPTION: if none of the conditions listed below apply, then it is acceptable for a crew member to detrain and have the train pull ahead not exceeding slow speed to the first defect, and then to the subsequent defects.
• If an inspection point is designated for the scanner location, then
  • STOP the train immediately to perform the inspection.
  EXCEPTION: If none of the conditions listed below apply, then the train need not stop immediately, but may proceed to the inspection point not exceeding slow speed. At the inspection point, it is acceptable for a crew member to detrain and have the train pull ahead to the first and subsequent defect(s).

Conditions referenced in the above two situations are:

• the defect is visible to the crew; or
• the HBD transmits an alarm for dragging equipment; or
• the detector is one that is identified with double asterisks (**) and the train is carrying one or more car loads, container loads, or trailer loads of SPECIAL dangerous commodities; or
• the detector broadcasts more than six alarms; or
• the cause of the alarm is not heard or is in doubt.

Other instructions related to HBD alarms include the following:

• Inspection for defects must be performed while the train is stationary.
• Whenever practicable, if an HBD transmits an alarm for "HOT BOX," do not exceed 5 mph while moving the defect over facing-point switches. Position a crew member (or another radio-equipped employee alerted to the situation) ahead of the switch so that the train can be stopped if the axle has been burnt through.

1.13 Timetable instructions

Each railway develops and maintains timetables for subdivisions within its rail network. The timetable identifies special instructions pertaining to the movement of trains that may differ from the CROR or the GOI. The timetable for the Belleville Subdivision came into effect on 14 January 2002, and this timetable was in the possession of the operating crew.

As stated in CPR's timetable for the Belleville Subdivision:

• Lonsdale Siding is located at Mile 79.8 and is under the supervision of the Montréal Service Area.
• For eastward train movements passing by the detector at Mile 82.1, the inspection point is Lonsdale and the set-out point for equipment found defective is Lonsdale Siding.
• For westward movements passing this detector, the inspection point is immediately east of the crossing at Mile 86.81. The set-out point for defective cars is Thurlow Siding at Mile 87.8. This location is identified with double asterisks (**).
• The double asterisks (**) advise the reader of the requirements in Section 8, Item 5.1 of the GOI.

1.14 Locomotive engineer training requirements

Locomotive engineers are required to complete four weeks of classroom study, which includes lectures and the use of train simulators. The topics covered include locomotive overview, train operations, braking systems, and train handling strategies. Upon successful completion, the student engineers return to their respective terminals where they are permitted to operate trains under the supervision of a qualified locomotive engineer for approximately 12 to 17 weeks. During this period, a number of written examinations are administered. The candidates must pass each examination with at least an 85 per cent grade (90 per cent for CROR). After completing a pre-determined number of qualifying trips, a second examination is then administered. In addition, all locomotive engineers must pass a re-certification and an on-the-job training evaluation every three years.

Locomotive engineer training is a one-time requirement, with refresher training required every three years. However, employees are offered additional training if new technology or train handling techniques are introduced, if the employee requests additional training, or if their performance warrants it. These additional "coaching clinics" are provided by qualified operating locomotive engineers who have consistently demonstrated good operating and train handling practices. These coaches will have taken additional training to qualify them as trainers.

1.14.1 Train handling strategies and instruction

Module 30 of CPR's locomotive training manual, Train Handling Strategies, was developed to help the student identify and assess conditions that affect train handling and to help in selecting the safest, most efficient train handling method. These conditions include equipment considerations; dynamic forces resulting from track-train interactions; operating conditions such as throttle modulation, braking systems, train length, and train weight; and track conditions such as gradient and curvature.

Objective Two, Section N ("Track Grades") of Module 30, describes how track gradient (including humps, knolls, sags, and dips) affects dynamic forces within the train. Track gradient is considered light when the grade is less than 0.8 per cent; heavy when the grade is between 0.8 per cent and 1.8 per cent; and mountain grade when the grade is greater than 1.8 per cent. On the Belleville Subdivision, the track between Mile 83.5 (near the scanner location) and Mile 80.1 (entrance into the Lonsdale Siding) had a maximum descending grade of 0.8 per cent and a maximum ascending grade of 0.7 per cent.

Objective Three, Section B ("Dynamic Brake") of Module 30, was developed to help the student understand the use of dynamic brakes. The following information is included in this module:

• During the slowing or stopping of a train, the dynamic brake should be used whenever possible.
• The most effective use of the dynamic brake is between 18 mph and 28 mph with standard range and between 0.5 mph and 28 mph with extended range. These ranges must be considered when planning the use of the dynamic brake.
• While the braking effort lessens outside these ranges, sufficient effort is provided above and below these speeds so that the dynamic brake may be effectively used for slowing, controlling, and stopping trains.
• When operating through turnouts, crossovers, passing tracks, curves, and temporary speed restrictions, particular care must be exercised to control the amount of dynamic braking effort. The high dynamic forces involved may easily derail cars.
• When cresting a grade, the throttle should be decreased as the head end crests the grade. Speed should be below maximum to allow the locomotive engineer time to adjust slack gently when making the transition from power to braking.
• When controlling trains using dynamic brake or controlling trains with automatic air brake and dynamic brake, the maximum dynamic brake retarding force must not be exceeded.

Module 20, "Communication and Trackside Detection Devices," describes the functions and uses of trackside devices such as HBDs. The module also describes the principles and procedures for radio communication. References to HBD instructions in Module 20 are based on the instructions contained in CPR's GOI and the timetable in effect at the time of this occurrence.

1.15 Regulatory requirements

There are no regulatory requirements for railways to be equipped with trackside detection systems. In addition, there are no regulatory requirements pertaining to the installation, inspection, calibration, and alarm levels for trackside detection systems. Prior to the Railway Safety Act (RSA), issues related to wayside inspection systems (WIS) and the need to inspect rolling stock were addressed by orders of the Canadian Transport Commission (CTC). The CTC order requiring WIS was partially revoked in 1994 and completely revoked in 1995, in accordance with the provisions of the RSA.

In March 2003, Transport Canada (TC) introduced the Hot Box, Hot Wheel, Dragging-Equipment Detector Inspection/Audit Program Guide. This guide is used by TC's Rail Safety inspectors (RSIs) to conduct audits and inspections. During an audit, the RSI reviews and documents the procedures used by the railways to calibrate and maintain their scanning devices, as required by Section 11 of the RSA. This program guide is also provided to the railways as an information document.

TC's Railway Safety Directorate has the mandate to regulate railway safety in accordance with the RSA. The objectives of the RSA are:

• to promote and provide for the safety of the public and personnel, and the protection of property and the environment, in the operation of railways;
• to encourage the collaboration and participation of interested parties in improving railway safety;
• to recognize the responsibility of railway companies in ensuring the safety of their operations; and
• to facilitate a modern, flexible, and efficient regulatory scheme that will ensure the continuing enhancement of railway safety.

Railways are required to adhere to the requirements of Section 11 of the RSA for engineering work. Section 11 states, "All engineering work relating to railway works, including design, construction, evaluation or alteration, shall be done in accordance with sound engineering principles. A professional engineer shall take responsibility for the engineering work." In 1999, TC, in conjunction with Canada's professional engineering associations, developed a guideline for the interpretation of Section 11, "Engineering Work Relating to Railway Works." This guideline was approved and released in early 2001. Section 2.2.3 of the guideline covers railway defect detection systems, including dragging equipment detectors and HBDs.

TC has allowed exemptions to pull-by inspections at CN and CPR, providing these railways use WIS to ensure safety in accordance with the principles of Section 11 of the RSA. Following the Mississauga, Ontario, derailment in 1979, a requirement to inspect trains entering large cities with populations above a specific level was implemented. These inspections could be conducted manually through pull-by inspections or automatically using WIS. The railways chose to use WIS devices, including systems such as HBDs, hot wheel detectors, and dragging equipment detectors. For higher traffic subdivisions close to populated locations, the railways have installed scanning devices approximately 20 to 30 miles apart. However, there are some lower traffic subdivisions where no scanning devices have been installed.

A post-accident review of the inspection and maintenance records for WIS equipment near the accident site determined that there were no deviations from the required procedures.

TC's Railway Employee Qualification Standards Regulations, established in March 1987, require that train crews are knowledgeable on operating rules, railway radio regulations, train marshalling, air brake systems, locomotive operation, train handling, freight car inspection, and train inspection. These regulations require refresher training for crew members every three years.

1.16 Hot box and dragging equipment detector

1.16.1 Detector type and function

The scanner at Mile 82.1 of CPR's Belleville Subdivision was a SERVO System 9000 HBD. A typical SERVO 9000 system is comprised of trackside detection equipment, wayside equipment, and message output equipment. The HBD is designed to scan roller bearings for heat as the train passes through the scanning device. The temperature for each axle is measured in degrees Fahrenheit above ambient air temperature. Each increment of 10°F is recorded as one millimetre (mm) of heat measurement. When heat measurements from opposite bearings on the same axle are greater than a preset difference, or greater than a fixed value for similar bearings, or greater than an average for similar bearings, the HBD alarm is triggered indicating that a possible problem is developing.

In addition to detecting overheated bearings, the SERVO 9000 system has the capability to detect hot wheels and dragging equipment. This system processes input from heat sensing scanners, wheel sensing transducers, and dragging equipment sensors. Scanner data are stored in system memory. These data can be recalled, repeated, and transmitted to the train crew and dispatcher in voice, visual, or hard-copy format at any time.

The scanner has a number of built-in options that allow the railway to customize alarm messages. CPR scanners were programmed to broadcast alarms as two messages: an initial alarm tone when the problem is first detected and then a voice message indicating the suspect location once the entire train has passed through the scanner.

1.16.2 Detector location and inspection points

On the Belleville Subdivision, detectors are located on average every 20 miles, with a maximum spacing of 26 miles. CPR indicated that trains do not have to stop immediately after an alarm at some locations if it is not practicable. Due to the presence of curves, grades, and road crossings, along with the close proximity to the Lonsdale Siding, the scanner at Mile 82.1 was identified as a location where it is not practicable to stop the train immediately. CPR had no record of the risk analysis principles used for deciding on the location of this HBD. CPR indicated that the scanner had been installed prior to the requirement to apply risk assessment principles when determining detector location.

When a WIS alarm is triggered, and if an immediate inspection is not required, the CPR timetable is used to determine where the inspection should be performed. Inspection locations (see Table 1) on the Belleville Subdivision can be as close as 0.8 miles away from the scanner to as far as 5.6 miles away from the scanner. For other CPR subdivisions, the inspection locations range from immediate (i.e. as soon as the alarm is triggered) to a distance of 8.5 miles away from the scanner.

Table 1. HBD locations on the Belleville Subdivision

Location of HBD	Distance from last HBD	Inspection Location Eastward	Inspection Location Westward	Distance from HBD
Mile 18.0	16.2	Mile 15.4	Mile 21	East 2.6	West 3.0
Mile 34.2	22.7	Mile 30.8	Mile 39.5	East 3.4	West 5.3
Mile 56.9	25.2	Mile 52.2	Mile 61.7	East 4.7	West 4.8
Mile 82.1	25.6	Mile 79.8	Mile 86.8	East 2.3	West 4.7Footnote **
Mile 107.7	19.3	Mile 103.5	Mile 111.5	East 4.2Footnote **	West 3.8
Mile 127.0	20	Mile 121.4	Mile 130.3	East 5.6	West 3.3Footnote **
Mile 147.0	17.5	Mile 144.0	Mile 152.2	East 3.0Footnote **	West 5.2Footnote **
Mile 164.5	19.3	Mile 161.3	Mile 169.8	East 3.2Footnote **	West 5.3Footnote **
Mile 183.8	17	Mile 180.0	Mile 188.6	East 3.8**	West 4.8**
Mile 200.4	-	Mile 199.6	Mile 204.1	East 0.8Footnote **	West 3.7Footnote **

Train 410 had passed through the previous scanner at Mile 107.7 with no alarms generated. A review of the scanner download indicated that the average reading for roller bearings on train 410 was 38°F above ambient air temperature. The train speed into the scanner at Mile 107.7 was 37 mph. The speed was 32 mph when the last car passed over the scanner.

The download from the scanner at Mile 82.1 indicated that the train speed into the detector was 34 mph and that the train speed had increased to 37 mph by the time the last car passed over the detector. The average temperature reading had increased to 42°F above ambient temperature, a four-degree difference from the previous scanner. In addition, a scanner alarm had been triggered by the 122nd axle, which was on the 27th car (SOO 18748). The heat differential reading for this axle was 25 mm, the maximum level that can be displayed with this type of HBD.

1.17 Post-accident site examination

Once the site was declared safe for entry, TSB investigators examined the site starting at Mile 82.1 (scanner location) eastward towards the siding switch at Mile 80.5. The following observations were made:

• The scanner at Mile 82.1 was in good mechanical condition.
• The post-accident inspection by CPR determined that the scanner was working as designed.
• The inspection and maintenance records for the scanner were reviewed and no defective conditions were noted.
• Approximately 1100 feet west of the siding switch, the stub of a bearing and some associated parts that were still warm were found in the ditch on the south side of the track.
• Immediately east of Mile 80.9, there were heavy gouge marks on the head of the rail. Intermittent abrasion marks were also noted on track spikes, rail anchors, and ties eastward towards the derailment site. The abrasion marks continued eastward until Mile 80.5 (siding track switch).
• The abrasion marks were predominantly on the north rail of the diverging route into the siding.
• Approximately 53 feet east of the switch point, heavy crushing and gouge marks were observed on the ties. From this point eastward, marks were observed on the tie ends and in the ballast of the siding track leading to the derailment site.
• A loaded car (SOO 18748) with both trucks and axles was found slightly east of the main derailment area and north of the main track. This car was heavily damaged with signs of fire impingement. Marks on the bottom frame of the car (B end, leading end) in the area of the body bolster were noted. Grease spatter was observed on the bottom frame and on the truck components (B end, leading truck, south side). Heavy abrasions were noted on the bottom of the north truck side frame (B end) and on the end of the bolster closest to the north rail.
• Heavy gouging was noted in several locations around the trailing axle (B end, L-2 location). The north bearing of the trailing axle (B end, L-2 location) of the lead truck was found with only the stub of the original axle remaining. Heat deformation was observed on the truck components (leading B end).

1.18 TSB statistical data

Between 1998 and 2002, there were on average 11 derailments per year caused by burnt-off journals (BOJs). Twenty-four per cent of the BOJs occurred on covered hopper cars, while approximately 15 per cent occurred on tank cars carrying dangerous goods.

The TSB database of BOJs only includes reportable occurrences when a derailment, collision, or main track blockage occurs. Many overheated bearings are discovered before they cause a derailment and are not required to be reported under current TSB requirements.

1.19 TSB simulation

The TSB conducted a simulation of the events leading to the derailment. An actual train of similar weight and length, along with locomotives of similar HP rating and braking capability, was operated through the derailment area. The simulation started in Trenton, Ontario, and proceeded eastward through the scanner location (Mile 82.1) towards the derailment site.

The locomotive engineer involved in the simulation was instructed to operate the train using safe operating practices while complying to all TC requirements and CPR instructions. During the simulation, the following additional instructions were given to the locomotive engineer:

• Bring the train speed as close to 32 mph as possible and maintain this speed through the scanner location at Mile 82.1.
• At a designated location shortly after entering the scanner, start making preparations to stop the train.
• After being alerted by radio communication that the tail end of the train has passed over the scanner, start reducing train speed by throttle modulation and dynamic brake only.
• Then, start applying minimal train brake in a safe manner without causing excessive in-train forces. (The locomotive engineer indicated that this procedure could be performed safely without causing excessive in-train forces.)
• Once the train comes to a complete stop, and with the train in full brake set-up, a TSB investigator will mark the location on the track roadbed of the front wheels of the first locomotive.

The simulation results are as follows:

• The train speed at the scanner (Mile 82.1) was 31 mph.
• At the designated location shortly after entering the scanner, throttle was reduced to idle and the train started to decelerate.
• When the tail end of the train was completely through the scanner and with the dynamic brake initiated, the train speed further decreased.
• Once full dynamic brake was reached, the train speed was approximately 14 mph.
• After applying a light train brake immediately after reaching full dynamic brake, the train came to a stop approximately 520 feet west of the facing-point switch at the Lonsdale Siding.
• The train braking effort did not cause any significant in-train forces detectable in the locomotive cab or observed by personnel positioned on the ground.

1.20 TSB engineering analysis

1.20.1 Wheel and bearing analysis

The wheels, axle, and recovered components from the burnt-off journal on axle 122 of the 27th car (see Photo 2) were sent to the TSB Engineering Laboratory for analysis. Both wheels were CJ33 type and had been manufactured in February 1985. No significant grease spatter was observed on either wheel plate. The wheel set "back to back" measurement was within specified limits. There were no significant shelling defects or other tread defects on either wheel.

The bearings were Class E BRENCO 6X11. The burnt-off bearing had experienced significant heat damage, and the outer seal and ring were missing. No grease remnants remained. The cause of the bearing failure could not be determined due to extensive heat damage, which changed the material microstructure and hardness.

The non-failed bearing was removed and examined. There was no pre-existing damage on this bearing. Grease from this bearing was removed and tested. The grease was found to be free of contaminants and to contain minimal water content, which was acceptable given the age of the bearing.

The weight of the loaded car was within allowable limits. However, it is not known whether the load was equally distributed over the car body length, as the contents had spilled from the car during the derailment.

1.20.2 Tank shell analysis

Tank shell specimens from the destroyed tank cars were sent to the TSB Engineering Laboratory for examination. Due to the severe heat damage on these tank shell pieces, it was determined that a metallurgical examination would likely be inconclusive.

1.21 Emergency response

Fire departments and many municipalities have mutual aid agreements for joint cooperation in case of a major disaster. In this occurrence, the fire department from the Township of Tyendinaga was notified immediately after the accident. Given the nature of the accident, the community's Emergency Response Plan was put into effect; neighbouring villages were notified and joined the emergency response. In addition to local and neighbouring fire departments, the Ontario Provincial Police, representatives from various levels of government, railway officials, petroleum industry officials, and site clean-up companies arrived at the site shortly thereafter.

Throughout the response, coordination meetings were held with all involved participants. During these meetings, the participants discussed what action should be taken, the possible response methods, and the impact on clearing operations and evacuees.

2.1 Introduction

An examination of the derailed rolling stock determined that a burnt-off journal at the No. 2 wheel on the 27th car (SOO 18748) of train 410 had occurred. Just prior to the derailment, the roller bearing overheated and seized. The axle then extruded, resulting in a reduction in cross-sectional thickness. After sufficient thinning, the overheated axle could no longer support the weight of the car, leading to a complete axle fracture.

Based on derailment marks on the track, it was determined that the axle failed approximately 3800 feet east of the scanner located at Mile 82.1. The train continued eastward with the 27th car derailed, resulting in damage to the track, roadbed, switch point, and switch heater. When the train reached the west switch at the Lonsdale Siding, the derailed car and the following cars were steered down the diverging route and into the stationary train waiting in the siding.

The analysis will focus on the roller bearing failure, inspections employed to detect bearing failures, instructions, railway requirements related to scanners, and a regulatory overview of scanner technology.

2.2 The roller bearing failure

The cause of the overheated bearing could not be determined due to the extensive damage to the axle journal and roller bearing. An examination of car SOO 18748 after the accident determined that there was grease spatter on the floor underframe, immediately above the failed roller bearing location. However, it could not be determined whether the grease spatter resulted from this overheated condition or was residue from a previously failed bearing, as there is no requirement to remove grease from the undercarriage of a car body from previously failed bearings.

2.3 Crew actions after receiving scanner alarm

When passing over a scanner, an alarm tone is the first indication to the train crew that there may be a problem. However, this initial alarm tone does not provide any indication of the location or extent of the problem. Only once the train is completely past the scanner will a second alarm be broadcast. This second alarm consists of an automated voice message, identifying the nature and location of the suspected problem. Once the alarm is transmitted, the operating crew can refer to CPR's GOI, which identify the appropriate action to be taken. If the second alarm indicates that there is an overheated roller bearing, the conductor will check the train journal to determine the location of the suspect axle and the applicable car number. While the conductor is reviewing the train journal, the locomotive engineer will normally assess the situation to determine the appropriate train handling method to stop or slow the train.

In this derailment, approximately two minutes elapsed between the time the first audible tone alarm was transmitted and when the unsolicited emergency brake application occurred. During this period, the train speed increased from 35 mph to 42 mph. This increased speed contributed to an increase in the number of cars involved in the derailment. Had the train slowed when the first alarm tone was received, the extent of damage and the seriousness of the accident likely would have been reduced.

2.4 Scanner capabilities

The scanner at Mile 82.1 (SERVO System 9000) has a number of programmable features to allow the railway to customize alarm messages. CPR programmed the scanner to broadcast alarms as two messages. Since suspect locations are only identified in the second message, which is broadcast when the entire train is through the scanner, there is a delay that affects how quickly a train crew can respond. In the situation where a long train is involved (e.g. some trains exceed 9000 feet in length), an overheated bearing detected in the front portion of the train would continue along the track for several minutes before the train crew is advised of the suspect location.

Scanners can be programmed to initiate the voice alert as soon as an excessive heat differential is detected. By broadcasting this information immediately, the train crew has additional time to make an informed decision. In critical situations, the train could be stopped immediately. Any delay in transmitting the voice alert increases the risk that an overheated bearing will burn off prior to the train being able to stop.

2.5 Scanner locations

As part of the voice alarm, the train crew is instructed to stop the train for an inspection. However, the train does not have to stop immediately at locations where it is not practicable. The practicability of being able to stop is influenced by the presence of curves, grades, road crossings, and other track infrastructure. The scanner at Mile 82.1 is identified as a location where it is not practicable to stop the train immediately.

CPR indicated that this scanner was installed prior to the requirement to apply risk assessment principles when determining detector location. By locating scanners at locations where it is not practicable to stop immediately, there is an increased risk that roller bearings will burn off before a train can be stopped.

2.6 Operating instructions

CPR's GOI identify the requirements for train crews when they encounter a WIS. These requirements include the specific instructions when passing through a hot box detector and the actions required when an alarm is generated.

When an alarm message is broadcast, the GOI, along with other timetable instructions, are used to determine the appropriate course of action. Subject to a number of conditions, the options are to stop the train immediately to perform the required inspection, or to stop the train at the designated location to perform the required inspection. However, regardless of the situation, train speed should be slowed to 15 mph. In this accident, the speed was increased from 35 mph at the time of the initial alarm to approximately 42 mph, resulting in less time to stop prior to the collision.

The timetable identified the inspection location as the Lonsdale Siding (but not beyond the east end switch of the siding). Further instructions advise that the train should not exceed 5 mph when moving defective equipment over facing-point switches. Without stopping the train to perform the inspection, it is unlikely that the train crew would know the exact location of the defective equipment and be able to slow the train sufficiently to allow defective equipment to travel over the facing-point switch at less than 5 mph. Train 410 encountered a facing-point switch at the west end of the siding.

2.7 Locomotive engineer training

Locomotive engineer training is intended to help students identify and assess the factors affecting train handling strategies. CPR's Locomotive Engineer Training Manual, however, does not include specific training on how train crews respond to alarms from WIS equipment and on the influence of WIS equipment on train handling issues, such as train speed. The instructions in the training manual are based on the GOI that were in effect at the time of the occurrence and do not reflect the changes in the latest version of CPR's GOI. This increases the risk that an inappropriate train handling method will be chosen.

2.8 Train handling methods

In the train simulation, the test train was operated using safe operating practices, which complied with TC requirements and CPR instructions. Using dynamic brakes initially, followed by a combination of train and dynamic brakes, the train was safely stopped approximately 520 feet west of the facing-point switch at the Lonsdale Siding. The simulation indicated that, had efforts been made to control train speed from the time of the initial alarm, followed by normal braking when the voice message was broadcast, the train could have been stopped before reaching the Lonsdale Siding, thereby minimizing the severity of the derailment.

Another factor influencing the choice of train handling method is track condition. Locomotive engineers are advised to exercise care to control the amount of dynamic braking effort in areas where there are temporary speed restrictions. Some speed restrictions are associated with track conditions that do not meet track safety standards for the respective class of track. On track that does not meet standards, the longitudinal forces generated during dynamic braking may exceed the track structure's capacity to resist these forces.

2.9 Regulatory overview of WIS technology

The mandate for TC's Rail Safety Directorate includes ensuring, promoting, and improving railway safety. To achieve this goal, a number of regulatory programs have been developed. In 1999, TC, along with other industry representatives, including Canada's professional engineering associations, developed guidelines for "Engineering Work Relating to Railway Works." However, these are guidelines only. There are currently no existing regulatory requirements specifically directed at WIS.

It is acknowledged that most railways have installed WIS technology to enhance the safety of their operations. However, a number of WIS installations were installed prior to any requirement to apply risk assessment principles when determining their location. At WIS locations where it is not practicable to stop immediately, the trains continue on to a designated inspection location farther away from the scanner. This operational practice negates part of the benefit of having the automated WIS installation. Without regulatory requirements to apply risk assessment or engineering principles, there is the risk that WIS installations may not be located at the most effective locations. In addition, the lack of regulatory requirements related to the maintenance, testing, and calibration of WIS systems increases the risk that this technology is not being used in the most effective manner.

2.10 Event recorders

In this occurrence, the lead locomotive on train 251 was subjected to extreme fire and heat conditions, resulting in damage to the event recorder and the complete loss of data. Since 1992, there have been five other rail accidents investigated by the TSB in which data from the locomotive event recorder were lost due to fire exposure or water contamination.

Although federally regulated railways are required to install event recorders in locomotives when operating on main track, there are no performance requirements in the regulations related to the survivability of the recorder under extreme conditions. Consequently, the absence of design and performance standards for locomotive event recorders impedes the effort to investigate rail accidents and to improve railway safety.

3.1 Findings as to causes and contributing factors

1. The accident occurred when a roller bearing on the south side of car SOO 18748 overheated and seized, resulting in a burnt-off axle journal and the subsequent derailment of 23 cars.
2. Despite being advised of potential defective equipment, the locomotive engineer's decision not to slow the train down to 5 mph or less when travelling over the facing-point switch at the west end of the Lonsdale Siding resulted in a more severe derailment outcome.

3.2 Findings as to risk

1. The delay in transmitting a voice alert immediately after an initial tone alert increases the risk of an overheated bearing burning off.
2. At wayside inspection system (WIS) locations where it is not considered practicable to stop trains immediately for inspection when a hot box detector alarm is triggered, there is an increased risk that a bearing will burn off before the train is able to reach the designated inspection location.
3. CPR's locomotive engineer training does not include specific information on how train crews respond to alarms from WIS equipment, nor on how this equipment influences train handling decisions, increasing the risk that an inappropriate train handling method will be chosen.
4. There are no regulatory requirements for WIS to be maintained, calibrated, programmed or installed, increasing the risk that systems may not be installed at the most effective location, nor used in the most effective manner.

3.3 Other findings

1. Areas where track problems are known to exist may influence the choice of train handling strategies by locomotive engineers.
2. The absence of design and performance standards for locomotive event recorders, including survivability, impedes efforts to investigate rail accidents and improve railway safety.

4.1 Action taken

4.1.1 Canadian Pacific Railway

Canadian Pacific Railway's (CPR) General Operating Instructions (GOI) have been revised and are contained in books 1 and 2, effective 17 May 2004. The specific instructions involving train inspections and hot box detectors are contained in GOI Book 1, Section 5.

Subsequent to this occurrence, CPR modified the software on all wayside detectors such that, while passing the detector, the alarm tone is immediately followed by a radio announcement identifying the nature of the defect (e.g. dragging equipment, hot box or hot wheel).

In 2003, CPR completed a tie replacement program on the Belleville Subdivision.

4.1.2 Transport Canada

Transport Canada (TC) Railway Safety inspectors conducted an audit of employee compliance with hot box detector (HBD) procedures. On 01 March 2004, TC issued a letter to CPR, requesting clarification on the requirement for setting the distance measuring device on the approach to the HBD site. As a result, CPR issued revisions to Section 5 of its GOI.

On 12 March 2003, following a number of derailments in Ontario, TC issued a Notice under Section 31 of the Railway Safety Act, requesting that CPR take corrective action. In response to the Notice, the railway advised that the following corrective actions were taken:

• train inspection forces were alerted to be more diligent in their inspection efforts;
• a poster was developed to highlight bearing inspections;
• training was provided to mechanical and operations staff on roller bearing inspections; and
• as part of an Association of American Railroads committee, CPR is participating in an industry review of roller bearing life.

The TC Notice was subsequently revoked, and TC will continue to follow up on these corrective actions.

TC is currently finalizing the Terms of Reference for the purpose of creating a Project Team on the development of national standards for addressing the survivability of locomotive event recorders. The team will consist of representatives from TC, the Canadian rail industry, and the U.S. Federal Railroad Administration. The scope of the project will be to identify options and provide advice on the potential establishment of comprehensive national standards for locomotive event recorders.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 27 July 2004.