Railway Investigation Report R05E0059

On 03 August 2005, at 0509 mountain daylight time, Canadian National freight train M30351-03, proceeding westward from Edmonton, Alberta, to Vancouver, British Columbia, derailed 43 cars, including 1 loaded car of pole treating oil, 1 car of toluene (UN 1294), and 25 loaded cars of Bunker C (heavy fuel oil) at Mile 49.4 of the Edson Subdivision near Wabamun, Alberta. Approximately 700 000 litres of Bunker C and 88 000 litres of pole treating oil were spilled, causing extensive property, environmental, and biological damage. About 20 people were evacuated from the immediate area. There were no injuries.

Ce rapport est également disponible en français.

1.1 The accident

On 03 August 2005, at approximately 0351 mountain daylight time,^{Footnote 1} Canadian National (CN)^{Footnote 2} freight train M30351-03 departed Edmonton, Alberta, destined for Vancouver, British Columbia. The train consisted of 3 locomotives, 117 loaded cars, 13 residue cars, and 10 empty cars. It was 8547 feet long and weighed 15 562 tons.

The train crew, a locomotive engineer and a conductor, took control of the train in Edmonton. They met fitness and rest standards and were familiar with the Edson Subdivision.^{Footnote 3} The locomotive engineer was qualified to operate trains on the subdivision. Neither he nor the conductor noted any irregularities or problems with the train between Edmonton and the point of derailment.

Recorded information indicates that the train was travelling at 46 mph when a train-initiated emergency brake application occurred at 0509:49.

After making the necessary emergency broadcast and notifying the rail traffic controller (RTC), the conductor initiated an inspection and discovered that the train had derailed with loaded tank cars of Bunker C piled up and perpendicular to the main track.

A total of 43 cars derailed in three separate locations in the train. The first group totalled 28 cars, the 6th through 33rd inclusive. This group included 25 tank cars of Bunker C, a tank car described as containing "LUBOIL,"^{Footnote 4} a loaded car of wood products, and a loaded tank car of toluene.^{Footnote 5} The 43rd car, which contained oats, and the 52nd to 65th cars, which contained an assortment of canola pellets, wall board, and wood pulp, also derailed.

1.2 Weather

The weather was clear, and the temperature was 11°C.

1.3 Particulars of the track

Train movements on the Edson Subdivision are governed by the Centralized Traffic Control System, as authorized by the Canadian Rail Operating Rules, and are supervised by an RTC in Edmonton. Maximum speed is 65 mph for freight trains, and 70 mph for passenger trains. There is a permanent slow order between Mile 48.7 and Mile 53.4, which restricts speed to 50 mph for both freight and passenger trains. This is Class 5 track^{Footnote 6} as defined by the Railway Track Safety Rules. In 2005, the line carried 65 million gross tons (MGT) of traffic.

The village of Wabamun is located at Mile 44.3 of the Edson Subdivision, where track typically runs along the north side of Lake Wabamun. There is a public crossing at Mile 49.25 that provides access for cottagers. It intersects the track at near right angles and runs downhill towards the water.

The point of derailment was determined to be on single main track at Mile 49.25, which is situated in a four-degree one-minute right-hand curve located between Mile 49.13 and Mile 49.37. The track structure was 136-pound continuous welded rail (CWR) installed on concrete ties with large, clean crushed-rock ballast. The high rail was 1993 136-pound Sydney fully head-hardened (FHH), and the low rail was 1995 136-pound Nippon head-hardened rail. Both were in good condition. There is a rail lubricator located on the short tangent between this curve and the 3-degree 32-minute left-hand curve to the east centered at Mile 48.89. The curve at Mile 49.25 is on level grade; it is an intermediate plateau between two 0.2 per cent westward-ascending grades.

1.4 Curve superelevation

The elevation on the curve at Mile 49.25, as measured by a Track Evaluation Systems Test (TEST)^{Footnote 7} car, ranged from 4.32 to 5.53 inches, with an average of 4.99 inches. The maximum imbalance permitted, according to CN's Standard Practice Circular (SPC) 1305,^{Footnote 8} is two inches less than the balance elevation.^{Footnote 9} The maximum elevation allowable, without special permission from the chief engineer, is five inches. The curve elevation was two inches less than the balance elevation and was at the maximum imbalance permitted.

1.5 Recovered rail

Following the derailment, a number of rail pieces were recovered and an attempt was made to reconstruct the high rail of the curve. A defect, known as a detail fracture, was observed on the fracture face of a piece from the curve's high rail (see Photo 1). As more pieces of the high rail were recovered, more detail fracture defects were observed on the fracture faces. No defects were observed on the fracture faces of pieces from the low rail.

To aid in reconstructing the high rail, some key site measurements were taken. Other measurements were determined from analysis of thermite weld positions and bond hole^{Footnote 10} locations identified ultrasonically. Approximately 360 feet of rail, in 26 pieces, was recovered.

1.6 The Hayange Rail

All the rail pieces recovered with detail fractures were from one particular rail, with the following identifying marks:

Branding 136 RE VT HAYANGE 1985 IIIIIIIII
Heat Stamp 3HB C149 R 035

All or some of these identifying numbers were found on the recovered pieces, with the exception of piece 023, which was recovered south of the track and east of the public crossing.^{Footnote 11} A review of CN's Rail Defect Tracking System (RDTS),^{Footnote 12} indicated that this rail-manufactured by the French firm, Hayange-was a maintenance rail 40 feet long and had been installed on 26 August 2003. Eight detail fractures were observed on the broken surfaces of the Hayange pieces. Rail head batter was observed on the east end of three pieces-019, 026, and 033-and three distinct marks were observed on the gauge corner of piece 026.

1.7 TSB Engineering Laboratory report LP 092/2005

Approximately 29 of the 32 feet of recovered Hayange rail were sent to the TSB Engineering Laboratory where a detailed visual examination was made to characterize the nature of the fracture surfaces and document the number, size, and location of the detail fractures. Fractures between the rail sections appeared to be mostly transverse with a bright crystalline or granular surface typical of the overload failure of an inherently brittle material. In total, eight transverse defects were identified; these ranged in size from a low of 3 per cent to a high of 29 per cent of the worn cross-sectional head area. Ultrasonic testing of the rail fragments later revealed an additional five embedded flaws.

After extensive analysis and testing, the following conclusions were made:

• Rail fragmentation was due to the formation of transverse defects along the full length of the 40-foot maintenance rail. These had initiated in regions of shelling,^{Footnote 13} itself the result of high traffic density and loading.
• It was not possible to determine how long the transverse defects had been present or the growth rate of the defects. However, no transverse defects had been detected during the previous ultrasonic inspection, in May 2005. There is also a concern about the difficulty of detecting detail fractures such as transverse defects in the presence of shelling, which could shield the defect from ultrasonic signals.
• Although ultrasonic testing for internal rail defects reduces the risk of broken rail derailments, the detection of all internal rail defects is beyond current systems. Operator training and experience can also influence testing effectiveness.

The Hayange rail was purchased by CN in 1984 to a mill specification supplied by Hayange and incorporated into CN Specification 12-5 in 1986. Chemical analysis showed concentrations of major elements to be within requirements. The rail showed a fully pearlitic microstructure with little or no ferrite.^{Footnote 14} No micro-structural anomalies were found to be associated with the initiation of the transverse defects, and no unusually large inclusions or high concentrations of inclusions were found.^{Footnote 15} Mean section hardness in the centre of the rail met the requirements of CN Specification 12-5. Accordingly, the laboratory concluded, in part:

• No material deficiencies relative to the Hayange 3HB^{Footnote 16} and the original Sydney FHH rail specifications current at the time of installation were considered contributory to the failure.

1.8 Clean steel specifications

Research has shown that inclusions or impurities that become trapped in the steel during the manufacturing process are detrimental to fatigue life. As a result, numerous railways have adopted clean steel specifications, which specify the maximum level of inclusions. The earliest reference to CN's clean steel practices is Specification 12-5 for intermediate hardness rail issued in May 1986. CN issued addenda in August 1986 to specify clean steel practice in its premium and standard carbon Specifications 12-4 and 12-3 respectively. The aim of these specifications was to produce steel with the lowest possible volume fraction, count density, and size of oxide and sulphide particulates. As this was a time of testing evolution for many rail mills, this specification made no reference to any testing methods for determining clean steel and the first such stipulation came in 1993, when it was inserted into CN Specification 12-16.

Following the derailment, samples of Hayange 3HB and Sydney FHH rail were analyzed and compared against Specification 12-16. Although the Hayange steel met CN's specification at the time it was purchased, it was well outside this new specification with respect to the length of sulphide inclusions, and was slightly over the limit for oxides and silicates. The Sydney steel met all requirements, with the exception of the count density and number of inclusions.

1.9 History of the Hayange Rail

The Hayange maintenance rail that developed the detail fractures was a partly worn (PW) rail^{Footnote 17} that was installed on 26 August 2003 at Mile 49.25. It replaced another rail that had been identified with defects through inspection. As stated in CN's SPC 3200 (see Appendix A), track forces must match head wear and wear profile as closely as possible when installing maintenance rails. Records indicate that this maintenance rail most likely came from the high rail on the north track at Mile 43.69, a 2-degree 15-minute left-hand curve. The investigation determined that the date of original installation was sometime in 1986, that is, before Specification 12-16 of 1993.

According to CN records, the plug was removed in 2000. From 1992 to 2000, accumulated tonnage on the rail was 250 MGT.^{Footnote 18} Accumulated tonnage since its 2003 installation at Mile 49.25 was approximately 135 MGT. Total accumulated tonnage, therefore, is at least 385 MGT, for the period in which records are available, and can be conservatively estimated at 485 MGT overall since first installation.

CN's SPC 3200 prescribes the wear limits at which rails should be replaced. In this instance, measurements on the Hayange rail indicated that head wear was 11 mm and that flange wear was 3 mm, both of which are well within prescribed limits.

Although SPC 3200 sets out wear life specifications, it does not discuss fatigue life. CN has, however, developed a Rail Defect Index (RDI) to help in the replacement of defect (fatigue) rail based on its prior defect history. The Railway Track Safety Rules are silent on fatigue life, containing no guidelines for rail life based on either accumulated tonnage or defects.

1.10 History of inspections

Inspection records show that inspection frequency met or exceeded standards prescribed in CN's SPCs and the Railway Track Safety Rules. The last hi-rail inspection before the derailment was on 02 August 2005. No defects were noted in the vicinity of the curve. The only defect noted in the months leading up to the derailment was that the shoulder on the south side of the track required ballast, a situation that was corrected on July 14.

The track in the vicinity of the curve at Mile 49.25 was tested with CN's TEST car on 15 May 2005, and again on 02 June 2005. During the former run, an urgent wide-gauge defect of one inch was detected just east of the crossing at Mile 49.25.^{Footnote 19} During the latter run, a near-urgent warp (deviation in expected cross-level variation between the two rails) was detected in the curve itself. CN records indicate that remedial action was taken immediately after each run.

In April 2005, a hi-rail inspection was made to review replacement plans for 2006 and beyond. It was determined that the high rail in this curve should be replaced in 2006. The reason for the replacement was gauge-corner spalling.^{Footnote 20}

In June 2005, new ties were installed through the crossing at Mile 49.25 to make permanent repairs to the wide-gauge and cross-level defects noted in the TEST runs of May and June. A total of 52 feet of PW rail was also installed through the crossing, eliminating the rail with gauge-corner spalling.

1.11 Rail testing

The Railway Track Safety Rules require Class 5 track to be inspected for internal defects at least once per year. However, according to CN's SPC 3207 (Rail Testing Frequency and Remedial Action for Defective Rails), the Edson Subdivision, as Class 5 track with 65 MGT, would have required five tests per year. For this track, the frequency of inspections exceeded all requirements,^{Footnote 21} with records indicating that the subdivision was tested six times in 2003, six times in 2004, and three times in 2005 before the derailment. The next ultrasonic test for the Edson Subdivision was scheduled for mid-August, less than two weeks after the derailment.

Between August 2003 and the most recent test on 10 May 2005, the rail was tested 11 times. During the last test, no defects were found in the curve at Mile 49.25. The investigation confirmed that the rail flaw detection car was operating properly on that date. Maintenance records and test tapes dating back to January 2003 show that all previously detected defects had been repaired and there were no known defects in the curve at the time of the derailment.

1.12 Surface condition of the rail

The rail on the curve's high rail was CWR, predominantly 1993 Sydney FHH rail. Five repair rails had been welded into place in the vicinity of the point of derailment. The head of the rail throughout the curve had fine head checking,^{Footnote 22} with some minor spalling, but there was no visible evidence of shelling. From a visual perspective, the rail appeared in good condition.

CN performs frequent rail grinding to remove surface fatigue (cracking) and to keep the wheel contact band within the centre of the rail head, reducing the initiation and growth of rail defects.

The records provided by CN indicate that the segment of the Edson Subdivision between Edson and Edmonton was ground twice per year in 2003, 2004 and 2005. This equates to a grinding interval of 30 to 35 MGT.

1.13 Detail fractures

Detail fractures are part of a group of fatigue defects known as transverse defects, that is, where the plane of the crack is perpendicular to the rail's running direction. The detail fracture is a progressive fracture starting from a longitudinal separation near the running surface, or from shelling starting at the gauge corner, and spreading transversely through the head. Detail fractures are a common type of fracture,^{Footnote 23} and the only method to find them before failure is ultrasonic inspection. However, positive identification cannot be made until the rail is broken because the longitudinal separation or seam in a detail fracture is not often exposed. Failure frequently occurs before the defect becomes visible, and generally results in a complete break of the rail.

Photo 1 shows a detail fracture in a rail recovered at Wabamun. The detail fracture is in the gauge side of the head. There is a shell (the longitudinal separation) above the transverse defect, as well as rings indicating the progressive growth of the detail fracture with each fatigue cycle. As the size of the detail fracture increases, less of the head area is available to support the load. The critical size is reached when the remaining head area can no longer support the load; the result is sudden and complete failure.

The size of a detail fracture is commonly recorded as the percentage of head area of a new or unworn rail. In the rails recovered from Wabamun, the largest detail fracture was 21.5 per cent of new head area. There were two defects with approximately 13.5 per cent, and one with 12 per cent. The remaining four defects were less than 10 per cent of head area.

Photo 2 clearly shows the presence of the shell above the detail fracture.

Shell initiation in the rail is a fatigue defect caused by the stresses from passing wheels. As a rail wears due to tonnage over the surface, the combination of non-conformal wheel-rail contact geometry-where the flange comes into contact with the rail head-and sliding friction creates stresses that cause rail surface plastic flow^{Footnote 24} (creep) on the high rail's gauge side and on the low rail's field side. These stresses result in surface fatigue defects (spalling, shelling, and head checks), which mask other internal defects. Plastic flow on the high rail can lead to gauge-corner collapse that yields deep-seated shells or internal inclusions. These act as nuclei for various defects, including transverse ones such as detail fractures. Once initiated, the shells can grow for some length.^{Footnote 25}

Transverse cracks split or branch from the longitudinal shell and start to grow vertically. It is known that the vast majority of shells do not turn into detail fractures. The mechanism by which shells branch and start to grow in a transverse direction is unknown.

CN's SPC 3207 (Rail Testing Frequency and Remedial Action for Defective Rails) defines "shelly" rail as a progressive horizontal separation that may crack out at any level on the gauge side. This SPC, however, mandates no remedial action; neither do the Railway Track Safety Rules, which do not identify shelly rail as a defect.

Shells are difficult if not impossible to find by conventional ultrasonic detection. Their presence can be detected visually as dark spots irregularly spaced on the gauge side of the running surface, or if the cracks branch and grow to the surface, crescent-shaped pieces may break away right at the gauge corner of the rail. The Hayange rail displayed none of these features.

Both SPC 3207 and the Railway Track Safety Rules have identical instructions on remedial action for rails with detail fractures. Depending on the size of the defect, slow orders can be applied or joint bars may be applied and operating speeds reduced to 60 mph.

1.14 Detail fracture growth rate

Research has helped develop models for the growth rate of detail fractures that indicate that the number of detail fractures increases exponentially in relation to tonnage carried. The results have been used to establish rail testing intervals. (Defect growth from initiation to 10 per cent, for example, is relatively slow, whereas the growth rate increases after 10 per cent.)

The three factors that most influence the growth rate of detail fractures are:

1. Temperature Differential - This is defined as the difference between the actual rail temperature and its installed neutral temperature.^{Footnote 62}
2. Residual Stress - These are stresses in the entire rail section and can be tensile or compressive depending on the part of the rail being discussed. Longitudinal residual stress in the rail head is first introduced during the manufacturing process and then modified by the passage of wheels. Detail fractures tend to form and grow in the areas of tensile longitudinal residual stress.
3. Degree of Curvature - The increased lateral loads exerted in curves that increase the magnitude of the wheel load stress cycle.

Of these three factors, temperature differential and residual stress were found to have the most influence on the size of detail fractures.

Plotted below in Figure 1 is the temperature differential for the rail at this location since the May 2005 test. The daytime differential averaged 6 to 9 degrees and 19 to 21 degrees at night. At the time of the derailment, the differential temperature was 21 degrees.

1.15 Residual stress

Rail failures are often related to the relationship between defects and residual stress. Typically, a fracture is the result of a progressive defect, the propagation of which is related to the inherent residual stresses. (Residual stress can be defined as the stress that remains in the material after all external loads have been removed. It results from stresses induced during the manufacturing process,^{Footnote 27} combined with those created during service.^{Footnote 28})

High-contact pressures, such as the alternating stress created by each passing wheel, create subsurface residual tensile stress; subsurface-initiated cracks, in turn, are the cause of 35 per cent of freight train derailments.^{Footnote 29} For given stress levels, the higher the ultimate tensile strength (UTS) of the rail, the more fatigue cycles it should be able to withstand.

Residual stresses have been the subject of much research in recent years, and significant efforts have been made to characterize them. The National Research Council of Canada facility at Chalk River, Ontario, examined a sample of the Wabamun derailment rail, which was free of detail fracture indicators, but which had shell locations marked. It concluded that "residual stress may play a role in shell formation," and "in-service loading could be altering the as-fabricated stress state." Rail failure, therefore, may be a combination of initial residual stresses, service-induced stress (such as repetitive loading), and in-service loads.^{Footnote 30}

1.16 Inability to detect detail fractures

In 1990, the TSB investigated a derailment on Canadian Pacific Railway's (CPR) Aldersyde Subdivision (TSB report R90C0124). The cause was found to be a broken rail from two detail fractures 21 inches apart. The subdivision had been tested that April, some six months before the derailment, but no defects were found.

A review of ultrasonic test tapes revealed indications that should have been recognized by the operator and that would have warranted manual ultrasonic inspection. Following this investigation, the Board made two recommendations.

In August 1994, the Minister of Transport provided information indicating that the railways had increased ultrasonic testing. The Board assessed the response as Fully Satisfactory.

The Department of Transport sponsor research to improve the effectiveness of current rail testing methods. (R92-24, issued January 1993)

Transport Canada (TC) responded that its Transportation Development Centre was working with consultants to develop new technologies for rail testing. This response was assessed as Fully Satisfactory.

In 1993, the Board made two more recommendations.

TC's initial response was assessed as Unsatisfactory; however, in consideration of the continued improvements in detection technology and analytic techniques, the response has been reassessed as Satisfactory in Part.

TC responded that the new technology of rail testing vehicles incorporates pattern recognition software so that detection is not operator dependent. The Board assessed this response as Fully Satisfactory.

Subsequently, TC, in conjunction with CN and CPR, funded research into the adaptation of new technology. Although the results showed potential, considerable further development would have been required to fully develop the system, and funding was ended in 1999.^{Footnote 31} Research on this subject is being continued by other organizations (see Appendix B).

A review of TSB records from 2003 to 2005 shows that rail failures from transverse defects, including detail fractures, resulted in 13 main-track derailments. This represents 24 per cent of all main-track derailments caused by broken rails during that time. Typically in these incidents, however, the frequency of rail testing met or exceeded the minimum requirements.

1.17 Ultrasonic testing of post-derailment rails

In this incident, ultrasonic testing at the TSB Engineering Laboratory found three suspected detail fractures.^{Footnote 32} This was confirmed afterwards by breaking open a rail containing one of the suspected defects. The TSB then hired an independent firm to determine if the two defects could also be found by more conventional methods. A rolling track tester was used to make the first pass, but it found only one defect. This was then hand-tested in the conventional manner, with the probe being moved more or less longitudinally, parallel with the sides of the rail. The operator, however, found no defect.

Later, an expert ultrasonic rail testing technician from the Transportation Technology Center, Inc. (TTCI) used a different hand-testing technique to find more suspected defects. A wedge probe was run at many different angles, right up on the gauge corner and right on the gauge face itself. A total of 11 suspected detail fractures in 7 pieces were detected. It was estimated that these defects were small, all less than 10 per cent head area, and were located in an area of the rail head where conventional ultrasonic equipment cannot test due to its limitations or the shape of the rail. Five rails containing suspected defects were subsequently broken, and in each case, the defects were confirmed as detail fractures. Based on those five samples, and on similar responses observed for the other suspected defects, it is likely that they were also detail fractures.

In March 2006, the TSB, in conjunction with a CN ultrasonic technician, hand-tested pieces of Hayange rail from the curve west of the crossing, as well as one piece from the rail rack at Wabamun. No shell and detail fractures were detected. Portions of these rails were then sent to the TSB Engineering Laboratory, where they were again tested by the TTCI technician. This time, a total of eight detail fractures were found, all of which were very small (estimated to be less than 1 per cent head area).

Appendix D of SPC 3200 describes CN's policy on ultrasonic inspection of PW rail, which seeks to ensure that PW rail installed on Class 3 or greater main tracks is free of internal defects. The piece from the rail rack at Wabamun was marked "UTT July 03." This indicates that it was tested by CN in July 2003 and that no defects were found. Subsequent hand-testing of the three-foot portion of that rail at the TSB Engineering Laboratory found five small detail fractures less than 1 per cent in size. It should be noted that the hand-testing procedure done to find these defects is only viable in a laboratory setting. None of these defects would be detectable using a rolling ultrasonic walking detector used by CN to test rail outside of track or with conventional hi-rail testing equipment and methods that are used in a field/operating environment.

1.18 Rail defect management

Different strategies help mitigate the risks that defects are missed by ultrasonic inspections. Some railways have developed large databases to capture information on track conditions, train activities, and rail defects so as to monitor trends and predict future behaviour. This helps allocate resources more effectively, decreasing the risk of rail failure. Other research has developed models that can be used to monitor rail defects and to establish rail testing intervals to control service defects and hence risk.

CN has developed a Rail Defect Index (RDI) to help in the placement of cold weather speed restrictions, replacement of defect (fatigue) rail and the cascading of used rail based on its prior defect history. The RDI analysis is a risk-based approach that assigns a severity number (from 1 to 10) to each defect. The severity number assigned is based on the defect type, its rapidity of growth, and ease of detectability, with fatigue defects having the highest severity rating and wear defects having the lowest.

1.19 Tank car details

In this accident, the derailed cars containing Bunker C and pole treating oil (PTO) were general purpose, non-pressurized tank cars. A total of 14 of the 25 derailed Bunker C tank cars were built between 1974 and 1976; the remaining 11 were built in 1996 and 1998. The tank shell and head materials specified for all 25 Bunker C cars was 7/16 inch American Society for Testing and Materials (ASTM) A516 grade 70 steel. Heater coils were welded to the exterior of the tank shell to allow for heating the product at its destination. To reduce heat loss, four inches of fibreglass insulation was applied over the tank surface; this was covered with an 11-gauge steel jacket.

The PTO tank car was built in 1994. It was not equipped with heater coils, insulation, or a jacket. The shell material was Association of American Railroads (AAR) TC-128 grade B, which is stronger steel than that used for the Bunker C cars. Nonetheless, the car containing PTO as well as 11 of the 25 derailed Bunker C cars were breached during the derailment.

1.20 Lake wabamun

The derailment site is located within the community of Whitewood Sands, approximately 7.5 km west of Wabamun. The lake itself covers some 82 km², with a surrounding drainage basin about three times its size. About half the surrounding land is used for agriculture, and the lake, which is a source of water for seasonal and permanent residents of nearby communities, is also a prime recreational area. There are natural beaches along much of its shoreline, as well as a provincial park and private cottages. Three coal-fired power plants take advantage of the abundant supply of water and coal strip-mined extensively north and south of the lake. Two First Nations reserves also border the eastern edge.

The derailment affected a land area of approximately 1 km²; this included CN's right-of-way as well as land to the south of the rail line towards the lake's north shore. A portion of the spilled material ended up in the lake.

1.21 Spilled product details

CN estimates that 88 000 litres of PTO and 712 117 litres of Bunker C were lost during the derailment, wrecking operations, and cleanup. In all, 11 Bunker C tank cars lost product.

Bunker C is a multi-purpose heavy fuel oil. It is a black, highly viscous fluid with relatively low solubility. It is not a regulated commodity under the Transportation of Dangerous Goods Regulations. Although it has low inhalation and ingestion toxicity in humans,^{Footnote 33} it has acute, prolonged toxicity to aquatic life.

The Bunker C from the ruptured cars flowed principally along the surface southward towards the lake. Except for the oil that reached the lake, the material accumulated in pools in lower areas and soaked into the soil.

PTO is composed principally of low viscosity, relatively low-solubility mineral oils that will float on water. PTO is mixed with other chemicals and used as a wood preservative.^{Footnote 34} The shipping document for the PTO car indicated that the product under load was petroleum lubricating oil and that no dangerous goods placards were required. While PTO is not a regulated commodity under Transportation of Dangerous Goods Regulations, it may contain regulated materials, such as toluene, benzene and its derivatives, naphthalene and its derivatives, and phenyls.^{Footnote 35} These materials are not present in sufficient quantities to meet the regulatory threshold. According to the Material Safety Data Sheet (MSDS), PTO also contains polycyclic aromatic compounds (PACs). Laboratory testing indicates that prolonged and/or repeated skin contact with certain PACs has been shown to cause skin cancer in test animals.

When the tank car containing the PTO derailed, its contents spilled into a ditch on the north side of the track, where some of it penetrated in the groundwater. The PTO was observed in only two locations on the south side of the CN track: a spring east of the derailment site, and around a decommissioned wooden culvert. The minimal amount of PTO that did reach the lake was quickly diluted.

Although the 33rd car, which carried a load of toluene, derailed, it was not breached and did not leak.

1.22 Transportation of Dangerous Goods Regulations

According to the Transportation of Dangerous Goods Regulations, substances with a flashpoint above 60.5°C but less than or equal to 93°C may be transported by road, railway, or ship (on a domestic voyage) as Class 3 flammable liquids (Packing Group III).

According to the Transportation of Dangerous Goods Regulations, liquids, or liquids that contain solids in a solution or in a suspension, are considered Class 3 flammable liquids if they:

• have a flashpoint less than or equal to 60.5°C^{Footnote 36}; or
• if they are intended or expected to be at a temperature that is greater than or equal to their flashpoint at any time while in transport.

PTO has a minimum flashpoint of 66°C and is not a regulated commodity under the Transportation of Dangerous Goods Regulations.

Bunker C has a minimum flashpoint of 65°C, although, as a blended hydrocarbon, this can vary. Most of the Imperial Oil product has a flashpoint greater than 100°C. If the flashpoint was determined to be less than 65°C, it would be off specification and corrected before loading. If the loading temperature was determined to be above the flashpoint, the tank car would be placarded. The temperature is measured on each loaded tank car. Bunker C is normally stored at a temperature of approximately 70°C to 75°C to facilitate loading. This is above the minimum flashpoint, but below those normally observed. The flashpoint of the oil spilled at Wabamun was measured at 88°C. The maximum temperature recorded for a loaded tank car involved in the derailment, meanwhile, was 85°C when measured after loading, with most tank cars between 70°C and 75°C. Normally, when cars arrive during the summer, the temperature is 50°C to 60°C, even though it can be as low as 25°C in the winter.

1.23 Effects of the spill

The oil spilled into the lake along the north shore. Strong westerly winds and wave action resulted in the oil plume drifting to the north, east, and southeast shoreline, although contamination was limited by booms that helped contain the oil. The spill of Bunker C oil into the lake caused the TransAlta power station, located on the north shore a few miles east of the spill, to temporarily shut down to prevent fouling of the cooling system and turbines.

In July 2006, Alberta Sustainable Resource Development reported that the oil spilled had left no short-term impact on fish.^{Footnote 37} Fish populations, however, are still being monitored to determine any long-term effects.

A wildlife recovery centre was set up immediately after the spill.^{Footnote 38} Due to warm temperatures in the summer of 2006, heavy concentrations of submerged oil in the form of tar balls and particulate oil were released to the surface within various reed beds, causing some waterfowl to become oiled, and a number were found dead throughout 2006. Crews continue to monitor the lake to ensure that existing oil does not spread.

On the day of the derailment, the Capital Health Authority advised area residents to avoid using the lake until further notice. Testing by Alberta Environment (AENV) confirmed the presence of PTO, and a second advisory on August 10, a week after the accident, widened the scope to include both the lake and any wells within half a kilometre. Tests then carried out by the Capital Health Authority showed either no detectable oil or trace amounts that were well below safe-drinking standards. An August 11 advisory, however, urged residents to continue avoiding lake water until the Capital Health Authority was sure that the toxic component levels posed no health risk. Swimming, fishing, and boating were not advised.

The Capital Health Authority continued to monitor water quality, issuing updates on August 26 and 31, and again on September 9 and 30. The water advisories were gradually lifted to allow consumption for some residents, and although fishing and hunting were permitted, consumption of fish or waterfowl was not recommended. In 2006, updates issued on May 19 and 28 placed a voluntary restriction on boating due to potential interference with cleanup activities. Trucking of water stopped in March 2007.

A groundwater monitoring program of over 300 potable water wells put in place by CN began on 08 August 2005, with delineation activities initiated on August 15. Approximately 88 wells were installed to intercept the shallow groundwater table. A total of 126 soil samples and 101 groundwater samples were collected and analyzed. Testing results indicated that groundwater quality results exceeded quality guidelines for drinking water.^{Footnote 39}

1.24 Canadian National incident response and remediation

The derailment occurred at 0509 on 03 August 2005. CN conducted a press briefing at 0900 that morning, and a subsequent briefing at 1330 on August 4. At the August 4 0800 site debrief meeting with all responders and government representatives, CN was asked to update the public. CN indicated that it would set up a 1-800 information line for the public and scheduled a press conference for the afternoon of August 4. CN did not attend a public meeting scheduled by community members for 1100 on August 5. This resulted in some citizens setting up a blockade of CN's main line in Wabamun, temporarily halting CN operations in protest over the apparent lack of progress in containing and cleaning up the oil. The disruption lasted until the evening of August 5, following a meeting with CN.

Following the derailment, CN implemented its Dangerous Goods Emergency Response Plan (DGERP). This plan, which serves as the Emergency Response Assistance Plan (ERAP) filed with TC, details the incident notification process, the Response Management System, and CN's Incident Command System Organization, which facilitates the rapid mobilization and efficient and effective use of resources for dangerous goods derailments. Although the spilled Bunker C caused property and environmental damage, it was not required to be transported as a dangerous good.

The DGERP is also linked with CN's Environmental Emergency Response Plan (EMP 3), which outlines the necessary environmental incident response required of CN personnel. It also contains a summary of applicable federal and provincial legislation. Protecting the environment is of primary concern.

The Unified Command (UC) organization section of CN's DGERP was not implemented. Under the UC, several response agencies are brought together as partners in the response effort, including provincial and regional response organizations, federal representatives and the consignor and its mutual aid emergency response assistance teams. UC is a management concept for coordinating responses to emergency incidents by two or more organizations. It provides guidelines for agencies to work together effectively and allows all agencies with responsibilities for the incident, either jurisdictional or functional, to jointly provide management direction to an incident through a common set of objectives and strategies established at the command level. This is accomplished without losing agency authority, responsibility or accountability.^{Footnote 40}

Although the UC part of the DGERP was not implemented, the DGERP incident-notification aspect of the response process was followed. The rail traffic control centre, network operations centre, CN Police, special commodities officers and environment engineers, commodity shippers, Wabamun Fire Department, and the Royal Canadian Mounted Police were all advised within minutes of the accident. Outside agencies, including Alberta Environment, Environment Canada, Department of Fisheries and Oceans, and Transport Canada's Transport Dangerous Goods Directorate, were also quickly alerted, as was the Capital Health Authority.

As the magnitude of the spill became evident, environmental cleanup consultants and contractors were engaged. The Bunker C oil, because it was still in a liquid state, reached the lake within minutes of the derailment and began to spread over the water immediately. Ditches and dykes were constructed to contain the oil and divert it from the lake. Vacuum trucks helped recover and transfer spilled oil into empty tank cars. Some oil was also recovered by hand-shovelling and with skimmers. Once the dykes were built, no further oil reached the lake. Booms were deployed to contain the spread of the oil on the lake, but local supplies were soon exhausted, and additional equipment was brought in from across Canada and the United States. It was later determined that not all provincial resources were made available to the Wabamun response because of the possibility of not being able to respond to a concurrent environmental disaster.

The initial focus was on containing the Bunker C, which was both very visible and spreading, to prevent product from reaching the lake. It was known early on that a tank car identified on the train consist as "LUBOIL" was involved in the derailment. It was also known that a car of toluene was derailed, but that this car neither tipped over nor leaked. It was not known until much later on August 3 (when it was observed beneath a tank car) that the PTO had spilled. Its potential workplace hazard was neither recognized nor communicated until days later, even though the MSDS for both Bunker C and PTO had been sent to the CN command centre in the early afternoon of August 3 and copies were available.

CN's environmental response proceeded parallel to wrecking operations and restoration of the line. CN worked closely with federal, provincial, and local agencies, as well as area residents, to develop comprehensive remediation and long-term restoration plans for the area. CN also put in place a compensation package for area residents.^{Footnote 41}

1.25 Alberta spill response protocol

Alberta's Dangerous Goods Incident Support Plan (2002) provides a framework for public- and private-sector responses to incidents that have an impact on the public or the environment. The plan helps to clarify the roles and responsibilities of all involved, and to coordinate resources and activities during the response. A protocol for spill reporting and response, established in March 2005, outlines the roles and responsibilities of the various federal and provincial government agencies.

Spills of environmental pollutants must be reported to the Alberta Environmental Hotline, which shares the information with other agencies that have a legislative responsibility. Such "one-window reporting" limits the number of calls required to report a spill; it also allows for information sharing and a more coordinated response. For example:

• Spills that occur during transport must be reported to Alberta Infrastructure and Transportation's Coordination Information Centre (CIC), and to the local police.^{Footnote 42}
• Rail, air, and marine spills also require that immediate notification be given to TC's Canadian Transport Emergency Centre (CANUTEC).
• In Alberta, when a dangerous occurrence is reported or becomes known to CANUTEC or the CIC, each agency will immediately notify the other.
• Alberta Infrastructure and Transportation's Dangerous Goods and Rail Safety Branch also maintains agreements with both Alberta Environment and the Alberta Energy and Utilities Board to share spill information and to provide assistance and technical information.

1.26 Response from Alberta Environment

CN's rail traffic control centre contacted AENV's Emergency Response Centre at 0629 on August 3. As per the response protocol, they then contacted Environment Canada (EC). The local AENV officer was on site early, followed by an EC representative later that morning. Because EC has jurisdiction over CN on the right-of-way, and AENV has jurisdiction over materials that leak or flow off the right-of-way, the two bodies agreed to a joint investigation.

Wrecking operations and cleanup were initially coordinated by CN at a nearby incident command post (ICP).^{Footnote 43} A second CN command post for lake operations was established at the Wabamun Marina, at the village, by midday on August 3.

A standardized, internationally recognized emergency or incident response management system, known as the Incident Command System (ICS), has been developed to effectively manage large incidents such as this one. The ICS provides an organizational framework in which a UC structure can be implemented to coordinate the various responding agencies, creating an integrated response team that makes joint decisions based on common objectives, priorities, and strategies.

In this accident, an emergency operations centre (EOC) under UC was not set up. Although AENV and EC participated in meetings at the derailment site command post, they were not part of the incident command structure. As a result, there were organizational and communication issues.

On August 5, AENV issued Environmental Protection Order EPO-2005/12-CR, ordering CN to contain and clean up the spill; to remediate any soil, surface, or groundwater that had or would come into contact with the spilled substances; and to initiate a public communications strategy. An amendment to this order, issued August 12, added the following requirements, along with details and timelines for their implementation:

• The company shall develop a comprehensive plan for substance management, shoreline cleanup, remediation of the substance release, waste management, and monitoring of the effects of the substances on the lake.
• The Comprehensive Plan shall contain the following:
  • a water-surface management plan;
  • a shoreline plan;
  • a delineation plan;
  • an initial remediation plan;
  • a detailed remediation plan;
  • a short-term monitoring plan;
  • a long-term monitoring plan; and
  • a long-term communications strategy.

CN continued site cleanup work after rail traffic resumed on August 5. As part of the response, a Shoreline Cleanup Assessment Technique (SCAT)^{Footnote 44} team surveyed the affected area to provide an accurate geographic picture and determine cleanup needs and appropriate techniques for each sector. An overall shoreline treatment plan was developed, and post-treatment shoreline evaluations were conducted that fall. The SCAT team returned to the lake in May 2006 to reassess shoreline conditions.

The train derailed when one or more rail breaks occurred under the train.

Neither the condition of the rolling stock nor the manner in which the train was operated is considered contributory to this accident. Defects were observed in several pieces of rail recovered from the derailment site. The analysis will focus on the rail, including mechanical properties, quality and strength, defects, rail management, inspection, and testing practices. The environmental response to this accident will also be discussed.

2.1 Track

2.1.1 Track composition and defects

A number of rail pieces were recovered with pre-existing fatigue defects on the fracture surface. It was determined that all belonged to a single 40-foot piece that had been installed in August 2003. Of the eight pieces recovered - approximately 32 feet in all - there were eight pre-existing defects found on the fracture surfaces. Three of the pieces had some evidence of wheel batter, which would indicate that wheels travelled over the rail after it failed. One of these three had three distinct marks on the gauge corner, which would indicate that the wheel flanges had climbed the flange of the rail.

The pre-existing defects found on the fracture surfaces were fatigue defects identified as detail fractures. These initiated from subsurface shell cracks, which progressed longitudinally in the rail. (The subsurface shell is also a fatigue crack initiated by the repeated passage of wheels. The exact mechanism that leads to a shell splitting and turning downward into a detail fracture is not clearly understood.) Once initiated, detail fractures continue to grow, in turn decreasing the rail's ability to withstand wheel loads. Rail fragmentation is considered the result of the formation, along the full length of the 40-foot maintenance rail, of transverse defects that initiated in regions of shelling, itself the result of high traffic density and loading.

Detail fractures grow beneath a rail's surface and can only be detected by ultrasonic inspection. The last ultrasonic test before the derailment was on 10 May 2005, and a review of test tapes indicates no defect at that time. The tapes also indicate that the rail's surface was in reasonably good condition and did not affect the test accuracy. It cannot be determined if shells above the detail fractures, or the orientation of the detail fractures, prevented the ultrasonic system from detecting any defects. However, given that no defects were detected, and that there is no evidence that a defect was present, the following are the scenarios for the rail's condition at the time of testing:

• no defects were present;
• defects were too small to be detected; and
• defects were present but went undetected due either to their orientation or the presence of the shell.

If left long enough, defects can grow to a critical size, causing the rail to fail suddenly. In this instance, the rail breaks occurred when the pre-existing detail fractures grew, undetected, to critical size.

The Hayange rail that was used as a permanent repair in the curve was a 3HB rail with an average hardness of 302 BHN (Brinell hardness number). The original rail in the curve was 136-pound FHH rail with an average hardness of 363 BHN, manufactured to clean steel specifications. The Hayange rail was rolled in 1985, before CN rails were required to meet clean steel specifications. Had the 3HB rail's mechanical properties, quality, and strength all matched those of the parent rail in the curve, the defects would have been less likely to develop.

CN's SPC 3200, which was in effect at the time the Hayange rail was installed, would have required that any new rail installed in the curve be 136 FHH rail and that it be manufactured to clean steel specifications. This harder rail has been specified for improved wear resistance and greater fatigue strength. Similar requirements do not exist for the selection of maintenance rails. CN's only requirement for the selection of maintenance rail is that the rail wear and profile be similar to the rail in the track.

CN specifications do not require maintenance rails to be of the same quality and strength as the existing rail in track, thereby increasing the risk of defect development, growth, and premature failure in those maintenance rails. Furthermore, the Railway Track Safety Rules contain no guidance with respect to selection or use of maintenance rails.

2.1.2 Track inspection

Ultrasonic inspection is the primary method used to detect internal rail defects and control the risk of rail failures. Over the years, improvements have been made in the field of rail testing, including operator training, additional probes positioned at different angles, and improvements to defect recognition software. This has proven to be a reliable and economical testing method. However, detail fractures cannot in some cases be detected due to their orientation with the surface of the rail or because they are masked by the shell crack above the detail fracture.

Appendix D of CN's SPC 3200 requires that PW rail installed on Class 3 or greater main tracks be free of internal defects. PW rails are tested and marked to indicate that they have been tested, and are then stored for future use. The piece from the rail rack at Wabamun was marked "UTT July 03," indicating that it was tested in July 2003 and that no defects were found. However, subsequent testing revealed five small detail fractures (less than 1 per cent head area) in a three-foot section. Field testing of rail out of track is subject to the limits of current portable testing equipment technology and the detectability of certain defects. Accuracy of post-derailment hand-testing was dependent on the technique and expertise of the probe operator.

Given the limitations of ultrasonic inspections and despite recent advances in ultrasonic technology that have reduced the risk of broken rail derailments, the detection of all internal rail defects remains problematic. The risk therefore remains that, despite the requirements of Appendix D of SPC 3200, rails with internal defects can sometimes be misclassified as free of defects.

2.1.3 Fatigue limits

Rail fatigue depends on a number of factors, including accumulated tonnage, location (curve or tangent), cleanliness of steel, support conditions, grade of steel, and residual stresses within the rail. Under optimal conditions, certain rails can achieve a fatigue life of over a billion gross tons. Total accumulated tonnage on the maintenance rail is known to be at least 385 MGT for the period in which records are available and conservatively estimated at 485 MGT since it was first installed. Including the defects found in post-derailment testing, 19 detail fractures were found in the 32 feet of recovered Hayange rail, strongly indicating that the Hayange rail had reached its fatigue limit.^{Footnote 45}

CN has internally attempted to address the issue of fatigue of rails with the RDI system. The Railway Track Safety Rules, however, are silent on fatigue life, containing no guidelines for rail life based on either accumulated tonnage or defects. In the absence of industry standards for rail fatigue life, rails can remain in track beyond their fatigue limit, increasing the risk of sudden rail failure and derailment.

2.1.4 Defect tracking

Rail defect management is a broad term used to cover a variety of actions to manage rail defects. For the most part, ultrasonic inspection is CN's primary method to manage the risk of rail defects and fatigue life of rail. However, technological limitations on the current ultrasonic inspection equipment allow masked defects and defects outside the detection area to remain undetected. Given the limitations of ultrasonic inspection technology and methods, the continued development of effective complementary defect management strategies is necessary to reduce the risk that defects will remain undetected, grow to critical size, and cause rail failure.

In 1993, the Board stressed the importance of accurate rail testing to identify defects. While rail flaw detection systems have developed over the years, these systems are still not able to detect certain defects. There is room for improvement in the accurate detection of shelling and transverse defects.

2.1.5 Emergency response

Emergency response problems are mainly the result of management decisions, rather than the lack of resources or the failure of tactics. In this instance, the lack of an EOC under the ICS unified command resulted in poor organization and communication, as well as poorly defined roles, responsibilities, and a lack of overall effective joint planning and coordination with emergency responders and government agencies.

The absence of a UC system meant that, in meetings between individual agencies, situational information, operational updates, and other concerns were discussed and then acted upon agency by agency. Had there been an EOC under the joint command of AENV and CN, information flow and inter-agency coordination would have been improved, and overall performance would have been optimized.

The effectiveness of integrating both CN's DGERP and its EMP 3 under a UC was later demonstrated in the response to a subsequent derailment involving dangerous goods at Cheakamus, British Columbia. (TSB report R05V0141). Had the DGERP and EMP 3 plan been activated under a UC system, the management of the spill would have been more efficient. In this instance, it was only after the initial poor communication and confused response to the containment and cleanup of the Bunker C that CN, federal, provincial and local agencies/residents worked closely to develop comprehensive remediation and long-term restoration plans for the area.

Although a spill reporting and response protocol was established under the Alberta Dangerous Goods Incident Support Plan in 2002-and updated in March 2005-resources were not in place to support the response protocol at the time of the derailment. In a province with an extensive petrochemical industry and where large volumes of product are transported by rail, pipeline, and highway, an effective provincial emergency plan to respond to spills of this magnitude could have mitigated its effects. Instead, without sufficient resources in place, the volume of spilled product quickly overwhelmed containment efforts.

2.1.6 Bunker C and pole treating oil

The fact that neither Bunker C nor PTO was being shipped as a regulated commodity under the Transportation of Dangerous Good Regulations may have been a factor in CN's management of the derailment response. The DGERP mandates the establishment of a unified EOC only for incidents involving dangerous goods and that result in offsite consequences; however, the products spilled in this derailment were not classified as such, despite the widespread contamination and property/environmental damage.

Although the Bunker C tank cars carried no placards identifying their contents as dangerous, they were nonetheless in compliance with the Transportation of Dangerous Goods Regulations, which state in part that liquids, or liquids containing solids in solution or suspension, are considered Class 3 flammable liquids if they are expected to be at a temperature that is greater than or equal to their flashpoint at any time while in transit. While these regulations state that substances such as Bunker C and PTO may therefore be shipped as dangerous goods, there is nothing saying they must be, even though, as noted earlier, there is a difference of only few degrees between the measured flashpoint of the spilled product (88°C) and the maximum recorded temperature for a loaded tank car involved in the derailment (85°C). In any event, the Bunker C was not classified as a dangerous good because it was never at a temperature greater than or equal to its flashpoint at any time while in transport.

PTO, meanwhile, contains regulated constituents that, if transported separately, would be identified and placarded as dangerous goods not because of the constituents' toxicity, but because of their flammability. Although PTO is not a regulated commodity under the Transportation of Dangerous Goods Regulations, it is regulated under the Workplace Hazardous Materials Information System (WHMIS), Canada Occupational Safety and Health Regulations and the Canadian Environmental Protection Act. These deal with chemical spills and their effect on human safety and the environment, and they cover many more substances than the Transportation of Dangerous Goods Regulations, which focus more on the containment and transportation of substances.

The accepted industry safety practice is that, when a hazardous workplace substance is identified, a safety briefing is provided to all parties that may come in contact with it. The MSDS for PTO clearly states the physical and chemical properties, health hazard information, and preventive and corrective measures to be taken when exposed to the substance. Although the MSDS was posted in the CN command centre on the day of the derailment and copies made available to all parties, including AENV, the hazardous properties of the PTO and Bunker C were not understood and effectively communicated to enable preventive mitigation of the associated risks to residents, workers, and the environment. In fact, the toxicity did not become widely known and appreciated until days later, when cleanup operations were well under way.

3.1 Findings as to causes and contributing factors

1. The train derailed when one or more rail breaks occurred under the train.
2. The fragmentation of the maintenance rail resulted from the formation of transverse defects along the full 40-foot length of the rail. The transverse defects initiated in areas of shelling that resulted from high traffic density and loading.
3. The rail breaks occurred when pre-existing detail fractures grew, undetected, to critical size.
4. Had the maintenance rail's mechanical properties, quality, and strength all matched those of the parent rail in the curve, the defects would have been less likely to develop.

3.2 Findings as to risk

1. Although it is a common industry practice, the use of maintenance rails of different mechanical properties, quality, and strength as existing rail increases the risk of defect development, growth, and premature failure.
2. Despite the requirements of Appendix D of Canadian National's Standard Practice Circular 3200, rails with internal defects can sometimes be misclassified as free of defects due to the limitations of current ultrasonic inspections and the detectability of certain defects.
3. Despite advances in ultrasonic testing technology, the detection of all internal rail defects remains problematic.
4. In the absence of industry standards for rail fatigue life, rails can remain in track beyond their fatigue limit, thereby increasing the risk of sudden rail failure and derailment.
5. Given the limitations of ultrasonic inspection technology and methods, the continued development of effective complementary defect management strategies is necessary to reduce the risk that defects will remain undetected, grow to critical size, and cause rail failure.
6. The hazardous properties of Bunker C and pole treating oil were not understood and effectively communicated to enable preventive mitigation of the associated risks to residents, workers, and the environment.

3.3 Other findings

1. Had Canadian National's Dangerous Goods Emergency Response Plan (DGERP) and its Environmental Emergency Response Plan (EMP 3) been activated under a Unified Command (UC) system, the management of the spill would have been more efficient.
2. The Bunker C was not classified as a dangerous good because it was never at a temperature greater than or equal to its flashpoint at any time while in transport.
3. An effective provincially developed emergency plan to respond to spills of this magnitude could have mitigated the impact of this accident.

4.1 Action taken

4.1.1 Alberta Environment

Canadian National (CN) and Alberta Environment (AENV) continue to sample and test soil, lake water, and groundwater, and test results are posted on their websites as soon as they are available. AENV is also working closely with the Capital Health Authority to coordinate water-monitoring efforts.

AENV also established an Environmental Protection Commission to review and make recommendations on the province's ability to respond to future environmental incidents. This commission urged a stronger oversight capacity to ensure a better response during emergencies. In response to the Environmental Protection Commission recommendation for the creation of a provincial agency responsible for a comprehensive, all-hazards approach to emergencies, disasters, and security, an Emergency Support and Response Team was established in July 2006. Other recommendations included the establishment of a one-window emergency call centre, the identification of "at risk" water bodies and environmentally sensitive areas, the adoption of an Incident Command System (ICS), and increasing joint emergency response training exercises for all emergency responders. AENV has since adopted the ICS as the structure it will use to manage an environmental incident. There has been extensive training in ICS throughout the department at appropriate levels from those tasked to initially respond as an Agency representative to those that would act as an incident commander in a Unified Command (UC) structure.

4.1.2 Canadian National

CN has undertaken the following initiatives:

1. It established additional response equipment capability, increasing the capacity of existing response contractors for major spills, for both railway and other industries. Response contractors have also increased their own capability through training and additional resources.
2. It strengthened its dangerous goods program with the formation of a dangerous goods group focused on prevention, compliance, and emergency preparedness including enhanced public outreach programs such as the Responder Education and Certification Training (REACT) initiative and the Railroad Emergency Response (RER) course.
3. It reviewed its various emergency response plans (ERPs) and combined them, taking advantage of best practices. The new ERP is used for all emergencies, regardless of the presence of dangerous goods regulated under the Transportation of Dangerous Goods Act. It features a new communications protocol that ensures that key documents are communicated to all stakeholders and recorded in an Incident Command and Supervisor Logbook. The new plan includes detailed incident commander training for key supervisors and an on-line ERP awareness course for all managers and supervisors.
4. It worked with shippers on a suggested joint effort to identify non-regulated commodities that might be environmentally sensitive. These commodities would be entered in Electronic Data Interface (EDI) using a revised description, including a 24-hour emergency contact number.
5. It developed a computer-based reporting and monitoring system for its track personnel. This system will have the ability, once problem locations for either rail wear or fatigue are identified, to track and either ensure that appropriate slow orders are applied or that the rail is removed from service.

4.1.3 Transport Canada

Transport Canada (TC), jointly with the industry, is in the process of developing a long-term strategy to modernize the Railway Track Safety Rules. It is intended that rail testing frequency and effectiveness, as well as rail maintenance and fatigue, will be considered in the review.

4.2 Action required

4.2.1 Rail testing, inspection, and maintenance

The Railway Track Safety Rules do not provide any guidance on fatigue life, nor are there common industry standards for rail life based on accumulated tonnage and the properties of the steel.

CN has developed its own Rail Defect Tracking System (RDTS), which is, in part, able to track the history of maintenance rails. Maintenance rails are selected based on observed wear and conformity to the profile of the parent rail. Neither the quality of steel nor the accumulated tonnage is factored into this decision.

In this occurrence, a maintenance rail failed because it had reached the end of its fatigue life. Because of the way the defects developed in the rail, they could not be identified by the available inspection tools. The rail was installed because it matched the profile of the parent rail; no consideration was given to matching the steel specification of the maintenance rail with the parent rail.

Inspection programs are the primary defence against rail fractures. Recognizing the limitations of existing inspection tools, there is a requirement for additional strategies to ensure that maintenance rails are not installed where they are likely to have a shorter fatigue life than the parent rail.

Taking into account the risk of undetected defect development and premature failure of maintenance rails, the Board recommends that:

Current TC rules focus primarily on geometric criteria and there is no requirement to establish the fatigue life of rails. Furthermore, there are no common industry guidelines for rail life based on accumulated tonnage, defects or steel quality. In the absence of industry standards for rail fatigue life, rails can remain in track beyond their fatigue limit. This increases the risk of sudden rail failure and derailment. Therefore, the Board recommends that:

4.3 Safety concern

4.3.1 Emergency response

In the aftermath of most derailments, there is a need for coordination between federal and provincial environment officials. Environment Canada has jurisdiction over railway rights-of-way on federally regulated railways and the provinces have jurisdiction over materials that end up on lands under provincial jurisdiction.

There was considerable confusion among first responders in the first few days, due in part to the lack of a UC structure and the resultant miscommunications and delays in decision making. As part of the effort to mitigate the spill, booms were immediately deployed to contain the spread of the oil on the lake. However, the local supply was inadequate, and additional equipment had to be brought in from across Canada and the United States to contain the rapidly expanding plume. The investigation revealed that, in order to protect against the possibility of having to deal with other environmental spills, not all emergency equipment available in Alberta was deployed to the Lake Wabamun accident site.

Both of Canada's Class 1 railways already have a detailed and comprehensive ERP to mitigate the risk of environmental contamination of adjacent lands and waterways as a result of railway operations. There is a clear need for railway companies to work with provincial environmental departments to establish a system that allows access to sufficient emergency equipment in the event of a major environmental disaster.

Even though a spill reporting and response protocol was established under the Alberta Dangerous Goods Incident Support Plan in 2002 - and updated in March 2005 - sufficient resources were not in place to support the response protocol at the time of the derailment. In a province with an extensive petrochemical industry and where large volumes of product are transported by rail, pipeline, and highway, an effective provincial emergency plan to respond to spills of this magnitude could have mitigated its effects. Instead, without sufficient resources in place, the volume of spilled product quickly overwhelmed containment efforts.

The Board is concerned that Environment Canada has not established environmental response protocols with its provincial counterparts to ensure an adequate and comprehensive early response to environmental damage as a result of rail transportation accidents.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 20 August 2007.

Appendix A - History of rail defects and rail welding

The maintenance history of the high rail in this curve can be traced to January 2003. Information regarding rail defects, as well as temporary and permanent repairs, is recorded in the Rail Defect Tracking System (RDTS). Item 6 of Canadian National's (CN) Standard Practice Circular (SPC) 3207 states that all visually detected rail defects are to be entered in the RDTS. The RDTS database can capture rail in and rail out^{Footnote 46} and can be used to monitor repairs in continuous welded rail (CWR) to ensure that CWR is properly de-stressed. To supplement the RDTS, interviews were conducted and ultrasonic tapes and welding records were reviewed. Below is a summary of the rail defects and repairs to the curve's high rail.

A review of the RDTS for this curve showed missing records on permanent repairs, the details of which are in Table 1. Specifically, records were missing for permanent repairs to two defects replaced in 2003 and 2004. Furthermore, the system does not have records indicating a temporary repair for a defect found in October 2004, nor for another defect found in January 2005. Data entry for this system was done at headquarters in Edmonton. It was the local supervisor's practice to hang on to records until the permanent repairs were complete. While this practice would account for the missing records regarding the latter two defects, it does not explain why permanent repairs were not listed for those defects repaired in January 2003 and August 2004.

Missing records notwithstanding, a review of documents and the Sperry Rail Service tapes make it clear that these defects were corrected, and that there were no known defects in the track at the time of the derailment.

Table 1. Rail replacement history - High rail of curve at mile 49.26

Date	Action	Record in RDTS
2003.01.17	Ultrasonic inspection finds defect No. 37 - detail fracture size 25 per cent at Mile 49.26, just west of the crossing.	RDTS file has record of the defect.
2003.01.17	Section of rail with defect removed and a 15-foot length of rail is bolted in place.	RDTS has record of temporary repair.
2003.08.26	Two rails are permanently welded in the track. One rail, a 29-foot piece of 1985 Hayange rail, is welded in just west of the crossing. Presumably, this rail was the permanent repair for the elimination of defect No. 37. A second rail, a 40-foot piece of 1985 Hayange rail (the derailment rail), is welded in to replace one or more crushed heads approximately 160 feet east of the crossing.	RDTS has records of these two rails being welded in, but the RDTS record does not reflect that the 29-foot piece was a permanent repair where defect No. 37 was removed. As of August 2005, the RDTS shows defect No. 37 requiring adjustment and welding.
2004.02.04	Ultrasonic inspection finds defect No. 7, a defective field weld at Mile 49.21, approximately 300 feet east of the crossing.	RDTS file has a record of the defect being found.
2004.02.04	A section of rail with the defect is removed, and a 12-foot piece of rail is bolted in place.	The temporary repair is recorded in RDTS.
2004.10.06	A review of the ultrasonic tapes indicates that the joints for defect No. 7 were eliminated and a permanent repair was welded in.	RDTS records did not record the permanent repair for defect No. 7.
2004.10.06	Ultrasonic inspection finds defect No. 8, a detail fracture of size 35 per cent at Mile 49.25, just east of the crossing.	RDTS file has a record of defect No. 8.
2004.10.06	Records indicate that defect No. 8 was removed and that a piece of rail was bolted in place.	RDTS records do not indicate a temporary repair for defect No. 8.
2005.01.25	Ultrasonic inspection finds defect No. 10, a detail fracture of size 15 per cent at Mile 49.29, just east of the crossing.	RDTS system has a record of the rail defect.
2005.01.25	A section of the rail is removed and a 12-foot piece of rail is bolted in place.	RDTS system does not have a record of the remedial repair.
2005.06.10	CN crews install new ties through crossing at Mile 49.26 and weld in a 52-foot piece of Workington 3HB rail through the crossing. This piece of rail eliminates the bolted rail installed on 25 January 2005 and some rail that had gauge-corner spalling.	RDTS system does not have a record of the installation of this rail.
2005.07.13	A section of 400 feet of rail at crossing is de-stressed to the proper rail temperature.	RDTS system did not have a record of this work, but a paper copy with the information to be forwarded for data entry has been completed.

Appendix B - Rail testing

Canadian National's (CN) rail flaw detection cars use ultrasonic transducers to transmit high-frequency sound waves into the rail. A defect, which is a discontinuity created by an internal crack or separation in the rail, is detected when a portion of the transmitted waves bounce off the crack's surface and are picked up by the transducer. These transducers are housed in roller search units (RSUs). There are a number of transducers in each RSU, oriented at different angles so as to detect defects at various orientations. This manages to test the rail's entire cross-section, except for the base outside the portion directly under the web.

Defect recognition software processes the inspection equipment's raw data, and presents it on monitors. If an operator considers an indication to be suspect, the test vehicle is stopped, the operator gets out, and the rail is hand-tested. If a defect is confirmed, it is marked and a following crew changes the rail or otherwise protects it.

Ultrasonic inspection has its limitations, and a 100 per cent accuracy rate is beyond current equipment. Furthermore, such testing is not an exact science: skill, training, and experience are all required to properly interpret data and identify defects. Moreover, operators are required to perform numerous tasks while testing, including monitoring test data as the data scrolls by, and observing rail conditions and track features as the car progresses. Testing accuracy is also affected by rail conditions because grease or dirt on the rail's head, head checking, and internal shelling can interfere with the ultrasonic signal. Defects must be large enough and oriented so that they present a reflective surface large enough to be detected. Deficiencies in any of these areas can-and have-resulted in operator misinterpretation, in defects not being properly identified, and in smaller defects being missed (TSB Safety Issues Investigation SII R05-01 and TSB reports R04C0002, R03C0101, R03E0091, and R05C0012 refer).

A TSB human performance assessment was conducted on a test vehicle on 30 July 2004, and again on 07 March 2005, to determine if, given the limitations of human performance, rail testing was a reasonable task. Although significant judgment is required, it was concluded that the task is manageable for an experienced operator, even if there are factors that can reduce testing accuracy.

CN's contract with its rail testing contractor contains a performance specification for the detection of detail fractures. The criterion for detecting detail fracture defects from shelling or head check is based on the size of the detail fracture (measured as a percentage of the head area). The table below shows the percentage of defects that should be detected.

Size (Percentage of head area)	Percentage of defects to be detected
10 to 20	95
21 to 40	98
≥ 41	100

These contract specifications are stricter than those recommended by the American Railway Engineering and Maintenance-of-Way Association (AREMA). Verification against the contract, however, is difficult if not impossible. CN nonetheless tracks records of broken rails within 30 days of an ultrasonic test, and then the tapes are checked. A review of the records for 2005 indicates that six broken rails were traced to defects that could have been detected by the car but were missed by the operator.

The Transportation Technology Center, Inc. (TTCI), a subsidiary of the Association of American Railroads (AAR), developed the Rail Detection Test Facility (RDTF) to evaluate rail flaw detection technology. The facility uses a section of track containing a number of known defects over which detection cars are run, thereby determining their effectiveness. A 1999 report done for the TTCI analyzed the results of six different detection vehicles,^{Footnote 47} resulting in the following values:

Flaw size (Percentage of head area)	Probability of detection (Percentage)
10	68
20	80
30	88

Therefore, in 1999, technology was not meeting the CN standard, because none of the six cars could detect a defect 10 per cent in size with a probability greater than 80 per cent.

Association of American Railroads report R-963

Research on this issue has been performed by the TTCI. In 2003, the AAR published a report that clearly showed the limitations of current ultrasonic technology.^{Footnote 48}

The report noted that not only can shelling mask the presence of a detail fracture,^{Footnote 49} but a detail fracture's very orientation can also reflect a signal away from the transducer and thereby prevent detection.

These issues have been accepted by railways and the research community. One report, published by the Volpe National Transportation Systems Center,^{Footnote 50} notes that current, non-destructive inspection methods are "highly reliable but not perfect," and that "detection of internal defects under shells or heavy surface damage can be difficult." It concludes that "research is needed to overcome these difficulties."

Ongoing research and development

Research into new technologies and methods continues. AAR report R-963 looks at three developments, the first of which is low-frequency eddy current (LFEC). Work to date indicates that the LFEC system can detect transverse defects below shells, but the technology is still being developed.

A second option is a phased-array technology, which would substantially increase the number of angled probes (from 12 to 64 or even 128). One limitation, however, is the time required to process so many of the signals, which would effectively limit tests to walking speed.

The third option is a laser ultrasonic system that can transmit and receive signals without the transducers being in contact with the rail. This will enable better testing of a rail's web and base, and permit the introduction of signals into the head at angles and locations different from wheel probes. A test of this technology in a production environment is expected in the near future.

Sperry Rail Service is actively focused on increasing rail flaw defect detectability through the following initiatives:

1. research and development of new RSUs with probes at angles to target the detection of defects under shells;
2. development of a comprehensive database of testing to monitor development and growth of defects over time for the purpose of developing testing frequencies; and
3. continued refinement of operator training and certification.

Appendix C - Residual Stress Testing

Mapping of residual stress in rails has been done by several methods and is typically measured in different planes. Residual stresses are typically plotted in the vertical plane (stresses acting from the bottom of the rail head to the top), the transverse plane (stresses acting from one side of the rail head to the other side), and the longitudinal plane (stresses acting along the rail's length). For longitudinal stresses, the patterns typically show a compressive residual stress at the surface and just below the surface of the rail - one balanced by a region of tensile stress in the centre of the head. In the longitudinal direction, this region of tensile stress in the centre has two "fingers" that extend up towards the field and gauge corner. The detail fractures develop in this finger area of tensile longitudinal stress in the gauge corner.

Appendix D - Canadian National maintenance policies

Standard practice circular 3200

Standard Practice Circular (SPC) 3200 provides instructions on rail wear and rail usage. If new rail were to be installed on the curve at Mile 49.26, SPC 3200 states the type to be used; that is, 136-pound fully head-hardened (FHH) rail. New 3HB rail would be permitted on the Edson Subdivision on tangent or curves less than two degrees.

Rails used for maintenance, or for spot renewals, should have the same average wear as the rail in track. The only restrictions with respect to the use of older rails for maintenance are that non-control-cooled rail must not be laid with control-cooled, bloom-cooled, or vacuum-treated rail.

The partly worn (PW) rail installed had a curve-worn^{Footnote 51} profile that was intended to match the curve-worn profile of the existing rail in the curve. The rail was installed with the field side of the PW rail on the gauge side and the former gauge face on the field side.

Improvements in rail metallurgy

Significant improvements have been made in both rail maintenance practices and rail manufacturing, thus improving the wear and fatigue life of modern railway rail. Lubrication has reduced friction at the wheel-rail interface, and reduced the wear rate from wheel passages. Rail grinding has also been used to control wheel-rail contact and to control the depth of head checking, thereby preventing spalling and premature rail removal. Modern premium rails are harder, ranging from 380 to 400 BHN (Brinell hardness number). In rail, steel hardness is proportional to ultimate tensile strength (UTS), so increasing hardness not only improves wear resistance but also fatigue strength. Improvements in rail steel microstructure have resulted in cleaner steel with less impurities and more homogeneous steel, which reduces the number of stress concentrations and improves the rail's fatigue strength.

Research continues on ways to improve rail steel, control wheel and rail profiles (to minimize stress at the wheel interface), and improve rail lubrication (including top-of-rail lubrication), all with the aim of extending rail life.

Rail defect management

Rail defect management is a broad term describing "the creation, implementation, and management of instructions, rules, regulations, and systems to control rail defects."^{Footnote 52} The most serious consequence of a rail defect is derailment. American studies indicate that there is one derailment for every 100 to 125 service defects.^{Footnote 53,Footnote 54} A service defect is defined as a defect found by means other than an ultrasonic inspection; these include defects found by visual inspection and rails that fail in service.

The primary risk-control method for rail failures is testing, and the frequency of testing should be scheduled so that cracks do not progress to the point that they penetrate deep into the rail head where they cause shelling and transverse defects. Defects that are too small cannot be detected, and given that ultrasonic inspection is not 100 per cent accurate, there is the probability that undetected defects remain in track. Therefore, the interval between inspections should be short enough to catch defects before they grow too large and fail.

One method to control rail integrity, developed by the Volpe National Transportation Systems Center, uses self-adaptive scheduling of rail tests.^{Footnote 55} Such scheduling took into account that undetected defects likely remain in the rail, and so the goal was to control, rather than eliminate, service defects by adjusting the interval between tests.^{Footnote 56} The model, which was to be slowly self-adaptive, would dictate a shorter interval between tests if defects increased, and maintain a steady, or increasing, interval should the number of defects fall. Issues, however, still need to be resolved regarding track segment length, double-track locations, and seasonal variations in defect rates.

Other models have since been developed that monitor trends in rail defects and predict future behaviour based on a variety of track and train conditions. These, however, require a large volume of data on reported defects and on the network in general. Indeed, a report by France's International Union of Railways (UIC) states that statistical models "can and do play a major part in rail defect management."^{Footnote 57}

Appendix E - Responding agencies

The following agencies responded to this occurrence:

• Alberta Environment
• Transport Canada's Transport Dangerous Goods Directorate
• Transportation Safety Board of Canada
• Canadian National
• Environment Canada
• Royal Canadian Mounted Police
• Village of Wabamun
• Capital Health Authority
• Department of Fisheries and Oceans
• Wabamun First Nation
• Alberta Sustainable Resource Development
• Public Safety Canada
• Health Canada
• Indian and Northern Affairs Canada

Appendix F - Glossary

AAR

Association of American Railroads

AENV

Alberta Environment

AREMA

American Railway Engineering and Maintenance-of-Way Association

ASTM

American Society for Testing and Materials

BHN

Brinell hardness number

CANUTEC

Canadian Transport Emergency Centre

CIC

Coordination Information Centre

CN

Canadian National

CPR

Canadian Pacific Railway

CWR

continuous welded rail

DGERP

Dangerous Goods Emergency Response Plan

EC

Environment Canada

EDI

Electronic Data Interface

EMP 3

Environmental Emergency Response Plan

EOC

emergency operations centre

ERAP

Emergency Response Assistance Plan

ERP

emergency response plan

FHH

fully head-hardened (rail)

HB

hardness on the Brinell scale

ICP

incident command post

ICS

Incident Command System

km

kilometres

km²

square kilometres

LFEC

low-frequency eddy current

MGT

million gross tons

mm

millimetres

mph

miles per hour

MSDS

Material Safety Data Sheet

PAC

polycyclic aromatic compound

PTO

pole treating oil

PW

partly worn

RDI

Rail Defect Index

RDTF

Rail Detection Test Facility

RDTS

Rail Defect Tracking System

REACT

Responder Education and Certification Training

RER

Railroad Emergency Response

RSU

roller search unit

RTC

rail traffic controller

SCAT

Shoreline Cleanup Assessment Technique

SPC

Standard Practice Circular

STCC

Standard Transportation Commodity Code

TC

Transport Canada

TEST

Track Evaluation Systems Test

TSB

Transportation Safety Board of Canada

TTCI

Transportation Technology Center, Inc.

UC

Unified Command

UIC

International Union of Railways

UTS

ultimate tensile strength

°C

degrees Celsius