Railway Investigation Report R06V0136

On 29 June 2006, at about 1650 Pacific daylight time, Canadian National freight train L-567-51-29, travelling southward on the Lillooet Subdivision, derailed a locomotive and a loaded car of lumber after losing control while descending the grade near Lillooet, British Columbia. The lumber car came to rest at Mile 184.8 approximately 1000 feet below the right-of-way. The locomotive came to rest at Mile 182.5, approximately 800 feet below the right-of-way. Two of the three crew members sustained fatal injuries. The third crew member was taken to hospital with serious injuries.

Ce rapport est également disponible en français.

1.1 The accident

On 29 June 2006, at about 1230,^{Footnote 1} the crew of switching assignment L-567 (the train), known locally as the Exeter Switcher, arrived at Chasm, British Columbia, Mile 213.2 of the Lillooet Subdivision, where locomotive CN 9606 was stationed (see Figure 1). The crew, consisting of a locomotive engineer, a conductor, and a trainman, were experienced in mountain railway operations, familiar with the subdivision, and met fitness and rest standards.

The assigned tasks for the day consisted of switching activities at various locations along the subdivision as far north as Koster, British Columbia, Mile 216.5 (see Figure 2). At the completion of their switching duties, the crew members were to take car CN 625862, a centre beam flat car loaded with lumber, from Koster to Lillooet, British Columbia, Mile 157.6. The weight of the car and locomotive was about 260 tons.

Before departing Koster, the crew applied a sense and braking unit (SBU)^{Footnote 2} to the rear of the car and performed the required brake test and train information and braking system^{Footnote 3} function test. The tests were successful and the end-of-train brake pipe pressure (BPP) was seen to restore.

The trip from Koster to Kelly Lake, British Columbia, Mile 192.6, was uneventful. Approaching Kelly Lake, the train was travelling at about 35 mph. To comply with railway instructions, the locomotive engineer made several automatic brake applications totalling 14 pounds per square inch (psi)^{Footnote 4} to bring the train speed down to the required 15 mph and verify the efficacy of the air brake system before descending the long grade into Lillooet.

While descending the grade, automatic brake applications were made at about Mile 189.0 (22 psi) and Mile 187.2 (25 psi - full service). At about Mile 186.7, while the train was travelling at approximately 27 mph, the automatic brake was placed in emergency and the locomotive independent brake was placed in the fully applied position.

Fearing that their train was out of control, the crew members contacted the train ahead of them to apprise them of the situation. An unsuccessful attempt was made to notify the rail traffic controller (RTC) in Edmonton, Alberta. However, the information was relayed by the train ahead.

When the train speed reached about 35 mph, the conductor applied the hand brake on the locomotive and pulled the operating lever to disconnect the coupling between the locomotive and the car. He then climbed onto the car and began to make his way over the lumber to apply the hand brake located on the other end of the car. With the connection between the locomotive and the car severed, the two began to separate.

At Mile 184.8, having separated from the locomotive by about 200 feet, the car derailed to the outside of an 11-degree, left-hand curve (see photos 1 and 2). The conductor was thrown from the derailing car and sustained fatal injuries. The car came to rest about 1000 feet down the mountain.

The locomotive continued to accelerate. Both the trainman and the locomotive engineer had departed the cab in search of a place to safely detrain but the speed was too great. At Mile 182.5, while negotiating a 12-degree, left-hand curve, the locomotive derailed to the outside and slid about 800 feet down the mountain (see photos 3 and 4). The trainman, who was positioned on the front right footboard, was thrown from the locomotive and sustained fatal injuries. The locomotive engineer, who was crossing over from the right-hand side to the left-hand side at the rear of the locomotive, was thrown off and sustained serious injuries.

At the time of the derailment, the sky was clear and sunny and the temperature at Environment Canada's weather station at Lillooet was 31°C.

1.2 Site examination

The first markings were noted across the top of the outside rail of the curve at Mile 184.8 and were consistent with wheel climb. Near this location, there were also markings on the edge of the right-of-way to the outside of the curve. These markings continued along the right-of-way and down the mountain side to the derailed car. Fifty metres south of the markings on the rail, minor track damage was noted as both rails were slightly misaligned.

At Mile 182.5, markings similar to those at Mile 184.8 were found on the edge of the right-of-way to the outside of the curve, leading down the mountain side to the locomotive. The derailed locomotive had come to rest on its side and burned in a post-accident fire. Its trucks had separated from the locomotive body and came to rest several hundreds of feet away. They were not exposed to the fire.

An on-site examination of the car about one hour after the derailment revealed that the brake rigging did not display any apparent condition that would have precluded its proper operation. Both brake pipe angle cocks between the locomotive and car were open. The wheels were not hot to the touch and did not display any visual signs of thermal damage. The brake shoes were in serviceable condition and did not show signs of excessive braking; however, a number of them had sustained post-derailment damage. The hand brake was found released. A sensor plate on the truck side frame that was part of the ELX empty/load^{Footnote 5} device was missing. The ABDX control valve,^{Footnote 6} the ELX empty/load device and the SBU were recovered and sent to Canadian National (CN) facilities in Winnipeg, Manitoba, and then on to the TSB Engineering Laboratory in Ottawa, Ontario, for inspection. All eight wheels and brake shoes were also recovered and sent to the TSB Engineering Laboratory in Ottawa for inspection.

An examination of the locomotive revealed that the automatic brake valve handle stem was in the emergency position and the independent brake valve handle stem was in the full application position. Both were cut in. The air brake and multiple-unit hose angle cocks were correctly positioned.

The two-stage air compressor had a broken pressure cylinder and the number two main reservoir one-way check valve was found to have the internal spring partially screwed around the check valve (see photos 5 and 6), impeding proper check valve operation. The main reservoir piping from the high-pressure cylinder of the locomotive air compressor to the number one main reservoir and the piping between the main reservoirs, including the automatic water drains, were intact. The derailment and fire damage precluded any further inspections and testing of the air brake components on site.

All wheels were found mounted on axles, except for the L2^{Footnote 7} wheel, which had cleanly separated from the axle and was found lying by itself. The wheel treads showed blue discolouration typical of high-temperature surface oxidation.

The locomotive brake shoes displayed characteristics of heat damage. The lining had delaminated and detached in many areas, creating rough, irregular contact surfaces. Where the lining had not delaminated, the contact surfaces displayed a shiny reflective appearance. The shoes were thin. The thickness of the wearable material in the thinnest surviving areas of the most worn shoe measured approximately 3/8 inch, just at the acceptable limit.^{Footnote 8}

The locomotive was equipped with an event recorder that was severely damaged in the fire. The locomotive event recorder (LER), the air compressor, the check valve, the air brake rack, seven of the eight brake shoes, and all eight locomotive wheels were recovered and sent to the TSB Engineering Laboratory for examination.

1.3 The Lillooet Subdivision

1.3.1 Particulars of the track

The Lillooet Subdivision extends from Mile 157.6 at Lillooet to Mile 312.9 at Williams Lake, British Columbia. The area in which the accident occurred is rugged, mountainous territory (see Photo 7). The track at this location is built into the side of the Coastal Mountains and follows the Fraser River. From Mile 190.8 to about Mile 167.0, there is a descending grade that varies between 1.5 and 2.85 per cent. The railway considers the controlling grade between Fountain, British Columbia, Mile 165.3, and Kelly Lake to be 2.2 per cent for northward movements.

The track through the derailment area consisted of 124-pound continuous welded rail, fastened with elastic fastener clips to tie plates, and screwed to No. 1 hardwood ties with four lag screws per plate. The ballast was crushed rock. The cribs were full. The track was last inspected by a track maintenance supervisor on 29 June 2006. The last track evaluation car inspection was completed on 25 April 2006. No anomalies were noted by either of these inspections. There were no anomalies noted with the track or substructure after the derailment.

1.3.2 Operating Restrictions

Railway speed restrictions required that trains not exceed 20 mph between Mile 191.4 and Mile 158.1. Also, in accordance with the CN British Columbia monthly bulletin re-issue, effective June 2006, the following restriction was in effect for southbound trains between Mile 191.0 and Mile 167.0:

Prior to cresting the grade, trains weighing more than 5000 gross tons and/or when comprised of cars averaging 100 gross tons or more must reduce to a speed not exceeding 15 mph and must not be permitted to exceed that speed until braking effectiveness is seen to be ample.

1.4 Train 567, Exeter Switcher

1.4.1 Normal workload

The Exeter Switcher was assigned a single four-axle locomotive. The assignment worked a five-day week. Its principal job was to set off or pick up cars at customer sidings at Exeter, Chasm, and Lime, British Columbia (Mile 197.5), and prepare outbound blocks of cars for pickup by other freight trains. These blocks of cars were usually placed in the siding at Exeter where they could be handled by six-axle locomotives. The daily turnaround run usually did not go south of Chasm, servicing the customer at Lime about once a week.

The assignment normally worked at Exeter and would tie up at Exeter, with the crew travelling to and from Lillooet by taxi. Occasionally, the job would tie up at Lillooet. When operating over the main track between the various customer locations, the train normally included a small number of cars or consisted of only the locomotives.

1.4.2 Assignment of motive power

Before being acquired by CN, British Columbia Railway (BCR) purchased locomotives with dynamic brakes (DB) for use on this territory due to the need for added braking capability in this mountainous environment. DB is a type of locomotive brake that uses the locomotive traction motors to provide resistance against the momentum of the train. The electrical energy generated is dissipated through resistor grids on the locomotive. Industry considers DB to be a supplementary braking system and a very effective fuel-saving tool. Trains should be able to be safely handled by their air brake capacity alone in the event that DB is rendered inoperative.

BCR generally confined non-DB-equipped units to yard service. The locomotives it normally assigned on the Exeter Switcher were General Electric (GE) B36-7 or B39-8, four-axle locomotives built by GE and equipped with DBs capable of furnishing 40 000 pounds of DB effort at 20 mph. These locomotives were comparable in size and weight to the General Motors (GM) GP40-2L, which CN assigned to the job on the day of the accident.

After CN acquired BCR, CN operating practices, including motive power assignment, were integrated with former BCR operating practices for this territory. Effective 01 April 2006, the former BCR locomotives were removed from service on the Exeter Switcher by CN and replaced by GM GP40-2L locomotives, which were not equipped with DBs. These locomotives were built between 1974 and 1976. There were about 65 still in service with CN in 2006, including 10 similar GP40-2 locomotives.

Motive power assignment is normally based on estimated maximum trailing tonnage requirements and the suitability of the locomotives for the trackage on which they are required to work. In this situation, no consideration was given to the need for supplemental DBs for the safe descent of mountain grades and there was no formal risk assessment performed before removing DB-equipped locomotives from this territory.

CN's June 2006 Pacific Division Monthly Operating Bulletin applicable to the Lillooet Subdivision contains restrictions on operating six-axle locomotives on certain spurs and other tracks at Lime, Chasm, and Exeter. This required the exclusive use of four-axle locomotives for serving customers at these locations.

1.4.3 Locomotive CN 9606

Locomotive CN 9606 was manufactured by GM as GP40-2LUM and is referred to by CN as GF430c. It is a four-axle road diesel-electric locomotive weighing 263 000 pounds and equipped with six 40-inch, Class C wheels, two 40-inch, Class B wheels and industry standard Schedule 26L brake equipment. The truck in use is the Electro-Motive Diesel, Incorporated (EMD) Blomberg-M two-axle truck. The Blomberg-M, as installed under GF-430c locomotives, has a single brake shoe per wheel and uses COBRA® part number V-330 high-friction composition shoes (new product length - 14 inches, width - 3.38 inches, thickness - 2 inches).

1.4.4 Loaded centre beam flat var CN 625862

Car CN 625862 was a 73-foot, 286 K^{Footnote 9} centre beam flat car with a light weight of 61 100 pounds, and a carrying capacity of approximately 110 tons. At the time of the accident, the car had a gross rail load (GRL) of 257 134 pounds, which was within its allowable limit.

The car was 1 of 200 such cars delivered to CN at the TrentonWorks Ltd. facility in Trenton, Nova Scotia. This particular car was delivered on 10 February 2003. These cars were equipped with eight Class C, 36-inch wheels, ABDX-L brake control valves, brake cylinders measuring 8 ½ inches by 12 inches, ELX-B 60 per cent empty/load devices, No. 8 vent valves, and identical foundation brake rigging.

1.5 Recorded information

The fire and heat damage precluded the recovery of any useful data from the LER (see Photo 8). With the actual data unavailable, the investigation sought data for a comparable train trip. On 02 July 2006, a test train with a sister locomotive (CN 9574) and a sister loaded centre beam flat car was operated down the Lillooet Subdivision over the derailment location. The LER data from the resulting run was obtained by the TSB for analysis and comparison purposes.

The SBU from the accident train was a TRAINLINK® ATX ES manufactured by Wabtec Corporation of Wilmerding, Pennsylvania, United States. This SBU can enable a locomotive engineer to initiate both emergency and service brake applications simultaneously at the front and rear of the train, provided the locomotive is also equipped with a compatible TRAINLINK ES input and display unit. However, locomotive CN 9606 was not so equipped. The SBU also performs standard monitoring functions and transmits the following information to the communications logic unit for display to the crew in the locomotive cab:

• end-of-train BPP,
• motion status (moving or stopped),
• marker light status (ON or OFF),
• communications status, and
• end-of-train emergency braking valve status.

The SBU had an integrated satellite global positioning system (GPS) unit. The GPS data can be sent by telemetry to railway ground stations to help monitor train movements. Although the railway did not elect to acquire the GPS telemetry option, the device had been installed on the SBU by the manufacturer and the TSB was able to recover some data. Time, GPS location coordinates, and end-of-train BPP data were downloaded from the SBU. This information showed that:

• there was brake pipe continuity^{Footnote 10} as the train was descending the grade, and
• the SBU had been tested as per railway requirements before the train departed Koster.

Table 1 shows the control inputs that were interpolated from the SBU data.

Table 1. Recorded information recovered from the SBU (Operating BPP was set at 89 psi)

Location	Automatic brake applications
Approaching Kelly Lake	Minimum reduction train brake application is made, 7 psi
Mile 191.4	BPP reduced by 3 psi to 10 psiFootnote 11
Mile 191.4	BPP reduced by 4 psi to 14 psi
Mile 190.0	BPP reduced by 4 psi to 18 psi
Mile 189.6	BPP reduced by 1 psi to 19 psi
Mile 189.4	BPP reduced by 1 psi to 20 psi
Mile 189.0	BPP reduced by 2 psi to 22 psi
Mile 187.2	BPP reduced by 3 psi to 25 psi; full service
Mile 186.7	Emergency brake application initiated

A comparison of the SBU data to the test train LER data disclosed that, although the test train approached the Kelly Lake summit at approximately the same average speed as the occurrence train (20.0 mph near Mile 191.4), and the test train's average speed remained higher than the occurrence train's average speed during the initial phases of the descent, the occurrence train required a much larger sustained service brake application to try to control the speed while descending the exact same grade (refer to Area "A" in Figure 3).

Analysis of data also indicated that the test train and the occurrence train had both been travelling at the same average speed of approximately 29.2 mph near Mile 211.0. Both trains then traversed the same section of track to Mile 206.4, at which point both were once again travelling at the same average speed (approximately 30.7 mph). During the voyage, the occurrence train required a much larger sustained service brake application when compared to the test train, in order to control the speed while descending the exact same grade between Chasm and Clinton (refer to Area "B" in Figure 3).

The test train crested the summit at Mile 190.8, just past Kelly Lake, with the brake pipe reduced from 87 psi to 76 psi, an 11 psi brake pipe reduction or 44 per cent of its service braking capability, while the accident train crested the grade with the brake pipe reduced from 89 psi to 75 psi, a 14 psi brake pipe reduction or 55 per cent of its service braking capability.

At about Mile 189.0, while descending the long hill toward Lillooet, the accident train's brake application had been increased to 22 psi while the test train's brake application remained the same. By Mile 187.2, the accident train's brake application had increased to 25 psi, a full service brake application. The test train maintained an 11 psi brake application until it stopped at Mile 178. The test train maintained a speed near 20 mph after cresting the summit while the speed of the accident train increased to 27 mph by Mile 186.7, where it was placed into emergency.

This investigation marks the first time that data have been acquired from an SBU by the TSB or by anyone else for similar purposes. In the absence of an LER, the SBU provided useful information; however, protocols had to be developed during the process. For a more detailed account of the SBU data and how it was acquired and used, consult TSB Engineering Laboratory Report LP 074/2006, available upon request.

1.6 TSB Engineering Laboratory report LP 115/2006: Calculation of rollover speed and brake force

The TSB Engineering Laboratory calculated the rollover speeds and the residual braking forces^{Footnote 12} available for the rolling stock. The analysis of residual braking forces was made using test results of a load cell brake shoe device or "golden shoe" testing of a sister car and locomotive as a comparison reference. The report shows that:

• Car CN 625862 would have had to attain a speed of at least 50.7 mph to roll off the track in the 11-degree curve at Mile 184.80 (point of derailment [POD] 1).
• Locomotive CN 9606 would have had to attain a speed of at least 60.0 mph to roll off the track in the 12-degree curve at Mile 182.50 (POD 2).
• The residual brake force on the train between the point where the train was placed in emergency and POD 1 was about 6804 pounds, only 19 per cent of the emergency brake capability of the tested sister locomotive and car.
• The residual brake force on the locomotive alone between POD 1 and POD 2 was about 2736 pounds, only 11 per cent of the emergency brake capability of the tested sister locomotive.
• Ignoring the effects of brake shoe friction fade, the air brake capabilities of the tested sister locomotive would have been sufficient to control the train on the grade. However, neither the full service nor the emergency braking capabilities from the sister car alone were sufficient.

1.7 Brake shoes and friction fade

When the automatic brake is applied, heat is generated at the brake shoe/wheel tread interface. The amount of heat generated is proportional to brake horsepower (BHP),^{Footnote 13} which is proportional to speed and brake retarding force. Heavier cars and locomotives need a higher retarding force for speed control when descending grades and therefore generate higher temperatures.

When the thermal capacity of brake shoes is exceeded, the coefficient of friction may be lowered and friction fade can occur. In order for friction fade to occur, the thermal capacity of brake shoes needs to be exceeded for a sufficient length of time. Short-term exposure to high temperatures will not necessarily lead to friction fade.

In order for a train to descend a long mountain grade at constant speed, any reduction in brake retarding force at those wheels where brake shoe friction fade is occurring must be compensated by increased braking effort from the remaining wheels. The application of more brake shoe force can cause these wheels to enter into a brake shoe friction fade condition due to the additional braking effort imposed upon them. Similarly, should the emergency brakes be applied, the friction fade situation could be increased, resulting in a loss of control situation.

This cascading effect can also occur on an individual car because not all brakes produce the same braking effort due to variations in factors such as the brake rigging and brake shoe wear rates. Those wheels that are producing the highest BHP may be the first to encounter brake shoe friction fade, which could lead to a "domino" failure effect in the remaining wheels as conditions degrade.

This serious situation is further complicated by the accelerated brake shoe wear rates at higher BHP levels. For example, the shoe wear rate at 35 BHP per wheel, which is the maximum recommended nominal BHP for a 38-inch-diameter car wheel, will be about double that for the same wheel under a 25 BHP load.^{Footnote 14}

Association of American Railroads (AAR) Specification M-926, issued in 1964, is the standard used to manufacture high-friction composition brake shoes for rail cars. At that time, the standard applied to 100-ton cars with a GRL^{Footnote 15} of 263 000 pounds. The AAR Specification M-926 grade test requires brake shoes to be exposed to a 1450-pound net shoe force at 20 mph for 45 minutes and produce a minimum retarding force of 400 pounds. Although a BHP value is not specified in AAR Specification M-926, this is equivalent to a coefficient of friction of 0.28 and BHP of 21 at a temperature of 600°F (316°C).

Following two catastrophic runaway derailments in the United States in 1997 and 2000, a Brake Shoe Fade Task Force^{Footnote 16} was established to develop an appropriate grade test to address the higher shoe forces present on today's heavier cars. The task force proposed a heavy grade test where the net braking ratios and net shoe force were increased. Improved performance fade-resistant brake shoes were designed to the proposed specification.

The AAR has proposed Specification M-997 entitled Brake Shoe - High Friction Tread Conditioning, High Capacity. It details both new heavy grade test requirements and the existing light grade test requirements found in AAR Specification M-926 for typical high-friction composition brake shoes. The heavy grade test will require that rail car brake shoes apply a 600-pound retarding force when exposed to a 2250-pound brake shoe force for 45 minutes at a speed of 20 mph. Specification M-997 was promulgated 01 November 2008.

There are no specifications detailing grade tests on high-friction composition brake shoes for locomotives; only an optional AAR recommended practice (RP) is currently in place to provide some guidance (AAR RP-599). This practice adopts much of AAR's Specification M-926 in that it duplicates the same net shoe force of 1450 pounds at 20 mph for 45 minutes, but it recommends that a retarding force of 450 pounds be produced as opposed to 400 pounds for cars. Also, RP-599 does not have heavy grade test requirements as does Specification M-997.

1.8 Braking capacity

Calculations were made to determine if the occurrence train speed exceeded the train's braking capacity to stop, due to brake shoe friction fade (TSB Engineering Laboratory Report LP 074/2006). The calculations were based upon methodology^{Footnote 17} applied in two runaway occurrences investigated by the United States National Transportation Safety Board (NTSB).^{Footnote 18}

According to commonly accepted air brake industry standards, and based on accepted design practices, rail cars that have 36-inch-diameter wheels (such as the occurrence train) should not exceed an average BHP of 30. For 33-inch-diameter wheels, the BHP should not exceed 25. The larger 40-inch-diameter locomotive wheels have a practical thermal capacity of approximately 40 BHP per wheel. Recommended industry practice dictates that BHP limits be restricted to 25 when designing any operation involving a mixture of general interchange cars.^{Footnote 19} Although the occurrence car did not have 33-inch-diameter wheels, other cars involved in general interchange usage may have. Literature indicates that these average values will usually result in car wheel tread temperatures in the 400°F (204°C) to 600°F (316°C) range.^{Footnote 20} No published literature was found to indicate what the locomotive tread temperatures would be; however, it is reasonable to assume that they would be similar.

Calculations indicated that the occurrence train would not exceed the theoretical BHP capacity of the 36-inch car wheels (30 BHP) when travelling at up to approximately 20 mph, on descending grades of 1.75 per cent or less. The theoretical BHP capacity for 40-inch locomotive wheels would not be exceeded when travelling at up to approximately 20 mph, on descending grades of 2.25 per cent or less. On steeper descending grades, the BHP limit of the wheels would be reached at lower speeds (see tables 2 and 3).

Table 2. Speed at which maximum recommended thermal capacity of 36-inch wheels is reached

Grade (%)	Speed (mph)	BHP
1.25	31.0	30
1.50	25.0	30
1.75	21.0	30
2.0	17.5	30
2.25	16.0	30
2.50	13.0	30
2.75	12.5	30

Table 3. Speed at which maximum recommended thermal capacity of 40-inch wheels is reached

Grade (%)	Speed (mph)	BHP
1.25	46.0	40
1.50	34.5	40
1.75	28.0	40
2.0	24.0	40
2.25	21.0	40
2.50	18.0	40
2.75	17.0	40

1.9 Dynamometer testing

To better substantiate and validate theoretical predictions and BHP calculations, dynamometer testing was performed at the brake shoe manufacturer's facility (TSB Engineering Laboratory Report LP 074/2006). During the tests, a locomotive wheel was fixed at the end of a shaft and a brake shoe assembly was mounted adjacent to it (see Photo 9). When the wheel was spun, the test brake shoe was applied to the wheel tread to simulate the actual braking of a locomotive. Sensors calculated and recorded parameters such as distance travelled, velocity, wheel tread temperatures, net shoe force, retarding force, coefficient of friction, and brake horsepower. Data from the following sources were integrated into spreadsheets to reconstruct braking activities of the train from 16 to 29 June 2006 for use in the dynamometer testing:

• LER data from a sister CN locomotive carrying out switching activities similar to those which took place on the day of the occurrence.
• LER data from the test train that was operated down the grade subsequent to the accident.
• Track profile information.
• Load cell data collected on a sister locomotive and car to obtain their actual braking ratios.
• Data recovered from the SBU of the occurrence train for activities from a few days before the occurrence up to and including the day of the occurrence.

This work was carried out to further test the hypothesis that brake shoe friction fade occurred in this accident. Dynamometer tests were run simulating the descent of the grade with the locomotive only, with the locomotive and car, with the locomotive and car with inoperative brakes on the car and, finally, with the car only simulating normal brake applications followed by an emergency brake application. In addition, the same input data were used to see if theoretical heat transfer predictions might correlate with the residual stress levels found in the overheated locomotive wheels (that is, correlation with saw-cut test results [see Section 1.11.5]).

The following observations were made from these tests:

• The test of the locomotive descending the grade by itself showed that no friction fade occurred and thermal loads remained within normal operating ranges.
• The test of the locomotive and the loaded centre beam flat car descending the grade at 20 mph with normal brakes (dynamometer test 8130) showed that net brake shoe forces up to 4700 pounds, and varying around 3500 pounds, were required to control train speed. Average BHP values produced were around 41 with higher values closer to 48. Friction fade was observed to take place but at a location much further south than the points of derailment.
• The test of the locomotive descending the grade with the loaded centre beam flat car with inoperative brakes (dynamometer test 8255) indicated the following:
  • The onset of friction fade coincided with the locomotive engineer's recollection of the point at which the train began to accelerate out of control (at about Mile 186.7).
  • The application of the emergency braking increased the friction fade effect, and further accentuated the loss of control.
  • When friction fade was observed to take place, the BHP values coincided with the calculated BHP values from TSB Engineering Laboratory Report LP 074/2006.
  • BHP values varied between 60 and 80 and peaked over 90.
  • The locomotive wheel tread temperatures reached a sufficient level (about 1400°F or about 760°C) to coincide with the metallurgical heat damage sustained by occurrence wheel L2, that is, the worst heat-damaged wheel (see Section 1.11.3).
  • After the wheel was allowed to air-cool, the locomotive wheel tread exhibited superficial blue discolouration, but no visual thermal cracks or heat checks, which matched the condition of the occurrence locomotive wheels.
  • The test brake shoe wear rate significantly increased and large quantities of smoke were produced once friction fade was encountered at high BHP values.
  • The test brake shoe was worn down to the backing plate.
  • During the simulated brake shoe wear-in and conditioning, before the final descent at Kelly Lake, superficial tread discolouration that had resulted was observed to wear off such that it was no longer visible.
• The tests performed on the car wheel which simulated normal brake applications followed by an emergency brake application (as per SBU data) yielded the following observations:
  • After one hour of air-cooling, the residual wheel surface temperatures were observed to be hot to the touch (about 175°F).
  • The wheel tread was observed to be discoloured blue.
  • The wheel tread did not exhibit any visual indication of heat checks or thermal cracks.
  • The post-test condition of the test brake shoe showed some signs of overheating.

1.10 Locomotive and car wheels

The wheels in this occurrence, and the vast majority of locomotive and car wheels in service in North America, are made of steel designed and heat treated to produce the desired metallurgical characteristics. The metallurgy creates a favourable residual compressive stress distribution in the wheel rim and a hardened outer surface. The compressive stress helps to improve fatigue crack resistance and the hardened outer surface enables the wheel to better withstand contact fatigue and the types of wear they are exposed to during normal railway operations.

When wheels are not exposed to excessively high BHP, the deformation and stresses are elastic and the wheels return to their original state when cooled. However, train operations on long descending grades can have large BHP requirements and generate large quantities of heat. If a wheel is subjected to heavy braking over long enough periods of time, the thermal stresses may be sufficient to cause the wheel to deform beyond the elastic limit of the steel. This results in a reduction in the wheel residual compressive stress levels. If the heat exposure is large enough, the residual compressive stress in the wheel may be reduced to zero and then be reversed, creating residual circumferential tensile stresses in the rim of the wheel upon cooling, damaging the wheel.^{Footnote 21}

Thermal damage weakens the wheel and makes it more susceptible to failure. If the residual circumferential tensile stress is large enough, the wheel can fail catastrophically in an explosive manner (that is, rapid fracture that forcibly ejects pieces of the wheel) or progressively by an accelerated shelling process (that is, accelerated contact fatigue).

Railway wheels are classified according to heat treatment and carbon content. Since carbon content affects hardness and toughness,^{Footnote 22} the classes of wheels have different recommended uses. High carbon content wheels (Class C) are harder and more brittle, they shell less but have a lower overall thermal capacity, and are preferred where loads are heavy but braking is light.^{Footnote 23} Medium carbon content wheels (Class B) are preferred for high-speed service with severe braking conditions and heavier wheel loads.^{Footnote 24} Class B or C wheels are used for freight cars in interchange service^{Footnote 25} and are recommended for use on locomotives.

1.11 TSB Engineering Laboratory analysis of locomotive and car wheels and brake shoes - LP 074/2006

1.11.1 Visual Inspection of the Car and Locomotive Brake Shoes

The eight car shoes were high-friction composition shoes. All shoes were worn but were within AAR^{Footnote 26} acceptable limit, which is that car brake shoes possess a minimum of 3/8 inch (1 cm) of wearable material, including lining and backing plate. Four of the eight shoes displayed areas where large chunks of the wearable material had separated from the assembly. This separation appeared to have been caused by secondary damage as a result of the derailment. Some small narrow regions of wearable material had also separated from some of the brake shoes, predominantly creating shallow trenches orientated along the longitudinal axis of the shoes (that is, along the circumferential direction of the mating wheel). In the remaining areas, the patterns observed appeared typical of normal wear, and no signs of excessive heat were apparent (see Photo 10).

The seven recovered locomotive brake shoes were all high-friction composition brake shoes. The shoes were worn thin in some areas but were within the AAR acceptable wear limit of 3/8 inch.^{Footnote 27} In contrast to the car brake shoes, the locomotive brake shoes displayed characteristics of being significantly overheated. The lining of the shoes had delaminated and detached in many areas, creating rough, irregular contact surfaces that are indicative of overheat damage (see Photo 11). The heat damage had not been caused by the post-crash fire because the trucks and wheels, with brake shoes attached, had separated from the locomotive during the derailment and were found a considerable distance from the post-crash fire area. The tread contact surface on the brake shoes displayed a shiny reflective appearance in most regions where the lining had not delaminated.

1.11.2 Visual Inspection of the Car and Locomotive Wheels

Markings indicated that the locomotive wheels were type T40A 40-inch wheels manufactured by Griffin Wheel Company. In contrast to the car wheels, all of the locomotive wheel treads showed blue discolouration due to high-temperature surface oxidation (see Photo 12). Laboratory analysis showed that, when the tread was lightly buffed, the blue discolouration could be readily removed, which indicated that it was only a superficial layer. There were no thermal crack patterns or heat checks visually apparent in the treads or flanges.

When the wheels were compared to other locomotive wheels that had not been overheated, no striking differences in their external appearance were found (excluding the blue discolouration of the tread). Visual inspection by railway technical experts could not detect the difference between these overheated wheels and other undamaged wheels.

1.11.3 Etching

Cross-sectional samples of the wheel treads from the eight locomotive wheels were etched and metallurgical analyses revealed tempered martensite close to the tread surface of wheel L2 to a depth of about 5 mm. The normal microstructure of railway wheels is ferrite-pearlite. For the microstructure of this wheel to have changed would indicate that it has been heated above a temperature of about 1340°F (727°C).

Microstructural analysis of the remaining wheels showed that three other locomotive wheels exhibited a mainly uniform microstructure of ferrite-pearlite, with some patches of bainite. Although bainite is somewhat similar to tempered martensite, it is normally associated with temperatures slightly lower. The remaining four locomotive wheels displayed typical ferrite-pearlite microstructure.

1.11.4 Magnetic particle inspection

A magnetic particle inspection of the locomotive wheels revealed a series of small superficial cracks in the wheel treads and flanges both in the transverse and longitudinal directions. These cracks can act as stress concentration sites, or risers, which can initiate failure mechanisms, particularly in thermally damaged wheels.

1.11.5 Saw-cut tests

Saw-cut testing on the car and locomotive wheels was performed to quantify their residual stress. A radial cut with a band saw from the tip of the flange toward the centre of the axle was made. As the cut was taking place, the circumferential displacement of the wheel at the flange was measured to determine the amount that the cut width was decreasing (due to the presence of residual compressive stress) or the amount that it was increasing (due to the presence of residual tensile stress).

The test results indicated that the residual compressive stress in all eight locomotive wheels had been altered. A typical newly manufactured type T40A locomotive wheel would be expected to display a cut displacement of approximately -0.020 inch (Note: The negative sign means the cut width is decreasing or is under compression) at a cut depth of five inches. Two of the locomotive wheels (serial number 59304, Class B, and serial number 36319, Class C) displayed a displacement less than one-half of the referenced value (-0.008 inch and -0.009 inch, respectively). Although wear of the wheel treads may account for some of the loss in compressive residual stress, it is probable that some may also have been due to thermal damage. The remaining six wheels displayed a complete loss of compressive displacement at the referenced saw-cut depth. The compressive displacement was replaced with tensile expansion. Tensile expansion indicates the presence of a residual tensile stress. The locomotive wheel that displayed the greatest residual tensile stress (cut displacement +0.019 inch at a depth of five inches) was a Class B wheel. The presence of residual circumferential tensile stresses in the rim is consistent with the wheels having been thermally damaged.^{Footnote 28}

Saw-cut tests conducted on all of the car wheels indicated that the residual compressive stress appeared typical of a new as-manufactured car wheel. There was no evidence that the car wheels had been heated enough to alter the wheel's characteristics.

A saw-cut test was subsequently carried out on the locomotive dynamometer wheel. The data points obtained to a cut depth close to 2 inches (5.1 cm), which corresponds to a tread depth of about ½ inch (1.3 cm) if the flange height is taken into account, essentially mimicked the test results obtained for the worst heat-damaged wheel, wheel L2 (serial number 59180), from the occurrence locomotive. Both wheels exhibited a loss of compressive residual stress to an approximate neutral stress state at this depth. The dynamometer wheel suddenly fractured while it was being cut at this location. The fracture measured 0.045 inch (1.14 mm) wide and approximately 1 foot (31 cm) in length, extending from the saw-cut. The crack propagated completely through the tread toward the centre of the wheel, whereupon it changed direction along an arc, such that it began to propagate circumferentially in the wheel plate near the axle.

1.12 Canadian National and Association of American Railroads instruction regarding heat-damaged wheels

Operationally, CN advises its locomotive engineers that the following conditions will contribute to the overheating of locomotive wheels:^{Footnote 29}

• using the independent brake valve at speeds above 15 mph,
• applying the independent brake with the throttle in power position,
• creating excessive brake cylinder pressure, and
• applying the independent brake in excess of half a mile.

Therefore, wheels need to be measured and inspected for defects to ensure good performance while in service. Visual inspection techniques are used as the primary means to detect an overheated wheel condition, prior to dispatch.^{Footnote 30} Hot wheel detectors that form part of wayside inspections systems are used to identify overheated wheels in service. There are a number of different heat-related defects that can be present in heat-damaged wheels. Heat checks are an example.

The AAR defines heat checks as follows:

Brake shoe heating frequently produces a fine network of superficial lines or heat checks running in all directions on the surface of the wheel tread. This is sometimes associated with small skid burns. It should not be confused with true thermal cracking and is not normally a cause for wheel removal.^{Footnote 31}

No description of thermal or heat checks was found in the CN Locomotive Inspection Handbook, which is issued to locomotive engineers. However, the following guideline is provided:

Stuck or dragging brakes can result in an overheated wheel condition. This condition is identified by blue or reddish brown discolorations on the front and back face of the plate.³²

Thermal cracks are another more serious defect that can be present in overheated wheels. The AAR defines thermal cracks as:

Cracks which occur cross-wise on the tread and may be confined to the tread or flange or, in extreme cases, may go through the entire tread and into the plate.

The AAR indicates that thermal cracks are caused by intense brake heating. It also advises that thermal cracking is a serious defect and, in any stage of development, is cause for the immediate removal of the wheel from service.^{Footnote 33}

Regarding thermal cracks, the CN Locomotive Inspection Handbook says:

Thermal cracks in the tread or rim are condemnable, because they risk wheel breakage. Thermal cracks are detected visually and condemnable at any time. Thermal cracks are transverse to rim or flange (running across wheel tread and rim). This condition is caused by too much heat, generally the result of excessive braking. Do NOT confuse thermal cracks with thermal or heat checks.^{Footnote 34}

1.13 Locomotive one-way check valve and two-stage compressor

Subsequent to the recovery of the defective one-way check valve, a series of leakage tests was performed on another CN GM locomotive in Lillooet Yard with similar brake equipment. A blow-back test^{Footnote 35} of the one-way check valve was performed. The one-way check valve did not hold, and the main reservoir pressure dropped from 140 psi to 90 psi (standard equalizing reservoir and BPP settings on CN) in four minutes, and below 43 psi (minimum train BPP required to ensure emergency brake action on a freight car) in eight minutes. The locomotive was removed from service by CN and repaired.

The one-way check valve, between the number one and number two main reservoirs, serves two purposes. The first is to ensure the retention of a sufficient quantity of high-pressure air to allow the locomotive engineer to bring the train to an emergency stop in the event of a catastrophic loss of the high-pressure air supply. The second is to allow the number two main reservoir to charge to standard BPPs when the locomotive is operated "dead in train" and the dead engine cock is in the IN position. This is to ensure that the brakes of the "dead in train" locomotive respond to service brake applications without any loss of air from the number two main reservoir.

Testing demonstrated that such a defective one-way check valve could compromise control of the air brakes on a single locomotive provided there was also a loss of main reservoir air. This could occur if the locomotive two-stage air compressor was inoperative and main reservoir air was depleted.

Laboratory examination (LP 074/2006) of the locomotive compressor indicated that the broken cylinder head failed in overload. No pre-cracks or pre-existing metallurgical defects were found contributory to the failure. The laboratory analysis concluded that the compressor broke due to a post-derailment lateral impact.

1.14 Loaded centre beam flat car CN 625862

1.14.1 Simplified Description of Freight Car Air Brake System Operation

The car air brake system consists of mechanical rigging and air brake components operated by compressed air from the locomotive. During normal or service air brake applications, the locomotive engineer reduces BPP at a slow, controlled rate. This reduction in pressure is transmitted along the entire length of the train through the brake pipe. The reduced air pressure causes the control valve on each car to operate and allow air to flow from the auxiliary reservoir through the control valve to the brake cylinder. The air pressure causes the brake cylinder to operate, which in turn causes the brake rigging to move and the brakes shoes to apply against the wheel treads.

With an emergency application, BPP is reduced more rapidly than during a normal or service brake application. This faster rate of drop in BPP is sensed by the control valves on each car, which allow air from both the emergency and auxiliary reservoirs to flow to the brake cylinders, thus causing the brakes to apply at a faster rate and with greater braking force.

When the brakes are released by the locomotive engineer, BPP throughout the train is increased back to its normal operating pressure; that is, 90 psi. The control valves on each car sense the increase in BPP and allow the brake cylinder pressure to vent to atmosphere and both the emergency and auxiliary reservoirs to recharge.

1.14.2 Net braking ratios

The braking ratio of air brake systems on railway vehicles is defined as the ratio of the net shoe force to vehicle weight. Generally speaking, the higher the braking ratio, the higher the retarding force for train braking. However, cars with too high a braking ratio can result in sliding of the wheels when they are empty. Conversely, cars with too low a braking ratio risk having inadequate braking when they are fully loaded. Braking ratios must be chosen to balance the requirements of both the loaded and empty condition.

In circumstances where the difference between the empty weight of the car and the loaded weight of the car is such that retarding force cannot be kept below the wheel/rail friction limit by design braking ratio alone, empty/load devices are used. These devices provide reduced braking effort for empty cars so that wheel slides are prevented.

The occurrence car was built to meet the net braking ratio (NBR) requirements of AAR design standard S-401-99 (see Table 4). A higher standard is required for cars built after 01 January 2004.

Table 4. Net braking ratio requirements - AAR design standard S-401

All new cars	Loaded Car		Empty Car
Date	Minimum	Maximum	Minimum	Maximum
From 01 February 1999	8.5%	13%	Nil	38%
From 01 January 2004	11%	14%	15%	32%

Brake shoe force testing was performed on sister car CN 625825 in Winnipeg in July 2006. The service brake application tests produced a total truck brake force with the empty/load device in the load position of 18 668 pounds. Dividing this total force by the 286 000 - pound maximum GRL of a loaded car gives a loaded braking ratio of 6.5 per cent. The car, as tested with the empty/load device and control valve from the derailed car, did not meet the AAR design standard S-401-99 for minimum braking ratio for a loaded car of 8.5 per cent. However, this standard is applicable to new cars only, unless application is made for rebuild status with a change in carrying capacity, or some other major alteration to the car. The test was designed to allow for some degradation of braking performance in the first one to three years of service life.

In April 2007, brake shoe force tests were conducted in Prince George. Three cars, CN 625870, CN 625899 and CN 625863, were tested. The results of these tests were as follows:

• CN 625870 loaded braking ratio: 9.04 per cent
• CN 625899 loaded braking ratio: 8.86 per cent
• CN 625863 loaded braking ratio: 8.74 per cent

At the 2004 Technical Conference of the AAR Air Brake Association, a paper titled Increasing Train Safety and Capacity with a Better Brake Shoe stated:

Car weights have increased from 220,000 pounds to 286,000 pounds and are headed higher . . . S-401 recommends a loaded car NBR of between 12% and 12.5%. The changes were made to provide improved grade braking. Some railways, notably CN and CP, have built 263,000 pound coal and grain cars at well above the minimum NBR specification for many years to ensure adequate braking performance on steep grades in unit train service.

1.14.3 ABDX-L control valve

The control valve regulates the flow of air between the air brake reservoirs and the brake cylinder. Control valves consist of two portions - service and emergency - mounted on either side of the pipe bracket. The service valve portion primarily reacts to controlled changes in BPP initiated by the locomotive engineer. The emergency valve portion primarily reacts to sudden reductions in BPP to propagate an emergency application of the air brakes, which may be either unintentional or crew-initiated.

Bench testing of the ABDX-L control valve from the car conducted immediately after the accident showed that it operated properly. The valve was subsequently sent to the TSB Engineering Laboratory for analysis (LP 074/2006). Among the observations made was the discovery of a white powder located at a hole near the vent valve. Energy dispersive X-ray (EDX) analysis of the white powder shows a complex spectrum with the major constituents being aluminum, zinc, and sodium, probably in an oxidized state. Lesser amounts of other elements, including silicon, sulphur, chlorine, chromium, manganese, and iron, were detected. The analysis is consistent with the powder being a corrosion by-product produced by a manufacturing process.

Further inspection of the emergency and service portions of the control valve showed that some passages in the casting of the emergency portion were contaminated with metal turnings, some of which were found next to the inshot piston diaphragm and near the inshot piston valve. A test conducted by the manufacturer, Wabtec Corporation, on a similar ABDX-L control valve determined that the valve responded properly to both service and emergency brake demands with contamination placed in the emergency portion of the valve as found at disassembly. Notwithstanding the results of these tests, TSB analysis determined that the metal turnings in the emergency portion, near the inshot piston and the inshot piston valve, have the potential to adversely affect operation of the inshot piston valve and consequently adversely affect service braking (TSB Engineering Laboratory Report LP 074/2006).

Stereomicroscope and scanning electron microscope examination of the fragments found on the inshot piston diaphragm identified them as turnings or "swarf" from a metalworking operation. EDX analysis of the turnings showed an aluminum-silicon base material similar in composition to casting alloys used to construct the control valve. Records indicated that the occurrence control valve had not been opened for servicing since the time of manufacture; therefore, the turnings were probably deposited in the valve at the time of manufacture.

1.14.4 Sensor plates and empty/load devices

Empty/load devices are intended to sense whether the car air brake system should brake as a loaded or empty car. When a car is empty, the sensor arm travels farther because the car springs are not compressed. The empty/load device interprets the extra travel of the sensor arm to mean that the car is empty and therefore reduces the air brake pressure to 60 per cent for a car that has approximately 20 per cent or less of its loaded weight. A car carrying 20 per cent or more of its loaded weight causes the empty/load device to sense the loaded condition and provide full (100 per cent) brake cylinder pressure.

The ELX-B 60 per cent empty/load device that was on the occurrence car was secured to the underframe of the car body, and its sensor arm swings down when an air brake application is made. This causes the sensor arm to contact the sensor plate, which is welded to the top of the truck side frame (see Figure 4). The sensor plate provides a smooth flat surface upon which the foot of the empty/load device would contact when the train was in motion (that is, the empty/load device is mounted on the car body but the sensing arm on it contacts the truck that rotates independently). Bench testing of the empty/load device from the occurrence car showed that it operated properly. Further inspection revealed that it had retained its original factory settings.

During examination of the accident car and several other cars (at Joffre, Quebec), as well as subsequent air brake testing of similar centre beam cars (at Winnipeg and Prince George), TSB personnel noted that many of the cars were missing the sensor plate (see Photo 13). Of the nine cars that the TSB examined, five had missing sensor plates: the accident car, the car examined at Winnipeg, one at Prince George, and two at Joffre. Of the four remaining cars, one had a sensor plate that was replaced in the field. It was not as per the original manufacturer in size and shape.

The manufacturer of the empty/load device (model ELX-B 60 supplied by Wabtec Canada Inc.) states that the contact ball of the adjustment screw on the sensor arm must contact a flat and level surface throughout the appropriate amount of truck swing the car would encounter, including lateral and vertical displacement. Later versions of the sensor plate specified an increase in thickness to ½-inch material and the use of "plug welds" for enhanced securement to the top of the truck sides.

The Greenbrier Companies, parent company of the builder of the occurrence car (TrentonWorks Ltd.), indicated that it has built more than 3000 cars with sensor plates, more than 1000 with plates similar to the accident car, for North American service. Further, there have been several versions of the plates, largely dependent on the various types of trucks to which the empty/load device would contact. Although the exact number of cars equipped with similar plates by all car builders has not been validated, the number is thought to be in the thousands. The car builder of the occurrence car was not aware that there were problems with the securement of the sensor plates.

Furthermore, manufacturer's instructions for the empty/load device specified that the cars were to be set up using a ¼-inch spacer block; however, the cars were incorrectly stencilled for 5/8 inch. The initial set-up height (5/8 inch) was intended to be used only at the time of car manufacture. Both the car builder and the railway were aware of the discrepancy. It was not considered to affect the safe operation of the equipment, and it did not play a factor in this occurrence.

Although an improperly set-up empty/load device would not normally present much of a concern, in the right circumstances, a device operating approximately one inch out of adjustment could have safety implications. Testing showed that a missing sensor plate on a car that is "lightly loaded" (due to light weight material or a partially loaded condition) may have insufficient spring deflection to cause the sensor arm on the empty/load device to correctly sense the loaded condition. This could cause the car air brake system to brake as an empty car, resulting in less retarding force than may be required. (It should be noted that there was no indication that this condition existed on the accident car.) However, post-accident testing on fully loaded cars from the same construction lot indicated that, when the ELX valve retained its manufactured settings for set-up height, the missing sensor plate would not affect the braking performance of the car.

1.15 Locomotive event recorder survivability

The LER in the accident sustained severe fire and heat damage and all data were destroyed. In previous investigations into occurrences in which LERs were heavily damaged or destroyed, the Board emphasized the importance of the survivability of LER data (TSB investigation reports R96C0172, R97V0063, R99H0010, and R03V0083). As a result of investigation R99H0010, the Board issued the following recommendation:

Transport Canada ensure that the design specifications for locomotive event recorders include provisions regarding the survivability of data. (R02-04, issued September 2002)

New crashworthiness standards have been implemented and included in Transport Canada-approved Railway Locomotive Inspection and Safety Rules. However, these standards are applicable to locomotives built after 01 January 2007 and delivered after 01 January 2008. Older locomotives, such as the occurrence locomotive, were permitted to remain in service with existing event recorders. Regarding implementation, the Railway Locomotive Inspection and Safety Rules state, in part:

12.1 IMPLEMENTATION PERIOD

1. all locomotives, built prior to January 1, 2007 shall be equipped with an event recorder designed with a solid state memory module and shall record as a minimum the following data elements:
   • time,
   • distance,
   • speed,
   • brake pipe pressure,
   • throttle position,
   • emergency brake application,
   • independent brake cylinder pressure,
   • horn signal and where applicable the reset safety control function;
2. all new locomotives built after Jan. 1, 2007 and delivered after January 1, 2008 shall be equipped with an event recorder designed with a "Certified Crashworthy" ERMM [Event Recorder Memory Module] that records;
   1. train speed,
   2. selected direction of motion,
   3. time,
   4. distance
   5. throttle position,
   6. applications and operations of the train automatic air brakes, including emergency applications. The system shall record, or provide a means of determining, that a brake application or release resulted from manipulation of brake controls at the position normally occupied by the locomotive engineer. In the case of brake application or release that is responsive to a command originating from or executed by an onboard computer (e.g. electronic braking system controller, locomotive electronic control system, or train control computer), the system shall record, or provide means of determining, the involvement of any such computer; (this includes brake pipe and brake cylinder pressure)
   7. applications and operations of independent brake,
   8. applications and operations of dynamic brake, if so equipped,
   9. cab signal aspect, if so equipped and in use,
   10. end-of-train device (EOT) device lost of communication front to rear and rear to front,
   11. electronic controlled pneumatic braking (ECP) message and loss of such message, if so equipped,
   12. EOT armed emergency brake command, emergency brake application,
   13. Indication of EOT valve failure,
   14. EOT brake pipe pressure (EOT and ECP devices),
   15. EOT marker light on/off,
   16. EOT low battery status,
   17. position of on/off switch for headlights on lead locomotive,
   18. position of on/off switch for auxiliary lights on lead locomotive,
   19. horn control handle activation, high and low signal
3. effective January 1, 2010, should an event recorder be replaced on a locomotive built prior to January 1, 2008, the event recorder shall be replaced by an event recorder with a hardened memory module or by an event recorder with a certified crashworthy ERMM recording as a minimum the same number of data elements as the recorder replaced.

The Board assessed Transport Canada's response to this recommendation as "Satisfactory in Part" noting that the new standards are not retroactive, resulting in a slow rate of equipping the fleet. As old event recorders fail, the intention is for railways to install event recorders that meet the new standard. However, there is no "grandfather clause" requiring a date by which all main line (road) locomotives will be equipped with the new recorders. The typical service life of locomotives is 20 to 30 years.

1.16 Safety Management Systems and practice

The Railway Safety Management Systems Regulations are the result of amendments to the Railway Safety Act, which came into force on 01 June 1999. These amendments included a requirement for safety management systems (SMS), as well as a new authority for Transport Canada to monitor safety performance and compliance with the regulations through auditing and analysis of safety performance indicators.

Under Part 2(e) of these regulations, effective 31 March 2001, all federally regulated railway companies are required to implement and maintain an SMS that includes a process for:

1. identifying safety issues and concerns, including those associated with human factors, third-parties and significant changes to railway operations, and
2. evaluating and classifying risks by means of a risk assessment.

Part 2(f) of these regulations requires railway companies to include risk control strategies in their SMS. When a risk assessment is carried out by a company before a major operational change, there is no requirement for the company to provide the risk assessment to Transport Canada (other than in response to an audit request).

One of the risk management objectives stated by CN is "To identify and analyze risks that CN may be exposed to and take the necessary action to eliminate or reduce the risks." In support of this objective, Transport Canada worked with CN as part of the process leading up to the acquisition of the BCR by CN on 15 July 2004. CN prepared a Safety Integration Plan that was reviewed at length with Transport Canada, and a number of changes to the plan were made as a result of these discussions. This process reviewed 19 issues, including safety culture and practices, SMS, regulatory reporting, operating practices, and work/rest and medical standards. None of the 19 issues included the removal of DB-equipped locomotives from service on the Lillooet Subdivision between Kelly Lake and Lillooet. The railway did not perceive the use of non-DB locomotives on the Lillooet Subdivision to be a major operational change requiring a formal risk assessment. However, a formal risk assessment, especially if it draws on local expertise, can help decision makers better understand a new operational context, allowing them to make more informed choices and proactively address safety risks.

An effective SMS depends on free-flowing communications about hazards and safety concerns. Information collected during the investigation suggested that some operating employees had concerns about the operational suitability of non-DB-equipped GP 40-2L locomotives on the Lillooet Subdivision. These concerns were not communicated to CN management.

The effective management of safety requires an organization to have a culture, structures, and processes in place to allow for the proactive identification and mitigation of risks. CN's SMS revised in 2005 states that the company is to "Respond as soon as possible to employee reports of at-risk behaviours or hazardous conditions."

One formal way for employees to communicate safety concerns was through the local Occupational Safety and Health (OSH) Committee. At the time of the occurrence, running trades employees were not represented on the local OSH Committee, in spite of numerous company efforts to solicit their participation. Other mechanisms, both formal and informal, were available to communicate employee safety concerns to their supervisors or their union. Safety concerns could also have been reported to Transport Canada Rail Safety or TSB's confidential safety reporting program Securitas.

1.17 Canadian National derailment history on former British Columbia Railway territory

There were a number of accidents following the transition to CN operation of the BCR territory. Four CN main-track derailments occurred on the Squamish Subdivision south of Lillooet between August and December 2005.

The TSB formally investigated the derailment that occurred on 05 August 2005 at Mile 56.6 of the Squamish Subdivision (TSB investigation report R05V0141). An improperly set-up long, heavy, distributed power train stringlined and derailed to the inside of a sharp curve, spilling 40 000 litres of caustic soda into the Cheakamus River, causing extensive environmental and biological damage. The TSB investigation determined that CN had developed a Safety Integration Plan for the acquisition of BCR and this plan had been reviewed by Transport Canada. The purpose of the plan was to guide in the safe transition to CN's ownership and operation of this territory. However, CN resumed long, distributed power train operations without adequate consideration of the value of retaining and using local knowledge and experience but did not inform Transport Canada. CN was of the view that resuming this type of operation on this territory did not constitute a major operational change that would require a formal risk assessment. This resulted in a lack of training and proper supervision that contributed to the derailment.

2.1 Introduction

The derailment occurred after the runaway train reached a speed at which it could not negotiate the sharp curves while descending the long, steep mountain grade. The markings along the right-of-way on the outside of the curves and leading to the derailed car and locomotive were consistent with those caused by an overspeed derailment. The presence of minimal track damage between the rails at the derailment site of the car and no track damage at the derailment site of the locomotive would indicate that both pieces of rolling stock experienced wheel lift conditions due to high lateral forces and rolled off the rails. Laboratory rollover speed calculations indicated that the car was travelling in excess of 50 mph and the locomotive in excess of 60 mph when they derailed. In the absence of event recorder data, the investigation relied upon the following sources of information to determine the most likely causes and contributing factors of the runaway:

• site examination,
• interviews,
• testing of brake components and wheels,
• laboratory and dynamometer testing,
• simulations,
• analysis of data acquired from the train's SBU,
• a review of operating and safety management practices.

The defective one-way main reservoir check valve and broken compressor cylinder discovered during the site examination presented a possible reason for loss of control. Had there been a loss of main reservoir air, the defective check valve had the potential to lead to a complete loss of air brake control. However, metallurgical analysis of the broken compressor cylinder determined that it broke due to a post-derailment impact and, consequently, was not a causative factor in this accident. Therefore, the defective one-way check valve did not play a role.

The SBU data confirmed that there was brake pipe continuity throughout the train and that proper SBU function and air brake tests were performed before departure. In addition, the data indicated that three service brake applications totalling 14 psi were made before cresting the grade at Mile 190.8 and that the train had been operated in compliance with CN train handling and operating instructions for this territory. Moreover, the crew followed proper emergency procedures and made an emergency radio broadcast.

While descending the grade, the locomotive engineer made several brake applications leading to the application of maximum service braking effort followed by an emergency brake application. However, the train continued to accelerate until the car derailed at Mile 184.8 and the locomotive derailed two miles later at Mile 182.5. Both the conductor and the trainman sustained fatal injuries. The locomotive engineer sustained serious injuries. The investigation focused on determining the factors that affected the braking capacities of the locomotive and the car and the safety management practices that led to the elimination of DB-equipped locomotives from this territory.

2.2 The runaway

A number of factors combined to support the conclusion that the brakes on the loaded centre beam flat car did not provide the expected braking effort, that is:

• The car wheels did not display the blueing normally associated with heavy braking.
• The brake shoes were not excessively worn and did not show signs of excessive heat damage.
• The car wheels were not hot one hour after the accident. It would be expected that excessively heated wheels would remain hot to the touch for hours.
• A comparison of the braking of the test train with the data obtained from the SBU shows that heavier brake application had to be made on the occurrence train.

Moreover, dynamometer tests indicated that the scenario that best replicated the occurrence characteristics only took place when the centre beam flat car brakes were not functioning properly. The tests indicated that a loss of braking efficiency would occur on the locomotive at about the same location where the train began to lose control during the actual descent (that is, where the brakes were placed in emergency by the locomotive engineer).

Because the car air brakes were not functioning optimally, greater braking effort was required from the locomotive air brake system to control train speed throughout the descent from Kelly Lake. The higher braking effort for the long period of time required to descend the grade resulted in elevated locomotive wheel temperatures, reaching levels in excess of 1340°F (727°C) as shown by the presence of tempered martensite and bainite on the treads of the wheels. The elevated temperatures led to a reduction in the coefficient of friction at the interface of the brake shoe and the wheel tread (friction fade) on the locomotive and resulted in acceleration of the train. The train continued to increase speed until the car derailed at Mile 184.8 and the locomotive derailed at Mile 182.5.

Consideration was also given to the possibility that the car experienced friction fade. However, analysis of SBU data and dynamometer testing as well as the absence of superficial blueing of the wheel treads and noticeable heat on the wheel tread surfaces all indicate that this was not the case.

The car and the locomotive were uncoupled and separated from each other after the train was placed into emergency at about Mile 186.7. The hand brake on the car was never successfully applied. Mile 186.7 was the approximate location where the train began to "run away." Dynamometer testing shows friction fade occurring at this location. By the time the car was uncoupled from the locomotive, friction fade had begun on the locomotive brake system, lowering the effective braking of the locomotive below that of the poorly braking car, and resulting in separation of the two.

2.3 Centre beam flat car brake system effectiveness

Notwithstanding the effects of friction fade, calculations showed that, had the occurrence car's brakes been fully operational and met the requirements of AAR Standard S-401-99 (required braking capacities), the resultant braking force should have been sufficient to safely descend Kelly Lake Hill. However, if the loaded car in this occurrence had the same braking ratio as the tested sister car, it could not provide sufficient braking effort to control its own speed on many sections of this grade. Given the performance degradation that can occur through normal service, and in consideration of the braking efforts required for today's heavier loaded cars, AAR braking ratios and railway operating practices may not ensure an adequate safety margin for trains descending mountain grades.

There was concern that a missing sensor plate mounted on the truck side frame to facilitate operation of the empty/load device could have caused the accident car to brake as an empty car even though it was loaded. However, post-accident testing on fully loaded cars from the same construction lot indicated that, if the ELX valve retained its manufactured settings (which the occurrence car did) for set-up height, the missing sensor plate would not have affected the braking performance of the car.

The large number of cars noted to have either a missing or repaired sensor plate and the fact that these problems were noted on cars manufactured to the same specification by more than one car builder indicate that there may be systemic problems with the design, inspection, and maintenance of these cars.

The investigation did not determine the role, if any, that the ABDX-L control valve played in this accident. The presence of metal turnings in the ABDX-L emergency portion could cause the emergency portion to malfunction; however, no metal turnings or other contaminants were found in the service portion of the control valve. However, the metal turnings in the emergency portion, near the inshot piston and the inshot piston valve, have the potential to adversely affect service braking as well.

The SBU data confirmed that the pneumatic signal from the locomotive brake valve was reaching the rear of the train. However, the investigation did not determine with certainty why the brakes on the loaded centre beam flat car were not providing the anticipated braking effort. The following possible explanations were considered:

• Although no anomalies were noted with the functionality of the ABDX-L control valve during testing after the accident, the results do not preclude the possibility that internal contamination caused an intermittent problem that reduced braking effort.
• While there is no indication that the brake rigging on the occurrence car was binding or fouled, the condition is not unknown in the industry and can render brakes less effective or inoperative, posing a hazard for train operations.

2.4 Dynamic brake

The train had only tread brakes available because the locomotive was not equipped with DBs. Since DB uses the locomotive traction motors to provide resistance, there is no contact and no friction between wheels and brake shoes. Therefore, DB can help prevent or reduce the likelihood of friction fade, and its use can help reserve train air brake capacity to control train speed on long mountain grades.

The investigation determined that the maximum force on the train due to the grade did not surpass the maximum DB capability of a single GP 40-2 locomotive when so equipped. Had the train been controlled with DB, the 40 000-pound DB capacity would have been sufficient to maintain the speed at the 20 mph limit without any use of the train air brakes or the locomotive independent brake significantly reducing the risk of loss of control.

The lack of DB on the locomotive to control train speed on the long, steep descending grade and the absence of the expected level of brake capacity of the loaded centre beam flat car necessitated the locomotive brakes to be applied beyond their sustainable capacity. This led to friction fade and the eventual loss of control.

2.5 Safety management

Train operation on the steep grades and sharp curvature on the Lillooet Subdivision demands extra care to avoid derailments. BCR recognized this and, before acquisition by CN, had a practice of using DB-equipped locomotives on this territory. Even though there was no comparable territory elsewhere on the CN system, CN applied some of its operating practices to the BCR territory. For instance, DB-equipped locomotives in switcher service were replaced with non-DB-equipped locomotives that were put into service on the severe mountain terrain.

The investigation learned that some railway operating employees were concerned about GP 40-2L locomotives being able to safely perform in the same manner as DB-equipped locomotives that were formerly assigned to the Exeter Switcher. These concerns were not communicated to management either formally or informally for their review and response. Furthermore, they were not reported to the local OSH Committee because the operating employees did not participate in the committee in spite of management's invitation to select a representative. Since employee concerns regarding the use of non-DB-equipped locomotives on this territory were not brought to the attention of management through the local OSH Committee, or by any other available means, an opportunity was lost to resolve this safety issue.

CN's SMS defines risk management as "the process of identifying, assessing and controlling risks arising from operational factors and making decisions that balance the cost of risks with benefits."^{Footnote 36} In obtaining GP 40-2L locomotives for use on this territory, only the GRL requirement for four-axle locomotives in some areas was considered and not the ramifications of eliminating DB-equipped locomotives from switching service on the territory. Although CN had prepared a Safety Integration Plan before the acquisition of the BCR territory, non-DB locomotive operations were implemented without doing a formal risk assessment to identify potential operational hazards in this challenging physical environment.

The TSB's investigation into CN's Cheakamus River derailment on 05 August 2005 (TSB investigation report R05V0141) also determined that another operational change had been made without following sound risk management practices.

While TC's Railway Safety Management Systems Regulations stipulate that a formal risk assessment must be performed in the event of a major operational change, the fact that the railway did not consider the removal of DB-equipped locomotives from this territory to be a major operational change went unnoticed by Transport Canada. Safety action taken by Transport Canada immediately after the accident required the re-establishment of DB-equipped locomotives on this territory. Transport Canada considered that the removal of DB from this territory was a major operational change and that a formal risk assessment was required by the regulations.

2.6 Locomotive wheels

The sustained application of the automatic and independent brakes on the locomotive exceeded the thermal capacity of the wheels and the brake shoes and resulted in a reversal of the residual stress from compressive to tensile. The expansion of the cut during the saw-cut test on the locomotive wheels indicated the presence of residual tensile stresses instead of the residual compressive stresses that were designed in at the time of manufacture. This showed that the heat generated during braking was great enough to thermally damage the wheels. These results corresponded well to the saw-cut test results from the locomotive wheel involved in the dynamometer test, which developed a crack during the test. If the residual tensile stress becomes large enough, the effects of contact fatigue encountered in regular service use are accelerated and, in extreme circumstances, thermally damaged wheels can fail catastrophically.

While hot wheel detector systems identify cars with overheated wheels, subsequent visual inspections may not always correctly identify the extent to which the wheel has been damaged. For example, although the locomotive wheel used during the dynamometer test was exposed to extreme temperatures and braking forces, it still did not display the characteristic reddish brown discolouration of the wheel plate used when identifying wheels to be taken out of service and no thermal cracking was present. Because thermally damaged wheels may not always display the typical discolouration and thermal cracking expected, there is a risk that they can remain unidentified or be returned to service after identification, where they may fail catastrophically.

Standard metallurgical examination of locomotive and wheel fractures has historically focused on determining the fracture mechanism. The TSB is not aware of a reliable non-destructive test used to assess the degree of heat damage present in a railway wheel. Moreover, analysis for the presence of heat damage would not typically occur unless there was some obvious reason to perform this work, for example, visual signs of excessive overheating. It is possible that heat damage has remained unidentified as a contributing factor in previous wheel failure analyses due to a lack of awareness of the extent of heat damage and the absence of a reliable non-destructive test method to permit targeted metallurgical analysis.

2.7 Braking capacity

TSB theoretical brake force calculations^{Footnote 37} showed that, with fully functional brakes and in the absence of friction fade, a full service air brake application on the car and locomotive should have been sufficient braking power to control the train up to a speed of 30 mph. With the locomotive brakes released, neither a full service nor an emergency air brake application on the car alone is sufficient to control or stop the movement. However, the full braking capability of the locomotive alone is sufficient in the absence of friction fade.

Dynamometer test 8130 showed that a train (single locomotive and fully loaded car) with fully operational brakes and travelling at the posted speed limit of 20 mph down the occurrence track would risk experiencing the effects of friction fade. Average BHP values produced would be in excess of the industry accepted limit of 40, for a 40-inch-diameter locomotive wheel for much of the journey^{Footnote 38} and far in excess of the equivalent minimum BHP value of 21 that the brake shoes are currently tested to in AAR Specification M-926.

At lower speeds, however, the braking force required to control a train is lower and the resulting BHP levels are also lower. A safe maximum speed for a train to descend any long continuous grade would be the speed at which wheel and brake shoe thermal capacities are not exceeded long enough to bring about friction fade. For the occurrence train, with one locomotive and a single fully loaded car, the 20 mph speed limit on the subdivision between Kelly Lake and Lillooet presented an inherent risk that friction fade would occur and lead to BHP levels that exceeded both the wheel and brake shoe thermal capacities.

Moreover, in dynamometer test 8130, all of the wheels were being operated beyond their thermal capacities. Six of the eight occurrence locomotive wheels and all of the car wheels were Class C. The remaining two locomotive wheels were Class B. Class C wheels are not designed for heavy tread brake applications such as those involving mountain grade operations. Although Class C wheels are used in mountain service throughout the North American railway industry, the use of Class C wheels that are less resilient under heavy tread braking conditions (they have a lower thermal capacity) presents a risk that such wheels will sustain heat damage and be more prone to develop defects due to contact fatigue in normal service operation.

There were industry recommended maximum BHP limits to which operating practices for descending grades should be designed not to exceed, that is, the BHP limit is 25 for 33-inch-diameter wheels. In order to avoid heat damage to wheels or loss of control, these limits should be observed. However, railway operating instructions for the descent of Kelly Lake Hill did not consider BHP levels and, consequently, could result in BHP levels that exceed the maximum recommended thermal capacity of the wheels.

AAR 1964 Specification M-926, the standard to which high-friction composition brake shoes are currently manufactured, is based on braking a 100-ton car with a GRL of 263 000 pounds for a period of 45 minutes. The specification requires brake shoes to be exposed to a 1450-pound net shoe force and produce a retarding force of 400 pounds. However, today's cars can have a GRL of 315 000 pounds.^{Footnote 39} The time required to descend Kelly Lake Hill at 20 mph is about 105 minutes, well in excess of the time in the test specification. The brake shoe forces developed during a successful descent of the hill (dynamometer test 8130) were shown to reach as high as 4700 pounds and generally varied around 3500 pounds. The discrepancy between the 1964 specification and the actual operating requirements shows that current performance standards for composition brake shoes may be inadequate to ensure that brake shoes can withstand the sustained service brake loads of today's heavier cars while descending long mountain grades. Although brake shoes designed to AAR Specification M-997 would be more resistant to friction fade, it is likely that it would take years before a significant number of the new brake shoes enter service.

Furthermore, an acceptable worn condition of a brake shoe under normal circumstances (that is, within AAR standard wear limits of 3/8 inch of wearable material, including lining and backing plate, remaining on the brake shoe) may be inadequate for grades where high BHP levels are being encountered. When this situation is created, the brake shoes can wear rapidly, further compromising the braking capacity of the train. Brake shoe wear rates are currently not considered when establishing operational procedures, such as the setting of minimum brake shoe thickness allowed at the top of a grade and the establishment of maximum speeds (BHP levels) for descending grades.

The 20 mph speed limit on this descending grade established by BCR for the operation of trains equipped with DB locomotives was not changed by CN subsequent to the acquisition of BCR. While the same maximum speed existed under BCR, the presence of DB-equipped locomotives usually precluded the need for heavy air brake use that can lead to friction fade. Nevertheless, even under BCR, the maximum speed of 20 mph was likely to result in excessive thermal loading of wheels in the event of DB malfunction.

It should also be noted that the operation of a single locomotive and one heavily loaded car down the steep mountain grade represents a "worst case scenario" from the perspective of tons per operative brake. Had the train included several empty cars, lighter air brake applications would have been needed to control the train on the grade, keeping thermal loads on the wheels low and temperatures below the range in which friction fade occurs.

2.8 Locomotive event recorders and sense and braking unit data

In the case of most major accidents in which the locomotives were exposed to a post-crash fire, the LER was subjected to extreme temperatures and the data were unrecoverable.

The SBU data from the occurrence train only became available to the TSB 18 months after the accident occurred. It was used in the dynamometer test to help replicate the descent of the accident train and thus show how the sustained application of brake shoes against the wheel affects both the wheels and the shoes. Without this information, an understanding of the effect that the heat generated from braking had on the locomotive wheels would have been less accurate. Had the occurrence train LER survived, it would have provided more data points and fields to facilitate the dynamometer testing as well as a source of information against which to compare the SBU data. Had the LER survived the post-crash fire, the occurrence train LER data would have been available in a much timelier manner.

While new standards that require certified crashworthy ERMMs have been adopted into the Railway Locomotive Inspection and Safety Rules, as revised in June 2007, the occurrence locomotive was not subject to these new requirements. The new standards apply only to those locomotives delivered after 01 January 2008, unless the existing event recorder requires replacement after 01 January 2010. Many locomotives currently in service are not required to have an LER built to the 2008 standards for crashworthiness and may continue to operate without one for the remainder of their service life.

3.1 Findings as to Causes and Contributing Factors

1. The derailment occurred after the runaway train reached a speed at which it could not negotiate the sharp curves while descending the long, steep mountain grade.
2. The train set-up, without a locomotive equipped with dynamic brake (DB) and with a single loaded car, resulted in a high gross weight for the braking capacity available from a small number of operative brakes.
3. The brakes on the loaded centre beam flat car did not provide the expected braking effort.
4. Because the car air brakes were not functioning optimally, greater braking effort was required from the locomotive air brake system to control train speed throughout the descent from Kelly Lake.
5. The elevated temperatures led to a reduction in the coefficient of friction at the interface of the brake shoes and the wheel treads (friction fade) on the locomotive and resulted in acceleration of the train.
6. The reduced level of braking capacity of the loaded centre beam flat car required the locomotive brakes to be applied beyond their sustainable capacity on the long, steep descending grade. This led to friction fade and the eventual loss of control.
7. Although Canadian National (CN) had prepared a Safety Integration Plan before the acquisition of the British Columbia Railway (BCR) territory, non-DB locomotive operations were implemented without doing a formal risk assessment to identify potential operational hazards in this challenging physical environment.
8. For the occurrence train, with one locomotive and a single fully loaded car, the 20 mph speed limit on the subdivision between Kelly Lake and Lillooet presented a risk that friction fade would occur and led to brake horsepower (BHP) levels that exceeded both the wheel and brake shoe thermal capacities.

3.2 Findings as to Risk

1. Railway operating instructions for the descent of Kelly Lake Hill did not consider BHP levels and, consequently, increased the risk that BHP levels would exceed the maximum recommended thermal capacity of the wheels.
2. Given the performance degradation that can occur through normal service, and in consideration of the braking efforts required for today's heavier loaded cars, Association of American Railroads (AAR) braking ratios and railway operating practices may not ensure an adequate safety margin for trains descending mountain grades.
3. Because thermally damaged wheels may not always display the typical discolouration and thermal cracking expected when viewing overheated wheels, there is a risk that they can remain unidentified or be returned to service where they may fail catastrophically.
4. Although Class C wheels are used in mountain service throughout the North American railway industry, the use of Class C wheels that are less resilient under heavy tread braking conditions (they have a lower thermal capacity) presents a risk that such wheels will sustain heat damage and be more prone to develop defects due to contact fatigue in normal service operation.
5. Current performance standards for composition brake shoes may be inadequate to ensure that brake shoes can withstand the sustained service brake loads of today's heavier cars while descending long mountain grades.
6. Brake shoe wear rates are currently not considered in establishing operational procedures, such as the setting of minimum brake shoe thickness allowed at the top of a grade and the establishment of maximum speeds (BHP levels) for descending grades.
7. The large number of similar cars, from a variety of manufacturers, noted to have either a missing or repaired sensor plate, indicates that there may be systemic problems with the design, inspection, and maintenance of these cars.
8. Many locomotives in service today are not required to have a locomotive event recorder (LER) built to the 2008 standards for crashworthiness and may continue to operate without one for the remainder of their service life.

3.2 Other Findings

1. The sense and braking unit (SBU) data indicate that, before the runaway, the train had been operated in compliance with CN train handling and operating instructions for this territory.
2. Had the train been controlled with DB, the 40 000-pound DB capacity would have been sufficient to maintain the speed at the 20 mph limit without any use of the train air brakes or the locomotive independent brake, significantly reducing the risk of loss of control.
3. It is possible that heat damage has remained unidentified as a contributing factor in previous wheel failure analyses due to a lack of awareness of the extent of heat damage and the absence of a reliable non-destructive test method to permit targeted metallurgical analysis.
4. Metallurgical analysis of the broken compressor cylinder determined that it broke due to a post-derailment impact and, consequently, was not a causative factor in this accident. Therefore, the defective one-way check valve did not play a role either.
5. No anomalies were noted with the functionality of the ABDX-L control valve from the loaded centre beam flat car during testing after the accident. However, these results do not preclude the possibility that an intermittent problem contributed to the reduced braking effort of the car.
6. It could not be determined why the braking system on the car did not function properly.
7. The ELX empty/load device retained its manufactured settings for set-up height; therefore, the missing sensor plate did not affect the braking performance of the car.
8. Since employee concerns with the use on non-DB-equipped locomotives on this territory were not brought to the attention of management, either through the local Occupational Safety and Health (OSH) Committee or by any other available means, an opportunity was lost to resolve this safety issue.
9. In the absence of LER data, the recovery and analysis of recorded SBU data enabled the validation of other information and a more accurate determination of cause.

4.1 Action taken

4.1.1 TSB Rail Safety advisories

4.1.1.1 Defective locomotive one-way check valve

On 28 September 2006, the TSB issued Rail Safety Advisory (RSA) 06/06 to Transport Canada concerning a defective locomotive one-way check valve. During the post-accident examination of the locomotive, a defective one-way check valve between the two main reservoirs of the locomotive was identified. The one-way check valve was found to have its internal spring partially screwed around the check valve, impeding proper check valve operation.

A series of leakage tests was performed on another, non-identical Canadian National (CN) locomotive in Lillooet Yard with similar brake equipment, and a blow-back test of the one-way check valve was performed. The one-way check valve did not hold, and the main reservoir pressure dropped from 140 pounds per square inch (psi) to 90 psi. The locomotive was subsequently removed from service and repaired.

In October 2006, Transport Canada contacted CN who reported that the following actions had been taken:

• CN initiated a blitz campaign to test and, if necessary, replace defective locomotive check valves during the next 90-day inspection;
• a locomotive one-way check valve test was added to CN's Operational Brake Test Schedule and Procedure that is conducted every 184 days; and
• mandatory replacement of these valves was added to CN's Quadrennial Schedule and Procedure.

Transport Canada also contacted Canadian Pacific Railway (CPR) who provided a copy of the CPR inspection procedures.

4.1.1.2 Canadian National train operations on heavy grade mountain territory

On 13 February 2007, the TSB issued RSA 01/07 suggesting that Transport Canada might wish to review and evaluate CN's operations, train speeds, braking effectiveness, and equipment handling instructions to assess their adequacy for safe train operation on steep mountain grades. The RSA indicated that brake shoe friction fade could have occurred in the Lillooet runaway. The RSA also provided detailed information on the phenomenon of brake shoe friction fade and on the role it had played in a number of previous runaways investigated by the United States National Transportation Safety Board (NTSB). It also included the related NTSB recommendations.

Transport Canada noted the issues raised in the RSA but indicated that it would await completion of the TSB investigation before taking any action.

4.1.1.3 Contaminated wabco ABDX-L emergency portion

On 06 September 2007, the TSB issued RSA 11/07 concerning contamination of the emergency portion of the ABDX-L control valve from occurrence car CN 625862. The RSA indicated that Transport Canada might wish to determine if other ABDX-L valve emergency portions are similarly contaminated and determine what actions should be taken. Copies of the RSA were sent to CN, the Railway Association of Canada, the Association of American Railroads (AAR) and Wabco.

TSB Engineering Laboratory borescope imagery of the inside of the valve revealed that some small internal objects and marks were present. Stereomicroscope and scanning electron microscope examination of the recovered fragments, which were on the inshot piston diaphragm, identified them as turnings or swarf from a metalworking operation. Analysis of the turnings showed an aluminum-silicon base material similar in composition to casting alloys used to construct the control valve.

The control valve has a service portion and an emergency portion. The service valve portion primarily reacts to controlled changes in air brake pipe pressure (BPP) initiated by the locomotive engineer. The emergency valve portion primarily reacts to sudden reductions in air BPP to initiate an emergency application of the air brakes, which may be either unintentional or crew-initiated.

This control valve was subject to testing in Winnipeg after the accident. There were no anomalies noted with the functionality of the valve at that time.

Transport Canada responded, indicating that it did not see the need for action at this time.

4.1.2 TSB Rail Safety information letters

4.1.2.1 Potential risks associated with steel sensor plates and empty/load devices

On 11 January 2008, the TSB issued Rail Safety Information Letter (RSI) 01/08 concerning potential risks associated with steel sensor plates and empty/load devices. An examination of the accident car and several other cars, as well as subsequent air brake testing of similar centre beam cars (at Winnipeg and Prince George) revealed that seven out of nine cars were missing sensor plates.

Sensor plates are large steel plates (approximately ¼ inch by 7 ½ inches by 23 ½ inches) that are welded in a horizontal position to the top of the truck sides to provide a smooth surface for the sensor arm of the empty/load device to travel on during rotation of the freight car trucks (see Section 1.14.4). There are more than 3000 cars built with varying designs of sensor plates, of which approximately 1000 are equipped with plates similar to the accident car.

Because a significant number of cars had sensor plate securement problems, the RSI advised of the risk of a steel sensor plate falling off a rail car in transit and causing damage or injury, or coming into contact with a railway wheel and derailing a train.

Furthermore, because of irregularities with the interdependent sensor plates and empty/load devices, a missing sensor plate can result in the empty/load device being more than one inch out of adjustment. This could cause the car's air brake system to brake as an empty car, resulting in less retarding force than may be required.

4.1.3 Transport Canada

On 04 July 2006, a Transport Canada Rail Safety Inspector issued a Notice and Order under section 31 of the Railway Safety Act requiring that

Canadian National Railway operates all southbound trains on the Lillooet Subdivision between Kelly Lake, Mile 192.6 and Polley, Mile 162 with dynamic brake equipped locomotives. This operating requirement must be included in the Lillooet Subdivision Footnotes. Any changes to this order must be mutually agreed upon between Canadian National Railway and Transport Canada.

In the opinion of the Rail Safety Inspector, an immediate threat to safe rail operations existed. The Notice and Order stated that, pursuant to subsection 4(4.1) of the Railway Safety Act, there is a "hazard or condition that could reasonably be expected to develop into a situation in which a person could be injured or damage could be caused to the environment or property." The hazard or condition was described as follows:

Southward trains operating between Kelly Lake, Mile 192.6 and Polley, Mile 162, Lillooet Subdivision, are operating on a descending grade with a constant degree of descending slope on average in excess of 2%. With the high percentage of grade and length of slope there is very little margin for error in train handling by the operating crew when utilizing non-dynamic brake equipped locomotives. This type of operation could pose a threat or condition that could reasonably be expected to develop into a situation in which a person could be injured or made to be ill or damage could be caused to the environment or property.

In response, CN issued the following bulletin in August 2007:

When available, Dynamic Brake must be utilized in conjunction with the Automatic Brake to balance speed on descending grades.

When Dynamic Brake is not available, the Independent Brake may be used at speeds up to 20 MPH.

1. operating a single locomotive or locomotive consist without cars;
2. the locomotive consist of the movement is equal to or exceeds the number of trailing rail cars; or
3. required to assist in train control when air brakes are utilized.

Note: To avoid overheating the brake shoes, Independent Brake application must not exceed 30 PSI nor be prolonged beyond a distance of 2 miles.

If the speed of the movement exceeds maximum authorized speed by 5 MPH the movement must be brought to an immediate stop, including an emergency stop if necessary. Movement must not then proceed until a determination is made that adequate braking performance is restored.

CN's British Columbia South Division monthly bulletin effective 01 February 2009 to 30 April 2009 contains the following information:

Southward trains on the Lillooet Subdivision between Kelly Lake, Mile 192.6 and Polly, Mile 162, must operate with Dynamic Brake equipped locomotives.

4.1.4 Canadian National

4.1.4.1 Empty/load devices

CN has worked with the car builder to develop a design for an improved sensor plate that would resist breakage. In addition, CN's field inspectors have been made aware of the new design.

4.1.4.2 Thermally damaged wheels

CN is expanding on the information it provides to its mechanical department inspectors regarding thermally damaged wheels. Under the section of the CN Locomotive Inspection Handbook entitled "Overheated Wheels," the following will be added:

Thermal or heat checks are often caused by brake shoe heating and appear as a fine network of superficial lines and checks running in all directions on the surface of the wheel tread. This condition should not be confused with thermal cracking and is not cause for wheel removal.

4.1.5 Association of American Railroads

4.1.5.1 Specification M-997, Brake Shoe - High-Friction Tread Conditioning, High Capacity

On 01 November 2008, AAR Specification M-997 entitled Brake Shoe - High-Friction Tread Conditioning, High Capacity was adopted. This specification establishes a process for the introduction, testing, and potential approval of a new type of brake shoe with superior performance characteristics, including improved resistance to friction fade. Specification M-997 does not address the gross weight of the equipment that should be fitted with high-capacity brake shoes, or whether that requirement will become mandatory.

4.2 Action required

4.2.1 Canadian National's Safety management

The effective management of safety requires an organization to have a culture, structures, and processes in place to allow for proactive identification and mitigation of risks. This was highlighted in two recent investigations where CN did not identify the risks involved as required by its own safety management system (SMS):

• In the Cheakamus investigation (TSB investigation report R05V0141), the TSB determined that no formal risk assessment was performed before CN resumed operating distributed power trains on the steep mountain grade.
• In the Prince George investigation (TSB investigation report R07V0123), the TSB found that the risk assessment conducted before the accident was inadequate in identifying the hazards and mitigating the risks involved in switching long, heavy cuts of cars on the descending grade.

In this investigation, the failure to identify and mitigate risks through effective SMS has again emerged as a safety deficiency. Although CN had prepared a Safety Integration Plan before acquiring the British Columbia Railway (BCR) territory, non-dynamic brake-equipped locomotive operations were implemented without a formal risk assessment being made to identify potential operational hazards in this challenging physical environment.

In aggregate, these three accidents strongly suggest that CN's overall safety management practices do not ensure safe train operations on its network before operational changes are implemented. Therefore, the Board recommends that:

4.3 Safety concern

4.3.1 Performance standards for composition brake shoes

The capacity of wheels and brake shoes to handle thermal loads can be exceeded, particularly since safety margins have been reduced as operating weights have increased. Brake shoe friction is affected by speed, shoe force, and especially wheel temperature. Friction typically reduces or fades at high temperature. Heavier cars need higher retarding force to balance a descending grade, which leads to higher BHP and higher wheel temperatures unless speed is reduced.

On 01 November 2008, 1964 AAR Specification M-926 (the standard used to manufacture high-friction composition brake shoes for rail cars) was supplemented with the new AAR Specification M-997 entitled Brake Shoe - High-Friction Tread Conditioning, High Capacity. This specification establishes a process for the introduction, testing, and potential approval of a new type of brake shoe with superior performance characteristics, including improved resistance to friction fade.

Specification M-997 is a specification designed to assess and approve high-capacity brake shoes. This process is expected to take a number of years. In the meantime, the AAR has not adopted, and is unlikely to adopt, a framework providing for the mandatory use of high-capacity brake shoes for equipment in interchange service, including minimum gross weights and timing.

While it is encouraging that the AAR has implemented Specification M-997, the Board is concerned that heavier cars will continue to be operated using the old Specification M-926 brake shoes.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 20 May 2009.

Appendix A - Glossary

AAR

Association of American Railroads

BCR

British Columbia Railway

BHP

brake horsepower

BPP

brake pipe pressure

cm

centimetres

CN

Canadian National

CPR

Canadian Pacific Railway

DB

dynamic brake

ECP

electronic controlled pneumatic (braking)

EDX

energy dispersive X-ray

EMD

Electro-Motive Diesel, Incorporated

EOT

end-of-train (device)

ERMM

Event Recorder Memory Module

GE

General Electric

GM

General Motors

GPS

global positioning system

GRL

gross rail load

LER

locomotive event recorder

mm

millimetres

mph

miles per hour

NBR

net braking ratio

NTSB

National Transportation Safety Board

OSH

Occupational Safety and Health

POD

point of derailment

psi

pounds per square inch

RP

recommended practice

RSA

Rail Safety Advisory

RSI

Rail Safety Information Letter

RTC

rail traffic controller

SBU

sense and braking unit

SMS

safety management system

TSB

Transportation Safety Board of Canada

%

per cent

°C

degrees Celsius

°F

degrees Fahrenheit