Railway Investigation Report R13D0054

On 06 July 2013, shortly before 0100 Eastern Daylight Time, eastward Montreal, Maine & Atlantic Railway freight train MMA-002, which was parked unattended for the night at Nantes, Quebec, started to roll. The train travelled approximately 7.2 miles, reaching a speed of 65 mph. At around 0115, when MMA-002 approached the centre of the town of Lac-Mégantic, Quebec, 63 tank cars carrying petroleum crude oil (UN 1267) and 2 box cars derailed. About 6 million litres of petroleum crude oil spilled. There were fires and explosions, which destroyed 40 buildings, 53 vehicles, and the railway tracks at the west end of Megantic Yard. Forty-seven people were fatally injured. There was environmental contamination of the downtown area and of the adjacent river and lake.

1.1 The accident

On 05 July 2013, at about 1355,^{Footnote 1} eastward Montreal, Maine & Atlantic Railway (MMA)^{Footnote 2} freight train MMA-002 (the train) departed Farnham (near Brookport, Mile 125.60 of the Sherbrooke Subdivision), Quebec, destined for Nantes (Mile 7.40 of the Sherbrooke Subdivision), Quebec, where it was to be re-crewed and was to continue on to Brownville Junction, Maine. The train’s final destination was Saint John, New Brunswick (Figure 1). The train consisted of 72 tank cars loaded with approximately 7.7 million litres of petroleum crude oil (UN 1267), 1 box car (buffer car^{Footnote 3}), and the locomotive consist (5 head-end locomotives and 1 VB car ^{Footnote 4}). The train was controlled by a locomotive engineer (LE) who was operating alone and was positioned in the lead locomotive, MMA 5017. During the trip, the LE reported mechanical difficulties with the lead locomotive, which affected the train’s ability to maintain speed.

At around 2250, the train arrived at Nantes, was brought to a stop using the automatic brakes, and was parked for the night on a descending grade on the main track. The LE applied the independent brakes to the locomotive consist. He then began to apply the hand brakes on the locomotive consist and the buffer car (7 cars in total), and shut down the 4 trailing locomotives. Subsequently, the LE released the automatic brakes and conducted a hand brake effectiveness test without releasing the locomotive independent brakes. The LE then contacted the rail traffic controller (RTC) responsible for train movements between Farnham and Megantic Station (Megantic), who was located in MMA’s yard office in Farnham, to indicate that the train was secured.

The LE then contacted the RTC in Bangor, Maine, who controlled movements of United States crews east of Megantic. During this conversation, the LE indicated that the lead locomotive had continued to experience mechanical difficulties throughout the trip and that excessive black and white smoke was now coming from its smoke stack. The LE expected that the condition would settle on its own. It was mutually agreed to leave the train as it was and that performance issues would be dealt with in the morning.

A taxi was called to transport the LE to a local hotel. When the taxi arrived to pick up the LE at about 2330, the taxi driver noted the smoke and mentioned that oil droplets from the locomotive were landing on the taxi’s windshield. The driver questioned whether the locomotive should be left in this condition. The LE indicated that he had informed MMA about the locomotive’s condition, and it had been agreed upon to leave it that way. The LE was then taken to the hotel in Lac-Mégantic and reported off-duty.

At 2340, a call was made to a 911 operator to report a fire on a train at Nantes. The Nantes Fire Department responded to the call and arrived on site, and the Sûreté du Quebec (SQ) called the Farnham RTC to inform the company of the fire. After MMA unsuccessfully attempted to contact an employee with LE and mechanical experience, an MMA track foreman was sent to meet with the fire department at Nantes. When the track foreman arrived on site, the firefighters indicated that the emergency fuel cut-off switch had been used to shut down the lead locomotive. This shutdown put out the fire by removing the fuel source. Firefighters also moved the electrical breakers inside the locomotive cab to the off position to eliminate a potential ignition source. These actions were in keeping with railway instructions.

Both the firefighters and the track foreman were in discussion with the Farnham RTC to report on the condition of the train. Subsequently, the fire department and the MMA track foreman left the scene.

With no locomotive running, the air in the train’s brake system slowly began to be depleted, resulting in a reduction in the retarding force holding the train. At about 0100 (July 06), the train started to roll downhill toward Lac-Mégantic, 7.2 miles away. At about 0115, the train derailed near the centre of town, releasing about 6 million litres of petroleum crude oil, which resulted in a large fire and multiple explosions.

The locomotive consist did not derail; rather, it separated from the rest of the train and then further separated into 2 sections. Data downloaded from the de la Gare Street crossing (located by Megantic Station) showed that the 2 sections were separated by 104 feet. Both continued travelling eastward onto the Moosehead Subdivision, coming to rest on an ascending grade in the eastern part of town and stopping approximately 475 feet apart. During the course of this entire sequence, the train passed through 13 level crossings.

After approximately 1.5 hours, while emergency and evacuation efforts were under way, the leading section of the locomotive consist rolled backwards toward downtown and contacted the trailing section; both sections travelled backwards an additional 106 feet. At approximately 0330, MMA officials secured the locomotive consist on the grade by re-tightening the hand brakes.

See Appendix A for more detailed information about the sequence of events.

1.2 Aftermath

As a result of the derailment and the ensuing fires and explosions, 47 people died, and about 2000 people were evacuated. Forty buildings and 53 vehicles were destroyed (Photo 1).

The derailed tank cars contained about 6.7 million litres of petroleum crude oil, about 6 million litres of which were released, contaminating approximately 31 hectares of land. Crude oil migrated into the town’s sanitary and storm sewer systems by way of manholes. An estimated 100 000 litres of crude oil ended up in Mégantic Lake and the Chaudière River by way of surface flow, underground infiltration, and sewer systems. About 740 000 litres were recovered from the derailed tank cars.

The hydrocarbon recovery and cleanup operation began as soon as the fire was extinguished and the site was stabilized, approximately 2 days after the derailment. The assessment and remediation of the environment were performed using a combination of monitoring wells and exploratory trenches serviced by vacuum trucks under the guidance of a specialized engineering firm.

1.3 Weather

At 2300 on 05 July 2013, the temperature at the weather station in Sherbrooke, Quebec, approximately 95 km west of Lac-Mégantic, was 21.7 °C. The dew point was 20.5 °C, and wind speed was 5 km/h from the south. At 0100 on 06 July 2013, the temperature was 21.2 °C, with a dew point of 20.4 °C and wind speed of 0 km/h.

1.4 Subdivision information

The Sherbrooke and Moosehead Subdivisions were owned and operated by MMA. These subdivisions were previously owned by Quebec Southern Railway (QSR) and, prior to that, by Canadian Pacific Railway (CPR).

1.4.1 Sherbrooke Subdivision

The MMA Sherbrooke Subdivision was a single main track extending west from Megantic (Mile 0.00) to Brookport (Mile 125.60), Quebec, where it connected with the Adirondack and Newport Subdivisions, near Farnham. Train movements were controlled by the Occupancy Control System (OCS), as authorized by the Canadian Rail Operating Rules (CROR), and supervised by an RTC located in Farnham. Traffic on the Sherbrooke Subdivision consisted of 2 freight trains per day, for an annual tonnage of 4.5 million gross tons. The track was classified as Class 3^{Footnote 5} according to the Transport Canada–approved Track Safety Rules (TSR). The maximum allowable speed for freight trains was 40 mph. However, due to track conditions, the speed on the entire subdivision had been reduced with temporary slow orders, including:

• 25 mph between Mile 0.82 and Mile 93 (with 11 locations further reduced to 10 mph),
• 10 mph between Mile 93 and Mile 103.87, and
• 25 mph between Mile 103.87 and Mile 125.60 (with 2 locations further reduced to 10 mph).

The subdivision was equipped with 6 hot box detectors, the last one located at Mile 13.30. MMA-002 did not receive any alarms from these detectors.

Between Nantes and Megantic (Mile 7.40 to the lowest point near Mile 0.00), the average descending grade was 0.94%, and the steepest grade over the length of the train was 1.32% at Mile 1.03 (Figure 2). The elevation dropped approximately 360 feet between Nantes and Megantic. For the last 2 miles before the point of derailment, the track descended at a grade of approximately 1.30%. The maximum horizontal curvature of the track was 4.25°, which was at the derailment location (Engineering Laboratory Report LP167/2013).

Cautionary limits^{Footnote 6} were in effect between Mile 0.82 and Mile 0.00, due to the presence of the yard at Megantic. Movements were to be made in accordance with CROR 94 and 105(c).^{Footnote 7} There was a permanent speed restriction of 10 mph over Frontenac Street (Mile 0.28) until the crossing was fully occupied.

1.4.2 Moosehead Subdivision

The Moosehead Subdivision was a single main track that extended east from Megantic (Mile 117.14) to Brownville Junction (Mile 0.00), where it connected with the Millinocket Subdivision. The track was classified as Class 3 according to the TSR. Movements departing Megantic and heading eastward on this subdivision encountered an ascending grade of approximately 1%. Further east at Vachon (Mile 114.10), Quebec, the closest siding to Lac-Mégantic, there was a 6470-foot passing track.

1.5 Rail traffic control

MMA had 2 RTCs on duty at all times (1 in Bangor and the other in Farnham), with duty periods of 12 hours, starting at 0600 and 1800. The Farnham RTC controlled movements west of Megantic, and the Bangor RTC controlled movements east of Megantic. The Farnham RTC on duty at the time of the accident was a qualified LE with previous experience securing trains at Nantes.

1.6 Personnel information

From Farnham to Nantes, MMA-002 was operated by 1 LE positioned in the lead locomotive as per single-person train operations (SPTO) special instructions. The LE was rules-qualified and met fitness and work/rest regulatory requirements. The LE’s 2 previous shifts were:

• MMA-002 (eastbound from Farnham to Megantic) on 02 July 2013 from 1230 to 0030, and
• MMA-001 (westbound from Megantic to Farnham) on 03 July 2013 from 0830 to 2030.

Both trips had been performed with a conductor.

On 05 July 2013, the LE awoke at approximately 0530 and reported for duty at 1330 for MMA-002. When the LE was at home in Farnham, he normally slept about 8 hours per night. When the LE laid over, he usually slept between 5 and 6 hours per night.

The LE was hired by CPR in January 1980, and qualified as an LE in 1986. In September 1996, he transferred to QSR when that company acquired the trackage from CPR. In January 2003, the LE transferred to MMA when QSR was purchased by Rail World, Inc. (RWI), MMA’s parent company. During this time, he completed hundreds of trips between Farnham and Lac-Mégantic and was familiar with the territory.

In the 12 months before the accident, the LE completed about 60 eastbound trips on MMA-002. About 20 of these trips were completed as a single-person train operator.

1.7 Train information

The tank cars originated in New Town, North Dakota, where they were picked up by CPR. At origin, the train consisted of 1 box car (the buffer) and 78 tank cars loaded with petroleum crude oil (UN 1267), a Class 3 flammable liquid.On 30 June 2013, when the train was in Harvey, North Dakota, 1 tank car was removed for a mechanical defect after the train received a safety inspection and a Class I air brake test.^{Footnote 8} This air brake test verifies the integrity and continuity of the brake pipe, as well as the brake rigging, the application, and the release of air brakes on each car.

The petroleum crude oil had been purchased by Irving Oil Commercial G.P. from World Fuel Services, Inc. (WFSI). The shipping documents indicated that the shipper was Western Petroleum Company (a subsidiary of WFSI) and the consignee was Irving Oil Ltd. (Irving).

The cars operated through Minneapolis, Minnesota, Milwaukee, Wisconsin, Chicago, Illinois, and Detroit, Michigan, and arrived in Canada through Windsor, Ontario. The cars travelled to Toronto, Ontario, and underwent a No. 1 air brake test by a certified car inspector on 04 July 2013. The cars departed Toronto as part of a mixed freight train, consisting of 2 locomotives and 120 cars, destined for Montréal. When the train arrived in Montréal, it underwent a routine safety and mechanical inspection in Saint-Luc Yard on 05 July 2013. Mechanical defects were identified on 5 tank cars, which were removed from the train. The remaining tank cars were then interchanged to MMA.

On the morning of 05 July 2013, the cars were taken to Farnham, where they received a brake continuity test and a mechanical inspection by Transport Canada (TC). Minor defects were noted on 2 cars, and these were corrected. Departing Farnham, the train was approximately 4700 feet long, weighed about 10 290 tons (Appendix B) and consisted of the following (Photo 2):

1. lead locomotive MMA 5017, General Electric Company (GE) C30-7;
2. special-purpose caboose (VB car) VB 1;
3. locomotive MMA 5026, GE C30-7;
4. locomotive CITX 3053, General Motors (GM) SD-40;
5. locomotive MMA 5023, GE C30-7;
6. locomotive CEFX 3166, GM SD-40;
7. buffer car CIBX 172032; and
8. 72 tank cars.

1.8 Accident site information

The investigation focused on 3 locations (Figure 3):

• Nantes, where the train was parked;
• downtown Lac-Mégantic, where the train derailed; and
• the ascending grade, east of Megantic, where the locomotive consist came to its final stop (Mile 116.41 of the Moosehead Subdivision).

1.8.1 Nantes

Railway lines at Nantes are located in a rural area where the main track and a siding run parallel and immediately adjacent to public highway 161. The average descending grade on the main track where the train was parked is 0.92%.^{Footnote 9} During site examination, a black oily residue was found on the surrounding vegetation and on the rails where the lead locomotive was parked (Photo 3).

The east siding switch was located at Mile 6.67, and the siding was 7160 feet long. At the time of the accident, several rail cars were being stored there. The siding was equipped with a special derail,^{Footnote 10} located approximately 230 feet west of the switch (Photo 3). A derail is a mechanical safety device that sits on top of the rail and is used to derail runaway equipment. This derail was locked in the derailing position to protect the main track from unintended movements out of the siding.

1.8.2 Lac-Mégantic derailment site

The MMA Megantic Station was located in a commercial district of Lac-Mégantic, where the Sherbrooke and Moosehead Subdivisions met. Frontenac Street, a main thoroughfare, ran through the centre of the town. The main track intersected with Frontenac Street just west of the Megantic West turnout and was maintained for a maximum speed of 15 mph. The turnout was located at Mile 0.23, with the switch points facing west (Photo 4).

The derailed equipment covered the main track, 3 adjacent yard tracks, and the west leg of the wye, which is a triangular arrangement of tracks that can be used for turning rail equipment (Photo 5).^{Footnote 11} At the time of the accident, there were box cars parked in yard tracks 1 and 2.

The track and crossing infrastructure was damaged as follows:

• The damage to the main track started approximately 20 feet east of Frontenac Street.
• The main-track turnout, approximately 400 feet of main track, and an additional 2000 feet of yard and wye tracks, including 3 turnouts, were destroyed.
• Approximately 500 feet from the crossing, the main track was shifted about 4 feet to the north.
• Yard tracks 1 and 2 were demolished from the west-end turnout for about 600 and 500 feet, respectively.
• Rails were curled and twisted, unsettled from tie plates, and moved randomly. Due to the severity of the fire, most track components were badly damaged.
• The Frontenac Street southeast public-crossing cantilever mast and the control box were shattered. Road traffic lights, electrical wires, lighting posts, and other appliances were also damaged.

The derailed equipment at the Lac-Mégantic site consisted of 2 box cars and 63 loaded tank cars.

The derailed equipment came to rest as follows:

• The buffer box car, which had a broken knuckle from a torsional overstress on the leading end (Engineering Laboratory Report LP184/2013), and the first 3 derailed tank cars were on their sides, jackknifed, and partially coupled. They came to rest close to each other and came in contact with the 7 box cars in yard track 2, derailing 1 of the standing box cars.
• The fourth and fifth derailed tank cars were also on their sides, jackknifed, and resting between yard tracks 2 and 3, about 50 feet north of the main track. They were separated by 125 feet from the preceding cars and had struck a pile of rails stored in the yard.
• The sixth and seventh derailed tank cars, still coupled together, came to rest near yard track 3, about 150 feet north of the main track.
• The eighth derailed tank car was uncoupled and came to rest in a wooded area between yard track 3 and the west leg of the wye.
• All of the remaining derailed tank cars came to rest in a large pileup toward the west leg of the wye, with the last derailed car coming to rest on the Frontenac Street crossing. The ninth and tenth cars stayed coupled and aligned with the roadbed. The next 53 cars came off their trucks, jackknifed, and were severely damaged. The debris from the derailed equipment was confined to the derailment site. Most of the wheel sets and trucks were found on the south side of the pileup, within approximately 400 feet from the Frontenac Street crossing. There were no reports of any pieces of tank cars being projected away from the downtown area.

The last 9 tank cars on the train were still coupled to the last derailed car, but did not derail.

Examination of the derailed equipment determined that a hand brake had been applied on the buffer car. No hand brakes were found to have been applied on any of the tank cars.

1.8.3 Location of the locomotive consist

The locomotive consist came to rest approximately 4400 feet east of the Lac-Mégantic derailment site, at Mile 116.41 of the Moosehead Subdivision (Photo 6).

At this location, the track ran parallel to d’Orsennens Street. During site examination, the following was noted:

• There was no damage to the track between the derailment site and the location of the locomotives.
• There was a black oily residue, similar to the residue observed at Nantes, on the ground adjacent to the lead locomotive (MMA 5017), as well as about 600 feet east of where the locomotives came to rest.
• Hand brakes were applied on all 5 locomotives and the VB car.
• There was severe wear on some of the brake shoes and various degrees of blueing^{Footnote 12} on most of the wheels.
• One of the knuckles connecting the second locomotive (MMA 5026) and the third locomotive (CITX 3053) was broken, and a locomotive connector cable had been pinched between the knuckles (Photo 7), indicating that a separation had occurred and the consist had rejoined.
• A broken piece of the knuckle was found under the second locomotive, approximately 15 feet from the coupling (Photo 8). The locomotive knuckle and pin failed in tensile overstress mode, initiating at pre-existing fatigue cracks (Engineering Laboratory Report LP184/2013).

1.9 Train air brakes

Trains are equipped with 2 air brake systems: automatic and independent. The automatic brake system applies the brakes to each car and locomotive on the train, and is normally used during train operations to slow and stop the train. Each locomotive is equipped with an independent brake system, which only applies brakes on the locomotives. Independent brakes are not normally used during train operations, but are primarily used as a parking brake.

1.9.1 Automatic brakes

A train’s automatic braking system is supplied with air from compressors located on each operating locomotive. The air is stored in the locomotive’s main reservoir. This reservoir supplies approximately 90 pounds per square inch (psi) of air to a brake pipe that runs along the length of the entire train, connecting to each locomotive and individual car. Air pressure changes within this brake pipe activate the brakes on the entire train.

When an automatic brake application is required, the LE moves the automatic brake handle to the desired position. This action removes air from the brake pipe. As each car’s air brake valve senses a sufficient difference in pressure, air flows from a reservoir located on each car into that car’s brake cylinder, applying the brake shoes to the wheels.

In order to release the brakes, the LE moves the automatic brake handle to the release position. This action causes air to flow from the main reservoir on the locomotive into the brake pipe, restoring pressure to 90 psi. Sensing this, each car’s brake valve allows air to be released from its brake cylinder, and the shoes are removed from the wheels.

1.9.2 Independent brakes

The independent brakes are also supplied with air from the main reservoir. When an independent brake application is required, the LE moves the independent brake handle, which in turn injects up to 75 psi of air pressure directly from the main reservoir into the brake cylinders of the locomotive. This causes the brake shoes to apply to the wheels (Figure 4).

To release the independent brakes, the LE moves the independent brake handle to the release position. This causes air to be released from the locomotive’s brake cylinders, and the shoes are removed from the wheels.

1.9.3 Penalty brake application

A penalty brake application is similar to a full automatic brake application. However, this type of braking further reduces the brake pipe pressure to zero, requiring a moving train to stop and recharge the brake pipe. This type of braking occurs as a result of a “penalty” applied by the system, such as when the reset safety control (RSC) is not reset. This application occurs at a rate that does not deplete all of the air in each car's reservoir.

1.9.4 Emergency brake application

An emergency brake application is the maximum application of a train's air brakes, during which the brake pipe pressure is rapidly reduced to zero, either from a separation of the brake pipe or operator-initiated action. Following an emergency brake application, a train's entire air system is depleted.

Brake pipe pressure below 40 psi cannot be relied upon to initiate an emergency brake application.

1.9.5 Leakage

When locomotives are shut down, the air compressors are also shut down and no longer supply air to the train. Given that the system has many connections, which are prone to air leaks, the main reservoir pressure will slowly begin to drop soon afterward.

Because the main reservoir supplies air to the entire system, when its pressure falls to the level of that in the brake pipe, the pressure in both components will thereafter diminish at the same rate. This sequence also occurs when the main reservoir and brake pipe reach the same pressure as that in the brake cylinder, at which point all 3 will lose pressure at the same rate.

As the air in the brake cylinder decreases, the amount of force being applied to the locomotive wheels by the independent brakes is reduced. If the system is not recharged with air, the brakes on the locomotives will eventually become completely ineffective.

1.10 Train hand brakes

In addition to a train's air brake system, all locomotives and rail cars are equipped with at least 1 hand brake, which is a mechanical device that applies brake shoes to the wheels to prevent them from moving or to retard their motion (Photo 9). Typically, hand brakes consist of a hand brake assembly, which designates the B-end of each car. When the wheel on the hand brake assembly is tightened, the brakes are applied.

The effectiveness of hand brakes depends on several factors, including hand brake gearing system lubrication and lever adjustment. Also critical is the force exerted by the person applying the hand brake, which can vary widely from one person to another. For example, railway standards are based on an application of 125 pounds of force on the outside rim of the hand brake wheel. However, previous TSB investigations have noted that, on average, employees apply 80 to 100 foot-pounds of force.

1.10.1 Hand brake requirements

1.10.1.1 Locomotives

There are no requirements for a locomotive to hold any other equipment when the hand brake is applied. On many locomotives, including the ones in this accident, when the hand brake is applied, only 2 of as many as 12 brake shoes are applied to the locomotive wheels.

For locomotives placed in service after 04 January 2004, the Federal Railroad Administration (FRA) in the United States requires that the hand brake(s) alone be capable of holding a locomotive on a 3% grade. This equates to a net braking ratio^{Footnote 13} of approximately 10%. Although there were no such requirements prior to 2004, locomotive manufacturers generally designed locomotive hand brakes to meet the 3% holding capacity.

1.10.1.2 Cars

According to Standard S-401 (Brake Design Requirements) of the Association of American Railroads' (AAR) Manual of Standards and Recommended Practices (MSRP), the force applied to the wheels by the brake shoes must be equal to about 10% of the car's gross load weight, with 125 pounds of force applied to the outside rim of the hand brake wheel.

Unlike hand brakes on many locomotives, hand brakes on cars normally apply all brake shoes (typically 8) to the wheels.

1.11 Hand brake effectiveness test

In order to verify that the hand brakes applied are sufficient to secure the train, crews were required to perform a hand brake effectiveness test, in accordance with CROR 112 (b), to ensure that the equipment will not move. After applying the hand brakes, the test is performed by releasing all of the air brakes and allowing the slack to adjust under gravity, or by attempting to move the equipment slightly with reasonable locomotive force.

If the hand brakes prevent the equipment from moving, then they are determined to be sufficient. If not, additional hand brakes must be applied and the process repeated until a successful effectiveness test has been completed.

Special instructions of some Canadian railway companies, including MMA, permitted the hand brakes on the locomotive consist to be included in the minimum required number of hand brakes. For example, if a company's special instructions required at least 10 hand brakes to be applied, and the train were operating with 4 locomotives, then only 6 hand brakes were required to be applied on the cars in addition to those on the locomotives. During an effectiveness test performed with hand brakes applied on the locomotive consist, the LE has to overcome the braking force on the locomotives before moving the rest of the train.

1.12 Rules and instructions on securing equipment

1.12.1 Rule 112 of the Canadian Rail Operating Rules

The CROR are the rules by which Canadian railways under federal jurisdiction operate, which include MMA's Canadian operations. At the time of the accident, CROR 112 stated the following, in part:

(a) When equipment is left at any point a sufficient number of hand brakes must be applied to prevent it from moving. Special instructions will indicate the minimum hand brake requirements for all locations where equipment is left. If equipment is left on a siding, it must be coupled to other equipment if any on such track unless it is necessary to provide separation at a public crossing at grade or elsewhere.^{Footnote 14}

To ensure that there was sufficient retarding force to prevent a train or cars from moving unintentionally, CROR 112 required the effectiveness to be tested when hand brakes were used to secure the equipment. The rule stated:

(b) Before relying on the retarding force of the hand brake(s), whether leaving equipment or riding equipment to rest, the effectiveness of the hand brake(s) must be tested by fully applying the hand brake(s) and moving the cut of cars slightly to ensure sufficient retarding force is present to prevent the equipment from moving [. . .]^{Footnote 15}

In addition to CROR 112, MMA employees were governed by the special instructions in MMA's General Special Instructions (GSIs) and Safety Rules.

Since MMA operated in former CPR territory, it adopted CPR's General Operating Instructions (GOIs).^{Footnote 16}

1.12.2 Montreal, Maine & Atlantic Railway's General Special Instructions on Rule 112

Section 112-1 (Hand Brakes) in MMA's GSIs provided instructions on the minimum number of hand brakes required, and stated in part:

Crew members are responsible for securing standing equipment with hand brakes to prevent undesired movement. The air brake system must not be depended upon to prevent an undesired movement.

[…]

Cars	Handbrakes	Cars	Handbrakes
1 – 2	1 Hand Brake	50 - 59	7 Hand Brakes
3 – 9	2 Hand Brakes	60 - 69	8 Hand Brakes
10 – 19	3 Hand Brakes	70 - 79	9 Hand Brakes
20 – 29	4 Hand Brakes	80 - 89	10 Hand Brakes
30 – 39	5 Hand Brakes	90 - 99	11 Hand Brakes
40 – 49	6 Hand Brake	100 - 109	12 Hand Brakes

Note: […] If conditions require, additional hand brakes must be applied to prevent undesirable movement.^{Footnote 17}

The numbers in the table are commonly referred to by MMA employees as the “10% + 2” instruction.

Section 112-2 (Hand Brakes: Reduced Minimum Number, Designated Specific Locations) provided specific locations where the minimum number of hand brakes had been reduced. For example, at Sherbrooke, between cautionary limit signs, including the main track and sidings, and at Farnham, the minimum number of hand brakes equated to approximately 10%. For Megantic Yard, the required number was less than 10%.

1.12.3 Montreal, Maine & Atlantic Railway's Safety Rules on Rule 112

MMA's Safety Rule 9200 (Sufficient Number – Operating Hand Brakes) stated in part:

Employees must:

a. Know how to operate the types of hand brakes with which various types of cars are equipped.

[…]

c. Before attempting to operate handbrake, make visual inspection of brake wheel, lever, ratchet and chain.

[…]

f. Be aware of and work within the limits of your physical capabilities and do not use excessive force to accomplish tasks. Past practices that do not conform to the rules are unacceptable.^{Footnote 18}

MMA's Safety Rule 9210 stated in part:

h. All hand brakes shall be fully applied on all locomotives in the lead consist of an unattended train.

i. When leaving railway equipment, the minimum number of hand brakes must be applied as indicated in the following chart.^{Footnote 19} Additional hand brakes may be required; factors which must be considered are:

• Total Number of Cars
• Empties or Loads
• Weather Conditions
• Grade of Track

[…]

k. In reference to the minimum number of hand brakes in the preceding chart, 19 it is acceptable to include the hand brakes applied on locomotives.

[…]

m.  There may be situations where all hand brakes should be applied.

[…]

o. To ensure an adequate number of hand brakes are applied, release all air brakes and allow or cause the slack to adjust. It must be apparent when slack runs in or out, that the hand brakes are sufficient to prevent that cut of cars from moving. This must be done before uncoupling or before leaving equipment unattended.^{Footnote 20}

1.12.4 Instructions of Class 1 railways regarding Rule 112 of the Canadian Rail Operating Rules

1.12.4.1 Canadian Pacific Railway

Prior to early 2013, CPR's instructions for determining the minimum number of hand brakes were to divide the number of cars to be left unattended by 10, and then add 2. The instructions also included the requirement to secure each locomotive left unattended with its hand brake. When a train was to be left unattended with the locomotive(s) attached, it was acceptable to include the locomotive hand brakes as part of the minimum required number of hand brakes.

Prior to the accident, CPR modified its hand brake instructions, no longer specifying the minimum number of hand brakes. Crews were responsible for evaluating their train and other operating conditions to determine the sufficient number of hand brakes and for testing their effectiveness before the equipment was left unattended.

In addition, section 2.0 of CPR's GOIs still stated that on light, heavy, and mountain grades,^{Footnote 21} a specific number of hand brakes (higher than the minimum) was required when a hand brake effectiveness test could not be performed. For example, on grades between 1.0% and 1.29%, hand brakes were required on 25% of the train. Additionally, in some territories, an increased number of hand brakes had to be applied when a movement was stopped on a grade.

1.12.4.2 Canadian National

At Canadian National (CN), the hand brake instructions in effect at the time of the accident for rail cars left unattended were:

• Divide the number of cars on the train by 10 and add 1 additional hand brake, up to a maximum of 5 hand brakes.
• If the hand brake effectiveness test is not successful, more hand brakes are required to ensure that the movement remains immobilized.
• Certain locations outlined in CN's timetable required double (up to a maximum of 10) the number of hand brakes, depending on the track characteristics.
• Trains with locomotives attached with at least 1 locomotive running can be left on the main track with only 1 locomotive hand brake applied, provided that there is brake continuity throughout the train, the automatic air brakes are fully applied and the independent brakes are applied.^{Footnote 22}

In addition to the above instructions, CN special instructions for leaving trains or transfers unattended on mountain grade territory were as follows:

• Every effort must be made, including RTC pre-planning, to avoid leaving trains or transfers in steep grades in excess of 0.75%.
• When absolutely necessary, a sufficient number of hand brakes must be applied to prevent any unintended movement caused from possible brake cylinder leak-off.
• The automatic air brakes must not be solely relied upon to secure equipment against undesired movement.
• Stop with the least amount of air brake application possible.
• Leave locomotives attached with brake pipe continuity throughout the train, and do not bleed off cars before applying hand brakes.
• Apply 25% of the train hand brakes on grades between 0.75% and 0.9%, and apply 40% of the train hand brakes on grades up to 1.4%.^{Footnote 23}

Crew members were required to communicate and confirm that they had left the train in accordance with these instructions, and the RTC was to be advised of the number of hand brakes applied.

1.13 Recorded information

1.13.1 Locomotive event recorder

A train's locomotive event recorder (LER) is analogous to a “black box” on an aircraft. The LER monitors and records a number of parameters, including throttle position, time, speed, and distance, as well as pressure within the brake pipe and locomotive brake cylinder. Changes in the brake pipe pressure cause each car to apply (or release) its air brake. In this accident, because the train was unattended, the LER was instrumental in providing key pieces of data.

Table 1 summarizes some important information obtained from the download of the LER on the lead locomotive. Brake pipe pressure is at its maximum at 95 psi (brakes fully released), and locomotive brake cylinder pressure is maximized at 70 psi (full independent brake application). Any drop in brake cylinder pressure indicates a reduction in retarding force.

Table 1. Locomotive event recorder information

Time	mph	Brake pipe pressure (psi)	Locomotive brake cylinder pressure (psi)	Event
05 July 2013 2249:37	0	82	69	MMA-002 wa stopped at Nantes using a 13-psi automatic brake application, and the independent brakes were fully applied.
2303:48	0	94	69	The automatic brakes were released. The locomotive independent brakes remained fully applied.
2358:42	0	95	69	Lead locomotive MMA 5017 was shut down.
06 July 2013 0005:55	0	94	70	Brake pipe pressure began to decrease, and continued to decrease at an average rate of 1 psi per minute.
0013:55	0	79	69	Independent brake cylinder pressure began to decrease at the same rate as the brake pipe pressure.
0058:21	1	32	27	MMA-002 began to run away.
0115:30	65	16	14	The highest recorded speed of 65 mph was attained.
0115:31	65	0	14	Brake pipe pressure dropped to 0 psi as the cars began to derail. The locomotive consist separated into 2 sections.
0117:12	0	0	6	The first section stopped 5016 feet east of the point of derailment, at Mile 116.30 of the Moosehead Subdivision, on a 1% ascending grade.
0245:06	1	0	0	The first section of the locomotive consist began to move backwards (west) down the grade toward downtown Lac-Mégantic.
0246:23	8	0	0	The first section of the locomotive consist travelled 475 feet west and struck the stationary second section of the consist.
0246:42	0	0	0	The 2 sections rejoined and moved an additional 106 feet west before coming to a final stop.

1.13.2 Sense and braking unit

The sense and braking unit (SBU) is a device placed on the rear of the train and is connected to the train brake pipe. The SBU senses train movement, monitors brake pipe pressure, and sends the information to the locomotive, where it is displayed in the cab. The SBU can also be used to initiate an emergency brake application from the end of the train.

The SBU data from MMA-002 were downloaded (Engineering Laboratory Report LP132/2013). The SBU data and crossing download data were used to corroborate the LER data. An analysis of the SBU data determined that when the SBU first recorded movement (start-to-move) at Nantes, brake pipe pressure at the rear of the train was 29 psi. Approximately 16 minutes and 40 seconds after the train began to move, the brake pipe pressure at the rear of the train had diminished to 0 psi.

1.14 Brake testing conducted by the Transportation Safety Board

1.14.1 Air brake and hand brake tests using similar locomotives and tank cars

A train similar to MMA-002 was assembled to test braking system performance. The train consisted of 5 locomotives (2 GE C30-7s, 2 GE C39-8s, and 1 GM SD-40), 1 VB car, and 80 Class 111 tank cars. The first test was conducted to determine the time required to manually shut down the 4 trailing locomotives and apply hand brakes. The test results are summarized in Table 2.

Table 2. Time required to shut down the 4 trailing locomotives and apply hand brakes

Number of locomotives shut down	Number of hand brakes applied	Time
4	7	9 minutes and 20 seconds
4	9	10 minutes and 55 seconds
4	18	17 minutes and 20 seconds

With the locomotives shut down, the brake pipe fully charged with air, the automatic brakes released, and the independent brakes applied, a second test was conducted to understand the effects of a normal loss of air on the brake system. The train brake pipe pressure as well as the locomotive brake cylinder pressure were monitored at different locations on the train. The test results were as follows:

• After 30 minutes, the brake pipe pressure began to drop, and continued to drop at an average rate of approximately 1 psi per minute.
• After 50 minutes, the locomotive brake cylinder pressure began to decrease at the same rate as the brake pipe pressure.
• After 1 hour and 35 minutes, the brake cylinder pressure dropped to 27 psi, the point at which MMA-002 first began to roll.
• Due to the slow decrease in brake pipe pressure, no automatic brake application occurred.

Also, when the electrical breakers were put in the off position, no penalty brake application occurred.

1.14.2 Air brake and hand brake tests on the occurrence locomotives

The locomotives from MMA-002 were moved to the siding at Vachon for examination and testing of the air brakes and hand brakes. This testing included a brake leakage test of the entire consist, a full brake system evaluation for each locomotive, and brake shoe force testing.

The first test determined that, starting from a fully charged brake system, the brake cylinder pressure dropped to 27 psi in 1 hour and 6 minutes due to air leakage.

The second test evaluated the braking performance of each locomotive and its components. Appendix C identifies the sources of measurable air leakage for each locomotive.

Locomotives are expected to leak air from their systems once they are shut down, yet the amount of time it takes for the independent brakes to leak off is highly variable. While leakage was noted, and was sometimes excessive on several components, it did not exceed the pressure-maintaining capabilities of the locomotives, and the combined leakage was within industry norms. Nevertheless, as a result of the above tests, 5 valves, including the quick release brake (QRB) valve, were removed for further analysis. The majority of the defects with the valves were related to the age and condition of their internal components (rubber seals, O-rings, return springs, etc.). See Engineering Laboratory Report LP185/2013 for complete details on the condition of the valves.

1.14.2.1 Quick release brake valve

On GE C30-7 locomotives, the brake cylinder for the brake shoes applied by the hand brake is equipped with a QRB valve. The QRB valve is normally tripped during the application of the hand brake by the brake chain. When tripped, the QRB valve removes air from the brake cylinder so that an effective hand brake can be applied (Photo 10 and Photo 11).

The QRB valve on the second locomotive (MMA 5026) did not trip to exhaust brake cylinder air when tested. An examination of the valve showed wear and damage to the QRB valve's lifter and inside surface of the retaining disc. In addition, the examination showed that non-standard repairs had been applied to the valve's release mechanism in an attempt to keep the valve working.

If the QRB valve does not trip, the hand brakes will not provide any braking effort. To ensure that the hand brakes remain operational on these locomotives, MMA issued Summary Operating Bulletin 2-276, which stated in part:

The hand brake will not tighten if the air from the R#2 brake cylinder is not exhausted. The handbrake chain will tighten and it may appear that the handbrake is set however if the R#2 brake cylinder is in the “out” position, the handbrake is not applied. On C-30-7 locomotives if an air exhaust is not heard while tightening the handbrake the QRB valve may be malfunctioning or out of adjustment.

It is possible to manually operate the valve from the ground on the right side of the locomotive. The QRB valve and handle is located directly adjacent to the handbrake chain, mounted on the top of the front truck between axles 2 and 3. A crew member can manually trip the valve by use of the lever located on the valve. After tripping the QRB valve the handbrake must immediately be re-tightened.^{Footnote 24}

The LE was not aware of this instruction.

1.14.2.2 Examination of the wheels and brake shoes on the locomotive consist

The wheels and brake shoes on the locomotives were examined. The brake shoes were measured to analyze the wear that had occurred during the runaway and to determine the amount of braking force that was being applied (Engineering Laboratory Report LP182/2013). The following was determined:

• Some of the brake shoes had worn through the lining to the backing plate.
• The pattern of wheel blueing (Photo 12) and brake shoe lining wear indicated that the independent brakes had been providing most of the retarding brake force for the train.
• Not all of the wheels subjected to hand brake force (2 per locomotive) showed full tread blueing or excessive brake shoe lining wear. This pattern indicated that these hand brakes had not been, or could not be, applied securely.

1.14.2.3 Brake shoe force testing on the locomotive consist

An examination of the brake shoe force generated by the locomotive consist was performed with both air brakes and hand brakes (Engineering Laboratory Report 187/2013). Using a coefficient of friction of 0.38 and 100 foot-pounds of torque,^{Footnote 25} the following was determined:

• The total retarding brake force required to hold the train on the grade where it was parked at Nantes was calculated to be approximately 146 700 pounds.
• Before applying the hand brakes, the total retarding brake force generated by the independent brakes was approximately 249 760 pounds.
• After applying the hand brakes (and activating the QRB valves on those locomotives so equipped), the total retarding brake force generated by the independent brakes was approximately 215 500 pounds.
• The total retarding brake force generated by the 7 hand brakes on the train (taking into consideration that the QRB valve did not trip on MMA 5026) was approximately 48 600 pounds. Had the QRB valve been operative, the total retarding brake force would have increased by 4830 pounds.
• At a brake cylinder pressure of 27 psi, when the train first began to move, the retarding brake force of the independent brakes was reduced to approximately 97 400 pounds.
• The average brake ratio of the locomotive hand brakes was approximately 3.8% (range of 3.0% to 4.7%). The average retarding brake force generated by the locomotive hand brakes was approximately 5590 pounds per locomotive. (When 80 foot-pounds of torque were applied, the average retarding brake force was 4360 pounds per locomotive.)
• The brake ratio of the VB car was 19.2%.

1.14.3 Hand brake and air brake testing on tank cars

The air brakes and hand brakes of the 9 tank cars that did not derail were tested and met AAR requirements. The average retarding brake force generated by the hand brakes at 80 foot-pounds of torque was approximately 6920 pounds per car. At 100 foot-pounds of torque, the brake force was approximately 8650 pounds per car.

1.14.4 Testing of the sense and braking unit

Testing was conducted on a rail car to evaluate how the rate of brake pipe leakage affected the car's air brake system. Following simulated brake pipe leakage, the car's brake pipe pressure dropped 5 psi (to 85 psi) in 7 minutes. The car's air brakes did not engage. The car was then recharged to 90 psi, and the test was repeated. In this test, the brake pipe was reduced by 80 psi (to 10 psi) in 75 minutes. The car's air brakes again did not engage.

A turbine-equipped SBU,^{Footnote 26} similar to the one used on MMA-002, was then tested to determine what effect the brake pipe air lost through the SBU would have on the car's air brake system. The venting of air through the SBU caused the air brakes on a single car to engage almost immediately.

Testing was then conducted with a turbine-equipped SBU on a train with 2 locomotives and 71 cars. The test showed that a similar rate of brake pipe air loss through the SBU would initiate a brake application on a train that was 5 cars or fewer, but not on a train longer than 5 cars. Similar to the single-car test, this test demonstrated that brake pipe air pressure on an entire train can be reduced to 0 psi at a slow rate and result in no brake application on the cars.

1.14.5 Additional hand brake testing on tank cars

Railways require that air brakes be fully released on cars prior to the application of hand brakes. However, in some instances, such as when a train is stopped on a grade, it is not possible to release the air brakes before applying the hand brakes. Testing was conducted on a cut of tank cars to determine the effect on the hand brakes from the 13-psi automatic brake application on MMA-002 at Nantes. It was determined that when the hand brakes were applied after an air brake application, more brake force was applied to the wheels. The extent of the additional force was relative to the extent of the brake application. Through this testing, it was also determined that an air brake application of 13 psi would result in hand brake forces approximately 40% higher than the same application without air brakes applied.

1.14.6 Previous brake testing for other occurrences

The TSB investigated other runaway train occurrences where extensive hand brake tests were conducted (TSB Rail Investigations R95C0282, R96C0172, and R11Q0056). It was determined that an average of 65 foot-pounds to 80 foot-pounds of torque had been applied on the hand brakes. In one occurrence, the air brakes leaked off and released after approximately 7 hours due to weather conditions. In another occurrence, the majority of the brake cylinders of the cars leaked off after approximately 1 hour following an emergency brake application due to their poor condition. See Appendix D for more information on previous brake testing for other occurrences.

1.14.7 Wiring of the locomotive reset safety control

New locomotives manufactured since 1986 must be equipped with a reset safety control (RSC). The RSC is a vigilance system that activates alarms and then applies a penalty brake application if it is not reset by the LE, or the controls are not being manipulated within a predetermined time interval. There are no standards for the installation of RSCs. Usually, when the electrical breaker on an RSC is opened or the main electrical power is shut off on a locomotive, a penalty brake application will result. However, when the electrical power was shut off on MMA 5017 at Nantes, the RSC did not create a penalty brake application.

The 3 GE locomotives on MMA-002 were built before 1986 and were retrofitted with an RSC by a previous owner. The locomotives were examined by the TSB (Engineering Laboratory Report LP233/2013), and the following was determined:

• The wiring modifications on the 3 locomotives were not consistent, and the penalty brake performance for all 3 locomotives was different.
• Locomotive MMA 5017 did not produce a penalty brake application under any of the power loss conditions tested. The RSC had been connected directly to the battery. Therefore, the RSC would remain powered even when the main electrical cut-off switch was opened.

Testing of 5 other GE locomotives owned by MMA showed similar variations. In total, no penalty brake application occurred when the electrical breakers were opened on 5 of the 8 locomotives tested. Since there is no requirement for the RSC to initiate a penalty brake application in the event that the power to the device is cut, there is no requirement for this function to be verified during shop inspections.

1.15 Lead locomotive MMA 5017

Lead locomotive MMA 5017 was a GE model C30-7 that had been placed in service in 1979. It was equipped with a 16-cylinder, turbocharged 4-stroke diesel engine, and generated 3000 horsepower. The locomotive had 2 three-axle trucks and a 26 L-type air brake system. The overall weight of MMA 5017 was approximately 195 tons.

1.15.1 Engine repair and fire on locomotive MMA 5017

On 07 October 2012, MMA 5017 entered the shop in Derby, Maine, after an engine failure. It was determined that several power assemblies as well as cam segments had been damaged as a result of an articulated rod failure on one of its power assemblies. The engine block had also been damaged at the same cam bearing. On 15 March 2013, the locomotive was returned to the shop, where an oil leak was found at the same cam bearing bore. To repair the leak, the cam bearing mounting bolt at the cam bearing bore was tightened.

On 04 July 2013, MMA 5017 was in the lead position of MMA-001, being operated by another LE. On the trip from Nantes to Farnham, MMA 5017 was having engine problems. The engine was surging, which was reported by fax to the shop in Derby that day, and verbally to Farnham management the next morning. No action was taken, and MMA 5017 remained in service.

On 05 July 2013, with MMA 5017 in the lead position of MMA-002, the LE reported to the RTC upon departure that there were problems with the engine surging when the throttle was at full. During the trip to Nantes, the engine continued to surge, affecting the LE's ability to maintain a consistent speed. Upon arrival, heavy black and white smoke, as well as oil droplets, were observed coming from the lead locomotive. At 2340, shortly after the LE's departure, a fire ignited in the locomotive smoke stack (Photo 13).

Following the accident, the locomotive consist was moved from Lac-Mégantic to a maintenance facility in Saint John for examination. A partial engine teardown of MMA 5017 was conducted (see Engineering Laboratory Report LP181/2013 for complete details). It was determined that the cam bearing had fractured when the mounting bolt was over-tightened after the cam bearing had been installed as part of a non-standard repair to the engine block. This temporary repair had been performed using a polymeric material, which did not have the strength and durability required for this use (Photo 14). Failure of the cam bearing reduced the engine oil supply to the valve train at the top of the associated power assembly. The decreased lubrication led to valve damage and eventually to a punctured piston crown. The damaged valves and piston crown allowed engine oil to flow into the cylinder and the intake and exhaust manifolds. Some of the engine oil collected in the body of the turbocharger. The engine fire later occurred in the exhaust stack due to the build-up and ignition of engine oil in the body of the turbocharger.

1.15.2 Abnormal engine conditions

MMA's Safety Rule 9126 stated:

When there is an abnormal condition such as noise, smoke or odor coming from engine, the engine should be shut down. Employees must immediately leave the engine room and shut down the engine by emergency “shut down” button at the control stand, control panel or fueling location on either side of the locomotive.^{Footnote 27}

1.16 Defences to prevent runaway trains

Runaways can best be avoided by selecting a location that would limit the distance travelled by an uncontrolled movement (bowl-shaped tracks for switching) or by ensuring that trains are not left unattended by performance of crew-to-crew exchanges. Due to many factors, such as mechanical breakdowns and severe weather conditions, railways have developed rules regarding the safe securement of equipment. In addition, there are physical defences that provide additional levels of safety, such as:

• Derails—These are usually placed on secondary tracks, and in some cases in sidings, and set in the derailing position to protect the main track from cars that may be rolling uncontrolled. In locations such as the main track, where there are no permanent derails, portable derails weighing about 40 pounds can be carried in a locomotive cab. They can be easily applied by an LE and can provide a physical defence to prevent uncontrolled movements. Portable derails are not commonly used when securing trains on the main track.
• Chocking devices—These portable devices weigh as little as 20 pounds, and can be applied to the rail, directly against the leading wheels of a train. They provide temporary blocking of that equipment. Chocking devices are more commonly used when securing trains on other than main track.
• Mechanical emergency device—This device activates the braking system of a stopped train in the case of an undesired movement. It consists of a clamp that attaches to the rail and to the lead locomotive air brake hose. If the train begins to move, the hose detaches from the locomotive, the brake pipe air is vented, and the emergency brakes are activated.
• Electronically controlled pneumatic (ECP) brakes—This braking system is an alternative to conventional air brakes. The system sends electrical signals to the cars, instantaneously applying the brakes (quick response braking); it does not rely on the flow of air from the locomotive to each car to activate the brakes. Information is also exchanged between the locomotives and each car. When the system senses that the brake pipe pressure has dropped below 50 psi, a “low brake pressure condition” message is initiated. This message results in all of the ECP-equipped cars and the ECP-equipped locomotives automatically applying their brakes in emergency.

Auto-start systems (also known as hot starts) can be installed on locomotives to automatically shut down and restart locomotives for fuel conservation and to protect critical systems. Locomotives equipped with auto-start will automatically shut down when they are idling for a set time and will automatically restart when certain parameters are met, such as when locomotive brake cylinder pressure falls below a prescribed level and when main reservoir pressure falls below 100 psi. However, the auto-start feature would be nullified if the locomotive is set to isolate, or if it has been shut down manually.

Some of the locomotives used by MMA were equipped with an auto-start system, including locomotives CITX 3053 and CEFX 3166. MMA's Summary Operating Bulletin 2-276 states:

(L) Hot Starts/Locomotive Shut Down: Unless equipped with a working Hot Start, when temperature is above 45 degrees, Engineers must shut down locomotives that will be idling for periods in excess of 15 minutes [....]^{Footnote 28}

When MMA crews were leaving trains at Nantes, most would leave the lead locomotive running and shut down all others, including those equipped with the auto-start system. On the night of the accident, the LE manually shut down locomotives CITX 3053 and CEFX 3166.

Operating instructions adopted by MMA on locomotive auto-start systems highlight the importance of ensuring that trains are properly secured and tested, as it is expected that main reservoir, brake pipe, and brake cylinder pressures will eventually leak off.

The RSC can be upgraded to include a built-in runaway protection feature that initiates an alarm as soon as it detects a movement of 0.5 mph. If the RSC is not reset, a penalty brake application is initiated.

As the SBU, along with the input and display unit (IDU) in the locomotive, serves as a monitor for the air pressure, manufacturers indicated that, with a software update, SBUs could be set up to apply a penalty or emergency brake application before the brake pressure becomes too low to provide effective braking.

1.17 Track information

1.17.1 Particulars of the track

In the vicinity of the derailment, the track was continuous welded rail (CWR). The rail was secured with 2 spikes per tie plate in tangent track, and 3 spikes per tie plate in the curves. Most of the rail was Algoma Steel 115-pound RE rolled between 1966 and 1971, except in some curves, where the high rail was rolled and installed in 2003. The rail was laid on 14-inch double-shouldered tie plates. There were approximately 3200 hardwood ties per mile. Every second tie was box-anchored. The ballast consisted mainly of crushed rock and was generally in good condition. There was insufficient ballast, or ballast fouling, noted at 10 locations over a 10-mile distance.

1.17.2 In-train forces, vehicle dynamics, and derailment speed

MMA-002 ran away eastward and, when approaching Megantic Station, encountered a reverse curve configuration beginning with a 1.5°, left-hand, 670-foot curve with a maximum superelevation ^{Footnote 29} of 1 inch, followed by a 60-foot tangent section of track, then a 4.25° right-hand, 1200-foot curve. This curve had a 230-foot-long entry spiral, starting approximately 100 feet west of the Frontenac Street public grade crossing. After the crossing, the turnout at Megantic West provided access to Megantic Yard and its wye tracks. The turnout was a No. 11, 115-pound, left-hand-operated turnout^{Footnote 30} at the end of the entry spiral.

For the right-hand curve section in the vicinity of the derailment, the superelevation (1 inch to 1 ½ inches) corresponded to a balanced speed^{Footnote 31} of between 18 mph and 22 mph. An analysis of the derailment speeds estimated that 10 cars derailed below 40 mph, 5 of which derailed below 30 mph (Engineering Laboratory Report LP039/2014) (Figure 5). Recorded data showed that the derailment took approximately 1 minute (Engineering Laboratory Report LP136/2013).

At the time of the derailment, the train was near the Megantic West turnout. The train was analyzed to assess the in-train forces as it transitioned from the downhill grade of 1.26% to the relatively flat terrain of 0.2% at Megantic. A vehicle dynamics simulation of a Class 111 tank car negotiating the curve at Megantic Station was also conducted (see Engineering Laboratory Report LP188/2013 for complete details). It was determined that a combination of the centrifugal force and the dynamic forces generated by the track geometry conditions at a speed of 65 mph was sufficient to cause the derailment. With extremely high lateral forces on the high rail, gauge widening could occur. Furthermore, with complete unloading on the low rail, wheel lift could occur. Either of these conditions or a combination could cause track damage and a derailment.

1.17.3 Track inspections by Montreal, Maine & Atlantic Railway

The main track was regularly inspected as per the TSR. Prior to the accident, MMA performed these track inspections:

• Visual inspection by a track maintenance employee in a hi-rail vehicle was performed on 05 July 2013. During this inspection, no exceptions were noted in the vicinity of the derailment.
• Monthly turnout inspections were performed as required. The most recent turnout inspection was performed on 21 June 2013, and no defects were noted.
• The track was tested annually for internal rail defects using an automated rail flaw detection system. The most recent rail flaw testing was on 19 September 2012, and no defects were noted in the vicinity of the derailment.
• The track geometry was last tested by a track geometry car on 21 August 2012 (Appendix E).

In the immediate area of the rail joints located between the Frontenac Street public grade crossing and the Megantic West turnout, the track geometry readings for surface, cross-level, gauge, and alignment were measured.

The track geometry readings met the maximum allowable limits for 15 mph. According to the TSR, to operate as Class 2 track, the track had to be improved to meet the 25-mph criteria (within 72 hours after the passage of the track geometry car). Consequently, following the August 2012 track geometry test, the rail joints were lifted to correct the geometry irregularities and restore the track to Class 2 criteria. The fouled ballast was not replaced, and was not compacted with heavy machinery.

1.17.4 Post-accident track examination

The TSB examined sections of track over approximately 30 miles on each side of the town of Lac-Mégantic (that is, between Mile 106.00 of the Moosehead Subdivision and Mile 18.00 of the Sherbrooke Subdivision). The following was observed:

• The rail surface had microcracks, corrugation, and multiple signs of wheel slippage and crushed rail head.
• The rail head on the low rail (that is, inside of the curve) of many curves was flattened and worn.
• The vertical rail wear exceeded the acceptable wear limits at Miles 106.60, 107.50, 110.40, 115.56, and 116.25 of the Moosehead Subdivision, and at Miles 3.00, 16.15, 17.50, and 17.60 of the Sherbrooke Subdivision. The vertical wear was as much as 25 mm (1 inch) in some areas.
• Lateral rail wear could not be accurately measured because of crushed rail head and loss of rail profile condition. At Mile 110.55 of the Moosehead Subdivision, the lateral part of the rail head on the field side was completely worn.
• In the curve at Mile 17.60 of the Sherbrooke Subdivision, the rail showed signs of track buckling (for example, the rail undulated laterally, and the ties had shifted sideways).
• At rail joints with significant vertical rail wear, there was damage to the joint bars due to wheel load impacts (that is, contact with wheel flanges). Wheel flange contacts were observed in the area of the derailment (Photo 15).

1.17.5 Rail wear standards at Montreal, Maine & Atlantic Railway

MMA's track standards were based on standards previously developed by the Bangor & Aroostook Railroad^{Footnote 33} (that is, System Track Standards, Part I, for track maintenance limits, and Part II for construction and maintenance practices).

For rail wear, System Track Standards, Part I, Section 113.5 (b), specifies in part:

(1)  VERTICAL HEAD WEAR
115 RE ¾”– Then limit track speed to 25 mph

[…]

(2)  GAGE WEAR (is measured five-eighths of an inch below the top of the rail head)
115 RE ¾”– Then limit track speed to 25 mph^{Footnote 34}

At MMA, when the vertical rail wear exceeded the limits set out in its Rail Wear Standard, a temporary slow order of 25 mph was placed on the track. This track section would also be identified for its rail replacement program. MMA did not have a vertical head wear limit specific to jointed rail.

In comparison, the rail wear standards for Canadian Class 1 railways are:

• CN's track standards are summarized in Engineering Track Standard (ETS) TS 1.0 – General 13 and 14, June 2011 edition. Based on these standards, the vertical wear limit for 115-pound rail is 16 mm (5/8 inch) for CWR, and 8 mm for jointed rails. For jointed track, high-clearance joint bars must be used to avoid any contact between the wheel flange and joint bar. Rail wear standards do not require replacement of the rail, as long as the wear limit has not been reached. However, the sum of the vertical and flange wear shall not exceed 21 mm (13/16 inch). A speed restriction may be placed and additional inspection frequency specified if rail is worn beyond the limits and is to be left in the track. The condition of rail (for example, shells, spalls, corrugation) must also be taken into consideration if the rail is left in the track.^{Footnote 35}
• CPR's track standards are summarized in the Red Book of Track Requirements. These standards specify that the vertical wear limit of 115-pound RE rail is 17 mm (11/16 inch). A varying amount of combined vertical and flange wear is allowed, up to a maximum of 23 mm (7/8 inch). Where rail wear has resulted in joint bars being heavily affected by wheel flanges, the joint must be welded, or a high-clearance bar or compatible worn bar must be applied. Train speed must be restricted to a speed as near as possible to equilibrium speed until the joint is welded or a high-clearance bar is applied.^{Footnote 36}

1.17.6 Laboratory examination of track components

A No. 11 rail-bound manganese frog and other track components were recovered and sent to the TSB Laboratory for examination (Engineering Laboratory Report LP151/2013). It was determined that the wing rails and other components were damaged due to overstress fractures. It was also determined that the vertical rail wear was within allowable limits, and that there were no pre-existing defects or fatigue cracks on the fracture surfaces.

1.18 Class 111 tank cars

In 2013, there were approximately 228 000 Class 111 tank cars in service in North America, of which over 141 000 were being used to transport dangerous goods (DGs). Of those, 98 000 were used to carry Class 3 DGs (flammable liquids). The majority of these tank cars were general-service cars (Figure 6). The specifications applicable to these cars are listed in TC safety standard CAN/CGSB-43.147^{Footnote 37} and the U.S. Code of Federal Regulations Title 49 (49 CFR), paragraph 179.200,^{Footnote 38} for Canada and the United States, respectively.

1.18.1 Examination of the derailed tank cars

The 63 derailed tank cars were examined in the field (Engineering Laboratory Report LP149/2013), and the following was determined:

• All tank cars were manufactured to United States Department of Transportation (DOT) specification 111A100W1 between 1980 and 2012, and 78% were built in the 5 years prior to the accident.
• All tank cars had been ordered before 01 October 2011.
• None of the tank cars were equipped with head shields, jackets, or thermal protection.
• The shells of 52 tank cars and the heads of 44 tank cars were made of non-normalized steel.^{Footnote 39}
• The shells of 11 tank cars and the heads of 19 tank cars were made of normalized steel.

All 63 derailed tank cars were in compliance with the specification requirement that was in effect at the time of their approval and construction.

The stencilling or stamped markings on some of the tank cars was not legible due to fire and impact damage. Furthermore, some tank car identification plates had been affixed with low-melting-point fasteners and had separated from the tank during the post-derailment fire.

1.18.2 Tank car damage assessment

An assessment of the damage sustained by the 63 derailed tank cars revealed that 59 (94%) were breached and released crude oil due to tank damage. The location and extent of the damage varied, depending on the orientation and speed of the cars during the derailment. Many cars sustained damage in multiple locations (Table 3).

Table 3. Distribution of damage on derailed tank cars

Tank car shells	37 cars
Tank car heads	31 cars
Top fittings and protective housings	20 cars
Pressure relief devices	12 cars
Bottom outlet valves	7 cars
Thermal tears	4 cars
Manway covers	2 cars

Three-dimensional (3D) laser scanning was performed on selected derailed tank cars (Engineering Laboratory Report LP165/2013). Analysis of the data revealed that the shells of the tank cars exhibited impact damage ranging from localized buckles to large-scale buckling, and sustained significant reductions in volume (for example, close to 40% reduction in volume was sustained by the most deformed tank) (Photo 16).

1.18.2.1 Damage to stub sills and couplers

Stub sills are located at each end of a tank. For cars so equipped, the tank not only carries the product, but is also used as the primary structural member to carry in-train forces. The stub sills contain draft gear components that help absorb in-train dynamic buff (push) and draft (pull) forces, as well as coupler vertical forces (Photo 17).

The field examination showed the following:

• Five tank cars had no impact damage to either the stub sill or coupler.
• Fifty-eight tank cars exhibited at least 1 damaged stub sill or coupler.
• Forty-six tank cars were damaged at both ends of the car, including damage to the stub sill or coupler.
• The last 2 derailed cars exhibited significant impact damage to their stub sills and couplers.
• Nine tank cars exhibited separations at the stub sill attachments (Photo 18).

1.18.2.2 Damage to tank car shells

More than half of the tank cars (37 cars) released product due to impact damage to their shells (Photo 19). Other tank car shell damage included deformed/dented shells with no breach, as well as breaches due to thermal tears.

1.18.2.3 Damage to tank car heads

All but 4 of the 63 derailed cars exhibited some form of impact damage (for example, denting or breach) in the top portion of at least one head (Photo 20). About half of the tank cars (31) released product due to damage to the tank car head.

1.18.2.4 Damage to top fittings and housings

The majority of the tank cars with damaged top fittings came to rest on their sides or upside down, allowing the product to flow from the damaged top fittings and feed the pool fire.

The top fittings of 32 of the 63 tank cars were housed in a ¾-inch-thick steel circular protective housing designed to provide top discontinuity protection in accordance with applicable AAR requirements^{Footnote 40} (Photo 21).

The top fittings of the remaining 31 tank cars were located in a hinged housing that did not have to meet any of the top discontinuity protection requirements (Photo 22).

The field examination determined the following:

• The top fittings were breached on 4 of the 27 cars (15%) that were equipped with top discontinuity protection housings and that sustained impact damage.
• The top fittings were breached on 16 of the 26 cars (62%) that were equipped with a hinged housing and that sustained impact damage.

1.18.2.5 Damage to manway covers

A manway cover is used to seal the large opening at the top of the tank (Photo 23). This opening is used by personnel to gain entry into the tank for inspection and maintenance activities and, in Class 111 tank cars, may also be used to load product into the tank car. The manway cover is secured to the manway nozzle using a hinge and typically 6 to 8 bolts. It is sealed by tightening the bolts onto a manway cover gasket.

The field examination determined the following:

• The manway gaskets on most of the derailed tank cars were damaged by extended exposure to the post-derailment fire.
• The manway cover of 2 cars had separated as a result of impact damage.
• The manway cover hinges, bolts, or lugs of 22 tank cars exhibited impact damage that may have compromised their seals.

1.18.2.6 Damage to pressure relief devices

All 63 derailed tank cars were equipped with at least 1 reclosing pressure relief device (PRD),^{Footnote 41} as per the federal regulations.^{Footnote 42} The start-to-discharge (STD) pressure^{Footnote 43} of these PRDs was either 75 psi (on 48 tank cars) or 165 psi (on 15 tank cars). In addition to different STD pressures, PRDs are designed with different flow capacities.^{Footnote 44} A PRD that can discharge product at greater than 27 000 cubic feet per minute (CFM) is considered to have high flow capacity. In this accident, 13 of the 15 PRDs with STD pressure of 165 psi had flow capacities of about 38 900 CFM.

The field examination determined the following:

• Most of the cars with damaged PRDs came to rest on their sides or upside down, putting the PRD in contact with the liquid space inside the tank; product flowed from the damaged PRD and fed the pool fire.
• On 32 cars, the PRD was fastened to the top unloading nozzle assembly within the top discontinuity protection housing. The PRD of 3 of these 32 cars, or 9%, were breached.
• On the 31 other cars, the PRD was fastened to a safety valve nozzle attached to the top of the tank (Photo 24). The PRDs of 9 of these, or 29%, were breached.

1.18.2.7 Damage to bottom outlet valves

Federal regulations require that tank cars equipped with bottom outlet valves (BOVs) be built to prevent damage to the valve and the subsequent loss of product during a derailment. Design features include various combinations of breakaway designs and skid protection structures around the valve, as well as a locking arrangement to ensure that the BOV stays closed during transit (Photo 25). The AAR Manual of Standards and Recommended Practices (MSRP) specification M-1002, Appendix E, section 10.1.2.8, specifies that BOV handles, unless stowed separately, must either be designed to bend or break free on impact or be positioned so that the handles, in the closed position, are above the bottom surface of the skid protection.

The field examination determined the following:

• There were 36 tank cars with sheared-off BOV nozzles (Photo 26).
• Seven of these tank cars had damaged or missing BOV handles, resulting in the ball valve being open or partially open, which led to a release of product.
• Six tank cars were equipped with internal plug-type BOVs. None of these BOVs were breached.
• The BOV handle assemblies of 43 tank cars were deformed, impact-damaged, or missing.

1.18.2.8 Damage due to thermal tears

A thermal tear occurs when a tank car is exposed to elevated temperatures such as that from a post-derailment fire. As the temperature inside the tank rises, the product vapourizes, causing an increase in both its internal pressure and the stresses in the tank wall. If the pressure is not relieved, the tank ruptures. Ruptures involving the sudden release of built-up pressure can result in large explosions and fire.

Thermal protection helps delay the rate at which the internal tank temperature rises. It typically consists of an insulating material applied to the exterior of the tank and covered by a steel jacket. Federal regulations specify when thermal protection is required, as well as the performance standard it has to meet (for example, prevention of tank failure for at least 100 minutes in a pool fire and at least 30 minutes in a torch fire). Most general-service Class 111 tank cars are not required to have thermal protection.

Examination of the 63 derailed tank cars showed the following:

• None of the cars were equipped with thermal protection.
• Four cars that had sustained only minor impact damage due to the derailment experienced thermal tears, resulting in an energetic release.
• The length of the thermal tears ranged from 1.6 m to 4.4 m. No fragments of tank material were separated as a result of the thermal tears.
• All of the thermal tears were situated in the vapour space, and the PRDs were located in the liquid space.
• The car with the largest thermal tear (4.4 m) (Photo 27) was equipped with a PRD with an STD pressure of 75 psi, whereas the car with the smallest thermal tear (1.6 m) had a 165-psi PRD.
• Two tank cars experienced a thermal tear within approximately 20 minutes after the fire began.

1.18.2.9 Damage due to burn-through

Thirteen tank cars had localized loss of tank material in the form of a burn-through^{Footnote 45} as a result of extreme fire damage (Photo 28). In the regions around these perforations, there were jagged edges and the tank material exhibited reduced wall thickness, and in some cases, contained brittle cracks.

1.18.2.10 Metallurgical examination of tank cars

Selected samples were taken from tank cars involved in the derailment and sent for metallurgical analysis (Engineering Laboratory Report LP168/2013). At least 1 tank car from each car builder was selected.

It was determined that the tank car material generally met all applicable specifications at the time of manufacture. The sample examination did not find any material deficiency that would have affected the performance of the tank cars during the derailment.

1.18.3 Regulatory activities related to Class 111 tank cars

Following a TSB investigation^{Footnote 46} into an accident in August 2004 involving a petroleum product unit train near Lévis, Quebec, the Board recommended that:

Subsequently, an AAR task force examined improvements to tank car safety, and the AAR tank car standards were amended (Casualty Prevention Circular No. CPC-1232)^{Footnote 47} to incorporate a number of enhancements to all Class 111 tank cars built after 01 October 2011 for the transportation of crude oil and ethanol in PG I or PG II. These enhancements include construction of the tank cars to 286 000-pound standards, protection of the service equipment on the top shell, use of reclosing PRDs, use of normalized steel for tank shells and heads, increased minimum thickness for all tank cars not jacketed and insulated, and at least ½-inch half-head shields. As all of the tank cars had been built before October 2011, none were subject to the requirements of AAR Circular No. CPC-1232.

In 2011, the AAR petitioned Canadian and U.S. regulators to adopt these changes in regulations.

In 2012, following the Cherry Valley, Illinois, investigation,^{Footnote 48} the NTSB recommended that the Pipeline and Hazardous Materials Safety Administration (PHMSA):

In the same investigation, the NTSB recommended that the AAR:

In September 2013, PHMSAannounced its intent to propose a regulation ^{Footnote 49} adopting new tank car requirements in the Hazardous Materials Regulations (49 CFR). PHMSA requested comments from stakeholders on the AAR's 2011 Class 111 tank car improvements.

In November 2013, both the AAR and the American Short Line and Regional Railroad Association (ASLRRA) expressed support for even more stringent tank car standards. They called for additional improvements to tank cars transporting flammable liquids (including PG III flammable liquids), retrofitting of existing tank cars in flammable liquid service, and aggressive phase-out of tank cars that cannot meet retrofit requirements. The tank car improvements include modifications such as:

• tank car jackets, for added puncture resistance;
• full-height head shields;
• thermal protection blanket or coatings in conjunction with jackets;
• high-capacity PRDs;
• reconfiguration of the BOV handles; and
• possible designation of a new tank car class.

In January 2014, TC proposed^{Footnote 50} adopting AAR's 2011 Class 111 tank car improvements in the Transportation of Dangerous Goods Regulations (TDG Regulations).

In January 2014, TSB Recommendation R14-01 called for enhanced protection standards for tank cars used to transport flammable liquids. See section 4.1.2.1 for further details.

1.19 Dangerous goods

The transportation of dangerous goods^{Footnote 51} (DGs) is governed in Canada^{Footnote 52} and the United States^{Footnote 53} by federal regulations, which are based on the United Nations Recommendations on the Transport of Dangerous Goods.

1.19.1 Class 3 – Flammable liquids

Flammable liquids in Class 3 are DGs whose vapours form an ignitable mixture with air at or below a temperature of 60 °C. Flammable liquids can pose serious hazards due to their volatility and flammability, which are determined respectively by the initial boiling point^{Footnote 54} and by flashpoint.^{Footnote 55}

Given that volatility and flammability of flammable liquids vary widely, they are grouped together based on these characteristics so that different requirements, including packaging, storage, handling, and transportation, can be established. According to the TDG Regulations, Class 3s are divided into 3 packing groups (PGs), ranging from PG I (highest hazard) to PG III (lowest hazard):

• PG I, if the flammable liquid has an initial boiling point of 35 °C or less at an absolute pressure of 101.3 kPa and any flashpoint.
• PG II, if the flammable liquid has an initial boiling point greater than 35 °C at an absolute pressure of 101.3 kPa and a flashpoint less than 23 °C.
• PG III, if the criteria for inclusion in PG I or PG II are not met.

The PG is established by determining a flammable liquid's flashpoint and boiling point.

1.19.2 Petroleum crude oil

Petroleum crude oil is a Class 3 flammable liquid with a wide range of flammability and volatility characteristics, and is therefore assigned to one of the 3 PGs. It is most prominently qualified in terms of its sulphur content (sweet to sour) and density (light to heavy).

The density of petroleum crude oil is described in terms of its American Petroleum Institute (API) gravity^{Footnote 56} (expressed in degrees), whereby a higher number indicates lower density. The thresholds defining “light,” “medium,” and “heavy” crude oil vary by the product's region of origin and by the organization making the determination.^{Footnote 57}

1.19.2.1 Testing of crude oil samples

Crude oil samples were collected from 9 tank cars on MMA-002 that did not derail. Samples were also taken from 2 tank cars in Farnham that were part of another MMA unit train (MMA-874). This train was transporting petroleum crude oil from the same origin.

All crude oil samples were collected at atmospheric pressure and tested for characteristics relevant to the classification of the petroleum crude oil and to its behaviour and effects during the post-accident spill and fire. The level of hazard posed by the petroleum crude on MMA-002 had not been accurately documented, as the samples that were tested had the properties of a flammable liquid of Class 3, PG II. It was concluded that the large quantities of spilled crude oil, the rapid rate of release, and the oil's high volatility and low viscosity were the major contributors to the large post-derailment fireballs and pool fire. There was no indication that the crude oil's properties had been affected by contamination from fracturing process fluid additives. No detectable levels of hydrogen sulphide gas were found at the derailment site. See Appendix F for a summary of the test results of the crude oil samples, and Engineering Laboratory Report LP148/2013 for further details.

1.19.3 Regulatory requirements for classification and packaging

The federal regulations^{Footnote 58} require DGs to be properly classified and packaged^{Footnote 59} before they are offered for transport. For flammable liquids, the classification consists of determining the primary class, subsidiary class, UN number, proper shipping name, and PG. Once a DG is properly classified, an authorized container must be selected.

For DGs imported into Canada, the Transportation of Dangerous Goods Regulations^{Footnote 60} (TDG Regulations) require the importer (consignor)^{Footnote 61} to ensure that the DGs have the correct classification before they are transported in Canada. For flammable liquids, the TDG Regulations also permit^{Footnote 62} a consignor to use a classification that was determined by a previous consignor or the manufacturer.

The TDG Regulations allow dangerous goods to be included in PG I if the packing group is unknown, and in PG II if it is known (or reasonably believed) to be PG II or III.^{Footnote 63} They also contain provisions in case of detected or suspected classification errors.

1.19.4 Safety data sheets

A safety data sheet (SDS)^{Footnote 64} is produced by chemical manufacturers, distributors or suppliers pursuant to federal hazardous products legislation and standards.^{Footnote 65} The primary purpose of the SDS is to communicate the dangers of the hazardous chemical product. It contains detailed information about the nature of the hazardous product, including physical and chemical properties, and health, safety, fire and environmental hazards. Although not required by federal law, an SDS may also include other information, such as DG classification and transportation information.

Some products, such as petroleum crude oil, contain many ingredients whose concentrations can vary depending on the product's origin and vintage. Common industry practice, as permitted by federal hazardous products legislation, is to prepare and provide generic, representative SDSs that apply to products having similar characteristics.

The petroleum crude oil transported by MMA-002 originated from oil wells belonging to 11 different producers in the Bakken shale formation in North Dakota. WFSI provided 10 different SDSs representing the petroleum crude oil in the train (Appendix G). The classification of the petroleum crude oil for the purpose of transportation was not based on SDS information.

There was no specific practice or procedure to either verify that each SDS accurately reflected the properties of the product or family of products it represented, or that the products were properly classified for transport. Further, where there were multiple SDSs for products having similar characteristics, there was no review to compare and reconcile the provided information for consistency.

1.19.5 Transportation of petroleum crude oil from North Dakota toward New Brunswick

1.19.5.1 Transportation of petroleum crude oil by road

The petroleum crude oil was loaded in DOT-407^{Footnote 66} cargo tank trucks operated by Prairie Field Services at each product supplier facility, and transported by road to the rail loading facility at New Town, North Dakota, operated by Strobel Starostka Transfer, LLC (SST).

The shipping documents indicated that the shipper was the product's supplier and that the consignee was WFSI. The product was described on the majority of the shipping documents as UN 1267, petroleum crude oil, Class 3, PG II.^{Footnote 67} The majority of producers in the Bakken region considered crude oil from the region as PG II product, and had cargo tank truck shipping documents preprinted to reflect this designation.

There was no practice, procedure, or activity to verify, confirm, or validate the classification of the product transported by cargo tank trucks from the suppliers' facilities to the rail loading facility. The product was not being tested for the purpose of classification for transportation by road.

SST's standard operating procedures were to collect and test (on a monthly basis) composite samples representing the product being shipped from New Town. The tests primarily determined sulphur content, API gravity, boiling point, and the presence of light-end gases. The testing was performed primarily for quality assurance and control purposes and to establish the product's market value. The product's flashpoint was not being determined.

1.19.5.2 Transportation of petroleum crude oil by rail

At the New Town rail loading facility, the product was transloaded directly from the cargo tank trucks into Class 111^{Footnote 68} rail tank cars, with about 3 truckloads filling 1 tank car. The tank cars were leased by the Western Petroleum Company. The product was loaded, offered for transport, and being transported from New Town to Saint John pursuant to the applicable provisions of the United States Code of Federal Regulations, Title 49 (49 CFR).^{Footnote 69}

The shipping documents for the tank cars identified the shipper as Western Petroleum Company and the consignee as Irving Oil Ltd. The product was identified as UN 1267, petroleum crude oil, Class 3, PG III.

The tank car shipping documents were generated by CPR based on the shipper's instructions. These instructions were provided by SST on behalf of the shipper, using CPR's web-based bill-of-lading instruction system. The shipper had no procedure to verify, validate, or confirm the classification of the DGs being offered for transport, or to reconcile the shipping document information of the tank cars being offered for transport with those of the inbound product transloaded into those tank cars prior to releasing the tank cars to CPR.

The characteristics of the product for the purpose of classification for transportation by rail were not tested prior to being offered for transport. At destination, Irving sampled petroleum crude oil based on the volume of product being unloaded. Tests at an on-site laboratory determined density (which is used to calculate the API gravity), Reid vapour pressure, and whether bottom sediment or water were present.

This testing was performed for quality assurance and control purposes, and the product's flashpoint and initial boiling point were not determined. Irving relied on its suppliers to determine the classification of imported petroleum crude oil, as permitted by the TDG Regulations.^{Footnote 70}

1.20 Route planning and analysis for trains carrying dangerous goods

The frequency and consequences of derailments are dependent on several operational factors, such as train speed, rail integrity, braking systems, and emergency response.

Train speed is a factor because the energy dissipated during a derailment depends on the kinetic energy of the train in movement, and thus on its speed and mass. TSB data on main-track derailments from 2003 to 2012 indicate that higher derailment speeds are significantly associated with a higher number of derailed cars; the number of derailed cars is an indicator of accident severity. Speed reduction has the potential to reduce the severity and consequences of derailments, but would not necessarily result in a reduction in the number of derailments. This is because track maintenance standards are less stringent for lower classes of track.

In January 1990, the AAR issued Circular OT-55, Recommended Railroad Operating Practices for Transportation of Hazardous Materials. Circular OT-55 gave the rail industry guidance on railroad operating practices for the transport of selected dangerous goods, including poisonous-by-inhalation (PIH) or toxic-by-inhalation (TIH) products and radioactive materials. It also identified technical and handling requirements for “key trains” and “key routes.” Key trains were restricted to 50 mph, and main tracks on key routes had to be inspected by rail defect detection cars and track geometry inspection cars (or be subject to an equivalent level of inspection) at least twice per year, and all sidings at least once per year. Following the Lac-Mégantic accident, the definition of a “key train” was expanded in Circular OT-55-N.^{Footnote 71}

Route planning and analysis involves a comprehensive, system-wide review of all operations, infrastructure, traffic, and other factors affecting the safety of train movements. Factors to be considered in selecting the route that presents the fewest overall safety risks include hazards related to the nature of the product, the volume being transported, the handling of the product, railway infrastructure characteristics (for example, signalling, track class, crossings, wayside systems, traffic density), passenger traffic (that is, shared track), geography, environmentally sensitive areas, population density, and emergency response capability along the route. Route planning and analysis, as well as periodic assessments of the safety risks along the selected route, are critical to enhancing rail transportation safety because they allow the identified vulnerabilities to be proactively addressed (Figure 7).

In January 2014, TSB Recommendation R14-02 called for route planning and analysis, as well as periodic risk assessments, for trains carrying dangerous goods. See section 4.1.2.2 for further details.

1.21 Emergency response

The Lac-Mégantic Fire Department was notified by 911 calls immediately after the accident. Given the size of the fire, the city's emergency response plan was put into effect. The first general alarm was sounded at 0119 on 06 July 2013. The first fire rescue vehicle and the SQ arrived at the accident site at about 0122 on 06 July 2013.

The Lac-Mégantic Fire Department and the Nantes and Saint-Augustin-de-Woburn fire departments have intermunicipal mutual aid agreements to allow joint action in case of major disasters. More than 1000 firefighters from 80 different municipalities in Quebec, and from 6 counties in the state of Maine, participated in the response, which was reported to be the largest fire response in recent Quebec history. At any given time, approximately 150 firefighters were on site. Initial firefighting efforts focused on evacuating people and preventing further spread of the fire to nearby buildings and structures. Approximately 2000 people were evacuated.

Following confirmation that the DGs involved in the fire consisted of a Class 3 flammable liquid hydrocarbon, the emergency responders assessed the situation and estimated that approximately 33 000 litres of foam concentrate would be required to allow a continuous, uninterrupted production of foam to be applied to the fire. As that quantity of supply was not available locally, the Lac-Mégantic Fire Department arranged to transport the foam concentrate from a refinery in Lévis, about 180 km away.

The foam concentrate arrived on site at approximately 1800 on 06 July 2013. Application of the foam started at approximately 2200 and continued uninterrupted for about 8 hours, until the fire was under control at 0600 on 07 July 2013. The fire was extinguished at approximately 1100 on 07 July 2013, with minor occasional flare-ups afterward.

Class 3 flammable liquid hydrocarbons present a risk of fire and explosion if exposed to heat, sparks, or flames. All firefighters in Quebec are trained in accordance with provincial requirements. The training, which includes a DG component, is not specific to rail transportation.

Support from numerous organizations arrived at various intervals, including personnel from MMA, CN, the Railway Association of Canada (RAC), the federal and provincial governments, WFSI, the importer (Irving Oil Commercial G.P.), the petroleum industry, and environmental remediation companies.

Throughout the emergency response, regular coordination meetings were held with all involved. During these meetings, priorities were established, and participants discussed what action should be taken and possible response methods, as well as the impact on the progress of the overall operations. For several hours, all work at the site stopped due to concerns about the ability of the railway to cover all emergency response costs. The stoppage affected the progress of the emergency response and environmental remediation, resulting in oil migrating back to zones that had earlier been declared safe.

1.21.1 Emergency response assistance plans

The risks posed by specific DGs are determined based on the properties, characteristics, and quantities of the DGs being transported. An emergency response assistance plan (ERAP) is required by the TDG Regulations for certain DGs^{Footnote 72} that pose a higher than average risk when transported in certain quantities. Persons who offer such DGs for transport or import must have an ERAP approved by TC.

When there is an accident, the handling of these DGs requires special expertise, resources, supplies, and equipment. An approved ERAP describes the specialized response capabilities, equipment and procedures that are available to local emergency responders to assist with addressing the consequences of the accident.

In 2013, the TDG Regulations did not require an approved ERAP for petroleum crude oil (UN 1267). However, meetings were held between MMA and a number of stakeholders in April 2013 to discuss mutual assistance plans in the event of a petroleum crude oil spill.

1.21.1.1 Previous recommendation

Following the TSB investigation into the 1999 derailment, collision, and fire involving a unit train carrying flammable liquid hydrocarbons near Mont-Saint-Hilaire, Quebec (TSB report R99H0010), the Board determined that a comprehensive emergency response plan, for which roles, resources, and priorities for emergency response are defined ahead of time, would enhance the emergency response and alleviate post-accident risks. The Board recommended that:

At that time, liquid hydrocarbons were not routinely transported in unit trains of tank cars. The TDG Regulations were amended to require an approved ERAP for diesel fuel, gasoline, and aviation fuel when offered for transport or imported in a configuration of 17 or more interconnected rail tank cars that are each at least 70% full.

In assessing the response to TSB Recommendation R02-03, the Board found that the updated ERAP application criteria, as implemented by TC, mitigated the risks to the public posed by the transportation of large volumes of liquid hydrocarbons that were regularly transported between Québec and Montréal in interconnected tank cars. The Board therefore assessed the response to TSB Recommendation R02-03 as Fully Satisfactory in August 2008.

In January 2014, TSB Recommendation R14-03 called for emergency response assistance plans for the transportation of large volumes of liquid hydrocarbons. See section 4.1.2.3 for further details.

1.22 Montreal, Maine & Atlantic Railway

MMA was formed in January 2003, when RWI acquired the Bangor & Aroostook assets, including the former QSR, from Iron Road Railways. RWI is a railway management, consulting and investment corporation specializing in privatizations and restructurings.

MMA owned 510 miles of track in Maine, Vermont, and Quebec, and employed approximately 170 people. Its head office was in Bangor, Maine, and there was a Canadian office in Farnham, where about 25 LEs and train conductors were based. At the time of the accident, MMA operated about 15 trains daily, with a fleet of 52 locomotives, 38 of which were available for service. Main-track operations were conducted regularly between Millinocket, Maine, and Searsport, Maine, and from Brownville Junction, Maine, to Montréal, Quebec. Service was also provided between Newport, Vermont, and Farnham to connect the northeastern United States westbound trains to Montréal for CPR destinations in the United States and Western Canada.

MMA connected with 7 railways (Class 1, short line, and local) and provided the shortest, most direct rail link through Maine, between Saint John and Montréal.

1.22.1 Montreal, Maine & Atlantic Railway's operations for MMA-001 and MMA-002

Prior to June 2012, westbound MMA-001 from Brownville Junction, and eastbound MMA-002 from Saint-Luc Yard through Farnham, were operating 3 times per week. These trains carried mixed freight, which included some DGs. Upon arrival at Megantic, MMA-002 would be immediately taken over by a Brownville Junction crew for the continuation of its journey. At the beginning of each week, an extra Brownville Junction crew would travel by road to Megantic to ensure the uninterrupted journey of MMA-002. On occasion, when these crews were not immediately available, MMA-002 was left unattended at Nantes on the main track or in the siding. After arrival, a Farnham crew would lay over for rest, and the next day would take MMA-001, which would have been tied up for the night at Vachon, westward to Farnham.

Starting in June 2012, the addition of unit trains to transport crude oil resulted in an increase in MMA's train traffic. Eastward weekly train traffic consisted of about 2 unit fuel trains and 5 mixed freight (that is, 1 train per day). Westward train traffic was also about 1 train per day. All crew changes were performed near Lac-Mégantic. As a result of this increase in traffic, both the Brownville Junction crew and the Farnham crew would lay over and, once they met the work/rest requirements, they would take control of the opposing train for their return trip. The next day, the LE for MMA-002 would be called earlier than the LE for MMA-001. The trains would meet at Vachon; MMA-001 would be in the siding while MMA-002 would pass on the main track.

This crew-change practice usually resulted in MMA-002 being left unattended on the main track at Nantes and MMA-001 being left unattended at Vachon, often for 6 or more hours. As per normal MMA operating practice, these trains were left with the reverser^{Footnote 73} removed from the control stand and placed with the train's paperwork on the console or on the LE seat. The doors on all locomotives were left unlocked.

Travel time for an MMA train between Farnham and Nantes typically was between 10 to 12 hours. Trains were normally left at Nantes instead of Vachon so that the crew would not exceed the maximum of 12 hours on duty. On some occasions, the trip to Nantes took longer than expected, resulting in the crew members exceeding their allowable duty time or leaving the train at Gould, Quebec, at Mile 31.00 of the Sherbrooke Subdivision.

1.22.2 Mandatory off-duty times for operating employees

The maximum continuous on-duty time for operating employees on a single tour of duty is 12 hours. The Work/Rest Rules for Railway Operating Employees^{Footnote 74} specify that operating employees who are off duty after being on duty in excess of 10 hours at other than the home terminal must have at least 6 continuous hours off duty, with the mandatory off-duty time commencing upon arrival at the accommodations provided by the railway company. In case of an emergency, off-duty employees can be recalled. If a crew's rest is interrupted, the rest time is reset.

The continuous duty time of the LE for MMA-002 was 10 hours and 15 minutes. The LE for MMA-001 was under the same mandatory off-duty time and was lodging at the same accommodations in Lac-Mégantic as the LE for MMA-002.

1.22.3 Securement of trains (MMA-002) at Nantes

With the new train schedule, trains were left at Nantes and at Vachon (the location where the 2 trains could meet, some 10 miles away). By leaving MMA-002 at Nantes, the train could be parked in a location where no crossing would be blocked, where access would be easy for pick-up and drop-off of crews, and where rail access to the siding would be allowed where cars were normally stored. There were no regulations precluding trains, including those carrying DGs, from being left unattended on a main track. When trains were secured at Nantes, they would be left on the main track with at least 1 locomotive running, the automatic brakes released, the independent brakes applied, and a number of hand brakes applied.

For 2-person crews, train securement was the responsibility of both crew members. Securement consisted of applying a number of hand brakes and then testing their effectiveness. The conductor would determine the number of hand brakes to be applied and would apply them once the train was brought to a stop. On occasion, LEs would assist in the application of the hand brakes.

With a single-person train operator, the responsibility rested with the LE for both the application and the effectiveness testing of the hand brakes. To ensure that the train would not roll away while the LE was applying the hand brakes, the automatic brakes were applied.

TSB conducted a survey of LEs and conductors to determine train securement practices at Nantes, and it showed that the number of hand brakes applied to trains varied. Two-person crews would consistently apply at least the minimum number of hand brakes specified in MMA's GSIs. Some single-person train operators reported applying less than the minimum number of hand brakes.

To perform a hand brake effectiveness test, some LEs would release the automatic and independent brakes and attempt to move the train, while others would not release the independent brakes and would not attempt to move the train. When a proper hand brake effectiveness test was performed, additional hand brakes would be applied, if required.

For fuel conservation purposes, MMA instructions were to shut down all idling locomotives not equipped with an auto-start. To comply with U.S. regulations (requiring brake testing by qualified employees if a train is off air for more than 4 hours), the MMA practice was to leave at least 1 locomotive running on U.S.-bound trains. Some crews left all of the locomotives running in all weather.

1.22.4 Securement of trains (MMA-001) at Vachon

Shortly before the accident, MMA-001 was parked in the siding at Vachon by a Brownville Junction single-person train operator who was to be assigned to MMA-002 the following morning. MMA-001, consisting of 5 locomotives and 98 residue tank cars, had been secured with 5 hand brakes, and the independent brakes were applied. The locomotive cab door was not locked, and the train's paperwork along with the reverser were sitting on the locomotive console. The minimum hand brake requirement for a train of this length, as per MMA's instructions, was 11 hand brakes.

1.22.5 Recent runaway train history at Montreal, Maine & Atlantic Railway and previous TSB investigations

According to TSB's Rail Occurrence Database System (RODS), there were 5 occurrences involving runaway MMA equipment between 20 September 2004 and the date of the accident. All 5 involved yard-switching movements, 1 of which involved cars rolling onto the main track.

The TSB has investigated 9 runaway train occurrences since 2005; in addition to this accident, 5 others involved short line railway operations. In all of these occurrences, the investigation into the operations of these railways identified safety deficiencies in training, oversight, and operational practices (Appendix H).

1.22.6 Training and requalification of Montreal, Maine & Atlantic Railway crews in Farnham

Section 10 of the Railway Employee Qualification Standards Regulations (SOR/87-150) states that “a railway company shall, at intervals of not more than three years, have each employee in an occupational category re-examined on the required subjects.”^{Footnote 75} CROR General Rule A requires every employee in any service connected with movements to:

[…]

6. be conversant with and governed by every safety rule and instruction of the company pertaining to their occupation;
7. pass the required examination at prescribed intervals, not to exceed three years, and carry while on duty, a valid certificate of rules qualification;^{Footnote 76}

[…]

Railways design and administer training and requalification programs according to their needs. The programs usually take place in a classroom setting, where the exam topics are reviewed with an instructor and discussions take place to ensure that the rules are properly understood and applied. Exams vary from knowledge-based to scenario-based, with short-answer questions requiring written responses or with multiple-choice questions. Knowledge-based exams contain questions that test specific rules or instructions and are typically closed-book. Scenario-based exams require the interpretation and application of CRORs, as well as of special instructions, to frequent scenarios. These exams are usually open-book and promote the development of problem-solving skills while using the company-provided manuals. Instructor feedback is a component of a requalification program. TC has the authority to review companies' training and requalification programs.

MMA delivered training to RTCs, locomotive engineers, conductors, and engineering employees. A review of MMA's training and requalification program determined the following:

• MMA's requalification exams tested employees on most CRORs and several MMA special instructions. They were knowledge-based, with short answers and multiple-choice questions.
• Requalification typically consisted of 1 day to complete the exam, and did not always involve classroom training. On many occasions, employees would take the exam home for completion.
• MMA employees did not have the opportunity to review their requalification exam after it was corrected, and received no feedback on their mistakes.
• A comparison between multiple requalification exams revealed that, over the years, they had essentially remained the same. However, there was increased use of multiple-choice questions.
• The exams repeated the same question on the minimum number of hand brakes for leaving unattended equipment. They did not have questions on the hand brake effectiveness test, the conditions requiring application of more than the minimum number of hand brakes, nor the stipulation that air brakes cannot be relied upon to prevent an undesired movement.
• Inconsistencies in the correction and grading of exams were noted. On some multiple-choice questions, more than one answer was accepted as correct, and some short-answer questions were answered by writing the applicable CROR number rather than writing the procedure to be followed.
• MMA did not consistently comply with the 3-year interval for requalification. For several employees, the deadlines were exceeded by several months, with temporary certificates being issued.

1.22.7 Training and requalification of the locomotive engineer

The accident LE had completed a requalification exam in September 2006. The next requalification was completed in December 2009, which was 3 months beyond the mandatory deadline. The LE received a new certificate of rules qualifications in March 2013, again 3 months after the expiration of his certificate. In April 2013, the LE completed the requalification exam at home, after having received the new certificate. The LE did not receive feedback on the results of that exam.

The LE's requalification exams in 2006 and 2009 included the same question on the number of hand brakes for a cut of cars left in a siding. In both exams, the LE's answers complied with MMA's hand brake requirements as per the instructions. In 2012, the LE's requalification exam contained 2 multiple-choice questions on the minimum number of hand brakes required for a cut of cars left unattended. Again, the LE's answers complied with MMA's hand brake instructions.

CROR General Rule A requires every employee in any service connected with movements to:

2. have a copy of this rule book, the general operating instructions, current time table and any supplements, and other documents specified by the company accessible while on duty.^{Footnote 77}

At MMA, the other required documents under CROR General Rule A included its GSIs and Safety Rules. At the time of the accident, the LE was not in possession of all of the mandatory documents, including the GSIs and Safety Rules.

1.22.8 Operational tests and inspections at Montreal, Maine & Atlantic Railway

MMA developed the Operational Tests and Inspections (OTIS) Program for its supervisors to monitor employees' adherence to railway safety rules and instructions. The OTIS program at MMA involved field supervisors observing employees as they performed their work. These observations were to be conducted unannounced. The employee evaluations were based on compliance with GSIs, operating bulletins (OBs), Safety Rules, timetables, GOIs, and CROR.

Non-compliance with rules and instructions would be noted, and corrective action could result. Depending on the severity of the infraction, the non-compliance could result in a verbal correction, a letter of reprimand, or a suspension. All observations were entered into the OTIS system with either a “pass” or “failure” evaluation. Employees were notified of the result only if they failed the test.

MMA developed an OTIS manual to aid supervisors in the implementation of the program. The manual outlined the program's objectives, provided guidance on the methods and frequency of test administration, and provided general field instructions on implementing the program. Each supervisor was required to conduct a minimum of 15 OTIS tests per month (that is, 180 per year). Additional guidance provided to the supervisors included:

• instruction in ensuring that observations are conducted at various times and locations so that employees perceive that they may be tested at any time;
• direction in identifying those employees who need remedial rules training or appropriate discipline;
• guidance in periodically advising employees who consistently comply with all operating instructions that they were found to be in compliance with a recent test;
• development of a list of “Core Rules”. The 2013 list, on which supervisors were to focus, included CROR 112(a) and (b), and OB 2-133, which covered the application and testing of hand brakes;
• identification of several rules in which a minimum number of tests per month were to be conducted. For example, CROR 112 was to be tested at least 2 times per month per supervisor.

Supervisors were provided with periodic reports (at least quarterly) on their progress in completing the required number of tests and were reminded of which rules to focus on. Table 4 summarizes the number of OTIS observations completed by each supervisor.

Note: Supervisor 5 was no longer employed at MMA after July 2011.

For the 4-year period from 2009 to 2012, the OTIS results were as follows:

• Of the 3789 tests conducted, 128 of the observations were entered into the system as “Failure”.
• Testing on CROR 112 and GSI 112 had been conducted 31 times. There were 2 failures.
• Testing on OB 2-133 had been conducted 35 times. There were 5 failures.

During a test for compliance with hand brakes, supervisors checked the number of hand brakes applied to ensure that the number met the minimum requirement. However, they seldom checked to ensure that a proper hand brake effectiveness test was conducted. To test for a proper hand brake effectiveness test, supervisors had to be at the site, unannounced, when the train arrived. Failing that, supervisors had to review the LER download after the trip. MMA reviewed downloads only after accidents. Since 2009, no employee had been tested on CROR 112(b), which targeted the hand brake effectiveness test. In 2012, U.S. employees had been tested twice on that rule; both tests had resulted in a “Failure”.

Since 01 January 2009, the LE had been tested 97 times, and had failed 3 of these tests. Eight of the tests had been conducted outside of the hours of 0800 to 1800. Of the 97 tests, 70 were conducted within 27 miles of Farnham, and the remaining 27 were conducted in Sherbrooke. Seven of the 97 tests were on CROR 112 or OB 2-133, and the LE had successfully passed. None of the tests targeted the hand brake effectiveness test, and none were performed at Nantes.

1.23 Single-person train operations

1.23.1 Implementation of single-person train operations

At the time of the accident, there were no rules or regulations preventing railways from implementing SPTO (single-person train operations). In Canada, there are only 2 federally regulated railways to have operated using SPTO: MMA, and Quebec North Shore and Labrador Railway (QNS&L).

QNS&L implemented SPTO in 1996, without seeking a Minister's exemption to certain CROR provisions.^{Footnote 78} A collision occurred on the second day of operation.^{Footnote 79} TSB's investigation determined that, without a comprehensive analysis and the implementation of effective compensatory safety measures by the railway, SPTO operation was a contributory factor. As a result, a working group was formed involving TC, QNS&L management and employees, and representatives from industry and labour. Recommencement of SPTO was conditional on arriving at a consensus on minimum operating conditions to ensure a level of safety equivalent to that of 2-person operating crews.

In September 1996, rather than requiring railways to obtain exemptions, TC suggested to the RAC that rules be developed for SPTO.

In 1997, SPTO was re-implemented at QNS&L with 69 new conditions. Some of the key conditions were to:

• provide LEs and RTCs with 120 to 130 hours of training, including in SPTO emergency procedures, with the training program to be monitored by TC;
• provide increased supervision of LEs; and
• install proximity detection devices (PDDs) on all lead locomotives, track units, and on-track vehicles operating on the main track.

In June 1997, TC acknowledged that the RAC had been developing an SPTO circular for its members, while repeating the expectation that the RAC develop SPTO rules for inclusion in the CROR.

In 1998, the RAC first proposed rule changes to the CROR under Section 20 of the RSA relating to SPTO. TC rejected these proposed changes, as they did not establish rules for SPTO that would ensure a level of safety equivalent to that of existing crew requirements.

In 2000, the RAC produced SPTO guidelines based on industry review and consultation^{Footnote 80} and made them available to its members.^{Footnote 81} The guidelines were based on the principles of risk assessment, mitigation, and monitoring. They were not approved by TC, nor were they required to be. The guidelines specified the following:

Railway companies must advise Transport Canada in writing at least 60 days prior to implementing One Person train operations.

[…]

Prior to implementation of One Person operations, the railway company shall identify safety issues and concerns associated with One Person Train Operations, evaluate the risk involved with such an operation, and take appropriate measures to mitigate the risk.

[…]

Each railway company shall develop and institute an appropriate monitoring program for One Person operations that measures the safety performance of the operation.

This program shall be described to Transport Canada and may be subject to follow-up regulatory review.^{Footnote 82}

A copy of the guidelines was provided to MMA.

1.23.2 Canadian Railway Operating Rules (CROR)

TC can order the development of a rule or the amendment of an existing rule. The RAC, in consultation with its member railways, would then draft the rule. Once completed, it must be circulated to employee associations for comment before it is submitted to the Minister for approval. If there are objections to the proposed changes, the RAC can respond to the employee association's objections, and then their comments, along with the RAC response, are provided to the Minister's representatives for consideration. The rules must be approved by the Minister before coming into force. Rules may also be formulated by individual railways on their own, which also requires union consultation and submission to the Minister for approval.

In 2008, a major revision of the CROR by the RAC, approved by TC, introduced General Rule M, which provided in part, “Where only one crew member is employed, operating rules and instructions requiring joint compliance may be carried out by either the locomotive engineer or conductor…”^{Footnote 83} The union consultation period for the rules was 90 days, and a 2-day meeting was held. These rule changes allowed railways to implement SPTO without the need for exemptions from TC to specific CROR rules, such as were required by QNS&L in 1997.^{Footnote 84}

1.23.3 Single-person train operations at Montreal, Maine & Atlantic Railway

In 2003, MMA discussed the implementation of SPTO in Canada with TC. TC advised that MMA should consider QNS&L's SPTO implementation and operation as a Canadian “best practices” model. Between 2004 and 2008, MMA did not pursue SPTO in Canada, as it considered the 69 conditions that had been implemented at QNS&L to be unattainable.

In April 2009, after being informed of MMA's intention to begin SPTO, TC initiated a research project^{Footnote 85} to develop internal guidelines to review SPTO applications. The targeted completion date was October 2009. The research was completed in March 2012 (see section 1.23.5).

In June 2009, MMA submitted its SPTO risk assessment and proposal to TC. MMA advised of its intent to pursue a phased approach to implementing SPTO, using the 23-mile segment between the Maine-Quebec border and Lac-Mégantic as a “test-bed” for further expansion, pending approval by TC. In its risk assessment, MMA stated that a single-person crew member is more attentive when working alone, and cited its previous success on its U.S. network.

In July 2009, TC expressed a number of concerns that centred on deficiencies in MMA operations, including lack of consultation with employees in doing risk assessments, problems managing equipment, problems with remote-control operations, issues with rules compliance, issues with fatigue management, and a lack of investment in infrastructure maintenance. TC reiterated its recommendation that MMA look at the QNS&L consensus-based process as a model in crafting operational conditions.

In May 2010, MMA began its test operation running SPTO. TC was told that MMA's SPTO crews were coming across the border^{Footnote 86} as far as Nantes. However, on a number of occasions, TC became aware that MMA had operated SPTO trains with U.S. crews beyond these limits when there had been weather issues or other operational demands, such as equipment failures. There were no performance indicators identified for tracking, nor was a formal monitoring program established. TC Quebec Region reiterated its concern about MMA's suitability as an SPTO candidate.

In the same month, TC Headquarters and the FRA conducted an informal review of MMA's U.S. operations, including SPTO. As a result of that review, TC and the FRA identified 4 areas for subsequent action, including the absence of a written emergency response plan and concerns over employee fatigue, efficacy of company oversight, and rules compliance.

In December 2011, MMA informed TC that, as of 09 January 2012, it was extending SPTO westward to Farnham. TC indicated that it viewed this expansion as a significant change to operations, reiterating that it required a new risk assessment. MMA submitted a revised risk assessment for its SPTO that identified 16 risks. Several mitigation measures were proposed, and where necessary, added to the company's SPTO special instructions, such as informing local authorities, establishing procedures for a single operator when taking control of an unattended train, allowing an SPTO engineer to stop the train for 20-minute naps, and requiring formal communications between the engineer and the RTC at least every 30 minutes. This risk assessment did not identify or address the specific risks of a single-person train operator performing tasks previously performed by 2 persons, such as securing a train and leaving it unattended at the end of a shift.

In February 2012, TC met with MMA and the RAC. TC advised MMA that TC did not approve SPTO. MMA only needed to comply with all applicable rules and regulations. TC Quebec Region remained concerned about the safety of SPTO on MMA.

In April 2012, the collective agreement was renegotiated to allow for SPTO. Later in April, TC Quebec Region acknowledged that MMA was going ahead with the expanded use of SPTO to Farnham once the employee consultations were completed and the crews were trained. MMA committed to informing the regulator in advance of the date when SPTO would commence.

The SPTO training plan for LEs (which scheduled training for approximately 4 hours) was intended to address the new SPTO special instructions.

The actual SPTO training for several LEs, including the accident LE, consisted of a short briefing in a manager's office on the need to report to the RTC every 30 minutes, on the allowance for power naps, and on the need to bring the train to a stop to write clearances. In some cases, training consisted of a briefing within the hour preceding the operator's first SPTO train departure. The training did not cover fatigue management or a review of tasks normally performed by conductors, such as determining the minimum number of hand brakes. A review of RTC recordings determined that the instruction to communicate to the RTC at least every 30 minutes was not consistently followed.

In July 2012, MMA began operating SPTO between Lac-Mégantic and Farnham. However, no job task analysis with the employees in the territory specific to SPTO was performed, nor were all of the potential hazards associated with those tasks identified. MMA had no plan for further monitoring and evaluating SPTO. MMA did take specific measures, such as:

• extending train radio range to eliminate “dead spots”;
• supplying SPTO crews with equipment so that they could operate the locomotive remotely;
• meeting with every community along the track;
• installing mirrors on the left-hand side of its locomotives;
• identifying locations along the track where a helicopter could safely land to evacuate employees; and
• making arrangements with emergency service companies to be on call if an evacuation was needed.

On 29 August 2012, TC became aware that MMA had extended SPTO operations to Farnham. TC did not verify that the mitigation measures identified in MMA's risk assessment were implemented and effective.

In March 2013, TC published an internal guideline to assist in evaluating SPTO applications. The purpose of the guideline was to provide TC regional staff with a guide to review and address SPTO risk assessments provided by railway companies.

1.23.4 Review of the Montreal, Maine & Atlantic Railway submission and its relation to the requirements of Standard CSA Q850

In December 2011, 2 guidance documents published by TC for filing rule submissions recommended the use of Standard CSA–Q-850-97, Risk Management Guidelines of Decision-Makers (October 1997). A comparison was made between MMA's risk assessment on SPTO introduction and the requirements of standard CSA-Q-850-97. There were significant gaps identified in MMA's process. For example, MMA did not quantify safety data to indicate safety trends and to identify some of the possible hazards when major operational changes were being planned.

1.23.5 Research into single-person train operations

MMA's 2009 request prompted TC to renew research into SPTO. TC recognized that it lacked the tools to review an SPTO risk assessment.

TC contracted the National Research Council (NRC) to conduct the research. The report was issued in 2012 and indicated that the safety impact of SPTO is unique to each individual task, and that risk-mitigating countermeasures should be designed accordingly. It stated that “reducing the train crew to one person without appropriate operational changes and technological intervention diminishes safety.” The report recommended:^{Footnote 87}

• consolidating human factors knowledge into a best practices resource;
• identifying which technologies are required to fully support SPTO, depending on operational complexity;
• developing an SPTO guide with recommended training and refresher programs for operating personnel;
• developing communication protocols;
• developing a procedures guide to be used to determine if an operation is suitable for SPTO;
• conducting a workshop involving TC, NRC, and railways to review SPTO knowledge and identify one or two specific routes that could be used for a pilot test program; and
• running a pilot test program, complete with detailed monitoring and evaluation, over a 2-year period.

In the United States, the FRA conducted a series of cognitive task analyses pertaining to railway operating crews.^{Footnote 88} With respect to the role of the conductor, they found the following:

• Conductors and LEs not only work together to monitor the operating environment outside the locomotive cab, they also work together to plan activities, to solve problems, and to plan and implement risk mitigation strategies.
• Operating in mountain grade territory can significantly alter the complexity of a conductor's duties, introducing additional cognitive demands.
• When the conductor must handle unexpected situations, “these unanticipated situations impose cognitive as well as physical demands on the conductor.“^{Footnote 89}
• New technologies, such as positive train control (PTC), will not account for all of the cognitive support that the conductor provides.

SPTO has been implemented in other parts of the world, including the U.S., Europe, Australia and New Zealand. In many countries, technological advancements were used to mitigate the risks of operating with one less crew member (Appendix I).

1.24 Safety culture

All members of an organization, and the decisions made at all levels, have an impact on safety. A recognized definition of an organization's “safety culture” is:

shared values (what is important) and beliefs (how things work) that interact with an organization's structures and control systems to produce behavioural norms (the way we do things around here).^{Footnote 90}

TC's Rail Safety Management Systems Guide: A Guide for Developing, Implementing and Enhancing Railway Safety Management Systems states:

An effective safety culture in a railway company can reduce public and employee fatalities and injuries, property damage resulting from railway accidents, and the impact of accidents on the environment.

In simple terms, an organization's safety culture is demonstrated by the way people do their jobs—their decisions, actions and behaviours define the culture of an organization.

The safety culture of an organization is the result of individual and group values, attitudes, perceptions, competencies and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organization's health and safety management system.

Organizations with a positive safety culture are characterized by communications from various stakeholders founded on mutual trust, by shared perceptions of the importance of safety and by confidence in the efficacy of preventive measures.^{Footnote 91}

The Guide also states:

Experience has shown that a railway company will be markedly more successful in developing a safety culture if employees and their representatives, where applicable, are involved in the development and implementation of the safety management system.^{Footnote 92}

The relationship between safety culture and safety management is reflected in part by the attitudes and behaviour of a company's management.

An effective safety culture includes proactive actions to identify and manage operational risk. It is characterized by an informed culture where people understand the hazards and risks involved in their own operation and work continuously to identify and overcome threats to safety. It is a just culture, where the workforce knows and agrees on what is acceptable and unacceptable. It is a reporting culture, where safety concerns are reported and analyzed and where appropriate action is taken. And it is a learning culture, where safety is enhanced from lessons learned.^{Footnote 93}

A company's policies determine how safety objectives will be met by clearly defining responsibilities; by developing processes, structures and objectives to incorporate safety into all aspects of the operation; and by developing the skills and knowledge of personnel. Procedures are directives for employees and set management's instructions. Practices are what really happens on the job, which can differ from procedures and, in some cases, increase threats to safety.

The report on the review of the RSA states, “The cornerstone of a truly functioning SMS is an effective safety culture,“ and notes that “[a]n effective safety culture is one where past experience is not taken as a guarantee of future success and organizations are designed to be resilient in the face of unplanned events.”^{Footnote 94} The RSA review recommended that the TC Rail Safety Directorate and the railway industry “take specific measures to attain an effective safety culture.”^{Footnote 95} TC's SMS guide contains a section on achieving an effective safety culture, and TC has published a safety culture checklist for companies to perform a self-assessment on their safety culture.^{Footnote 96}

1.25 Regulatory oversight

1.25.1 Transport Canada

1.25.1.1 Background information

TC promotes safe and secure transportation systems in the air, marine, rail, and road modes, as well as the safe transportation of dangerous goods. To do so, TC develops safety regulations and standards, or in the case of railways, it facilitates the development of rules by the rail industry. TC is then responsible for enforcement. It tests and promotes safety technologies and has also introduced safety management system (SMS) regulations requiring railways to manage their safety risks. Rail safety is governed by the Railway Safety Act (RSA). The transportation of dangerous goods is governed by the Transportation of Dangerous Goods Act (TDG Act).

The objectives of the RSA are:

1. to promote and provide for the safety and security of the public and personnel, and the protection of property and the environment, in railway operations;
2. to encourage the collaboration and participation of interested parties in improving railway safety and security;
3. to recognize the responsibility of companies to demonstrate, by using safety management systems and other means at their disposal, that they continuously manage risks related to safety matters; and
4. to facilitate a modern, flexible and efficient regulatory scheme that will ensure the continuing enhancement of railway safety and security.^{Footnote 97}

To carry out the objectives of the RSA, TC‘s Rail Safety Directorate, based at TC Headquarters in Ottawa, sets the direction for railway safety oversight through the development of policy and programs. TC's Surface Group, based out of regional offices, is responsible for implementing the policies and programs. Regional railway safety inspectors (RSIs) monitor and promote regulatory compliance regarding railway operations, equipment, infrastructure, and railway-roadway grade crossings. RSIs also promote education and awareness, as well as conducting SMS audits and enforcement activities.

The tools and strategies available to TC to promote safety and further the objectives of the RSA are outlined in Rail Safety: Compliance and Enforcement Policy (September 2007). The tools and strategies for compliance and safety fall into 3 categories of activity: promoting, monitoring, and enforcing.

Promoting refers to the means by which TC ensures that regulations are workable and understood by the railways. It includes regulatory development, consisting of clear and enforceable requirements, as well as consultation. It also includes implementation, consisting of Railway Safety Management System Regulations (SMS Regulations) and providing information, education/awareness, and counselling. SMS is specifically mentioned due to the requirement in the SMS Regulations for companies to put processes in place to ensure awareness of the applicable regulations and to demonstrate compliance.

Monitoring refers to the types of activities undertaken to monitor the level of safety and compliance within the industry. Key monitoring tools include:

• inspections to verify compliance with rail safety regulatory requirements, to collect data, and to identify threats to rail safety that require corrective action;
• safety audits to verify compliance with regulatory requirements and to assess safety performance;
• SMS audits (audits) to examine the company's SMS, or a portion of it, to determine “whether the company's actual operations conform to the procedures they developed to demonstrate compliance with applicable regulatory requirements”;^{Footnote 98} and
• accident and incident investigations.

Inspections and audits are complementary processes. While inspections look at conditions (that is, what is wrong), audits look at systems and processes (that is, to identify why the conditions exist). Inspections should be used to help target future audits and to help monitor the corrective action taken following previous audits.

Enforcing refers to the tools available to TC where a non-compliant condition or a safety concern is identified. TC's enforcement tools include the following:

• Letter of non-compliance, which is issued by the RSI to promote regulatory compliance and to address non-compliance;
• Letter of concern, which is issued by the RSI to identify and inform railways of safety concerns;
• Notice, or notice and order, which is issued by the RSI to respond to threats (notice) or immediate threats (notice and order) to safe railway operations;
• Ministerial order, which is issued by the minister to address a rail safety problem;
• Emergency directive, which is issued by the minister to mitigate an immediate threat to safe railway operations by requiring companies to cease a particular unsafe action or to take a specific action;
• Order of the court, whereby a notice and order, ministerial order, or emergency directive can be made into an order of the court and enforced as such;
• Prosecution, which can be pursued at the discretion of the Attorney General of Canada. This enforcement tool may be considered when there is serious, willful, uncorrected and/or continued non-compliance, or if the company disobeys orders issued by RSIs or the Minister of Transport.

In May 2013, the RSA was amended to enable improvements to the SMS Regulations and the implementation of regulations pertaining to administrative monetary penalties and railway operating certificates.

1.25.1.2 Rail Safety organization

1.25.1.2.1 Headquarters

The Rail Safety Directorate is under the direction of the Assistant Deputy Minister (ADM) for the Safety and Security Group, which reports to the Deputy Minister. The ADM is responsible for the development and enforcement of regulations and national standards, as well as for the implementation of monitoring, testing, and inspection programs in the aviation, marine, rail, and road modes of transportation.

The Director General of the Rail Safety Directorate reports to the ADM and is responsible for implementing the rail safety program. The Rail Safety Directorate consists of 4 branches: Regulatory Affairs, Operations Management, Program Management and the Rail Safety Secretariat. The Director of Operations Management is responsible for developing and managing the oversight programs, monitoring national trends, monitoring and supporting SMS auditing activities, and monitoring the level of completion of the inspection program.

At the time of the accident, the Director of Operations Management was responsible for a number of functional areas, including operations, engineering, equipment, and the SMS program. All were based at TC Headquarters, but provided program support to their regional counterparts.

The Audit, Enforcement and Risk Evaluation Group, created in 2011, provides oversight of the SMS program. It develops policies and procedures, reviews railway's initial and annual SMS submissions, audits national railways, provides auditor training, and oversees SMS activities conducted in TC's Regions. Regional oversight activities include supplying auditing expertise and assisting in audit planning activities.

In 2013, enforcement programs for the SMS Regulations had not yet been developed, and there was no procedure for the follow-up of audit findings.

1.25.1.2.2 Transport Canada Quebec Region

Each TC Region is headed by a regional director general, who is responsible for the delivery of transportation programs and services. The regional director general reports to the Deputy Minister.

The regional office is responsible for assessing the railways within its region, allocating regional inspection and auditing resources, and conducting any follow-up activities to ensure that the railways are in compliance with the rules and regulations and are operating safely.

When auditing regional railways,^{Footnote 99} the TC Regions identify the target of audits through a risk-based business planning process. The audit scope is also determined in the TC Regions by the audit team and approved by the convening authority, who is typically the regional director. The Rail Safety staff and TDG staff for TC Quebec Region report to the Surface Regional Director through the functional managers of Equipment and Operations, of Engineering, of Safety Systems Overview, and of Transportation of Dangerous Goods.

The role of the Manager, Safety Systems Overview, had evolved over time and initially included the responsibility for implementing SMS audits. In the 2006–2007 operating year, the responsibility for auditing in the Region was informally transferred to the functional groups (that is, to Equipment and Operations, and to Engineering). With this change, the Safety Systems Overview Manager assumed an advisory role with respect to the conduct of SMS audits, including the development and testing of audit tools for the inspectors. However, with limited support from the functional groups in advancing the implementation of SMS, the Safety Systems Overview Manager was subsequently assigned other projects that were not necessarily related to SMS oversight.

1.25.1.3 Planning of inspections and audits

In the third quarter of each year, TC begins a risk-based business planning process to identify and prioritize safety and program management issues and to determine the number of rail cars and locomotives, train crews, crossings, and miles of track to inspect. With this information as input, TC Headquarters develops a national inspection plan for the following year. The national inspection plan identifies the number of inspections and audits to be conducted by each TC Region, the time frame during which the inspections are to be completed, and the estimated level of effort required.

There are 3 components to the inspection system:

• The A-component inspection is a sampling process used to verify regulatory compliance and detect underlying safety issues. TC Headquarters, using a statistical model, identifies the number of inspections and target companies that are to receive these inspections.
• The B-component inspection is a planned inspection that focuses on specific recurring issues requiring closer monitoring. The TC Regions, using a risk-based method, identify the companies that are to receive these inspections.
• The C-component inspection is unplanned and responds to issues emerging through the year, such as derailments and ad hoc inspections.

Using the national inspection plan, each Region develops an operational plan to provide guidance to its RSIs on which companies, infrastructure locations, subdivision portions, operations, and maintenance employees to inspect. In TC Quebec Region, each functional group performs a risk assessment to rank the relevant subdivisions, yards, and maintenance facilities according to risk. Factors considered include accident history, compliance with standards and regulations, changes in operations, amount and type of traffic, hours of work, and type of work performed. From the risk assessment, the inspection sites are prioritized to ensure that the more risky sites are inspected in a timely manner.

TC Quebec Region is responsible for inspecting 3 national railways (CN, CPR, and VIA Rail Canada Inc. [VIA]) and 9 regional or inter-regional railways—1 passenger railway, 1 commuter railway, and 7 federally regulated short line railways. Together, these railways operate about 2900 miles of track in Quebec. Of this track, MMA operates 250 miles. In addition, TC Quebec Region inspects 8 provincially regulated short line railways, with another 1200 miles of track, on an as-requested basis.

TC Quebec Region is responsible for SMS audits at 4 regional railways, including MMA.

1.25.1.4 Operations

In the TC Quebec Region Operations Group, each inspector completes about 80 inspections per year, spread out on a level-of-risk basis among all of the regulated railways. Approximately 30 of those will be A-component inspections conducted at CN, CPR, and VIA. The remaining 50 are A-component inspections of regional railways, and the B- and C-component inspections of all of the railways. From the railway infrastructure in Quebec, the group has identified 27 subdivisions to be ranked annually according to level of risk. In each of the last 5 years, the Adirondack and Sherbrooke Subdivisions have been assessed as having either the second or third highest risk level. Factors considered include accident history, compliance with standards and regulations, human factors, operational factors (train activity, staffing levels, management), and type of work performed, as well as health and safety.

Table 5 lists the number of Operations Group inspections completed per year at MMA. When action was taken to resolve any non-compliance, MMA would report the completion date to TC Quebec Region.

A list of TC interventions with MMA follows:

• May 2009: A notice was issued regarding non-compliance with Rule 104.5 (Derails) in a yard, citing a history that went back to 2005, as well as a history of non-compliance with Rule 112 (Securing Equipment), also cited back to 2005 when cars were improperly secured in the siding at Nantes.
• May 2009: An inspection noted a lack of provision of first-aid training to 2 train crews.
• October 2011: An inspection noted 26 cars in Sherbrooke Yard that had been left without proper hand brake securement.
• February 2012: A notice was issued citing numerous infractions at the RTC office in Farnham, noting that some RTCs were not conversant with parts of the CROR and that there was no formal process to ensure compliance with the CROR by the RTCs. It was also noted that 1 RTC was allowed to work for over a year with expired minimal rule qualifications.
• February 2012: Two directions were issued under the Canada Labour Code, Part II, for failure to protect the employees from workplace hazards in Sherbrooke Yard and Farnham Yard.
• March 2012: A notice was issued citing the handling of rolling stock in a manner that disregarded the protection of workers on the track provided by red flags.
• April 2012: A “letter for insufficient action taken” was issued citing deficiencies in MMA's response to the notice regarding infractions at the RTC office.
• May 2012: An inspection noted that a crew left equipment without performing a hand brake effectiveness test.
• August 2012: A letter of non-compliance was issued regarding trains immobilized by mechanical error on or near crossings.

1.25.1.5 Equipment

The TC Quebec Region Equipment Group divides the railway infrastructure in Quebec into 15 to 20 inspection stations and ranks them annually according to risk. The stations are inspected at least once per year. MMA's Farnham and Sherbrooke yards are listed as 1 station and were ranked ninth for the 2011–2012 operating year, and second and third for the following 2 years. When assessing risk level, the Equipment Group used factors such as a railway's accident history, its history of compliance with standards and regulations, human factors, operational issues, and equipment activity.

Table 6 lists the number of Equipment Group inspections completed per year at MMA. When action was taken to resolve any infractions, MMA would report the completion date to TC Quebec Region.

A list of TC Quebec Region interventions with MMA follows:

• January 2009: An inspection found that certified car inspectors were not qualified to perform single car air brake tests.
• January 2012: A letter of concern was issued regarding a broken truck side frame, 2 carmen without recent training, and 1 carman trainee performing safety inspections and a No. 1 brake test by himself without any training.
• June 2013: An inspection found that the employees performing the safety inspections were not qualified as certified locomotive inspectors.

1.25.1.6 Engineering

TC Headquarters determines segments of track to be inspected annually as part of the A-component inspections. The TC Quebec Region Engineering Group divides the remainder of the track into segments and rates each segment according to risk. These are the B-component inspections. Factors considered when determining risk include class of track; type and amount of traffic; derailment, inspection and maintenance histories; and environmental factors. Fifty-five different track segments were identified and rated. Since 2009, MMA's Sherbrooke Subdivision was ranked 13th most risky.

Table 7 and table 8 show the Engineering Group inspections on the Sherbrooke Subdivision and selected defects that were noted. Once action was taken to correct any defect, MMA would report the completion date to TC Quebec Region.

In each of these inspections, track defects were noted, with some of the track defects recurring. Recurring defects included rail corrugations, battered rail joints, crushed rail head, insufficient ballast, and excessive vegetation (Table 8).

On 24 July 2012, during a track inspection at the Megantic West turnout, the RSI observed that the fasteners on the frog, guard rail, and heel block were loose. On 14 May 2013, the RSI observed similar conditions at the turnout.

The following are engineering-related findings of a functional audit at MMA in April 2006:

• Some Engineering Group employees received incomplete track inspection training, received incomplete CWR maintenance training, and have not received proper fall-protection training, which is needed when working on bridges.
• Insufficient ties, insufficient rail restraint, rail wear beyond the limits, rail defects remaining in the track, battered joints and rails with crushed heads with no protection, insufficient ballast, and track geometry deviations between Mile 62.0 and Mile 125.5.

The following are the resulting interventions taken by TC Quebec Region:

• April 2006: A notice and order was issued restricting train speed from Mile 62.0 to Mile 125.5 to 10 mph, citing track conditions as a hazard. MMA worked in stages to have the speed restriction removed. Many speed restrictions remained at the time of the accident.
• October 2012: A letter of concern was issued regarding Mile 0.0 to 87.0, noting urgent track geometry defects, rail corrugation, gauge corner shelling and rail surface collapse, excessive rail end batter with marginal track surface profiles, and excessive vegetation.

1.25.2 Railway safety management systems

1.25.2.1 Safety Management System Regulations

Traditional approaches to safety management were based primarily on compliance with regulations, reactive responses following accidents and incidents, and a “blame and punish, or retrain” philosophy.

An SMS is “a systematic, explicit and comprehensive process for managing safety risks.”^{Footnote 101} It is a means to ensure that the railway has the processes in place to identify the hazards in its operation and mitigate the risks. SMS was designed around evolving concepts about safety that  are believed to offer great potential for more effective risk management. Safety management systems were progressively introduced in the Canadian transportation industry because this approach to regulatory oversight, which seeks to ensure that organizations have processes in place to systematically manage risks, when combined with inspections and enforcement, is more effective in reducing accident rates.

One of the objectives of the RSA is to recognize the responsibility of companies to demonstrate, by using SMS and other means at their disposal, that they are continuously managing risks related to safety.

The SMS Regulations came into force on 31 March 2001. Section 2 states:

2. A railway company shall implement and maintain a safety management system that includes, at a minimum, the following components:
   1. the railway company safety policy and annual safety performance targets and the associated safety initiatives to achieve the targets, approved by a senior company officer and communicated to employees;
   2. clear authorities, responsibilities and accountabilities for safety at all levels in the railway company;
   3. a system for involving employees and their representatives in the development and implementation of the railway company's safety management system;
   4. systems for identifying applicable
      1. railway safety regulations, rules, standards and orders, and the procedures for demonstrating compliance with them, and
      2. exemptions and the procedures for demonstrating compliance with the terms or conditions specified in the notice of exemption;
   5. a process for
      1. identifying safety issues and concerns, including those associated with human factors, third-parties and significant changes to railway operations, and
      2. evaluating and classifying risks by means of a risk assessment;
   6. risk control strategies;
   7. systems for accident and incident reporting, investigation, analysis and corrective action;
   8. systems for ensuring that employees and any other persons to whom the railway company grants access to its property, have appropriate skills and training and adequate supervision to ensure that they comply with all safety requirements;
   9. procedures for the collection and analysis of data for assessing the safety performance of the railway company;
   10. procedures for periodic internal safety audits, reviews by management, monitoring and evaluations of the safety management system;
   11. systems for monitoring management-approved corrective actions resulting from the systems and processes required under paragraphs (d) to (j); and
   12. consolidated documentation describing the systems for each component of the safety management system.^{Footnote 102}

The SMS Regulations also require railway companies to:

• maintain records to permit the assessment of safety performance,
• submit documentation and records to the Minister that demonstrate compliance with the regulations, and
• produce safety management documentation upon request.

1.25.2.2 Montreal, Maine & Atlantic Railway's safety management system

MMA had an SMS manual that described how it would comply with each of the 12 mandatory components of the SMS Regulations. A summary of key sections of MMA's SMS manual follows:

• Safety goals and initiatives: The company sets corporate safety goals each year. The goals for year 2013 included outcome performance targets (that is, the number of incidents not to be exceeded in various categories). These performance targets would be achieved through “improved maintenance and capital improvements to the infrastructure of approximately $3.75 million in Canada.”^{Footnote 103}
• Risk management process: The identification of safety issues and concerns is a critical first step in managing risks. A list of the means by which safety issues would be identified was presented, including: OTIS, accident and incident investigations, a telephone number to report safety concerns, and internal and external audit reports.
• Operating officers were responsible for identifying safety risks that may develop due to major changes in operations.^{Footnote 104} A 1-page flowchart described the high-level steps included in the risk management process.^{Footnote 105} No guidance was provided on how to complete or document the steps.
• Risk control strategies: In the area of train operations, one of the risks identified was “unintended movements.” Among the risk control strategies noted were ensuring compliance with operating rules through OTIS, training of railway employees to ensure that qualifications were current, review of procedures for risks identified through the risk management process, and evaluation of supervisors on safety performance on a semi-annual basis.^{Footnote 106}
• Safety audit and evaluation: “The Company has developed an internal auditing system to measure compliance with the procedures outlined in the Safety Management System and to evaluate the effectiveness of the System.”^{Footnote 107}
• Operational Tests and Inspections (OTIS) Program: This program was used to ensure employee compliance with rules, regulations, and standards, among other purposes. A section of the manual was devoted to describing the OTIS program and documenting how it was to be carried out.

In addition, MMA had a safety committee on its Board of Directors, which met quarterly and discussed issues such as employee injuries, derailments, and other accidents. MMA also had multi-departmental local safety committees based at 6 MMA locations (including Farnham), which met monthly to discuss safety concerns.

MMA management conducted daily and weekly operating meetings, during which safety issues and the performance of each department were discussed.

MMA maintained databases showing injuries, derailments, and a summary of the Operational Tests and Inspections (OTIS) testing. Periodically, MMA internally issued safety information on accidents occurring on other railways, on conditions being reported, and on other railway industry safety awareness information.

Between 2009 and 2013, MMA took a number of disciplinary actions against employees in Canada for rules violations.

1.25.2.3 Transport Canada oversight of safety management systems

TC's oversight of SMS is focused on verifying that the systems are in place, that they are being used, and that they are effectively improving safety.

Compliance with the SMS Regulations is established through TC's compliance monitoring program, which is designed to verify that:

• a railway's safety management system is in compliance with the minimum regulatory requirements;
• the railway is operating in accordance with the commitments, processes and procedures outlined in its SMS; and
• the SMS is effective in improving safety.^{Footnote 108}

The company's documented SMS is assessed using the following 3 processes:^{Footnote 109}

• An initial submission review, which verifies that the documentation required under section 4 of the SMS Regulations has been submitted to the Minister. Upon completion, a letter is provided to the company confirming compliance with section 4.
• A pre-audit, which verifies that a railway company has established the minimum processes required under section 2 of the SMS Regulations. A pre-audit report is issued to the railway describing deficiencies identified in documentation.
• A verification audit, which verifies that the required processes are being used and is intended to assess their effectiveness. An audit report is issued to the company, describing deficiencies in the implementation and maintenance of the SMS.

The procedural details for these reviews and audits include the following:

• The initial submission review and the pre-audit are conducted when a railway submits its SMS to the regulator for the first time.
• A verification audit can be conducted at any time after the pre-audit is completed, based on TC's risk-based planning process.
• There is no minimum frequency at which verification audits must be conducted, nor is there a requirement to conduct a verification audit on all components of a railway's SMS at any one time.
• The audit scope is determined by the convening authority.
• The procedure for conducting verification audits is described in TC's Rail Safety Audit Procedure.^{Footnote 110}
• Once an audit team determines its findings from the audit, the railway company must submit a corrective action plan.
• TC's follow-up action on the verification audit centres on the railway company's corrective action plan. The Audit Team Lead reviews the corrective action plan and notifies the railway if the plan is acceptable.
• When an acceptable corrective action plan is received, the findings are closed.
• The audit report is forwarded to TC Headquarters and the regional managers for follow-up as required.
• The audit findings and corrective action plans serve as inputs to subsequent risk-based planning processes.

The Railway Safety Management System Regulations Enforcement Policy states:

3.3 While railway companies may be prosecuted for non-compliance to the SMS Regulations, they will not be prosecuted for deficiencies found in their implemented safety management systems.

3.4 In cases of serious deficiencies to railway companies safety management systems, section 32(3.1) Ministerial Order will be used […]^{Footnote 111}

Section 32 of the RSA states in part:

(3.1) If the Minister is of the opinion that the safety management system established by a company has deficiencies that risk compromising railway safety, the Minister may, by notice sent to the company, order the company to take the necessary corrective measures.^{Footnote 112}

In practice, this means that railway companies are required to comply with the SMS Regulations. However, unless an RSI believes that there is an immediate threat, whatever deficiency is found concerning conformance with its SMS processes would not trigger an enforcement action, but would be flagged to the railway company as an opportunity to improve its system. Where a deficiency is found in the railway company's SMS that is serious enough to risk compromising safety, the Minister can issue an order under subsection 32(3.1) requiring the railway company to take the necessary corrective measures.

1.25.2.3.1 Railway Safety Act review

In 2007, the Railway Safety Act (RSA) Review Panel examined the implementation of SMS in some detail. The panel noted that progress in implementing SMS by railways and by TC had been inconsistent and was not in line with the panel's expectations 7 years after the SMS Regulations came into force. Specific to TC, the panel noted that: “clear direction and support are required from national headquarters to overcome inconsistent approaches to delivery throughout TC's five regions.”^{Footnote 113} The panel also noted that TC was not assessing the implementation and effectiveness of railway companies' SMS, stating “Transport Canada seems to consider that a railway is compliant with SMS requirements if the railway demonstrates that the processes and management systems outlined in the SMS Regulations exist.”^{Footnote 114}

The panel identified 2 significant obstacles for TC when overseeing the implementation of SMS. First, the panel noted that a significant shift in thinking was required to move toward a regulatory framework that places the onus on the operator to demonstrate that they are capable of operating safely. As a result, the panel highlighted a need for additional training to prepare TC inspectors to fill an auditing role, since audits and inspections require two distinctly different skill sets.^{Footnote 115} Second, the panel highlighted resourcing as an issue for TC, stating that: “Transport Canada is inadequately resourced to carry out its many responsibilities in the area of railway safety.”^{Footnote 116} The effect of these challenges was described as follows:

In the Panel's opinion, Transport Canada, Rail Safety was not provided with sufficient human and financial resources and the appropriate skill sets at the outset of the SMS program. This impeded the transition to a regulatory oversight program that focuses on risk assessment and performance-based auditing at the safety management systems level.^{Footnote 117}

The same year that the RSA Review Panel published its report, TC published a document entitled Moving Forward: Changing the safety and security culture: A strategic direction for safety and security management. Noting that it is possible for organizations to be compliant with prescriptive regulations without managing risks to acceptable levels, the document outlines TC's policy “for industry to be accountable for systematically and proactively managing risks and threats within their transportation activities.”^{Footnote 118} The document notes that meeting this policy will require a significant cultural change and a change in approach on the part of the regulator:

In the past, TC intervened at the operational level. Under the new approach, TC (or a delegate) will audit and assess organizations at the organizational or system level and be able to verify that day to day operations are compliant. When an operator is found to have a system problem or a day to day problem that is left unresolved or mitigated poorly, TC will intervene at the appropriate level. TC will maintain the capability to apply its traditional compliance inspection and audit activity while augmenting its capability to perform system audits and assessments.^{Footnote 119}

Moving Forward recognized the same resourcing and skill-set challenges as the RSA Review Panel and provided strategies for overcoming the challenges associated with the transition to SMS both within TC and industry.

TC Rail Safety's Strategic Plan (2010–2015) restated the commitment to implementing SMS:

At Transport Canada, safety management systems (SMS) remain a priority and Rail Safety continues to focus its efforts on fostering and promoting SMS implementation and advancing safety culture within the rail industry.”^{Footnote 120}

The plan notes progress in addressing the challenges identified by the RSA Review Panel and Moving Forward. Specifically, it mentions that an organizational review of the Rail Safety Directorate was undertaken between September 2008 and March 2010, and that additional resources were added to the Rail Safety Budget for 2009, allowing an additional 53 positions to be added to support the national Rail Safety Program. Strategies outlined in the plan indicate that Rail Safety is focused on ensuring that all inspectors are trained in audit and risk management and on improving recruitment and retention, to ensure adequate human resources.

1.25.2.3.2 Report of the Auditor General of Canada: Oversight of Rail Safety—Transport Canada

The Office of the Auditor General (OAG) conducted an audit of TC (Rail Safety) for the 2011–2012 fiscal year to examine whether it has adequately overseen the management of rail safety risks for federal railways. The OAG report, tabled in Parliament on 26 November 2013, stated:

Transport Canada does not have the assurance it needs that federal railways have implemented adequate and effective safety management systems. Federal railways were required to implement such systems 12 years ago. At the same time, the government approved risk-funding for Transport Canada to oversee the systems. The Department has yet to establish an audit approach that provides a minimum level of assurance to senior management that federal railways have implemented adequate and effective safety management systems for managing their safety risks in day-to-day operations, and for complying with safety requirements.^{Footnote 121}

The audit noted that TC had made progress in addressing issues identified in previous reviews of SMS implementation, while highlighting that there was still work to be done. Specifically, the audit identified the following:

• TC had set a target of auditing federally regulated railways every 3 years, but had conducted only 26% of these audits.
• The scope of the audits was too limited and examined the effectiveness of only a small portion of SMS components.
• TC did not take any enforcement action to require railways to maintain adequate and effective safety management systems, even when deficiencies were identified that could affect safety.
• Audit reports identified whether the SMS met regulatory requirements, but did not identify whether it had been effectively implemented.
• In almost all cases, there was no follow-up by TC inspectors to ensure that corrective action plans submitted by companies in response to SMS audit reports had been implemented.
• Inspector skill sets required for the effective oversight of SMS have not been assessed, and position descriptions have not been updated, to reflect the need for oversight of SMS.
• Approximately 1/3 of inspectors and 2/3 of managers had not attended the available training courses provided by TC on audit methodology and on SMS concepts and principles.

1.25.2.4 Introduction of Safety Management System Oversight Program

In 2002, the introduction of the SMS program came under the jurisdiction of the Director, Audit and Quality Assurance, whose responsibilities included the implementation of the SMS Regulations, the delivery of national audits, the national training program, the quality assurance program, and the creation of oversight tools. The Safety Systems Overview manager in each Region participated as an audit team member or team leader in the national SMS audits.

The Director of Audit and Quality Assurance and 1 junior employee provided support related to SMS oversight to the regional inspectors, and produced audit procedures and guidelines. They were also responsible for reviewing the national railway's initial SMS submission and overseeing the auditing of the national railways. Each of TC's 5 Regions had 2 temporary employees to oversee the implementation of SMS in the regional railways.

In 2009, after the RSA Review Panel indicated that a lack of resources impeded the transition to an SMS-based regulatory oversight program, TC underwent a reorganization to integrate SMS as the key focus of its oversight activities. In addition, Budget 2009 provided $44 million over 5 years to TC for rail safety initiatives, such as enhancing its regulatory oversight and enforcement capacity, and conducting research, which included the development and publishing in 2010 of its Guide for Developing, Implementing and Enhancing Railway Safety Management Systems.

1.25.2.5 Auditor training

TC Rail Safety's Audit, Enforcement and Risk Evaluation Group began delivering a 4-day training program for SMS auditing in the 2012–2013 fiscal year. The training program for RSIs and managers included a 1-day course on SMS and a 3-day course on auditing.

Prior to this new course, other auditor training had been available to the RSIs. In 2001, the regional Manager of Safety Systems Overview and 1 inspector in that group attended auditor and lead auditor training. Between 2003 and 2004, the Safety Systems Overview Manager and 1 inspector each attended program evaluation or auditor training courses provided by third parties. In 2007 and 2008, a number of inspectors and managers from TC Quebec Region attended audit team member and audit team leader training provided by TC.

Table 9 shows which RSIs and managers in the TC Quebec Region attended these auditing courses.

Notes: The total number of inspectors represents positions that were filled at the time of the accident. The dates on which courses were attended are as follows:

• New Auditor Skills Course: March–September 2011
• Previous Team Leader Course: April 2007
• Previous Audit Member Course: May 2007–May 2008

Within the TC Quebec Region, some RSIs felt unprepared to participate effectively in SMS audits, particularly as audit team leaders, even after attending the courses. Many felt that resources devoted to SMS audits were poorly deployed, given that they believed that there was little that could be done if a railway company was not conforming to its SMS processes.

1.25.2.6 Safety management system audits

1.25.2.6.1 Transport Canada Quebec Region

TC Quebec Region was responsible for auditing the SMS of 4 regional railways. Table 10 shows a summary of the audits conducted and indicates whether they were performed to validate the existence of safety management processes and/or performed to validate the effectiveness of the processes in improving safety.

Note: A partial audit was conducted on Chemin de fer de la Matapédia et du Golfe in 2008. The railway was sold before the audit was completed.

In the 12 years since the SMS Regulations came into force, TC Quebec Region conducted initial pre-audits to verify that all 4 of the regional railways had documented the processes required by the SMS Regulations. From the time these pre-audits were completed to the date of the accident, only 3 audits were completed that were aimed at assessing the effectiveness of companies' SMS processes in improving safety. Two of these audits were conducted at MMA, and 1 was conducted at QNS&L. All 3 were limited in scope to part of the organization's SMS. An assessment of the effectiveness of all aspects of SMS has not been completed for the 4 regional railways in TC Quebec Region.

1.25.2.6.2 Montreal, Maine & Atlantic Railway

1.25.2.6.2.1 Initial submission and pre-audit (2002–2003)

MMA made its initial submission to TC Quebec Region, as required under the SMS Regulations, in December 2002. TC reviewed the information submitted under section 4 of the regulations and found MMA to be compliant.

TC conducted a pre-audit at the MMA offices in Farnham on 23 and 24 January 2003. The pre-audit report recognized the efforts of MMA to develop an SMS, but found that its SMS did not meet the requirements of section 2 of the SMS Regulations. Areas of the SMS that were non-compliant or in need of improvement were described in detail. Some of the issues identified included the following:

• The documentation for safety-related roles, responsibilities, authorities, and relationships between management, employees and third parties was not detailed.
• The systems used by MMA to identify which regulations, rules, standards, and orders were applicable to operations were not clear.
• The means for approving and implementing risk control strategies were not documented.
• Occurrence reporting requirements were not clear, and the procedure for performing investigations was not complete.
• The procedures for collecting and analyzing safety data were incomplete.
• The procedure for periodic internal audits was incomplete.
• There was no procedure for monitoring the implementation of corrective action resulting from systems and processes contained in the SMS.

The overall result of the pre-audit was that MMA's SMS required a thorough review. TC provided MMA with the pre-audit report on 06 April 2003 , and required the railway to provide a corrective action plan. On 11 September 2003, MMA submitted a revised SMS to TC.

1.25.2.6.2.2 Period between the pre-audit and the first safety management system audit (2004–2009)

MMA provided annual submissions required by section 5 of the SMS Regulations to TC Quebec Region in the spring of 2004, 2006, 2008, and 2009. There is no indication that TC solicited reports for the 2 missing years.

1.25.2.6.2.3 Period surrounding the first safety management system audit (2010–2012)

In March 2010, the TC Quebec Surface Regional Director convened an SMS audit of MMA. The on-site portion of the audit was conducted in Farnham and Sherbrooke yards between 15 and 24 March 2010. The audit was convened as a result of the number of non-conformances noted during inspections, the need to ensure that processes were in place to correct them, MMA's plan to implement SPTO, and its limited number of supervisory personnel.

The scope of the audit included elements of SMS and compliance with other rules, and was described as encompassing:

• systems for identifying applicable railway safety regulations, rules, standards, and orders, and the procedures for demonstrating compliance with them (subparagraph 2(d)(i) of the SMS Regulations);
• CROR 83, 103(c), 104(i), 104.5, and 112;
• freight car inspection and safety rules;
• freight and passenger train brake inspection and safety rules.

The audit report made 8 findings, the most significant of which was the fact that the SMS provided to TC Quebec Region had not been implemented. The auditors found that none of the 14 represented employees and managers interviewed during the audit had ever seen the SMS manual and that it had never been translated into French. MMA informed the auditors that it had been awaiting approval from TC following the 2003 submission of the revised SMS before proceeding with implementation. The company was informed that TC does not approve a railway's SMS. Under the SMS Regulations, it is the company's responsibility to implement and maintain an SMS and to submit documents to the Minister.

Other findings related to deficiencies in the company's SMS included the following:

• The risk management process was used solely by managers and only in the event of major operational changes or following employee injuries.
• Supervisors were not trained in how to perform efficiency tests under the company's OTIS.
• The company did not have a process in place for conducting an internal audit of its SMS and had never completed an internal audit.

Deficiencies related to employee training were also identified. Specifically, mechanical employees were not trained according to the CROR, and operating employees, as well as the rules instructor, were not properly qualified.

TC Quebec Region sent the audit report to MMA on 16 April 2010. A corrective action plan was provided on 28 May 2010. MMA indicated that its intention was to fully implement the SMS by 31 October 2010, following a review of the SMS manual by the Health and Safety Committee and translation into French. The corrective action plan also described the intention to involve employees more in risk mitigation through the health and safety committees, to conduct internal audits of the SMS by 31 August 2011, and to correct the various documentation and training deficiencies identified.

The corrective action plan was reviewed by the lead auditor when it was received, to verify that it addressed the findings. Only some of the findings were addressed with corrective action. No guidance was provided to the Regions stipulating who was the person responsible for ensuring that all of the findings were addressed with corrective action.

1.25.2.6.2.4 Period surrounding the second safety management system audit (2012-2013)

The TC Quebec Surface Regional Director convened a second SMS audit of MMA in October 2012. The lead auditor was provided by TC Headquarters and was assisted by 2 RSIs from TC Quebec Region. The scope of the audit included SMS components 2(b), (d), (g), (h), (k), and (l), which relate to accident and incident reporting, and covered the period from January 2010 to the time of the audit. The audit was convened by the Surface Regional Director in response to an occurrence in which an MMA train had blocked a crossing for a significant period of time. Given that TC Quebec Region had learned about the event through the media, a review of available occurrence data was conducted, and it was determined that an audit focused on MMA's reporting processes would be appropriate.

The audit report included 4 findings—3 related to documentation and record keeping, and 1 related to 4 reportable occurrences that were not found in the TSB database, suggesting that they had never been reported. Further examination by TSB revealed that MMA had not reported 22 occurrences over a 7-year period (2007–2013).

The audit report was provided to MMA on 10 December 2012, and a corrective action plan was provided to TC Quebec Region on 30 January 2013. MMA's corrective action plan was reviewed by the audit team.

MMA provided the annual submission required by section 5 of the SMS Regulations to TC Quebec Region in the spring of 2013.

1.25.2.6.3 Other Regions

Regulatory oversight activities for regional railways in TC’s Atlantic and Ontario Regions were reviewed for comparison purposes. Specifically, the SMS audits and follow-up activities for New Brunswick Southern Railway (NB Southern) and for Rail America, Inc. were examined.

It was determined that:

• NB Southern received a pre-audit of its SMS in 2003, a verification audit in 2004, and additional audits in 2005, 2006, 2007, 2009, 2012, and 2013. The Safety Systems Overview Group was involved in planning, managing, and following up on the audits. The audits were focused on the processes and procedures associated with components listed in the SMS. Audit findings were presented to the railway in audit reports; railway corrective action plans were evaluated, and their implementation was monitored. The scope of subsequent audits incorporated the findings from the previous audits to verify their implementation.
• Rail America, Inc. received a pre-audit in 2002 and a verification audit in 2005, and was audited again in 2006 and 2011. The Safety Systems Overview Group was active in the SMS auditing and follow-up processes. Corrective action plans were requested, and follow-up action was undertaken after the 2006 and 2011 audits. Some findings from previous audits were incorporated into the scope of subsequent audits. For example, the lack of a risk assessment process and an internal SMS auditing process was identified in the 2002 pre-audit. The 2005, 2006, and 2011 audits examined the risk assessment processes and the internal SMS auditing processes, and found that they were not being completed. Because of Rail America, Inc.’s perceived failure to implement and follow its internal SMS processes, TC Ontario Region began the process of issuing a ministerial order in 2007 to compel the company to do so. In 2012, after 5 years, it abandoned its initiative, stating that it had no authority to require a railway to follow its own SMS processes and procedures; rather, its authority was limited to requiring railways to develop adequate processes and procedures.

1.25.3 Other Transportation Safety Board rail investigations involving safety management systems

The TSB has conducted a number of investigations^{Footnote 122} that found deficiencies in the implementation of SMS. Through these investigations, the TSB has highlighted the following issues:

• companies not conducting risk assessments for changes in operations, or not effectively identifying the risks associated with operational changes;
• SMS processes that were ineffective in identifying unsafe practices, or differences between practices and procedures; and
• lack of SMS audits or ineffective SMS audits.

Following the investigation into a 2006 runaway freight train (R06V0136, near Lillooet, British Columbia), the Board noted the absence of formal risk assessments prior to the implementation of significant operational changes that contributed to the accident. In light of this instance and a similar lack of risk assessment to identify and mitigate risks prior to operational changes that preceded 2 other major derailments, the Board issued Recommendation R09-03:

Shortly after this recommendation was issued, TSB’s 2010 Watchlist^{Footnote 124} highlighted a problem with SMS for the air, rail and marine modes of transportation. In describing the Watchlist issue, the TSB stated:

Implemented properly, safety management systems (SMS) allow transportation companies to identify hazards, manage risks, and develop and follow effective safety processes. However, Transport Canada (TC) does not always provide effective oversight of transportation companies transitioning to SMS, while some companies are not even required to have one.^{Footnote 125}

Specific to the rail mode, the Watchlist issue stated:

Although SMS has been in place in the rail industry since 2001, recent investigations have shown that the railways are not always taking effective action to identify and mitigate risk through their safety management systems. The TSB has also found that regulatory audits are not always effective and may not consistently produce the expected benefits.^{Footnote 126}

Following the inclusion of SMS on TSB’s Watchlist, CN and TC provided information describing their respective responses to Recommendation R09-03. For TC’s part, it provided the following information in October 2011:

TC and the rail industry have developed guidelines and tools to assist railway companies in implementing and improving their safety management systems. Also, TC has completed staffing technical positions and is providing training for the new Audit, Enforcement and Risk Evaluation Division to provide leadership and functional direction to the industry. For TC this issue is completed.^{Footnote 127}

In February 2012, the Board assessed the response to Recommendation R09-03 as Fully Satisfactory. As a result of the reported progress in addressing this safety issue, the most recent version of the TSB Watchlist, published in 2012, did not include SMS as a systemic issue for the rail mode.

1.25.4 Substantial changes in railway operations: Increase in the transportation of crude oil by rail

In recent years, the transportation of crude oil by rail has increased dramatically in North America. Shipments of crude oil by rail by Canadian Class 1 railways have increased from about 500 car loads in 2009 to 160 000 car loads in 2013.^{Footnote 128} In the United States, crude oil shipments have increased from 10 800 car loads in 2009 to about 400 000 in 2013.^{Footnote 129}

As North American production of oil continues to increase, shipments of oil by rail will continue to rise. In North America, roughly 1.0 million barrels per day (b/d) of crude is currently moved by rail, and the total volume of crude transported by rail is expected to grow to 4.5 million b/d in the next 10 years.

1.25.4.1 MMA’s assessment of risk: Increase in the transportation of crude oil

Between 2011 and 2012, the number of car loads of DGs handled by MMA in Canada increased by 280%. Almost the entire increase was due to the increase in crude oil unit trains. This was a significant change to railway operations, changing the risk profile of the railway.

As MMA began to carry more and more crude oil, it discussed operating longer, heavier trains, and the effects on traction and braking. However, it did not perceive the need to systematically assess all of the changes through a formal risk assessment, and all risks were not identified.

1.25.4.2 Transport Canada’s response to Montreal, Maine & Atlantic Railway’s operational changes

Although there are annual SMS reporting requirements, there is no specific requirement to advise the regulator of major changes to operations, including changes to the risk profile of the goods being carried. However, in some other countries, such as Australia, major operational changes in railway operations, such as SPTO, must be reviewed and approved through assessment by the rail safety regulator.

Similarly, other transportation industries require direct involvement of the regulator when there is a substantial operational change. For example, in the pipeline industry, companies are required to monitor any change in land use or increase in population density within a specified area around their pipelines, and to submit to the regulator a proposed plan to deal with the changes. Likewise, regulatory approval is required when the maximum operating pressure of the pipeline is increased, or when the fluid type transported by the pipeline is changed. The regulator reviews the plans and interacts with the companies throughout the approval process to ensure that adequate safety measures are in place for the proposed change in operation.

In 2011, TC’s TDG Directorate identified the significant increase in crude oil volumes being transported in unit trains as one of the emerging issues potentially requiring greater regulatory oversight. The TDG Directorate’s risk assessment identified that the majority of the increased risks were related to the facilities where petroleum crude oil was loaded into rail tank cars. As a result, inspections of such facilities, which were not being inspected prior to 2011, were increased. The TDG Directorate’s risk analysis did not identify the misclassification of petroleum crude oil as having an elevated level of risk.

At the Irving facilities in Saint John, the loading and unloading facilities were inspected 4 times between 2009 and 2012. These inspections found no instances of non-compliance. The accuracy of the classification of the petroleum crude oil being imported, handled, or transported was not verified by either sampling and testing of the product or by inspecting the company’s classification processes.

TC did not ensure that an assessment of the operational risks inherent in transporting substantial volumes of crude oil by rail was performed. Nor did it specifically consider the risks presented by MMA carrying increasing volumes of crude oil from the Bakken region on its Canadian lines.

1.25.4.3 Canadian Transportation Agency’s response to Montreal, Maine & Atlantic Railway’s operational changes

The Canadian Transportation Agency (CTA) is an independent, quasi-judicial tribunal and economic regulator. The role of the CTA in the regulation of Canada’s rail transportation system is to consider applications for certificates of fitness (COF) for proposed construction or operation of railways underthe Canada Transportation Act.

The Canada Transportation Act requires a person who is proposing to construct or operate a freight or passenger railway under federal jurisdiction to apply to the CTA for a COF. The CTA will issue the COF if it is satisfied that there will be adequate third-party liability insurance coverage^{Footnote 130} for the proposed construction or operation, as determined in accordance with the Third Party Liability Coverage Regulations.

When determining whether third-party liability insurance coverage is adequate, the CTA examines the risks associated with the proposed operation by considering information that is provided by the applicant, including information on passenger ridership, train miles, volume of traffic, class and volume of DGs transported, population areas served, number of level crossings, speed of trains, train crew size and training, method of train control and the overall safety record of the applicant. To obtain safety record data, the CTA contacts TC. The CTA identifies railways with similar risk profiles and compares their levels of insurance to make a determination of insurance adequacy.

Once a COF is issued, there is no requirement for renewal or for periodic reassessment of the applicant. However, on an ongoing basis, the certificate holder must notify the CTA whenever its liability insurance coverage is cancelled or altered, or whenever there is a change in construction or operation such that its liability insurance may no longer be adequate. The CTA does not proactively seek out this type of information. When an operational change, or a change to the construction of the railway occurs, the railway must apply for a variance to the certificate which would then trigger a CTA review. The magnitude and type of changes in operations that necessitate informing the CTA are subjective and left to the railway to determine. If the CTA determines that the insurance coverage is no longer adequate, it may suspend or cancel the COF.

The COF for MMA’s freight operations in Quebec was issued in 2002. In 2003, MMA applied for and received a variance to its COF to reflect a reduction of track on which it operated. Again in 2003, MMA requested and received a variance to permit the operation of a passenger train for a 6-day period. In 2005, a third variance was obtained to permit the operation of passenger trains on its track.

When it came to more significant changes in operations, including the increase in DG traffic or the commencement of SPTO between Farnham and Lac-Mégantic, MMA did not seek a variance to its COF, nor increase its liability insurance. The CTA was not aware of changes in operations that may have affected MMA’s COF.

1.25.5 Transportation of dangerous goods

1.25.5.1 Directorate

TC’s TDG Directorate regulates the transportation of DGs under the authority of the TDG Act. The TDG Act applies, for the purpose of transport, to every person that imports, offers for transport, handles or transports DGs by all modes of transportation in Canada.

The TDG Directorate develops policies, regulations, and standards. It registers facilities involved in the manufacture, inspection, maintenance, or repair of containers. It also reviews and approves ERAPs, and provides guidance during emergency response activities (through its Canadian Transport Emergency Centre [CANUTEC]). Furthermore, the TDG Directorate conducts research to improve safety, and administers compliance monitoring and enforcement programs.

1.25.5.2 Compliance monitoring and enforcement

TDG inspectors can inspect any facility or means of transport where DGs are handled, offered for transport or transported, as well as facilities where DG containers are manufactured, repaired, or tested.

The selection and prioritization of TDG inspection sites are determined by a risk-based methodology. Risk factors taken into account are:

• inspection and compliance history,
• regional and national issues,
• incident history,
• DG class and container type,
• facility type,
• the presence of an ERAP, and
• any emerging issues.

Inspections are carried out at the location where DGs enter the transportation system, commonly at the facility where they are offered for transport (such as where they are manufactured, produced, or shipped from). Inspections en route and at border crossings occur, but much less frequently.

Inspection of ERAPs or registered facilities that manufacture, repair, or test DG containers are also performed as part of the compliance monitoring activities.

During the course of an inspection, TDG inspectors may examine such things as safety marks and shipping documents, as well as loading and unloading operations. Inspections do not include verification of the accuracy of classification by either sampling and testing of the product or by examining the classification processes used by consignors.

All instances of non-compliance are documented in inspection reports. These are communicated to the person(s) responsible for the facility or activity that was inspected. Depending on the nature or seriousness of identified instances of non-compliance, notices of infractions may also be issued. Such notices are not explicitly authorized by the TDG Act and are used to warn companies that instances of non-compliance may result in stricter enforcement actions.

All instances of non-compliance are tracked in TDG’s Inspection Information System (IIS). The sites for follow-up inspections (i.e., inspections to ensure that identified instances of non-compliance are remedied) are selected using a risk-based approach with data from the IIS. TDG inspectors may also take, as applicable, the following regulatory actions, in accordance with the procedures outlined in the TDG inspector manual, to address various types of non-compliance:

• Issuance of detention orders (section 17 of the TDG Act), and
• Issuance of directions (sections 7, 13, 17 and 19 of the TDG Act).

TDG inspectors may also initiate prosecutions by summary or indictable conviction pursuant to section 33 of the TDG Act, and have the option of issuing tickets^{Footnote 131} under the Contraventions Act. Only selected, more serious offences are considered for prosecution, due to the complexity, cost, and resource-intensive nature of the criminal prosecution process. When a prosecution is initiated, an investigation is undertaken in order to ensure that all evidence gathered is admissible in court.

The TDG legislation that was in effect at the time did not contain administrative monetary penalty provisions.^{Footnote 132}

1.25.5.3 Transportation of dangerous goods inspections

There were approximately 11 000 TDG inspections performed over the past 5 years across Canada, of which 1650 were conducted in Quebec.

These inspections resulted in 186 actions taken to address identified instances of non-compliance (Table 11).

Note: 2013 data represents January to June only.

1.25.5.4 Transportation of dangerous goods inspections – Rail mode

TDG inspections involve the inspecting of facilities where DGs are being loaded, unloaded, and offered for transport by rail, as well as inspections of shippers and ERAP holders. From 2009 to 2013, there were approximately 1320 TDG inspections performed in Canada for the rail mode, of which 12 were in Quebec (which does not have TDG inspectors dedicated to the rail mode).

These inspections resulted in a total number of 22 actions taken to address identified instances of non-compliance (Table 12).

Note: 2013 data represents January to June only.

There were 3 TDG inspections at MMA in the past 5 years. No detention orders or directions were issued, and no prosecutions had been initiated, and there was no identified reason to do so.

In this accident, a 4700-foot train transporting petroleum crude oil, that was parked on the main track, ran away, travelling 7.2 miles down a descending grade. The train gained speed and derailed at 65 mph in the town of Lac-Mégantic, Quebec. Sixty-three tank cars spilled approximately 6 million litres of crude oil, which ignited, levelling buildings, destroying the centre of the town, and killing 47 people. There was environmental contamination of the downtown area, as well as contamination of the adjacent river and lake.

The investigation into this accident was complex. Using data from the locomotive event recorder (LER), the rail traffic control recordings, the information gathered from the locomotives, and what remained of the tank cars, as well as the recollections of those involved, the TSB was able to piece together what happened. This information led to an understanding of how the train was secured, what role the locomotive fire played, why the train began to roll on the descending grade, and the events that followed. The derailment and subsequent failure of the tank cars, as well as the manner in which the crude oil caught fire and fuelled many other fires, is now well understood. These factors will be analyzed in this section of the report.

However, understanding what happened is only the first step; it is important to determine why such accidents happen. This analysis will therefore focus on the underlying factors that played a role in this accident, including Transport Canada's (TC) oversight, as well as on organizational factors, such as Montreal, Maine & Atlantic Railway's (MMA's) safety culture and the effectiveness of its safety management system (SMS). The analysis will then look beyond this accident, with the objective of improving rail safety in Canada.

2.1 The accident

On the evening before the accident, MMA-002 arrived at Nantes, Quebec, and the locomotive engineer (LE) parked the train on a grade on the main track. A replacement LE was scheduled to continue the trip east in the morning. This was standard company procedure, and the LE had regularly parked the train overnight in this manner.

After bringing the train to a stop using the automatic brakes, the LE applied the independent brakes to the locomotive consist. He began applying hand brakes and shutting down the trailing locomotives, including the 2 locomotives that were equipped with an auto-start system. The lead locomotive was left running to comply with United States air brake rules.

In order to test whether the number of hand brakes applied on the train was sufficient, the LE released the automatic air brakes, but the independent brakes were left applied. As such, the train was held in place by a combination of the hand brakes and by the independent brakes on the locomotives, as opposed to being held by the hand brakes alone. When the train did not move, the LE deemed the test successful and the train adequately secured.

During this time, the LE also noted that the lead locomotive engine was producing excessive amounts of black and white smoke. This smoke was the result of engine oil that had superheated after building up in the body of the turbocharger. The build-up was caused by failure of a non-standard engine repair. The LE discussed the smoke with the rail traffic controller (RTC) in Bangor, Maine. It was expected that the situation would improve and be dealt with in the morning.

Upon arrival of the taxi sent to pick up the LE, the taxi driver noted the smoke and mentioned that oil droplets from the locomotive were landing on the taxi's windshield. The LE acknowledged this and took no further action. The taxi left the area for the hotel.

At 2340, a 911 call was made to report a fire on a train at Nantes. The Nantes Fire Department responded to the call and extinguished the fire. To do so, the firefighters shut off the locomotive's fuel supply, thus stopping the engine, and moved the electrical breakers inside the cab to the off position, which was in keeping with railway instructions. The employee who was dispatched by MMA to meet the firefighters was a track foreman with no locomotive operations background. As a result, another locomotive was not started. After notifying the RTC in Farnham, Quebec, of the train's condition, this employee soon left the site with the firefighters.

Normally, when the electrical breakers were moved to the off position, an automatic penalty brake would have been applied to the entire train. The reset safety control (RSC), however, was wired in such a way that this did not occur, nullifying a potential safety defence. Moreover, with the locomotive's engine shut down (and no other locomotive started), the compressor was no longer supplying air to the air brake system. As air began to slowly leak from components of the train's brake system, the main reservoirs began to be depleted. This gradually reduced the effectiveness of the independent brakes on the locomotive consist and, as the air pressure dropped further, the securement of the train became progressively more reliant on the hand brakes.

Eventually, when the air pressure dropped sufficiently, the combination of the independent brakes and hand brakes was no longer sufficient to hold the train, and it began to roll. As it proceeded down the grade, the train picked up speed, reaching 65 mph. The train derailed in the curve at the Megantic West turnout.

2.2 Unattended trains

MMA-002 was left unattended adjacent to a public highway, with the locomotive cab doors unlocked, the reverser on the LE seat, and the lead locomotive still running; it was therefore at increased risk of unauthorized access. Even if the train had been properly secured, the consequences of vandalism and of locomotive controls tampering can be serious. Although there is no evidence of unauthorized entry that night, there are risks to leaving locomotives unlocked in easily accessible locations with the reverser handle in the cab.

2.3 Securement of MMA-002 at Nantes

2.3.1 Number of hand brakes

As demonstrated in this accident, railway rules related to the securement of trains are important because of the potential consequences of improperly secured equipment.

MMA followed Canadian Rail Operating Rule (CROR)112, which stated that a “sufficient” number of hand brakes must be applied and an effectiveness test must be performed to verify that the retarding force is adequate. In addition, MMA had supplementary rules in its General Special Instructions and Safety Rules. These rules reference a chart detailing the minimum number of hand brakes to be applied—the “10% + 2” instruction. Since all air brake systems leak, MMA's instructions also explicitly stated that air brakes “must not be depended upon to prevent an undesired movement.”^{Footnote 133}

Furthermore, the chart detailing the minimum number of hand brakes was only meant to be a guideline and, as stated in the Safety Rules, “additional hand brakes may be required” because of factors such as grade, the number of cars, the weight of a train, and weather conditions.

In addition, TSB tests have demonstrated that a variety of other factors can affect the performance of individual hand brakes, including the amount of force applied by a person, the mechanical condition and the efficiency of the hand brake, as well as the presence of foreign matter between the brake shoes and the wheels. It is therefore imperative that an LE properly verify the securement of a train by performing a hand brake effectiveness test.

In this accident, the 7 hand brakes that were applied correlated to approximately 10% of the cars. This number proved insufficient once the air from the brake system leaked off and the independent brakes no longer provided supplementary retarding force.

Therefore, this investigation examined why work is not always performed in accordance with written procedures, and how adaptations of procedures sometimes occur. More specifically, the investigation examined why the LE considered 7 hand brakes to be sufficient, and why he did not perform a proper effectiveness test.

One reason for this decision may have been that the LE was not fully conversant with relevant rules and special instructions on train securement. Although the LE's results from his requalification tests indicated that he had correctly answered questions relating to the minimum number of hand brakes, these questions were relatively simple and did not demonstrate that the LE possessed knowledge of the significance and rationale behind the rules. Furthermore, the LE was never tested on the procedures for performing a hand brake effectiveness test, nor did the company's Operational Tests and Inspections (OTIS) Program confirm that hand brake effectiveness tests were being conducted correctly. In addition, the LE did not have all of the required documents with him on board the train, and could not easily refer to rules and company instructions.

The LE's previous experiences might also have been a factor in his selection of the number of hand brakes. The LE had previously secured trains at this location using hand brakes on just 10% of the cars. Furthermore, at other locations, circumstances were different (less challenging terrain and gentler grades), and applying only 10% may well have been sufficient or permitted by special instructions. The absence of previous problems may have been taken as an indicator of future success.

The TSB's investigation revealed that the LE's use of the independent brakes at Nantes on previous occasions influenced his perception of the force provided by the hand brakes, leading him to conclude that just 10% was sufficient. The LE was not alone in this belief; some other MMA LEs also did not release the independent brakes when securing trains, which is indicative that poor train securement practices were not isolated to this accident.

In order to determine how many hand brakes would have been sufficient to hold MMA‑002 on a 0.92% average descending grade—that is, without using the independent brakes on the locomotive consist—the TSB performed an extensive series of tests, taking into account a variety of factors affecting hand brake performance. The main conclusion of these tests was that 9 hand brakes, which is the minimum number set out in the MMA chart, would not have been sufficient to hold the train at Nantes.

In a scenario in which there was no application of automatic air brakes, and depending on the force applied,^{Footnote 134} the TSB concluded that the LE would have needed to apply between 18 and 26 hand brakes on the cars and locomotive consist.

Given that a 13-psi automatic air brake application was used to stop the train, the TSB concluded that, in this situation, the LE would have needed to apply between 15 and 20 hand brakes on the cars and locomotive consist.

The TSB also concluded that, since the hand brakes on the tank cars were more effective than the hand brakes on the locomotives, between 12 and 18 hand brakes would have been sufficient if the hand brakes were applied only to the cars.

The detailed results of these tests are shown in Appendix J.

However, as noted in the company's Safety Rules, the numbers set out in the chart are only minimums, and some conditions may require additional hand brakes. For this reason, the LE must determine, through a proper hand brake effectiveness test, the sufficient number of hand brakes.

Before the Lac-Mégantic accident, there had been no runaway trains as a result of unoccupied trains being left at Nantes or Vachon, Quebec. This was likely due to the fact that independent brakes were being used in addition to hand brakes to secure trains. Nonetheless, if a proper hand brake effectiveness test is not performed, equipment may not be adequately secured, increasing the risk of a runaway.

2.3.2 Conducting a hand brake effectiveness test

Locomotive independent air brakes can provide very effective braking force and are normally able to hold a train on their own. However, these brakes cannot be relied upon in all situations. If locomotives are shut down or become inoperative, system leakage will cause the brake cylinder pressure to drop and the air brakes to lose effectiveness. Hand brakes, which do not rely on air pressure, are therefore a critical defence, and must be able to hold a train on their own. Their effectiveness cannot be determined without a properly conducted effectiveness test.

A hand brake effectiveness test involves isolating the effect of the hand brakes on the cars from that of any other brakes. This is done by releasing all of the air brakes on the train and on the locomotives, and allowing or causing the slack to adjust (through gravity or by applying throttle as necessary).

However, if, during a hand brake effectiveness test (when applying throttle), hand brakes are also applied on the operating locomotive(s), the retarding force from the locomotive hand brakes can give the false impression that the retarding force is that of the entire train. This can result in an inaccurate effectiveness test, increasing the risk of runaways. An LE would therefore have to compensate with a greater throttle application to overcome the retarding force of the locomotive hand brakes.

Because a locomotive was always left operating and therefore maintained the integrity of the independent brakes, there had been no previous train securement problems at Nantes. Therefore, any improperly conducted hand brake effectiveness test had not previously resulted in train movement.

2.3.3 Locomotive hand brake maintenance

Because the quick release brake (QRB) valve on MMA 5026 was defective, the brake cylinder air was not released when the hand brake was applied. Once the brake cylinder air leaked off, its hand brake force was lost. Consequently, only 6 of the 7 hand brakes applied were providing braking force. Therefore, in reality, even less hand brake force was being applied to the train than the LE had intended.

As a result of common malfunctions with QRB valves, MMA issued instructions on when and how to trip the QRB valve manually if it did not exhaust. The QRB valve on MMA 5026 had previously been modified to keep it working. However, the valve had sustained further wear and damage to the lifter, and the retaining disc was no longer operating. As a result, the QRB valve had to be manually tripped for the hand brake to be operational. Because the LE was not aware of these instructions, he did not know about the malfunction and did not manually trip the valve.

Furthermore, hand brake testing on the 5 locomotives determined that, at 100 foot-pounds of torque, only an average brake ratio of approximately 3.8% could be attained. Moreover, even at 150 foot-pounds of torque, the combined brake ratios of the hand brakes ranged from approximately 4.2% to 6.8% of the locomotives' gross weight on rail, which is below current Association of American Railroads (AAR) requirements. By comparison, the same testing on the occurrence tank cars determined that the cars generally met the AAR requirements, generating brake ratios in the range of 10% of their gross weight on rail. These ratios resulted in average brake shoe forces generated by the locomotives that were significantly less (below 2/3) than those generated by the tank cars when the same torque was applied. Therefore, hand brakes applied on 3 locomotives provided less brake shoe force than that of 2 tank cars.

Futhermore, hand brakes on some locomotives apply the brake shoes to only 2 wheels. Therefore, if a locomotive hand brake system is out of adjustment, the overall retarding brake force could be reduced. Although modern locomotives can have higher net braking ratios than do freight cars, older locomotives, especially if not well maintained, can be more susceptible to reduced effectiveness. Consequently, given the variable condition of locomotive hand brakes, counting them as part of the total number of required hand brakes can lead to an overestimation of the braking force, thereby increasing the risk of runaways.

2.4 Locomotive fire on MMA-002

In October 2012, 8 months before the accident, MMA 5017 was sent to the company's repair shop in Derby, Maine, following an engine failure. Given the significant resources (in time and money) required to carry out a standard repair to the engine block, as well as the need to return the locomotive to service because of increased traffic, the repair was performed using a non-standard and less costly method. This method involved the use of a polymeric material that lacked the required strength and durability.

This material eventually began to fail, leading to problems in the cam bearing area and, ultimately, to inadequate lubrication of the valves. The valve failure was not immediate, and the locomotive continued operating, but with increased engine oil consumption. As this slight increase was not unusual for an old locomotive, the underlying cause of this condition went undetected.

As the condition worsened, the engine began to surge, which was reported during the previous trip by another LE, and again by the accident LE when departing Farnham. Despite these reports, MMA did not immediately address the situation, either by removing the locomotive from service or by taking it out of the lead position. ^{Footnote 135}

As the train worked up the grade toward Nantes, oil that was flowing from the damaged cylinder into the intake and exhaust manifold began to accumulate in the body of the turbocharger. There, it became superheated, creating the excessive black and white smoke observed by the LE.

The LE secured the train at Nantes and shut down all of the locomotives except the lead locomotive, including those with an auto-start system. The LE then had a discussion with the Bangor RTC, which did not resolve the situation. Despite MMA's safety rule regarding actions to be taken in the event of abnormal engine conditions, as well as the observed excessive smoke and significant mechanical problems, it was decided that no immediate remedial action was necessary. It was agreed that MMA 5017 would be assessed in the morning to address the engine performance issue, and the lead locomotive was left running.

Shortly after the LE departed by taxi for the hotel, the oil that had accumulated and superheated in the turbocharger caught fire. Neither the LE from MMA-001 or the LE from MMA-002 was called to return to Nantes, due to the impact that it would have on train departure time the following morning and due to mandatory rest provisions. Having to perform a No. 1 brake test the next morning may have been an inconvenience, but avoiding inconvenience was not a sufficient reason to bring the LE back to start another locomotive that night. Because another locomotive was not started, the pressure in the train's independent brakes was not maintained.

The RTC, who had experience securing trains at Nantes, was aware that no locomotive was left running. However, he knew that train securement should not be dependent on a running locomotive, and assumed that the train had been adequately secured with sufficient hand brakes. Without a compelling cue to the contrary, the RTC did not consider that shutting down the locomotives would affect the securement of the train.

2.5 Train movement and defences against runaways

MMA-002 began to run away when the retarding brake force from the locomotives' independent brakes was reduced to a level that, combined with the force of the hand brakes, was insufficient to hold the train on a 0.92% grade.

The hand brakes applied by the LE were providing only about 48 600 pounds (1/3) of the approximate 146 700 pounds of retarding brake force^{Footnote 136} required to hold the train (based on the grade of the track, the weight of the train, and the estimated rolling resistance). However, the train was initially secured effectively because the independent brakes, which are quite powerful, were providing an additional 215 500 pounds of retarding brake force, for a total of 264 100 pounds.

Air brake systems are designed to prevent automatic brake applications that might arise from normal fluctuations in air flow. In this accident, once the lead locomotive was shut down, the average rate of air leakage was approximately 1 psi per minute. Although somewhat excessive, this rate was still within industry norms and less than what was required to activate the air brake control valves (approximately 3 psi per minute). No automatic brake application was therefore triggered. Had this automatic brake application occurred, it likely would have been sufficient to hold the train until morning.^{Footnote 137}

The critical threshold was reached approximately 1 hour after the lead locomotive was shut down, when the brake cylinder pressure dropped to 27 psi. At that point, the independent brake force was reduced to 97 400 pounds, reducing the total retarding brake force (including the hand brakes) to just 146 000 pounds. The train began to roll downhill.

In the rail industry, there are a number of physical and administrative defences to prevent runaways, including where and how trains are parked, crew transfers, derails and chocking devices, mechanical emergency devices, and electronically controlled pneumatic (ECP) brakes. The following measures are also available on most trains, including MMA-002:

• Reset safety control (RSC): Usually, an RSC is expected to initiate a penalty brake application when the rear electrical panel breakers are opened. However, no such penalty brake application occurred on MMA-002 because of the manner in which the device was wired. Although there is no standard way to wire an RSC, had a penalty brake application occurred when the power was shut down, the train would likely have remained safely secured.
• Auto-start system: One of the benefits of an auto-start system is that it will restart a locomotive when the brake cylinder pressure drops below a certain level, thereby maintaining the integrity of the independent brakes. In this accident, the LE did not have detailed knowledge of the auto-start system and was not aware of MMA's instruction to leave locomotives with an auto-start system running. Therefore, when the 2 locomotives equipped with the auto-start system were shut down, their pressure-maintaining capabilities were nullified. Sometime later, when the lead locomotive was also shut down, there was nothing maintaining the brake cylinder pressure, and it began to drop.
• Application of the automatic brakes: While MMA instructions did not allow the automatic brakes to be set following a proper hand brake effectiveness test, doing so would have acted as a temporary secondary defence, one that likely would have kept the train secured, even after the eventual release of the independent brakes.

Ultimately, none of these defences were used, and some were nullified by design or human intervention. Thus, they were unavailable to prevent the runaway. If equipment is left unattended without additional physical safety defences, there is an increased risk that it will run away leading to an accident.

2.6 Derailment

2.6.1 Point of derailment and derailment sequence

The train derailed near the Megantic West turnout as it negotiated the curve at 65 mph, which is more than 3 times the balanced speed of the track. The results of a dynamic simulation showed that in the body of the curve, where centrifugal forces would have been at their highest, the cars would have generated excessive lateral forces on the high rail and experienced complete wheel unloading on the low rail. Therefore, speed was the major contributing factor in the derailment.

Previously at this location, work had been performed to improve the geometry conditions recorded in 2012. However, without the use of mechanized equipment, the improvements were temporary; therefore, similar geometry conditions were likely present the day of the accident. The simulation showed that these conditions, although acceptable for 15-mph movements, would have exacerbated the effect of the centrifugal force and further destabilized the passing cars. Although the locomotives were able to negotiate the curve at about 65 mph without derailing, the tank cars—due to their rigidity and relatively high centre of gravity—could not.

The general trajectory of the derailed equipment also confirmed that the point of derailment (POD) was at or near the Megantic West turnout. To determine which cars were most likely the first to derail, the TSB analyzed LER information to establish the locations of the cars when the brake pipe pressure dropped to zero, as this indicated the moment of separation caused by the derailed equipment. Results show that tank cars 4 through 6 were closest to the POD at that time (Photo 29).

An examination of the damage and of the final resting locations of the first derailed cars, starting from the front of the train, allowed the investigation to conclude that the derailment most likely occurred ahead of the sixth tank car.

It was determined that the knuckle on the leading end of the buffer car failed in torsion. The failure characteristics of the knuckle indicated that the buffer car was rolling toward the north when the knuckle failed. The marks on the trailing end of the buffer car indicated that the cars behind it derailed first, overturning the buffer car. The buffer car was relatively lightweight and was not severely damaged. It came to rest with its trucks still attached, and its wheel sets either with the trucks or located nearby. Its post-derailment condition and location close to the main track indicated that it did not travel an extended distance on its side.

The first tank car on the train came to rest on its side, with its trucks still attached. Its leading end was immediately next to the buffer car close to the main track, indicating that it had travelled toward that location when coupled to the buffer car. Two large pieces of rail ran through the car (1 through the head and 1 through the body bolster). The location of the rail through the body bolster indicated that the car was on its side when this occurred. Because the rails of the main track and of yard track 2 were relatively intact, these rails were likely picked up from the damaged yard track 1. Marks on the car draft gear indicated that the tank had rolled toward the north while coupled.

The draft gears of the second tank car indicated that it had been subjected to a torsional force from the third tank car. The second tank car most likely derailed after the third tank car and took the first tank car with it. The tank of the third tank car had rotated to the north relative to its draft system. The fourth tank car showed little sign of tank car rotation relative to its draft system; however, the lateral deformation of its stub sills indicated that its leading end had been derailed to the north. The fifth tank car was the only one of the first cars that had a broken coupler shank, and the damage to the bottom of the car's leading striker indicated that the coupler was exerting excessive force in that direction. Both the fourth and fifth cars showed more physical signs of overall damage than the first 3 cars, suggesting that they quickly lost their wheel sets.

The sixth and seventh cars showed little rotation of the coupler or draft sill components; however, both had extensive damage to the bottoms of the cars and significant denting of their heads or shells. This indicated that they came into contact with previously derailed equipment. Their trajectory, consistent with a tangent direction starting near the POD, indicated that the track was already destroyed at the time of their derailment. It is therefore most likely that the derailment occurred ahead of the sixth tank car.

2.6.2 Separation of the locomotive consist during the derailment

During the runaway and subsequent derailment, the locomotive consist separated into 2 sections at the same moment that (or just before) the consist separated from the rest of the train. The first section was comprised of MMA 5017, VB 1, and MMA 5026, and the second section was comprised of CITX 3053, MMA 5023, and CEFX 3166.

According to the LER, 1 sudden deceleration was recorded—the moment of derailment—at which point the brake pipe pressure dropped to zero.

Lab testing indicated that the knuckle that broke between locomotives MMA 5026 and CITX 3053 failed in tension, likely due to a pre-existing defect. As such, less tensile force would have been required to break it.

The second separation—due to a broken knuckle between the last locomotive (CEFX 3166) and the buffer car—occurred when the buffer car overturned. This failure occurred at the same moment as the initial separation or shortly thereafter; had it happened earlier, the LER would have recorded 2 notable decelerations instead of just 1. Moreover, both sections crossed de la Gare Street separated by 104 feet, and given the train speed (approximately 90 feet per second), that indicated that they were traveling just over 1 second apart.

The 2 sections of the locomotive consist then travelled an additional 4400 feet through Lac-Mégantic, eventually stopping approximately 475 feet apart. The first section came to rest on an approximately 1% grade, where it remained for about 90 minutes. As the independent brakes were no longer providing any retarding force, and the hand brake on MMA 5026 was defective, the first section was held only by the hand brakes on MMA 5017 and the VB car. This location was identified by the presence on the ground of the same black oily residue found on the ground at Nantes, where the engine fire had been extinguished. However, once the wheels and brake shoes sufficiently cooled, the first section began to move backwards, down the grade toward the downtown, due to the residual lessening of hand brake retarding force. It was travelling at about 8 mph when it collided with the stationary second section. Both sections then moved backwards for approximately 100 feet before coming to a final stop, and were held mainly by the retarding force from the hand brakes on the second section.

After the accident, MMA employees found the locomotive consist almost 1 mile east of the derailment site, and tightened the hand brakes on all 5 locomotives and the VB car. A hand brake that can be tightened is indicative of slack in the system; this slack was likely due to brake shoe wear from the uncontrolled movement.

Examination of the locomotive wheels also indicated that less than half of the wheels subjected to hand brake force showed full tread blueing or excessive brake shoe lining wear. This meant that several of the hand brakes had either not been applied securely, or could not have been applied securely, and confirms that the independent brakes had been providing most of the retarding force to hold the train on the grade at Nantes.

2.7 Class 111 tank cars

2.7.1 Stub sills and couplers

Almost every derailed tank car exhibited at least 1 damaged stub sill or coupler, and most were damaged on both ends. The last 2 derailed tank cars had significant impact damage to their stub sills and couplers. The damage was consistent with the generally severe impacts in this derailment.

Nine derailed tank cars exhibited separations at the stub sill attachments. One tank car separated at the fillet weld between the front sill pad and the tank, breaching the tank in 2 locations. This type of failure was present in a 2009 accident in Cherry Valley, Illinois, and resulted in U.S. National Transportation Safety Board (NTSB) Recommendation R-12-9.

2.7.2 Tank heads and shells

Damaged tank heads and shells were a major source of product loss. Fifty-nine of the 63 derailed tank cars exhibited some form of impact damage (denting or breach) to the heads or shells.

The majority of the tank cars exhibited impact damage (denting or breach) on the top portion of at least 1 head. This is not unexpected, as most of these cars came to rest on their sides, thereby bringing the top portion of the heads closer to the ground and increasing the probability of impacts with objects such as rail, couplers, and body bolsters. A full-head shield would have been beneficial, as half-head shields protect only the bottom portion of the head.

Almost 60% of the tank cars had a breached shell due to impact damage, and more than half of these breaches were of a size commensurate with the car's diameter, which would have caused an almost instantaneous release of the entire car's lading (Photo 30).

About half of the cars with large breaches were clustered toward the end of the derailment. These cars would have encountered more severe derailment conditions than the conditions experienced by the cars located toward the front of the train, due to the large pileup ahead of them. This pileup likely acted as a wall for the cars derailing toward the end of the train. These highly constrained derailment conditions caused large-scale buckling and extreme tank deformations (that is, plastic collapse), which resulted in large shell ruptures. These cars derailed at a slower speed, and came to rest perpendicular to the track. Their thin wall construction (7/16 inch), as well as the absence of jackets, did not provide sufficient protection from the derailment forces. Consequently, large tank shell breaches occurred in a short period of time on about 1/3 of the derailed tank cars, which resulted in the rapid release of large quantities of petroleum crude oil.

2.7.3 Protection of tank car fittings

With the majority of the tank cars coming to rest on their sides or upside down, the petroleum crude oil flowed from a number of damaged top fittings and fed the pool fire. Top fittings that were located within a housing that provided top discontinuity protection fared better than the top fittings that were not protected. Approximately 15% of the cars with impact-damaged top discontinuity protection housings had breached top fittings, whereas 62% of the cars with impact-damaged hinged housings had breached top fittings.

In addition, pressure relief device (PRD) survivability improved significantly when the fittings were located within a protective housing. About half of the PRDs were so protected, and only 9% of these exhibited release of product from impact damage. In the case of the unprotected PRDs, 29% exhibited impact damage resulting in product release. This comparison demonstrates that top discontinuity protection is effective in reducing the release of product from impact-damaged top fittings (including PRDs).

Examination of the derailed tank cars highlighted the need for a better bottom outlet valve (BOV) design, specifically with respect to ball valves equipped with handles. In most cases, the bottom outlet skid protection worked as intended, as the nozzles sheared off where designed (shear plane). However, some of the ball valves (7) opened due to handles being moved during the derailment. On cars equipped with an internal self-closing plug-style BOV, the valve's location inside the tank protected it from sliding damage, and the self-closing feature resulted in fewer valves being opened. Self-closing plug-style valves seem to perform better than external ball valves in preventing product loss during derailments.

Given that tank cars are prone to rollover in a derailment (due to their cylindrical shape), the need for enhanced protection of their fittings and valves is heightened. In this derailment, the high number of damaged unprotected top fittings, as well as the number of external ball valves that were opened, demonstrate the need for additional safety improvements in these areas. Without adequate top-fitting protection during a rollover, and without design improvements to BOVs, there is an increased risk of product release when general-service Class 111 cars are involved in derailments. If Class 111 tank cars that do not meet enhanced protection standards transport flammable liquids, there is an ongoing risk of product loss and significant damage to persons, property, and the environment when these cars are involved in accidents.

2.7.4 Thermal tears and fire damage

As no fragments of tank material were projected away from the tank cars, none experienced a BLEVE.^{Footnote 138}

There was no indication that the type of PRD on the cars that sustained thermal tears contributed to these tears. However, when some tank cars rolled over during the accident, their PRDs became located in the liquid space, reducing their ability to effectively relieve internal pressure. In the case of tank cars equipped with PRDs with low start-to-discharge (STD) pressure and high flow capacity, more vapours will vent faster, thereby reducing the risk of tank cars building up excessive internal pressure in a fire.

One of the tank cars that sustained a thermal tear came to rest adjacent to another car that did not sustain this type of tear. As these cars were both exposed to similar fire conditions, this configuration suggests that they experienced only a small difference in temperature and internal pressure. Therefore, a relatively modest improvement in fire survivability may prevent thermal tears. Thicker steel, jackets and thermal protection on tank cars, combined with adequate pressure-relief capacity, can significantly extend the time that these cars can survive in a pool fire. These features would also have helped better protect the 13 cars that lost product due to burn-throughs.

2.7.5 Post-accident identification of tank cars

The extent of the fire made identification of some cars difficult because car markings were illegible. This meant that the cars had to be identified by their identification plates or stampings. However, some of the cars' identification plates were secured with aluminum fasteners that were consumed in the fire or melted, resulting in identification plates falling off the cars. Also, some of these stampings were light and, when oxidized after the fire, were difficult to read. If cars are missing identification plates and have illegible stampings, severely damaged cars may not be correctly identified in a timely manner.

2.7.6 Tank car: General

The derailed tank cars were subjected to a range of impact speeds and forces depending on their position in the train. Even though some 15% of the tank cars derailed at estimated speeds of 40 mph or less, which are typical speeds for freight trains, these tank cars still experienced significant tank shell and head damage, as well as product loss.

The amount of product released could have been reduced had the tank car shells and heads been more impact-resistant. Specifically, tank cars built with thicker steel, full-head shields and tank jackets would have been better protected. In this accident, all but 4 of the 63 derailed Class 111 tank cars lost product from head or shell breaches, or through damaged valves and fittings.

This failure rate again demonstrates the poor performance in derailments of general-service Class 111 tank cars that are built to minimum requirements, and highlights the inability of these tank cars to withstand accident forces. Commodities posing significant risk must be shipped in safe containers, which include defences such as stronger tank shells, tank car jackets, full-height head shields, thermal protection, and high-capacity PRDs.

2.8 Dangerous goods

2.8.1 Properties of petroleum crude oil

The laboratory analysis of the petroleum crude oil samples determined that the product's properties were consistent with those of a light, sweet crude oil, with volatility comparable to that of gasoline. Given that the samples were taken at atmospheric pressure, the volatility of the crude oil may have been higher than measured at the time of the analysis. This is because some light hydrocarbons may have evaporated when the tank cars were opened for the first time to collect the samples.

The low flashpoint of the petroleum crude oil explains in part why it ignited so quickly once the tank cars were breached. The large quantities of spilled product, the rapid rate of release of the product, as well as the product's high volatility and low viscosity were the major contributors to the large post-derailment fireballs and pool fire.

2.8.2 Safety data sheets

The purpose of a safety data sheet (SDS) is to communicate the dangers of hazardous chemicals; it is therefore critically important that the information contained in these documents be accurate. For naturally occurring substances, such as petroleum crude oil, the preparation of generic representative SDSs for a range of products with similar characteristics was permitted by U.S. and Canadian legislation.

In this accident, each petroleum crude oil supplier provided a different SDS characterizing its product. However, the information in each SDS was inconsistent and sometimes contradictory. There was no systematic method of verifying or reconciling the information contained in the different SDSs; these inconsistencies and contradictions were not picked up, and corrective action was not initiated.

The safety of personnel who handle or come in contact with hazardous chemicals is largely dependent on an accurate characterization of the hazards of the substances. Therefore, when an SDS contains inaccurate information on the properties of the product or family of products, the usefulness of the SDS for communicating the dangers of the product is compromised, increasing the risks of injury.

In addition, the usefulness of SDSs alone for the purpose of product classification is limited in cases where products from different sources are blended together when loaded in large bulk containers.

2.8.3 Testing and classification of dangerous goods

An accurate characterization of the properties of a dangerous good is critical to ensuring its proper classification. This classification is required by federal regulations, and allows the dangerous good to be packaged in the appropriate container, as well as allowing for the proper equipment and procedures to be used when handling, loading, and unloading dangerous goods. The packing group (PG) is an integral part of the classification of Class 3 flammable liquids. It is dependent on determination of the product's flashpoint and initial boiling point through testing of representative samples. A system must be in place to determine, and then consistently validate, the classification of the product being offered for transport.

In this accident, the shipping documents for the majority of the cargo tank trucks used to transport the petroleum crude oil to the rail loading facility in New Town, North Dakota, correctly identified the product as PG II. However, this classification was not due to testing, but rather to a practice of considering crude oil from the Bakken region as PG II.

Although monthly tests on collected composite samples were being performed at the rail loading facility, these tests were not being carried out for product classification. Furthermore, the PG information in the rail cars' shipping documents was not reconciled with the corresponding information in the documents for the cargo tank trucks. Had this been done, the discrepancy could have been detected.

When the oil reached Irving's refinery in Saint John, New Brunswick, samples were collected and tests were performed, but mainly for operational reasons. There was neither determination nor verification of the product's initial boiling point and flashpoint, nor were these required or part of Irving's operational needs. Irving relied on its suppliers for proper classification of imported dangerous goods, as permitted by the Transportation of Dangerous Goods Regulations (TDG Regulations).

As a result, the petroleum crude oil being transported by the train was improperly classified, and remained that way throughout the transportation cycle. The product was assigned a PG III classification (lowest hazard), despite meeting the criteria for PG II. Therefore, its hazards were not correctly identified.

Moreover, as crude oil loaded in large bulk containers includes products from a variety of sources, the characteristics of the resultant blend may vary. If systematic testing is not conducted on representative samples of petroleum crude oil at an appropriate frequency, there is an increased risk that these dangerous goods will be improperly classified.

When improperly classified and documented, dangerous goods may be moved and handled incorrectly, increasing the risk of injury to people, and of damage to property and the environment.

While proper classification of the petroleum crude oil would have allowed the railways to identify the true hazards of the product they were transporting, it is not known what effects (if any) this identification may have had on MMA's operating plans.

The incorrect classification did not result in the selection of an unauthorized container to package and transport the product. Federal regulations in effect at the time of the accident did not mandate the use of enhanced Class 111 tank cars similarly to the standards that the industry adopted on a voluntary basis in 2011 for transportation of petroleum crude oil in PG I and II. Furthermore, given that all of the tank cars involved in this accident were ordered before the effective date of that voluntary standard, none were covered by these industry provisions.

2.8.4 Transportation of dangerous goods monitoring

Between 2009 and 2013, TC's Transportation of Dangerous Goods (TDG) Directorate performed over 11 000 inspections throughout Canada, which resulted in the issuance of 99 notices of infractions, 96 detention orders, and 76 directions, as well as the initiation of 14 prosecutions.

In 2011, the TDG Directorate identified the rapid increase in the transportation by rail of petroleum crude oil as an emerging issue requiring greater regulatory oversight. As a result, the TDG Directorate started inspecting petroleum crude oil transloading facilities, focusing on specific areas of regulatory compliance in facility operations, such as tank car loading and securement practices. However, these inspections did not include verification of the classification of the petroleum crude oil being handled, offered for transport, transported, or imported. Such verifications would have included a review of company classification procedures to ensure that dangerous goods are being classified based on the appropriate tests. Without monitoring and effective enforcement of compliance with applicable classification provisions in the TDG Regulations, there is a risk that improperly classified dangerous goods will enter the transportation system.

2.9 Emergency response

The pileup of cars, combined with the large volume of petroleum crude oil on fire, made the firefighters' job extremely difficult. The 911 calls were received and responded to promptly, and the incident response protocols for response escalation worked as designed.

The firefighters were facing a major disaster involving a rail accident; this type of disaster was not specifically covered by their practical training. Nevertheless, the large emergency response was well coordinated, and the prompt assistance of other fire departments in the province and from the State of Maine was critical in the provision of adequate human resources and standard emergency-response equipment. The various fire departments were able to effectively coordinate their efforts and implement appropriate measures to protect the site, as well as ensure public safety after the derailment. The evacuations were conducted in a prompt and efficient manner. Despite the challenges of responding to a major disaster not specifically covered by many firefighters' practical training, the emergency response was conducted in a well coordinated and effective manner.

2.10 Emergency response assistance plan

When the TDG Regulations were amended in 2008 to extend emergency response assistance plan (ERAP) requirements to include 3 additional flammable liquids, petroleum crude oil was not considered. At that time, the volume of petroleum crude oil transported by unit trains was not significant.

However, there has been a considerable increase in the shipment of petroleum crude oil by rail in the last 5 years, and it is projected to continue growing significantly in the coming decades. This increase is particularly true for crude oil from the Bakken field. Unit trains will continue to carry large volumes of petroleum crude oil over long distances and through populated areas. The large increase in the frequency of these unit trains, combined with the volumes of product transported by each train, have significantly increased the risks. One of the elements of an adequate defence system against these risks is ensuring that the consequences of any accident can be appropriately mitigated.

The release of dangerous goods transported by rail can jeopardize the health, safety, and welfare of railway employees and of residents living near railway tracks. The risks are even greater in the case of tracks running through urban areas. As demonstrated in this accident, petroleum crude oil can be highly flammable. Firefighters may not always be equipped or trained to handle flammable liquid spills and fires of this magnitude. If the shipper has not developed an adequate, regulator-approved ERAP, the required resources to assist local responders may not be available in the event of an accident involving large quantities of liquid hydrocarbons.

2.11 Route planning and analysis

A primary safety concern related to the transportation of dangerous goods by rail is prevention of a catastrophic release in a densely populated or environmentally sensitive area. Route planning for the transportation of dangerous goods identifies the route with the lowest overall risks to the public. Some railways have multiple lines servicing major centres, or pre-arranged running-right agreements with other carriers. Others railways offer logistical services, providing integrated transportation services from origin to destination. Route planning must cover the entire route, including any connecting railways that may form part of the transportation service. Each route needs to be evaluated to ensure that the safest route is chosen (Figure 8).

Once the safest route is selected, the risk of carrying dangerous commodities can be reduced by proactively examining all aspects of operations over the entire route to ensure that the identified risks are adequately mitigated. The measures included in Circular OT-55-N, such as restricting key trains to a maximum speed of 50 mph and requiring additional inspections on key routes, can reduce the risk when transporting dangerous goods. However, the level of mitigation provided by Circular OT‑55‑N may not be sufficient; as demonstrated in this accident, many tank cars that derailed, travelling at speeds below 50 mph, were heavily damaged and had severe loss of crude oil.

Once adequate mitigating measures are in place, periodic risk assessments will help ensure the continued safe movement of dangerous goods. If route planning, analysis, and follow-up risk assessments are not conducted by railways along routes where dangerous goods are carried, comprehensive safety measures to mitigate the risks may not be introduced.

2.12 Single-person train operations at Montreal, Maine & Atlantic Railway

Some railways have argued that there are potential safety benefits to single-person train operations (SPTO), such as increased attentiveness by the lone operator because of the absence of a second crew member on whom to rely. It is also said that there are fewer distractions from extraneous conversations. Although most of the benefits of joint compliance are lost when operating as a single person, some benefits can still be achieved by confirming critical actions with another person (e.g., the RTC), albeit remotely.

However, there are also demonstrated risks to SPTO, including reduced joint compliance (which can help catch errors), a tendency to take shortcuts, additional physical and time-related requirements for a single person to perform tasks, the possibility that individuals working alone will be subject to fatigue and cognitive degradations, and the need for additional training to properly prepare LEs to work alone. It is also important to consider how a single operator might deal with the abnormal conditions that may arise, as well as whether all safety-critical tasks (such as the application of hand brakes and the performance of a hand brake effectiveness test) can be performed in a reasonable amount of time.

Following the 1996 Quebec North Shore and Labrador Railway (QNS&L) accident, in which SPTO was found to be contributory, TC facilitated the creation of a consensus-based working group. This group required all key stakeholders (including management and employees) to collaborate in crafting clear operating conditions that would ensure safety levels equivalent to those of multi-person operations. Under the 2008 changes to the CROR, MMA was not required to adopt these conditions, but rather worked with TC to develop customized conditions applicable to its operations.

After the QNS&L accident, although TC suggested that the Railway Association of Canada (RAC) develop new rules pertaining to SPTO within the CROR, TC did not order the RAC to do so. In 2000, the RAC adopted internal SPTO guidelines based on the principles of risk assessment, mitigation, and monitoring. These guidelines stipulated that member railways had to develop a monitoring program to measure the safety performance of its SPTO, and that TC had to be provided with a description of this program. In 2012, a National Research Council (NRC) study, sponsored by TC, made several recommendations, including the creation of a 2-year pilot project with detailed monitoring and evaluation. However, none of these guidelines and recommendations were binding.

Following the 2008 revision of the CROR, railways no longer needed exemptions to implement SPTO. As a result, there were no rules preventing operations with 1-person crews, nor a mandatory requirement to have plans reviewed and approved in advance by TC. Consequently, there was no longer a requirement to directly involve TC in the process of implementing SPTO.

In July 2009, MMA indicated to TC that SPTO between the Maine–Quebec border and Lac-Mégantic represented a “test-bed”, which could be expanded upon successful implementation. Prior to MMA's implementation of SPTO in 2010 (east of Lac-Mégantic) and 2012 (Farnham to Lac-Mégantic), TC insisted that risk assessments be completed. These risk assessments, which were reviewed by TC, identified several risks and mitigation measures, with a focus on trains in movement (given that, in the past, this aspect had represented the greatest concern). As securement was covered by both CROR 112 and MMA's own instructions, the risk assessments did not identify single-person train securement as a risk.

Subsequently, between April 2011 and June 2012, TC engaged MMA through meetings, site visits, and correspondence to ensure that a substantial review was performed by the company, including meetings with municipalities. To allay TC's concerns, MMA cited its previous experience with SPTO in the U.S., as well as its SPTO experience east of Lac-Mégantic. Contrary to the RAC guidelines, MMA had no plan to further monitor and evaluate SPTO beyond its normal supervisory activity.

Meanwhile, TC—despite concerns of its regional inspectors and without detailed SPTO monitoring and evaluation, as recommended by its own study—did not follow up to verify that the mitigation measures identified in MMA's risk assessment had been implemented and were effective.

MMA's SPTO risk assessment identified mitigation measures, such as informing local authorities of single-person operations, instituting a procedure for a single operator to take control of an unattended train, allowing an LE to stop a train for a 20-minute nap, and requiring an LE to contact the RTC once every 30 minutes. However, contrary to what MMA had proposed, there was very limited SPTO training. The SPTO training did not include a review of securement rules and instructions. Furthermore, no job task analysis was discussed with employees, nor were all of the potential hazards associated with the tasks identified, notably the risks associated with single-operator train securement at the end of a shift. Consequently, no mitigation measure was identified for this critical task, such as confirming with an RTC how a train was secured, or even questioning the practice of leaving a train on the main track in Nantes when securement relied on a single operator. Finally, MMA did not conduct a single OTIS inspection to verify SPTO train securement in Nantes.

In some countries, regulators consider a company's ability to execute its plan before granting authority to implement SPTO. Others require the operator to be accredited, and narrowly circumscribe its SPTO program to the territory and type of application, with all changes requiring pre-approval by the regulator. The experience in operations around the world shows that SPTO can be done safely when risks are identified, and when technologies and processes are put in place to ensure the physical and cognitive risks inherent to 1-person operations are effectively and reliably mitigated.

Despite concern over MMA's elevated risk profile, and knowledge of the weaknesses in its risk assessment process (as documented in audits going back to 2003), TC did not require MMA to use processes and technological advancements to mitigate the risks of operating with 1 less crew member.

The investigation carefully examined whether SPTO played a role in the securement of the train at Nantes, and whether SPTO influenced how the abnormal condition of the locomotive was addressed.

With respect to train securement, TSB testing showed that it was possible for a single operator to apply a sufficient number of hand brakes within a reasonable amount of time. A TSB survey also determined that there were instances when MMA LEs working as single operators applied less than the minimum number of hand brakes. The minimum hand brake requirement was more consistently met when trains were operated by 2 crew members. On the basis of this survey, it cannot be concluded how many more (if any) hand brakes would have been applied had the LE been paired with a conductor. Furthermore, even if the LE had applied the minimum number of hand brakes required by MMA's General Special Instructions (GSIs) (9, based on the “10% plus 2” chart), TSB testing showed that this number would not have provided sufficient retarding force to hold the train once the air pressure in the independent brake system was reduced. Moreover, since the LE did not perform the hand brake effectiveness test properly, he likely would not have recognized the need for additional hand brakes, even with the presence of a second crew member.

Given that the conductor and LE operate as an integrated team, contributing knowledge and providing backup for each other as necessary, the TSB considered whether the presence of a second crew member could have influenced how the abnormal engine condition was handled. Although fatigue was not considered to be a contributing factor in this accident, after having been awake for more than 17 hours, there may have been a slight degradation of the LE's cognitive performance, which would have affected his ability to solve the issue surrounding the source of the excessive smoke. When discussing the engine's abnormal condition with the Bangor RTC, the LE sought a second opinion, which is an example of joint compliance. However, the LE presented the situation in a manner that suggested it would settle down and that no further action was required that night. The pair did not discuss the MMA procedure requiring that a locomotive be shut down due to abnormal smoke, and the only person to question the decision to leave the locomotive was the taxi driver, whose comments did not carry the same weight as a qualified railway employee. It is therefore not possible to conclude whether the presence of another crew member would have resulted in different actions that night (either shutting down the lead locomotive and starting another, or putting another locomotive in the lead and keeping it running).

On the whole, it could not be concluded whether SPTO contributed to the incorrect securement of the train or to the decision to leave the locomotive running at Nantes despite its abnormal condition. However, it is clear that MMA's implementation of SPTO did not address all critical risks, specifically how a single operator might deal with any abnormal conditions, the risks of single-person securement, or the need for joint compliance. Moreover, TC did not develop an oversight plan to ensure that MMA implemented SPTO in accordance with MMA's risk assessment. Despite being aware of significant operational changes at MMA, TC did not provide adequate regulatory oversight to ensure that the associated risks were addressed.

The number of required crew members is related to the tasks that must be performed to accomplish the work safely and efficiently. To ensure an equivalent level of safety is maintained when reducing the number of crew members, railways must analyze the impact of the reduction on the activities to be performed and determine what, if any, new risks may be introduced. Mitigation measures can then be put in place, followed by subsequent monitoring to assess their effectiveness.

If railways implement SPTO without identifying all risks, and if mitigation measures are not implemented, an equivalent level of safety to that of multi-person crews will not be maintained. Moreover, if there are no rules and regulations for SPTO, nor a requirement for TC to approve and monitor railways' plans for SPTO, then single-person trains may operate without all of the necessary defences in place.

2.13 Montreal, Maine & Atlantic Railway operations

2.13.1 Additional defences against runaways

Workers will sometimes deviate from written rules and procedures, either because they do not know the rule or procedure or do not understand its purpose, or to accomplish the work more efficiently. When there are no negative consequences, these employee adaptations can persist and become widespread. In doing so, this way of working becomes normalized and can erode the safety margins that the rules and procedures were intended to provide.

The practice of leaving trains unattended on the main track had been in place for several months at MMA. This decision was based on convenience and efficiency, given crew scheduling, the length of the trains, and the need to avoid blocking crossings in the town. At Nantes, leaving the train on the main track clear of the east switch allowed access to the siding where cars were stored. However, as the siding was equipped with a special derail, this practice resulted in a potential safety device not being used. Since leaving a train on the main track was not prohibited by regulation, it was not questioned by TC inspectors. Further, it had not resulted in any adverse consequence, and so MMA's management did not examine the practice.

The concept of “defence in depth” is one that has been adopted by some industries for many years. Layers of defences, or safety redundancy, have proven successful in ensuring that a single-point failure does not lead to catastrophic consequences. In the rail industry, physical defences can be used as additional defences to prevent runaways. These additional defences were not used by MMA, nor were they required by regulation. This risk was never assessed or addressed, and no additional physical safety defences were put in place to prevent the uncontrolled movement of trains left unattended on the main track.

2.13.2 Excessive rail wear

There was excessive rail wear (that is, exceeding the vertical wear limits in MMA's and other Class 1 railway standards) on some rail in the Lac-Mégantic area. Rail wear results in an increase in stresses and reduces rail fatigue life. Consequently, worn rail will become more susceptible to development and spread of cracks leading to rail breaks, thereby increasing the risk of derailment. Poor rail conditions, such as wear beyond limits, battered rail joints, and crushed head, were identified by TC during its many engineering inspections (53), resulting in a letter of concern being issued in the year prior to the accident.

If head wear exceeds 8 mm on 115-pound rail, standard joint bars can be struck by the wheel flanges of passing trains. This results in high impacts to wheels and rails, and can also increase the risk of derailment. The risk is elevated when wheel profiles have increased flange heights, or when new rail joint bars are applied to head-worn rail. Due to the extent of the vertical rail wear (as much as 25 mm in 1 location), impact marks were clearly visible on some rail joint bars during the TSB investigation; however, they had not been identified previously by MMA or TC inspections, nor had corrective action been taken. The application of maximum vertical rail wear limits and the use of high-clearance joint bars are intended to prevent such high impact forces, but these types of joint bars were not in use in MMA's track maintenance program.

Rail wear was normally accurately measured by the track geometry car used by MMA; however, due to the rail head's severely worn and deformed condition, a correct profile was not recorded. The condition of the rail (for example, whether there are shells, spalls, and corrugation) when conducting such inspections must also be taken into consideration. Therefore, although track geometry inspections were performed by MMA and TC, the excessive rail head wear was not identified, and maintenance crews were not being alerted to the severity of the wear. If poor rail and joint conditions are not addressed, there are increased stresses on wheels and rails, which may lead to damaged equipment or infrastructure, thus increasing the risk of derailment.

2.13.3 Safety management

All organizations must manage competing priorities; key among these priorities are safety, service, cost-effectiveness, technology, and return on investment. The challenge is to balance these priorities, while still reducing safety risks to an acceptable level. To do this, it is important that railways have the necessary safety processes in place to continually identify and mitigate the hazards and risks that may arise.

In 2001, TC developed regulations to further promote safety and to ensure that companies have a minimum standard for safety processes. Railways are required to implement and maintain an SMS that integrates safety in day-to-day operations, and that enables the company to find risks and take action before those risks lead to an accident. A well-implemented and actively used SMS promotes a highly-effective safety culture.

Although MMA had certain safety processes in place and had developed an SMS in 2002, the company did not begin implementing the program until 2010, and did so only in reaction to a TC audit. By 2013, many of the processes outlined in MMA's SMS manual were not contributing to the identification of hazards and mitigation of risks. For example, the company's toll-free number for reporting safety concerns was not being used.

There were 4 crucial indicators (analyzed in the next section) that MMA did not have a functioning SMS; these were:

• absence of an internal safety auditing process;
• weaknesses in the process for ensuring adequate employee training;
• weaknesses in the OTIS program, which limited its effectiveness in identifying areas of non-compliance; and
• inconsistently used risk assessment processes.

2.13.4 Internal safety auditing

Internal SMS audits play a critical role in the system's continual improvement, by providing the organization with an opportunity to observe whether SMS processes are being used as designed.

Although MMA's SMS manual indicated that a process was in place to conduct internal audits, no detail was provided. On 2 occasions, TC determined that MMA's procedures for conducting internal audits were incomplete. This issue was never resolved, and by the time of the accident, MMA had never conducted an internal audit to assess the effectiveness of its safety management processes.

The lack of internal audits caused other deficiencies in MMA's SMS to remain unidentified and unaddressed, which limited the company's ability to proactively identify hazards and manage risks.

2.13.5 Training and requalification

Rail transportation is a rules-based industry that requires knowledge and understanding of, as well as adherence to, many rules and regulations in order to ensure safe and efficient operations. Employees must therefore receive proper training and testing, as well as adequate requalification testing.

Each railway determines the methods for training and requalification, yet the 3-year time frame for this is mandated by TC. MMA did not consistently comply with this requirement. For example, the company provided the LE with 3-month extensions in both 2009 and 2013, resulting in the LE's requalification training being delayed beyond the 3-year time frame specified by regulation. Furthermore, in 2013, the LE was allowed to complete his exams at home, without classroom training.

Several other problems existed within MMA's training and requalification program for LEs:

• Exams remained relatively unchanged year after year. This meant that MMA was not using the requalification program to address deficiencies identified through monitoring, and rule changes or new operational instructions could not be addressed.
• The increasing use of multiple-choice questions limited the ability of instructors to evaluate comprehension.
• Requalification sometimes consisted of only a written exam, without classroom training; this negated an opportunity for interactive employee-instructor discussions.
• A lack of feedback on exam results meant that employees missed learning opportunities, increasing the risk of potential misunderstanding and subsequent misapplication of rules and instructions.

Although several exams show that the LE correctly answered multiple-choice questions related to the minimum number of hand brakes, these questions were relatively simple, and did not adequately demonstrate the LE's knowledge of the significance and rationale of securement rules. Furthermore, the LE was never tested on the procedures for performing a hand brake effectiveness test, or on the fact that the air brake system must not be depended upon to prevent an undesired movement. There was also an indication that the LE had limited knowledge of MMA's instructions, namely on the use of the auto-start system, and the procedure for QRB valves as well as their significance to the proper operation of a locomotive hand brake.

Therefore, MMA did not provide effective training to ensure crews understood and correctly applied rules governing train securement.

This issue goes beyond the training and requalification of 1 LE. Between 2006 and 2013, inspectors from TC Quebec Region noted numerous instances of improperly qualified employees working in different departments, such as the operations, engineering, and mechanical departments, as well as the rail traffic control centre. In addition, during SPTO implementation, MMA had planned to provide LEs with approximately 4 hours of training, covering rules, instructions, and procedures for SPTO, as well as issues related to working alone, first-aid, and fatigue and lifestyle planning. The actual SPTO training was often significantly abbreviated, and delivered within the hour preceding an operator's first train departure as a 1-person crew.

2.13.6 Rules compliance

In order to promote consistent operating practices, railways must provide clear rules and instructions to employees, and must verify that these rules and instructions are being followed.

Rules and instructions need to be clearly documented, and employees must be kept abreast when changes occur. In addition, employees must have access to the necessary reference materials (rulebooks, supplements, and other documents) while on duty.

The accident LE did not have all of the required documents at the time of the accident. The company was not ensuring that all employees were familiar with new operating bulletins. The company's rules, supplements, and general operating instructions were organized in multiple documents, which made it difficult to refer to these documents and increased the risk of misinterpreting rules.

Clear rules and instructions are only valuable if they are consistently applied in day-to-day operations. MMA's OTIS program sought to verify compliance by observing employees unannounced. For this approach to be effective, employees must be aware that they could be tested at any location and at any time. Unannounced tests must then be performed at a satisfactory frequency across the railway's network, and the employees must be made aware that the tests have been performed, regardless of the results.

This investigation identified a number of weaknesses in MMA's oversight program.

At MMA, employees were only informed of tests if they failed. However, because the failure rate was so low, and because managers did not conduct even the minimum number of tests required, employees were rarely informed of these tests and so remained unaware of the full extent of the program. In addition, testing was performed much less frequently east of Sherbrooke. For example, the LE, who had made 60 trips to Nantes in the previous 12 months, had never been tested on train securement at Nantes during the previous 4 years. He had only been tested either at Sherbrooke or further west.

Moreover, CROR 112 is identified as one of a few rules warranting a minimum number of monthly tests. However, when a Rule 112 test was performed, MMA managers usually only ensured that the required number of hand brakes had been applied (Rule 112[a]). Because of practical difficulties associated with the test, managers seldom checked that a proper hand brake effectiveness test was conducted (Rule 112[b]). Therefore, MMA's oversight of equipment securement rules and procedures did not effectively ensure that crews properly verified that the hand brake retarding force was sufficient to hold a train.

Consequently, MMA's employee oversight program was not effective in identifying the unsafe train-securement practices being used in the Lac-Mégantic area.

2.13.7 Risk assessment

Risk assessments are a cornerstone of a fully functioning and effective SMS, and are essential for a safe operating company. While important for day-to-day operations, risk assessments are particularly crucial when a company makes a change to its operations, since this is when new risks may emerge.

To be effective, a risk assessment process must be conducted for a sufficient range of situations, must encourage the identification of all anticipated hazards, and must ensure that mitigation measures have been effectively implemented. Although MMA had undertaken a few formal risk assessments, most risk-management initiatives were informal and undocumented.

This situation increased the likelihood that not all of the newly emerging risks would be properly assessed when significant operational changes were made. When increasing the number of unit oil trains, company personnel discussed issues surrounding the operation of the larger, heavier trains, such as traction and braking. However, no formal risk assessment was performed, and all of the risks of carrying increasingly more crude oil were neither evaluated nor mitigated.

Similarly, no risk assessment was conducted when the company moved the crew-change location to Nantes and began parking trains unattended on the main track on a descending grade. In this instance, it was believed that a risk assessment was not required, since rules and instructions governing train securement already existed, and trains had occasionally been parked at this location in the past. Securement relied on a single administrative line of defence: a properly conducted hand brake effectiveness test. As a result, this practice, although compliant with regulations, did not reduce risk to a level as low as reasonably practicable.

Finally, when implementing SPTO, the company only performed a formal risk assessment at TC's request. This risk assessment, however, did not address how the task of securing a train, previously performed by a crew of 2, would be completed, since the rules for train securement were already in place. In addition (as described in section 2.13.5), some of the mitigation measures identified in the assessment were not effectively implemented.

These weaknesses in MMA's use of risk assessments meant that, when making significant operational changes on its network, MMA did not thoroughly identify and manage the risks to ensure safe operations.

To help an organization manage risk, the required processes must be in place and used effectively. MMA submitted SMS documentation to TC in 2003 and was found compliant with the regulations. However, MMA's SMS was lacking key processes, and other processes were not being effectively used. As a result, MMA did not have a fully functioning SMS to effectively manage risk.

2.13.8 Safety culture

The 2007 report on the review of the Railway Safety Act (RSA)^{Footnote 139} notes, “The cornerstone of a truly functioning SMS is an effective safety culture.” An effective safety culture in a railway can significantly reduce the number of accidents, and is the basis for an effective safety program. The strength of an organization's safety culture starts at the top, and is characterized by proactive measures to eliminate or mitigate operational risks. MMA was generally reactive in addressing safety issues. Furthermore, there were significant gaps between MMA's operating instructions and how work was actually conducted in day-to-day operations.

There were also other signs in MMA's operations that were indicative of a weak organizational safety culture, such as:

• MMA management's acceptance of rail wear on the main track that was well beyond industry norms and their own track standards;
• MMA management's tolerance of non-standard repairs (for example, to the locomotive engine and the QRB valve), which either subsequently failed, or did not return the parts to their proper operating condition;
• the systemic practice of leaving unattended trains on the main track, and on a descending grade, at Nantes for several hours without in-depth defences to prevent an uncontrolled movement;
• crews and single-person train operators not always correctly applying CROR 112 and MMA's instructions when securing trains at Nantes;
• inadequate company oversight to ensure the correct securement of trains at Nantes;
• MMA's inadequate recertification program and SPTO training that did not ensure that operating crews knew and understood the procedures for train securement;
• the giving of extensions for competency cards by MMA management, in some cases for several months beyond the mandatory limit of 3 years; and
• the fact that only local corrective action resulted from recurring deficiencies identified during TC inspections of MMA track and operations; the systemic issues contributing to these deficiencies were not fully analyzed by MMA, and thus persisted.

If instructions or rules are disregarded, and unsafe conditions and practices are allowed to persist, this leads to an increased acceptance of such situations. Deviations from the norm thus become the norm, and the likelihood of unsafe practices being reported and addressed is reduced. Although educational material about safety culture was provided to railway companies, safety culture was not formally assessed or documented within regulatory inspections or audits. MMA's weak safety culture contributed to the continuation of unsafe conditions and practices, and compromised MMA's ability to effectively manage safety.

2.14 Transport Canada oversight

2.14.1 Regulatory oversight of Montreal, Maine & Atlantic Railway

2.14.1.1 Regulatory inspection program at Montreal, Maine & Atlantic Railway

TC Quebec Region had been inspecting and monitoring MMA's operations, equipment, and infrastructure. For several years, MMA had been identified as a railway company with an elevated level of risk requiring more frequent inspections. Through inspections, TC Quebec Region identified a number of ongoing safety deficiencies requiring safety action. TC Quebec Region issued numerous notices, notices and orders, letters of concern, and letters of non-compliance. Although MMA normally took action after the inspection to address the identified safety deficiency, it was not uncommon for similar deficiencies or risks to be identified in subsequent inspections. The following are examples of such safety deficiencies:

• Problems with train securement were identified on multiple occasions since 2005, and were still present at the time of the accident.
• Between 2006 and the time of the accident, training deficiencies were noted in several functional groups, including the mechanical group, operations and engineering group, and rail traffic control.
• Track condition was noted as an ongoing issue between 2006 and the time of the accident.

TC Quebec Region did not follow up to ensure that recurring safety deficiencies at MMA were effectively analyzed and corrected; consequently, unsafe practices persisted.

Moreover, following MMA's implementation of SPTO, TC's oversight was insufficient in verifying that SPTO had been implemented in a manner consistent with the mitigation measures outlined in MMA's risk assessment.

2.14.1.2 Safety management system audits at Montreal, Maine & Atlantic Railway

TC's guidance material indicates that TC verifies that an operator has an SMS that is documented, employed, and effective in improving safety.^{Footnote 140} While inspections are critical in identifying unsafe conditions, SMS audits are complementary to the inspection process. SMS audits allow the reasons for underlying unsafe conditions to be explored, and for verification that the organization has effective processes in place to identify and mitigate similar conditions in the future.

At MMA, the first SMS audit to assess the effectiveness of the company's safety management processes took place in 2010, which was 7 years after the company was found to be in compliance with the SMS Regulations. During this audit, inspectors were informed that the SMS had not yet been implemented because the company was awaiting regulatory approval. TC then clarified with MMA that TC does not approve a railway's SMS. A second SMS audit was conducted in 2012, and focused on a very limited subset of SMS elements.

Although TC Quebec Region reviewed the corrective action plans provided by MMA as a result of the audits, no specific follow-up was conducted to verify that the corrective action plans had been implemented. TC Quebec Region did not have a procedure in place for conducting such follow-ups. Moreover, no follow-up was conducted during the 2012 audit on the findings of the previous audit, since it was not within the scope of the audit as determined by the convening authority. Therefore, the auditors could not verify that effective corrective action plans had been developed to address previous identified deficiencies.

As a result, many of the deficiencies in MMA's SMS that came to light through the audit process were never resolved. For example, weaknesses in MMA's risk assessment process were identified during TC's pre-audit in 2003. The 2010 audit found that risk assessments were being conducted only for major operational changes. Since that time, very few risk assessments had been conducted, and no documented risk assessments were conducted for the practice of leaving unattended trains on a grade at Nantes.

The absence of an internal audit procedure at MMA was first identified during TC's pre-audit in 2003, and again in the 2010 SMS audit. An internal audit procedure had not been developed, and no internal SMS audits had taken place at MMA.

Other weaknesses in MMA's SMS, including the fact that the toll-free number for reporting safety concerns was not being used and that the required number of OTIS tests were not being conducted, were not identified during the verification process.

Although TC inspections identified problems at MMA between 2003 and 2010, and it was clear to TC that MMA's SMS was not effective, no SMS audits were conducted in that time frame. The 2010 TC audit determined that MMA had not implemented its SMS. The limited number and scope of SMS audits that were conducted by TC Quebec Region, as well as the absence of a follow-up procedure to ensure MMA's corrective action plans had been implemented, contributed to the fact that systemic weaknesses in MMA's SMS remained unaddressed.

If TC does not audit the SMS of railways in sufficient depth and frequency and confirm that corrective actions are effectively implemented, there is an increased risk that railways will not effectively manage safety.

2.14.2 Transport Canada's monitoring of regional audits

Given that the SMS Regulations came into force in 2001, TC Rail Safety should have had enough time to confirm that all railways have an SMS in place that is effectively improving safety.

In 2007, the RSA Review Panel found that, while improvements had certainly been made, progress in implementing SMS had been inconsistent. The review panel expressed concern over the regulator's ability to implement the use of SMS successfully, citing a number of challenges, including resourcing issues, the skill sets required of inspectors, and a belief that demonstrating the existence of processes was sufficient to demonstrate compliance. Since then, TC has taken steps to address the recommendations made by the panel. For example, in 2011, a group responsible for leading national audits, overseeing audit planning, and developing auditor training for all inspectors was created in TC Headquarters. Through this group, TC Headquarters increased its oversight of SMS programs.

However, as the Office of the Auditor General's (OAG's) examination of the adequacy of rail safety oversight in November 2013 revealed, this objective has not been met. The OAG concluded that, 12 years after the implementation of SMS, TC does not have adequate assurance that federal railways have implemented effective SMS.

Despite TC's efforts, this accident demonstrated that a number of weaknesses are still present in the oversight of safety programs.

The TC Regions wer the convening authority for SMS audits, and were responsible for identifying the target and scope of the audits. TC Quebec Region had not been conducting sufficient audits to verify the effectiveness of SMS in the province's 4 regional railways. Although all railways were subject to a pre-audit shortly after the regulations came into force, only 3 audits examining the use and effectiveness of SMS procedures had been completed at the time of the accident.

Although audits should be conducted periodically, or triggered in reaction to results from compliance inspection activities, neither of these approaches were used in TC Quebec Region; instead, MMA was audited in response to a railway accident. Auditing in response to accidents does not effectively place the onus on the railway company to demonstrate that it is continuously managing risks, as outlined in objective 3(c) of the RSA. The limited number and scope of the audits conducted by TC Quebec Region meant that many aspects of railways' SMS had not been validated for effectiveness.

The lack of audits and follow-up on audit findings was due to a number of factors. There was a belief by TC regional personnel that it would not be possible to conduct periodic SMS audits convering all elements required under the SMS Regulations for all regional railways, given the personnel requirements of SMS audits. Furthermore, some railway safety inspectors (RSIs) felt unprepared to participate effectively in SMS audits, particularly as audit team leaders.

Many inspectors felt that resources devoted to SMS audits were wasted; they believed that there was little that could be done if an operator was not conforming to its SMS. This belief originated from TC's Railway SMS Regulations Enforcement Policy, which established that a railway company could be prosecuted for non-compliance with SMS Regulations, but not for deficiencies in the implementation of SMS. Although the RSA provides tools to take action when an immediate threat to safety exists, the deficiencies identified during the implementation of a company's SMS would be presented to the company as an opportunity for improvement. However, inspectors were provided with few tools to require improvements if a company was unwilling or unable to effectively implement the processes required under the SMS Regulations.

Many inspectors in TC Quebec Region were not engaged in SMS implementation, and saw SMS in the Region as being within the domain of the Safety Systems Overview group. However, the Safety Systems Overview group was not actively supported from colleagues and management.

As a result, TC Quebec Region was not ensuring that regional railways had an effective SMS in place.

Because regional railways were the responsibility of each TC Region, TC Headquarters did not provide leadership, but rather limited its role to providing support for the regional oversight of the SMS program. The support focused on helping Regions prepare and deliver audits of regional railways. TC Headquarters did not provide the minimum requirements regarding audit frequency or audit scope to the Regions. Moreover, TC Headquarters did not monitor regional auditing activities to ensure that the minimum standards were being met and that all activities, such as following up on audit findings, were consistently performed. Consequently, TC Headquarters was unaware of any weaknesses in oversight of regional railways in Quebec, and did not intervene to provide additional support. Without sufficient national monitoring, TC does not have adequate assurance that its Regions are providing effective oversight of regional railways to ensure that the risks to the public are being properly managed.

2.15 Canadian Transportation Agency reporting requirements

The Canada Transportation Act requires railways to carry adequate insurance to cover the risk of operations. The Canadian Transportation Agency (CTA) initially examines insurance coverage when issuing a certificate of fitness (COF). Subsequently, a review can be triggered when the agency is advised by a railway company of operational changes. At the time of the accident, the magnitude and type of operational changes that needed to be reported were subjective; therefore, railways determined what they would report to the CTA.

MMA had requested 3 variances to its COF as a result of changes in operations. However, the railway did not consider the increase in crude oil to be a significant operational change, and therefore did not inform the CTA of this change in its risk profile. Moreover, the CTA did not routinely seek out this type of information or conduct periodic assessments of certificate holders' insurance. Consequently, the CTA was not aware of operational changes at MMA affecting the adequacy of its insurance coverage.

The significant increase in the transportation of dangerous goods and, in particular, the increasing number of unit trains of petroleum crude oil, raised the risk profile of MMA's operations. However, the regulatory requirements in place at the time of this accident did not ensure that an increase in risk was reflected in MMA's insurance coverage.

3.1 Findings as to causes and contributing factors

1. MMA-002 was parked unattended on the main line, on a descending grade, with the securement of the train reliant on a locomotive that was not in proper operating condition.
2. The 7 hand brakes that were applied to secure the train were insufficient to hold the train without the additional braking force provided by the locomotive’s independent brakes.
3. No proper hand brake effectiveness test was conducted to confirm that there was sufficient retarding force to prevent movement, and no additional physical safety defences were in place to prevent the uncontrolled movement of the train.
4. Despite significant indications of mechanical problems with the lead locomotive, the locomotive engineer and the Bangor, Maine, rail traffic controller agreed that no immediate remedial action was necessary, and the locomotive was left running to maintain air pressure on the train.
5. The failure of the non-standard repair to the lead locomotive’s engine allowed oil to accumulate in the turbocharger and exhaust manifold, resulting in a fire.
6. When the locomotive was shut down as a response to the engine fire, no other locomotive was started, and consequently, no air pressure was provided to the independent brakes. Further, locomotives with an auto-start system were shut down and not available to provide air pressure when the air brake system began to leak.
7. The reset safety control on the lead locomotive was not wired to initiate a penalty brake application when the rear electrical panel breakers were opened.
8. Because air leaked from the train at about 1 pound per square inch per minute, the rate was too slow to activate an automatic brake application.
9. When the retarding brake force provided by the independent brakes was reduced to about 97 400 pounds, bringing the overall retarding brake force for the train to approximately 146 000 pounds, the train started to roll.
10. The high speed of the train as it negotiated the curve near the Megantic West turnout caused the train to derail.
11. About one third of the derailed tank car shells had large breaches, which rapidly released vast quantities of highly volatile petroleum crude oil, which ignited, creating large fireballs and a pool fire.
12. Montreal, Maine & Atlantic Railway did not provide effective training or oversight to ensure that crews understood and complied with rules governing train securement.
13. When making significant operational changes on its network, Montreal, Maine & Atlantic Railway did not thoroughly identify and manage the risks to ensure safe operations.
14. Montreal, Maine & Atlantic Railway’s safety management system was missing key processes, and others were not being effectively used. As a result, Montreal, Maine & Atlantic Railway did not have a fully functioning safety management system to effectively manage risk.
15. Montreal, Maine & Atlantic Railway’s weak safety culture contributed to the continuation of unsafe conditions and unsafe practices, and compromised Montreal, Maine & Atlantic Railway’s ability to effectively manage safety.
16. Despite being aware of significant operational changes at Montreal, Maine & Atlantic Railway, Transport Canada did not provide adequate regulatory oversight to ensure the associated risks were addressed.
17. Transport Canada Quebec Region did not follow up to ensure that recurring safety deficiencies at Montreal, Maine & Atlantic Railway were effectively analyzed and corrected, and consequently, unsafe practices persisted.
18. The limited number and scope of safety management system audits that were conducted by Transport Canada Quebec Region, and the absence of a follow-up procedure to ensure Montreal, Maine & Atlantic Railway’s corrective action plans had been implemented, contributed to the systemic weaknesses in Montreal, Maine & Atlantic Railway’s safety management system remaining unaddressed.

3.2 Findings as to risk

1. If a proper hand brake effectiveness test is not performed, equipment may not be adequately secured, increasing the risk of a runaway.
2. If hand brakes are applied on the operating locomotive(s) during a hand brake effectiveness test, this may result in an inaccurate effectiveness test, increasing the risk of runaways.
3. Given the variable condition of locomotive hand brakes, counting them as part of the total number of hand brakes required can lead to overestimating the braking force, thereby increasing the risk of a runaway.
4. If equipment is left unattended without additional physical safety defences, there is an increased risk that it will run away, leading to an accident.
5. If railways implement single-person train operations without identifying all risks, and if mitigation measures are not implemented, an equivalent level of safety to that provided by multi-person crews will not be maintained.
6. If there are no rules and regulations for single-person train operations, nor a requirement for Transport Canada to approve and monitor railways’ plans, then single-person trains may operate without all of the necessary defences in place.
7. If trains are left unattended in easily accessible locations, with locomotive cab doors unlocked and the reverser handle available in the cab, the risk of unauthorized access, vandalism, and tampering with locomotive controls is increased.
8. If poor rail and joint conditions are not addressed, there are increased stresses on wheels and rails, which may lead to damaged equipment or infrastructure, thus increasing the risk of derailment.
9. If systematic testing is not conducted on representative samples of petroleum crude oil at an appropriate frequency, there is an increased risk that these dangerous goods will be improperly classified.
10. If not properly classified and documented, dangerous goods may be moved and handled incorrectly, increasing the risk of injury to people, and of damage to property and the environment.
11. Without monitoring and effective enforcement of compliance with applicable classification provisions of the Transportation of Dangerous Goods Regulations, there is a risk that improperly classified dangerous goods will enter the transportation system.
12. If Class 111 tank cars that do not meet enhanced protection standards transport flammable liquids, there is an ongoing risk of product loss and significant damage to persons, property, and the environment when these cars are involved in accidents.
13. If the shipper has not developed an adequate, regulator-approved emergency response assistance plan, the required resources to assist local responders may not be available in the event of an accident involving large quantities of liquid hydrocarbons.
14. If route planning, analysis and follow-up risk assessments are not conducted by railways along routes where dangerous goods are carried, comprehensive safety measures to mitigate the risks may not be introduced.
15. If Transport Canada does not audit the safety management systems of railways in sufficient depth and frequency and confirm that corrective actions are effectively implemented, there is an increased risk that railways will not effectively manage safety.
16. Without sufficient national monitoring, Transport Canada does not have adequate assurance that its Regions are providing effective oversight of regional railways to ensure that the risks to the public are being properly managed.

3.3 Other findings

1. It could not be concluded whether single-person train operations contributed to the incorrect securement of the train or to the decision to leave the locomotive running at Nantes, Quebec, despite its abnormal condition.
2. The petroleum crude oil being transported by the train was improperly classified; it was assigned packing group III (lowest hazard), despite meeting the criteria for packing group II.
3. The Nantes Fire Department had to shut down the locomotive to stop the flow of oil, which was feeding the fire. Their actions were consistent with railway instructions.
4. The track geometry condition was adequate for the existing traffic and was acceptable for the speed allowed (15 mph) for trains travelling through Megantic Station.
5. Despite the challenges of responding to a major disaster not specifically covered by many firefighters’ practical training, the emergency response was conducted in a well-coordinated and effective manner.
6. The regulatory requirements in place at the time of this accident did not ensure an increase in risk was reflected in Montreal, Maine & Atlantic Railway’s insurance coverage.

4.1 Safety action taken

4.1.1 Montreal, Maine & Atlantic Railway

To improve the safety of its rail operations, Montreal, Maine & Atlantic Railway (MMA) has:

• implemented all orders, directives, and safety advisories put in place by the Minister, Transport Canada (TC), the Transportation Safety Board (TSB), the United States Department of Transportation (DOT), and the Federal Railroad Administration (FRA);
• ceased, by agreement with the Canadian Transportation Agency (CTA), the handling of crude oil of any type from any location;
• addressed all TC notices, and notices and orders, regarding track and right-of-way;
• installed 1100 crossties at several locations to protect the integrity of the track structure;
• performed rail flaw detection and track geometry testing between St-Jean Station, Quebec, and the U.S. border, and addressed identified deficiencies;
• cut and removed brush between Magog, Quebec, and the U.S. border;
• eliminated single-person train operations (SPTO);
• increased field supervision as well as operating-rules testing and enforcement;
• instituted and complied with all procedures mandated or suggested by the Minister, TC, the TSB, or U.S. authorities. These included the securement of trains and locomotives, as well as the prohibition from leaving unattended trains containing dangerous goods on the main track;
• adopted the Association of American Railroads (AAR) Circular OT-55, titled Recommended Railroad Operating Practices For Transportation of Hazardous Materials.

4.1.2 Transportation Safety Board rail safety recommendations

On 23 January 2014, the TSB issued 3 recommendations.

4.1.2.1 Vulnerability of Class 111 tank cars to sustainment of damage

The examination of the 63 general-service Class 111 tank cars that derailed in Lac-Mégantic revealed that 59 of the cars (94%) had released petroleum crude oil due to impact damage. The damage to the tank cars in Lac-Mégantic clearly indicates that product release could have been reduced had the tank car shells and heads been more impact-resistant. Recent accidents, including those that occurred in Aliceville, Alabama (November 2013), Casselton, North Dakota (December 2013), Plaster Rock, New Brunswick (January 2014), and Lynchburg, Virginia (April 2014), involving Class 111 tank cars, have again highlighted their vulnerability to accident damage and product release. Design improvements to these types of cars are needed to mitigate the risks of a dangerous goods release and the consequences observed in the Lac-Mégantic accident. Commodities posing significant risk must be shipped in safe containers that include defences, such as stronger tank shells, tank car jackets, full-height head shields, thermal protection, and high-capacity pressure relief devices. Given the magnitude of the risks, and given that tank car standards must be set for the North American rail industry, the Board recommended that:

In February 2014, both Class 1 Canadian railways (Canadian National [CN] and Canadian Pacific Railway [CPR]) announced a surcharge for customers using the pre-CPC-1232 Class 111 tank cars.

In March 2014, CPR and CN announced improvements to their Class 111 tank car fleets. CPR committed to phasing out or retrofitting its (fewer than 200) Class 111 tank cars. CN committed to phasing out or retrofitting its fleet of pre-CPC-1232 Class 111 tank cars. It will replace all 40 tank cars that it owns, and will replace the remaining 143 cars as their leases expire over the next 4 years.

In February 2014, Irving Oil Ltd. (Irving) stated that it intended to phase out by May 2014 the remainder of the pre-CPC-1232 Class 111 tank cars in its fleet. It further stated that 88% of its fleet already meets the Association of American Railroads (AAR) 2011 standard. It has also requested that all of its suppliers, by the end of the year, use cars that adhere to the AAR 2011 standard.

Response from Transport Canada

In response to TSB Recommendation R14-01, TC indicated that it will prohibit the use of the highest-risk group of pre-CPC-1232 Class 111 tanks cars. Under subsection 32(1) of the Transportation of Dangerous Goods Act (1992), Protective Direction No. 34 was issued on 23 April 2014 prohibiting the use of tank cars that have no continuous reinforcement of their bottom shell for carrying any Class 3 flammable liquids, including crude oil and ethanol. The industry had 30 days to fully comply.

TC further stated that it will require that all pre-CPC-1232/TP 14877 tank cars used for the transportation of crude oil and ethanol be phased out of service or retrofitted within 3 years.

In the interim, the train routing restrictions outlined in TC's response to Recommendation R14‑02 (see section 4.1.2.2) are designed to reduce the associated risks. TC plans to meet or exceed any new U.S. standard; therefore, it will continue to work closely with its U.S. counterparts on the development of more stringent tank car construction and retrofit standards to further enhance safety of the integrated North American rail system.

In addition, TC will proceed expeditiously with the Canada Gazette, Part II, publication of the 13 updated means of containment standards, including the AAR 2011 CPC-1232 standard for DOT-111 tank cars, that were introduced for consultation in Canada on 11 January 2014.^{Footnote 141}

Response from the Pipeline and Hazardous Materials Safety Administration

In response to TSB Recommendation R14-01, the Pipeline and Hazardous Materials Safety Administration (PHMSA) indicated that on 30 April 2014, the DOT, on behalf of PHMSA and the FRA, submitted a notice of proposed rulemaking (NPRM). The NPRM, titled Hazardous Materials: Enhanced Tank Car Standards and Operational Controls for High-Hazard Flammable Trains (HM-251),^{Footnote 142} was sent to the Office of Management and Budget's (OMB) Office of Information and Regulatory Affairs (OIRA) for review. This notice proposes a comprehensive approach to rail safety to improve tank car integrity, as well as to provide additional operational controls, enhance emergency response, and establish methods to improve the classification and characterization of hazardous materials.^{Footnote 143}

In addition, on 07 May 2014, PHMSA and the FRA issued Safety Advisory Notice No. 14-07: Recommendations for Tank Cars Used for the Transportation of Petroleum Crude Oil by Rail,^{Footnote 144} urging railroad carriers transporting petroleum crude oil from the Bakken formation in the Williston Basin to use the tank cars of the highest integrity within their existing fleet and to avoid using legacy DOT-111 tank cars to the extent practicable.

Board assessment of Transport Canada's response to Recommendation R14-01

TC immediately prohibited the use of some pre-CPC-1232 Class 111 tank cars, and will require the phasing-out or retrofitting of the existing fleet within 3 years. TC has also committed to expeditiously publishing updated regulations in the Canada Gazette, Part II, including the new standard TP 14877 (which adopts the AAR 2011 CPC-1232 standard for Class 111 tank cars), making it mandatory for new tank cars built for the transportation of dangerous goods (including crude oil and ethanol) in packing groups (PGs) I or II to include end-of-tank protection, thicker and more impact-resistant steel tanks, and protected top fittings, as a minimum, to improve accident performance.

However, the TP 14877 standard is not sufficiently robust to minimize the risk of dangerous goods releases when Class 111 tank cars are involved in a derailment. The railway industry is asking both the Canadian and U.S. regulators to go much further than the AAR 2011 CPC-1232 standard, and it would seem that both governments are actively discussing improvements.

The Board is encouraged by the safety actions and the immediate steps to mitigate the risks taken to date. However, the process of implementing safety enhancements to the North American fleet of tank cars will take time, and the specific improvements to new tank car designs will not be known until the process is finalized. Therefore, until all pre-CPC-1232/TP 14877 tank cars are no longer used to transport flammable liquids, and a more robust tank car standard with enhanced protection is set for North America, the risk will remain.

Board assessment of the Pipeline and Hazardous Materials Safety Administration's response to Recommendation R14-01

PHMSA has accepted the recommendation, and an NPRM on enhanced tank car standards has been submitted for review. During the regulatory process, comments were received on a variety of topics, including on the redesign of DOT specification 111 tank cars, as well as operational practices such as speed limits, train securement, and track integrity.

However, because the process is ongoing, the final ruling on the enhanced tank car standards is not yet known. In the interim, the recommendations contained in Notice No. 14-07 (urging carriers to use the highest-integrity tank car specifications and recommending that they avoid use of the pre-CPC-1232—referred to as “legacy”—tank cars to the extent reasonably practicable) may in some small measure help reduce the risk of petroleum crude oil releases when tank cars are involved in a derailment. The Board is also encouraged by the actions taken to address issues raised in the NTSB safety recommendations (see section 4.1.12).

Board rating of Transport Canada's and the Pipeline and Hazardous Materials Safety Administration's responses to Recommendation R14-01

The Board notes favourably the close cooperation between Canada and the U.S. in addressing this issue, as it is important that federal regulations in both countries be harmonized to the greatest extent possible given that North America is an integrated market. However, the process of implementing safety enhancements to the North American fleet of tank cars will take time, and the specific improvements to new tank car designs will not be known until the process is finalized. Therefore, until all pre-CPC-1232/TP 14877 tank cars are no longer used to transport flammable liquids, and a more robust tank car standard with enhanced protection is set for North America, the risk will remain.

For these reasons, the Board assessed the TC and the PHMSA responses to Recommendation R14-01 as being Satisfactory in Part.

The TSB will continue to monitor progress on the development and implementation, on both sides of the border, of rules for tank cars used to transport flammable liquids to meet enhanced protection standards that significantly reduce the risk of product loss when these cars are involved in accidents.

Subsequently, on 18 July 2014, TC issued for consultation a proposal for a new class of tank car (TC-140). The proposal also included a retrofit schedule for older TC/DOT-111 tank cars and the CPC-1232/TP 14877 tank car. According to TC, the new car was specifically developed for the transportation of flammable liquids in Canada by rail, such as crude oil and ethanol, and would enhance the requirements of its TP 14877 standard. Stakeholders have 45 days to provide their comments. TC stated that it will expedite the pre-publication of the new requirements in the Canada Gazette, Part I, in the fall of 2014.

On 23 July 2014, PHMSA, in coordination with the FRA, issued an NPRM^{Footnote 145} proposing requirements for high-hazard flammable trains, such as unit trains carrying petroleum crude oil and ethanol. The NPRM included new operational requirements for certain trains transporting a large volume of Class 3 flammable liquids, improvements in tank car standards, and revision of the general requirements for offerors of hazardous materials to ensure the proper classification and characterization of mined gases and liquids. Comments were sought on 3 options for enhanced tank car standards. Stakeholders have 60 days to provide their comments.

4.1.2.2 Route planning and analysis for trains carrying dangerous goods

A primary safety concern related to the transportation of dangerous goods by rail is prevention of a catastrophic release or explosion in a densely populated or environmentally sensitive area. The Lac-Mégantic accident heightened the public's awareness of the risks associated with the transportation of dangerous goods.

The AAR Circular OT-55-N, or similar operating restrictions, are necessary to alleviate many of the shortcomings identified during the Lac-Mégantic investigation and other investigations involving the release of dangerous goods. However, these measures need to be complemented by a more comprehensive and proactive approach. An approach based on Circular OT-55-N, strengthened with a requirement to conduct route planning and analysis as well as periodic risk assessments, would be a positive step toward improving the safety of transporting dangerous goods by rail. Therefore, the Board recommended that:

Response from Transport Canada

On 23 April 2014, in response to TSB Recommendation R14-02, TC issued an emergency directive under section 33 of the Railway Safety Act (RSA) requiring railways carrying dangerous goods to implement minimum critical operating practices, including speed restrictions, enhanced inspection and maintenance requirements, and risk assessments on key routes over which key trains operate. The emergency directive is in force for 6 months, and may need to be renewed to reflect further consultation with stakeholders and consideration of any additional U.S. requirements that may be established.

At the same time, TC also issued a ministerial order under section 19 of the RSA.This ministerial order requires railways carrying dangerous goods to formulate and submit for approval, within 180 days, new rules based on these above-described operating practices to further improve the safe transportation of dangerous goods by rail in the long term.

Board assessment of Transport Canada's response to Recommendation R14-02

On 18 June 2014, the TSB issued its assessment of TC's response to Recommendation R14-02, as follows:

The Emergency Directive will require risk assessments to be conducted on key routes over which key trains operate. However, key routes are defined as a route over which 10 000 car loads of dangerous goods are transported annually. This threshold may limit the number of routes subject to these enhanced safety measures. A rigourous analysis should be conducted of the 10 000-car threshold to determine which routes will be excluded and whether the safety deficiency identified in R14-02 will be addressed.

If the new rules developed pursuant to the Ministerial Order cover the same scope of activities or more, and are strengthened to include more railway routes, the risk posed by movements of dangerous goods could be significantly reduced. However, the proposed rules have not yet been developed, and the outcome cannot be known until the process is finalized.

Therefore, the Board assessed the response to Recommendation R14-02 as having Satisfactory Intent.

The TSB will monitor the railways' progress on the development and implementation of new rules to improve their operating practices for the safe transportation of dangerous goods.^{Footnote 146}

4.1.2.3 Requirements for emergency response assistance plans

An emergency response assistance plan (ERAP) is required by the Transportation of Dangerous Goods Regulations for certain goods that pose a higher-than-average risk when transported in certain quantities. When an accident occurs, the handling of these dangerous goods requires special expertise, resources, supplies, and equipment. At the time of the accident, an ERAP was not required for the transportation of all large volumes of flammable liquids, such as petroleum crude oil. However, approved ERAPs help ensure that first responders consistently have access, in a timely manner, to the required resources and assistance to deal with an accident involving significant quantities of flammable liquids.

Following this accident, an emergency response working group was established by TC's Transportation of Dangerous Goods General Policy Advisory Council in November 2013. The working group, chaired by the Canadian Association of Fire Chiefs, was tasked to examine the possibility of extending the ERAP program to include flammable liquids, such as crude oil, or to recommend other emergency response solutions aimed at ensuring access to appropriate response capability and specialized supplies.

The Board acknowledged this TC initiative. However, given the significant increase in the quantities of crude oil being transported by rail in Canada, as well as the potential for a large spill and the risks it would pose to the public and the environment, the Board recommended that, at a minimum:

Response from Transport Canada

On 23 April 2014, in response to TSB Recommendation R14-03, TC issued Protective Direction No. 33 under the Transportation of Dangerous Goods Act (1992). This protective direction, in effect 150 days from the issue date, requires an ERAP for certain higher-risk hydrocarbons and flammable liquids, including crude oil and ethanol, when offered for transport or imported by rail in 1 or more tank cars that are each filled to 10% of capacity or more.

TC indicated that it will establish an emergency response planning task force with members from key partners and stakeholders to provide a dedicated forum, and with support from a team of experts, to respond to recommendations of the emergency response working group of the Transportation of Dangerous Goods General Policy Advisory Council. The task force will focus on ERAP activation processes, cooperative industry approaches, development of information-sharing protocols, and promotion of unified incident command structures. The task force will also review and provide advice on the possible expansion of ERAP requirements to other Class 3 flammable liquids.

Board assessment of Transport Canada's response to Recommendation R14-03

In its assessment of TC's response to TSB Recommendation R14-03, issued on 18 June 2014, the TSB noted that the protective direction will require ERAPs for commonly transported hydrocarbons and flammable liquids that present a higher risk, even for volumes of 1 loaded tank car or more, and TC will also establish a task force to focus on ERAP requirements.

The protective direction ensures that there will be approved ERAPs in place for the shipment of higher-risk hydrocarbons and other flammable liquids, including ethanol. Therefore, the Board assessed the response to Recommendation R14-03 as Fully Satisfactory.

The TSB will continue to monitor progress of the industry task force on ERAPs for the transportation of large volumes of liquid hydrocarbons.

4.1.3 Transportation Safety Board rail safety advisories

4.1.3.1 Securement of locomotives, equipment, and trains left unattended

On 18 July 2013, the TSB issued Rail Safety Advisory 08/13 to TC. The advisory stated that, given the importance of the safe movement of DGs and the vulnerability of unattended equipment, TC may wish to consider reviewing all railway operating procedures to ensure that trains carrying DGs are not left unattended on the main track.

Also on 18 July 2013, the TSB issued Rail Safety Advisory 09/13 to TC. The advisory stated that, given that there is considerable variability in the effectiveness of the hand brake system on rail cars, and that the hand brake effectiveness test used by railways to satisfy Canadian Rail Operating Rules (CROR) 112(b) does not always adequately verify whether the braking force of the hand brake application is sufficient to hold the cars, TC may wish to review CROR 112 and related railway special instructions to ensure that equipment and trains left unattended are properly secured in order to prevent unintended movements.

On 12 September 2013, in reply to Rail Safety Advisories 08/13 and 09/13, TC indicated that, on 23 July 2013, pursuant to section 33 of the RSA, it had issued an emergency directive^{Footnote 147} (which was to remain in effect until 31 December 2013) whereby all federally regulated railway companies and local railway companies operating equipment on federal railways were ordered to:

1. ensure that all unattended controlling locomotives on a main track and sidings^{Footnote 148} are protected from unauthorized entry into the cab of the locomotives;
2. ensure that reversers are removed from any unattended locomotive on a main track and sidings;
3. ensure that the company's special instructions on hand brakes referred to in CROR 112 are applied when any locomotive coupled to 1 or more cars is left unattended for more than 1 hour on a main track or sidings;
4. ensure that, when any locomotive coupled to 1 or more cars is left unattended for 1 hour or less on a main track or sidings, in addition to complying with the company's special instructions on hand brakes referred to in CROR 112, the locomotives have the automatic brake set in full service position and have the independent brake fully applied;
5. ensure that no locomotive coupled to 1 or more loaded tank cars transporting DGs is left unattended on a main track; and
6. ensure that no locomotive coupled to 1 or more loaded tank cars transporting DGs is operated on a main track or sidings with fewer than 2 persons qualified under the company's requirements for operating employees.

TC also indicated that it was following up on this emergency directive with all rail operators in federally regulated and local railway companies to ensure that the requirements contained therein were met. As a result of the emergency directive, several changes were made to the CROR, including Rules 62 and 112, as well as General Rule M. As for the order to not leave trains transporting dangerous goods unattended on the main track, this requirement does not appear to be covered in any subsequent rule change. Other conditions that appear to be less restrictive than the emergency directive relate to orders 3 and 4 (above) and CROR 112 (see 4.1.8 for more information).

4.1.3.2 Determination of petroleum crude oil properties for safe transportation

On 11 September 2013, the TSB issued Rail Safety Advisory 12/13 to TC, which stated that the waybill information described the product carried in each tank car of MMA-002 as UN 1267, petroleum crude oil, Class 3, PG III.^{Footnote 149} However, the results of tests performed on the content of the 9 tank cars that did not derail indicated that the product sample was in the lower end of the petroleum crude oil flashpoint range, well below the PG III threshold, which corresponds to a product that is required to be identified as Class 3, PG II. Given that the safety of individuals who handle or otherwise come into contact with DGs during transport is dependent in large part on an accurate description of the product being transported, and considering the volatility of the type of petroleum crude oil involved in this accident and the potential consequences of its release during an accident, the advisory suggested that TC may wish to review the processes in place for suppliers and companies transporting or importing these products to ensure the product properties are accurately determined and documented for safe transportation.

TC responded that, on 17 October 2013, it issued Protective Direction No. 31, pursuant to section 32 of the Transportation of Dangerous Goods Act (TDG Act), requiring any person who imports, offers for transport or transports petroleum crude oil to:

• conduct classification testing of any petroleum crude oil being classified as UN 1267 or UN 1993 that has not been classification-tested since 07 July 2013;
• make those test results available to TC upon request;
• update their safety data sheets (SDSs) and immediately provide them to TC's CANUTEC (Canadian Transport Emergency Centre); and
• ship all petroleum crude oil classified as UN 1267 or UN 1993 as Class 3, flammable liquids, PG I, when shipping by rail, until classification testing has been completed.

In response to Rail Safety Advisory 12/13, TC published amendments to the TDG Regulations in the Canada Gazette, Part II, on 02 July 2014. These amendments include a requirement that the person who classifies a DG before transportation keep a record of classification of those goods, as well as a record of the sampling method for petroleum crude oil, and the requirement for consignors to certify that the person named on the shipping document has prepared the consignment to the regulations that apply.

Also on 11 September 2013, the TSB issued Rail Safety Advisory 13/13 to PHMSA on the same subject. On 23 September 2013, PHMSA responded that a joint safety advisory had been issued with the FRA on 02 August 2013, recommending that shippers of hazardous materials, including petroleum crude oil, reassess their operating procedures to ensure that the petroleum crude oil is properly classified and assigned the appropriate PG. This review is to include evaluation of the frequency of verification of flashpoint and boiling point, and the effects that blending of crude from different wells have on these characteristics. PHMSA also indicated that it continues to inspect shippers and carriers, and to monitor, among other things, the material classification of petroleum crude oil in the U.S. under a nationwide inspection campaign with the FRA.

On 14 November 2013, PHMSA and the FRA issued Safety Advisory No. 2013-07, emphasizing the importance of proper characterization, classification, and selection of a packing group for Class 3 materials, and the corresponding requirements in federal hazardous materials regulations for safety and security planning. In addition, offerors by rail and rail carriers are expected to revise their safety and security plans, including the required risk assessments, to address the safety and security issues identified in the FRA's 02 August 2013 Emergency Order No. 28 and joint safety advisory.

The United Nations is also working on issues related to the classification and safe transportation of crude oil. A subcommittee of the Committee of Experts on the Transport of Dangerous Goods and on the Globally Harmonized System of Classification and Labelling of Chemicals is soliciting feedback with respect to the classification and hazard-communication elements of the United Nations Model Regulations currently applicable to crude oil. This subcommittee includes participants from Canada and the U.S.

On 15 August 2014, the TSB issued a safety advisory to TC. Rail Safety Advisory 06/14 related to the classification accuracy of mined gases and liquids, such as petroleum crude oil.

4.1.3.3 Short line railway employee training

On 15 August 2014, the TSB issued Rail Safety Advisory 07/14 to TC, which related to the adequacy of employee training programs by short line railways.

4.1.4 Tranportation Safety Board rail safety information letters

Following this accident, the TSB received a number of reports concerning potential problems with sections of MMA track and with MMA railway equipment. As a result, the TSB issued to TC the rail safety information letters described below.

On 18 July 2013, the TSB issued Rail Safety Information Letter 10/13 on the track conditions at Lac-Brome, Quebec. In response, TC indicated on 30 September 2013 that it had inspected all MMA main tracks using a track assessment vehicle. In addition, an examination of the subject section of track by a TC inspector revealed some anomalies in certain rail joints that did not meet MMA's standards. As a result, MMA lowered its train operating speed in this section to the equivalent of a Class 1 track.

Also on 18 July 2013, the TSB sent Rail Safety Information Letter 11/13 to TC regarding the track conditions at Sherbrooke Yard, Quebec. TC conducted an inspection of the MMA Sherbrooke Yard and identified several significant safety concerns with respect to the infrastructure on all yard tracks. As a result, on 26 July 2013, a TC railway safety inspector issued a notice informing MMA that a threat to safe railway operations existed due to the track condition in the Sherbrooke Yard. On 09 August 2013, MMA replied to the notice, indicating that the company would make repairs to certain conditions found, apply remediation to other conditions found, make tracks “excepted”, or close tracks, and would adjust operations in Sherbrooke Yard as well as develop a plan for further usage.

On 22 July 2013, the TSB issued Rail Safety Information Letter 13/13 on the soil conditions in Sherbrooke, Quebec. In its response dated 30 September 2013, TC informed the TSB that inspection of the Sherbrooke Yard had revealed that a broken City of Sherbrooke water pipe had eroded the soil under a bike path and the MMA right-of-way. MMA made appropriate repairs, and the problem was resolved.

On 26 August 2013, the TSB sent Rail Safety Information Letter 16/13 to TC regarding the crossing condition at Agnès Street in Lac-Mégantic. On 27 September 2013, TC advised the TSB that the Ministry of Transport of Quebec was planning to replace the crossing surface in the fall to address the reported unsafe condition at the Agnès Street public crossing. Subsequently, the Ministry of Transport of Quebec made a temporary repair to the road surface by adding asphalt where the road crosses the main track; the spur leading to a local industrial facility was covered over with asphalt, as it had not been used for 2 years.

Also on 26 August 2013, the TSB issued Rail Safety Information Letter 17/13 on the drainage condition near Chemin du Versant in Lac-Mégantic. On 18 October 2013, TC indicated that it had conducted an extensive site visit, which indicated erosion affecting the head wall of the culvert and a need for the embankment to be stabilized. TC recommended that a 10-mph temporary slow order (TSO) be applied until the situation was corrected. MMA advised that it would be transferring this issue to the new operator and would be involving the town of Lac-Mégantic to discuss an eventual work plan. In the meantime, MMA will continue to monitor the situation during its weekly inspections, and TC will continue to follow up.

4.1.5 Other measures taken by the Transportation Safety Board

On 08 October 2013, the TSB provided TC with the results of its examination of sections of track near Lac-Mégantic (see section 1.17.4 for details). TC combined this information with the results from its own inspections and followed up with MMA. In addition, on 09 October 2013, the TSB provided the same information to the municipality of Lac-Mégantic.

4.1.6 Transport Canada

On 23 July 2013, pursuant to section 33 of the RSA, TC issued an emergency directive to federally regulated railway companies and local railway companies operating equipment on federal railways. The emergency directive clarified the regulatory regime with respect to unattended locomotives on main track and sidings, and the prohibition of trains transporting dangerous goods from being operated with fewer than 2 persons (see section 4.1.3.1). In connection with the emergency directive, and pursuant to section 36 of the RSA, federal and local railway companies were ordered to file with the Minister, within 7 days:

• their special instructions on hand brakes, referred to in CROR 112 and mentioned in item 3 of the directive; and
• their requirements for operating employees, mentioned in item 6 of the directive.

Also on 23 July 2013, pursuant to section 19 of the RSA, TC issued Ministerial Order 07-2013, ordering all federally regulated railway companies and local railway companies to formulate and, as the case may be, to revise, within 120 days (by 20 November 2013), rules respecting the safety and security of unattended locomotives, uncontrolled movements, and crew size requirements. The order specified that the rules should be based on an assessment of safety and security risks, and shall, at a minimum:

1. Ensure that the cab(s) of unattended controlling locomotives are secure against unauthorized entry;
2. Ensure that the reversers of unattended locomotives are removed and secured;
3. Prevent uncontrolled movements of railway equipment […] due to tampering or accidental release of brakes from defective components [by addressing relevant factors];
4. Ensure the security of stationary railway equipment transporting “dangerous goods” […];^{Footnote 150} and
5. Provide for minimum operating crew requirements considering technology, length of train, speeds, classification of dangerous goods being transported, and other risk factors.^{Footnote 151}

A revised Ministerial Order, no. 07.1-2013, was issued on 25 November 2013 to extend the deadline for some companies to submit new or revised rules, by an extra 120 days (to 20 March 2014), to allow for further consultation with TC.

On 17 October 2013, pursuant to section 32 of the TDG Act, TC issued Protective Direction No. 31, directing any person engaged in importing or offering petroleum crude oil for transport to immediately test its classification if no classification testing has been conducted since 07 July 2013. The protective direction also states that, until such testing is completed, all such products being shipped by rail must be classified as a Class 3 flammable liquid PG I. (See section 4.1.3.2 for more details.)

On 18 November 2013, the Minister of Transport requested that the House of Commons Standing Committee on Transport, Infrastructure and Communities (commonly referred to as SCOTIC) conduct an in-depth review of the Canadian regime regarding the safe transportation of dangerous goods, and the role of safety management systems across all modes of transportation. It was requested that an interim report be presented by June 2014, followed by a final report by December 2014. SCOTIC accepted the request, undertook the study, and tabled its preliminary report in Parliament on 13 June 2014.

In November 2013, TC announced the creation of 3 industry-led working groups on classification, emergency response, and means of containment. All 3 working groups provided a report to TC on 31 January 2014, which have been posted on TC's website. The reports' recommendations are under consideration.

On 20 November 2013, TC issued Protective Direction No. 32, directing Canadian Class 1 railways and persons who transport DGs by rail to periodically provide specified DG traffic information to each municipality through which DGs are transported by rail, and to notify municipalities of any significant changes to that information. This information must also be provided to TC, through CANUTEC.

In December 2013, TC developed an action plan to address the recommendations contained in the 2013 Fall Report of the Auditor General of Canada. TC stated that most action items are to be completed by fall 2014, and the entire action plan is expected to be fully implemented by fall 2015.

On 24 December 2013, TC issued another emergency directive similar to the one issued on 23 July 2013. It was issued to local railway companies, some of which were not covered by the earlier directive. The emergency directive was to be in effect for 6 months (that is, until 01 July 2014) or until rules are approved for all companies.

On 26 December 2013, TC approved changes to the CROR (TC O 0-167), including a new General Rule M (iii), which states, “The minimum operating crew requirement for a freight train or transfer carrying one or more loaded tank cars of dangerous goods is two (2) crew members”.

On 30 December 2013, TC issued an order under section 36 of the RSA to all Railway Association of Canada (RAC) member railways to file their special instructions on CROR 112, governing testing the effectiveness of hand brakes.

Amendments to the RSAcame into force on 01 May 2013, and enabled the making of regulations in a number of areas that strengthen the Minister's enforcement powers. Therefore, on 15 March 2014, TC published Railway Operating Certificate Regulations in the Canada Gazette, Part I. These proposed regulations would require a railway company to hold a railway operating certificate (ROC) issued by the Minister of Transport. The Minister may suspend or cancel an ROC if the company has contravened a provision of the Act or the regulations made under this Act.

On 23 April 2014, in response to the 3 railway safety recommendations issued by the TSB on 23 January 2014, TC took the following measures:

• Under the TDG Act, it issued Protective Direction No. 33, requiring ERAPs for smaller volumes of commonly transported flammable liquids, such as crude oil and ethanol (see section 4.1.2.3).
• It issued Protective Direction No. 34, removing the least crash-resistant Class 111 tank cars from dangerous goods service (see section 4.1.2.1).
• It issued Order MO 14-01 pursuant to section 19 of the Railway Safety Act, requiring railway companies to formulate rules respecting the safe and secure operations of trains carrying certain dangerous goods and flammable liquids. In conjunction with Order MO 14-01, TC issued an emergency directive pursuant to section 33 of the RSA, requiring railways to implement minimum operating practices on key routes over which they operate key trains (see section 4.1.2.2).

On 17 May 2014, Administrative Monetary Penalties Regulations (AMP Regulations) were published in the Canada Gazette, Part I. These proposed regulations would allow for monetary penalties ranging from $5000 to $50 000 for individuals, and from $25 000 to $250 000 for corporations, for contraventions to various sections of the Railway Safety Management System Regulations (SMS Regulations).

In June 2014, TC advised that follow-up procedures both for audits and for inspections had been developed. These procedures are expected to be released in mid-2014. Furthermore, a baseline audit plan has been developed in order to assess railway companies' implementation of their SMS. A baseline audit will be conducted on each railway on a 5-year cycle and will include the components of section 2 of the SMS Regulations, effective fiscal year 2014—2015.

On 02 July 2014, TC published amendments to the TDG Regulations in the Canada Gazette, Part II. These amendments include requirements to build, after 15 July 2014, all Class 111 tank cars used for the transport of DGs in PG I or PG II (other than toxic by inhalation substances) to specifications similar to the AAR CPC-1232 standard. The amended regulations also apply to tank cars used for the transport of PG III petroleum crude oil (UN 1267) and petroleum products not otherwise specified (UN 1268).

Revised SMS Regulations were published in the Canada Gazette, Part I, on 05 July 2014. These proposed regulations, which would come into force on 01 April 2015, would expand the scope of application to all companies that operate on federal track, would introduce new provisions, and would clarify existing provisions to facilitate more effective compliance and enforcement.

TC collaborated with the National Municipal Rail Safety Working Group of the Federation of Canadian Municipalities to discuss rail and TDG safety-related concerns, such as improving risk assessments, emergency planning and response capability, and increasing insurance requirements for railways and shippers.

4.1.6.1 Safety action taken by Transport Canada Quebec Region with respect to Montreal, Maine & Atlantic Railway

TC Quebec Region took the following measures regarding safety concerns and safety deficiencies noted at MMA after the Lac-Mégantic accident:

• On 10 July 2013, a notice and order was issued to MMA regarding equipment left unattended.
• On 24 July 2013, a notice was sent to MMA and the Municipality of Eastman regarding damage on the overhead timber bridge crossing. This notice was superseded by the notice and order issued on 23 December 2013 and cited below.
• On 26 July 2013, a notice was issued regarding significant safety concerns on the state of the infrastructure on the Sherbrooke Subdivision.
• On 26 July 2013, a notice and order was issued regarding the state of the infrastructure on the Stanbridge Subdivision.
• On 26 July 2013, a notice was issued regarding significant safety concerns on the state of the infrastructure on all yard tracks in Sherbrooke Yard.
• On 09 August 2013, a notice was issued regarding significant safety concerns on the state of the infrastructure on the St-Guillaume Subdivision and in Farnham Yard.
• On 11 October 2013, a notice and order was issued regarding safety deficiencies of public and private crossings on the Sherbrooke Subdivision. On 31 October 2013, after a review and evaluation of actions taken by MMA, TC revoked the notice and order.
• On 31 October 2013, a notice and order was issued regarding rail wear and rail surface defects on the Moosehead Subdivision.
• On 31 October 2013, a notice and order was issued regarding the conditions of tracks on the Sherbrooke Subdivision.
• On 31 October 2013, a notice and order was issued regarding safety deficiencies of public and private crossings on the Sherbrooke Subdivision.
• On 23 December 2013, a notice and order was issued to MMA and to the Municipality of Eastman regarding the condition of the Chemin d'Orford-sur-le-Lac overhead bridge located in the Municipality of Eastman and crossing the MMA Sherbrooke Subdivision. On 28 January 2014, following a review and evaluation of actions taken by the Municipality of Eastman, TC revoked the notice and order, and issued a second notice and order regarding the condition of timber curbs, posts and handrails on the bridge. Repairs by the Municipality of Eastman were begun in the spring of 2014 and are ongoing.

4.1.7 Canadian Transportation Agency

Following the derailment, on 13 August 2013, the CTA suspended MMA's certificate of fitness (COF). After MMA took a series of actions to improve the safety of its rail operations (see section 4.1.1) and demonstrated to the CTA's satisfaction that it had insurance in place, the CTA allowed the company to resume operations.

In the 16 October 2013 Speech from the Throne, the Governor General stated that the “government will require shippers and railways to carry additional insurance so they are held accountable.” In the fall of 2013, the CTA conducted public consultations regarding the adequacy of the Railway Third Party Liability Insurance Coverage Regulations. After the first round of consultations ended in late January 2014, the CTA published a report entitled What We Heard and opened a second round of consultations, which closed on 09 May 2014. The CTA continues to work with TC on increased railway insurance requirements, and on a framework for railways and shippers to fund cleanup costs.

Regarding enhanced enforcement, the CTA is considering the introduction of administrative monetary penalties for non-compliance with regulatory requirements.

Furthermore, the CTA is expanding its memorandum of understanding with TC to include collaboration and information-sharing about federal railways to get a better understanding of the overall safety records of railways in connection with their COFs. The CTA is also aiming to have a similar memorandum in place with the TSB.

4.1.8 Railway Association of Canada

On 20 November 2013, the RAC submitted to TC for approval a revised CROR 112 (Leaving Equipment Unattended). The revised rule, which was approved by TC on 26 December 2013, states the following:

1. Equipment must be secured if it is left unattended. The following are acceptable methods of ensuring securement:
   1. Sufficient number of hand brakes;
   2. A mechanical device approved for use by a professional engineer;
   3. Equipment is left on a track designed to prevent the equipment from moving unintentionally (e.g. switching bowl or where grade does not allow) and that design is approved by a qualified employee;
   4. Equipment is derailed or coupled to derailed equipment;
   5. A movement secured as per paragraph (c) in this rule.
2. While switching enroute, the standing portion must be protected as per paragraph (a) unless:
   1. There are at least 15 cars;
   2. Not on a grade in excess of 1.25%;
   3. The equipment will not be left in excess of 2 hours;
   4. The air brake system is sufficiently charged to ensure proper air brake application; and
   5. The brake pipe is fully vented at a service rate or an emergency application of the air brakes has been made, and the angle cock is left fully open.

Whenever it is possible that the portion left standing cannot be secured within the applicable time limit, the standing portion must be secured as per paragraph (a).

3. A movement may be left unattended if:
   1. Secured as per paragraph (a); or
   2. Left at a location where a derail protects the movement from unintentionally obstructing main track and
      • The air brake system is sufficiently charged to ensure proper brake application;
      • The locomotive controlling the air brake system maintains air pressure;
      • A full service or emergency air brake application is made; and
      • Independent brake is fully applied; or
   3. Air brake system is sufficiently charged to ensure a proper brake application and
      • The locomotive controlling the air brake system maintains air pressure;
      • A full service or emergency air brake application is made;
      • Independent brake is fully applied;
      • Hand brakes are applied on 10% of the equipment to a maximum of 5;
      • It is not on a grade exceeding 1.25%; and
      • Is not left in excess of 2 hours.
4. Exceptional weather situations, such as high winds or other unusual conditions, must be considered and factored into securement decisions. Special instructions may contain location specific instructions where extreme weather events are prevalent.
5. Instructions governing testing the effectiveness of hand brakes will be carried in special instructions.
6. Application of hand brakes must not be made while equipment is being pulled or shoved.
7. Before leaving equipment at any location, the employee securing such equipment must confirm with another employee the manner in which the equipment has been secured.

Following the issuance of TC's Order MO 14-01 in April 2014, the RAC established a working group to initiate the rule-making process in order to formulate rules respecting the safe and secure operations of trains carrying certain DGs and flammable liquids.

The RAC initiated the development of mutual aid agreements to improve DG accident response times and capabilities.

Railways and a number of industry stakeholders are collaborating and have initiated work to develop an ERAP process for liquid hydrocarbons and ethanol that will serve shippers, railways, and emergency response contractors.

Railways and a number of industry stakeholders have established the Canadian Training Coalition for Transportation Incidents. This coalition's objective is to raise awareness of and competence in handling fires involving liquid hydrocarbons and ethanol among local first responders.

4.1.9 Canadian Pacific Railway

In response to TC's order of 30 December 2013, CPR advised that its special instructions for CROR 112 state:

Testing Hand Brake Effectiveness

To ensure sufficient number of hand brakes are applied, release all air brakes and allow or cause the slack to adjust. It must be apparent when slack runs in or out, that the hand brakes are sufficient to prevent that equipment from moving. This must be done before uncoupling or before leaving equipment unattended.

IMPORTANT: When brakes are released to test effectiveness, allow sufficient time for the air brakes to release.^{Footnote 152}

CPR and CN signed a joint mutual-aid agreement to improve DG accident response times and capabilities.

4.1.10 Canadian National Railway

In response to TC's order of 30 December 2013, CN advised that its special instructions for CROR 112 state:

Handbrake effectiveness must be tested before uncoupling and leaving equipment unattended or riding equipment to rest. To test the effectiveness, release all air brakes and allow or cause the slack to adjust. It must be apparent when slack runs in or out, that the handbrakes are sufficient to prevent that equipment from moving. When brakes are released to test effectiveness, allow sufficient time for the air brakes to release. If unable or difficult to observe slack movement, or securing less than 10 cars, slightly move the car(s) to ensure sufficient retarding force.^{Footnote 153}

As previously mentioned in section 4.1.9, CN and CPR signed a joint mutual-aid agreement to improve DG accident response times and capabilities.

4.1.11 Irving Oil Ltd.

Following the accident, Irving took the following measures:

• amended its transportation of DGs training program to extend training to all company petroleum crude oil traders and rail logistics personnel;
• engaged petroleum crude oil suppliers and transloaders to ensure that they are correctly classifying the petroleum crude oil to be transported to Irving's facilities and providing accurate SDSs for the petroleum crude oil supplied;
• implemented processes to reconcile shipping documents with other product documentation (such as SDSs) to confirm the accuracy of the product's classification;
• conducted periodic testing for the classification of petroleum crude oil (for example, flashpoint and initial boiling point) at loading points to collect data in order to better understand the classification and the potential variability in petroleum crude oil from different producers and suppliers;
• increased its oversight of transloading facilities to ensure that all applicable regulatory provisions are met;
• continued working with its counterparts, including suppliers and transloading facilities, to determine how best to provide improved oversight on matters related to the transportation of DGs, given some of the unique commercial challenges presented by the transportation of petroleum crude oil.

4.1.12 Safety action taken in the United States

Following the Lac-Mégantic derailment, a number of measures were taken in the U.S. to enhance railway safety.

On 02 August 2013, the FRA issued Emergency Order 28 (EO-28), strengthening train securement rules by requiring the development and submission of each railroad's process for securing unattended trains carrying DGs on the main line. The order established certain securement requirements for unattended trains, such as use of locks or removal and securement of the reverser on a locomotive, communication between train dispatchers and train crews, recording of information, daily job briefings, and notification to railroad employees. EO-28 was later amended by the FRA based on a petition by the AAR to modify 2 of its provisions.

Also on 02 August 2013, PHMSA and the FRA jointly issued a Safety Advisory No. 2013-06 to railroad owners and hazardous materials shippers detailing recommended actions the industry is expected to take to better ensure the safe transportation of hazardous materials. The recommendations include guidance on train crew size; on operating, testing and classification procedures; on system-wide evaluations of security and safety plans; and on risk mitigation.

On 07 August 2013, PHMSA and the FRA announced a comprehensive review of operational factors that affect the safety of the transportation of hazardous materials by rail (Title 49, Code of Federal Regulations [49 CFR], Part 174). On 27 and 28 August 2013, PHMSA and the FRA held a public meeting to solicit input from the public, stakeholders, and interested parties.

In August 2013, “Operation Classification”was initiated. This compliance activity, also known as the “Bakken Blitz”, consisted of unannounced inspections and testing by PHMSA and the FRA to verify the material classification and packing group assignments selected and certified by offerors of petroleum crude oil.

On 06 September 2013, PHMSA issued an advanced notice of proposed rulemaking (ANPRM), which was published in the Federal Register. The ANPRM requested comments on enhancements to the standards for DOT-111 tank cars used to transport PG I and PG II petroleum crude oil and ethanol. On 30 April 2014, the U.S. DOT, on behalf of PHMSA and the FRA, submitted an NPRM pertaining to enhanced tank car standards for the OMB's review. PHMSA and the FRA continue to work with the OMB to ensure the NPRM is published as quickly as possible (see section 4.1.2.1).

On 14 November 2013, PHMSA and the FRA jointly issued Safety Advisory No. 2013-07, emphasizing the importance of proper characterization, classification, and selection of a PG for Class 3 materials, and the corresponding requirements in the federal hazardous materials regulations for safety and security planning.

FRA draft regulations provide requirements to continue SPTO in place prior to 01 January 2014. A special approval procedure will be required for railroads commencing SPTO after that date.

On 02 January 2014, PHMSA issued a safety alert notifying the general public, emergency responders, shippers, and carriers that the type of crude oil being transported from the Bakken region of North Dakota may be more flammable than traditional heavy crude oil.

On 16 January 2014, the Secretary of Transportation met with members of the rail and the petroleum industries in a call-to-action meeting, to address the risks associated with the transportation of crude oil by rail.

On 22 January 2014, the AAR confirmed its agreement to apply, by no later than 01 July 2014, the routing requirements (49 CFR subsection 172.820) to trains carrying more than 20 cars of crude oil, as discussed at the 16 January call-to-action meeting. The AAR also agreed to further address risks by restricting the speeds of trains carrying more than 20 cars of crude oil to 50 mph, and to 40 mph for such trains with at least one DOT-111 or non-specification tank car travelling through high-threat urban areas, as designated by the Department of Homeland Security.

On 23 January 2014, as a result of its participation in the TSB's investigation into the Lac-Mégantic accident, the U.S. National Transportation Safety Board (NTSB) issued the following 3 safety recommendations to the FRA:

The NTSB also issued 3 safety recommendations to PHMSA, as follows:

On 25 February 2014, the U.S. DOT issued an emergency restriction/prohibition order requiring all shippers to test petroleum crude oil from the Bakken region to ensure that it is properly classified before it is transported by rail. The order also states that Class 3 petroleum crude oil shipped by rail must only be treated as a PG I or PG II hazardous material. This order was later amended and restated on 06 March 2014 to clarify its provisions.

On 09 April 2014, the FRA announced its intention to issue a proposed rule establishing minimum crew-size standards for most main-line freight and passenger rail operations. The notice of proposed rulemaking (NPRM) would require a minimum of 2-person crews for most main-line train operations, including those trains carrying crude oil. The FRA plans to issue an additional NPRM that would prohibit certain unattended freight trains or standing freight cars on main track or sidings, and require railroads to adopt and implement procedures to verify securement of trains and unattended equipment for emergency responders. It would also require locomotive cabs to be locked and reversers to be removed and secured. Railroads would also be required to obtain advance approval from the FRA for locations where or circumstances in which cars or equipment may be left unattended.

On 07 May 2014, the U.S. DOT issued an emergency restriction/prohibition order requiring all railroad carriers that transport in a single train 1 000 000 gallons or more of petroleum crude oil (UN 1267) from the Bakken shale formation to notify the appropriate State Emergency Response Commission of expected movements of such trains through their jurisdiction.

On 07 May 2014, PHMSA and the FRA jointly issued Safety Advisory Notice No. 14-07, urging railroad carriers transporting petroleum crude oil from the Bakken formation to use tank cars of the highest integrity within their existing fleet (see section 4.1.2.1).

4.1.13 Municipality of Nantes

Following the accident, the municipality of Nantes initiated a review of its rail response protocols and procedures.

4.2 Safety action in progress

4.2.1 Transport Canada oversight of regional railways

TC oversees railway safety by conducting inspections and audits. While inspections look at conditions (that is, what is wrong), audits look at systems and processes (that is, to identify why the conditions exist). Inspections should be used to help target future audits and to help monitor the corrective action taken following previous audits.

TC Headquarters oversees SMS in national railways and assigns the oversight of regional railways (both inspections and SMS audits) to its regional offices. These offices make the decisions on which regional railways will be inspected or audited, the scope of each activity, when they will be conducted, and with which frequency at each railway.

TC Quebec Region was inspecting and monitoring the operations, equipment, and infrastructure at MMA. For several years, MMA had been identified as a railway company with an elevated level of risk, requiring more frequent inspections. Through inspections, TC Quebec Region identified a number of ongoing safety deficiencies requiring safety action. TC Quebec Region issued a number of notices, notices and orders, letters of concern, and letters of non-compliance. Although MMA normally took action after the inspection to address the identified safety deficiency, it was not uncommon for similar deficiencies or risks to be identified during subsequent inspections.

TC Quebec Region was performing very few SMS audits, and was not following up on the corrective action plans that railways submitted to ensure that each railway's SMS was effective at reducing safety risks. In contrast, the Atlantic and Ontario Regions were much more active in auditing and follow-up.

As TC Headquarters did not review the oversight activities of its Regions, it was unaware that the Quebec Region was not following up on railways' corrective action plans or risk-mitigation activities. Although meetings were held between Regions and Headquarters several times per year, these meetings did not focus on regional railways. Consequently, TC Headquarters was unaware of the extent to which regional railways were implementing SMS and of the impact, or lack thereof, that SMS was having on each railway's safety performance. Without adequate oversight of regional activities by TC Headquarters, TC Regions may not be effectively ensuring that all of their regional railways have fully implemented their SMS. Consequently, TC cannot be assured that each regional railway's SMS is effective and improving safety.

The 2013 Fall Report of the Auditor General of Canada examined TC's quality management framework for its Rail Safety Program and found that TC had not assessed whether the oversight methodology for conducting audits and inspections met best practices, and whether audits and inspections were conducted according to that methodology. Consequently, the Office of the Auditor General (OAG) recommended that TC:

develop a detailed quality assurance plan to assess its oversight methodology against best practices and to regularly evaluate audits and inspections against its methodology, with the goal of promoting continuous improvement.^{Footnote 154}

TC agreed with this recommendation, stating that it will, by the fall of 2014:

strengthen its quality assurance program by including periodic assessments of its oversight methodology against best practices and assessing whether audits and inspections are being carried out in accordance with this methodology.^{Footnote 155}

If implemented, this action by TC would lead to a more robust regulatory oversight regime and promote continuous improvements in every regional railway's SMS. However, because TC's quality assurance program has not yet been implemented, it cannot be determined at this time whether the planned changes will be sufficient to ensure adequate Headquarters oversight of activities in all of TC's Regions. The Board considers it crucial that TC Headquarters follow through with the implementation of processes for it to confirm that all regional offices are effectively overseeing regional railways, including their safety management systems.

4.3 Safety action required

4.3.1 Prevention of runaway trains: Unattended equipment

In this accident, a 4700-foot train transporting petroleum crude oil that was parked on the main track ran away. It travelled 7.2 miles down a descending grade, gained speed, and derailed at 65 mph in the town of Lac-Mégantic, Quebec. Sixty-three tank cars spilled approximately 6 million litres of crude oil, which ignited, levelling buildings, destroying the centre of the town, and killing 47 people. There was environmental contamination of the downtown and of the adjacent river and lake.

In this accident, the train was secured at Nantes with both hand brakes and air brakes. However, a proper hand brake effectiveness test had not been conducted to ensure that the hand brakes alone would hold the train. When the locomotive supplying air pressure to the train was shut down, the air brake system leaked off in less than 1 hour. The force from the hand brakes was not sufficient to secure the train, and the train ran away.

Both air brake and hand brake systems are subject to failure, as the technology is not fail-proof.

For example, air brakes are prone to leakage and suffer from limitations in maintaining brake cylinder pressure; when brake pressure is low, fail-safe functions are compromised. In this accident, it took less than 1 hour for the air to be depleted to a point where it was no longer capable of holding the train on the 0.92% grade.

Hand brakes also have significant limitations, in that they cannot provide feedback to the operator about the force applied, and often do not provide the necessary braking force required due to their design and other mechanical and physical factors. In this accident, only 6 of the 7 hand brakes applied by the LE were providing retarding force, and the total force provided by the hand brakes was 48 600 pounds. As a result, it is necessary that a proper effectiveness test, as prescribed by railway operating instructions, be carried out to ensure effective securement of unattended equipment.

In the rail industry, these limitations in technology are addressed with the expectation that there will always be strict compliance with rules. For equipment securement, reliance is placed on CROR 112, company special instructions, and training. When failures occur, it is often concluded that either the rule or the operator is deficient and must therefore be corrected.

Training can improve the effectiveness of rules application. However, the Board found that some MMA employees lacked the knowledge or had not demonstrated the skills required to safely and competently perform their jobs. This included knowledge of the CROR and the performance of a proper hand brake effectiveness test. Similar deficiencies in training and rules compliance have been observed in a number of other TSB investigations. Of the 9 TSB investigations into runaway equipment carried out in the past 20 years, misinterpretation or misapplication of rules was identified in most to be a cause or contributing factor.

In a system where the final layer of defence is reliance on the application of hand brakes and an effectiveness test, there needs to be clear rules that are well understood and consistently applied. However, no matter how clear and comprehensive rules are, these are administrative defences and, invariably, there will be instances where practices in the field will deviate from these written rules and procedures. TSB investigations into the Lac-Mégantic accident and other runaways have revealed that the chain of events almost always included the application of an insufficient number of hand brakes to secure the train. This means that no matter how well the rule is worded, it will not always be strictly complied with, thereby introducing vulnerability into the safety system. The following TSB data suggest that these vulnerabilities are magnified at short line railways. Of 16 investigations involving short line railways in the past 20 years (including 6 runaways), deficiencies in rules compliance, misinterpretation and/or training have been identified as causal or contributing in 10 cases (62%).

Following this accident, regulators and industry examined the adequacy of CROR 112 with a view to strengthening the procedures. However, the new rule is convoluted, and in some cases, is less restrictive than its previous version. The rule contains a circular reference; paragraph (a) (v) refers to paragraph (c), whereas paragraph (c) (i) refers to paragraph (a).  Further, the rule states that  “instructions governing testing of hand brakes will be carried in special instructions” but does not explicitly state that the effectiveness of the hand brake(s) must be tested.

Furthermore, under certain circumstances while switching, the amended CROR 112 allows for trains to be left unattended for up to 2 hours on the main track on a grade of up to 1.25%, secured only with air brakes. This is in contrast with the previous rule that did not allow any equipment to be left unattended without hand brakes. The amended rule also does not take into consideration TC's emergency directive that did not allow any equipment carrying dangerous goods to be left unattended on main lines. The lack of clarity in wording of the rule, and its confusing construction, make it difficult to understand. Because this safety-critical rule is not well worded and more permissive than the emergency directive with respect to dangerous goods, there is an increased risk that equipment  will not be properly secured.

The train in Nantes ran away in 1 hour. The TSB has investigated other occurrences in which air leakage has resulted in trains running away, such as in Dorée, Quebec (R11Q0056), where the uncontrolled movement occurred in 1 hour. In consideration of the above and the advice of air brake manufacturers that air brake systems not be relied upon for securement, there is a risk that the 2-hour limit has reduced the margin of safety.

Even with the right rules, it has been demonstrated over the years that depending solely on the correct application of rules is not sufficient to maintain safety in a complex transportation system. The concept of “defence in depth” has shaped the thinking in the safety world for many years. Layers of defences, or safety redundancy, have proven to be a successful approach in many industries, including the space and nuclear industries, to ensuring that a single-point failure does not lead to catastrophic consequences.

There are physical defences to protect against the risk of runaway rolling stock, which are available to mitigate the risk of air brake pressure loss, and these include derails, wheel chocks, mechanical emergency devices, and locomotive auto-start systems. New technology is available, such as GPS-equipped devices that can be applied to a hand brake chain, allowing for the remote monitoring of the hand brake status. In addition, some existing technology, such as reset safety controls and sense and braking units, with minor programming changes, can offer additional protection.

Advanced air brake control valves, such as electronically controlled pneumatic (ECP) brakes, can provide added protection by overcoming some of the inherent limitations of the traditional air brake systems. ECP brakes protect against brake cylinder leakage, and will monitor brake pipe pressure and automatically generate an emergency brake application if the brake pipe pressure gets low. The instantaneous application and release of ECP brakes greatly diminishes in-train forces, reducing the risk of derailment. With ECP brakes, the brake pipe is solely dedicated to continuously supplying air, to keep all of the reservoirs charged on the train. ECP brakes also provide valuable information about the status of the train, and feedback on factors such as brake system health, brake pipe continuity, and the number of operative brakes.

The NTSB recently made a recommendation to address the need for redundant protection, such as wheel chocks and derails, to protect against runaway trains (NTSB Recommendation R-14-03 Urgent). The recommendation is derived from the NTSB's investigation into the collision between 2 Chicago Transit Authority trains that occurred on 30 September 2013, in Forest Park, Illinois.

The TSB has pointed out the need for robust defences to prevent runaways since 1996 (Rail Investigation R96C0172), and since then, there have been over 120 runaways in Canada that have affected main-track operations. Equipment runaways are low-probabilityevents, but as this accident demonstrates, they can have extreme consequences, particularly if they involve dangerous goods. As demonstrated in Lac-Mégantic, the cost to human life and our communities can be incalculable. For this reason, the Board recommends that:

4.3.2 Safety management system audits and essential follow-up

Managing risk to acceptable levels requires that railway companies analyze the findings of regulatory inspections and SMS audits, identify the underlying causes of these findings, and ensure that corrective actions are effectively implemented and are working. For railway companies to effectively manage risk using SMS, the related processes must not only be documented, they must be in place and actively used.

In addition, for effective regulatory oversight, the regulator must be assured that corrective action plans and measures to mitigate risks have been implemented. Furthermore, if they are not, the regulator must have the power to compel companies to improve their SMS.

Under TC Quebec Region, all railways had been the subject of a pre-audit to verify that the required SMS documentation was in place. However, audits assessing the effectiveness of the regional railways' SMS were extremely limited; some railways had never been the subject of an SMS audit, and none had been the subject of an audit of all SMS components. As such, the regulator could not know whether SMS at these railways was in place and working.

TC had identified a number of recurring problems at MMA. However, MMA had a poor history of analyzing and rectifying the systemic causes of these problems. Moreover, regional oversight did not identify or address this issue. Ten years after TC had informed MMA that it was in compliance with the SMS Regulations, MMA did not have a fully functioning SMS to effectively manage risk. The time between audits conducted at MMA, the limited scope of these audits, and the lack of regulatory follow-up on audit findings meant that the regulator remained unaware of the extent of the weaknesses in MMA's SMS. In contrast, other TC Regions were conducting more follow-ups to ensure corrective actions were addressing underlying causes or problems and were effectively improving safety.

In its 2013 report, the OAG concluded that “Transport Canada does not have the assurance it needs that federal railways have implemented adequate and effective safety management systems.”^{Footnote 156} The OAG recommended, among other things, that TC establish a minimum level of oversight for SMS, that TC have its inspectors assess the quality and effectiveness of railways' SMS, and that TC require federal railways to correct deficiencies affecting the safety of their operations. It also recommended that TC “conduct timely follow-up on deficiencies affecting the safety of federal railways' operations, to assess whether they have been corrected.”^{Footnote 157}

In response to these recommendations, TC indicated that it plans to improve procedures and training for inspectors and is pursuing a number of regulatory changes.

In the past, the Railway Safety Act and the SMS Regulations only allowed TC to require railway companies to have an SMS. They did not permit TC to assess the effectiveness of SMS components in order to determine whether the SMS was functioning properly and would therefore ensure a safe operation.

The 2013 amendments to the Act allow the Minister to order a company to take corrective measures where its SMS has deficiencies that risk compromising railway safety. The proposed Railway Operating Certificate and Administrative Monetary Penalty Regulations published in the Canada Gazette, Part I, in the spring of 2014, will also strengthen the Minister's enforcement powers. They are intended to provide the means for TC to encourage or require railway companies to address deficiencies without having to resort to prosecution. Whether monetary penalties or certificate action are a worthwhile tool in addressing an ineffective or poorly implemented SMS will depend largely on how and when these measures are applied.

Furthermore, proposed new SMS Regulations, if adopted in the spring of 2015, will provide greater accountability for SMS implementation within railways through, among other measures, the appointment of an accountable executive and requirements to designate persons responsible for individual processes and procedures outlined in a company's SMS. The regulations should also make it easier to assess a company's SMS against the regulatory requirements, as the new regulations clearly describe the expectations related to required processes. For example, the requirements for a risk assessment would be expanded to include a number of defined triggers where risk assessment must be done, a requirement to identify remedial actions stemming from the risk assessment, and a process for following up to ensure these remedial actions are implemented.

With the legal framework and enforcement tools in place, TC will have the ability to determine whether a company has implemented an effective SMS and to require changes where it finds deficiencies that compromise rail safety. Further, it would appear that TC intends to audit to ensure that railway companies are effectively using their SMS to improve safety. The regulatory impact analysis statement accompanying the proposed SMS Regulations states:

The oversight activities consist of a combination of inspections to verify compliance and audits to verify the effectiveness of company's safety management system. Once the proposed Regulations are in force, Transport Canada would continue to conduct a minimum baseline audit every five years for both railway and local companies. This audit cycle would be complemented by an emergent audit program where audits are conducted at any time during a year.^{Footnote 158}

However, although the impact statement specifies that audits would verify the effectiveness of a company's SMS, it is not clear how this would be carried out or whether the baseline audit would examine the effectiveness of all components of a company's SMS.

The success of this new approach in improving safety will depend on 2 factors. First, railways are rule-based cultures, and the full transition to SMS will require a cultural shift away from strict reliance on rules, to a culture that recognizes that administrative defences alone are not sufficient to maintain safe operations and that seeks to build multiple layers of defence to reduce risks.

Secondly, TC now has a legal and conceptual framework to require SMS implementation, but equally important is how the regulator uses these tools and what action it takes in the coming years. It is crucial that TC follow up on its commitments relating to SMS audits, and on truly ensuring that railways have an SMS in place that is capable of identifying risks and managing them to prevent accidents.

Until Canada's railways make the cultural shift to SMS, and TC makes sure that they have effectively implemented SMS, the safety benefits from SMS will not be realized.

Therefore, the Board recommends that:

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on July 2014. It was officially released on 19 August 2014.

Appendix A – Sequence of events

Notes:

• The data are from rail traffic control radio and telephone recordings, locomotive event recorder, 911 records, etc.
• For acronyms, see Appendix L – Glossary.

Appendix B – MMA-002 train consist

Appendix C – Sources of measurable air leakage from each locomotive on MMA-002

Appendix D – Previous brake testing for other occurrences

The TSB has investigated several other runaway train accidents where extensive hand brake tests were conducted (Coal Valley, Alberta, in 1995 [R95C0282]; Edson, Alberta, in 1996 [R96C0172]; and Dorée, Quebec, in 2011 [R11Q0056]). The following was determined:

• In the case of the 3 runaways, an average of 65 to 80 foot-pounds of torque had been applied on the hand brakes.
• For a constant torque (for example, 80 foot-pounds), the applied force on the wheels varied from 12 000 pounds to 21 000 pounds.
• With 8 hand brakes applied at 125 foot-pounds of brake wheel torque, the 55 cars would have moved down the 0.65% grade. (TSB Rail Investigation R95C0282)
• The cars remained stationary until the air brakes leaked off and released after approximately 7 hours in extreme cold. The retarding brake force was attributed to the applied hand brakes and the air brakes that had not completely released. (TSB Rail Investigation R95C0282)
• There was no guidance from the railway with respect to the sufficient number of hand brakes.( TSB Rail Investigation R95C0282)
• Hand brake operators do not receive any definitive feedback to confirm that sufficient brake shoe force has been attained. (TSB Rail Investigation R96C0172)
• Given the available guidelines and instructions, determining what is a sufficient hand brake application requires more information than the employees had available to them. (TSB Rail Investigation R96C0172)
• Training can provide a better understanding of the relevant variables affecting hand brake effectiveness. (TSB Rail Investigation R96C0172)
• The majority of the car brake cylinders leaked off after approximately 1 hour following the emergency brake application. The leakage was due to the poor condition of the cars. (TSB Rail Investigation R11Q0056)
• To determine the sufficient number of hand brakes to be applied, employees rely on their personal experience gained in situations where cars have either not moved or ran away. (TSB Rail Investigation R11Q0056)
• Without specific instructions that take into consideration local conditions, there is a risk that the number of hand brakes required to secure a train on a steep grade will be underestimated. (TSB Rail Investigation R11Q0056)

Appendix E – Track geometry inspection of the Montreal, Maine & Atlantic Railway Sherbrooke Subdivision, between Mile 0.0 and Mile 1.0 (21 August 2012)^{Footnote 159}

Appendix F – Summary of crude oil testing results

The crude oil testing (Engineering Laboratory Report LP148/2013) focused on the characteristics relevant to the classification of the petroleum crude oil, as well as its behaviour and effects during the post-accident spill and fire.

Characteristic determined	Method	Purpose	Results
Flashpoint (closed-cup)	ASTMFootnote 160 D93	Determine the tendency of the product to form a flammable mixture with air under controlled conditions	< −35 °C
Initial boiling point (atmospheric distillation)	ASTM D86	Determine the lightest fractions present in the product for the purpose of regulatory classification	43.9 °C to 50.0 °C
Density	ASTM D5002	Determine the tendency of the product to sink or float on water	815.9 kg/m3 to 821.9 kg/m3
API gravity	Calculated		41.8 to 40.5°
Reid vapour pressure	ASTM D323 Procedure A	Determine the rate at which the product will evaporate	62.3 kPa to 66.1 kPa
Pour point	ASTM D5853	- Determine the handling characteristics of the product at low temperatures - Determine the rate at which spilled product in the environment will spread and the extent to which it will penetrate the soil	< −65 °C
Viscosity (kinematic)	ASTM D7042		2.882 centistokes (cSt) to 3.259 cSt at 20 °C
Sulphur content (total)	ASTM D4294	- Characterize the product as a sweet or sour crude oil - Determine whether the product presents health hazards to on-site personnel	0.096 mass % to 0.117 mass %
Volatile organic compounds (BTEX: benzene, toluene, ethylbenzene, xylene)	Gas chrom-atography mass spectrometry	Determine whether the product presents health hazards to on-site personnel	Benzene: 1470 ppm to 1850 ppm
			Toluene: 2770 ppm to 3170 ppm
			Ethylbenzene: 768 ppm to 852 ppm
			m/p-Xylene: 2890 ppm to 3500 ppm
			o-Xylene: 1500 ppm to 1660 ppm
Heat of combustion	ASTM D240	Determine the total amount of energy that can be released when the product is burned to completion	42.905 MJ/kg to 45.160 MJ/kg

Appendix G – Safety data sheets of the product loaded in the accident train

A review of the 10 safety data sheets (SDSs) of the product loaded in the accident train determined the following:

• While most of the SDSs were generic, 1 referred to the product as “Bakken crude”.
• There were differences in the chemical composition information presented in the SDSs. For example, while most SDSs identified benzene concentration values ranging between 0% and 1% by weight, 2 SDSs identified benzene concentration values of 2% and 9% respectively.
• All 10 SDSs contained dangerous goods classification and transportation information. All 10 SDSs identified the product as UN 1267, petroleum crude oil, Class 3.
• With respect to packing groups (PGs), the following information was provided:
• 3 SDSs indicated that the product was a PG I, including the one that described the product as “Bakken crude”;
• 1 SDS that described the product as “Alaska Beaver Creek Crude Oil” indicated that it was PG II;
• 1 SDS indicated that the product was a PG III;
• 1 SDS indicated that the product was a PG I or PG II;
• 2 SDSs did not indicate a PG, but stated that the flashpoint and explosive limits are highly dependent on crude oil source; and
• 2 SDSs indicated that it was necessary to “determine flashpoint to accurately classify packing group.”

Appendix H – Other short line runaway train accidents investigated by the Transportation Safety Board

Since 2005, the TSB has conducted 9 investigations into runaway train events. In addition to this accident, 5 others have involved short line railway operations.

R11Q0056: On 11 December 2011, in Dorée, Quebec, a Quebec North Shore & Labrador Railway (QNS&L) freight train, with 2 locomotives and 112 Labrador Iron Mines (LIM) gondola cars, was experiencing problems with its automatic and dynamic brakes. It had been secured by the locomotive engineer on a steep grade with the train air brakes and 35 hand brakes. One hour later, the train’s air brakes released, and the 35 hand brakes proved insufficient to hold the train. The locomotive engineer, who was finishing applying hand brakes on the train and waiting for assistance, saw the train moving and jumped on board the lead locomotive. He applied the dynamic brakes, which were not working properly, but the train continued to accelerate as it descended the grade. The train finally stopped when the track leveled off. No one was injured. In March 2012, the Newfoundland and Labrador government ordered thorough brake inspections on each of the iron ore cars. Transport Canada (TC) conducted a safety inspection in Sept-Îles, Quebec, that revealed many air brake deficiencies (for example the brake cylinders were not remaining applied). On 09 February 2012, a notice was issued under section 31 of the Railway Safety Act (RSA) to QNS&L regarding damaged rail cars being placed in service or continuing to be in service. The Newfoundland and Labrador government ordered LIM to conduct single-car tests on all its cars. All the necessary work for the cars to comply with the Association of American Railroads (AAR) specifications was completed. QNS&L modified its inspection and brake-test procedures for LIM cars; it now conducts walking brake tests to examine brake cylinders and brake shoes. QNS&L also committed to define the minimum number of required hand brakes to secure cars on heavy grades.

R09T0057: On 11 February 2009, in Nanticoke, Ontario, a Southern Ontario Railway (SOR) 0900 Hagersville Switcher, consisting of 4 locomotives and 43 predominantly dangerous goods and special dangerous goods tank cars, ran uncontrolled from Mile 0.10 to Mile 1.9 of the Hydro Spur track. Although the train had a 3-person crew, it had been secured by a single crew member on a 1% grade. After the last crew member departed, the train’s automatic brakes released, and the hand brakes were insufficient to hold the train. It ran away, reaching a speed of 20.7 mph, before travelling over a split-switch derail and derailing 9 loaded dangerous goods tank cars. The split-switch derail had been installed at this location because of a previous runaway train accident in 1996 at the same location.

Three Class 111 tank cars loaded with gasoline (UN 1203, flammable liquid) were breached and released approximately 31 000 litres of gasoline. The gasoline did not ignite during the derailment. Two nearby homes were evacuated.

The TSB report noted the following:

• Securing a train consisting predominantly of dangerous and special dangerous goods, adjacent to a major refinery on a descending grade, requires increased vigilance to safely complete the task.
• When only 1 crew member is left to complete train securement tasks at the end of a work shift, the risk for runaway equipment is increased.
• With only 1 crew member left at the end of the shift, the other crew members did not have the opportunity to verify whether the train was properly secured.
• Insufficient company oversight allowed deviations in standard operating practices to occur.

On 20 February 2009, TC issued a notice and order under subsection 31(3) of the RSA, which required SOR management to report in writing by 06 March 2009 how the company intended to resolve the hazard or condition resulting from the failure of SOR employees to properly secure unattended equipment on the Hydro Spur at Nanticoke. On the same day, SOR issued 2 operating bulletins relating to the practice of leaving unattended cars or trains on the Hydro Spur. TC conducted inspections under its audit program between May and August 2009, and conducted follow-up interviews with selected members of management and employees.

R08V0270: On 29 December 2008, in Waneta, British Columbia, a Kettle Falls International Railway assignment with 2 locomotives and 12 cars started moving while switching and quickly began to head down a steep grade. When the train, with insufficiently charged air brakes, accelerated to about 20 mph, the locomotive engineer jumped from the train into deep snow and sustained minor injuries. The runaway train collided with stationary cars after travelling 2.8 miles, causing it to derail, along with some of the stationary cars. Subsequent to the accident, TC performed a regulatory inspection which led to the issuance of a notice and a notice and order under Section 31 of the RSA on 12 January 2009. The notice indicated that the operation of movements on grade without a complete understanding of the operation of the air brake system and the functionality of locomotive control features may result in experiencing an uncontrolled movement with serious consequences. The notice and order indicated that the lack of clear train handling instructions related to switching and descending the grade can lead to operating crews descending this grade with less than adequate air and operative brakes to properly control the movement.

R06V0183: On 03 September 2006, in Log Cabin, British Columbia, a White Pass and Yukon Route (WP&YR) work train, consisting of 1 locomotive and 8 overloaded ballast cars, ran away down a steep grade. The train reached a speed of about 45 mph before the locomotive and 6 of the cars derailed on a sharp curve. One person was fatally injured, and 3 others were seriously injured. The TSB determined that the train was too heavy due to overloading, and it is likely that the brake systems on all of the ballast cars were functioning at a diminished capacity. On 23 November 2006, the TSB issued to TC Rail Safety Advisory 07/06, Pressure Retaining Valves on WP&YR Ballast Car, indicating that TC may wish to assess the extent to which management ensures that cars are properly equipped and maintained, and that train crews handling these cars have adequate instruction and training to ensure that sufficient control is exercised on mountain grades. On 30 November 2006, the TSB issued to TC Rail Safety Advisory 08/06, Overloading of WP&YR Ballast Cars, indicating that TC may wish to assess the loading practices of engineering service cars. On 12 December 2006, TC issued a letter of non-compliance and a notice to WP&YR citing violations of various TC regulations referenced under the RSA concerning hazards and conditions related to the ballast cars and to the operation of ballast trains. On 05 June 2007, TC issued a notice and order requiring that trains not operate in certain areas unless they are equipped with a system that ensures direct positive communication with the RTC and that facilitates emergency calling recognizable by the RTC. From 04 to 07 June 2007, TC conducted an SMS audit. Following are some of the findings relevant to this investigation:

• Risk assessments were not being carried out.
• WP&YR was in non-compliance with the Railway Employee Minimum Qualification Standards Regulations (1987-3).
• There was no documented process describing how the company carries out air brake tests and how it ensures compliance with the Railway Freight and Passenger Train Brake Rules.

On 11 June 2007, TC issued a notice to WP&YR concerning several hazards and conditions related to the reliance by the railway on employee familiarity for protection on the main track. TC also sent a letter in regard to train-operation monitoring activities, which revealed several safety-related deficiencies. On 31 July 2007, TC sent a letter to WP&YR directing them to conduct a formal risk assessment on the safe operation of rolling stock when descending grades are greater than 2% and to then develop written procedures. On 31 July 2007, a TC issued a direction to the WP&YR concerning their contravention of Part II of the Canada Labour Code regarding the provision of information, training, and instructions to operating employees. WP&YR replied to TC indicating that numerous measures had been taken, such as in training, communications, operating bulletins, and mechanical equipment. WP&YR also provided TC with its corrective action plan to address the findings in TC’s report on the June 2007 audit.

R05H0011: On 02 May 2005, in Maxville, Ontario, an Ottawa Central Railway (OCR) freight train left 74 cars on the main track with the air bottled at Mile 34.65 of the Alexandria Subdivision while the head-end movement went to switch 2 cars into a customer’s spur. As the movement entered the spur, the 74 cars rolled uncontrolled and collided with the movement. As a result of the collision, a Class 111 tank car loaded with denatured alcohol was punctured, and about 98 000 litres of product was released. Approximately 200 people were evacuated for 8 hours. There was no derailment and there were no injuries. After the accident, OCR informed all employees about the risks associated with the practice of bottling the air. For 2 months after the accident, OCR doubled the number of train crew observations, emphasizing the securement of unattended cars while performing en route switching. The number of safety audits performed in 2005 was doubled. OCR also purchased a portable input and display unit (IDU) for transportation supervisors to remotely monitor the end-of-train air brake pipe pressure.

In all these occurrences, the investigation into the operations of these railways identified safety deficiencies in training, oversight, and operational practices. Although the companies had filed safety management system documentation as required by TC, the safety management system was not being used to identify and proactively address deficiencies through formal risk assessment or continuous improvement processes.

Appendix I – Single-person freight train operations

Single-person train operations implementation outside Canada

Single-person train operations (SPTO) have been implemented in other parts of the world, including the United States, Europe, Australia, and New Zealand. For example, Danish and Swedish railways use sophisticated automatic train control (ATC) technologies to enforce signal and speed regulations. British railways use an audio-visual safety device called an advance warning system, which warns the driver of signal aspects. A driver's failure to acknowledge the restrictive signal warnings results in the automatic braking of the train. Tranzrail uses a vigilance device that sounds an alarm and stops the train if the driver fails to respond to its demands.

As previously mentioned, SPTO has also been implemented in the United States.

In the 1990s, the SPTO technology later used by MMA was developed and introduced as an efficiency measure at Wisconsin Central Limited (WC). The Federal Railroad Administration (FRA) was not made aware that WC had started SPTO until after a serious train accident (involving a 2-person crew) in Weyauwega, Wisconsin, in March 1996. Operation, maintenance, training, and funding issues were identified at WC during the accident investigation, conditions also identified at a subsidiary company, Tranz Rail Holdings Limited (Tranz Rail), in New Zealand.

In December 2004, MMA's operations in the United States began running dark territory^{Footnote 161} SPTO trains. SPTO operations at MMA had also commenced without FRA awareness. After the FRA became aware of MMA's SPTO operations in 2006, MMA indicated that SPTO had been used successfully on its United States network for about 2 years. MMA was allowed to continue its SPTO. However, the FRA required MMA to produce written SPTO special operating instructions.

In Australia, the Rail Safety Regulators' Panel^{Footnote 162} produced a guidance document for driver-only operations (DOO, the equivalent term in Australia for SPTO). The related regulatory legislation was developed, in conjunction with the rail industry and rail unions. Key elements include:

• Responsibility for the granting and monitoring of accreditation of single-person train operators lies with the local regulators.
• The appropriateness of the operators' approach to SPTO is considered as part of the accreditation process.
• Accreditation is only for the SPTO program as narrowly defined. Any change to the program requires re-accreditation (for example, the introduction of dangerous goods unit trains).
• Risks need to be mitigated “so far as is reasonably practicable”(SFAIRP); this includes considering the likelihood, degree of harm, what can be reasonably known about the risk, the availability of risk-reducing means, and the cost of eliminating the risk.
• Crew cabs must be designed for SPTO, crews must be trained, and clearly defined operating limits must be enforced.
• SPTO must be validated through consultation with stakeholders, including written agreements and testing, as well as trialling before implementation.
• SPTO must be reviewed and approved through a robust assessment by the rail safety regulator, in a manner similar to any other aspect of the company SMS.
• The applicant must provide supporting documentation that demonstrates that SPTO risks have been identified and evaluated, and that controls have been established that achieve management of risk SFAIRP.
• The plan needs to address minimum operating standards in situations where the work conditions have degraded.
• All SPTO-compliant equipment must be documented.
• It should be recognized that the work conditions can skew a worker's willingness to accept SPTO work, and workers should be empowered to refuse work if appropriate controls are not functional. The document recognizes that, when commercial, social, and industrial pressures are applied, it may be unlikely that a worker will refuse to work, even if work conditions are degraded.
• All accreditation decisions and variations are to be documented.

Appendix J – Estimated number of hand brakes to secure MMA-002

The table below shows a summary of the estimated number of hand brakes required to safely secure MMA-002 in various scenarios, based on the factors identified in section 2.3.1. and the brake testing results.

The highlighting in the table indicates the minimum and maximum estimated number of hand brakes required for each scenario (depending on torque and coefficient of friction).

Scenario	Coefficient of friction	Number of hand brakes required
		80 foot-pounds of operator-applied torque	100 foot-pounds of operator-applied torque
With no air brake application on the cars and including hand brakes on the locomotive consist	0.38	25.9	21
	0.45	22.2	18
When hand brakes are applied after a 13-psi air brake application, including hand brakes on the locomotive consist (the accident scenario)	0.38	19.9	16.4
	0.45	17.2	14.2
With no air brake application on the cars and hand brakes applied on the cars only	0.38	24.0	19.1
	0.45	20.3	16.1
When hand brakes are applied after a 13-psi air brake application and applied on the cars only	0.38	17.1	13.6
	0.45	14.5	11.5

Notes:

• The stationary coefficient of friction between brake shoe and wheel surfaces is 0.38 for normal condition (Wabtec source) and 0.45 for extremely dry clean.
• A rolling resistance of 2.15 pounds/ton is used.
• For scenarios showing a 13-psi air brake application, a 40% improvement in hand brake force was included based on testing.

Appendix K – TSB Laboratory reports

The following TSB Laboratory reports were completed, and are available at www.tsb.gc.ca:

• LP132/2013 – End of Train Telemetry Download and Analysis
• LP136/2013 – LER Data Retrieval and Analysis
• LP141/2013 – Lac-Mégantic Video Analysis
• LP148/2013 – Analysis of Crude Oil Samples
• LP149/2013 – Field Examination of Tank Cars
• LP151/2013 – Examination of Switch Frog
• LP152/2013 – Examination of Box Car Wheel Set
• LP165/2013 – Tank Car Volume Measurements
• LP167/2013 – Site Survey and Grade Calculations
• LP168/2013 – Metallurgical Analysis of Tank Car Coupons
• LP181/2013 – Locomotive Engine Fire Examination
• LP182/2013 – Examination of Locomotive Wheels and Brake Shoes
• LP184/2013 – Examination of Knuckle and Pin
• LP185/2013 – Examination of Locomotive Air Brake
• LP187/2013 – Brake Force Analysis
• LP188/2013 – Dynamic Simulation and Derailment Forces Analysis
• LP233/2013 – Locomotive Electrical Examination
• LP039/2014 – Derailment Speed Calculation

Appendix L – Glossary

AAR

Association of American Railroads (United States)

API

American Petroleum Institute

ASLRRA

American Short Line and Regional Railroad Association (United States)

ASTM

American Society for Testing and Materials

b/d

barrels per day

BOV

bottom outlet valve

CANUTEC

Canadian Transport Emergency Centre

CFM

cubic feet per minute

CFR

Code of Federal Regulations (United States)

CN

Canadian National

CPR

Canadian Pacific Railway

CROR

Canadian Rail Operating Rules

CSA

Canadian Standards Association

CTA

Canadian Transportation Agency

CTC

centralized traffic control

CWR

continuous welded rail

DG

dangerous good

DOT

Department of Transportation (United States)

ECP

electronically controlled pneumatic (braking system)

ERAP

Emergency response assistance plan

ERG

Emergency Response Guidebook

FRA

Federal Railroad Administration (United States)

GE

General Electric Company

GM

General Motors

GOI

General Operating Instructions

GSI

General Special Instructions

IIS

Inspection Information System (TC)

Irving

Irving Oil Ltd.

kip

kilopound (1 kip = 1000 pounds)

km/h

kilometres per hour

LE

locomotive engineer

LER

locomotive event recorder

m

metres

mm

millimetres

MMA

Montreal, Maine & Atlantic Railway

mph

miles per hour

NB Southern

New Brunswick Southern Railway

NRC

National Research Council of Canada

NTSB

National Transportation Safety Board (United States)

OAG

Office of the Auditor General

OB

Operating Bulletin

OTIS

Operational Tests and Inspections Program

PDD

proximity detection device

PG

packing group

PHMSA

Pipeline and Hazardous Materials Safety Administration (United States)

PRD

pressure relief device

psi

pounds per square inch

QNS&L

Quebec North Shore and Labrador Railway

QRB

quick release brake (valve)

QSR

Quebec Southern Railway

RAC

Railway Association of Canada

RODS

Rail Occurrence Database System (TSB)

RSA

Railway Safety Act

RSC

reset safety control

RSI

railway safety inspector

RTC

rail traffic controller

RWI

Rail World, Inc.

SBU

sense and braking unit

SDS

safety data sheet

SMS

safety management system

SMS Implementation Guide

Guide for Developing, Implementing and Enhancing Railway Safety Management Systems

SMS Manual

Safety Management System Manual (MMA)

SMS Regulations

Railway Safety Management System Regulations

SOR

Southern Ontario Railway

SPTO

single-person train operations

SQ

Sûreté du Québec

SSO

Safety Systems Overview

SST

Strobel Starostka Transfer, LLC

STD

start-to-discharge (pressure)

TC

Transport Canada

TDG

transportation of dangerous goods

TDG Act

Transportation of Dangerous Goods Act

TDG Regulations

Transportation of Dangerous Goods Regulations

Tranz Rail

Tranz Rail Holdings Limited (New Zealand)

TSB

Transportation Safety Board of Canada

TSR

Track Safety Rules

UN

United Nations (product code)

VIA

VIA Rail Canada Inc.

WC

Wisconsin Central

WFSI

World Fuel Services, Inc.

3D

three-dimensional

°

degrees

°C

degrees Celsius

%

per cent