Railway Investigation Report R13T0060

On 03 April 2013, at about 0750 Eastern Daylight Time, Canadian Pacific Railway freight train 420-02 was proceeding eastward at 34.9 miles per hour on the Heron Bay Subdivision when it experienced an undesired emergency brake application at Mile 9.16 near White River, Ontario. Subsequent inspection determined that 22 cars (19 loads and 3 empties) had derailed, 7 of which were dangerous goods tank cars loaded with petroleum crude oil (UN 1267). During the derailment, a number of cars rolled down an embankment. Two of the dangerous goods tank cars released approximately 101 700 litres of product, and another non-dangerous goods tank car released approximately 18 000 litres of product. There were no injuries.

On 29 March 2013, Canadian Pacific Railway (CP) freight train 118-29 departed Edmonton, Alberta. Prior to departure, CP 118-29 received a mechanical inspection and a No. 1 air brake test performed by certified car inspectors. CP 118-29 travelled eastward from Edmonton to Thunder Bay, Ontario, without incident.

As governed by Canadian Rail Operating Rules (CROR) Rule 110, CP 118-29 was subjected to a number of roll-by inspections at crew change-out locations and by crew members of trains met en route. CP 118-29 also traversed a number of wayside inspection systems (WISs), which included wheel impact load detectors (WILDs) and hot bearing detectors (HBDs). No significant defects were identified during any of the inspections. Upon arrival at Thunder Bay, dangerous goods (DGs) tank car DBUX 302383 (loaded with petroleum crude oil, UN 1267) and a number of other cars were set out and then added to CP freight train 420-02 (the train).

At 1800^{Footnote 1} on 02 April 2013, the train departed Thunder Bay destined for Toronto, Ontario. The train arrived at Schreiber, Ontario, at 0240 on 03 April 2013. After a crew change, 3 cars were set out, and the train departed Schreiber at 0321. The train now consisted of 3 locomotives and 111 cars (47 loads and 64 empties). Twenty-two of the loaded cars were tank cars transporting DGs. The train was 8198 feet long and weighed 9535 tons.

The train crew consisted of a locomotive engineer, a conductor who was also receiving on-the-job training as a locomotive engineer trainee, and a brakeperson. The train crew met fitness and rest standards and were familiar with the Heron Bay Subdivision.

Subdivision and track information

In the vicinity of the accident, the CP Heron Bay Subdivision is Class 4 single main track that extends westward from White River (Mile 0.0) to Schreiber (Mile 118.3). Train movements on the subdivision are governed by the centralized traffic control (CTC) system, as authorized by the CROR and controlled by a rail traffic controller (RTC) located in Montréal, Quebec. The authorized speed for freight trains in the area was 45 mph.

The track structure in the vicinity of the derailment consisted of 115-pound continuous welded rail (CWR), rolled in 2001 and 2004 by manufacturers Nippon and Rocky Mountain respectively. In the vicinity of the accident, there was a 3°, 33-minute, left-hand curve, with an average superelevation of 3.5 inches. The rail was in good condition. It was set into double-shouldered tie plates, secured to No. 1 hardwood ties with 5 spikes per plate, and box-anchored every other tie. The cribs were full, and the ballast shoulders ranged from 12 to 18 inches beyond the ends of the ties.

The track was visually inspected in accordance with Transport Canada (TC)-approved Track Safety Rules on 01 April 2013, with no defects observed. The 2 most recent track geometry tests were conducted on 01 August 2012 and on 27 November 2012, respectively. Although some priority and urgent defects were identified, they were corrected subsequent to the testing. No other defects were observed.

The accident

At about 0750, the train was proceeding eastward at 34.9 mph when it experienced an undesired emergency brake application at Mile 9.16 of the Heron Bay Subdivision near White River, Ontario (Figure 1).

Subsequent inspection determined that 22 cars (19 loads and 3 empties) had derailed, 7 of which were DG tank cars loaded with petroleum crude oil (UN 1267). During the derailment, 4 DG tank cars rolled down an embankment. Two of the DG tank cars, and a third tank car loaded with canola oil, released product. There were no injuries.

The temperature at the time of the occurrence was –11°C. The sky was clear.

Emergency response and deployment

The Transportation Safety Board of Canada (TSB) was advised of the occurrence at 0905 and deployed investigators at 0930. CP dispatched emergency responders and commenced site mitigation activities. At 1030, while en route, TSB investigators contacted CP site officials. A discussion ensued, and CP officers on site were permitted to move cars not involved in the derailment, but were instructed to protect the point of derailment and other derailed cars. If it was necessary to move other cars to address environmental concerns, TSB investigators were to be consulted, and any cars or areas that were to be disturbed were to be documented and photographed. CP employees had local radio communication and cell phone coverage within the vicinity of the accident site.

The TSB arrived at White River at about 2230. Local residents reported that there had been a fire on the derailment site, and the local fire department had responded earlier that evening. Fire department logs indicate that the fire department was dispatched to a flare-up of released product at the accident site at 2055. The fire was extinguished, and the fire department returned to the station at 2255.

The TSB arrived on site at about 2330. There was no formal incident command structure in place, there was no sign-in sheet to keep track of staff on site, and no safety briefing was conducted to review any potential dangers of released product. Access to the site was virtually unrestricted, with no visible safety perimeter. During a subsequent meeting with CP officials, the TSB was informed that about 5 barrels (900 litres) of petroleum crude oil (crude oil) had leaked from the tanks. A more detailed site inspection was planned for the following day.

Overnight, CP's environmental consultant implemented a site air monitoring/sampling plan. No community or perimeter monitoring was initiated, as it was deemed unnecessary. On 04 April 2013, the Ontario Ministry of the Environment confirmed that one of the tank cars containing crude oil had lost most of its load the previous day. CP revised its estimate of the amount of product lost to about 63 000 litres. On 10 April 2013, the CP estimate was again revised to approximately 101 700 litres of crude oil and 18 000 litres of canola oil.

Site examination

On 04 April 2013, the initial TSB site examination commenced. Minor rail damage was observed on the head of the south rail at about Mile 12.4. The damage continued intermittently, primarily on curves on the south rail up to the derailment area, where a broken rail was observed in the low rail of a 3°, 33-minute, left-hand curve  at Mile 9.41 (Photo 1). Several large pieces of a wheel rim were located near the broken rail.

Subsequent examination identified that DG tank car DBUX 302383 (loaded with petroleum crude oil, UN 1267), the 34th car from the head end, sustained a broken R1 wheel (south rail) of the trailing truck. A non-condemnable slid flat was observed on the mate (L1) wheel tread in line with a suspected fracture origin on the R1 wheel. The car was upright, had not derailed, and was located east of the derailment site (Photo 2).

The 35th car did not derail; however, the following 22 cars (lines 36–57) derailed primarily to the low (south) side of the curve. A number of the cars slid down a 90-foot embankment and came to rest in various positions (Figure 2).

While on site, the smell of crude oil was prevalent. During site remediation, a CP subcontractor operating a bulldozer equipped with a sideboom tipped over and fell partway down the embankment while trying to move a car. The operator sustained minor injuries, but refused medical attention and returned to work.

Following site mitigation, the 3 tank cars that released product were off-loaded, then re‑positioned and cleaned in preparation for detailed examination. The broken rail, the No. 1 wheel set from DBUX 302383, and the recovered wheel pieces were removed and forwarded to the TSB Laboratory for examination. Tank car DBUX 302383 was forwarded to CP Agincourt Yard in Toronto for brake force testing.

Crude oil

Crude oil, an unrefined petroleum product, can be refined to produce products such as gasoline, diesel fuel, and other petrochemicals. Crude oil can range in viscosity and varies in colour from black to yellow, depending on its hydrocarbon composition.

The Transportation of Dangerous Goods Regulations (TDG Regulations),Part 2, set forth the requirements for classifying Class 3 flammable liquids. Class 3 flammable liquids are further divided into 3 packing groups (PGs), with PG I having the highest hazard and PG III, the lowest. The PGs are defined by the flash point, which is the temperature at which the product's vapours can ignite in controlled circumstances, and by the boiling point of the product. The criteria for each PG are as follows:

• PG I, if the product has an initial boiling point of 35°C or less at an absolute pressure of 101.3 kPa and any flash point
• PG II, if the product has an initial boiling point greater than 35°C at an absolute pressure of 101.3 kPa and a flash point less than 23°C
• PG III, if the criteria for inclusion in PG I or II are not met.

Products with lower flash points (i.e., PG I and II) are more prone to ignition at ambient temperatures when involved in a transportation accident (i.e., they typically generate more flammable vapours at normal ambient temperatures). TSB Laboratory Report LP148/2013, released publicly on 06 March 2014 as part of the Lac-Mégantic investigation (TSB Rail Investigation Report R13D0054), determined that the crude oil involved in that accident had been categorized as PG III, but met the PG II criteria, and had volatility comparable to that of a condensate or gasoline product.

In this occurrence, the waybill information for TILX 198203 and TILX 192186 described the product as petroleum crude oil, UN 1267, Class 3 flammable liquid, PG II.

The 2012 Emergency Response Guidebook

Guide 128 of the 2012 Emergency Response Guidebook identifies potential hazards of the product and provides guidance for emergency response and public safety. Under Potential hazards, the guide states the following, in part, about flammable liquids of the type that includes crude oil:

• They are lighter than water, are highly flammable, and “will be easily ignited by heat, sparks or flames.”^{Footnote 2}
• “[V]apors are heavier than air. They will spread along ground and collect in low or confined areas (sewers, basements, tanks).”^{Footnote 3} These “vapors may form explosive mixtures with air” and “may travel to source of ignition and flash back.”^{Footnote 4}
• They are associated with a “vapor explosion hazard indoors, outdoors or in sewers,”^{Footnote 5} and “containers may explode when heated.”^{Footnote 6}

With regard to emergency response and public safety, the guide states, in part, that water spray, fog, or regular foam should be used to fight fire, and straight streams of water should not. Because these products have a very low flash point, water spray may be inefficient and vapour suppressing foam may be necessary to reduce vapours. For a spill or leak, the guide specifies the following:

• Consider initial downwind evacuation for at least 300 meters (1000 feet).

[…]

• ELIMINATE all ignition sources (no smoking, flares, sparks or flames in immediate area).
• All equipment used when handling the product must be grounded.
• Do not touch or walk through spilled material.
• Stop leak if you can do it without risk.
• Prevent entry into waterways, sewers, basements or confined areas.

[…]

• Absorb or cover with dry earth, sand or other non-combustible material and transfer to containers.
• Use clean non-sparking tools to collect absorbed material.^{Footnote 7}

Incident command

When dealing with Class 3 flammable liquid PG II products in an emergency response situation, industry best practice requires that a formalized incident command structure (ICS) be established to manage the response.

ICS has been used extensively by the military, firefighters, police services, and hazardous material emergency response teams, and has been incorporated into law in the United States since March 1990.^{Footnote 8} ICS is a response management system, developed to organize people, equipment, and resources to respond to any emergency situation, including fire and hazardous materials incidents. In Canada, when ICS is established for fire and hazardous materials incidents, the local fire chief or provincial fire official (fire commissioner) may assume the role of incident commander. When a fire chief or provincial official is not directly involved, the senior railway company officer on site will usually implement ICS and manage remediation activities.

A properly implemented ICS would comprise, but not be limited to

• an incident commander who is responsible for overview of the incident;
• ICS command staff with clear lines of responsibility and consisting of a public information officer, site safety officer, logistics and planning officer, and other positions, depending on the size and complexity of the incident;
• a site perimeter with adequate security to control access;
• a dedicated command post to facilitate meetings and briefings;
• a controlled site entry access point;
• a site control system, with sign-in sheets and tags to keep track of all personnel on site and coordinate activities;
• oversight of all interventions to ensure that they are appropriate and use equipment that is compatible for the product involved (in the case of flammable liquids, this would include use of non-sparking tools, intrinsically safe electronics and grounded equipment to prevent igniting a flare-up); and
• oversight of mitigation activities to ensure that they are properly coordinated and supervised for safety.

Site environmental mitigation

Initially, containment and collection trenches were constructed to remove the released crude oil and canola oil. These efforts prevented the released products from reaching the White River. Following the fire that flared up on the evening of 03 April 2013, the White River Fire Department, with aid from other fire departments, were on site 24 hours a day for the duration of the cleanup, beginning on 04 April 2013.

Site monitoring commenced with the installation of 27 groundwater monitoring wells and collection of surface water samples from multiple locations along the White River. Impacted soil (about 12 000 m³) was excavated and placed into lined containment cells on site. Between 08 April and 04 September 2013, about 2.6 million litres of oily water was removed for off-site treatment at an Ontario Ministry of the Environment (MOE)-approved facility in Thunder Bay, Ontario. Solid products released during the derailment were either disposed of at an approved landfill or were recycled.

Between 07 August and 09 September 2013, approximately 20 210 tonnes of impacted soil was transported to a landfill owned by the Ontario Ministry of Natural Resources (MNR) located in Havilland, Ontario. Following the soil excavation activities, an additional 12 monitoring wells were installed. Recovered groundwater samples showed 2 limited areas with petroleum hydrocarbon concentrations above the applicable MOE standards, and 5 additional monitoring wells were installed to further delineate the identified impacts. CP subsequently implemented a chemical oxidation injection program to further remediate the groundwater. The first phase of the site restoration plan was completed in 2013. Supplemental work will be completed at a later date, once the observed minor groundwater exceedances have been fully remediated.

Examination of tank cars that released product

As a result of the derailment, 3 tank cars released product (Table 1). Although these cars sustained various impacts, the tank shells retained their integrity. Damage was sustained by the top fittings and the bottom fittings, resulting in the release of product.

Table 1. Summary of tank car and product release information

Car	Position in train	Built date	Tank car design	Product	Product weight (lbs)	Product specific gravity	Litres (estimated by weight)	Estimated loss (litres)
TILX 198203	39th	June 2007	DOT-111A100W1, non-insulated	Crude oil	194 880	0.825	107 372	3221
TILX 192186	40th	September 2005	DOT-111A100W1, non-insulated	Crude oil	191 690	0.825	105 615	98 481
PROX 76346	41st	December 1994	DOT-111A100W1, jacketed and insulated	Canola oil	184 637	0.915	91 722	18 190

Car TILX 198203

The top of car TILX 198203 sustained impact damage that had deformed and stretched one of the hinged manway hold-down bolts (eyebolts). This damage resulted in small leaks from the manway, which stopped when the hold-downs were tightened by emergency responders. The protective housing was torn off, and a small amount of product leaked from the 1-inch air/vapour valve fitting that had sheared off. The leak was plugged with a wooden dowel. There were no other leaks or damage to the top fittings (Photo 3).

There was no impact damage to the bottom outlet valve (BOV). The BOV nozzle and cap assembly were still intact. The handle for the BOV had separated at the valve as designed, and the skid protection functioned as intended (Photo 4).

Car TILX 192186

Car TILX 192186 overturned and came to rest with the BOV in the upright position (Photo 5). Impact damage to the top of the car had torn the protective housing for the load/unload arrangement from its hinges. Both the 2-inch-diameter liquid valve fitting and the 1-inch-diameter air/vapour valve fitting had sheared off, resulting in the release of product (Photo 6).

The BOV nozzle and cap had sheared off below the BOV as intended. In this arrangement, the BOV handle was mounted to the valve shaft and was perpendicular to the longitudinal axis of the car. As the car rolled down the embankment, the BOV handle was torn from its retainer, moved to the open position, and bent up against the tank car, such that it could not be closed by emergency responders (Photo 7). Product was released from the open BOV until the car came to rest with the BOV in an upright position. With the car overturned, the open BOV facilitated a more rapid release of product from the damaged top fittings.

Car PROX 76346

Impact damage sustained by the top of car PROX 76346 had torn away one of the hinged manway eyebolts, which created an air leak (Photo 8 and Photo 9).

The tank car thermal jacket near the BOV was extensively damaged (Photo 10). The BOV sustained impact damage, and the nozzle and cap assembly had sheared off as designed. The BOV handle was torn from the retainer and bent, but did not break away. As a result, the BOV was partially open and released product (Photo 11), but responders were still able to close the BOV. With the BOV partially open, the manway air leak accelerated the product release.

Tank car top fitting and bottom outlet valve protection

Top fitting protection

Top fitting protection requirements are outlined in the Association of American Railroads (AAR) Manual of Standards and Recommended Practices (MSRP), under Specification M-1002, Section C, Part III. The standard in place at the time of the car construction did not require that all non-pressure tank cars be equipped with rollover protection. However, when such protection was specified, the protective housing structure had to meet specific design criteria.

In 2010, the standard was revised^{Footnote 9} and required that all non-pressure tank cars constructed after 01 July 2010 that would be used to transport hazardous materials in either PG I or II (e.g., petroleum crude oil) must be equipped with protective housings for top fittings to provide rollover protection in the event of a derailment. Specifically, the protective housing must be able to withstand

• a force equal to the weight of the fully loaded tank car (1 W), less the weight of the trucks, in the longitudinal direction; and
• a force equal to ½ the weight of the fully loaded tank car (½ W) in the horizontal or vertically downward direction without overstressing the tank shell or nozzle.

The AAR supports application of this standard to older DOT/TC cars to allow them to continue in flammable liquid service.

Bottom outlet valve

The AAR standard in effect at the time that the subject cars were manufactured^{Footnote 10} specified that, for the protection of bottom discontinuities on non-pressure tank cars, BOV handles (unless stowed separately) must be designed to bend or break free on impact, or the handle in the closed position must be located above the bottom surface of the skid. This requirement is also cited in the current Canadian tank car standard CAN/CGSB-43.174-2005. The requirement remains unchanged in both standards.

Previous National Transportation Safety Board Recommendation regarding bottom outlet valves

Following an investigation into the Canadian National Railway (CN) freight train derailment in Cherry Valley, Illinois, United States (2009), the United States National Transportation Safety Board (NTSB) determined that “existing standards and regulations for the protection of bottom outlet valves on tank cars do not address the valves' operating mechanisms and therefore are insufficient to ensure that the valves remain closed during accidents.”^{Footnote 11} The NTSB recommended to the United States Pipeline and Hazardous Materials Safety Administration (PHMSA) that it

Require that all bottom outlet valves used on newly manufactured and existing non-pressure tank cars are designed to remain closed during accidents in which the valve and operating handle are subjected to impact forces. (R12-6)^{Footnote 12}

To date, the recommended changes have not been made. With about 228 000 Class 111 tank cars currently in service in North America, of which over 141 000 are used to transport DGs, these types of releases continue to occur during derailments.

Tank car DBUX 302383

Car DBUX 302383 was constructed in 2007 under AAR certificate No. F071004B. It was a 100-ton, general-purpose DOT111A100W1 tank car, equipped with 100-ton trucks, roller bearings of 6 ½ X 12 inches, and 36-inch wheels. Between January 2011 and February 2012, the car had 4 minor repairs. On 28 February 2012, the car required a change out of the No. 2 wheel set due to a high wheel impact at the L2 wheel location. This high wheel impact had been identified by a WILD.

A review of the No. 1 wheel set WILD history for this car, dating back to December 2012, was conducted. The results are summarized in Table 2.

Table 2. Wheel impact load detector (WILD) history of No. 1 wheel set for tank car DBUX 302383

Date	WILD site	Railway	Train speed (mph)	Load/empty	Position	Measured impact (kips)	Calculated impact at 50 mph (kips)
16 December 2012	Carseland, Alberta	CP	30.5	Load	L1	79	108.1
		CP	30.5	Load	R1	77.8	104.6
16 December 2012	Mortlach, Saskatchewan	CP	41.7	Load	L1	72.9	80.9
		CP	41.7	Load	R1	89.2	100.1
02 February 2013	Georgeville, Minnesota	CP	49.2	Load	L1	84.7	85.5
		CP	49.2	Load	R1	82.8	83.6
29 March 2013	Airdrie, Alberta	CP	40.5	Load	L1	71.4	80.3
		CP	40.5	Load	R1	72.9	81.7
29 March 2013	Carseland, Alberta	CP	54.3	Load	L1	83.7	83.7
		CP	54.3	Load	R1	81.6	81.6
30 March 2013	Mortlach, Saskatchewan	CP	50.2	Load	L1	85.9	85.9
		CP	50.3	Load	R1	103.9	103.9
30 March 2013	Grand Coulee, Saskatchewan	CP	34.1	Load	L1	85.6	110.7
		CP	34.1	Load	R1	82.5	105.5
30 March 2013	Poplar Point, Manitoba	CP	39.4	Load	L1	66.2	75.2
		CP	39.4	Load	R1	85.3	99.1
31 March 2013	Thunder Bay, Ontario	CP	35.5	Load	L1	75.7	92.9
		CP	35.5	Load	R1	69.5	84.5

The WILD data for the R1 wheel of car DBUX 302383 revealed that 7 of the 9 impacts were measured at speeds between 30 and 42 mph, which are well below the usual train speed of 50 mph for measured wheel impacts.

Due to the observed wheel tread slid flat on the failed No. 1 wheel set, tank car DBUX 302383 was subsequently subjected to brake shoe force testing at CP's Agincourt Yard in Toronto on 09 May 2013. The braking system functioned as designed.

Wheel impact load detectors

The development and installation of WILD technology was an industry initiative that has enhanced rail safety by proactively identifying wheels with tread defects that can generate high impact loads so that the wheels can be removed before they cause damage to track infrastructure or rolling stock components, or before the wheel fails in service.

WILD systems are usually installed on tangent track with a track speed of 50 mph, with the objective of recording the measured impact at track speed. The measured wheel impact force is directly related to speed; therefore, the faster the train travels, the greater the measured wheel impact will be when a wheel tread defect is present. Similarly, a reduction of train speed through a WILD site will reduce measured wheel impacts. Train crews are generally aware of the relationship between the measured wheel impact force and speed, and are also aware that, if the train passes through a WILD site at a lower speed, it will often result in a lower reading.

These wayside systems measure the impact load of a wheel on the rail, usually through a strain-based system or accelerometer-based system. The strain-based system quantifies the force applied to the rail through a mathematical relationship between the applied load and the deflection at the base of the rail. The strain gauges are physically mounted on the web of rail, about halfway down from the top of the rail head. Strain in the rail is used as a direct measure of the load at the rail head. The unit of measure for wheel impacts is the kip.^{Footnote 13}

The TC-approved Railway Freight Car Inspection and Safety Rules do not have any provisions for condemning in-service wheels due to high wheel impact loads. There are currently no regulatory requirements or thresholds governing WILD use in Canada or the United States. In response to TSB's Rail Safety Advisory (RSA) 11/11, entitled “Broken Wheels with Previous AAR Condemnable WILD Readings”, TC indicated that

• it would be creating a joint TC–industry forum to undertake a comprehensive review of wayside inspection system (WIS) and WILD criteria; and
• from this review, TC may create guidelines, standards, or rules governing the use of WIS, including WILD.

To date, there have been no tangible developments.

Association of American Railroads wheel impact load detector removal thresholds

Rule 41 of the 2013 Field Manual of the AAR Interchange Rules sets forth the following criteria for determining steel wheel defects:

Rule 41

STEEL WHEEL DEFECTS—OWNER'S RESPONSIBILITY

1. Condemnable at Any Time

[…]

18. Wheel Out-of-Round or 90,000 Pounds (90 kips) or Greater Impact.
    1. Detected by a wheel impact load detector reading 90,000 pounds (90 kips) or greater for a single wheel. The detector used must meet the calibration and validation requirements of Appendix F. The detector must reliably measure peak impacts and must provide a printable record of such measurements. Device calibration records must be maintained. Wheels with condemnable slid flat spot(s) are handling line responsibility and must not be billed otherwise.

[…]

1. Condemnable When Car Is on Shop or Repair Track for Any Reason

[…]

6. Detected by a Wheel Impact Load Detector reading from 80 kips to less than 90 kips for a single wheel. The detector used must have been calibrated per Appendix F. The detector must reliably measure peak impact and must provide a printable record of such measurements. Device calibration records must be maintained. Wheels with condemnable slid flat spots are handling line responsibility and must not be billed otherwise. This will be considered an Opportunistic Repair for the repairing party.

[…]

HANDLING LINE RESPONSIBILITY—CONDEMNABLE AT ANY TIME

1. Slid Flat:
   1. 2 inches or over in length.
   2. 2 or more adjoining spots each 1½ inch or over in length.^{Footnote 14}

The AAR Wheels, Axles, Bearings and Lubrication (WABL) Committee was responsible for the development and implementation of Rule 41. Its decision to use 90 kips as the condemning limit was based on a number of technical studies that were conducted during the early 1990s.^{Footnote 15} Engineering analysis from these studies supports 90 kips as a reasonable wheel-removal threshold to limit the damage to both equipment and track infrastructure.

Railway wheel impact load detector thresholds

In addition to the AAR condemning limits for wheel impacts, railways have developed their own removal thresholds. The railway thresholds are based on the operating practices and conditions of each railway and, as such, railway removal thresholds vary throughout the industry.

Railway WILD thresholds have evolved over time and evaluate the measured impact and the calculated impact for a given wheel. The measured impact is the actual wheel impact force recorded at track speed, which is usually 50 mph. Canadian Class I railways will also typically adjust the measured impact value using a speed-corrected algorithm to produce a calculated impact. The algorithm is a proactive measure that takes an actual impact level at a slower speed and estimates it using linear progression to an impact at 50 mph. This calculation allows a railway to evaluate all wheel impacts to a normalized speed of 50 mph. However, the algorithm for each railway can be different and is sensitive to wheel defect type, low speed conversion, and assumed linearity. The calculated speed is not considered to be as accurate as the measured value.

For CP, the relationship between measured and calculated wheel impacts at various speeds is presented in Table 3.

Table 3. Measured and calculated wheel impacts at various speeds (source: CP)

Train speed (mph)	Nominal weight per wheel (kips)	Measured wheel impact (kips)	Calculated wheel impact at 50 mph (kips)
30	33	90	128
35	33	90	114
40	33	90	104
50	33	90	90

Canadian Pacific Railway thresholds

Presently, CP requires a car to be bad-ordered^{Footnote 16} immediately for measured wheel impacts of ≥ 130 kips or calculated wheel impacts^{Footnote 17} of ≥ 150 kips recorded in northern Ontario. For the remainder of the CP system, the WILD guidelines require a car to be bad-ordered immediately for measured wheel impacts of ≥ 140 kips or calculated wheel impacts of ≥ 170 kips. When this designation occurs, the train speed is reduced, and the car is set off at the next designated location for repair.

For calculated impacts of ≥ 90 kips, CP requires the car to be bad-ordered when empty. This requirement allows the car to proceed to destination with no restrictions and to be repaired once it is empty.

For calculated impacts of between 90 and 110 kips, CP has a number of opportunistic threshold limits (OP1 to OP4). In these cases, CP flags the car in its car information management system, but does not bad-order the car. The car can proceed to destination without restrictions and may be repaired when operationally convenient. However, the car may also return to service without removal of the subject wheel set.

CP's WILD thresholds were established primarily by industry practice and in order to manage the volume of wheels removed for WILD impacts. CP has no engineering analysis of WILD data to support the WILD removal thresholds contained in its guidelines.

CP has no formal company instructions that require train crews to reduce speed through a WILD site. Train crews are expected to traverse WILD sites at track speed.

Canadian National Railway thresholds

CN has the following WILD alarm threshold requirements for measured (peak) impacts of 140+ kips:

• For cars with a single measured impact over 160 kips, or 200 kips for a calculated impact, the rail traffic controller (RTC) must immediately restrict the speed of the train to 25 mph. If the recorded impact is on an inbound train, the car must be set out at the terminal. If the recorded impact is on an outbound train, the car must be set out at the first designated siding. The car will be bad ordered with Code WI by the RTC mechanical service representative (RTC Mech), who will advise the responsible repair personnel.
• For cars with a single measured impact between 150 and 159 kips, the RTC must immediately restrict the speed of the train to 10 mph less than the speed recorded at the WILD. The RTC will then decide whether the car should be set out at the inbound terminal (if inbound) or at the first designated set-out location (if outbound). If neither set-off location is practical, the car can be moved to another convenient location for set-off but should never move beyond the next location, where it will receive a certified car inspection (CCI). The car will be bad ordered with Code WI by the RTC Mech, who will advise the responsible repair personnel.
• For cars with a single measured impact between 140 and 149 kips, the RTC must immediately restrict the speed of the train to 5 mph less than the speed recorded at the WILD. If the temperature at the WILD is –25°C (–13°F) or colder, the speed reduction must be 10 mph less than the speed recorded at the WILD. The RTC will then decide whether the car should be set out at the inbound terminal (if inbound) or at the first designated set-out location (if outbound). If neither set-off location is practical, the car can be moved to another convenient location for set-off but should never move beyond the next location, where it will receive a CCI. The car will be bad ordered with Code WI by the RTC Mech, who will advise the responsible repair personnel.

In each of these cases, the subject wheel must be replaced before the car is placed back into service.

CN also has the following maintenance guidelines for handling cars with measured (peak) impacts between 80 and 139 kips:

• Cars arriving from interchange to CN with wheel impacts are automatically identified.
• Wheel set removal between 80 and 89 kips when a car is on a shop or repair track.
• Automatically identify wheels with impacts between 90 and 139 kips.
• Wheel impacts between 90 and 139 kips are removed selectively according to AAR guidelines at CCI locations.

TSB Laboratory examinations

The TSB Laboratory examined the 3 leaking tank cars (TILX 192186, TILX 198203, and PROX 76346) to determine the adequacy of the protection provided. It also examined the broken rail removed from the area of the curve containing the suspected initial point of derailment, and the failed R1 wheel from car DBUX 302383.

Tank cars

The following observations were made:

• The top fitting protective housings of cars TILX 192186 and TILX 198203 were torn off at the hinges and failed to protect the top fittings from damage. Consequently, the top fittings on both tank cars were sheared off and released product.
• The light steel construction and blunt profile of the top fitting protective housings on cars TILX 192186 and TILX 198203 did not adequately address the dynamics and related impact forces involved in a rollover derailment.
• The BOV skid protection on all 3 derailed tank cars functioned as designed.
• The BOV handles on tank cars TILX 192186 and PROX 76346 remained attached to the BOV throughout the derailment sequence and opened the respective valves. The BOV handle on TILX 192186 was deformed in such a way that it prevented subsequent closure of the valve. Both BOV handle designs met the current AAR standard.

Broken rail

Two 28-foot-long sections of rail, one from the north side of the curve and the other from the adjacent south side, and several small pieces of rail were examined. The following observations were made:

• Rail wear was within the allowable limits.
• The fractures on the south rail were the result of instantaneous overstress, with no indication of progressive cracking.
• There was no indication of previous rail defects.

Failed No. 1 wheel set

The failed R1 and mate L1 wheels were both manufactured by Griffin Wheel at its plant in Kansas City, Kansas,United States, in March 1998. The wheels were heat-treated, Class C, 36-inch, CH36 design (1-wear cast steel wheels). The wheels were originally mounted on the axle in April 1998 by CP. The locking plate markings (PRXL N 06 07) identified that Progress Rail Services Corporation in Louisville, Kentucky, United States, mounted new bearings in June 2007. The wheels were reprofiled prior to bearing installation.

The following observations were made:

• Both wheels were within the allowable wear limits.
  • The original rim thickness for this type of wheel was 27/16 inch. The measured rim thickness for both wheels was 20/16 inch, which is above the minimum allowable rim thickness of 7/8 inch for 36-inch diameter wheels.
  • The wheel set was mounted on a test stand and rotated to measure wheel run-out. Wheel run-out measurements showed a maximum deflection of 0.034 inch for the R1 wheel and 0.042 inch for the L1 wheel, which are below the maximum allowable wheel run-out of 0.070 inch.
• The R1 wheel showed no sign of overheating, while the L1 wheel tread exhibited heat checking around the entire wheel circumference.
• The R1 wheel met the AAR standards for wheel chemical composition and hardness.
• A qualitative assessment of residual compressive stress in the wheels was conducted using radial saw cuts. A compressive residual stress is created in Class C wheels during heat treating to enhance resistance to crack propagation in the wheel tread. The results of testing indicated that the wheels retained similar amounts of residual compressive stress in the wheel treads. Residual stress was not considered to be a contributing factor.
• There was a non-condemnable slid flat on the L1 wheel tread. The slid flat was directly in line with the fracture origin on the R1 wheel. As the wheels and the axle rotate as a unit, a slid flat on the L1 mate wheel means that there was likely a slid flat on the R1 wheel at the same relative location.
• A deep but non-condemnable shell was partially hidden beneath the tread surface of the slid flat area on the L1 mate wheel (Photo 12). The shell was further exposed as material came loose during cutting for metallographic sample preparation, which demonstrates that subsurface shelling can occur, yet remain undetected, as it is covered by tread surface material.

Detailed failed R1 wheel examination

The R1 wheel exhibited 3 phases of fracture:

1. During the first phase, a growth of shells occurred subsurface to the wheel tread. The shelling extended about 1/3 of the way around the circumference of the wheel, coincident with the larger separated portions of the wheel rim. Subsurface fatigue cracking was also present. Polishing in these zones indicated that the portions of the shelled tread surface were in situ for an extended period of time before fully separating.
2. The second phase of fracture was the initiation of the vertical split rim (VSR) at the root of a shell (i.e., origin), located about ½ inch below the running surface of the wheel tread (Photo 13). The darker surface colouration indicated that this phase of the fracture had been developing for some time, but for less time than the initial subsurface shelling (i.e., first phase).

3. The third phase of fracture occurred in the form of a VSR, which progressed about ¾ of the way around the wheel circumference and resulted in the separation of approximately 80 inches of the outboard rim (Photo 14). The fracture topography indicated that the final VSR failure was rapid and had propagated circumferentially from the extremities of the second phase of the fracture.

Macroscopic examination

Macroscopic examination of a radial cross-section taken from the R1 wheel adjacent to the origin area revealed the following:

• The macrostructure was composed of a mixture of dendrites. The areas near the tread surface and the outer surface of the wheel displayed smaller dendrites, which became progressively larger (i.e., coarser) toward the centre of the core material (Photo 15).

• This is considered to be normal structure in castings, since the material near the surface of the wheel cools quickly, creating smaller dendrites than in the central portions, where the material cools slower and the dendrites grow larger.
• The fracture origin was close to the coarser dendrite structure near the centre of the rim section. The orientation of the larger dendrites was roughly parallel to the fracture plane. Coarser dendrites facilitate more rapid crack propagation, as there is less resistance to cracking.

Metallographic examination of the R1 wheel determined the following:

• Near the fracture origin, there were secondary cracks extending from the free surface and initiating subsurface.
• There were no abnormal voids or inclusions observed in the wheel material adjacent to where the VSR originated.
• The R1 wheel exhibited a finely grained, pearlitic microstructure, which is normal for a Class C wheel.

Vertical split rim wheel failure

The VSR wheel failure phenomenon continues to be studied by researchers and is not yet fully understood. This type of wheel failure, which can be initiated by rolling contact fatigue or a spall, tends to originate at the bottom of a shell on the wheel tread.^{Footnote 18} In a study conducted by the Transportation Technology Center, Inc. (TTCI),^{Footnote 19} which examined 24 broken wheels, VSR was identified as the wheel failure mode 71% of the time. Furthermore, 12 of the broken wheels examined had historical WILD data available. Six of these 12 wheels had recorded impact loads that exceeded 90 kips prior to failure.

Previous derailments related to wheel impacts

Rail steel is known to have reduced fracture toughness and ductility at low temperatures, particularly if a rail defect, which can act as a stress raiser, is present. It is also recognized by the industry that wheels producing high impact loads may cause damage to equipment (such as wheels, axles, bearings, and journals) and to track infrastructure, often in the form of broken rails.

The TSB has investigated 6 accidents (including this occurrence) that were caused by either broken wheels or broken rails resulting from wheel impacts (Appendix A). In each of these accidents, company WILD records identified cars with recorded impacts that exceeded AAR WILD removal criteria (90 kips) but did not meet company WILD wheel set removal thresholds. In 4 of these accidents, the wheels subsequently failed as a result of a VSR. Because there are no regulations that require wheel removal for a recorded impact, the cars and wheel sets remained in service and subsequently caused a derailment.

Transportation Safety Board of Canada Lac-Mégantic investigation

On 05 July 2013, at about 2250 Eastern Daylight Time, Montreal, Maine & Atlantic Railway (MMA) freight train MMA-002, en route from Montréal, Quebec, to Saint John, New Brunswick, was stopped at Nantes, Quebec (Mile 7.40 of the Sherbrooke Subdivision), the designated MMA crew-change point. The train, consisting of 5 head-end locomotives, 1 VB car (i.e., special-purpose caboose), 1 box car, and 72 Class 111 tank cars carrying flammable liquids (petroleum crude oil, UN 1267, Class 3), was then secured on the main track and left unattended on a descending grade.

Shortly before 0100 on 06 July 2013, the unattended train started to move and gathered speed as it rolled uncontrolled down the descending grade toward the town of Lac-Mégantic, Quebec. Sixty-three Class 111 tank cars and the box car derailed near the centre of the town. Most of the derailed cars released their contents due to tank car damage. The released product ignited almost immediately, resulting in a large pool fire that burned for more than a day. The petroleum crude oil that did not burn permeated and contaminated the downtown soil, with some crude oil reaching the Chaudière River and Mégantic Lake. The 63 derailed tank cars were transporting 6.72 million litres of petroleum crude oil from the Bakken field in North Dakota. During the derailment, approximately 5.98 million litres (89%) of product was released. This derailment is among the largest on-land oil spills in North American history.

Forty-seven people were fatally injured. Many buildings, vehicles, and the railway tracks were destroyed. About 2000 people were initially evacuated from the surrounding area.^{Footnote 20}

Association of American Railroads Circular OT-55-N and Transportation Safety Board of Canada Rail Safety Recommendation R14-02

In January 1990, based on recommendations of the Inter-Industry Task Force on the Safe Transportation of Hazardous Materials by Rail, the AAR issued Circular OT-55 (OT-55), entitled Recommended Railroad Operating Practices for Transportation of Hazardous Materials. OT-55 gave the rail industry routing guidance for selected dangerous goods, including poisonous-by-inhalation (PIH) or toxic-by-inhalation (TIH) products and radioactive materials. It defined a list of TIH products (over 200, including chlorine and anhydrous ammonia). Furthermore, it identified technical and handling requirements for “key trains” and “key routes.” Following the Lac-Mégantic accident, the definition of a “key train” was revised^{Footnote 21} to include any train containing 1 or more cars of PIH or TIH material, such as anhydrous ammonia, ammonia solutions, spent nuclear fuel or high-level radioactive waste, or containing 20 car loads, or intermodal portable tank loads, of any combination of other hazardous materials (e.g., crude oil). Some of the other essential elements of OT-55-N are the following:

• Key routes must have wayside defective bearing sensors spaced not more than 40 miles apart.
• In the event that a hot box detector indicates an abnormal bearing in a key train, further speed restrictions and car handling requirements are imposed.

Although OT-55-N is not applicable in Canada, OT-55-N or similar operating restrictions are necessary to alleviate many of the shortcomings identified in the Lac-Mégantic investigation and other investigations involving the release of dangerous goods. In October 2013, CN extended these measures to its Canadian operations, and by late April 2014, CP had also fully implemented the requirements. The TSB indicated that an approach based on OT-55-N, strengthened with a requirement to conduct route planning and analysis, would be a positive step to improve the safety of transporting DGs by rail. Subsequently, on 23 January 2014, the Board recommended that

Response by Transport Canada to Transportation Safety Board of Canada Recommendation R14-02

On 23 April 2014, in response to TSB Recommendation R14-02, TC issued an emergency directive pursuant to section 33 of the Railway Safety Act entitled Rail Transportation of Dangerous Goods. It required railways carrying DGs to implement minimum operating practices for “key trains” to address the Board's recommendation and manage the immediate safety issue, including speed restrictions for trains carrying DGs, expansion of inspection requirements on restricted rail routes, and the completion of risk assessments for rail transportation “key routes.”

The emergency directive defined a “key train” as an engine with cars

1. that includes one or more loaded tank cars of dangerous goods that are included in Class 2.3, Toxic Gases and of dangerous goods that are toxic by inhalation subject to Special Provision 23 of the Transportation of Dangerous Goods Regulations; or
2. that includes 20 or more loaded tank cars or loaded intermodal portable tanks containing dangerous goods, as defined in the Transportation of Dangerous Goods Act, 1992 or any combination thereof that includes 20 or more loaded tank cars and loaded intermodal portable tanks.^{Footnote 22}

The directive defined a “key route” as

any track on which, over a period of one year, is carried 10,000 or more loaded tank cars or loaded intermodal portable tanks containing dangerous goods, as defined in the Transportation of Dangerous Goods Act, 1992 or any combination thereof that includes 10,000 or more loaded tank cars and loaded intermodal portable tanks.^{Footnote 23}

Among other criteria, the directive also required that the railways

[…]

3. Not operate a Key Train with any cars not equipped with roller bearings.
4. Perform an inspection of any bearing on a Key Train reported defective by a Wayside Defective Bearing Detector. If any such inspection confirms that a bearing on a car of a Key Train is defective, companies are to set off that car from the Key Train or must only operate the Key Train at a safe speed not exceeding 15 MPH until the car with the defective bearing is set off. If the inspection performed on a bearing of a car of a Key Train reported by a Wayside Defective Bearing Detector fails to confirm a defect in a bearing, companies must not operate the Key train at a speed exceeding 30 MPH until the next Wayside Defective Bearing Detector. If a defect in a bearing of the same car of a Key Train is reported by two consecutive Wayside Defective Bearing Detectors, companies must set off that car from the Key Train or must only operate the Key Train at a safe speed not exceeding 15 MPH until the car with the defective bearing is set off.^{Footnote 24}

The directive contains no other criteria to limit “key train” operations in the event that another type of wayside device, such as a WILD, detects an abnormal condition.

The emergency directive was put in place for 6 months, and was renewed for another 6 months pending further consultation with stakeholders, including the Federation of Canadian Municipalities, unions, and to reflect consideration of any additional United States requirements that may be established.

In April 2014, TC also issued Protective Direction 33. Under the direction, an emergency response assistance plan (ERAP) is now required for UN 1267 (crude oil) carried in tank cars. Going forward, an approved ERAP will ensure that responders demonstrate knowledge of an incident command system and that they provide evidence of being able to work within such a system through a combination of training and experience.

In addition, TC issued a ministerial order under section 19 of the Railway Safety Act, requiring railways carrying DGs to formulate and submit for approval within 180 days new rules based on these operating practices to further improve the safe transportation of DGs by rail in the long term.

Board assessment of Transport Canada response to Transportation Safety Board of Canada Recommendation R14-02 (June 2014)

In the Board's assessment of TC's response to R14-02, it was highlighted that

TC has accepted the recommendation and has issued an Emergency Directive that requires railways to set improved criteria for the operation of trains carrying dangerous goods, to conduct route planning and analysis, and to perform initial and periodic risk assessments. Further consultations with stakeholders will be conducted and the Emergency Directive may be renewed and modified based on any new information.

The Emergency Directive will require risk assessments to be conducted on key routes over which key trains operate. It will require that such routes meet enhanced inspection and maintenance requirements. However, key routes are defined as a route over which 10 000 car loads of dangerous goods are transported annually. This threshold may limit the number of routes subject to these safety measures. A rigorous analysis should be conducted of the 10 000-car threshold to determine which routes with trains carrying dangerous goods will be excluded and whether the safety deficiency identified in R14-02 will be addressed.

TC also issued a Ministerial Order requiring railways carrying dangerous goods to formulate and submit for approval new rules to improve their operating practices for the safe and secure transportation of dangerous goods. If the new rules contain the same scope of activities or more, but are strengthened to include more railway routes, the risk posed by movements of dangerous goods could be significantly reduced. However, the proposed rules have not yet been developed and the outcome cannot be known until the process is finalized. Therefore, the Board assesses the response to Recommendation R14-02 as having Satisfactory Intent.^{Footnote 25}

TSB Laboratory reports

The following TSB Laboratory reports were completed and are available from the TSB upon request:

• LP 072/2013 – Examination of Wheel Set and Rail
• LP 073/2013 – Field Examination of Tank Cars

The train was handled in accordance with regulations and company instructions. Track records and inspections did not reveal any track defects in the area of the derailment. The analysis will focus on the R1 broken wheel on tank car DBUX 302383, the detection of potential vertical split rim (VSR) wheel failures, company and regulatory overview of wheel impact load detector (WILD) thresholds, tank car top fitting protective housings and bottom outlet valves (BOV), and company emergency response.

The accident

The marks observed on the head of the south rail extending eastward from Mile 12.4 identified that the initial point of derailment (POD) coincided with the broken low (south) rail of the curve at Mile 9.41. The marks were consistent with damage caused by a broken wheel that was striking the head of the south rail. The 34th car from the head end (dangerous good [DG] tank car DBUX 302383) had sustained a broken R1 wheel (south side) in the trailing truck. All rail fractures recovered from the POD were determined to be the result of instantaneous overstress failure. Therefore, it is likely that the derailment occurred when an impact from the broken R1 wheel of the 34th car (DBUX 302383) fractured the south rail (low rail) in the curve at Mile 9.41 of the Heron Bay Subdivision, which subsequently resulted in the 36th to 57th trailing cars derailing.

Tank car DBUX 302383 R1 broken wheel

The R1 wheel fractured due to a VSR, resulting in the separation of about 80 inches of the outboard wheel rim. The VSR originated about ½ inch below the surface of the wheel tread at the root of a shell.

The failed R1 wheel was manufactured with a rim thickness of 27/16 inch. Service wear and re‑profiling had reduced the rim thickness to 20/16 inch, which was well above the Association of American Railroads (AAR) minimum of 14/16 inch. However, separation of the tread surface due to subsurface cracking and shelling further reduced the effective rim thickness by another 8/16 inch to 12/16 inch. With less than half of the original rim thickness remaining, the stress on the rim material was increased and was applied at a point deeper in the wheel core material.

Toward the centre of the wheel core material, the macrostructure consisted of coarser, larger dendrites. The fracture origin was closer to the coarser dendrite structure near the centre of the rim section, and the orientation of the larger dendrites was roughly parallel to the fracture plane. Once the crack progressed deeper into the rim material, the larger size and orientation of the dendrite structure near the centre of the wheel rim facilitated a more rapid VSR crack development. Wheel wear and tread surface deterioration due to shelling combined to create a stress environment in the rim that the material could no longer resist. The R1 wheel failure occurred when the VSR crack reached a critical size and the rim could no longer support normal service loads.

The material properties and wear for both wheels were within allowable limits, and no abnormal voids or inclusions were observed in the wheel material adjacent to the VSR fracture origin. A non-condemnable slid flat and shell were present on the L1 wheel tread, directly opposite the fracture origin of the failed R1 wheel. Since the wheels and the axle rotate as a unit, the presence of a slid flat on the L1 wheel tread indicates that a slid flat was likely present on the failed R1 wheel tread at the same relative location. Therefore, it is considered likely that shelling of the R1 wheel tread began as a result of a non-condemnable slid flat.

Generally, slid flats may be caused by braking system problems or a hand brake that is not fully released. However, subsequent brake shoe force testing on tank car DBUX 302383 determined that the braking system functioned as designed.

Wheel impact load detector history of tank car DBUX 302383 R1 wheel

Based on the WILD data recorded between December 2012 and the date of the accident for the R1 wheel of tank car DBUX 302383, the following was determined:

• In total, 6 of the 9 impacts met AAR Rule 41 removal criteria.
• One of the 9 impacts met AAR Rule 41 A.1.r (i.e., condemnable at any time; remove for a measured impact in excess of 90 kips). On 30 March 2013, the R1 wheel recorded a measured impact of 103.9 kips at Mortlach, Saskatchewan.
• Five of the 9 impacts met the AAR Rule 41 A.2.f (i.e., condemnable when the car is on a repair track; remove for a measured impact of between 80 and 90 kips). The same 5 of 9 impacts that were recorded correspond to calculated impacts of between 90 and 110 kips. While this would appear to meet Canadian Pacific Railway (CP) WILD guidelines for opportunistic repair (i.e., calculated impacts of between 90 and 110 kips), the CP WILD guidelines also indicate that the opportunistic repairs are to be considered when the measured impact values are greater than or equal to 90 kips. Therefore, when using the CP WILD guidelines, AAR Rule 41 A.2.f will never apply.

Following the impact of 103.9 kips, CP could have set the car out immediately, replaced the No. 1 wheel set and charged the car owner for the work in accordance with AAR rules. However, the impact did not meet the CP WILD threshold of ≥ 140 kips and, in the absence of any regulatory requirement for WILD thresholds, the car was subsequently allowed to proceed to destination because it was loaded. Despite recording a wheel impact that was condemnable under AAR Rule 41, CP WILD guidelines permitted the R1 wheel on tank car DBUX 302383 to remain in service until it failed 4 days later.

Association of American Railroads and Canadian Pacific Railway wheel impact load detector thresholds

WILD systems were developed and installed primarily as an industry initiative. They provide an additional level of safety and complement the visual inspection of trains performed by railway personnel. They are used as a preventive tool to identify high-impact wheels so that such wheels can be removed before they cause damage to track infrastructure or to rolling stock.

AAR Rule 41 states that a wheel that records a measured (actual) WILD impact of 90 kips (or greater) is condemnable at any time. This means that the railway can stop the train, set out the car, remove the wheel, and recover wheel change-out costs from the car owner. Similarly, any wheel with a measured WILD impact from 80 kips to less than 90 kips is condemnable when the car is on a shop or repair track for any reason. In these cases, railways can also recover wheel change-out costs from the car owner.

In comparison, CP immediately bad-orders a car, and requires that train speed be reduced and that the car be set off at the next accessible location for repair, if a car records

• a measured wheel impact of ≥ 130 kips or a calculated wheel impact of ≥ 150 kips in northern Ontario
• a measured wheel impact of ≥ 140 kips or a calculated wheel impact of ≥ 170 kips anywhere else on the CP system.

For measured impacts of ≥ 90 kips, CP requires the car to be bad-ordered when empty, in which case the car can proceed to destination with no restrictions. For calculated impacts of between 90 kips and 110 kips, CP flags the car in its car information management system, but does not bad-order the car. The car can proceed to destination without restrictions and may be repaired when operationally convenient but can also return to service without repair.

Tranport Canada Emergency Directive and Association of American Railroads Circular OT-55-N

A primary safety concern related to the transportation of DGs by rail is prevention of a catastrophic release in a densely populated or environmentally sensitive area. Route planning for the transportation of DGs identifies the route with the lowest overall risk to the public. Route planning must cover the entire route, and each route needs to be evaluated to ensure that the safest route is chosen. Once the safest route is selected, the risk posed by carrying dangerous commodities can be reduced by proactively examining all aspects of operations over the entire route to ensure that the identified risks are adequately mitigated. Such an assessment should include the use of all available wayside detection systems.

The occurrence train would now be considered a “key train” under both the Emergency Directive and OT-55-N definitions. The train would now be subject to other operating restrictions, such as route planning, restriction of maximum speed to 50 mph, requirement for additional inspections on “key routes,” and monitoring of roller bearings using wayside hot bearing detectors (HBDs). While the importance of monitoring roller bearings to protect against catastrophic bearing failure is well understood, it is also important to protect against high wheel impact loads, which can result in a wheel failure and/or broken rail that can cause a derailment. To protect against high wheel impact load damage, Canadian Class I railways have implemented WILD technology throughout their networks over the past 20 years. This technology has enhanced rail safety by proactively identifying wheels with tread defects that can generate high impact loads, so that the wheels can be removed before they cause damage to track infrastructure or rolling stock components. While both Transport Canada's (TC) Emergency Directive pursuant to section 33 of the Railway Safety Act and AAR Circular OT‑55-N require roller bearings to be monitored by wayside HBDs, neither require rolling stock to be monitored using WILD technology, which could further mitigate the risk posed by transporting DGs.

Wheel impact load detector recorded impacts and subsequent wheel vertical split rim failure

The Transportation Safety Board of Canada (TSB) has investigated 6 accidents (including this occurrence) that were caused by either broken wheels or broken rails resulting from wheel impacts above 90 kips. In each of these occurrences, company WILD records identified cars with recorded impacts that exceeded the current AAR WILD criteria for wheel removal. However, the recorded impacts did not exceed the company WILD removal thresholds. In 3 of these accidents, the wheels subsequently failed as a result of a VSR.

A study conducted by the Transportation Technology Center, Inc. (TTCI) examined 24 broken wheels and determined that VSR was the wheel failure mode 71% of the time. Available WILD data, which were reviewed for 12 of the broken wheels, revealed that, similarly to this accident, 50% (6 of 12) of these wheels recorded impact loads that exceeded 90 kips prior to wheel failure.

The TSB investigations and the TTCI study demonstrated that 9 of 15 cases (60%) recorded a wheel impact that was condemnable under AAR Rule 41. However, the railway's WILD guidelines permitted the wheel to remain in service. In each of the 9 cases, the wheel sustained a VSR failure a short time later. While the VSR wheel failure phenomenon continues to be studied and is not yet fully understood, there may be a correlation between elevated measured WILD impacts and the subsequent VSR failure of the wheel.

Although CP requires a car to be bad-ordered when empty for measured impacts of ≥ 90 kips, it does not take immediate action in such circumstances. Consequently, as demonstrated in this accident, a loaded car can remain in service and travel a great distance to destination with no restrictions. Under such conditions, if railway WILD guidelines do not provide adequate guidance for dealing with wheel impacts that are condemnable under AAR Rule 41, there is an increased risk that wheels with emerging defects, such as a VSR, will not be identified and removed from service before progressing to failure.

Train speed through wheel impact load detector sites

CP and Canadian National Railway (CN) use WILD results that are normalized for a speed of 50 mph. Because the measured wheel impact force is directly related to speed, any reduction of train speed at the WILD site will reduce the measured wheel impacts.

A review of WILD data for the DBUX 302383 R1 wheel revealed that 7 of the 9 impacts were measured at speeds between 30 and 42 mph, which are well below the train speed of 50 mph for measured wheel impacts. If train speed through a WILD site is less than 50 mph, greater variability occurs when wheel impacts are assessed, which increases the risk that defective wheels will not be immediately identified and will remain in service.

Regulatory oversight of wheel impact load detector technology

The TC-approved Railway Freight Car Inspection and Safety Rules have no provisions for condemning wheels due to recorded high impacts. Furthermore, there are currently no regulatory requirements or guidelines in Canada or the United States governing the use of wayside inspection systems (WIS), including WILDs. Consequently, the location of WILD sites, the distance between them, and the intervention thresholds differ for each railway. Railways can also alter WILD thresholds at any time to satisfy operational needs. While TC had indicated that it would create a joint forum to conduct a comprehensive review of WIS and WILD criteria in 2011, to date there have been no developments.

Although causal links have long been established between high wheel impact loads and rail failures, the discussion surrounding WILD thresholds has always centred on what the removal threshold should be. AAR Rule 41 identifies that a wheel that records a measured (actual) WILD impact of 90 kips (or greater) is condemnable at any time, while a wheel with a measured WILD impact from 80 kips to less than 90 kips is condemnable when the car is on a shop or repair track for any reason. The AAR thresholds are based on engineering analysis that supports them as reasonable wheel-removal thresholds for limiting the damage to equipment and track infrastructure.

In contrast, industry WILD thresholds vary between companies. The industry removal threshold for a measured impact typically ranges from 130 to 140 kips, which is approximately 50% greater than the AAR Rule 41 condemning limit of 90 kips. These WILD thresholds were established primarily by industry practice that was based on operational needs and set at a magnitude that makes it easier to manage the volume of wheels removed for WILD impacts. There is no engineering analysis of WILD data to support the industry WILD removal thresholds.

Railways operating on their own lines in Canada are governed by the TC-approved Railway Freight Car Inspection and Safety Rules and, consequently, are not bound by the AAR Rule 41 condemning criteria for wheel impacts. Since the rules have no provisions for condemning wheels due to recorded high impacts, railways are permitted to establish their own thresholds and can alter the thresholds at any time. The increasing use of WILD technology has been a positive development in improving railway safety. However, in the absence of regulatory oversight for WILD technology, company guidelines for WILD thresholds may not be sufficiently robust, which increases the risk that wheels with elevated impact readings may not always be removed from service in a timely manner.

Tank car top fitting and bottom outlet valve protection

If a loaded tank car comes to rest in an inverted position after the top fittings have been compromised during a derailment, product leakage can occur from the top fittings. Similarly, if it comes to rest in an upright position and the BOV has been compromised, product can be released from the BOV. Also, if the top fittings and the BOV are compromised, the fitting that comes to rest in the highest position can act as a vent, which greatly increases the rate of flow from the other compromised appurtenance. Therefore, in order to minimize and mitigate product release during a derailment, protection of both the top fittings and the BOV is necessary.

In this accident, the top fitting protective housings on both tank cars transporting crude oil (TILX 192186 and TILX 198203) had failed. During the derailment, the longitudinal movement of the inverted tank cars sheared off the blunt, upright top fitting protection and the top fittings themselves. The light steel construction and blunt profile of the top fitting protective housings on TILX 192186 and TILX 198203 did not adequately protect against the dynamics involved in a rollover derailment.

Approximately 3200 litres of crude oil leaked from the 1-inch air/vapour valve fitting that had sheared off from car TILX 198203. The leak was subsequently plugged with a wooden dowel by responders. There were no other leaks or damage to the top fittings or BOV.

TILX 192186 had both its 2-inch-diameter liquid valve fitting and 1-inch-diameter air/vapour valve fitting sheared off, which resulted in the release of crude oil. As the car rolled down the embankment, the BOV handle was torn from its retainer, moved to the open position, and bent up against the tank car such that it could not be closed by emergency responders. Crude oil was released from the open BOV until the car came to rest with the BOV in an upright position. With TILX 192186 overturned, the BOV that was stuck in the open position acted as a vent and facilitated a more rapid release of about 98 500 litres of crude oil from the damaged top fittings.

PROX 76346 had one of its manway eyebolts torn off, which created an air leak. During the derailment, the BOV handle was torn from its retainer, but did not break away as designed. It remained attached to the BOV and partially opened the valve. Although the PROX 76346 BOV handle was deformed and responders were still able to close the valve, the open BOV, combined with the air leak at the manway, facilitated the release of about 18 000 litres of canola oil.

The BOV handles on tank cars TILX 192186 and PROX 76346 remained attached to the BOV throughout the derailment, and subsequently opened and facilitated product release, despite meeting the AAR standards. This problem with BOV handles had been identified in other accident investigation reports, and in 2012, prompted the United States National Transportation Safety Board (NTSB) to recommend design changes to ensure that BOVs remain closed during derailments. However, at the time that this accident occurred, the recommended changes had not been made, and consequently, these types of releases continue to occur during derailments. Although the BOV handle designs met the AAR standards, the handles were still able to be moved to the open position during the accident. If BOV handles continue to be exposed without adequate protection, there is an increased risk of product release during derailments.

The shells of tank cars TILX 192186, TILX 198203 and PROX 76346 maintained their integrity, yet product was still released as a result of damage sustained by the tank car appurtenances. Although the top and bottom fitting arrangements met design criteria, the fittings were not adequately protected and were either sheared off or forced open during the derailment. In this occurrence, the tank car top and bottom fitting arrangements were inadequate to protect against product release during the derailment and contributed to the severity of the release.

Initial emergency response and site control

Due to the relatively remote location of the derailment, TSB investigators did not arrive at the site until late evening. Prior to TSB's arrival, CP emergency responders arrived on site and commenced site mitigation activities. While efforts were made to coordinate site activities with the TSB investigators (while en route), communications were sometimes limited, CP company officers were not always available, and updates with regard to the release of crude oil were not forthcoming. In this case, there were significant gaps in the CP response to the release of highly volatile crude oil. Specifically,

• there was no formal CP incident command structure (ICS) or command post in place;
• access to the site was virtually unrestricted, with no safety perimeter;
• there was no method for keeping track of who was accessing the site and how many people were on site;
• no site safety briefings were conducted to review any potential dangers of released product and to review coordination of activities;
• there was no mention of the fire that had ignited earlier that evening;
• important product and release information was not readily available for responders. At about 2330 on 03 April 2013, CP initially informed the TSB that about 5 barrels (900 litres) of crude oil had leaked from the 2 tank cars. The TSB later learned that, earlier in the day, environmental and CP company officials were already aware that at least 1 of the tank cars (TILX 192186) containing crude oil had lost most of its load (98 500 litres); and
• insufficient overview of site mitigation activities may have placed responding personnel at risk. During site remediation, a CP subcontractor operating a bulldozer equipped with a sideboom tipped over and fell partway down the embankment while trying to move a car.

When an accident occurs, it is important that as much accurate information as possible is relayed to appropriate agencies as quickly as possible. It is equally important that updates to the initial report be provided as soon as additional information becomes available. When DGs are involved, industry and emergency response best practice requires that a formalized ICS and protocols be implemented to coordinate all site activities and ensure the safety of all responding agencies and personnel. If information outlining the amount and type of DG product released is not communicated to emergency responders, and site control measures are not implemented to minimize exposure and hazards, there is an increased risk that personnel on site will be subjected to circumstances that can lead to injury.

Findings as to causes and contributing factors

1. The derailment occurred when an impact from the broken R1 wheel of the 34th car (DBUX 302383) fractured the south rail (low rail) in the curve at Mile 9.41 of the Heron Bay Subdivision, which subsequently resulted in the 36th to 57th trailing cars derailing.
2. The R1 wheel fractured due to a vertical split rim, resulting in the separation of about 80 inches of the outboard wheel rim.
3. The vertical split rim originated about ½ inch below the surface of the wheel tread at the root of a shell.
4. Once the crack progressed deeper into the rim material, the larger size and orientation of the dendrite structure near the centre of the wheel rim facilitated a more rapid vertical split rim crack development.
5. Wheel wear and tread surface deterioration due to shelling combined to create a stress environment in the rim that the material could no longer resist.
6. The R1 wheel failure occurred when the vertical split rim crack reached a critical size and the rim could no longer support normal service loads.
7. Shelling of the R1 wheel tread likely began as a result of a non-condemnable slid flat.
8. Despite recording a wheel impact that was condemnable under Association of American Railroads Rule 41, the wheel impact load detector guidelines of Canadian Pacific Railway permitted the R1 wheel on tank car DBUX 302383 to remain in service until it failed 4 days later.
9. The tank car top and bottom fitting arrangements were inadequate to protect against product release during the derailment and contributed to the severity of the release.

Findings as to risk

1. If railway wheel impact load detector guidelines do not provide adequate guidance for dealing with wheel impacts that are condemnable under Association of American Railroads Rule 41, there is an increased risk that wheels with emerging defects, such as a vertical split rim, will not be identified and removed from service before progressing to failure.
2. In the absence of regulatory oversight for wheel impact load detector technology, company guidelines for wheel impact load detector thresholds may not be sufficiently robust, which increases the risk that wheels with elevated impact readings may not always be removed from service in a timely manner.
3. If train speed through a wheel impact load detector site is less than 50 miles per hour, greater variability occurs when wheel impacts are assessed, which increases the risk that defective wheels will not be immediately identified and will remain in service.
4. If bottom outlet valve handles continue to be exposed without adequate protection, there is an increased risk of product release during derailments.
5. If information outlining the amount and type of dangerous goods product released is not communicated to emergency responders, and site control measures are not implemented to minimize exposure and hazards, there is an increased risk that personnel on site will be subjected to circumstances that can lead to injury.

Other findings

1. There may be a correlation between elevated measured wheel impact load detector impacts and the subsequent vertical split rim failure of the wheel.
2. While both Transport Canada's Emergency Directive pursuant to section 33 of the Railway Safety Act and Association of American Railroads Circular OT-55-N require roller bearings to be monitored by wayside hot bearing detectors, neither require rolling stock to be monitored using wheel impact load detector technology, which could further mitigate the risk posed by transporting dangerous goods.

Safety action taken

Transportation Safety Board of Canada

Rail Safety Advisory Letter 15/13

On 26 November 2013, the Transportation Safety Board of Canada (TSB) issued Rail Safety Advisory Letter 15/13, entitled Operating Lever Design for Tank Car Bottom Outlet Valve. The letter outlined that the bottom outlet valve (BOV) operating levers of tank cars TILX 192186 and PROX 76346 met Association of American Railroads (AAR) design requirements yet failed to prevent product loss, as both levers were bent and both BOVs opened and facilitated the release of substantial amounts of product. The letter indicated that, with over 228 000 Class 111 tank cars currently in service in North America and their propensity for BOV operating lever failure resulting in product loss during accidents, Transport Canada (TC) may wish to review the BOV operating lever design requirements for Class 111 tank cars.

Transport Canada

In response to Rail Safety Advisory Letter 15/13, TC indicated the following:

• TC's Transportation of Dangerous Goods (TDG) Directorate will continue to communicate with the AAR regarding this problem with BOVs, which appears to be limited to the quarter-turn, straight-through ball valve. Unfortunately, most cars in crude oil service are equipped with the quarter-turn ball valve.
• Many of the detailed requirements applicable to service equipment are found in the AAR Specification for Tank Cars, Specification M-1002. Appendix E of Specification M‑1002 contains requirements for the protection of BOVs in section 10.1. These requirements are cited in the current Canadian tank car standard, CAN/CGSB-43.147-2005, and in the proposed TC tank car standard, TP 14877.
• Docket T10.7.5 was formed by the AAR Tank Car Committee to investigate the behaviour of BOVs in derailments and propose possible solutions. The TDG Directorate participates on the Tl0.7.5 Task Force, which is now close to providing new regulatory text for adoption in Specification M-1002.

The latest revised draft proposed at the January 2014 AAR Tank Car Committee states the following:

10.1.2.8 Bottom Outlet Actuation

10.1.2.8.1 For cars ordered built new before ****, bottom outlet valve handles, unless stowed separately, must be designed to either bend or break free on impact, or the handle in the closed position must be located above the bottom surface of the skid.

10.1.2.8.2 Cars ordered built new on or after **** equipped with bottom outlet valves must have handles in a configuration specified below:

Handle that is stowed separately:

• Handles that are stowed separately must be equipped with a coupling as shown in Fig. *** and valves must be equipped with a coupling as shown in Fig. ***. Figure for illustration purposes only.
• Provision must be made for handle stowage to prevent loss of handle due to stresses or shocks incident to transportation.

Handle that is located completely within the skid:

• Handles can remain coupled to the valve provided they remain completely within the skid when in the closed position, and be equipped with a closed-position locking mechanism that requires a shear force in excess of TBD
  (e.g., ½ “ diam) pounds at the locking mechanism to operate the valve when locked.

Handle that is disengaged from the valve when in the closed position:

• Handles that are not stowed separately and located outside of the skid:
  • When in the closed position must be located above the bottom surface of the skid, and be disengaged from the valve.
  • When in the closed position must be equipped with a means to prevent unintended engagement with the valve.
  • When in the open position must remain engaged (coupled) with the valve.

Alternate means of actuation are permitted, if approved by the AAR Tank Car Committee meeting the intent of these rules.

10.1.2.8.3 Fully open valve position must be clearly discernible from the side of the car when viewed at the bottom skid level.

10.1.2.8.4 The valve operating mechanism must ensure against the operation of the valve due to stresses or shocks incident to transportation.

As part of the North American push to increase the safety of Class 111 tank cars, a study of BOV general performance in transport and possible retrofit of existing BOV actuating devices built to the old standard will be undertaken by the AAR Tank Car Committee and the DOT 111 Task Force of this Committee.

The TDG Directorate will continue to participate in these discussions at the AAR Tank Car Committee to ensure that these proposed requirements provide an increased level of safety for BOVs.

Association of American Railroads

Tank car bottom outlet valve operating handle design

In November 2013, in its response to a United States Pipeline and Hazardous Materials Safety Administration (PHMSA) Advanced Notice of Proposed Rulemaking (ANPRM), the AAR recommended that additional safety upgrades be required to those tank cars built since 2011, including design modifications relating to bottom outlets. Specifically, the AAR Tank Car Committee is proposing that upgrades be required to protect BOVs and valve handles to reduce the likelihood of the valve being damaged or actuating during a derailment. The AAR supports a requirement for this improvement on any car, new or currently in service, that is operating in flammable liquid service.

This report concludes the Transportation Safety Board’s investigation into this occurrence. the Board authorized the release of this report on 05 November 2014. It was first released on 11 December 2014.

• R99H0010 – On 30 December 1999, Canadian National Railway (CN) freight train U‑783‑21-30 was travelling westward on the north track of the Saint-Hyacinthe Subdivision. At Mile 50.84, near Mont-Saint-Hilaire, Quebec, the train derailed, and cars fouled the adjacent south main track. At about the same time, CN freight train M-306-31-30 was travelling eastward on the south track and collided with the cars of train U-783-21-30, which had just derailed. Two crew members on train M-306-31-30 were fatally injured in the accident.
  
  The report identified that an existing pre-crack was sufficient to initiate rail failure under the effect of stresses induced on the rail by the combination of low ambient temperatures and wheel impact loads of 103 to 112 kips, which were above Association of American Railroads (AAR) condemning criteria, but below CN company wheel impact load detector (WILD) threshold limits.
• R03T0030 – On 23 January 2003, while travelling at 34 mph, Canadian Pacific Railway (CP) freight train 213–22 was handling 92 cars (23 loads, 69 empties) when it derailed 29 cars at Mile 78.2 of the White River Subdivision. The temperature at the time was –20°C.
  
  The derailment occurred when the R2 wheel on the 10th car from the head end experienced a vertical split rim (VSR) failure. Impacts from the broken wheel caused the south rail to fail, resulting in the derailment. Two days previously, the same wheel had recorded a measured impact of 99 kips while travelling at a speed of 30 mph, which equates to a calculated impact of 136.5 kips. While the measured impact force was above the AAR's condemning limit of 90 kips, both the measured and calculated impacts were below CP's WILD removal thresholds. Consequently, no maintenance action was initiated for the wheel set after the impact measurement.
• R03T0064 – On 02 February 2003, while travelling at 37.5 mph, CP freight train 938–12 was inspected at a WILD site near Raith, Ontario, about 59 miles (95 km) west of Thunder Bay, Ontario. Although there were no wheel impacts greater than 140 kips, 4 of the recorded impacts were between 90 kips and 116 kips, which correlated to calculated impacts of between 109 kips and 144 kips. No maintenance action was taken or required.
  
  On 13 February 2003, CP freight train 938–12 was proceeding southward at 42.5 mph when it derailed 21 cars at Mile 39.5 of the Parry Sound Subdivision near Nobel, Ontario. The investigation determined that wheel impacts from the head-end portion of the train that were greater than the AAR Rule 41 condemning limit of 90 kips, but below CP's threshold of 140 kips, likely initiated a brittle fracture from the root of the pre-crack through the base of the rail, facilitating a final catastrophic rail failure.
• R11V0039 – On 12 February 2011, CN coal train C-751-51-11 was travelling westward on the Nechako Subdivision at about 45 mph when it experienced a train-initiated emergency brake application at Mile 93.45, near Fort Fraser, British Columbia. Upon examination, it was determined that a total of 36 cars had derailed.
  
  The derailment occurred as the L2 wheel on car BCNE 900534 failed catastrophically when the wheel experienced a VSR failure. The fracture originated at the base of a shell that had developed as a result of rolling contact fatigue and extended through the unsupported portion of the wheel tread throughout ¼ of the wheel circumference.
  
  Less than 3 hours before the derailment, the wheel recorded a WILD reading of 94.4 kips at a WILD site located about 78 miles in advance of the derailment site. On 3 other occasions in the previous 1 ½ months, the same wheel recorded impacts of over 80 kips. The investigation also determined that company WILD policies may not provide adequate guidance to identify emerging wheel defects when wheel impacts are above the AAR Rule 41 condemning limits but below company thresholds.
• R11T0072 – On 27 March 2011, CN freight train M30511-26, transporting 97 loaded and 19 empty cars, was proceeding westward at about 50 mph on the Kingston Subdivision when a train-initiated emergency brake application occurred, and 25 cars derailed near Port Hope, Ontario (Mile 268.50). The derailment occurred as the R4 wheel on tank car PROX 43452 failed catastrophically when the wheel experienced a VSR failure. The fracture originated at the base of a shell, about ¼ inch below the tread surface. The fracture origin developed as a result of rolling contact fatigue and extended through the unsupported portion of the wheel tread throughout ¼ of the wheel circumference.
  
  Between 29 December 2010 and 27 March 2011, the PROX 43452 R4 wheel recorded 5 WILD impacts that exceeded the AAR Rule 41 condemnable limit of 90 kips. These included a reading of 94.2 kips on the day of the derailment. Despite multiple WILD readings that exceeded AAR WILD thresholds, and numerous opportunities for a targeted inspection and/or removal of the wheel in the 3 months prior to the accident, the wheel remained in service until it failed.