Railway Investigation Report R14W0256

On 07 October 2014, at approximately 1135 Central Standard Time, Canadian National Railway Company (CN) freight train A40541-05 was proceeding westward on the CN Margo Subdivision when it derailed 26 cars, including 6 tank cars loaded with dangerous goods, at Mile 74.58 near Clair, Saskatchewan. Two of the tank cars, which were loaded with petroleum distillates (UN 1268), released product that subsequently caught fire. As a precaution, approximately 50 residents within a two-mile radius were evacuated and Provincial Highway 5 was closed. Approximately 650 feet of track was destroyed. There were no injuries.

On 06 October 2014, at approximately 1300,^{Footnote 1} Canadian National Railway Company (CN) freight train A40541-05 (the train) departed Winnipeg, Manitoba, for Edmonton, Alberta. Prior to departure, the train had received a Certified Car Inspection and a No. 1 air brake test, which were performed by a certified car inspector. The train was not a key train.^{Footnote 2} While en route, the train lifted 12 cars at Grandview, Manitoba. Then, at Canora, Saskatchewan, the train set out 56 cars and lifted 39 cars.

On 07 October 2014, at approximately 0605, the train departed Canora. The train consisted of 3 locomotives, 40 loaded cars, 53 empty cars, and 7 residue tank cars. The train weighed 6727 tons and was 6142 feet long. The train crew consisted of a locomotive engineer and a conductor. Both crew members were qualified for their respective positions, met fitness and rest standards, and were familiar with the subdivision.

While en route, the train was subject to a number of roll-by inspections at crew change locations and by crew members of trains that were met en route.^{Footnote 3} The train also travelled over a number of wayside inspection systems, which included a wheel impact load detector at Mile 20.4 of the Rivers Subdivision and several hot bearing detectors including 1 at Mile 21.5 of the Margo Subdivision. No significant defects were identified during these inspections.

1.1 The accident

At approximately 1135, near Clair, Saskatchewan (Figure 1), while proceeding westward on the Margo Subdivision at 40 mph with the throttle in position 6 and the brakes released, the crew felt a tug from the train. Shortly thereafter, a train-initiated emergency brake application occurred.

Looking toward the back of the train, the crew saw the train derail and catch fire. At the time of the occurrence, the crew had been on the radio with the rail traffic controller (RTC), discussing an unrelated matter. The crew was immediately able to advise the RTC of the derailment. After coming to a stop, the crew uncoupled the locomotives, proceeded a safe distance westward away from the burning cars, and made the necessary emergency radio broadcast. There were no injuries.

1.2 Weather

At the time of the accident, the temperature was 7°C and the skies were partly cloudy with light wind from the northwest. By 0400 on 08 October 2014, the wind had changed and was coming from the northeast (Table 1).

For an emergency response involving dangerous goods (DG) and fire, wind direction is critical for protecting response personnel, and entries to the site should be made from a primarily upwind location.

1.3 Site examination

The train derailed on tangent track in the vicinity of the railway crossing located at Mile 74.59. Twenty-six cars, from the 32nd to the 57th car behind the locomotives, had derailed and came to rest in various positions. The derailed equipment included 6 cars loaded with DG. Two tank cars (the 40th and 41st cars) loaded with hydrochloric acid (UN 1789) came to rest on the crossing and just west of it. Other equipment that derailed just east of the crossing included 2 tank cars (the 42nd and 43rd cars) loaded with sodium hydroxide solution (UN 1824) and tank cars GATX 82043 and PROX 126 (the 51st and 52nd cars) that were loaded with petroleum distillates (UN 1268) (Photo 1).

Tank car GATX 82043 sustained impact damage to its shell and A-end head which resulted in a release of product. The released product ignited and fed the post-derailment pool fire. Tank car PROX 126, which remained in the pool fire, sustained 2 thermal tears. Nearly all of the contents of these 2 cars were consumed in the fire.

During the site examination, the wheels of the head end cars that did not derail were examined. The wheels of the 31st car, DOWX 3282, a DG tank car loaded with ethanolamine (UN 2491), exhibited impact marks on the wheel tread (Photo 2).

Both rails were broken at Mile 74.58. The broken rail pieces from the south rail displayed impact marks on their west ends. A transverse defect^{Footnote 4} was present on 1 of the fracture surfaces. The mating fracture surface was not recovered. In addition, rail head checks,^{Footnote 5} shelling,^{Footnote 6} and a number of localized surface collapses (LSC)^{Footnote 7} were also present on the south rail. The vertical wear on the head of the rail was ¼ inch. Four pieces of the south rail were recovered and sent to the TSB Laboratory for further analysis.

1.4 Dangerous goods

In this occurrence, there were 6 derailed tank cars that were loaded with DG:

• GATX 82043 and PROX 126 contained petroleum distillates, Class 3, Packing Group (PG) III. Both cars ruptured and the contents were burned to atmosphere in the subsequent fire and flaring activity.
• SHPX 204894 and GATX 1601 were loaded with hydrochloric acid, Class 8, PG II. Neither car released any product. Both cars were subsequently transshipped during the site clean-up.
• TILX 160071 and UTLX 630502 were loaded with sodium hydroxide solution, Class 8, PG II. Neither car released any product. Both cars were subsequently transshipped during the site clean-up.

1.4.1 Petroleum distillates

Guide 128 of the Emergency Response Guidebook^{Footnote 8} identifies the potential hazards of the product and provides guidance for emergency response and for ensuring public safety. Under Potential Hazards, Guide 128 provides the following information relating to flammable liquids of the type that includes petroleum distillates:

• They are lighter than water, are highly flammable, and “will be easily ignited by heat, sparks or flames.”^{Footnote 9}
• “[V]apors are heavier than air. They will spread along ground and collect in low or confined areas (sewers, basements, tanks).”^{Footnote 10} These “vapors may form explosive mixtures with air and may travel to source of ignition and flash back.”^{Footnote 11}
• They are associated with a “vapor explosion hazard indoors, outdoors or in sewers,” and “containers may explode when heated.”^{Footnote 12}

Under Emergency Response and Public Safety, Guide 128 states that water spray, fog, or regular foam should be used to fight fire, and straight streams of water should not. Because these products have a very low flash point, water spray may be inefficient and vapor-suppressing foam may be necessary to reduce vapors. Further, it provides the following information:

• Consider initial downwind evacuation for at least 300 meters (1000 feet).

[…]

• ELIMINATE all ignition sources (no smoking, flares, sparks or flames in immediate area).
• All equipment used when handling the product must be grounded.
• Do not touch or walk through spilled material.
• Stop leak if you can do it without risk.
• Prevent entry into waterways, sewers, basements or confined areas.

[…]

• Absorb or cover with dry earth, sand or other non-combustible material and transfer to containers.
• Use clean non-sparking tools to collect absorbed material.^{Footnote 13}

1.5 National Fire Protection Association 472 Standard

The National Fire Protection Association 472 Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents (NFPA 472) is the standard applied for response agencies throughout North America. NFPA 472 specifies the minimum level of competencies required by responders to emergencies involving hazardous materials^{Footnote 14} (hazmat) and weapons of mass destruction, which are necessary for a risk-based response to these types of incidents. The standard covers competencies for

• awareness level personnel;
• operations level responder;
• hazmat technicians;
• incident commanders;
• hazmat safety officers; and
• other specialist employees.^{Footnote 15}

Competencies for hazmat technicians and incident commanders are similar and include the ability to

1. Analyze a hazmat/weapons of mass destruction incident to determine the complexity of the problem and potential outcomes.
2. Plan a response within the capabilities of available personnel.
3. Implement the planned response consistent with the standard operating procedures and the site safety and control plan.
4. Evaluate the progress of the planned response and modify the plan if necessary.
5. Terminate the incident by assisting in an incident debriefing and critique.^{Footnote 16}

In addition, incident commanders for responding agencies are required to conduct an incident debriefing and a multi-agency critique as well as submit a report of the incident to the authority having jurisdiction (AHJ).^{Footnote 17} The purpose of the critique is to learn what went right, what went wrong, and what needs to be improved to make responses safer in the future.

1.6 Canadian National Railway dangerous goods management

CN has implemented a DG management and response system under the direction of its vice-president, Safety and Sustainability (VPSS). Reporting to the VPSS is an assistant vice-president, Safety and Emergency Response (AVP) who, among other duties, leads a team of dangerous goods officers (DGO). There are 3 senior DGOs (SDGO) responsible for oversight within their assigned regions of Western Canada, Eastern Canada, and United States operations.

DGOs are stationed at most major terminals throughout CN territory, with various staff at each terminal also trained to assist in the responses. All team members are trained on the requisite NFPA 472 competencies for their positions and receive recurrent training every 3 years at the Association of American Railroads (AAR) Transportation Technology Center Incorporated Security and Emergency Response Training Center (SERTC) in Pueblo, Colorado.

At the time of the accident, the AVP had 27 years of fire and hazmat experience and had responded to over 100 major railway occurrences involving the release of DG. The AVP joined SERTC as a hazmat instructor in 1991 and occupied positions of increasing authority up to director. In 2006, already recognized as an expert in the field of emergency response involving DG, the AVP was recruited by CN and was tasked with developing the CN DG team, the CN Emergency Response Plan and the company-wide Railway Emergency Response Course. Each of these initiatives was based on established emergency response practices, company guidance, and NFPA 472.

The SDGO (Western Canada) had a background in chemistry and became a hazmat instructor at SERTC in 2001. The SDGO joined CN as a DGO in 2006 before being appointed as SDGO for Western Canada in 2010. The SDGO had responded to approximately 20 major derailments involving the release of a DG and was considered to be an expert in emergency response involving DG.

CN DGOs are equipped with

• hard copy reference material such as the Emergency Response Guidebook, the National Institute for Occupational Safety and Health manual and various conversion charts;
• fire turnout gear;
• fire retardant clothing;
• self-contained breathing apparatus;
• a four-gas meter (lower explosive limit, oxygen, carbon monoxide and carbon dioxide);
• colourimetric tubes for sampling products that cannot be sampled using the four-gas meter; and
• a portable weather monitoring device that is capable of detecting wind speed and direction.

A weather monitoring device can be useful for determining the direction of approach by the emergency responders at the accident site. In this occurrence, CN responders did not use a weather monitoring device.

1.7 Incident command

When dealing with Class 3 flammable liquid products in an emergency response situation, industry best practice requires that a formalized incident command (IC) structure be established to manage the response.

IC has been used extensively by the military, firefighters, police services, and hazmat emergency response teams, and has been incorporated into law in the United States since March 1990.^{Footnote 18} IC is a response management system, developed to organize people, equipment, and resources to respond to any emergency situation, including incidents that involve fire and DG. In Canada, when IC is established for fire and hazmat incidents, the local fire chief or provincial official may be the AHJ and assume the role of incident commander. The senior railway company officer on site will usually implement company IC and manage remediation activities.

A properly implemented IC would comprise, but not be limited to

• an incident commander who is responsible for overview of the incident;
• IC staff with clear lines of responsibility and consisting of a public information officer, site safety officer, logistics and planning officer, and other positions, depending on the size and complexity of the incident;
• a site perimeter with adequate security to control access;
• a dedicated command post to facilitate meetings and briefings;
• a controlled site entry access point;
• a site control system, with sign-in sheets and tags to keep track of all personnel on site and coordinate activities;
• oversight of all interventions to ensure that they are appropriate and use equipment that is compatible for the product involved (in the case of flammable liquids, this would include use of non-sparking tools, intrinsically safe electronics, and grounded equipment to prevent igniting a flare-up);
• oversight of mitigation activities to ensure that they are properly coordinated and supervised for safety;
• written records (ICS forms) signed off by appropriate authorities outlining site entries, planned activities, mitigation strategies, as well as unplanned events or issues encountered that impact safety; and
•  a debriefing with all parties following the response to document what went right, what went wrong, and what can be done to improve responses in the future.

1.7.1 Site incident command

With multiple agencies and companies responding, a unified command system (UCS) was established. The UCS included the responding Wadena volunteer fire department, the Saskatchewan Ministry of the Environment (MOE), the Office of the Fire Commissioner of Saskatchewan (OFC) and CN. Transport Canada (TC) and the Transportation Safety Board of Canada (TSB) also responded, but are generally not formally included in the UCS.

The Wadena fire chief (FC) was designated the incident commander. While the FC and assistant fire chief (AFC) were experienced fire fighters, they were not trained to NFPA 472 and had no experience with this type of response. This was the Wadena fire department's first experience with a derailment involving DG, and it was not equipped to respond to such an accident. Consequently, the MOE became the de facto incident commander within the UCS, assumed the role of the AHJ, and became responsible for documenting the response.

The FC primarily liaised with the incident command post (ICP) and was verbally briefed on developments. The Wadena fire department provided fire support and was on the ground near the site, under the direction of the AFC, prepared to intervene if required. The MOE and OFC responders are trained to establish an IC structure and respond to DG incidents. In this case, both provided logistical support at the ICP. All parties relied on CN operational expertise to deal with the tank cars, DG, and site remediation.

Within the UCS, the CN senior vice-president, Western Operations (SVPW), represented CN as its incident commander. The SVPW managed all CN operations in the vicinity of the accident.

Throughout the response, the FC as well as MOE and OFC staff primarily remained at the ICP. No staff was assigned to monitor or report on CN operational activities at the site.

1.8 Timeline of response

The following sequence of events was compiled from various sources. Some times are approximated based on known events.

1135 – The derailment occurred and initial reports indicated there were no injuries but freight cars were on fire. At the time, it was not known which cars or how many cars were on fire.

1300 – TSB investigators were deployed from Winnipeg, Manitoba, and Calgary, Alberta.

1315 – Two TC transportation of dangerous goods (TDG) inspectors were deployed from Saskatoon, Saskatchewan.

1345 – The Wadena fire department and Royal Canadian Mounted Police (RCMP) were the first on site. They established a one-mile evacuation zone, and all roads into the area were monitored. The Quill Lake, Saskatchewan, volunteer fire department and the Shamrock, Saskatchewan, Emergency Medical Service (EMS) also responded. The MOE established an ICP.

1400 – Two TC TDG inspectors were deployed from Winnipeg.

1510 – Due to shifting winds and smoke, the evacuation zone was increased to 2 miles. About 10 houses in the vicinity and the community of Clair had been evacuated (approximately 50 people).

1530 – A CN DGO provided an update to CANUTEC^{Footnote 19} indicating that

• Two DG tank cars containing petroleum distillates (position 51-52) were on fire.
• Two DG tank cars containing hydrochloric acid (position 40-41) were derailed but not on fire.
• Two DG tank cars containing sodium hydroxide (position 42-43) were derailed but not on fire.

1615 – The fire was no longer visible at the accident site from the ICP. The 2 TC TDG inspectors from Saskatoon arrived on site.

1645 – Aerial photos were taken by the MOE.

The MOE commenced with written ICS incident briefings (IB) and incident action plans (IAP). The activities outlined in the IB and IAP were general in nature and did not detail any specific actions taken before interventions for site remediation.

A site assessment was commenced by hazmat technicians from the Railway Association of Canada, Envirotec (CN contractor) and a CN DGO.

1830 – The site assessment team returned and provided the following assessment:

• car number 51 - GATX 82043 (petroleum distillates, UN 1268) was a Class 111 tank car. The car was breached on 1 end and a localized fire was burning. This car appeared to have lost all of its contents.
• car number 52 - PROX 126 (petroleum distillates, UN 1268). This was a dual compartment Class 111 tank car. One compartment appeared to be breached.
• car numbers 40 to 43 - The 2 tank cars containing hydrochloric acid (UN 1789) and 2 tank cars containing sodium hydroxide solution (UN 1824) remained intact.

It was decided that an assessment team would re-enter the site with fire turnout gear and full self-contained breathing apparatus to complete a more in-depth assessment of the tank car damage.

2000 - CN SDGO (Western Canada) arrived on site and joined the assessment team. TSB arrived on site.

2100 – CN SDGO provided the following verbal updated assessment to all parties:

• PROX 126 came to rest on its left side. Both compartments of the car were breached and released product. The right side of the B-end compartment, which was facing south, had a 65-inch-long thermal tear, which was facing upward in the derailed position.
• Some ground fire remained around the 2 petroleum distillate cars (GATX 82043 and PROX 126).
• Both petroleum distillate cars had a small amount of product remaining and were still smoldering, but deemed to no longer pose a risk.
• The 2 hydrochloric acid and 2 sodium hydroxide solution tank cars were dented but not leaking and posed minimal hazard, although DG tank cars SHPX 204894 (hydrochloric acid) and TILX 160071 (sodium hydroxide solution) were on their sides.
• No lower explosive limit or volatile organic compound levels were detected, and there were no obvious health risks present.
• The perimeter zone was reduced to the wreck site. The Quill Lake volunteer fire department was released.
• The Wadena fire department and Shamrock EMS remained and were moved to the new perimeter of the accident on Highway 5 just north of the derailment site, where they set up and were prepared to intervene if necessary.
• Highway 5 remained closed, but evacuated residents were allowed to return to their homes the following morning.

2115 – Revised IB indicated that wrecking operations and site remediation were to begin as soon as possible. The priority was to move the 2 petroleum distillate tank cars, 2 hydrochloric acid tank cars, and 2 sodium hydroxide solution tank cars to be clear of the track area. The introduction of air to the 2 petroleum distillate tank cars was considered to enhance burning.

2145 – The 2 TC TDG inspectors from Winnipeg arrived and remained on site throughout the night. The 2 TC TDG inspectors from Saskatoon departed and returned to Saskatoon.

2200 – A revised IAP was established in conjunction with the commencement of CN wrecking operations. The IAP indicated that CN wrecking operations commenced with the re-positioning of the DG tank cars as a priority.

The activities outlined in both the revised IB and IAP were general in nature and did not detail the specific actions of a tactical plan to be taken before interventions for site remediation.

The operations began with the removal of the non-dangerous derailed cars at the west end of the derailment and worked toward the 2 petroleum distillate cars (GATX 82043 and PROX 126) involved in the fire. CN planned to eventually pull both of these cars out of the way to the south of the site, then flare^{Footnote 20} the cars to burn off any residual product remaining.

2230 – The CN VPSS and AVP arrived on site. The AVP provided overview and guidance for the tactical plan to deal with DG aspects during wrecking operations.

2300 – CN verbally informed the TSB of its plan. Since the site would not be accessible for examination until the following morning, TSB investigators retired for the night and planned to return early the following morning.

2315 – CN SVPW signed off on the revised IB and IAP on behalf of CN.

2330 – A meeting ensued at the ICP between the MOE and the CN VPSS and AVP. Following the meeting, CN personnel proceeded to the site to oversee wrecking operations and execution of the tactical plan for the DG cars.

1.8.1 08 October 2016 - Events surrounding the flaring of tank car PROX 126

0015 – A TC TDG inspector updated CANUTEC on the CN plan to clean up the derailment site.

0200 – DG tank car GATX 82043 was pulled southward and removed from the track.

0300 - DG tank car PROX 126, with approximately 20% to 30% of its load remaining, was being pulled south across an adjacent shallow ditch when the car rolled a quarter turn. In this position, the 65-inch-long thermal tear in the B-end compartment, which was facing upward in the derailed position, was now facing slightly downward and released an estimated 2400 to 3200 litres of petroleum distillates. The product pooled on the ground near the tank.

Subsequently, the CN SDGO conducted additional damage assessment and air monitoring around the pool and downwind. Since there was a boxcar and auto rack actively burning just east of PROX 126, on the south side of the right of way, it was determined that eventually vapors could drift to the burning boxcar and could lead to an unpredictable ignition later. Based on the high flashpoint and the air monitoring, it was determined that the best course of action would be to control the situation and ignite the pool.

The plan was verbally discussed with the AFC and the TC TDG inspectors. All non-essential personnel were moved upwind and well clear of the site. The Wadena fire department was standing by on the highway with a charged hose line while the AFC video-recorded the flaring operation. The 2 TC TDG inspectors had moved to a safe distance some 300 to 400 metres away from the site.

0400 – At about this time, the wind, although light, had shifted from predominantly northwest to northeast. The CN SDGO and AVP, who were wearing fire retardant clothing, hard hats, safety glasses, and boots ignited a road flare and approached the pool from a slightly downwind position in line with the pool and the thermal tear in PROX 126 (Figure 2).

The flare was thrown into the pool near the base of the tank (Photo 3).

The product pool ignited and began to burn at the base of the tank car (Photo 4) when an unexpected flash fire occurred as the vapors inside the breached tank car ignited, sending a large fire ball toward the CN SDGO and AVP (Photo 5).

Both took immediate evasive action as the fire ball blew over them and then quickly extinguished itself. The SVPW and VPSS, who were on site at the time, immediately approached the CN SDGO and AVP. There were no injuries. Subsequently, wrecking activities continued.

From their vantage point and in the darkness, the TC TDG inspectors could not see the CN SDGO and AVP. While the TC TDG inspectors did notice the fire, they were unaware that a close-call had occurred during the flaring of PROX 126, and there was no mention of the flaring activity in the TC Accident Attendance Report.

The TSB investigation team returned to the site at approximately 0700 at which time all of the cars had been moved clear of the track and there was no fire. Subsequently, the TSB met with CN personnel for an update on activities. CN informed the TSB that a car had been flared off during the night, but there was no mention of the close-call during the flaring activity.

0800 – Another TC TDG inspector and a TC TDG remedial measures specialist arrived on site. The 2 TC TDG inspectors from Winnipeg departed the site for rest.

A site meeting was held with all attending agencies in the ICP. At that time, the site was reported as being stable. The IB and IAP were updated to indicate that track restoration, site remediation, and product transfers of remaining product would commence and continue until complete. At no time did CN provide a briefing to any of the attending agencies, nor was any internal CN documentation or report prepared indicating that a close-call had occurred during the flaring of PROX 126.

At 1930 on 11 October 2014, site remediation and product transfers were complete and the incident concluded.

The AFC had recorded a video, but the FC reportedly only became aware of the close-call a few weeks later. Although the FC was the incident commander for the response, no subsequent verbal or written debrief of the close-call was submitted to the MOE, TC or TSB.

The video-recording of the flaring activity of DG tank car PROX 126 was made public and broadcast in early December 2015. Only then did the MOE, TC and TSB become aware that a close-call had occurred.

1.9 Incident command documentation

By their nature, responses to derailments involving DG are usually dynamic and fluid as situations can change at any time. It takes some time to coordinate evacuation, secure the site, get hazmat technicians on site, conduct initial reconnaissance activities, and get an IC structure in place.

Once the IC had been established, and in accordance with established emergency response practice, the MOE commenced with written IB and IAP at approximately 1645. The IB and IAP were again updated at approximately 2115, and were subsequently signed off by all parties. However, the activities outlined in the initial IBs and IAPs were general in nature and did not detail site entry times, specific actions or monitoring performed before CN wrecking operations commenced or during wrecking operations as the situation changed. Once wrecking operations commenced at approximately 2200, they were continued until all cars were clear of the track at approximately 0500 on 08 October 2014. There was no CN or MOE record of any updated information regarding site operations during this time. The MOE did not have anyone assigned to monitor CN operations at the site and did not require updates as CN wrecking activities progressed. Consequently, the MOE was unaware that product had accidently released or that a close-call had occurred during the flaring activity.

For each incident, CN maintains its own detailed Emergency Response Incident Command Logbook. The Logbook was well structured and contained useful information and guidance for its completion. Guidance requires that all meetings with external parties be documented in the logbook. CN risk management personnel were tasked with completing the logbook. In this occurrence, the documentation was sparse with only 9 of the 108 pages partially completed and a site diagram. More specifically, there was no record of

• tank car information or damage assessment;
• site entry or monitoring of the affected cars;
• wrecking activities;
• any internal meetings or decisions;
• any meetings with, or briefings provided to, the MOE or other external parties; or
• any debriefing activities to discuss what went right, what went wrong, and what was learned that could be applied in the future.

Subsequent to the close-call during the flaring activity, an incident debriefing occurred during a CN DG Team conference call about 3 weeks after the derailment. After a discussion, it was decided to draft a controlled burn procedure that references the importance of openings in the car where a similar pressure event could take place and, if possible, ensure the ignition source is introduced at a 90-degree angle to the opening. The first draft DG Team Standard Operating Guideline (SOG) 200.16, entitled Controlled Burn, was prepared by September 2015. The SOG was issued on 07 January 2016, 15 months after the close-call.

1.10 Circadian rhythm and the effects of fatigue

Virtually every function in the body (i.e., temperature, digestion, hormone levels) follows a daily cycle known as a circadian rhythm. These cycles follow a pattern of approximately 24 hours, with the lowest point of activity normally in the early morning and a second, less pronounced low occurring in the early afternoon. Disruptions in circadian rhythms can affect performance and cognitive functioning,^{Footnote 21} with decreased performance levels correlating to these low points in the circadian rhythm. In addition, fatigue will also be more pronounced during the first night shift, after shifting from day work, since sleep propensity increases dramatically at night.^{Footnote 22}

Performance decrements associated with periods of prolonged wakefulness have been addressed in research literature for some time. A study quantifying performance impairment due to fatigue^{Footnote 23} determined that the performance level on various tasks will deteriorate steadily after 17 hours without sleep. Another laboratory study of fatigue^{Footnote 24} demonstrated that 17 hours of sustained wakefulness produces impairments in psychomotor functioning (hand-eye coordination) equivalent to a blood alcohol concentration (BAC) of 0.05%, and 24 hours of sustained wakefulness produces impairments equivalent to a BAC of 0.10%. Fatigue due both to prolonged wakefulness and disruptions in the circadian rhythm is known to produce similar decrements in performance and cognitive functioning. Decreased vigilance is one type of attentional deficit that is also associated with fatigue.

1.11 Senior Canadian National Railway personnel hours of service

The accident occurred at approximately 1135 Central Standard Time (CST), on Tuesday, 07 October 2014. The AVP and SDGO were both off duty during the weekend preceding the accident, and Monday was a regular work day.

The AVP, who is stationed in Chicago, Illinois, works an average of 50 hours a week and routinely wakes up at approximately 0630 Central Daylight Time (CDT) in the morning and goes to sleep at approximately 2230 CDT at night. On the day of the accident, the AVP awoke at the usual time. After the accident occurred, the AVP worked straight through the night without any rest until later the following morning, after the flaring activity occurred at approximately 0400 CST on Wednesday, 08 October 2014.

The SDGO, who was stationed in Vancouver, British Columbia, routinely wakes up at approximately 0500 Pacific Daylight Time (PDT) in the morning and goes to sleep at approximately 2200 PDT at night. On the day of the accident, the SDGO awoke at the usual time. After the accident occurred, the SDGO worked straight through the night without any rest until after the flaring activity occurred.

1.12 Regulatory oversight

TC promotes safe and secure transportation systems in the air, marine, rail, and road modes, as well as the safe transportation of DG. To do so, TC develops safety regulations and standards and, in the case of railways, it facilitates the development of rules by the rail industry. Once TC approves the rules, it is then responsible for their enforcement.

Rail safety is governed by the Railway Safety Act. The objectives of the Act are to

1. promote and provide for the safety and security of the public and personnel, and the protection of property and the environment, in railway operations;
2. encourage the collaboration and participation of interested parties in improving railway safety and security;
3. recognize the responsibility of companies to demonstrate, by using safety management systems and other means at their disposal, that they continuously manage risks related to safety matters; and
4. facilitate a modern, flexible and efficient regulatory scheme that will ensure the continuing enhancement of railway safety and security.

TC tests and promotes safety technologies and has developed safety management system regulations requiring railways to manage their safety risks.

1.13 Safety management system regulations

Traditional approaches to safety management were based primarily on compliance with regulations, reactive responses following accidents and incidents, and a “blame and punish, or retrain” philosophy.

A safety management system (SMS) is “a systematic, explicit and comprehensive process for managing safety risks.”^{Footnote 25} It is a means to ensure that the railway has the processes in place to identify the hazards in its operation and mitigate the risks. SMS was designed around evolving concepts about safety that are believed to offer great potential for more effective risk management. SMS was progressively introduced in the Canadian transportation industry because this approach to regulatory oversight, which seeks to ensure that organizations have processes in place to systematically manage risks, when combined with inspections and enforcement, is more effective in reducing accident rates.

Section 2 of the TC Rail Safety Management System Regulations (2001) (SMS Regulations),^{Footnote 26} which were in force at the time of the accident, states^{Footnote 27}

2. A railway company shall implement and maintain a safety management system that includes, at a minimum, the following components:

1. the railway company safety policy and annual safety performance targets and the associated safety initiatives to achieve the targets, approved by a senior company officer and communicated to employees;
2. clear authorities, responsibilities and accountabilities for safety at all levels in the railway company;
3. a system for involving employees and their representatives in the development and implementation of the railway company's safety management system;
4. systems for identifying applicable
   1. railway safety regulations, rules, standards and orders, and the procedures for demonstrating compliance with them, and
   2. exemptions and the procedures for demonstrating compliance with the terms or conditions specified in the notice of exemption;
5. a process for
   1. identifying safety issues and concerns, including those associated with human factors, third-parties and significant changes to railway operations, and
   2. evaluating and classifying risks by means of a risk assessment;
6. risk control strategies;
7. systems for accident and incident reporting, investigation, analysis and corrective action;
8. systems for ensuring that employees and any other persons to whom the railway company grants access to its property, have appropriate skills and training and adequate supervision to ensure that they comply with all safety requirements;
9. procedures for the collection and analysis of data for assessing the safety performance of the railway company;
10. procedures for periodic internal safety audits, reviews by management, monitoring and evaluations of the safety management system;
11. systems for monitoring management-approved corrective actions resulting from the systems and processes required under paragraphs (d) to (j); and
12. consolidated documentation describing the systems for each component of the safety management system.

The SMS Regulations also require railway companies to

• maintain records to permit the assessment of safety performance;
• submit documentation and records to the Minister that demonstrate compliance with the regulations; and
• produce safety management documentation upon request.

1.14 Canadian National Railway safety management system

In accordance with the SMS Regulations, CN has developed and implemented a detailed SMS. CN's SMS has been enhanced every year since 2008 and been integrated into most facets of its operations. It describes company initiatives which correlate to the requirements of Section 2 of the SMS Regulations and has evolved to the point where it has been included in TC's SMS Guide of Best Practices.

With regards to Section 2, sub-section (g) of the SMS Regulations, CN has implemented systems for accident and incident reporting, investigation, analysis, and corrective action. Specifically, CN requires that

• Details of all accidents and injuries must be entered into CN's recording and analysis information system.
• All accidents and injuries are investigated and corrective action is identified.
• Detailed closeout reports are systematically completed for all reportable accidents and injuries.
• Accidents and injuries are reviewed on weekly system, regional and functional safety conference calls.
• Accident and injury records are subject to trend analysis reviews to determine if further risk controls are necessary.

When human factors might have played a role in an accident, CN requires further investigation prior to formulating corrective action and the following should be considered:

• Was the work properly planned, organized and supervised?
• Was the employee properly trained and equipped?
• Did the employee have the opportunity for sufficient rest?
• Was the rule or work procedure well understood?^{Footnote 28, Footnote 29}

1.15 Safety culture

All members of an organization, and the decisions made at all levels, have an impact on safety. A recognized definition of an organization's “safety culture” is

shared values (what is important) and beliefs (how things work) that interact with an organization's structures and control systems to produce behavioural norms (the way we do things around here).^{Footnote 30}

TC's Rail Safety Management Systems Guide: A Guide for Developing, Implementing and Enhancing Railway Safety Management Systems states:

An effective safety culture in a railway company can reduce public and employee fatalities and injuries, property damage resulting from railway accidents, and the impact of accidents on the environment.

[…] In simple terms, an organization's safety culture is demonstrated by the way people do their jobs—their decisions, actions and behaviours define the culture of an organization.

The safety culture of an organization is the result of individual and group values, attitudes, perceptions, competencies and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organization's health and safety management system.

Organizations with a positive safety culture are characterized by communications from various stakeholders founded on mutual trust, by shared perceptions of the importance of safety and by confidence in the efficacy of preventive measures.^{Footnote 31}

The relationship between safety culture and safety management is reflected in part by the beliefs, attitudes and behaviours of a company's management.

An effective safety culture includes proactive actions to identify and manage operational risk. It is characterized by an informed culture where people understand the hazards and risks involved in their own operation and work continuously to identify and overcome threats to safety. It is a just culture, where the workforce knows and agrees on what is acceptable and unacceptable. It is a reporting culture, where safety concerns are reported and analyzed and where appropriate action is taken. Finally, it is a learning culture, where safety is enhanced from lessons learned.^{Footnote 32}

A company's policies determine how safety objectives will be met by clearly defining responsibilities; by developing processes, structures and objectives to incorporate safety into all aspects of the operation; and by developing the skills and knowledge of personnel. Procedures are directives for employees and communicate management's instructions. Practices are what really happens on the job, which can differ from procedures and, in some cases, increase threats to safety.

1.16 Canadian National Railway safety culture

In parallel with implementing an SMS, CN has recognized the importance of building an effective safety culture, which the company considers essential for SMS. To help strengthen its safety culture, CN has invested in training, coaching, employee recognition and involvement.

In 2014, CN opened 2 new training centres, 1 in Winnipeg, Manitoba, and 1 in Homewood, Illinois, United States. Both centres offer courses for new and seasoned railroaders from conductor to car mechanic and from track inspector to signal maintainer. Employees receive hands-on training in modern indoor labs with up-to-date equipment. CN estimates that some 3000 employees per year will be trained at the new centres.

In October 2014, CN co-hosted a safety culture symposium in Halifax, Nova Scotia, where attendees discussed and shared information about the emerging field of safety culture. CN also hosts safety summits throughout its territories to promote two-way communication and best safety practices.

Among other initiatives, in 2014, CN developed and implemented Looking Out for Each Other, which has become an integral part of CN's safety culture. The peer-to-peer engagement strategy was designed to

• Raise awareness among employees of the top causes of incidents and injuries.
• Identify and review safe work procedures for those activities.
• Train employees to be aware of their surroundings and to recognize potential at-risk work practices or situations in the field.
• Teach employees how to provide constructive feedback to peers.
• Learn from past incidents to prevent a reoccurrence of the same event and help each other stay safe.^{Footnote 33}

CN has established an independent close-call reporting hotline called PREVENT, which is managed through St. Mary's University. Employees are encouraged to call in near misses and close-calls. The data are edited by St. Mary's University to ensure that the reports remain confidential. The data are then shared with management for corrective action where warranted. The program is in its early phases and is available to both staff and management.

CN has policies and procedures detailing how safety objectives will be met. Such procedures include CN Standard Operating Guidelines (SOG) for CN emergency responders, DGOs and SDGOs. Many of the SOGs are based on experience and outline risks to consider when responding to an accident or incident involving DG. However, in practice and based on individual circumstances, employee actions in the field can differ from the procedures.

1.17 Subdivision and track information

The Margo Subdivision is single main track, which extends west from Canora (Mile 0.0) to Humboldt, Saskatchewan (Mile 122.4). This subdivision is part of CN's Prairie North Line (PNL), a secondary mainline that extends from Portage La Prairie, Manitoba, to Edmonton, Alberta. Train movements on this subdivision are governed by the occupancy control system as authorized under the Canadian Rail Operating Rules (CROR) and supervised by an RTC located in Edmonton. The authorized speed for freight trains in the vicinity of the derailment was 40 mph. The track is classified as Class 3 track according to the TC-approved Rules Respecting Track Safety (TSR).

Track throughout the subdivision was composed of a mix of 100-pound and 115-pound jointed rail and continuous welded rail (CWR). The track in the vicinity of the derailment is tangent on a flat grade. The track structure at this location was composed of 100-pound CWR with a number of bolted plug repair rails installed over several years to replace rail defects. The rail had been manufactured in 1959 by Dominion Steel. It was set into 14-inch double shoulder tie plates, secured to No. 1 softwood ties in fair condition with 2 spikes per plate and box-anchored every other tie. The cribs were full of 2-inch crushed rock ballast and the shoulders were approximately 12 inches. There was good drainage with no sinkholes, mudspots or churning ballast in the vicinity of the derailment.

Over the previous 5 years, the rail traffic, as measured in million gross ton-miles per mile (MGTM/M), had increased significantly (i.e., by approximately 480%) from 2.26 MGTM/M in 2010 to 10.85 MGTM/M in 2014, with a significant increase in 2013 and 2014 (Figure 3).CN operated an average of 1 train per day in 2010, which increased to 3 trains per day in 2013 and 2014. The increase in traffic volumes was directly related to the increase in bulk products (grain) and flammable liquids being transported on the PNL. Several new crude oil rail loading terminals had been constructed between Saskatoon, Saskatchewan, and Edmonton, from 2010 to 2014.

CN had detailed processes in place for track infrastructure maintenance while rail traffic volumes and detailed track defect analyses were used to identify the need for upgrades through a capital program. CN's route risk assessment methodology reviewed traffic volumes, class of track, and inspection frequencies for both track geometry and rail flaw detection testing. When trends emerged, CN could adjust the inspection frequencies as required.

1.18 Traffic volumes and Canadian National Railway corridor risk assessments

CN reviews rail traffic volumes annually to determine changes in key route^{Footnote 34} status. In October 2013, CN first identified the Margo Subdivision as a key route on part of the PNL. The Margo Subdivision was included in the corridor risk assessment for the PNL conducted that year. The risk assessment identified, in part, that:

• The route of the PNL is not heavily populated but passes through 3 major urban areas (Winnipeg, Saskatoon, Edmonton).
• The PNL passes through a number of smaller communities and runs adjacent to significant agricultural areas.
• The route crosses a number of streams and rivers. At several locations, the PNL uses large bridge and trestle structures to cross wide valleys.
• The PNL runs parallel to, and within a few miles of a number of secondary highways.

As the Margo Subdivision was part of a key route, CN had implemented the following mitigation strategies:

• wayside inspection systems locations, which include hot bearing, hot wheel and/or dragging equipment detectors, were spaced at approximately 30- to 50-mile intervals and were usually located on each side of major population areas.
• Trains received roll-by inspections on departure from CN yards in Winnipeg and Edmonton, and were viewed by other employees during their journey across the subdivision in accordance with CROR Rule 110.
• Freight train speed was reduced at certain major bridges and in areas of significant track curvature.
• Trains transporting DG were subject to speed restrictions in certain locations.
• The frequency of both track geometry and rail flaw (ultrasonic) testing was increased.
• The track was visually inspected a minimum of twice per week by a qualified track inspector.

On 28 November 2014, subsequent to the accident, a follow-up corridor risk assessment was conducted. From this risk assessment, it was decided that the existing mitigation strategies were adequate. However, track and structures inspection was identified for enhancement in accordance with any subsequent increase in traffic and tonnage on the PNL corridor.

1.19 Track inspection and maintenance

On 06 October 2014, the day before the accident, a certified track inspector had performed a hi-rail inspection. No track defects were noted in the vicinity of the derailment. There had been no recent track maintenance work performed in the area.

In 2014, before the derailment, 4 track geometry tests had been performed on the Margo Subdivision using CN's track evaluation car. The most recent track geometry test had been performed on 16 September 2014. No defects had been recorded between Mile 32.03 and Mile 93.39.

1.20 Rail flaw inspection

The TSR require that all rails in Class 3 track must be ultrasonically tested for internal defects at least once per year.^{Footnote 35} On the Margo Subdivision in the area of the derailment, 7 rail ultrasonic tests had been conducted between 06 December 2013 and 12 September 2014. Table 2 presents a list of the most recent rail defects that were detected in the vicinity of the derailment.

Ultrasonic (UT) inspection is the primary detection method to identify internal rail defects to proactively manage the risk of rail failures. Improvements have been made recently in rail testing technology, including additional probes being added at different angles and enhancements to the defect-recognition software. UT testing can be a reliable and economical method of rail flaw testing. However, the detectability of defects is dependent on the size and orientation of the transverse portion of the defect, and the test results can be affected by contamination on the rail surface and by other factors such as rail head checking and shelling. Such conditions can inhibit the transmission of UT signals into the rail head, which will mask internal defects.

Rail flaw testing at CN is conducted by Sperry Rail Service (SRS).^{Footnote 36} SRS rail flaw detector vehicles are equipped with an undercarriage test platform that contains electromagnetic (induction) technology and 3 fluid-filled roller search unit wheels for each rail. Each roller search unit contains a number of transducers that are used to detect vertical and transverse defects within the rail. Liquid couplant facilitates the transmission of UT energy from the transducers into the rail.

The American Railway Engineering and Maintenance-of-Way Association (AREMA) Manual, Chapter 4, Section 4.3, outlines the Recommended Minimum Performance Guideline for Rail Testing with regards to UT rail testing. For Category I track,^{Footnote 37} the AREMA guideline specifies a reliability ratio^{Footnote 38} for rail flaw testing of 98% for detail fracture defects that originate from shelling or head checking and that extend throughout 81% to 100% of the cross-sectional head area. This guideline is typically used as the minimum acceptable performance standard in the agreement between the rail testing operator and the railway. CN's specifications for rail flaw testing were, however, more stringent than the AREMA guideline, as CN required that certain defects be found on a more frequent basis.

Between 2011 and 2014, the rail conditions identified on the Margo Subdivision consisted primarily of rail end batter, bolt hole cracks, crushed heads, and LSCs. The primary rail-fatigue-related defects that were identified included defective welds, detail fractures, head and web separations, and vertical split webs (Appendix A). The majority of these defects were detected in 100-pound rail.

1.21 Localized surface collapse

LSCs are characterized by plastic metal flow, flattening and deformation of the rail head above the plane of the rail head/web fillet. LSCs are normally caused by mechanical interaction from repetitive wheel loadings. As an LSC becomes more severe and rail head vertical wear increases, wheel impact forces also increase. This can result in high contact stresses and lead to the development of other rail defects.

The TSR contain no guidance or condemning criteria with regards to LSCs. In Canada, LSCs are categorized as rail surface conditions rather than rail defects. While LSCs are not considered as service failures, they can be considered as an indicator of potential emerging rail defects.

CN Engineering Track Standard (ETS) 1.7 10a, Rail Testing and Remedial Action for Broken Rail, requires that LSC conditions that are less than 5 mm in depth, on rail worn to less than 75% of the vertical rail wear condemning limit, must be monitored and then repaired once the condemning limit is reached (Figure 4). The depth of an LSC is measured using a straight edge and a 10 mm wide taper gauge as described in ETS 1.7 11 (Figure 5).

In this occurrence, an LSC was identified on the south rail at Mile 74.58 on 18 July 2014. The LSC was marked as Defect 415 by the SRS 933 operator. This LSC was measured to be 3.5 mm in depth, and it was determined that the 100-pound rail was worn to less than 75% of the vertical wear condemning limit. There was no internal defect noted on the test tape or during the UT hand test performed by the operator while marking the LSC. When SRS marks an LSC condition as a defect, hand testing at these locations is not typically required during subsequent SRS testing. However, once an LSC condition has been identified, CN inspectors are required to monitor it.

The same LSC condition (Defect 415) was noted by the operator on SRS 454 during the 12 September 2014 test. This condition was identified as a previously marked defect, and did not require a further hand test verification. Both of the rail flaw inspection cars (i.e., SRS 933 and SRS 454) were equipped with vision camera systems that showed irregularities on the rail running surface. During the recent tests, images from both vehicles showed multiple indications of gauge surface anomalies, but resulted in a lack of responses due to surface condition.

1.22 Rail transverse detail defects

A transverse detail defect (TDD), which can be initiated by fatigue, is a crack perpendicular to the running surface of the rail. A TDD is a progressive rail failure that usually starts at the gauge corner and spreads transversely throughout the rail head. Such defects are commonly known as a detail fracture. Identification can be difficult as the fracture is not often exposed. While UT inspection can locate a TDD before it fails, the testing does have limitations. Consequently, a TDD can develop into a broken rail before the defect becomes visible.

TDD fractures typically display growth rings or striations that indicate the progressive growth of the detail fracture with each fatigue cycle. As the size of the detail fracture increases, less of the head area is available to support the load. Once the defect reaches a critical size, the remaining rail head area can no longer support the load, resulting in the sudden and complete failure of the rail. The size of detail fractures is commonly recorded as the percentage of cross-sectional head area of the rail.

TDDs typically develop in rails that are at or near their fatigue limit. Rail fatigue life^{Footnote 39} depends on a number of factors, including accumulated tonnage, location (curve or tangent track), cleanliness of the steel, support conditions, grade of steel, and residual stresses^{Footnote 40} within the rail. Rail fatigue life is difficult to predict. However, with increased testing, inspections, and rail relay programs, fatigued rails can normally be identified and removed before they reach their fatigue life.

CN addresses the issue of rail fatigue through its rail testing frequency and through the monitoring of the number and types of defects detected. Rail relay programs are then performed to replace rail that is close to its wear and fatigue life based on defect type and frequency.

1.23 Rail grinding

Rail head grinding is a maintenance procedure used to control surface damage on the rail, such as corrugations, shelling, head checking, and spalling.^{Footnote 41} Rail grinding is also used to restore the contact geometry between the wheel and the rail by ensuring the correct rail head profile. In doing so, the wheel/rail contact position can be moved across the rail head to a location that minimizes contact stresses. By adjusting the contact geometry, the initiation of deep-seated shell defects such as detail fractures^{Footnote 42} at the upper gauge corner can be prevented. Rail grinding can slow down the initiation and growth of small, deep-seated shell defects.

CN considers rail grinding to be the primary defence against internal defect initiation and propagation, and that it is critical to maintain the rail surface in good condition to optimize defect detection. At CN, grinding frequency is established in CN Standard Practice Circular 3709, which indicates that the grinding profiles and grinding frequency will be as specified by the railway chief engineer.

Rail grinding programs can be either corrective or preventive. Corrective programs restore the damaged surface of the rail. Preventive programs are proactive and are conducted at a frequency that ensures the rail surface does not deteriorate to the point where a corrective program is required. CN generally conducts grinding programs on its mainlines about every 20 MGTM/M. On the Margo Subdivision, rail grinding was conducted in 2010 and again in 2012, after approximately 7 MGTM/M. It had been planned for 2015, but there was a significant increase in tonnage starting in 2013 (Figure 3).

1.24 Laboratory analysis of broken rail

Four pieces of broken rail recovered from the south rail were examined at the TSB Laboratory. It was determined that:

1. The rail pieces were 100-pound 1959 Dominion standard carbon steel rail with ¼-inch headwear and 1/16-inch flange wear. The wear was within CN's vertical wear limit for 100-pound CWR (i.e., 5/8 inch).
2. The hardness measurements and metallurgical analysis results were typical for rails of that vintage.
3. Shelling was observed on the gauge side of the rail head running surface. As a result of the shelling, small portions of the rail head had broken away. A lip had formed on the field side of the rail head as a result of metal flow (Photo 6 and Photo 7).
4. Rail piece No. 1 had a detail fracture that had initiated from head check cracks on the upper gauge corner of the head. Over time, the crack had progressed in normal growth to approximately 20% of the cross-sectional area of the head. The crack experienced recent growth to approximately 85% of the cross-sectional area of the rail head. The remaining rail section then failed in overstress (Photo 8).

1. Examination results indicate that the detail fracture occurred at the location where a 3.5 mm deep LSC had been detected on 18 July 2014, some 12 weeks before the occurrence.
2. Rail pieces No. 2, No. 3 and No. 4 had each fractured in overstress. These fractures likely occurred during the derailment, resulting in post-separation impact damage.
3. The gauge and field side head wear measurements showed that the rail head had been slightly deformed by compressive loading from passing rail cars.

1.25 Examination of tank cars

The 6 derailed tank cars containing DG were examined. It was determined that

• No pre-existing conditions or defects were observed on any of the derailed rolling stock.
• SHPX 204894 and GATX 1601 (the 40th and 41st cars) were built in 2002 and 2005, respectively, to the U.S. Department of Transportation (DOT) specification 111A100W5. Each tank car had been fitted with a rubber lining and a manway arrangement that included a quick opening fill hole and pressure relief device (PRD). Neither car had a bottom outlet valve (BOV) or protective housing. During the derailment, both cars sustained car body bolster damage and multiple dents, and were separated from their running gear. Neither car was breached or released any of its contents.
• TILX 160071 and UTLX 630502 (the 42nd and 43rd cars) were built in 1989 and 2000, respectively, to the DOT 111A100W1 specification. Both cars were jacketed and insulated. They were each fitted with a BOV, top fittings with protective housing, a hinged and bolted manway, and PRD. During the derailment, both cars sustained car body bolster damage and multiple dents, and were separated from their running gear. Neither car was breached or released any of its products.
• GATX 82043 (the 51st car) was built in 1998 to the DOT 111A100W1 specification. The tank shell and tank head were constructed with 7/16-inch-thick TC128 Grade B steel. The car was fitted with a BOV, top fittings, a protective housing, a hinged and bolted manway, and PRD. This car sustained a breach from impact damage to its tank shell and A-end tank head, resulting in the release of product that fed the post-derailment fire (Photo 9). The car was not equipped with a jacket, thermal protection, head shields, or top discontinuity protection.

• PROX 126 (the 52nd car) was built in 1974 to the DOT 111A60W1 specification. It was constructed with a load limit of 220 000 pounds. It was built with 7/16-inch ASTM A-285 Grade C non-normalized steel. This car had a dual compartment tilted tank. Each compartment was fitted with a BOV, hinged and bolted manway, and PRD. It was pressure rated for 60 pounds per square inch (psi). Following the derailment, the car sustained 2 thermal tears — 1 in each compartment — as a result of exposure to the post-derailment fire (Photo 10). Nearly all of the contents of the car were consumed in the fire and in the subsequent flaring operation. The car was not equipped with a jacket, thermal protection, head shields, or top discontinuity protection.

1.26 The Lac-Mégantic accident

On 05 July 2013, at approximately 2250 Eastern Daylight Time, Montreal, Maine & Atlantic Railway (MMA) freight train MMA-002, en route from Montréal, Quebec, to Saint John, New Brunswick, was stopped at Nantes, Quebec (Mile 7.40 of the Sherbrooke Subdivision), the designated MMA crew-change point. The train, consisting of 5 head-end locomotives, 1 VB car (i.e., special-purpose caboose), 1 box car, and 72 Class 111 tank cars carrying flammable liquids (petroleum crude oil, UN 1267, Class 3), was then secured on the main track and left unattended on a descending grade.

Shortly before 0100 on 06 July 2013, the unattended train started to move and gathered speed as it rolled uncontrolled down the descending grade toward the town of Lac-Mégantic, Quebec. Sixty-three Class 111 tank cars and the box car derailed near the centre of the town. The derailed cars released approximately 5.98 million litres of product due to tank car damage. The released product ignited almost immediately, resulting in a large pool fire that burned for more than a day. Forty-seven people were fatally injured. Many buildings, vehicles, and the railway tracks were destroyed. About 2000 people were initially evacuated from the surrounding area.^{Footnote 43}

1.27 Industry and regulatory response to Class 111 tank car releases

In addition to the Lac-Mégantic accident, there have been a number of occurrences in Canada and the United States during which product was released from Class 111 tank cars following a collision, impact and/or fire. These occurrences highlight the vulnerability of Class 111 tank cars to accident damage and product release. As of June 2015, with approximately 270 000 Class 111 tank cars in service in North America, of which approximately 141 000 are used to transport DG, these types of releases have continued to occur during derailments.

In 2011, the Association of American Railroads (AAR) tank car standards were amended (Casualty Prevention Circular No. CPC-1232)^{Footnote 44} to incorporate a number of enhancements to all Class 111 tank cars built after 01 October 2011 for the transportation of crude oil and ethanol in PG I or PG II. These enhancements included the construction of tank cars to 286 000-pound standards, protection of the service equipment on the top shell, use of reclosing PRDs, use of normalized steel for tank shells and tank heads, increased minimum thickness for all tank cars not jacketed and insulated, and at least ½-inch thick half-height head shields.

In 2012, following its Cherry Valley, Illinois investigation,^{Footnote 45} the United States National Transportation Safety Board's (NTSB) issued recommendations to the Pipeline and Hazardous Materials Safety Administration (PHMSA), which included

Require that all bottom outlet valves used on newly manufactured and existing non-pressure tank cars are designed to remain closed during accidents in which the valve and operating handle are subjected to impact forces.

NTSB Recommendation R12-6^{Footnote 46}

As part of its Lac-Mégantic investigation, the TSB highlighted the vulnerabilities of Class 111 tank cars and recommended that

1.28 Response from Transport Canada to TSB Recommendation R14-01

On 23 April 2014, TC announced a three-year phase-out of older, less crash resistant Class 111 tank cars. On 02 July 2014, the TP14877 standard was adopted by reference in the Transportation of Dangerous Goods Regulations, aligning Canadian regulations with the 2011 AAR CPC-1232 standard.

In May 2015, TC published in the Canada Gazette, Part II, the Regulations Amending the Transportation of Dangerous Goods Regulations (TC-117 Tank Cars). These regulations established the requirements for a new flammable liquid tank car standard (TC-117), retrofit requirements for older DOT-111 and CPC-1232 tank cars in flammable liquid service, and implementation timelines to modernize the North American tank car fleet. The standards and timelines were generally harmonized with the United States regulators, the PHMSA, the Federal Railroad Administration (FRA), and the DOT. With the coming into force in the United States of the recent Fixing America's Surface Transportation (FAST) legislation, the United States has further harmonized with the Canadian requirements.

The Canadian regulations require that all new tank cars built for the transportation of flammable liquids be constructed using thicker and more impact-resistant steel, and be equipped with jacketed thermal protection, full-height head shields, top fittings protection, improved BOVs, and appropriate PRDs.

TC continues to work with the Canadian railway industry to consider braking provisions, such as electronically controlled pneumatic (ECP) brakes, in train operating rules rather than considering such braking provisions within the requirements of the TC-117 tank car standard. TC is also following closely the new requirements brought forward by the United States FAST legislation, which imposed new research requirements before ECP braking could be brought into effect in that country.

With the ongoing low world demand for crude oil and its associated low world price, the transportation of crude oil by rail has slowed and, consequently, so has tank car demand. Shippers and builders have used this low-demand cycle to better assess fleet usage, tank car demand, and retrofit requirements. With the coming into force of the United States FAST Act, which brings United States requirements further in line with Canadian requirements, industry has begun to ramp up the retrofitting of DOT-111 tank cars in flammable liquid service.

On 24 July 2016, TC issued Protective Direction 38 that moved up the date of compliance for limiting the use of legacy DOT-111 tank cars as outlined in the Regulations Amending the Transportation of Dangerous Goods Regulations (TC-117 Tank Cars). The date that both unjacketed and jacketed legacy DOT-111 tank cars will be phased out has been moved ahead to 01 November 2016 from 01 May 2017 and 01 March 2018, respectively. Protective Direction 38 applies only to crude oil defined within the protective direction as

• Petroleum crude oil (UN 1267)
• Petroleum distillates N.O.S., or Petroleum products N.O.S. that is crude oil (UN 1268)
• Petroleum sour crude oil, flammable, toxic (UN 3494).

1.29 Board assessment of Transport Canada's response to TSB Recommendation R14-01

In March 2016, the Board assessed TC's response to Recommendation R14-01. The Board acknowledged TC's commitment and progress made on the publication of the new tank car standards and the updating of TP14877. The Board noted the progress made on the construction of new TC-117 tank cars and the retrofitting of older flammable liquid tank cars. Given TC's progress made on this issue, its ongoing monitoring, and its intention to fully enforce the phase-out retrofit timelines, the Board assessed the response to Recommendation R14-01 as having Satisfactory Intent.

However, until all flammable liquids are transported in tank cars built sufficiently robust to prevent catastrophic failure when involved in an accident, the risk will remain high. Therefore, the Board called upon TC to ensure that risk control measures during the transition are effectively managed.

1.30 Association of American Railroads Circular OT-55-N and TSB Recommendation R14-02

In January 1990, based on recommendations of the Inter-Industry Task Force on the Safe Transportation of Hazardous Materials by Rail, the AAR issued Circular OT-55 (OT-55), entitled Recommended Railroad Operating Practices for Transportation of Hazardous Materials. OT-55 provided the rail industry with routing guidance for selected DG, including poisonous-by-inhalation (PIH) and toxic-by-inhalation (TIH) products. Radioactive materials were added in August 2001. OT-55 defined a list of TIH products (over 200, including chlorine and anhydrous ammonia). Furthermore, it identified technical and handling requirements for key trains and key routes.

Following the Lac-Mégantic accident, the definition of a key train was revised^{Footnote 47} within OT-55-N to include any train containing 1 or more cars of PIH or TIH material, such as anhydrous ammonia, ammonia solutions, spent nuclear fuel or high-level radioactive waste, or containing 20 carloads, or intermodal portable tank loads, of any combination of other hazardous materials.

Although OT-55-N was not applicable in Canada, in August 2013, CN extended these measures to its Canadian operations. As part of a company initiative, CN conducted risk assessments for subdivisions within corridors identified as key routes, which included the Margo Subdivision.

As part of the investigation into the Lac-Mégantic accident, the TSB indicated that a similar approach based on OT-55-N, strengthened with a requirement to conduct route planning and analysis, would be a positive step to improve the safety of the transportation of DG by rail for all railways in Canada. On 23 January 2014, the Board recommended that

1.31 Response from Transport Canada to TSB Recommendation R14-02

On 23 April 2014, TC issued Ministerial Order 14-01 requiring all railway companies and local railway companies to formulate and revise rules respecting the transportation of DG. The rules were to be filed with the Minister of Transport no later than 23 October 2014.

At the same time, TC issued an emergency directive requiring railways carrying DG to implement minimum operating practices for key trains to address the Board's recommendation, and to manage the immediate safety issue by, among other things, implementing speed restrictions for trains carrying DG, expanding the inspection requirements on restricted rail routes, and completing risk assessments for key routes. The emergency directive was put in place for 6 months, and was renewed every 6 months to allow further consultation with stakeholders, which included unions and the Federation of Canadian Municipalities, and to reflect consideration of any additional United States requirements that may be established.

A 10 000-DG-carload threshold was adopted based on the criteria outlined in the AAR Circular OT-55-N, which was also adopted by United States railways. TC recognizes that more analysis must be performed to determine a carload threshold that would optimize the safe transportation of DG, which may lead to more stringent criteria for key routes. TC has contracted a third-party expert to conduct the necessary analysis to determine the appropriate threshold criteria. The project, which is being led by TC's Transportation Development Centre, will determine the appropriate threshold criteria for key routes. The final report for this project is expected by December 2016.

TC is also considering whether to expand the current criteria that define key trains by introducing requirements for technology that could enhance braking capability. Moreover, through the risk-based planning process, TC will review all federally regulated railways to identify those that transport crude oil, but did not meet the 10 000-DG-carload threshold on their routes. Through this risk-based approach, TC has assigned appropriate resources to further monitor these railway operators.

The Railway Safety Management System Regulations, 2015, published in the Canada Gazette, Part II, on 25 February 2015 and in force on 01 April 2015, contain requirements for a risk assessment process. Section 15 of the Regulations requires that a railway company must conduct a risk assessment when it proposes to begin transporting DG, or to begin transporting DG different from those it already transports, or when there is a proposed change to its railway operations. Changes in railway operations include a change that may affect the safety of the public or personnel, or the protection of property or the environment, such as an increase in the volume of DG it transports and a change to the route on which DG are transported.

1.32 Board assessment of Transport Canada's response to TSB Recommendation R14-02

In March 2016, the Board assessed TC's response to Recommendation R14-02. The Board noted that TC has made progress on this issue, which includes more stringent risk assessment criteria for railways handling DG, the ongoing analysis to determine the appropriate threshold criteria for key routes, and the recent promulgation of Rules Respecting Key Trains and Key Routes. As such, the Board considers the risks associated with a catastrophic DG release or explosion to have been reduced. However, while some progress has been made on the 5 railways that have identified key routes, analysis of the appropriate threshold criteria for key routes must still be performed.

Therefore, the Board assessed the response to Recommendation R14-02 as having Satisfactory Intent.

1.33 Route planning thresholds

TC adopted the 10 000-DG-carload threshold based on the criteria outlined in AAR Circular OT-55-N. There is no rationale or scientific study to support the selection of the 10 000-DG-carload threshold for determining a key route. The Board has indicated that this threshold may limit the number of routes subject to appropriate safety measures and suggested that a rigorous analysis should be conducted of the 10 000-DG-carload threshold to determine which routes with trains carrying DG may be excluded and whether the safety deficiency identified in recommendation R14-02 will be adequately addressed.

TC initiated a study to assess whether the current definition of key routes, which originates from AAR Circular OT-55-L, is adequate for the Canadian context.

1.34 TSB Watchlist

In November 2014, the TSB added the Transportation of flammable liquids by rail to its Watchlist and the issue remains on the Watchlist today. The Watchlist is a list of issues posing the greatest risk to Canada's transportation system. The TSB publishes this list to focus the attention of industry and regulators on the problems that need addressing today.

The increase in the transportation of flammable liquids—such as petroleum distillates and crude oil—by rail across North America has created emerging risks that need to be effectively mitigated.

The Watchlist indicates that railway companies must conduct route planning and analysis, and perform risk assessments to ensure that risk-control measures are effective. Additionally, flammable liquids must be shipped in more robust tank cars to reduce the likelihood of a DG release during accidents.

1.35 Other similar occurrences

Over the past decade, the TSB has investigated a number of similar occurrences where rail breaks were either the primary cause or a contributing factor to the derailment. The following 6 occurrences each involved a rail break due to a pre-existing rail defect that was undetected by UT, and subsequently propagated to failure.

• R14C0114 - Main-track derailment near Pearce, Alberta. On 06 November 2014, at approximately 0115 Mountain Standard Time, eastbound Canadian Pacific Railway (CP) freight train 374-230 derailed 17 empty covered hopper cars at Mile 23.40 of the Crowsnest Subdivision near Pearce, Alberta. About 1000 feet of the main track was damaged and an additional 600 feet of the main track and of an adjacent storage track was destroyed. Two empty gondola cars in the storage track were struck by the derailing train, resulting in their derailment. There were no injuries.
• R13E0142 – Main-track Derailment near Gainford, Alberta. On 19 October 2013, at 0100 Mountain Daylight Time, CN freight train M30151-18, proceeding westward from Edmonton, Alberta, to Vancouver, British Columbia, derailed 13 cars, including 4 tank cars containing petroleum crude oil and 9 tank cars of liquefied petroleum gas (LPG) at Mile 57.25 of the Edson Subdivision. Two of the derailed LPG tank cars were breached and caught fire. A third LPG tank car released product from the safety valve and ignited. About 600 feet of track was destroyed. There were no injuries. One hundred and six homes in the vicinity of the derailment were evacuated.
• R11C0118 – Main-track derailment near Alix Junction, Alberta. On 21 October 2011, at 0935 Mountain Daylight Time, CN freight train Q11531-18, proceeding southward from Mirror, Alberta, to Calgary, Alberta, derailed 13 car bodies at Mile 13.2 of the Three Hills Subdivision. The derailed cars were carrying containers, some loaded with DG. Approximately 900 litres of phosphoric acid was released and 400 feet of track was destroyed.
• R10C0086 – Main-track derailment near Airdrie, Alberta. On 03 August 2010, at 0643 Mountain Daylight Time, CP freight train 2-269-02, proceeding southward from Red Deer, Alberta, to Calgary, Alberta, derailed 32 cars at Mile 21.4 of the Red Deer Subdivision. The derailed cars included 12 pressure tank cars containing anhydrous ammonia (UN 1005). No product was lost and there were no injuries.
• R09Q0047 – Main-track derailment near Saint-Tite, Quebec. On 21 November 2009, at 2046 Eastern Standard Time, CN train M-365-21-21 derailed 10 cars (5 loaded cars and 5 empty cars) on the railway bridge across des Envies River at Mile 6.53 of the Lac-St-Jean Subdivision. Approximately 200 feet of track was damaged and 1 span of the bridge was destroyed. No DG were released and there were no injuries.
• R08C0164 – Main-track derailment near Burdett, Alberta. On 30 November 2008, at 1604 Mountain Standard Time, CP freight train 356-196, proceeding eastward from Lethbridge, Alberta, to Bellcott, Alberta, derailed 18 empty covered hopper cars at Mile 45.62 of the Taber Subdivision. No DG were involved and there were no injuries.
• R05E0059 – Main-track derailment near Wabamun, Alberta. On 03 August 2005, at 0509 Mountain Daylight Time, CN freight train M30351-03, proceeding westward from Edmonton, Alberta, to Vancouver, British Columbia, derailed 43 cars, including 25 loaded cars of bunker C (heavy fuel oil), 1 loaded car of pole treating oil, and 1 loaded car of toluene (UN 1294), at Mile 49.4 of the Edson Subdivision. Approximately 700 000 litres of bunker C and 88 000 litres of pole treating oil were spilled, causing extensive property, environmental, and biological damage. About 20 people were evacuated from the immediate area. There were no injuries.

1.36 TSB laboratory reports

The following TSB laboratory reports were completed in support of this investigation:

• LP 212/2014 – Field Examination of Tank Cars
• LP 0229/2014 – Examination of Broken Rail

Neither the condition of the rolling stock nor the manner in which the train was operated were considered contributing factors in this derailment. The analysis will focus on rail testing, rail surface condition, rail maintenance, detection of transverse detail defects (TDD), tank car crashworthiness, and emergency response.

2.1 The accident

The impact marks observed on the wheel tread of the 31st car, which did not derail, were consistent with a wheel tread striking the west side of the fractures in the broken south rail at Mile 74.58, the initial point of derailment. There was no rail damage or track damage prior to this location.

A TDD was present at the point of derailment. The TDD had initiated from head check cracks at the upper gauge corner of the rail head. Over time, the crack had progressed in normal growth to approximately 20% of the cross-sectional area of the rail head. The TDD had experienced more recent growth to approximately 85% of the cross-sectional area of the rail head. The remaining rail section then failed in overstress once it could no longer support service loads.

The west fracture face displayed impact damage and evidence of burnishing due to rubbing against the east fracture face. The fractured rail had briefly remained in track, but then continued to break up under the 30th and 31st cars of the train, creating a gap in the track and leading to the derailment of the 32nd to the 57th cars. The train derailed when a sudden and catastrophic failure of the south rail occurred under the train, due to an undetected TDD.

2.2 Rail ultrasonic testing

During the Sperry Rail Services (SRS) 933 ultrasonic (UT) test on 18 July 2014, a localized surface collapse (LSC) was detected on the south rail at Mile 74.58. The LSC was marked and measured at 3.5 mm in depth. As the wear on the 100-pound rail was less than 75% of the vertical wear condemning limit, the LSC condition was to be monitored until it reached 5.0 mm in depth. There was no internal defect noted on the test tape or during the hand test.

During the SRS 454 UT test on 12 September 2014, there was no internal defect noted at Mile 74.58 on the test tape. However, the same LSC was detected, but as it had been identified as a previously marked defect, no hand testing was required.

At the time of the 12 September 2014 UT test, the LSC may have contained the TDD, which had initiated from head checks, cracks and severe shelling on the gauge corner of the rail head. However, the rail surface condition inhibited the transmission of the UT signals into the rail head and likely masked the presence of a TDD during the UT test.

2.3 Rail service life

The track structure in the vicinity of the derailment was composed of 1959 100-pound continuous welded rail with bolted plug repair rails installed over several years to replace rail defects. Most of the 100-pound rail on the Margo Subdivision had been in service for over 50 years. Although the total accumulated tonnage was unknown, the increase in rail defects on the Margo Subdivision observed in 2013 and 2014 as well as the presence of LSC conditions and TDDs were all signs that the rail was reaching the end of its service life.

Repetitive loading on rail that is nearing the end of its service life can manifest itself through the emergence of LSC conditions. As the rail wears and the LSC conditions become more severe, wheel impact forces will also increase. An increase in wheel impact forces usually results in higher contact stresses, which can lead to the development of other rail defects, such as a TDD.

Between 2010 and 2014, there had been a 480% increase in rail traffic on the Margo Subdivision. The increased traffic would have accelerated the rail wear and the development of rail fatigue defects, shortening the service life of the rail. If older vintage rail that is at or near the end of its service life remains in the track, rail defects and rail surface conditions will develop, increasing the risk of service failures and derailments.

2.4 Rail surface condition

To manage the risk of rail defects developing in rail that may be nearing the end of its service life, railways increase the frequency of UT testing and monitoring. In addition, rail grinding is used to protect against internal defect initiation and propagation, and is critical to maintaining the rail surface in good condition to optimize defect detection during UT testing. If rail surface condition is not adequately maintained through rail grinding before UT rail flaw inspection, the rail surface condition may inhibit the transmission of the UT signals and mask the presence of an emerging rail defect, increasing the risk that it will grow undetected leading to a broken rail derailment.

2.5 Rail grinding frequency

Canadian National Railway (CN) generally conducts grinding programs on its mainlines about every 20 million gross ton-miles per mile (MGTM/M). On the Margo Subdivision, rail grinding was conducted in 2010 and in 2012. However, rail traffic had increased significantly from 2.26 MGTM/M in 2010 to 10.85 MGTM/M in 2014, contributing to the deterioration of the rail surface conditions in the vicinity of the derailment. The frequency of rail grinding on the Margo Subdivision had not been sufficient to remove the rail surface conditions before UT testing.

2.6 Localized surface collapse

The Rules Respecting Track Safety (TSR) contain no guidance or condemning criteria with regard to LSCs. Therefore, the railway industry in Canada categorizes LSC as a rail surface condition, and not a rail defect. However, some railway companies have incorporated maintenance requirements for LSCs into their track standards. For example, CN Engineering Track Standards require that LSC conditions less than 5 mm in depth, on rail worn to less than 75% of the vertical rail wear condemning limit, be monitored, and repaired once they reach condemning limits.

LSCs are characterized by plastic metal flow, flattening and deformation of the rail head above the plane of the rail head/web fillet, and are usually caused by repetitive wheel loadings. As the rail wears and the LSC becomes more severe, wheel impact forces also increase. LSCs can be an indicator of potential emerging rail defects that would require more rigorous attention, particularly when they are present in older vintage rail that is at or near its fatigue limit.

2.7 Class 111 tank cars

The 6 derailed tank cars involved in this occurrence were Class 111 tank cars. During the derailment, 4 of them sustained car body bolster damage and multiple dents, and were separated from their running gear. Tank cars GATX 82043 and PROX 126 sustained more significant damage. In particular, PROX 126 was a dual compartment tank car built in 1974 using a lower grade steel and was only pressure rated for 60 pounds per square inch (psi). While current regulations no longer allow for this type of tank car to be manufactured to carry petroleum products, existing cars can still remain in service and transport flammable liquids.

Tank car GATX 82043 sustained a breach from impact damage to its tank shell and A-end tank head, leading to the release of product. The released product ignited and fed a post-derailment pool fire. Tank car PROX 126 remained in the pool fire and sustained 2 thermal tears. Neither of these cars was jacketed nor had thermal protection. Nearly all of the contents of both cars were consumed in the fire or subsequent flaring. The absence of thermal protection for tank car PROX 126 increased the severity of the product release and further fueled the fire as the car sustained thermal tears after being subjected to the pool fire.

The damage sustained by the Class 111 tanks cars that released product was consistent with failures noted by the TSB in other investigations. Only 2 cars lost product, but there was potential for more catastrophic environmental impact and loss of life. The damage observed in this derailment continues to highlight the vulnerabilities of Class 111 tank cars and reinforces the need for improved tank car design standards.

Following the catastrophic derailment in Lac-Mégantic in 2013, Transport Canada (TC) improved the requirements for the design of Class 111 tank cars. In May 2015, TC and the United States Pipeline and Hazardous Materials Safety Administration (PHMSA) introduced a new tank car standard, retrofit requirements, and implementation timelines to modernize and improve the tank car fleet for the transportation of Class 3 flammable liquids. If new tank car standards are not fully implemented in a timely manner, there is a continued risk of product loss and associated consequences when tank cars carrying flammable liquids are involved in a derailment.

2.8 Route planning and analysis

Key routes are defined as a route over which 10 000 carloads or more of dangerous goods (DG) are transported annually. TC adopted the 10 000-DG-carload threshold based on the criteria outlined in the Association of American Railroads' Circular OT-55-N. However, similar risks can exist for routes that do not meet the threshold. Without documentation for the threshold, there is no rationale or scientific basis to support the selection of the 10 000-DG-carload threshold. If the carload threshold limit for key routes is selected without supporting rationale, routes that do not meet the threshold will not be specifically considered, increasing the risk that any necessary mitigation strategies will not be implemented on these routes.

CN's route risk assessment methodology reviewed traffic volumes, class of track, and inspection frequencies for both track geometry and rail flaw detection testing. When trends emerged, CN could adjust the inspection frequencies as required. In addition, rail traffic volumes and detailed track defect analyses were used to identify the need for upgrades through a capital program.

Although the Margo Subdivision track met the criteria for Class 3 track, it also contained vintage rail that displayed characteristics indicating that it was near the end of its service life. The subdivision met the criteria for a key route and was therefore subject to additional safety measures, which included the requirement for a formal risk assessment and mitigating strategies. While CN's risk assessment for the Prairie North Line (PNL) corridor and its engineering processes took into account a number of factors and had mitigating strategies in place, the risk assessment did not consider some trends in infrastructure condition (i.e., leading indicators), such as the increase in LSCs and in track defects in older vintage rail that was at or near the end of its service life. Despite the measures in place, the train derailed when a rail failure occurred due to an undetected TDD in rail that was nearing the end of its service life. If corridor risk assessments do not consider leading indicators for infrastructure condition, track infrastructure failures might occur, increasing the risk of derailments.

2.9 Emergency response

2.9.1 Flaring of tank car PROX 126

At approximately 0300 on 08 October 2014, with approximately 20% to 30% of its load remaining, PROX 126 was being pulled south across an adjacent shallow ditch when the car rolled a quarter turn and released an estimated 2400 to 3200 litres of petroleum distillates from the 65-inch long thermal tear in the B-end compartment. The released product pooled on the ground near the tank with the thermal tear facing slightly downward toward the pool.

Subsequent assessment determined that the best course of action would be to flare (ignite) the pool. The flaring plan was verbally discussed with the Wadena assistant fire chief (AFC) and the TC transportation of dangerous goods (TDG) inspectors. All non-essential personnel were moved upwind and well clear of the site. The Wadena fire department was standing by on the highway with a charged hose line while the AFC video-recorded the flaring operation. The 2 TC TDG inspectors moved some 300 to 400 metres away from the site.

By approximately 0400, the wind direction, although light, had shifted from predominantly northwest to northeast. Around this time, the CN senior dangerous goods officer (SDGO) and assistant vice-president, Safety and Emergency Response (AVP) ignited a road flare, approached the pool from a slightly downwind position, in line with the thermal tear, and threw the flare into the pool near the base of the tank. The pool ignited and began to burn at the base of the tank car when an unexpected flash fire occurred as the vapors inside the tank car ignited, sending a large fire ball toward the CN SDGO and AVP, both of whom took immediate evasive action to avoid the flash fire. The flash fire quickly extinguished itself. The senior vice-president, Western Operations (SVPW) and vice–president, Safety and Sustainability (VPSS), who were both on site at the time, immediately approached the CN SDGO and AVP. There were no injuries.

From their vantage point and in the darkness, the TC TDG inspectors could not see the CN SDGO and AVP. Since the TC TDG inspectors were unaware that a close-call had occurred during the flaring activity, there was no mention of the PROX 126 flaring activity or close-call in the TC Accident Attendance Report.

Due to the ongoing fire, the accident site was inaccessible to the TSB throughout the night. When the TSB investigation team returned to the site at approximately 0700 on 08 October 2014 and met with CN personnel for an update, CN informed the TSB that a car had been flared off during the night, but there was no mention of a close-call.

At 0800 on 08 October 2014, a site meeting was held with all attending agencies in the incident command post (ICP). At that time, the site was reported as being stable. The Saskatchewan Ministry of the Environment (MOE) updated the incident briefing (IB) and incident action plan (IAP) indicating that track restoration, site remediation, and product transfers of the remaining product would commence and continue until complete. CN did not provide a briefing to any of the attending agencies, nor was any internal CN documentation or report prepared indicating that a close-call had occurred during the flaring of PROX 126.

The AFC had video-recorded the flaring activity and close-call, but did not report the activity, and the Wadena fire chief (FC) only became aware of the close-call a few weeks later. Although the FC was the incident commander for the response and later became aware of the close-call, contrary to incident command (IC) and National Fire Protection Association 472 Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents (NFPA 472) best practices, no subsequent verbal/written report or debrief of the close-call was submitted to the MOE, TC or TSB.

The video-recording of the flaring activity of DG tank car PROX 126 was made public in early December 2015, and only then did the MOE, TC and TSB become aware that a close-call had occurred.

2.9.2 Risks associated with flaring activity

CN has well-trained and highly qualified dangerous goods officers (DGO) and emergency responders. Prior to joining CN, the AVP and SDGO were hazmat instructors who, aside from attending incidents, taught incident command, tank car damage assessment, response mitigation procedures, and site safety. Their experience probably explains why they took cover immediately and why neither of them sustained injury. Despite their experience, there were several risks that were not fully considered prior to flaring the product released from PROX 126. Specifically:

• They did not fully consider the effect of product vapor which had built up as the product was agitated in tank car PROX 126 as it was pulled from its derailed position.
• Once the pool was ignited, the downward facing position of the thermal tear in PROX 126, relative to the spilled pool of product, allowed the fire from the burning pool to ignite the vapors in the tank, which resulted in the flash fire. To minimize the potential of igniting the vapors in the tank, the car could have been repositioned so the breach was not directly over the pool.
• By throwing the flare from a location directly in line with the pool and thermal tear in PROX 126, the AVP and SDGO were in a vulnerable position once the vapors in the tank ignited.
• CN did not use any weather monitoring devices. Wind information was not specifically considered prior to the flaring activity.

The CN AVP and SDGO did not consider all the risks associated with the flaring activity prior to igniting the pool of product released from tank car PROX 126 and were in a position that left them exposed to a fireball when the vapors in the tank ignited.

Emergency response personnel are taught to always approach from an upwind position. In this occurrence, the wind itself likely did not drive the fire, as the flame was directed by pressure within the tank car. However, if wind direction is not monitored and planned activities modified to correspond with changes in wind direction, there is an increased risk that emergency responders will be caught unexpectedly in a vulnerable position.

2.9.3 Fatigue during emergency response

It is not unusual or unexpected for emergency response personnel to be called upon to work for extended periods of time during emergency situations. However, when working extended hours, emergency response personnel can be subject to the effects of fatigue. Decreased vigilance is one type of attentional deficit that is associated with fatigue.

Circadian rhythm is a daily cycle that follows a 24-hour pattern. The lowest point of activity, known as a circadian low, occurs in the early morning. Disruptions in circadian rhythms can affect performance and cognitive functioning, with decreased performance levels correlating to these low points in the circadian rhythm. Fatigue will also be more pronounced during the first night shift, after shifting from day work, since sleep propensity increases dramatically at night.

Studies generally state that the performance level on various tasks will deteriorate steadily after 17 hours without sleep. One laboratory study of fatigue demonstrated that 17 hours of sustained wakefulness produces impairments in psychomotor functioning (hand-eye coordination) equivalent to a blood alcohol concentration (BAC) of 0.05%, and 24 hours of sustained wakefulness produces impairments equivalent to a BAC of 0.10%. Fatigue due both to prolonged wakefulness and disruptions in circadian rhythms are known to produce similar detriments to performance and cognitive functioning.

Both the AVP and the SDGO had the weekend off preceding the accident and worked a full regular daytime shift on Monday. They commenced a regular morning on Tuesday before working straight through the night, until after the flaring activity occurred at 0400 Central Standard Time (CST) on Wednesday 08 October 2014. When time zone changes are taken into account, at the time of the flaring activity, the AVP had been awake for some 22.5 hours while the SDGO had been awake for approximately 20 hours. In addition, the flaring activity took place at approximately 0400. This time also corresponds to the more significant early-morning circadian low, which is usually accompanied by a reduced level of alertness.

While the AVP and SDGO were very experienced, and had flared tank cars and pooled product before, all of the risks associated with flaring tank car PROX 126 were not fully identified prior to the flaring activity. Given the hours of wakefulness and the time at which the flaring activity occurred, it is likely that the AVP and SDGO experienced fatigue due both to prolonged wakefulness and circadian rhythm disruption, which led to decreased vigilance regarding the risks associated with the flaring of tank car PROX 126.

2.9.4 Authority having jurisdiction response documentation

The Wadena FC was designated as the incident commander. The FC primarily liaised within the ICP and was verbally briefed on developments. The MOE and the Office of the Fire Commissioner of Saskatchewan (OFC) provided logistical support at the ICP. The FC and AFC were not trained to the NFPA 472 and had no experience with this type of response. Consequently, the MOE became the de facto incident commander within the unified command system (UCS), assumed the role of the authority having jurisdiction (AHJ), and became responsible for documenting the response.

All parties relied on CN's operational expertise to deal with the tank cars, DG, and site remediation. Throughout the response, the FC, MOE and OFC staff primarily remained at the ICP. Once CN wrecking operations commenced at approximately 2200 on 07 October 2014, they continued until approximately 0500 on 08 October 2014 when all cars were finally clear of the track.

In this case, there were gaps within the implementation of UCS and the AHJ documentation of the response. Specifically:

• The designated incident commander was not trained to NFPA 472 and had no experience in dealing with train derailments involving DG.
• The activities outlined in the initial IBs and IAPs did not detail site entry times, specific actions or monitoring performed prior to CN wrecking operations being commenced, or during wrecking operations, as the situation changed.
• There was no record of any updated information regarding site operations during the execution of the CN tactical plan to deal with the 2 petroleum distillate cars.
• There was no staff assigned to monitor and report on CN operations at the site.
• Since updates were not required as CN wrecking activities progressed, the FC, MOE and OFC were unaware that product had accidently released from tank car PROX 126 or that a close-call had occurred during the subsequent CN flaring activity.

When an accident involving DG occurs, it is important that as much accurate information as possible is recorded and disseminated to appropriate agencies as quickly as possible. It is equally important that wrecking operations are monitored by, and written updates are provided to the incident commander as the situation changes. When terminating an incident, NFPA 472 requires that an incident debriefing and a multi-agency critique should be conducted and an incident report submitted to the designated authority. This can only be accomplished when the IC structure is properly implemented and staffed with qualified personnel so that the incident can be appropriately monitored and documented.

In this occurrence, the Wadena FC was the incident commander. However, the FC and AFC were not trained to the NFPA 472 and had no experience with this type of response. If an incident commander is not appropriately trained, the IC structure may not be properly implemented, increasing the risk that the incident will not be monitored and documented appropriately. Furthermore, if the AHJ does not require written updates or monitor operational activities at a derailment site, a release of product and/or close-call that occurs during site remediation might not be identified, increasing the risk that opportunities to learn from and improve the emergency response process will be missed.

2.9.5 Canadian National Railway documentation and response to close-call event

For each incident, CN maintains its own detailed Emergency Response Incident Command Logbook. The Logbook is well structured, and contains useful information and guidance for its completion. However, for the response to this occurrence, the documentation was sparse with only 9 of the 108 pages partially completed. Specifically, there was no record of

• tank car information or damage assessment;
• site entry or monitoring of the affected cars;
• wrecking activities;
• any internal meetings or decisions;
• any meetings with, or briefings provided to all external parties;
• the accidental release of product from PROX 126, and subsequent monitoring activities and decisions;
• consideration of the risks associated with flaring PROX 126;
• the close-call involving 2 senior CN personnel during the flaring activity of PROX 126; and
• any debriefing immediately following the flaring activity to discuss what risks were not considered prior to the flaring of PROX 126 and how those risks could be mitigated in the future.

Essentially, CN did not follow its own guidance, and the event was not documented in the CN Emergency Response Incident Command Logbook or shared outside of the CN DG team. Contrary to IC and NFPA 472 best practices, the close-call was also not shared during debriefings with other responding agencies such as the MOE, TC or TSB. The circumstances surrounding the close-call were not documented and openly shared. Therefore, an opportunity to learn from the event and advance safety, not only within CN, but also among other agencies was missed.

The AVP and SDGO were both experienced in emergency response and were considered to be the DG experts on site by all parties, including the CN SVPW. Decisions relating to DG during the wrecking operations, and any related follow-up, were therefore deferred to the AVP and SDGO. Consequently, the decisions relating to the flaring activity were made without considering a secondary defense or review. Since only PROX 126 remained and much of the product had burnt to atmosphere, the AVP and SDGO had likely perceived the risks relating to the flaring activity to be low.

The CN DG team conducted an internal incident debriefing during a conference call about 3 weeks after the derailment. After a discussion, it was decided to draft a controlled burn procedure. The first draft of DG team Standard Operating Guideline (SOG) 200.16 was prepared by September 2015. The close-call was not discussed internally at CN again until after the AFC released the video and the flaring activity of PROX 126 was broadcast by news agencies in early December 2015. Once video of the close-call was broadcast, a new CN VPSS required that it be documented and a procedure developed outlining the risks to consider when conducting a controlled burn (flare) of a DG product. If company and industry guidance is not followed, and close-calls during emergency response activities are not properly documented and openly shared among responding agencies, similar circumstances could occur with a commensurate risk of injury to emergency response personnel.

2.10 Canadian National Railway safety management system

A safety management system (SMS) is designed around evolving safety concepts that are believed to offer great potential for more effective risk management. SMS were progressively introduced in the Canadian transportation industry because this approach to regulatory oversight, when combined with inspections and enforcement, is considered to be more effective in reducing accident rates.

Section 2 of the TC Rail Safety Management System Regulations (2001) (SMS Regulations) requires that a railway company shall implement and maintain an SMS. CN has developed and implemented a detailed SMS that describes company initiatives that correlate to the requirements of Section 2 of the SMS Regulations. With regards to Section 2, item (g), CN has implemented systems for accident and incident reporting, investigation, analysis, and corrective action, and requires that:

• Details of all accidents and injuries must be entered into CN's recording and analysis information system.
• All accidents and injuries are investigated and corrective action is identified.
• Detailed closeout reports must be systematically completed for all reportable accidents and injuries.
• Accidents and injuries are reviewed on weekly system, regional, and functional safety conference calls.
• Accident and injury records are subject to trend analysis reviews to determine if further risk controls are necessary.

When human factors might have played a role in an accident, CN requires further investigation prior to formulating corrective action and requires that the following be considered:

• Was the work properly planned, organized and supervised?
• Was the employee properly trained and equipped?
• Did the employee have the opportunity for sufficient rest?
• Was the rule or work procedure well understood?

In this occurrence, a close-call occurred during the flaring of tank car PROX 126 which involved 2 senior CN management staff. Although the close-call event could be considered an incident and the information collected in accordance with Section 2 (g) of the SMS Regulations, CN's detailed SMS plan only requires that accidents and injuries be recorded. Since there were no injuries and the close-call that occurred during the flaring was not considered to be a railway accident, CN did not document the close-call event or pro-actively share the information with outside agencies.

Although the AVP and SDGO were very experienced, properly trained and equipped, all risks were not fully considered prior to flaring tank car PROX 126. The work associated with the flaring was not properly planned, and the senior management employees involved likely experienced fatigue, which led to decreased vigilance. Since human factors likely played a role in the close-call, it should have been further investigated in accordance with CN guidance.

Since CN has no requirement to document incidents and close-calls, which can also include senior management staff, there would appear to be a gap within CN's SMS. A close-call can be considered as a leading indicator in that the event had the potential to have a significant adverse outcome under different circumstances. A robust SMS should capture, document and analyze such events with a view to expeditiously put measures in place that would minimize risks in the future. If a company's SMS does not adequately capture close-calls, there is a missed opportunity to analyze the event and implement corrective actions to mitigate risks and improve safety.

2.11 Canadian National Railway safety culture, safety management system reporting, and procedures

In parallel with implementing an SMS, CN has recognized the importance of building an effective safety culture, which the company considers essential for SMS. To help strengthen its safety culture, CN has invested in training, coaching, employee recognition and involvement. Among other initiatives, CN developed and implemented the peer-to-peer engagement strategy Looking Out for Each Other, which has become an integral part of CN safety culture.

CN also has company policies and procedures detailing how safety objectives will be met. Such procedures include CN Standard Operating Guidelines (SOG) for CN emergency responders, DGOs and SDGOs. Many of the procedures are based on experience and outline risks to consider when responding to an accident or incident involving DG.

However, in this occurrence, CN had no procedure in place outlining risks to consider when conducting a controlled burn to flare off DG product released from a tank car. Despite the AVP's and SDGO's experience in emergency response, their actions increased risk to their personal safety and resulted in the close-call. Although the CN SVPW and VPSS were present at the site when the close-call occurred, they deferred to the CN DG experts and assumed that appropriate follow-up activities would take place. Consequently, there was no immediate follow-up, further investigation, nor pro-active sharing of the information with outside agencies.

Although the CN DG team conducted an internal debriefing 3 weeks after the close-call and subsequently developed guidance for a controlled burn (i.e., SOG 200.16), the guidance was only issued 15 months after the occurrence and 1 month after the video-recording of the close-call had been broadcast publicly. While the close-call was a singular event, the actions that led to the close-call and the absence of immediate follow-up by CN to deal with the risks following the event are elements that highlight gaps in reporting and/or procedures within CN's SMS.

3.1 Findings as to causes and contributing factors

1. The train derailed when a sudden and catastrophic failure of the south rail occurred under the train, due to an undetected transverse detail defect.
2. The rail surface condition inhibited the transmission of the ultrasonic signals into the rail head and likely masked the presence of a transverse detail defect during the ultrasonic test.
3. Rail traffic had increased significantly from 2.26 million gross ton-miles per mile (MGTM/M) in 2010 to 10.85 MGTM/M in 2014, contributing to the deterioration of the rail surface conditions in the vicinity of the derailment.
4. The frequency of rail grinding on the Margo Subdivision had not been sufficient to remove the rail surface conditions before ultrasonic testing.
5. The absence of thermal protection for tank car PROX 126 increased the severity of the product release and further fueled the fire as the car sustained thermal tears after being subjected to the pool fire.
6. The Canadian National Railway assistant vice-president, Safety and Emergency Response, and the senior dangerous goods officer did not consider all the risks associated with the flaring activity prior to igniting the pool of product released from tank car PROX 126 and were in a position that left them exposed to a fireball when the vapors in the tank ignited.
7. It is likely that the assistant vice-president, Safety and Emergency Response, and the senior dangerous goods officer experienced fatigue due both to prolonged wakefulness and circadian rhythm disruption, which led to decreased vigilance regarding the risks associated with the flaring of tank car PROX 126.

3.2 Findings as to risk

1. If older vintage rail that is at or near the end of its service life remains in the track, rail defects and rail surface conditions will develop, increasing the risk of service failures and derailments.
2. If rail surface condition is not adequately maintained through rail grinding before ultrasonic rail flaw inspection, the rail surface condition may inhibit the transmission of the ultrasonic signals and mask the presence of an emerging rail defect, increasing the risk that it will grow undetected leading to a broken rail derailment.
3. If new tank car standards are not fully implemented in a timely manner, there is a continued risk of product loss and associated consequences when tank cars carrying flammable liquids are involved in a derailment.
4. If the carload threshold limit for key routes is selected without supporting rationale, routes that do not meet the threshold will not be specifically considered, increasing the risk that any necessary mitigation strategies will not be implemented on these routes.
5. If corridor risk assessments do not consider leading indicators for infrastructure condition, track infrastructure failures might occur, increasing the risk of derailments.
6. If wind direction is not monitored and planned activities modified to correspond with changes in wind direction, there is an increased risk that emergency responders will be caught unexpectedly in a vulnerable position.
7. If an incident commander is not appropriately trained, the incident command structure may not be properly implemented, increasing the risk that the incident will not be monitored and documented appropriately.
8. If the authority having jurisdiction does not require written updates or monitor operational activities at a derailment site, a release of product and/or close-call that occurs during site remediation might not be identified, increasing the risk that opportunities to learn from and improve the emergency response process will be missed.
9. If company and industry guidance is not followed, and close-calls during emergency response activities are not properly documented and openly shared among responding agencies, similar circumstances could occur with a commensurate risk of injury to emergency response personnel.
10. If a company's safety management system does not adequately capture close-calls, there is a missed opportunity to analyze the event and implement corrective actions to mitigate risks and improve safety.

3.3 Other findings

1. Localized surface collapses can be an indicator of potential emerging rail defects that would require more rigorous attention, particularly when they are present in older vintage rail that is at or near its fatigue limit.
2. Since the Transport Canada (TC) transportation of dangerous goods inspectors were unaware that a close-call had occurred during the flaring activity, there was no mention of the PROX 126 flaring activity or close-call in the TC Accident Attendance Report.
3. Canadian National Railway informed the Transportation Safety Board of Canada that a car had been flared off during the night, but there was no mention of a close-call.
4. Canadian National Railway (CN) did not provide a briefing to any of the attending agencies, nor was any internal CN documentation or report prepared indicating that a close-call had occurred during the flaring of PROX 126.
5. Although the Wadena fire chief was the incident commander for the response and later became aware of the close-call, contrary to incident command and National Fire Protection Association 472 Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents (NFPA 472) best practices, no subsequent verbal/written report or debrief of the close-call was submitted to the Saskatchewan Ministry of the Environment, Transport Canada or the Transportation Safety Board of Canada.
6. A video-recording of the flaring activity of dangerous goods tank car PROX 126 was made public in early December 2015, and only then did the Saskatchewan Ministry of the Environment, Transport Canada and the Transportation Safety Board of Canada become aware that a close-call had occurred.
7. While the close-call was a singular event, the actions that led to the close-call and the absence of immediate follow-up by Canadian National Railway (CN) to deal with the risks following the event are elements that highlight gaps in reporting and/or procedures within CN's safety management system.

4.1 Safety action taken

4.1.1 Canadian National Railway

Canadian National Railway (CN) issued Standard Operating Guideline (SOG) 200.16 on 07 January 2016. The document outlines a new controlled burn procedure for flaring tank cars. The SOG references the importance of considering the location and orientation of any openings in a tank car where a pressure event could take place during a flaring operation. It also specifies that dangerous goods officers involved ensure that any ignition source is introduced at a 90-degree angle to any exposed opening.

CN revised its Emergency Response Plan and Emergency Response Incident Command Logbook; both became effective in 2016. The revised Logbook contains standard Incident Command System forms that are used by North American emergency response agencies.

Throughout 2016, CN Risk Management personnel will be trained on the requirements of documenting an emergency response using the CN Emergency Response Incident Command Logbook (2016).

4.1.2 Saskatchewan Ministry of the Environment

The Saskatchewan Ministry of the Environment (MOE) adjusted its protocols for incident command (IC) and incident action plans (IAP) as follows:

• Unless there are appropriately trained individuals at the local level (ICS 300/400), the MOE will assume command with augmentation from other Government of Saskatchewan resources to ensure that a type one HAZMAT ICS [incident command system] structure is established.
• The MOE will deploy resources to provide local meteorological monitoring.
• The MOE, in conjunction with other provincial ministries, will use the province's resources to staff qualified persons in key positions of the ICS structure during an emergency response involving dangerous goods. This will be implemented to ensure that appropriate direction is provided at all levels of the ICS and that there is adequate monitoring of site activities during the response and remediation.

In addition, the MOE will strengthen the ICS documentation process. The Planning Section, Situation Unit, and Documentation Units will be tasked with specific actions to document the IAP in detail. Regular incident updates will be provided to the Situation Unit for IC staff to review throughout each operational period. A stronger safety culture and dangerous occurrence reporting is encouraged at all incidents. Debriefings and critiques will be performed in a timely manner. Staff will be encouraged to conduct a comprehensive debriefing following the conclusion of all major incidents and close-call events.

This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 13 October 2016. It was officially released on 16 November 2016.

Appendix A – Margo Subdivision rail defects 2011 to 2014

Appendix B – Comparative table of TC/DOT-111 and TC-117 tank car

Appendix C – List of acronyms and abbreviations

AAR

Association of American Railroads (United States)

AFC

assistant fire chief (Wadena)

AHJ

authority having jurisdiction

AREMA

American Railway Engineering and Maintenance-of-Way Association

ASTM

American Society for Testing and Materials

AVP

assistant vice-president, Safety and Emergency Response

BAC

blood alcohol concentration

BOV

bottom outlet valve

C

Celsius (degrees)

CANUTEC

Canadian Transport Emergency Centre

CDT

Central Daylight Time

CST

Central Standard Time

CN

Canadian National Railway

CPC

Casualty Prevention Circular

CROR

Canadian Rail Operating Rules

CWR

continuous welded rail

DG

dangerous goods

DGO

dangerous goods officer

DOT

Department of Transportation (United States)

ECP

electronically controlled pneumatic (brakes)

EMS

Emergency Medical Service

ETS

Engineering Track Standard

FAST

Fixing America's Surface Transportation (United States legislation)

FC

fire chief (Wadena)

FRA

Federal Railroad Administration (United States)

hazmat

hazardous material

IAP

incident action plan

IB

incident briefing

IC

incident command

ICP

incident command post

ICS

incident command system

LPG

liquefied petroleum gas

LSC

localized surface collapse

MGTM/M

million gross ton-miles per mile

mm

millimetre

MMA

Montreal, Maine & Atlantic Railway

MOE

Ministry of the Environment (Saskatchewan)

NFPA 472

National Fire Protection Association 472 Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents

NTSB

National Transportation Safety Board (United States)

OFC

Office of the Fire Commissioner of Saskatchewan

OSHA

Occupational Safety and Health Administration (United States)

PDT

Pacific Daylight Time

PG

Packing Group

PHMSA

Pipeline and Hazardous Materials Safety Administration (United States)

PIH

poisonous-by-inhalation

PNL

Prairie North Line

PRD

pressure relief device

RCMP

Royal Canadian Mounted Police

RTC

rail traffic controller

SDGO

senior dangerous goods officer

SERTC

Security and Emergency Response Training Center (of the Transportation Technology Center Incorporated)

SMS

safety management system

SMS Regulations

Rail Safety Management System Regulations (2001)

SOG

Standard Operating Guideline

SRS

Sperry Rail Service

SVPW

senior vice-president, Western Operations

TC

Transport Canada

TDD

transverse detail defect

TDG

transportation of dangerous goods

TIH

toxic-by-inhalation

TSB

Transportation Safety Board of Canada

TSR

Rules Respecting Track Safety

UCS

unified command system

UT

ultrasonic

VPSS

vice-president, Safety and Sustainability

°

degrees