Language selection

Railway Investigation Report R15H0005

Main-track derailment
Canadian Pacific Railway
Freight train 118-10
Mile 42.0, Nipigon Subdivision
Dublin, Ontario

The Transportation Safety Board of Canada (TSB) investigated this occurrence for the purpose of advancing transportation safety. It is not the function of the Board to assign fault or determine civil or criminal liability. This report is not created for use in the context of legal, disciplinary or other proceedings. See Ownership and use of content.

Summary

On 13 January 2015, at 1118 Eastern Standard Time, Canadian Pacific Railway freight train 118-10 was proceeding eastward on the Nipigon Subdivision at about 35 mph when it experienced a train-initiated emergency brake application at Mile 42.0 near Dublin, Ontario. Subsequent inspection determined that 21 cars had derailed. The derailed equipment included 7 dangerous goods tank cars loaded with propane (UN 1075, liquefied petroleum gas). As a result of the derailment, 1 tank car lost its entire load and another tank car released product. One crew member sustained minor inhalation injuries.

Le présent rapport est également disponible en français.

1.0 Factual information

On 13 January 2015 at about 0710,Footnote 1 Canadian Pacific Railway (CP) freight train 118-10 (train 118) departed Thunder Bay, Ontario, proceeding eastward on the Nipigon Subdivision, destined for Montréal, Quebec. The train was not a key train.Footnote 2 Upon departure, the train received a pull-by inspection with no exceptions noted. Train 118 consisted of 1 head-end locomotive, 1 mid-train (remote) locomotive and 76 loaded cars. It weighed 9226 tons and was 8018 feet long. The train crew consisted of a locomotive engineer and a conductor; both were qualified for their positions, were familiar with the territory, and met fitness and rest requirements. Between Thunder Bay (Mile 132.90) and Dublin, Ontario (Mile 42.60), the train traversed 4 hot bearing detectors (HBD), and no exceptions were noted.

1.1 The accident

As train 118 approached the Dublin east siding switch (Mile 42.00), it passed westbound CP freight 113-11 (train 113), which was stationary in the siding.

At 1118, while travelling at about 35 mph over the Dublin east siding switch (Figure 1), train 118 experienced a train-initiated emergency brake application. The crew did not feel any track anomalies before the emergency brake application. Once train 118 came to rest, the crew made an emergency radio broadcast, and the conductor inspected the train. The inspection determined that the 11th to the 31st cars—which were all loaded cars—had derailed on the main track just east of the Dublin east siding switch. The derailment occurred in an area located just south of and adjacent to the Trans-Canada Highway. The derailed equipment included 7 dangerous goods (DG) tank cars loaded with propane (UN 1075). Because of the remote location, an evacuation was not necessary, but the highway was closed for about 15 hours. The conductor sustained minor inhalation injuries.

1.2 Weather

At 1100 on 13 January 2015, the HBD at Mile 59.0 broadcast an ambient temperature of approximately −23 °C. In the 24 hours before the derailment, the lowest temperature recorded at the weather station at Nipigon, Ontario, (21 miles west of Dublin) was −29.5 °C.

Figure 1. Derailment location (Source: Railway Association of Canada, Canadian Railway Atlas, with TSB annotations)
Derailment location

1.3 Summary of events

Table 1 provides a summary of the events, which were compiled from a number of sources, including the locomotive event recorder,Footnote 3 rail traffic control records, and radio transmissions. Following the accident, the in-charge manager requested information from the crew through the rail traffic controller (RTC), who relayed the questions to the crew and provided information back to the manager.

During the derailment site follow-up, communications between the conductor and the RTC were made using a standard railway crew portable radio. Railway crew portable radios are not intrinsically safe.Footnote 4

Table 1. Summary of events
Time Event
1118 Train 118 experienced an emergency brake application.
1119 Train 118 came to rest with the lead locomotive 1150 feet east of where the emergency brake application occurred.
1120 The train 118 crew advised the RTC that they were stopped in emergency.
1130 The train 118 conductor confirmed that the train had derailed. The conductor noted that the first tank car was upright and the following tank cars were down an embankment.
1132 The train 118 conductor provided the RTC with details on the DG tank cars that were derailed and their orientation.
1137 The RTC requested that the train 118 conductor provide further details on the derailed cars as soon as possible, as managers were waiting for the information.
1143 The conductor of westbound train 113 confirmed that the derailment was entirely east of the Dublin east siding switch and did not affect train 113.
1145 The RTC asked whether the tank cars were leaking. The train 118 conductor indicated that he would look but would stay west of the cars, because the wind was blowing eastward.
1152 The train 118 conductor confirmed the number of the last car derailed and confirmed that 7 DG tank cars were involved.
1155 The train 118 conductor indicated that a section man had been sent away from the site, because the cars were hanging over an embankment and could fall, and some of the DG tank cars were leaking.
1156 The train 118 engineer requested to cut away from the train and pull the head end of the train eastward. The RTC noted the request and indicated that the train 118 engineer would be advised shortly.
1201 The RTC requested that the train 118 crew remain on site until a relief crew arrived, unless train 118 crew felt unsafe.
1208 The train 118 conductor provided the car numbers for the 7 derailed DG tank cars.
1212 The RTC requested further information on the derailed cars.
1219 The RTC requested general information from the crew such as signal indication and speed, and also requested more details on which cars were derailed.
1224 to 1230 The train 118 conductor provided the RTC with a detailed list of the cars derailed in order while walking through the derailment site. The RTC indicated that some cars were missing from the list. The conductor replied that those cars were in the bush. The RTC requested the conductor to re-check one of the cars to verify whether it was derailed.
1232 to 1235 The RTC requested details on the derailed cars, including which cars were leaking and whether product was being released into the creek.
1236 The train 118 conductor reported feeling ill and said he wondered whether he should be checked. The RTC asked whether the conductor needed emergency medical services (EMS). The conductor responded that the RTC should wait before calling for EMS.
1238 The train 118 crew asked the RTC how much longer they would be on site. The crew was told to stand by.
1239 The train 118 crew was told that a relief crew had been ordered.
1300 A CP police officer arrived on site, confirmed that tank cars were leaking propane, and was concerned that the Dublin east siding switch heater was a possible source of ignition for the gas.
The police officer refused to access the site but accompanied the train 118 conductor back to the head-end locomotive for a job briefing.
1310 The RTC inquired how the train 118 conductor felt and whether the crew needed to be checked by EMS. The train 118 conductor responded that he had a cough but was feeling okay. EMS indicated that they were close by, but the highway was closed.
RTC indicated that there was no way to deactivate the heater. The police officer requested that the Dublin east siding switch heater be shut off on site, and asked the RTC to ensure that the switch heater was not started.
1320 Under the authority of a manager who had recently arrived on site, the train 118 crew uncoupled from the train the lead locomotive and the 10 cars at the head end and moved to the crossing at Mile 41.03.
1322 The train 118 engineer called the RTC and requested that someone evaluate the conductor, who was “coughing pretty good.”
1324 to 1332 The train 118 engineer indicated that the train had moved to the crossing at Mile 41.03 and asked to move further east, because the wind was continuing to blow in their direction.
The police officer agreed that the train should be moved, because there was propane leaking and the locomotive could be a source of ignition.
The RTC asked the train 118 crew to stand by.
The RTC asked EMS to check the conductor.
Following additional conversations, it was agreed that train 118 be moved further east to the crossing at Mile 39.36, where medical attention was sought for the conductor.
Further conversations ensued about the Dublin east switch heater. A maintainer was contacted to shut off the switch heater on site.
1341 The train 118 engineer enquired where the relief crew was. The engineer wanted to accompany the conductor, who was heading to the hospital. The train 118 crew was informed that a relief crew should be there within a half an hour.
As a precaution, the train 118 conductor and engineer were transported to hospital in Terrace Bay, Ontario. They were released from hospital later that evening.

1.4 Site examination

The first derailment marks observed on the track were at a poly-insulated rail joint (the joint) on the south rail at Mile 42.0, just east of the Dublin east siding switch. The joint was part of the Dublin east siding turnout assembly. Both joint bars and the rail extending to the west were intact. However, only a portion of the rail extending toward the east remained between the joint bars. The rail had fractured within the joint, and several pieces were scattered in the vicinity of the joint. The remainder of the south rail east of the joint was destroyed for approximately 250 feet. The north rail had remained intact; only minor derailment damage was observed. The joint containing the remaining rail was removed and forwarded to the TSB Laboratory for detailed examination.

The lead locomotive came to rest at Mile 41.56 with 17 cars still attached. The first 10 cars did not derail. The R4 wheel on the 4th car from the head end, PROX 035435, exhibited damage on its tread consistent with that of a heavy rail impact against a fractured rail (Photo 1).

Photo 1. Damaged wheel surface on car PROX 035435
Damaged wheel surface on car PROX 035435

The 21 derailed cars (11th to 31st cars) came to rest in various positions.

The 11th to the 17th car were derailed in the upright position along the track bed. Although these 7 cars sustained minor damage, no existing mechanical defects that would have contributed to the derailment were observed.

The 18th to 20th cars were DG tank cars loaded with propane. They came to rest parallel to the track bed at the bottom of the embankment south of the track. These cars displayed damage from the impact but did not release product.

The 21st to 31st cars came to rest on the south embankment of the track. The cars were jackknifed and on their sides in a pile, which extended from about 80 feet to 225 feet east of the joint (Figure 2).

Figure 2. View of derailed cars just east of the insulated joint (Source: Canadian Pacific Railway)
View of derailed cars just east of the insulated joint

1.5 Train documentation

The train documentation provided to the conductor included compressed waybills for all DG cars. Although DG tank car PROX 36178 was loaded with odourized propane, a “Non-Odorized” stencil was applied to each side of the car. The compressed waybill for the car did not indicate that the tank car was loaded with odourized propane, nor was it required to so indicate.

Transport Canada's (TC) Transportation of Dangerous Goods (TDG) Regulations set forth requirements for the shipment of DGs. Section 3.5 Information on a Shipping Document states (in part):

(1)  The following information must be included on a shipping document:

  1. the name and address of the place of business in Canada of the consignor;
  2. the date the shipping document or an electronic copy of it was prepared or was first given to a carrier;
  3. the description of each of the dangerous goods, in the following order:
    1. the UN number,
    2. the shipping name and, immediately after the shipping name unless it is already part of it,
  1. for dangerous goods that are subject to special provision 16, the technical name, in parentheses, of at least one of the most dangerous substances that predominantly contributes to the hazard or hazards posed by the dangerous goods, and
  2. for a liquefied petroleum gas that has not been odorized, the words “Not Odourized” or “Not Odorized” or “Sans odorisant”.

1.6 Subdivision and track information

CP's Nipigon Subdivision consists of a single main track that extends from Schreiber, Ontario (Mile 0.0), westward to Thunder Bay, Ontario (Mile 132.9). Train movements on the subdivision are governed by the centralized traffic control (CTC) system, as authorized by the Canadian Rail Operating Rules (CROR) and controlled by an RTC located in Calgary, Alberta.

In 2014, total traffic on the Nipigon Subdivision was 31 million gross tons (MGT),Footnote 5 including almost 74 000 cars loaded with DGs, of which over 50 000 were tank cars. The Nipigon Subdivision was classified as a key route.Footnote 6

In the vicinity of the derailment, the track was rated as Class 4, according to the TC–approved Rules Respecting Track Safety, also known as the Track Safety Rules (TSR). The authorized speed for freight trains in the area was 50 mph.

The track in the vicinity of the derailment was tangent. The track structure consisted of 115-pound continuous welded rail (CWR) manufactured by Sydney Steel in 2004. The rail was laid in 2005 and was in good condition. The rail was set into double-shouldered tie plates, secured to No. 1 hardwood ties with 5 spikes per plate, and box-anchored every other tie. The tie cribs were full, and the ballast shoulders ranged from 12 to 24 inches beyond the ends of the ties.

At Mile 42.0, immediately east of the Dublin east siding switch, there were 2 poly-insulated joints adjacent to each other on the north and south rails. The east siding switch was equipped with a propane-fueled switch heater. Switch heaters are remotely activated heating devices that use a burner to melt snow and ice so that the switch can be used in cold weather.

1.7 Roles and responsibilities of the train crew and rail traffic controller

A conductor is in charge of managing a train, the contents on a train, and the related documentation. CP's conductor training manual indicates that, in the event of an emergency, it is the conductor's responsibility to assure the safety of a train, other trains, tracks, crew members, and the public while complying with proper procedures applicable to CROR as well as with the company's rules, policies, and general operating instructions (GOI).

In this occurrence, the conductor had started CP's conductor training program in February 2011 and had qualified to work as a conductor in July 2011. The conductor had requalified in May 2012 and again in December 2014.Footnote 7 This accident was the first time the conductor had been involved in a large derailment.

A locomotive engineer, who is responsible for the safe operation of a train, operates the locomotive in accordance with the CROR and the company GOI. The locomotive engineer is expected to remain in the cab or close to the locomotive in most instances. In this occurrence, the locomotive engineer had over 37 years of service: he had been promoted to the position in 1981, after working as a brakeman and a conductor.

An RTC is responsible for the safe and efficient operation of the railway within an assigned operating territory. The RTC coordinates trains and other on-track railway movements from the rail traffic control centre. In this occurrence, the RTC had started working for CP in 1997 and had about 13 years' experience as an RTC.

1.8 Canadian Pacific Railway emergency response procedures

1.8.1 Crew

While on duty, all operating employees must have a copy of the company CROR rules and GOI manuals for quick reference. General rule A(iv) of the CROR states (in part) that employees must “communicate by the quickest available means to the proper authority any condition which may affect the safe operation of a movement.” The proper authority is defined in the CROR as “the rail traffic controller or the appropriate railway supervisor.”

In addition to rules and instruction manuals, operating employees must carry the Emergency Response Guidebook, which provides crews with information on DGs and instructions for responding to emergencies involving DGs. In this occurrence, both crew members had these books in their possession. During the initial conductor training and requalification training at CP, the rules and instructions with respect to responding to DG incidents/accidents were emphasized and tested.

With respect to derailments, CP's Train and Engine Safety Rule Book includes, as a core safety rule, “approach an emergency or a derailment site only when it has been determined that it is safe to do so.”Footnote 8 This rule book does not specify how, or by whom, this determination is to be made.

CP's GOI describes the steps for the crew to follow in assessing the hazards associated with DGs following an incident/accident. Following a visual inspection of the incident (from the locomotive cab, if possible), the crew is instructed to

If the DG hazard does not preclude approaching the derailed cars, the operating employees are instructed to conduct an assessment of site hazards, including physical, chemical, electrical, and other hazards.Footnote 10 The GOI advises employees to

In addition, the GOI instructs employees to rescue the injured, perform first aid, and keep members of the public away from the scene. With respect to the locomotives and cars not involved in the derailment, the GOI states, “If the locomotives are not directly involved in the accident, the train should be cut as close as safely possible and cars removed a safe distance.”Footnote 11

If a car is found to be leaking, the train crew is instructed to get clear of the spill or leak immediately, upwind if possible, and to avoid low-lying areas.Footnote 12

The Train and Engine Safety Rule Book provides procedures for conducting job briefings. It indicates that the conductor is responsible for leading a job briefing at the beginning of any job. The job briefing is to cover

It is further indicated that job briefings should identify the presence of any special DG cars and that additional job briefings are to be carried out as the situation changes.Footnote 13 However, there is no specific format or content specified for job briefings following a derailment or when responding to an occurrence.

1.8.2 Rail traffic control

Section 14.0 of CP's Rail Traffic Control Manual outlines the RTC's responsibilities with respect to occurrences involving DGs. This manual states (in part):

When an incident occurs involving DG and the RTC is the first railway employee notified by the operating crew, the RTC must notify the Director. They will ensure that all necessary civil and railway authorities are notified and appropriate emergency equipment is sent to the scene.

When advised of an incident, the RTC must obtain, verify and record (on RTC Planning Sheet) the following information:

  1. location of incident (subdivision and mileage),
  2. number of cars involved and condition,
  3. car initials and number,
  4. weather conditions.

1.8.3 Dangerous goods training for Canadian Pacific Railway operating employees

CP's training materials on the transportation of DGs indicate that any DG leak may be hazardous. The training materials describe the primary role of the crew as providing information to the RTC. They further indicate that the crew members are to vacate the area if they suspect that there is a leak.

In CP's training materials, the following guidance is provided to train crews in the event of an emergency response involving DGs:

However, CP crews were not specifically trained to

1.9 Propane characteristics and precautions

Propane is a compressed, odourless, flammable gas commonly used for heating, cooking, and welding. To detect the presence of the gas, ethyl mercaptan, an odorant, is often added so released gas can be easily identified. When shipped in bulk, the gas does not always have an odorant added. However, in this case, the derailed tank cars contained odourized propane.

1.9.1 2012 Emergency Response Guidebook – Guide 115

Guide 115 of the 2012 Emergency Response GuidebookFootnote 15 (Appendix A) identifies the potential hazards of various flammable gases, including propane, and provides guidance for emergency response and public safety. In addition, the guide outlines potential hazards and safety precautions to consider when dealing with flammable gases:

1.9.2 Effects of propane inhalation

A fact sheet on propane prepared by the Canadian Centre for Occupational Health and Safety provides the following information on the effects of propane inhalation:

Low concentrations are not harmful. A high concentration can displace oxygen in the air. If less oxygen is available to breathe, symptoms such as rapid breathing, rapid heart rate, clumsiness, emotional upsets and fatigue can result. As less oxygen becomes available, nausea and vomiting, collapse, convulsions, coma and death can occur. Symptoms occur more quickly with physical effort. Lack of oxygen can cause permanent damage to organs including the brain and heart. At high concentrations: can harm the nervous system. Symptoms may include headache, nausea, dizziness, drowsiness and confusion. Can cause irregular heartbeat.Footnote 16

The fact sheet further indicates that, in the event of difficulty breathing, the individual should be given emergency oxygen by trained personnel and that emergency medical assistance is urgently required.

1.10 Emergency response involving dangerous goods

For a railway occurrence involving propane, the initial responders are usually the train crew. Their task is to gather initial information from a safe distance. Once the first and last derailed cars are identified, the train crew should leave the area; the detailed assessment of the site should be conducted by qualified emergency responders. Qualified emergency responders can include specially trained railway personnel and fire departments.

A detailed secondary site assessment is made by qualified emergency responders from a safe distance. Once this is conducted, a detailed site entry plan is made, which includes identifying potential sources of ignition, such as a switch heater. Subsequently, responders enter with appropriate personal protective equipment (PPE), including, if necessary, positive-pressure SCBA. The responders would normally carry devices for air-quality monitoring and product detection, as well as intrinsically safe radios, cameras and/or cell phones. Electronic devices that are not intrinsically safe can be a source of ignition.

1.11 Research on emergency response

Research on how individuals and teams make decisions in high-stress situations highlights the need for clear, well-practised procedures for dealing with emergency situations. Specifically, it has been shown that, when teams initiate a novel task in extreme conditions, they tend to be conservative in their approach and focus on rules or formalized procedures.Footnote 17 This behaviour has been explained as follows: “individuals undergoing stress, anxiety and psychological arousal tend to increase their reliance on internal hypotheses and focus on dominant cues to emit well-learnt responses. In other words, the potential decision response to a crisis situation is to go by the book, based on learned responses.”Footnote 18

Research has underscored the importance of clear lines of responsibility in dealing with emergencies. Under stressful conditions, low-status members of a team may hesitate to take action and will defer to others. This may lead subordinates to be more hesitant to question authority in emergency situations, and subordinates may not offer valuable information. One way to counter this tendency is to ensure that responsibility is diffused throughout the team rather than focused at the top of the hierarchy.Footnote 19

1.12 Requirements for track inspections

Under the current TC-approved TSR and CP's Red Book of Track and Structures Requirements, a number of track inspections must be performed.

1.12.1 Visual track inspection

The TSR require the following:

Visual Track Inspection must be made on foot or by riding over the track in a vehicle at a speed that allows the person making the inspection to visually inspect and evaluate the track for compliance to the TSR.Footnote 20

The speed of the vehicle must not be more than 5 mph when traversing railway crossings, turnouts or special trackwork.Footnote 21

For Class 4 track, the TSR require that visual track inspection must be performed at a minimum twice per week with no more than a 3 day separation.Footnote 22

Visual track inspections are usually performed by a track inspector working from a hi-rail vehicle. With regard to rail joints, an inspector would be looking for such things as loose or missing bolts, and broken or cracked joint bars. During the winter, these inspections can be more difficult, as snow can cover the rail and hide some defects. However, if trains have operated over the track between the last snowfall and the inspection, indicators such as snow that has moved away from the joint can help identify loose joints.

In this occurrence, the track in the vicinity of the derailment had been visually inspected in accordance with regulatory requirements. The last visual track inspection had been conducted on 12 January 2015, the day before the accident; no defects had been noted.

1.12.2 Joint inspection

The TSR state that

Each rail joint, insulated joint, and compromise joint must be of the proper design and dimensions for the rail on which it is applied.Footnote 23

If a joint bar on Class 3 through Class 5 track is cracked, broken, or because of wear allows vertical movement of either rail when all bolts are tight, it must be replaced.Footnote 24

CP requires that scheduled joint inspections be conducted on the ground to ensure a close visual inspection for defects,Footnote 25 and that inspectors pay particular attention to

In addition, CP requires that joint inspections be performed twice per calendar year, with one inspection performed between the months of January and June and the other between the months of July and December, and that consecutive inspections be separated by at least 120 calendar days.Footnote 27

The last joint inspection before the occurrence was conducted on 31 October 2014; no defects were noted.

1.12.3 Turnout inspection

The TSR require that

A routine turnout and special trackwork inspection be conducted to assess general condition and identify defects on a Turnout or Special Trackwork each time they are traversed during a Visual Track Inspection.Footnote 28

For Class 4 track with annual tonnage in excess of 35 MGT [million gross tons], such as the Nipigon Subdivision, a Walking Turnout and Special Trackwork inspection must be performed on foot twice monthly to assess the general condition. A Walking Turnout and Special Trackwork inspection is not required in any month that a Detailed Turnout and Special Trackwork Inspection is completed.Footnote 29

Each Turnout and Special Trackwork must receive a Detailed Turnout and Special Trackwork Inspection annually. A Detailed Turnout and Special Trackwork Inspection is an inspection performed on foot to assess the condition of turnout or special trackwork.

A Detailed Turnout and Special Trackwork Inspection include the measuring and recording of the following specified items:

  1. Track gauge measurements 5 to 10 feet ahead of switch points, at the heel block, at the mid-point of curved closure rail and at intervals throughout the diverging route behind the frog.
  2. Guard check gauge measurement.
  3. Guard face gauge measurement.
  4. Switch Point Rise where contact is evident (Vertical clearance between the Switch Point and Stock Rail).
  5. Heel Block assembly for surface and check bolts to confirm they are tight.
  6. Cross level measurements at locations 15.5 feet apart on both routes throughout the turnout.Footnote 30

As required by CP, detailed turnout inspections were performed twice per year on the Nipigon Subdivision. During these inspections, all aspects of a turnout were thoroughly inspected, including the insulated joints on each side of the turnout.

Before this occurrence, the most recent detailed turnout inspection for the Dublin east siding switch turnout had been conducted on 05 December 2014, and no defects were noted.

1.12.4 Cold weather inspection

In CWR territory, severe cold causes rail to contract, which places it in tension. At low temperatures, rail steel has reduced ductility and fracture toughness. Under these conditions, rail steel has been known to pull apart and/or fail as a result of elevated wheel impacts, particularly at locations where a rail flaw is present or emerging. To protect against derailments due to rail pull-apart or failure, railways conduct additional cold weather track inspections.

CP requires that cold weather track inspections be performed daily on main track whenever the temperature falls to −25 °C or below. During cold weather inspections, inspectors are to look for broken rails and joints due to pull-aparts.Footnote 31

On 11 January 2015, because of cold temperatures and switch cleaning, a walking inspection was performed in the area of the derailment. Although no defects were noted, the track maintainer did note that the rail appeared a bit low in the area of the joint, but was within limits.

1.12.5 Track geometry inspection

The TSR set forth the minimum track geometry requirements for a given class of track. For Class 4 track, with annual tonnage of over 35 MGT, the TSR require that an electronic geometry inspection be conducted with a heavy geometry-inspection vehicleFootnote 32 at least twice per year.Footnote 33

Track geometry inspections record parameters such as

Railway companies can increase the frequency of geometry inspections and develop additional internal requirements to assist with track maintenance. For the Nipigon Subdivision, CP performed 4 geometry inspections per year, which exceeded regulatory requirements.

In the vicinity of the derailment, the 2 most recent CP track geometry inspections were conducted on 19 August 2014 and on 06 November 2014. In both inspections, CP priority defect S22-SRFootnote 38 (S22) and some minor alignment conditions were recorded in the area of the joint. A CP S22 priority defect occurs when the measured vertical displacement or midpoint of a 22-foot cord strung along the top of the rail in Class 4 track exceeds 0.625 inch. Such conditions are commonly associated with excessive joint deflection, which can result in higher-than-usual wheel impacts and lead to rail failure. When these defects occur at rail joints, they are normally indicative of deteriorating joint support that should be restored.

The 19 August 2014 geometry inspection recorded an S22 value of 0.705 inch and the 06 November 2014 test recorded an S22 value of 0.847 inch at the same location. Both values were within standard for Class 4 track, but exceeded the CP priority defect criteria and indicated that the condition of the joint had deteriorated further between August 2014 and November 2014. CP has no near-urgent or urgent status for an S22 defect, as it is expected that it a priority S22 defect will be monitored and repaired as soon as practicable.

The location was monitored during regular track inspections.

1.12.6 Rail flaw inspection

Rail cracks within joints (that is, bolt hole cracks) can be hidden from view during a visual inspection. Rail flaw (ultrasonic/induction) testing provides an additional method of identifying cracks within rail joints.

For Class 4 track with annual tonnage of over 35 MGT, the TSR require that the rails be ultrasonically tested for internal rail flaws/cracks a minimum of 4 times annually.Footnote 39 For the Nipigon Subdivision, CP performed 6 rail flaw tests per year, which exceeded the regulatory requirements.

Rail flaw testing was conducted by Herzog. Rail flaw detector vehicles are equipped with an undercarriage platform that contains electromagnetic (induction) technology and 3 fluid-filled roller search unit (RSU) wheels for each rail. Each RSU contains a number of transducers that are used to detect vertical and transverse defects within the rail. Liquid couplant facilitates the transmission of ultrasonic energy from the transducers into the rail. The energy waves, reflected off discontinuities, identify flaws and cracks within the rail before the defects can lead to rail failure. Improvements have been made in rail-testing technology, including probes being added to the defect-recognition software at different angles and enhancements. Ultrasonic testing can be a reliable and economical method of rail flaw testing, but it does have some limitations.

Rail flaw testing will normally detect a bolt hole crack that is at least ½ inch long and extends more than halfway across the rail web at least 75% of the time. However, bolt hole cracks smaller than ½ inch, or those that do not extend more than halfway across the rail web, may not be consistently detected. Ultrasonic detection of a bolt hole crack can also depend on the orientation of the crack and speed of the test.

Before the occurrence, the most recent rail flaw test had been performed on 08 December 2014, and no flaws or cracks were detected in the vicinity of the derailment.

1.13 Railway signalling system

Railway signalling systems divide subdivisions into blocks. Each block displays a signal, which depends upon a flow of electricity travelling through the rail. When a train enters a block that is free of traffic, the signal entering this block will display a “clear” indication. However, if another train is occupying a block ahead, or if the electrical continuity of the rails is interrupted as a result of events such as a broken rail or an open switch, the system generates a sequence of signals informing the crew to stop the train or to reduce its speed enough for it to be able to stop within half the range of vision. This speed should not exceed 15 mph. This failsafe feature helps to protect the crew by preventing collisions and preventing train operation through areas that may contain broken rails. However, if a rail break does not separate completely, the flow of electrical current may not be interrupted, and a warning signal may not be sent.

1.14 Insulated rail joints

Insulated rail joints are used to stop the flow of electricity at the beginning and end of a block where the signals are located. In this case, the joint was equipped with 2 poly-insulated joint bars. For this type of joint, polyurethane-encapsulated joint bars are placed on each side of the rail and secured into place with bolts placed through holes in the web of the rail. An insulator is placed between the end rails (Figure 3). Insulated joints and pre-bonded plugs do not inhibit the ability of a rail flaw ultrasonic test to detect the presence of bolt hole cracks.

Figure 3. Poly-insulated joint
Poly-insulated joint

1.15 Bolt hole cracks

One of the most common modes of rail failure is a fracture originating from a bolt hole crack within a rail joint. Cracks originating from the bolt holes in the web of the rail can develop for a number of reasons. These cracks usually propagate at a 45-degree angle extending from a bolt hole. Loose or poorly supported joints can accelerate the initiation of a crack owing to the stresses that occur within the joint when a train travels over it. An undetected bolt hole crack can lead to a rail break. Within a joint, cracked rail can remain undetected and in place for an extended period of time until it is replaced or fails in service.

1.16 Reducing stress levels at rail joints

In 1975, the Department of Transportation (DOT) in the United States sponsored a studyFootnote 40 to examine techniques to enhance fatigue life used in the aerospace industry and to apply them to rail bolt holes. The study demonstrated dramatic improvements to rail life by reducing bolt hole stress levels after applying a split sleeve cold expansion process. Further studies around the world have led to the use of this process in the United Kingdom, China, and the United States.

The process, which can be performed on site, involves mechanically expanding the bolt holes to the point of plastic deformation after the hole is drilled. This is accomplished by hydraulically pulling an oversized, tapered mandrel through an internally pre-lubricated split sleeve in the hole. With the use of a portable hydraulic pulling device, this process can be performed in the field and requires little additional time. A study published in 1993 concluded that

Cold expansion of these joints reduces the probability of cracking by allowing the joint to operate at higher stress levels. Inducing residual compressive stresses around rail-end bolt holes improves safety of operations by eliminating a potential cause of derailment. It also leads to more economical rail operations by extending inspection intervals and reducing routine and special maintenance costs.Footnote 41

1.17 Impact of cold weather on track infrastructure

During cold-temperature operations, the ability of the track infrastructure to endure in‑service forces, to withstand damage, and to avoid breakage is reduced. Rail steel is known to contract and to have reduced fracture toughness and ductility when subjected to low temperatures. The rail contraction increases tensile stresses within the rail. These tensile stresses can facilitate crack initiation, particularly when stress risers, such as internal rail defects, and track appliances, such as rail joints, are present.

To manage the effects of cold weather on track infrastructure, Canadian railways typically put train speed restrictions in place during cold weather. On the Nipigon Subdivision, train speeds were limited to 35 mph when an HBD broadcast temperatures below −25 °C. During the first part of the trip from Thunder Bay, train 118 had been limited to 35 mph. However, once the HBD at Mile 59.0 had broadcast a temperature of −23 °C, the train was allowed to proceed at the permitted track speeds (that is, between 40 mph and 50 mph). Some of the previous trains through this area had been restricted to 35 mph because of the temperature.

1.18 Wheel impacts on rail infrastructure

Within the railway industry, it is recognized that wheels producing high-impact loads can cause damage to equipment (axles and journals) and to the track infrastructure. The potential for damage to infrastructure increases as the rail fracture toughness and ductility are reduced owing to cold temperatures. Canadian National Railway (CN) previously analyzed wheel-impact and broken-wheel data from 1992 to 1995. The analysis established a causal link between high wheel-impact loads and broken rails.

The TSB has investigated at least 6 other occurrences caused by broken rails that had resulted from high wheel impacts (Appendix B).

1.19 Wheel impact load detectors

Wheel impact load detectors (WILD) are a type of wayside inspection system that measures wheel impact forces resulting from wheel tread defects. The wheel impacts are measured in kips (1 kip is equal to 1000 pounds of force). The development and installation of WILD technology was an industry initiative that has enhanced rail safety by proactively identifying high-impact wheels so that they can be removed before they cause damage to rolling stock or to the track infrastructure.

WILD systems are usually installed on tangent track, where the track speed is 50 mph. The objective is to record the measured impacts at track speed. The measured wheel impact force is directly related to speed. When a wheel tread defect is present, the faster the train travels, the greater the measured wheel impact will be. Conversely, any reduction of train speed as it traverses a WILD site can reduce the measured wheel impacts.

1.19.1 Wheel impact load detector impact wheel removal criteria

Rule 41 of the 2013 Field Manual of the Association of American Railroads (AAR) Interchange Rules specifies (in part) the following criteria for wheel removal due to impact detected by WILD:

Rule 41

STEEL WHEEL DEFECTS—OWNER'S RESPONSIBILITY

1.   Condemnable at Any Time

[…]

r.   Wheel Out-of-Round or 90,000 Pounds (90 kips) or Greater Impact.

(1) Detected by a wheel impact load detector reading 90,000 pounds (90 kips) or greater for a single wheel. The detector used must meet the calibration and validation requirements of Appendix F. The detector must reliably measure peak impacts and must provide a printable record of such measurements. Device calibration records must be maintained. Wheels with condemnable slid flat spot(s) are handling line responsibility and must not be billed otherwise.

[…]

2.   Condemnable When Car Is on Shop or Repair Track for Any Reason

[…]

f.   Detected by a Wheel Impact Load Detector reading from 80 kips to less than 90 kips for a single wheel. The detector used must have been calibrated per Appendix F. The detector must reliably measure peak impact and must provide a printable record of such measurements. Device calibration records must be maintained. Wheels with condemnable slid flat spots are handling line responsibility and must not be billed otherwise. This will be considered an Opportunistic Repair for the repairing party.

The AAR Wheels, Axles, Bearings and Lubrication Committee was responsible for the development and implementation of Rule 41. Its decision to use 90 kips as the condemning limit was based on a number of technical studies that had been conducted in the early 1990s. These studies determined that a measured impact of 90 kips was a reasonable wheel-removal threshold that would limit the damage to the equipment and to the track infrastructure.

1.19.2 Railway wheel impact load detector thresholds

In addition to the AAR condemning limits for wheel impacts, railways have developed their own removal thresholds. Because these thresholds are based on the operating practices and conditions of each railway, they vary throughout the industry.

Railway WILD thresholds have evolved over time; they evaluate the measured impact and the calculated impact for a given wheel. The measured impact is the actual wheel impact force recorded at track speed, usually 50 mph. Canadian Class I railways typically adjust the measured impact value using a speed-corrected algorithm to produce a calculated impact. The algorithm is a proactive measure that takes an actual impact level, recorded at a slower speed, and estimates it using linear progression to an impact at 50 mph. This calculation allows a railway to evaluate all wheel impacts to a normalized speed of 50 mph. However, the algorithm for each railway can differ and is sensitive to wheel defect type, low-speed conversion, and assumed linearity. The calculated value is not considered as accurate as the measured value.

1.19.3 Canadian Pacific Railway wheel impact load detector thresholds

At the time of the occurrence, in northern Ontario, CP required a car to be bad-orderedFootnote 42 immediately (BOI) for measured wheel impacts of 130 kips or greater, or for calculated wheel impacts of 150 kips or greater. For the remainder of the CP system, the WILD guidelines required a car to be BOI for measured wheel impacts of 140 kips or greater or calculated wheel impacts of 170 kips or greater. When cars meeting these criteria were identified, the train speed was reduced, and the car was set off at the next designated location for repair.

For calculated impacts of 100 kips or greater, CP required the car to be bad-ordered when empty. This requirement allowed the car to proceed to its destination with no restrictions and to be repaired once it was empty. If the car was already empty, it was directed to a repair facility where the wheel set was changed.

For calculated impacts of between 90 and 110 kips,Footnote 43 CP had a number of opportunistic threshold limits (OP1 to OP4). In these cases, CP flagged the car in its car information management system but did not bad-order the car. The car could then proceed to its destination without restrictions and could be repaired when operationally convenient. However, the car could also return to service without removal of the subject wheel set.

CP's WILD thresholds had been established primarily by industry practice and to manage the volume of wheels removed for WILD impacts. CP had not specifically conducted engineering analysis of WILD data to support the WILD removal thresholds contained in its guidelines. CP had no formal company instructions that require train crews to reduce speed through a WILD site.

1.20 Wheel impacts recorded before the derailment

Just before arriving in Thunder Bay, train 118 had traversed a WILD, where the 15th car from the head end recorded an actual impact of 99.4 kips on the south rail, which was in excess of the AAR condemning limit of 90 kips.

In the 24 hours before the derailment, 10 other trains had traversed a WILD in the vicinity of the derailment. Of these trains, 4 eastbound and 2 westbound CP trains had recorded elevated WILD impact readings on the south rail (Appendix C).

Summaries of the WILD results are presented in Table 2 and Table 3.

Table 2. Summary of calculated impact readings* on the south rail at the White River wheel impact load detector for eastbound Canadian Pacific Railway trains on 13 January 2015 (before the occurrence)
Train Time at which train was over the detector Number of impacts
90—110 kips 110–130 kips 130–150 kips (reading) Over 150 kips (reading)
112-09 0445 9 2 1 (137.2) 0
100-13 0826 2 1 0 0
422-12 1215 7 3 1 (149.1)
1 (133.7)
1 (183.0 on car GATX 62831)
118-09 1241 12 2 0 0
Total 30 8 3 1
*   Because reduced train speeds are reduced through the CP White River WILD site, all WILD impact readings are calculated values to enable comparison.

Train 422-12, which originated in Thunder Bay, was stopped once the readings were received from the WILD detector in White River. Car GATX 62831 recorded a calculated WILD reading of 183.0 kips, which was condemnable under CP BOI criteria. The wheel set was removed from train 422-12, and the suspect wheel set was replaced in White River.

In this occurrence, the previous trains had traversed the White River WILD at reduced speed of about 25 mph. A review of the weather information indicated that only train 112-09 (2445 on 12 January 2015) had a temperature-reduced slow order of 35 mph in place; no speed restrictions were required for the other trains, which would have been able to traverse the area of the derailment at track speed.

Table 3. Summary of calculated impact readings on the south rail at the Thunder Bay wheel impact load detector for westbound Canadian Pacific Railway trains on 13 January 2015 (before the occurrence)
Train Time at which train was over the detector Number of impacts
90—110 kips 110–130 kips 130–150 kips Over 150 kips
421-11 1523 1 0 0 0
119-11 1650 2 1 0 0
Total 3 1 0 0

1.21 TSB Laboratory examinations

The TSB Laboratory examined the broken south rail and insulated joint removed from the area of the suspected initial point of derailment. Sections of the 2 tank cars that released product (PROX 36178 and GATX 200483) were also examined to determine the adequacy of the protection provided.

1.21.1 Examination of broken rail and insulated joint

The south rail had broken into several pieces, commencing from the east end of an insulated rail joint located just east of the Dublin east siding switch. The west end rail within the joint remained intact. Not all of the fractured rail pieces were recovered, and only 3 of the original 6 joint bolts were located. The joint was part of the main track turnout assembly that led to the Dublin east siding.

It was determined that

Photo 2. Bolt shank wear
Bolt shank wear
Photo 3. Worn insulation joint bars
Worn insulation joint bars
Figure 4. Bolt hole fractures. Arrows indicate direction of crack propagation. Placement of brown construction paper is representative of tie spacing. The bolt hole that is the origin of primary Fracture A is located near the edge of a tie.
Bolt hole fractures

1.21.2 Examination of tank cars PROX 36178 and GATX 200483

PROX 36178 was a pressure tank car built in December 2011 to the U.S. DOT and TC specification 112J340W. GATX 200483 was a pressure tank car built in November 2003 to the DOT specification 112J340W. General requirements applicable to DOT-112 tank cars can be found in TC's Containers for Transport of Dangerous Goods by Rail, a Transport Canada Standard (TP 14877E) and the DOT Code of Federal Regulations (CFR) 49 CFR 173. The 2 standards are similar, and these tank cars met both standards.

PROX 36178 and GATX 200483 had full head shields and were jacketed and insulated. The venting, loading, and discharge valves were protected by a protective housing bolted to the manway cover. A pressure relief valve, with a start-to-discharge pressure of 280.5 pounds per square inch gauge (psig), was located inside the protective housing. The tank car heads and shell were made of AAR TC128 Grade B normalized steel with a minimum thickness of 9/16 ( 0.562) inch. The steel used to construct pressure tank cars ordered after 01 August 2005 must also meet a Charpy impact test requirement.

A total of 6 pressure tank cars were examined in the field. GATX 200483 had sustained a head puncture. On the 5 remaining tank cars, the head shields had been pushed back toward the tank. Two of these head shields had deep dents that extended into the heads, but none of the tank heads or shells on the 5 other cars had been breached. The tank-head puncture resistance system fitted to these pressure tank cars generally performed as intended.

1.21.2.1 Tank car PROX 36178

The top of tank car PROX 36178 had an impact in the area of the protective housing. The housing was designed to protect pressure tank car appurtenances such as the valves used to load and off-load the car, a safety vent valve, a gauging device, and a thermo-well. It was determined that

Photo 4. PROX 36178 protective housing and cover
PROX 36178 protective housing and cover
Figure 5. Photograph taken after removing the tank jacket to expose the weld joining the manway nozzle reinforcement to the tank. Note tank deformation near the leak location.
Photograph taken after removing the tank jacket to expose the weld joining the manway nozzle reinforcement to the tank
1.21.2.2 Tank car GATX 200483

The A end of GATX 200483 had an impact puncture that resulted in the loss of its entire load of propane. It was determined that

Photo 5. Puncture to tank GATX 200483
Puncture to tank GATX 200483

1.21.3 TSB laboratory reports

The following TSB laboratory reports were completed in support of this investigation:

2.0 Analysis

Neither the condition of train 118 rolling stock, nor the manner in which train 118 was operated, contributed to the derailment. The analysis will focus on rail bolt hole failures within rail joints, track inspections, elevated wheel impacts, post-accident site assessments, and pressure tank car crashworthiness.

2.1 The accident

The first marks observed on the track leading to the derailment area coincided with an insulated joint at Mile 42.0 of the Nipigon Subdivision, where the south rail within the joint was broken. A fresh impact mark observed on the tread of one of the wheels of the 4th car from the head end of train 118 indicated that the wheel likely contacted a piece of broken rail within the joint, further fragmenting the rail. The accident occurred when the broken south rail, located within the joint at Mile 42.0, further failed catastrophically beneath the head end of train 118, resulting in the derailment of the 11th to 31st freight cars.

2.2 Rail failure within the insulated joint

Indications of joint movement were observed on the bolt shanks, at the corresponding bolt holes, and at the top of the gauge side joint bar, where the insulating polyurethane rubber coating of the bar had been worn through. The polyurethane insulation was worn on the inboard side of the joint bars, which was in contact with the rail. The insulation had deteriorated primarily on the east half of both bars, but more significantly on the gauge side bar. The wear observed in the insulated joint components of the south rail was consistent with the east end of the joint having been loose for an extended period of time.

The rail failure originated at a bolt hole crack within the insulated joint, near the bottom of the eastern-most bolt hole in the south rail, and extended diagonally downward and westward from the bolt hole through the base of the rail. Post-failure damage on the primary fracture surface indicated that the fracture had existed for some period of time before the derailment.

2.3 Joint support and loose joint condition

Loose joint conditions and excessive joint deflection often occur in areas where joint support (ballast) has deteriorated and requires restoration. The 2 Canadian Pacific Railway (CP) track geometry tests conducted before the derailment recorded S22 defect values of 0.705 inch (August 2014) and 0.847 inch (November 2014) at the joint location. Both values exceeded the CP priority defect criteria of 0.625 inch and indicated that the condition of the joint had deteriorated between August 2014 and November 2014. The support of the joint had likely deteriorated further between November 2014 and the day of the occurrence (13 January 2015).

Priority S22 defects are expected to be monitored and repaired as soon as practicable. However, the S22 defect is a CP company threshold and not a Rules Respecting Track Safety (TSR) defect. As CP has no assigned near-urgent or urgent value for a S22 defect, it remains a priority defect that must be monitored. In this occurrence, the S22 priority defect was monitored, but the rail within the joint failed before restoration of the joint support. The deteriorated joint permitted excessive deflection at the east end of the joint, caused the polyurethane on the insulated joint bars to wear, and allowed the joint to become loose over time.

Without adequate support, the loose condition of the joint changed the stress distribution of the joint and overstressed the rail. As the joint loosened, the shear stress in the rail caused by the bending moment from the force of a wheel and by the impact of the advancing wheel on the joint was concentrated at the bolts and bolt holes, initiating the primary east bolt hole crack.

2.4 Wheel impacts and broken rail

In continuous welded rail (CWR) territory, severe cold temperatures cause rail to contract, which places the rail in tension. Rail steel is known to have reduced fracture toughness and ductility at low temperatures, particularly if a rail flaw, such as a bolt hole crack, is present or emerging. Wheels producing high-impact loads can cause damage to equipment (such as wheels, axles, bearings, and journals) and to the track infrastructure, often in the form of broken rails. When a rail flaw is present, it acts as a stress raiser, making the rail even more susceptible to brittle failure due to rail pull-apart or high wheel impacts.

A review of the recorded data from the wheel impact load detector (WILD) determined that at least 46 elevated wheel impacts had occurred on the south rail before the accident. Of these 46 calculated wheel impacts

The precise impact that caused the rail to fail within the joint could not be determined. While the recorded impacts were all calculated, the data indicated that the south rail in the area of the joint had sustained multiple elevated wheel impacts in the 24 hours preceding the accident. Given these conditions, it is likely that the rail failure within the joint propagated from the bolt hole crack as a result of 1 or more elevated wheel impacts imparted on the south rail in the area of the joint before the arrival of train 118. The cold temperature at the time of the accident made the rail more susceptible to brittle failure.

2.5 Inspections

The track in the area of the derailment was inspected in accordance with regulatory and company requirements. A review of the inspections determined the following:

Despite the regular inspections that were conducted, the loose condition of the joint and the emerging bolt hole crack were not detected. The location of the primary rail base fracture within the joint bars made visual detection of the fracture difficult, especially in the winter months with snow covering the rail base.

2.6 Prevention of bolt hole cracks

One of the most common modes of rail failure is due to a fracture originating from a bolt hole crack within a rail joint. Cracks originating from the bolt holes in the web of the rail can develop for various reasons and can lead to rail failure. Loose or poorly supported joints can accelerate the initiation of a crack owing to the stresses within the joint when a train travels over it. Within a joint, a bolt hole crack can remain undetected and in place for an extended period of time until the rail is replaced or fails in service.

Alternative rail joint assembly processes have been developed to reduce the potential for rail bolt hole cracks to develop. Split sleeve cold expansion is one such process that can be performed in the field and adds little time to the assembly of the joint. Rail joint bolt holes are mechanically expanded after the hole is drilled. The expansion is accomplished by hydraulically pulling an oversized, tapered mandrel through an internally pre-lubricated split sleeve in the hole. Studies and trials have demonstrated that the split sleeve cold expansion process induces residual compressive stresses around rail-end bolt holes and reduces the likelihood of cracking by allowing the joint assembly to operate at higher stress levels.

2.7 Site assessment

Response to an emergency involving dangerous goods (DG) requires a thorough site assessment to ensure that all of the hazards associated with the emergency are identified and appropriate steps are taken to minimize the risk of harm to persons and the environment. Propane is an odourless, colourless gas that forms explosive mixtures when mixed with air. Propane is also often scented with the odorant ethyl mercaptan to make it easier to identify in the event of a leak. The hazards associated with a propane release are significant.

During the response to a rail occurrence involving large volumes of propane, the following activities are normally carried out:

2.7.1 Personal protective equipment and sources of ignition

In this occurrence, DG tank car PROX 36178 was leaking odourized propane. DG tank car GATX 200483 lost its entire load of odourized propane, but this was not discovered until the day after the derailment.

Within 25 minutes of the derailment, sufficient information to determine that this was a serious derailment had been provided to the rail traffic controller (RTC). The information provided included the first and last cars derailed, the location of the derailed DG tank cars, identification of the cars that had rolled down the embankment, and the fact that propane was leaking. However, the RTC continued to request further information from the crew, including which tank cars were derailed, which cars were leaking, and whether the cars were in the creek. Early in the response, the RTC specified that managers were waiting for information, so the conductor continued to gather information from the site for over an hour.

The potential for rapid asphyxiation in the event of a large leak was not mitigated, as the conductor was working in the derailment area without the specified PPE for a prolonged period of time. The conductor spent considerable time in and around the derailment site seeking information on the location and state of the derailed cars. The conductor was ultimately transported to hospital suffering from respiratory irritation about 2 hours after the derailment. Respiratory irritation is listed as one of the risks of exposure to propane.

The gas-powered switch heater for the Dublin east siding switch was not identified as a source of ignition until the CP police officer arrived on site. Other possible sources of ignition, which included the head-end locomotive and the use of crew portable radios that were not intrinsically safe, were not addressed until long after the derailment had occurred.

The conductor did try to minimize exposure to the hazards by taking steps such as staying upwind and avoiding low-lying areas. However, the conductor was not equipped with SCBA, air-quality monitoring devices, product-detection devices or an intrinsically safe radio and was not aware that some of the propane was non-odourized. Furthermore, the conductor was not trained in assessing DG tank car damage or the potential for a subsequent release of product. While the conductor sustained minor injuries associated with exposure to and inhalation of propane, the outcome could have been worse.

In this occurrence, CP training, procedures, and guidelines were insufficient to protect the conductor from the hazards associated with the derailment and release of a large volume of propane while performing a detailed site assessment. Following a derailment in which a large volume of flammable gas may be present, if a train crew is unaware of potential sources of ignition and accesses a derailment site without intrinsically safe electronic devices and appropriate PPE, there is an increased risk of fire due to ignition and of health issues due to inhalation of the flammable gas.

2.7.2 Job briefing following a derailment

Responding to a derailment involving DGs is a high-stress, infrequent event for train crews. Research has shown that when teams initiate a novel task in extreme conditions, they tend to be conservative in their approach and focus on rules or formalized procedures. As a result, procedures that specifically require crews to pause, consult appropriate guidance material, and conduct a thorough job briefing that indicates how the hazards associated with the situation will be mitigated are critical to ensuring a reasoned response. Although CP's Train and Engine Safety Rule Book specify that job briefings should be conducted as the situation changes, there is no specific requirement, content, or guidance provided for a job briefing following a derailment. Consequently, following the derailment, no job briefing was conducted by the crew, nor was one specifically required by CP. If railways do not provide guidance detailing requirements for a job briefing following a derailment, hazards associated with the derailment may not be identified, increasing the risk of crew exposure or injury during a response.

2.7.3 Understanding scope of authority to make decisions on site

Research has shown that, under stressful conditions, low-status members of a team may hesitate to take action and will defer to others. This can result in subordinates being hesitant to question authority in emergency situations. In the railway hierarchy, a train crew will normally regard the RTC or an operations manager as the “proper authority.”

CP's General Operating Instructions (GOI) clearly state that “[i]f the locomotives are not directly involved in the accident, the train should be cut as close as safely possible and cars removed a safe distance.” However, this is only one of a number of instructions, and it is not emphasized that it should be the first course of action when DGs are involved. If a company does not have clear instructions and/or procedures on the safest course of action for a crew to take immediately when DGs are involved in a derailment, there is an increased risk of injury to the crew.

In this occurrence, the train crew requested permission from the RTC on 2 occasions to move the head end of the train away from the derailment site. The first request was made 35 minutes after the derailment and the second, 42 minutes after the first request. In each instance, the RTC instructed the train crew to stand by while management was consulted. The RTC further requested the train crew to remain at the derailment site, unless they felt it was unsafe to do so. In each case, the locomotive engineer deferred the decision to the RTC and remained close to the derailment site. The conductor also respected this authority and continued the site assessment as requested by the RTC. This authority was reinforced when the RTC indicated that managers were waiting for the site assessment information.

The locomotive engineer was experienced and did not require permission from the RTC to move the head end of the train away from the derailment site. In comparison, the conductor had only 4 years of experience, and this was the first derailment in which the conductor was involved. Regardless of experience, the events indicated that neither train crew member was clear on the scope of their authority. As a result, decisions were deferred to the RTC, who provided direction, rather than deferring the authority back to the train crew. If the authority of the crew to take actions in the interest of safety is not clearly communicated before and during an occurrence, safety-related decisions may not be taken at the appropriate level to reduce the associated risks.

2.8 Timely decision to seek medical attention

In the event of an injury, timely attention from emergency medical services can be critical. In this occurrence, the conductor first indicated to the RTC that he was suffering from the effects of propane inhalation at 1236. At that time and again at 1310, the RTC asked whether the conductor required an ambulance. Despite being exposed to propane and not feeling well, the conductor declined emergency medical assistance on both occasions. It was not until the locomotive engineer intervened at 1322 that medical attention was requested for the conductor.

RTC procedures in the event of an occurrence involving DGs are strictly limited to gathering information related to the derailment. The importance of providing this information is also emphasized in company DG training provided to train crews. There is no requirement for an RTC to consult, or to be aware of, the guidance provided in the 2012 Emergency Response Guidebook for the products involved in a derailment. Consequently, in this occurrence, the RTC continually requested the train crew to obtain additional information, without an appreciation of the hazards associated with the products involved or the PPE that was required for train crew members to remain at the site.

The Emergency Response Guidebook indicates that first aid for an individual exposed to propane, including moving the victim to fresh air and contacting emergency medical services. However, the RTC did not have access to this information and left the decision to the discretion of the conductor. This led to a considerable period of time elapsing between when the conductor first reported symptoms and then received medical attention.

The decision on whether emergency medical services were required was left to the conductor, who had already sustained exposure to the propane and was working in a stressful situation. Given that propane inhalation is a serious health risk that can also affect cognitive abilities, the conductor was not in an objective position to be able to make this determination at that time. Despite the conductor's repeated exposure to the propane, medical assistance was not specifically requested until the locomotive engineer intervened about 2 hours later. When coordinating an emergency response involving DGs, if RTCs do not have access to information describing potential health effects of the products involved and if the decision to request emergency medical assistance is deferred to those who have already been exposed to DGs, there is an increased risk that medical services will not be obtained in a timely manner.

2.9 Tank cars

Conditions such as train make-up, train speed, and terrain are all factors that contribute to the performance of tank cars when subjected to impact forces generated during a derailment. In this occurrence, 6 pressure tank cars were examined in the field. The head shields of 5 of the 6 tank cars had been pushed back toward the tank. Two head shields had deep dents that extended into the heads, but none of the 5 tank heads or shells was breached. Each of these 5 cars also had had significant impacts without a loss of product. In these cases, the head shields and other appliances provided proper protection. These 5 pressure tank cars generally performed as intended.

With regard to DG tank car PROX 36178, the head shield and shell remained intact. As none of the top fittings were breached, the protective housing performed as intended. However, the joint between the manway nozzle and protective housing assembly leaked product. An impact sustained during the derailment pushed the protective housing/manway nozzle assembly down into the tank, caused significant inward deformation of the shell, and crushed a portion of the gasket between the manway nozzle and protective housing assembly, which permitted the release of product.

DG tank car GATX 200483 lost its entire load due to an A-end head puncture. The car materials met the chemical and tensile requirements for AAR TC128 Grade B steel. No metallurgical anomalies were observed that might have contributed to the initiation of the puncture. Although this car was not required to meet impact energy absorption requirements, Charpy V-notch test results indicated that the tank car material met the requirements for improved puncture resistance. Despite this improved puncture resistance, tank car GATX 200483 lost its entire load when the A-end of the car sustained a significant localized head impact puncture during the derailment.

Although 5 of the 6 pressure tank cars generally performed as intended, this derailment demonstrated that even a DOT-112 pressure tank car with improved design can be vulnerable to loss of containment when exposed to high-impact forces and localized sharp-object impact punctures.

3.0 Findings

3.1 Findings as to causes and contributing factors

  1. The accident occurred when the broken south rail, located within the joint at Mile 42.0, further failed catastrophically beneath the head end of train 118, resulting in the derailment of the 11th to 31st freight cars.
  2. The rail failure originated at a bolt hole crack within the insulated joint, near the bottom of the eastern-most bolt hole in the south rail, and extended diagonally downward and westward from the bolt hole through the base of the rail.
  3. The deteriorated joint permitted excessive deflection at the east end of the joint, caused the polyurethane on the insulated joint bars to wear, and allowed the joint to become loose over time.
  4. As the joint loosened, the shear stress in the rail caused by the bending moment from the force of a wheel and by the impact of the advancing wheel on the joint was concentrated at the bolts and bolt holes, initiating the primary east bolt hole crack.
  5. It is likely that the rail failure within the joint propagated from the bolt hole crack as a result of 1 or more elevated wheel impacts imparted on the south rail in the area of the joint before the arrival of train 118.
  6. The cold temperature at the time of the accident made the rail more susceptible to brittle failure.
  7. Despite the regular inspections that were conducted, the loose condition of the joint and the emerging bolt hole crack were not detected.
  8. The location of the primary rail base fracture within the joint bars made visual detection of the fracture difficult, especially in the winter months with snow covering the rail base.
  9. Canadian Pacific Railway training, procedures, and guidelines were insufficient to protect the conductor from the hazards associated with the derailment and release of a large volume of propane while performing a detailed site assessment.
  10. Despite the conductor's repeated exposure to the propane, medical assistance was not specifically requested until the locomotive engineer intervened about 2 hours later.
  11. An impact sustained during the derailment pushed the protective housing/manway nozzle assembly of tank car PROX 36178 down into the tank, caused significant deformation of the shell, and crushed a portion of the gasket between the manway nozzle and protective housing assembly, which permitted the release of product.
  12. Tank car GATX 200483 lost its entire load when the A end of the car sustained a significant localized head impact puncture during the derailment.

3.2 Findings as to risk

  1. Following a derailment in which a large volume of flammable gas may be present, if a train crew is unaware of potential sources of ignition and accesses a derailment site without intrinsically safe electronic devices and appropriate personal protective equipment, there is an increased risk of fire due to ignition and of health issues due to inhalation of the flammable gas.
  2. If railways do not provide guidance detailing requirements for a job briefing following a derailment, hazards associated with the derailment may not be identified, increasing the risk of crew exposure or injury during a response.
  3. If a company does not have clear instructions and/or procedures on the safest course of action for a crew to take immediately when dangerous goods are involved in a derailment, there is an increased risk of injury to the crew.
  4. If the authority of the crew to take actions in the interest of safety is not clearly communicated before and during an occurrence, safety-related decisions may not be taken at the appropriate level to reduce the associated risks.
  5. When coordinating an emergency response involving dangerous goods, if rail traffic controllers do not have access to information describing potential health effects of the products involved and if the decision to request emergency medical assistance is deferred to those who have already been exposed to dangerous goods, there is an increased risk that medical services will not be obtained in a timely manner.

3.3 Other findings

  1. The split sleeve cold expansion process induces residual compressive stresses around rail-end bolt holes and reduces the likelihood of cracking by allowing the joint assembly to operate at higher stress levels.
  2. Although 5 of the 6 pressure tank cars generally performed as intended, this derailment demonstrated that even a DOT-112 pressure tank car with improved design can be vulnerable to loss of containment when exposed to high-impact forces and localized sharp-object impact punctures.

4.0 Safety action

The TSB is unaware of any safety action that has been implemented with regard to this occurrence.

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on . It was officially released on 31 August 2016.

Appendices

Appendix A – 2012 Emergency Response Guidebook – Guide 115

The following information (in part) for Liquefied petroleum gas/propane is listed as Guide 115 in the 2012 Emergency Response Guidebook (ERG):

Name of Material

Liquefied petroleum gas/Propane

ERG 2012 GUIDE 115

GASES - FLAMMABLE (Including Refrigerated Liquids)

POTENTIAL HAZARDS

FIRE OR EXPLOSION

HEALTH

PUBLIC SAFETY

PROTECTIVE CLOTHING

EVACUATION

Large Spill

Fire

EMERGENCY RESPONSE

FIRE

CAUTION: Hydrogen (UN1049), Deuterium (UN1957) and Hydrogen, refrigerated liquid (UN1966) burn with an invisible flame. Hydrogen and Methane mixture, compressed (UN2034) may burn with an invisible flame.

Small Fire

Large Fire

Fire involving Tanks

SPILL OR LEAK

CAUTION: When in contact with refrigerated/cryogenic liquids, many materials become brittle and are likely to break without warning.

FIRST AID

Appendix B – Other TSB investigations involving wheel impact/broken rail derailments

R99H0010 – On 30 December 1999, Canadian National Railway (CN) freight train U-783-21-30 was travelling westward on the north track of the Saint-Hyacinthe Subdivision. At Mile 50.84, near Mont-Saint-Hilaire, Quebec, the train derailed and cars fouled the adjacent south main track. At about the same time, CN freight train M-306-31-30 was travelling eastward on the south track and collided with the cars of train U-783-21-30 that had just derailed. Two crew members on train M-306-31-30 were fatally injured.

The investigation determined that the combination of low ambient temperatures and wheel impact loads that were below CN company wheel impact load detector (WILD) threshold limits was sufficient to initiate rail failure at an existing pre-crack.

R01H0005 – On 12 March 2001, at approximately 0230 Eastern Standard Time, Canadian Pacific Railway (CP) train 301-043, proceeding westward at about 40 mph, derailed 14 cars at Mile 85.0 of the Ottawa Valley Railway North Bay Subdivision, near Bonfield, Ontario. The investigation determined that a broken rail had caused the derailment. The rail failure had resulted from stresses generated by the impact loading from wheel R1 of car CPWX 601303, combined with tensile thermal stresses due to the low ambient temperature.

R02E0114 – At 0055 Mountain Standard Time on 04 December 2002, eastward CP freight train 614–046 derailed 42 loaded non-pressure tank cars of molten sulphur at Mile 11.8 of the Taber Subdivision, near Bullshead, Alberta. Ten tank cars were breached and released product, which caught fire. About 20 people were evacuated from the area nearby. There were no injuries.

The investigation determined that the derailment was likely caused by a sudden break on the north rail under the train. A loaded potash car with flat wheels on the previous train over the point of derailment had likely generated sufficient wheel impact to have broken the rail. The cold ambient temperature made the rail less ductile and prone to failure.

R03T0030 – On 23 January 2003, while travelling at 34 mph, CP freight train 213–22 derailed 29 cars at Mile 78.2 of the White River Subdivision. The temperature at the time was −20° C. The investigation determined that impacts from a broken wheel had broken the south rail and caused the derailment. Two days earlier, the same wheel had recorded an impact of 99 kips while travelling at a speed of 30 mph. This impact force was above the Association of American Railroads' (AAR) Rule 41 condemning limit of 90 kips, but below CP's WILD removal thresholds. No maintenance action had been initiated for the wheel set after the impact measurement.

R03T0064 – On 13 February 2003, CP freight train 938–12 was proceeding southward at 42.5 mph when it derailed 21 cars at Mile 39.5 of the Parry Sound Subdivision near Nobel, Ontario. The investigation determined that wheel impacts from a previous train, which were greater than the AAR Rule 41 condemning limit of 90 kips but below CP's threshold of 140 kips, likely initiated a brittle fracture from the root of a pre-crack through the base of the rail, facilitating the final catastrophic rail failure.

R14W0041 – On 15 February 2014, CP freight train 490-15 was proceeding eastward at 42 mph on the Minnedosa Subdivision when a train-initiated emergency brake application occurred and the train came to a stop. Subsequent inspection determined that 27 covered hopper cars loaded with potash and grain had derailed in the vicinity of the Keyes siding located at Mile 43.10 near Gladstone, Manitoba. The investigation determined that the rail had failed catastrophically in brittle mode likely as a result of a high wheel impact imparted on the rail by a condemnable 6-inch-long slid flat wheel tread under the passage of CP freight train 298-15, approximately 6 hours earlier.

Appendix C – Wheel impact load detector data from previous trains

Selected data from Canadian Pacific Railway (CP) trains' recorded wheel impacts on the south rail for eastbound trains at White River wheel impact load detector (WILD)
Train Speed (mph) Axle number Actual WILD impact (kips) Calculated WILD impact (kips)
112-09 23.3 103 70.7 110.5
  23.6 117 77.4 125.0
  23.7 123 70.4 109.1
  23.8 124 62.0 93.1
  24.0 138 60.9 97.8
  24.6 165 58.2 99.1
  24.7 172 66.0 98.2
  25.3 199 60.3 95.6
  27.4 326 85.5 137.2
  27.4 327 61.8 92.6
  27.6 345 64.2 104.3
  27.7 413 69.0 109.5
100-10 33.0 155 67.7 91.0
  33.2 163 87.1 120.5
  36.8 353 79.3 100.7
422-12 22.4 8 67.3 107.7
  22.5 10 62.2 96.8
  22.6 13 63.2 96.7
  23.0 28 62.9 94.7
  23.2 41 57.4 113.9
  23.9 95 64.4 98.1
  25.0 141 78.5 123.1
  25.0 142 92.2 149.1
  25.8 179 67.6 98.1
  25.8 180 62.2 90.4
  26.0 186 76.5 118.2
  27.0 236 86.1 133.7
  27.0 237 113.6 183.0 (on tank car GATX)
118-09 24.2 19 61.6 94.1
  24.4 44 72.1 114.6
  24.5 59 68.4 108.9
  24.7 77 63.3 93.5
  24.7 79 70.2 107.7
  24.9 99 65.4 92.9
  24.9 101 74.9 111.5
  25.0 107 72.0 109.3
  25.1 121 64.1 97.0
  25.1 122 60.7 90.4
  25.4 142 69.9 107.3
  25.5 153 71.0 104.4
  27.0 247 68.0 102.4
  28.6 438 67.3 91.8
Summary of previous CP trains' recorded wheel impacts on the south rail for westbound trains at Thunder Bay WILD
Train Speed (mph) Axle number Actual WILD impact (kips) Calculated WILD impact (kips)
421-11 47.0 370 92.4 96.1
119-11 43.8 90 88.1 97.1
  44.0 185 107.9 117.6
  43.9 191 95.1 104.8