CTLA Presentation

View document in PDF

You need a PDF reader to access this file. Find out more on our help page.

Faye Ackermans
Member, Transportation Safety Board of Canada
Halifax, Nova Scotia, September 26, 2014

Check against delivery.

Slide 1: Title page

 

Slide 2: Outline

My presentation today will look at a number of areas:

  • About the TSB
  • What happened the night of July 6, 2013?
  • TSB recommendations
  • What needs to change?
  • Conclusions

Slide 3: About the TSB

The TSB is an independent government agency. Our mandate is to advance safety by conducting independent investigations into four federally regulated modes of transportation: marine, pipeline, rail, and air.

To that end, we conduct independent investigations, identify safety deficiencies, identify causes and contributing factors, make recommendations, and make our reports public.

It is also important to note that it is not the function of the TSB to assign fault or determine civil or criminal liability.

Slide 4: TSB offices

We have 8 regional offices from coast to coast, in addition to our head office and Lab in the national capital region.

We receive thousands of notifications of accidents and incidents each year. We review each one and decide whether to deploy and then whether to carry out an investigation. Once an investigation is complete, the investigation report is released publicly. In 2013-14, we released 69 investigation reports: 13 marine, 2 pipeline, 12 rail, and 42 air.

Slide 5: The accident

Early on the morning of July 6, 2013, an MMA train carrying 7.7 million litres of petroleum crude oil in 72 DOT class 111 tank cars, derailed in the town of Lac-Mégantic, Quebec. 63 tank cars derailed. Almost all of these were damaged, and many had large breaches. About six million litres of petroleum crude oil were quickly released—described as a 4 foot wave of oil. A fire began almost immediately, and the ensuing blaze and explosions left 47 people dead. Another 2000 people were forced from their homes, and much of the downtown core was destroyed.

When you first look at an accident, there’s a tendency to focus only on the basic facts: what happened? But our investigations must also look at the context. We need to find out why things happened, so that we can take steps to ensure they don’t happen again.

In the Lac-Mégantic investigation, that context starts with the railway itself, MMA: Montreal, Maine and Atlantic.

Slide 6: MMA territory

MMA began operating in 2003 between Bangor, Maine and Farnham, Quebec. For many years, its trains primarily transported dry goods and travelled this route about 2 to 3 times a week. In 2009, MMA began hauling crude oil. In June 2012, shipments increased and about 1 train a day—only some of which were unit trains of oil—departed Farnham to be parked in Nantes for the night.

On 05 July 2013, the MMA train left Farnham around 1355. The train was operated only by a locomotive engineer, who was positioned in the lead locomotive. During the trip, the engineer reported mechanical difficulties with the lead locomotive, which affected the train’s ability to maintain speed.

The train arrived in Nantes around 2250, and the engineer parked the train on a descending grade on the main track, as was the normal practice.

Slide 7: Train securement in Nantes

This image is a screen capture from an animation, which I’ll play shortly.

To park the train, the engineer applied hand brakes on all 5 locomotives and 2 other cars and left the lead locomotive running with the locomotive air brakes applied. He then contacted the rail traffic controller in Farnham to inform him that the train had been secured.

The engineer then contacted the rail traffic controller in Bangor, who controls movements for the crews east of Lac-Mégantic. During this conversation, the engineer indicated that the lead locomotive had experienced mechanical difficulties throughout the trip, and that excessive black and white smoke was now coming from its smoke stack. Since they expected the condition would settle on its own, it was mutually agreed to leave the train as it was and to deal with the situation the next morning.

Shortly after the engineer left, the Nantes Fire Department responded to an emergency call reporting a fire in the train. To extinguish the fire, the firefighters shut off the locomotive's fuel supply and moved the electrical breakers inside the cab to the off position, effectively shutting down the locomotive.  These actions were in keeping with railway practices. In the meantime, an MMA employee, a track foreman, was dispatched to the scene. This person, however, had no experience with locomotive operations.

Once the fire had been put out, the firefighters and the MMA employee discussed the train's condition with the rail traffic controller in Farnham, and then departed.

Slide 8: Brakes

There were two brake systems that were used on this train: hand brakes and locomotive air brakes.

Locomotive air brakes, called independent brakes, are supplied with air from compressors located on each locomotive, and when applied, act like a parking brake.

Hand brakes are mechanical brakes applied by turning a wheel on each car and locomotive. A person must walk to each car or locomotive to apply the hand brakes.

The braking force supplied by a hand brake varies. It depends on several factors, such as the force exerted by the engineer, the condition of the brakes, and weather conditions.

When a train is left unattended, it is imperative to test the effectiveness of the hand brakes that have been applied. This test is performed by releasing all air brakes to confirm that the hand brakes alone provide sufficient force to prevent the train from moving. If the train moves during the test, additional hand brakes must be applied and the test repeated until the train is properly retained by hand brakes alone.

Slide 9: Why did the train run away?

On the night in question, the locomotive's air brakes remained fully applied during the test. The train was therefore being held by a combination of hand and air brakes. This gave the false impression that the 7 hand brakes alone were holding the train.

Since no other locomotive was running, when the lead locomotive was shut down to extinguish the fire, the compressor was no longer providing air pressure to the air brake system. As air in the train’s brake system slowly began to leak, the reservoirs were slowly depleted, which gradually reduced the retarding force of the locomotive’s brakes.

Just before 1 a.m., the air pressure dropped to a point at which the combined force of the locomotive's air and hand brakes could no longer hold the train, and it began to roll downhill toward Lac-Mégantic, just over 7 miles away.

Slide 10: Path of the train

As it moved down the grade, the train picked up speed, reaching a top speed of 65 mph and derailing at about 1:15 a.m. near the centre of town.

The TSB has concluded that, a minimum of 17 and possibly as many as 26 hand brakes would have been needed to immobilize the train that night, depending on the force with which they had been applied.

Slide 11: animation

Here’s a short animation putting it all together and explaining how the train ran away that night. Run time is about 3 minutes.

Slide 12: Why was there so much damage?

The investigation concluded that the high speed of the train in the curve caused the train to derail. The condition of the track was not causal.

As I said earlier, almost every tank car that derailed was breached, some in multiple areas, including shells, heads, top and bottom fittings, and pressure relief devices. About one-third of the derailed tank car shells suffered large breaches. This meant that about 6 million litres of highly volatile petroleum crude oil was quickly released. The petroleum ignited, creating large fireballs.

In addition, the petroleum crude oil in the tank cars was more volatile than described on the shipping documents.

If petroleum crude oil is not tested systematically and frequently, there is a risk of it being improperly classified. The movement of these improperly classified dangerous goods increases the risk to people, property and the environment.  That is why the TSB issued a safety advisory letter calling for changes.

Slide 13: Tank cars

The 72 tank cars were all DOT Class 111 cars manufactured between 1980 and 2012.They all met requirements in effect at the time they were built, but they were lacking additional protection designed to minimize consequences of an accident—such as a jacket, a full-height head shield or thermal protection.

Enhanced safety features could have reduced the damage to the tank cars. This is why the TSB called for tougher standards for tank cars carrying flammable liquids.

Slide 14: How could this have happened?

The investigation addressed numerous issues to determine what happened. However, before speaking about these issues, I would like to explain a term that will often come up: Safety Management Systems, or SMS.

Each railway company must manage its operational risks. An SMS is a formal, documented process required by Transport Canada’s regulation. SMS is effectively overlayed on top of all other regulatory requirements. SMS requires management to think about and anticipate what might go wrong and to  develop and execute a plan to reduce the impact of potential problems. For example, what kind of dangers could result from a railway company changing the type of goods it transports—from, say, canola oil to crude oil? What actions must be taken to address the dangers and reduce the risks? Basically, a good SMS identifies problems before they occur.

Safety culture at MMA

An SMS relies on a good safety culture. And an organization that has a good safety culture is proactive with respect to addressing the potential dangers. It anticipates risks and implements risk reduction practices. By contrast, MMA had a rather reactive approach:

  • It chose to restrict train speed instead of improving the condition of the track.
  • With track speeds reduced, trains could not travel as far, so the company chose to park trains in a particular location. But the company did not fully assess the risks of leaving trains carrying crude oil unattended, on a main track with a downhill grade, and with no other precaution taken to prevent them from rolling away uncontrolled other than the assumed correct application of hand brakes.
  • Employee training, recertification, and monitoring were not effectively implemented.
  • What was done in practice often did not comply with operating instructions.
  • Shortcuts were taken when performing maintenance work.

For example, 8 months before the accident, a non-standard repair was performed on the engine of the lead locomotive using an epoxy-like material that lacked the required strength and durability. Eventually, this material deteriorated and oil began to accumulate in the turbocharger. The night of the accident, this oil overheated and ignited. This caused the fire on the locomotive.

MMA had a weak safety culture, a culture in which dangerous conditions and practices went unrecognized. This posed a serious threat to the safety of its operations. MMA did not implement SMS as intended by the regulator.  In 2002, MMA met requirements by developing a safety management system (on paper), but this system was not implemented until 2010, when Transport Canada conducted an audit. It was still not fully functional in 2013.

Transport Canada’s oversight

Several years ago, Transport Canada’s Quebec Regional Office identified MMA as a high risk company which was to be subjected to more frequent inspections. Further to such inspections, MMA reported that these problems had been corrected, and yet the same problems were often detected during subsequent Transport Canada inspections. These problems included train securement, employee training, and the condition of the track. However, Transport Canada's Regional Office did not always ensure that MMA adequately resolved the problems. Furthermore, it did not verify MMA's safety management system before 2010, despite the fact that inspections clearly indicated that the system was not functioning.

Transport Canada's headquarters in Ottawa did not effectively monitor the activities of the Regional Office. It was therefore not aware of weaknesses in the monitoring of regional railway companies in Quebec, and did not intervene.

Slide 15: Findings as to cause and contributing factors

Investigations conducted by the TSB are complex—an accident is never caused by just one factor. The report identifies 18 distinct causes and contributing factors, many of them influencing one another.

You can see they cover six broad areas: the locomotive, tank cars, Transport Canada, derailment, train securement, and MMA.

Slide 16: TSB recommendations

In January 2014, the TSB made 3 recommendations aimed at addressing systemic safety issues that posed a significant risk. Three months later, we followed up to assess the action that had been taken by government and industry. In August 2014, the TSB made two additional recommendations. All five of these are presented here on screen.

Slide 17: “This must never happen again”

One very common sentiment to emerge from a tragedy such as this is that it must never be allowed to happen again. That’s admirable—and it’s possible. But it will require work, and the combined efforts of:

  • Transport Canada
  • railway companies
  • shippers
  • tank car manufacturers, and
  • refineries in Canada and the United States

Slide 18: What needs to change? The entire way we look at blame.

I said earlier that the TSB does not assign blame or determine civil or criminal liability. That’s part of our DNA, if you will. It’s written into our act. And it’s there for a reason. Because pointing the finger doesn’t advance safety, and it doesn’t prevent another accident from happening.

MMA was not alone in the way it viewed safety. For the most part, its primary defence was to rely on its employees to follow the rules. Lots of companies think the same way: If everybody follows the rules, then nothing will go wrong. Right?

Complex systems, though, require more than just a reliance on rules. Experience has taught us that even the most motivated and well-trained employees make mistakes. And when that inevitably happens, a robust safety system needs to have defences in depth—layers of protection, if you will. That’s the focus of one of our new Lac-Mégantic recommendations: Canadian railways must put in place additional physical defences to prevent runaways.

Because if you really want to advance safety, then you need to go beyond pointing to a rule, and then punishing someone when it’s broken. You need to look at things from many angles, such as:

  • Are the rules clear, understood and followed?
  • Is there monitoring of  how the rules are used in practice?
  • Is there adequate evaluation of risks introduced by changes in operations?
  • What is the tolerance for risk in a company or in an industry?

In any transportation system, rules are necessary to assure safe operations, but rules alone are not sufficient to prevent accidents. The safety culture of an organization needs to create the systems and practices to identify and mitigate unacceptable levels of risk.

Slide 19: Conclusions

The tragedy in Lac-Mégantic was not caused by one single person, action, or process. There were 18 causes and contributing factors. Complex systems require more than just relying on rules-compliance; they need defences in depth. To address the safety issues, a concerted effort will be required from the regulators, the railways, shippers, tank car manufacturers, and refiners in Canada and the United States.

The TSB will continue to monitor the five recommendations, and to report publicly on any progress—or lack of progress—until all the safety deficiencies have been adequately addressed.

Slide 20: Picture of Lac-Mégantic aftermath

 

Slide 21: Questions?

 

Slide 22: Canada wordmark