Railway Investigation Report R15H0005

On 13 January 2015, at 1118 Eastern Standard Time, Canadian Pacific Railway freight train 118-10 was proceeding eastward on the Nipigon Subdivision at about 35 mph when it experienced a train-initiated emergency brake application at Mile 42.0 near Dublin, Ontario. Subsequent inspection determined that 21 cars had derailed. The derailed equipment included 7 dangerous goods tank cars loaded with propane (UN 1075, liquefied petroleum gas). As a result of the derailment, 1 tank car lost its entire load and another tank car released product. One crew member sustained minor inhalation injuries.

Le présent rapport est également disponible en français.

On 13 January 2015 at about 0710,^{Footnote 1} Canadian Pacific Railway (CP) freight train 118-10 (train 118) departed Thunder Bay, Ontario, proceeding eastward on the Nipigon Subdivision, destined for Montréal, Quebec. The train was not a key train.^{Footnote 2} Upon departure, the train received a pull-by inspection with no exceptions noted. Train 118 consisted of 1 head-end locomotive, 1 mid-train (remote) locomotive and 76 loaded cars. It weighed 9226 tons and was 8018 feet long. The train crew consisted of a locomotive engineer and a conductor; both were qualified for their positions, were familiar with the territory, and met fitness and rest requirements. Between Thunder Bay (Mile 132.90) and Dublin, Ontario (Mile 42.60), the train traversed 4 hot bearing detectors (HBD), and no exceptions were noted.

1.1 The accident

As train 118 approached the Dublin east siding switch (Mile 42.00), it passed westbound CP freight 113-11 (train 113), which was stationary in the siding.

At 1118, while travelling at about 35 mph over the Dublin east siding switch (Figure 1), train 118 experienced a train-initiated emergency brake application. The crew did not feel any track anomalies before the emergency brake application. Once train 118 came to rest, the crew made an emergency radio broadcast, and the conductor inspected the train. The inspection determined that the 11th to the 31st cars—which were all loaded cars—had derailed on the main track just east of the Dublin east siding switch. The derailment occurred in an area located just south of and adjacent to the Trans-Canada Highway. The derailed equipment included 7 dangerous goods (DG) tank cars loaded with propane (UN 1075). Because of the remote location, an evacuation was not necessary, but the highway was closed for about 15 hours. The conductor sustained minor inhalation injuries.

1.2 Weather

At 1100 on 13 January 2015, the HBD at Mile 59.0 broadcast an ambient temperature of approximately −23 °C. In the 24 hours before the derailment, the lowest temperature recorded at the weather station at Nipigon, Ontario, (21 miles west of Dublin) was −29.5 °C.

1.3 Summary of events

Table 1 provides a summary of the events, which were compiled from a number of sources, including the locomotive event recorder,^{Footnote 3} rail traffic control records, and radio transmissions. Following the accident, the in-charge manager requested information from the crew through the rail traffic controller (RTC), who relayed the questions to the crew and provided information back to the manager.

During the derailment site follow-up, communications between the conductor and the RTC were made using a standard railway crew portable radio. Railway crew portable radios are not intrinsically safe.^{Footnote 4}

1.4 Site examination

The first derailment marks observed on the track were at a poly-insulated rail joint (the joint) on the south rail at Mile 42.0, just east of the Dublin east siding switch. The joint was part of the Dublin east siding turnout assembly. Both joint bars and the rail extending to the west were intact. However, only a portion of the rail extending toward the east remained between the joint bars. The rail had fractured within the joint, and several pieces were scattered in the vicinity of the joint. The remainder of the south rail east of the joint was destroyed for approximately 250 feet. The north rail had remained intact; only minor derailment damage was observed. The joint containing the remaining rail was removed and forwarded to the TSB Laboratory for detailed examination.

The lead locomotive came to rest at Mile 41.56 with 17 cars still attached. The first 10 cars did not derail. The R4 wheel on the 4th car from the head end, PROX 035435, exhibited damage on its tread consistent with that of a heavy rail impact against a fractured rail (Photo 1).

The 21 derailed cars (11th to 31st cars) came to rest in various positions.

The 11th to the 17th car were derailed in the upright position along the track bed. Although these 7 cars sustained minor damage, no existing mechanical defects that would have contributed to the derailment were observed.

The 18th to 20th cars were DG tank cars loaded with propane. They came to rest parallel to the track bed at the bottom of the embankment south of the track. These cars displayed damage from the impact but did not release product.

The 21st to 31st cars came to rest on the south embankment of the track. The cars were jackknifed and on their sides in a pile, which extended from about 80 feet to 225 feet east of the joint (Figure 2).

• The 21st car (PROX 36178), a DG tank car loaded with odourized propane, came to rest down an embankment, on its side. The car was the first to jackknife. The top of the car had experienced an impact in the area of the manway: it was dented around the manway reinforcement pad, and the shell of the tank at the manway was deformed. The manway nozzle was pushed down into the tank. The cover of the protective housing was deformed, and the manway gasket was damaged. Product had been released from the car. A portion of the tank car—containing the manway, jacket, reinforcement, and tank shell—was removed from PROX 36178 and forwarded to the TSB Laboratory for detailed examination.
• The 22nd car, a loaded covered hopper car, was directly beside and against the 21st car.
• The 25th car (GATX 200481), a DG tank car loaded with propane, had experienced an impact, but remained intact.
• The 26th car (GATX 200483), a DG tank car loaded with odourized propane, came to rest down an embankment, on its side. The car was impacted on the A-end and sustained a head puncture at the upper right edge of the tank head. The puncture was about 30 cm long by 60 cm high. A crack approximately 30 cm long extended downward from the bottom left corner of the puncture.
  • This tank car lost its entire load. Because of the orientation of the car when it came to rest, with the A-end among other cars at the bottom of an embankment, the puncture and loss of product were not discovered until the day after the accident.
  • A tank coupon containing the puncture and representative portions of the surrounding head and shell materials was cut out from tank car GATX 200483 and forwarded to the TSB Laboratory for detailed examination.
• The 31st car, DTTX 646929, was upright, with both trucks derailed, south of the track and was still attached to the tail end portion of the train.
• The first non-derailed car, the 32nd car, came to rest with its leading wheel set stopped on the rail at the west end of the broken joint bar.

1.5 Train documentation

The train documentation provided to the conductor included compressed waybills for all DG cars. Although DG tank car PROX 36178 was loaded with odourized propane, a “Non-Odorized” stencil was applied to each side of the car. The compressed waybill for the car did not indicate that the tank car was loaded with odourized propane, nor was it required to so indicate.

Transport Canada's (TC) Transportation of Dangerous Goods (TDG) Regulations set forth requirements for the shipment of DGs. Section 3.5 Information on a Shipping Document states (in part):

(1)  The following information must be included on a shipping document:

1. the name and address of the place of business in Canada of the consignor;
2. the date the shipping document or an electronic copy of it was prepared or was first given to a carrier;
3. the description of each of the dangerous goods, in the following order:
   1. the UN number,
   2. the shipping name and, immediately after the shipping name unless it is already part of it,

1. for dangerous goods that are subject to special provision 16, the technical name, in parentheses, of at least one of the most dangerous substances that predominantly contributes to the hazard or hazards posed by the dangerous goods, and
2. for a liquefied petroleum gas that has not been odorized, the words “Not Odourized” or “Not Odorized” or “Sans odorisant”.

1.6 Subdivision and track information

CP's Nipigon Subdivision consists of a single main track that extends from Schreiber, Ontario (Mile 0.0), westward to Thunder Bay, Ontario (Mile 132.9). Train movements on the subdivision are governed by the centralized traffic control (CTC) system, as authorized by the Canadian Rail Operating Rules (CROR) and controlled by an RTC located in Calgary, Alberta.

In 2014, total traffic on the Nipigon Subdivision was 31 million gross tons (MGT),^{Footnote 5} including almost 74 000 cars loaded with DGs, of which over 50 000 were tank cars. The Nipigon Subdivision was classified as a key route.^{Footnote 6}

In the vicinity of the derailment, the track was rated as Class 4, according to the TC–approved Rules Respecting Track Safety, also known as the Track Safety Rules (TSR). The authorized speed for freight trains in the area was 50 mph.

The track in the vicinity of the derailment was tangent. The track structure consisted of 115-pound continuous welded rail (CWR) manufactured by Sydney Steel in 2004. The rail was laid in 2005 and was in good condition. The rail was set into double-shouldered tie plates, secured to No. 1 hardwood ties with 5 spikes per plate, and box-anchored every other tie. The tie cribs were full, and the ballast shoulders ranged from 12 to 24 inches beyond the ends of the ties.

At Mile 42.0, immediately east of the Dublin east siding switch, there were 2 poly-insulated joints adjacent to each other on the north and south rails. The east siding switch was equipped with a propane-fueled switch heater. Switch heaters are remotely activated heating devices that use a burner to melt snow and ice so that the switch can be used in cold weather.

1.7 Roles and responsibilities of the train crew and rail traffic controller

A conductor is in charge of managing a train, the contents on a train, and the related documentation. CP's conductor training manual indicates that, in the event of an emergency, it is the conductor's responsibility to assure the safety of a train, other trains, tracks, crew members, and the public while complying with proper procedures applicable to CROR as well as with the company's rules, policies, and general operating instructions (GOI).

In this occurrence, the conductor had started CP's conductor training program in February 2011 and had qualified to work as a conductor in July 2011. The conductor had requalified in May 2012 and again in December 2014.^{Footnote 7} This accident was the first time the conductor had been involved in a large derailment.

A locomotive engineer, who is responsible for the safe operation of a train, operates the locomotive in accordance with the CROR and the company GOI. The locomotive engineer is expected to remain in the cab or close to the locomotive in most instances. In this occurrence, the locomotive engineer had over 37 years of service: he had been promoted to the position in 1981, after working as a brakeman and a conductor.

An RTC is responsible for the safe and efficient operation of the railway within an assigned operating territory. The RTC coordinates trains and other on-track railway movements from the rail traffic control centre. In this occurrence, the RTC had started working for CP in 1997 and had about 13 years' experience as an RTC.

1.8 Canadian Pacific Railway emergency response procedures

1.8.1 Crew

While on duty, all operating employees must have a copy of the company CROR rules and GOI manuals for quick reference. General rule A(iv) of the CROR states (in part) that employees must “communicate by the quickest available means to the proper authority any condition which may affect the safe operation of a movement.” The proper authority is defined in the CROR as “the rail traffic controller or the appropriate railway supervisor.”

In addition to rules and instruction manuals, operating employees must carry the Emergency Response Guidebook, which provides crews with information on DGs and instructions for responding to emergencies involving DGs. In this occurrence, both crew members had these books in their possession. During the initial conductor training and requalification training at CP, the rules and instructions with respect to responding to DG incidents/accidents were emphasized and tested.

With respect to derailments, CP's Train and Engine Safety Rule Book includes, as a core safety rule, “approach an emergency or a derailment site only when it has been determined that it is safe to do so.”^{Footnote 8} This rule book does not specify how, or by whom, this determination is to be made.

CP's GOI describes the steps for the crew to follow in assessing the hazards associated with DGs following an incident/accident. Following a visual inspection of the incident (from the locomotive cab, if possible), the crew is instructed to

• identify the DGs involved using the train consist and waybills; and
• use the Emergency Response Guidebook, supplemented with notes in the train documentation, to identify appropriate protective actions.^{Footnote 9}

If the DG hazard does not preclude approaching the derailed cars, the operating employees are instructed to conduct an assessment of site hazards, including physical, chemical, electrical, and other hazards.^{Footnote 10} The GOI advises employees to

• keep away from hazards to avoid injury;
• avoid any unnecessary exposure to smoke or fumes; and
• keep all open flames away from the scene.

In addition, the GOI instructs employees to rescue the injured, perform first aid, and keep members of the public away from the scene. With respect to the locomotives and cars not involved in the derailment, the GOI states, “If the locomotives are not directly involved in the accident, the train should be cut as close as safely possible and cars removed a safe distance.”^{Footnote 11}

If a car is found to be leaking, the train crew is instructed to get clear of the spill or leak immediately, upwind if possible, and to avoid low-lying areas.^{Footnote 12}

The Train and Engine Safety Rule Book provides procedures for conducting job briefings. It indicates that the conductor is responsible for leading a job briefing at the beginning of any job. The job briefing is to cover

• the tasks to be performed,
• individual responsibilities, and
• any situational awareness concerns.

It is further indicated that job briefings should identify the presence of any special DG cars and that additional job briefings are to be carried out as the situation changes.^{Footnote 13} However, there is no specific format or content specified for job briefings following a derailment or when responding to an occurrence.

1.8.2 Rail traffic control

Section 14.0 of CP's Rail Traffic Control Manual outlines the RTC's responsibilities with respect to occurrences involving DGs. This manual states (in part):

When an incident occurs involving DG and the RTC is the first railway employee notified by the operating crew, the RTC must notify the Director. They will ensure that all necessary civil and railway authorities are notified and appropriate emergency equipment is sent to the scene.

When advised of an incident, the RTC must obtain, verify and record (on RTC Planning Sheet) the following information:

1. location of incident (subdivision and mileage),
2. number of cars involved and condition,
3. car initials and number,
4. weather conditions.

1.8.3 Dangerous goods training for Canadian Pacific Railway operating employees

CP's training materials on the transportation of DGs indicate that any DG leak may be hazardous. The training materials describe the primary role of the crew as providing information to the RTC. They further indicate that the crew members are to vacate the area if they suspect that there is a leak.

In CP's training materials, the following guidance is provided to train crews in the event of an emergency response involving DGs:

• Emergency Response Overview
  • Any leak of a dangerous good (regardless of product or quantity) is an extremely hazardous condition and must be handled with caution. While only specially trained Emergency Responders are permitted to work on the problem, this section describes the steps you can take to ensure the incident is handled safely and efficiently.
  • Handling an accidental release of a dangerous good involves the following steps.
    1. Securing the area.
    2. Contact designated Emergency Responder.
    3. Gather product information in preparation of emergency responders.
• Crew's Role in Emergency Response
  • At the scene of an incident, once a train crew has protected the movement, they will advise the rail traffic controller or yard supervisor of an incident, notifying the RTC about;
    • Car numbers
    • Contents
    • Emergency response telephone numbers
    • Condition of the cars.
  • The crew must communicate the condition of cars carrying DG, even if they were not involved in the incident, but are located near the cars involved. The crew is to then remain at the scene to await emergency response personnel (crew must not give shipping documents to anyone but company designated representatives).
• Site Securement
  • Because the hazards associated with DG are so varied, the first response upon discovering a leak is to assess the situation as quickly as possible. If you suspect there is a leak . . .
    • If necessary, get clear of the spill or leak immediately, upwind if possible or as far away as possible.
    • When safe to do so notify others in the area.
    • Follow company procedure before attempting to investigate further.
    • Don't try to correct the situation yourself.
    • Avoid exposure to the product.
    • Avoid low-lying areas where gas vapours can collect.
    • Refrain from smoking and eliminate open flames or sparks.
    • Keep the area clear of all personnel except Emergency Responders.^{Footnote 14}

However, CP crews were not specifically trained to

• identify potential sources of ignition (such as a switch heater, locomotive, motor vehicle and hand-held radio, camera, or cell phone that are not intrinsically safe), or
• assess damaged DG tank cars.

1.9 Propane characteristics and precautions

Propane is a compressed, odourless, flammable gas commonly used for heating, cooking, and welding. To detect the presence of the gas, ethyl mercaptan, an odorant, is often added so released gas can be easily identified. When shipped in bulk, the gas does not always have an odorant added. However, in this case, the derailed tank cars contained odourized propane.

1.9.1 2012 Emergency Response Guidebook – Guide 115

Guide 115 of the 2012 Emergency Response Guidebook^{Footnote 15} (Appendix A) identifies the potential hazards of various flammable gases, including propane, and provides guidance for emergency response and public safety. In addition, the guide outlines potential hazards and safety precautions to consider when dealing with flammable gases:

• Potential hazards associated with flammable gases include fire or explosion.

• EXTREMELY FLAMMABLE.
• Will be easily ignited by heat, sparks or flames.
• Will form explosive mixtures with air.
• Vapors from liquefied gas are initially heavier than air and spread along ground.
• Vapors may travel to source of ignition and flash back.
• Cylinders exposed to fire may vent and release flammable gas through pressure relief devices.
• Containers may explode when heated.
• Ruptured cylinders may rocket.^{Footnote 16}

• Health hazards including asphyxiation, respiratory irritation, burns and frostbite.

• Vapors may cause dizziness or asphyxiation without warning.
• Some may be irritating if inhaled at high concentrations.
• Contact with gas or liquefied gas may cause burns, severe injury and/or frostbite.
• Fire may produce irritating and/or toxic gases.^{Footnote 16}

• The precautions include the following:

• Stay upwind and remain clear of low areas.
• Eliminate possible sources of ignition.
• Evacuate personnel for a distance of 800 m (½ mile) in the event of a large spill and 1600 m (1 mile) in the event of a fire involving a rail car.
• Respiratory protection for responding to a situation involving liquefied petroleum gas is specified as positive-pressure self-contained breathing apparatus (SCBA).
• First aid for an exposed individual includes moving the victim to fresh air and contacting emergency medical services.

1.9.2 Effects of propane inhalation

A fact sheet on propane prepared by the Canadian Centre for Occupational Health and Safety provides the following information on the effects of propane inhalation:

^{Footnote 16}

The fact sheet further indicates that, in the event of difficulty breathing, the individual should be given emergency oxygen by trained personnel and that emergency medical assistance is urgently required.

1.10 Emergency response involving dangerous goods

For a railway occurrence involving propane, the initial responders are usually the train crew. Their task is to gather initial information from a safe distance. Once the first and last derailed cars are identified, the train crew should leave the area; the detailed assessment of the site should be conducted by qualified emergency responders. Qualified emergency responders can include specially trained railway personnel and fire departments.

A detailed secondary site assessment is made by qualified emergency responders from a safe distance. Once this is conducted, a detailed site entry plan is made, which includes identifying potential sources of ignition, such as a switch heater. Subsequently, responders enter with appropriate personal protective equipment (PPE), including, if necessary, positive-pressure SCBA. The responders would normally carry devices for air-quality monitoring and product detection, as well as intrinsically safe radios, cameras and/or cell phones. Electronic devices that are not intrinsically safe can be a source of ignition.

1.11 Research on emergency response

Research on how individuals and teams make decisions in high-stress situations highlights the need for clear, well-practised procedures for dealing with emergency situations. Specifically, it has been shown that, when teams initiate a novel task in extreme conditions, they tend to be conservative in their approach and focus on rules or formalized procedures.^{Footnote 17} This behaviour has been explained as follows: “individuals undergoing stress, anxiety and psychological arousal tend to increase their reliance on internal hypotheses and focus on dominant cues to emit well-learnt responses. In other words, the potential decision response to a crisis situation is to go by the book, based on learned responses.”^{Footnote 18}

Research has underscored the importance of clear lines of responsibility in dealing with emergencies. Under stressful conditions, low-status members of a team may hesitate to take action and will defer to others. This may lead subordinates to be more hesitant to question authority in emergency situations, and subordinates may not offer valuable information. One way to counter this tendency is to ensure that responsibility is diffused throughout the team rather than focused at the top of the hierarchy.^{Footnote 19}

1.12 Requirements for track inspections

Under the current TC-approved TSR and CP's Red Book of Track and Structures Requirements, a number of track inspections must be performed.

1.12.1 Visual track inspection

The TSR require the following:

Visual Track Inspection must be made on foot or by riding over the track in a vehicle at a speed that allows the person making the inspection to visually inspect and evaluate the track for compliance to the TSR.^{Footnote 20}

The speed of the vehicle must not be more than 5 mph when traversing railway crossings, turnouts or special trackwork.^{Footnote 21}

For Class 4 track, the TSR require that visual track inspection must be performed at a minimum twice per week with no more than a 3 day separation.^{Footnote 22}

Visual track inspections are usually performed by a track inspector working from a hi-rail vehicle. With regard to rail joints, an inspector would be looking for such things as loose or missing bolts, and broken or cracked joint bars. During the winter, these inspections can be more difficult, as snow can cover the rail and hide some defects. However, if trains have operated over the track between the last snowfall and the inspection, indicators such as snow that has moved away from the joint can help identify loose joints.

In this occurrence, the track in the vicinity of the derailment had been visually inspected in accordance with regulatory requirements. The last visual track inspection had been conducted on 12 January 2015, the day before the accident; no defects had been noted.

1.12.2 Joint inspection

The TSR state that

Each rail joint, insulated joint, and compromise joint must be of the proper design and dimensions for the rail on which it is applied.^{Footnote 23}

If a joint bar on Class 3 through Class 5 track is cracked, broken, or because of wear allows vertical movement of either rail when all bolts are tight, it must be replaced.^{Footnote 24}

CP requires that scheduled joint inspections be conducted on the ground to ensure a close visual inspection for defects,^{Footnote 25} and that inspectors pay particular attention to

• broken rail ends;
• cracked or broken joint bars;
• loose, broken, bent, and missing bolts;
• missing insulation or metal flow across the rail ends of insulated joints;
• poor surface at joints;
• rail end batter or mismatch that contributes to instability of the joint; and
• evidence of excessive longitudinal rail movement in or near the joint.^{Footnote 26}

In addition, CP requires that joint inspections be performed twice per calendar year, with one inspection performed between the months of January and June and the other between the months of July and December, and that consecutive inspections be separated by at least 120 calendar days.^{Footnote 27}

The last joint inspection before the occurrence was conducted on 31 October 2014; no defects were noted.

1.12.3 Turnout inspection

The TSR require that

A routine turnout and special trackwork inspection be conducted to assess general condition and identify defects on a Turnout or Special Trackwork each time they are traversed during a Visual Track Inspection.^{Footnote 28}

For Class 4 track with annual tonnage in excess of 35 MGT [million gross tons], such as the Nipigon Subdivision, a Walking Turnout and Special Trackwork inspection must be performed on foot twice monthly to assess the general condition. A Walking Turnout and Special Trackwork inspection is not required in any month that a Detailed Turnout and Special Trackwork Inspection is completed.^{Footnote 29}

Each Turnout and Special Trackwork must receive a Detailed Turnout and Special Trackwork Inspection annually. A Detailed Turnout and Special Trackwork Inspection is an inspection performed on foot to assess the condition of turnout or special trackwork.

A Detailed Turnout and Special Trackwork Inspection include the measuring and recording of the following specified items:

1. Track gauge measurements 5 to 10 feet ahead of switch points, at the heel block, at the mid-point of curved closure rail and at intervals throughout the diverging route behind the frog.
2. Guard check gauge measurement.
3. Guard face gauge measurement.
4. Switch Point Rise where contact is evident (Vertical clearance between the Switch Point and Stock Rail).
5. Heel Block assembly for surface and check bolts to confirm they are tight.
6. Cross level measurements at locations 15.5 feet apart on both routes throughout the turnout.^{Footnote 30}

As required by CP, detailed turnout inspections were performed twice per year on the Nipigon Subdivision. During these inspections, all aspects of a turnout were thoroughly inspected, including the insulated joints on each side of the turnout.

Before this occurrence, the most recent detailed turnout inspection for the Dublin east siding switch turnout had been conducted on 05 December 2014, and no defects were noted.

1.12.4 Cold weather inspection

In CWR territory, severe cold causes rail to contract, which places it in tension. At low temperatures, rail steel has reduced ductility and fracture toughness. Under these conditions, rail steel has been known to pull apart and/or fail as a result of elevated wheel impacts, particularly at locations where a rail flaw is present or emerging. To protect against derailments due to rail pull-apart or failure, railways conduct additional cold weather track inspections.

CP requires that cold weather track inspections be performed daily on main track whenever the temperature falls to −25 °C or below. During cold weather inspections, inspectors are to look for broken rails and joints due to pull-aparts.^{Footnote 31}

On 11 January 2015, because of cold temperatures and switch cleaning, a walking inspection was performed in the area of the derailment. Although no defects were noted, the track maintainer did note that the rail appeared a bit low in the area of the joint, but was within limits.

1.12.5 Track geometry inspection

The TSR set forth the minimum track geometry requirements for a given class of track. For Class 4 track, with annual tonnage of over 35 MGT, the TSR require that an electronic geometry inspection be conducted with a heavy geometry-inspection vehicle^{Footnote 32} at least twice per year.^{Footnote 33}

Track geometry inspections record parameters such as

• track gauge,^{Footnote 34}
• track alignment,^{Footnote 35}
• curve super elevation,^{Footnote 36} and
• track surface and cross level.^{Footnote 37}

Railway companies can increase the frequency of geometry inspections and develop additional internal requirements to assist with track maintenance. For the Nipigon Subdivision, CP performed 4 geometry inspections per year, which exceeded regulatory requirements.

In the vicinity of the derailment, the 2 most recent CP track geometry inspections were conducted on 19 August 2014 and on 06 November 2014. In both inspections, CP priority defect S22-SR^{Footnote 38} (S22) and some minor alignment conditions were recorded in the area of the joint. A CP S22 priority defect occurs when the measured vertical displacement or midpoint of a 22-foot cord strung along the top of the rail in Class 4 track exceeds 0.625 inch. Such conditions are commonly associated with excessive joint deflection, which can result in higher-than-usual wheel impacts and lead to rail failure. When these defects occur at rail joints, they are normally indicative of deteriorating joint support that should be restored.

The 19 August 2014 geometry inspection recorded an S22 value of 0.705 inch and the 06 November 2014 test recorded an S22 value of 0.847 inch at the same location. Both values were within standard for Class 4 track, but exceeded the CP priority defect criteria and indicated that the condition of the joint had deteriorated further between August 2014 and November 2014. CP has no near-urgent or urgent status for an S22 defect, as it is expected that it a priority S22 defect will be monitored and repaired as soon as practicable.

The location was monitored during regular track inspections.

1.12.6 Rail flaw inspection

Rail cracks within joints (that is, bolt hole cracks) can be hidden from view during a visual inspection. Rail flaw (ultrasonic/induction) testing provides an additional method of identifying cracks within rail joints.

For Class 4 track with annual tonnage of over 35 MGT, the TSR require that the rails be ultrasonically tested for internal rail flaws/cracks a minimum of 4 times annually.^{Footnote 39} For the Nipigon Subdivision, CP performed 6 rail flaw tests per year, which exceeded the regulatory requirements.

Rail flaw testing was conducted by Herzog. Rail flaw detector vehicles are equipped with an undercarriage platform that contains electromagnetic (induction) technology and 3 fluid-filled roller search unit (RSU) wheels for each rail. Each RSU contains a number of transducers that are used to detect vertical and transverse defects within the rail. Liquid couplant facilitates the transmission of ultrasonic energy from the transducers into the rail. The energy waves, reflected off discontinuities, identify flaws and cracks within the rail before the defects can lead to rail failure. Improvements have been made in rail-testing technology, including probes being added to the defect-recognition software at different angles and enhancements. Ultrasonic testing can be a reliable and economical method of rail flaw testing, but it does have some limitations.

Rail flaw testing will normally detect a bolt hole crack that is at least ½ inch long and extends more than halfway across the rail web at least 75% of the time. However, bolt hole cracks smaller than ½ inch, or those that do not extend more than halfway across the rail web, may not be consistently detected. Ultrasonic detection of a bolt hole crack can also depend on the orientation of the crack and speed of the test.

Before the occurrence, the most recent rail flaw test had been performed on 08 December 2014, and no flaws or cracks were detected in the vicinity of the derailment.

1.13 Railway signalling system

Railway signalling systems divide subdivisions into blocks. Each block displays a signal, which depends upon a flow of electricity travelling through the rail. When a train enters a block that is free of traffic, the signal entering this block will display a “clear” indication. However, if another train is occupying a block ahead, or if the electrical continuity of the rails is interrupted as a result of events such as a broken rail or an open switch, the system generates a sequence of signals informing the crew to stop the train or to reduce its speed enough for it to be able to stop within half the range of vision. This speed should not exceed 15 mph. This failsafe feature helps to protect the crew by preventing collisions and preventing train operation through areas that may contain broken rails. However, if a rail break does not separate completely, the flow of electrical current may not be interrupted, and a warning signal may not be sent.

1.14 Insulated rail joints

Insulated rail joints are used to stop the flow of electricity at the beginning and end of a block where the signals are located. In this case, the joint was equipped with 2 poly-insulated joint bars. For this type of joint, polyurethane-encapsulated joint bars are placed on each side of the rail and secured into place with bolts placed through holes in the web of the rail. An insulator is placed between the end rails (Figure 3). Insulated joints and pre-bonded plugs do not inhibit the ability of a rail flaw ultrasonic test to detect the presence of bolt hole cracks.

1.15 Bolt hole cracks

One of the most common modes of rail failure is a fracture originating from a bolt hole crack within a rail joint. Cracks originating from the bolt holes in the web of the rail can develop for a number of reasons. These cracks usually propagate at a 45-degree angle extending from a bolt hole. Loose or poorly supported joints can accelerate the initiation of a crack owing to the stresses that occur within the joint when a train travels over it. An undetected bolt hole crack can lead to a rail break. Within a joint, cracked rail can remain undetected and in place for an extended period of time until it is replaced or fails in service.

1.16 Reducing stress levels at rail joints

In 1975, the Department of Transportation (DOT) in the United States sponsored a study^{Footnote 40} to examine techniques to enhance fatigue life used in the aerospace industry and to apply them to rail bolt holes. The study demonstrated dramatic improvements to rail life by reducing bolt hole stress levels after applying a split sleeve cold expansion process. Further studies around the world have led to the use of this process in the United Kingdom, China, and the United States.

The process, which can be performed on site, involves mechanically expanding the bolt holes to the point of plastic deformation after the hole is drilled. This is accomplished by hydraulically pulling an oversized, tapered mandrel through an internally pre-lubricated split sleeve in the hole. With the use of a portable hydraulic pulling device, this process can be performed in the field and requires little additional time. A study published in 1993 concluded that

^{Footnote 41}

1.17 Impact of cold weather on track infrastructure

During cold-temperature operations, the ability of the track infrastructure to endure in‑service forces, to withstand damage, and to avoid breakage is reduced. Rail steel is known to contract and to have reduced fracture toughness and ductility when subjected to low temperatures. The rail contraction increases tensile stresses within the rail. These tensile stresses can facilitate crack initiation, particularly when stress risers, such as internal rail defects, and track appliances, such as rail joints, are present.

To manage the effects of cold weather on track infrastructure, Canadian railways typically put train speed restrictions in place during cold weather. On the Nipigon Subdivision, train speeds were limited to 35 mph when an HBD broadcast temperatures below −25 °C. During the first part of the trip from Thunder Bay, train 118 had been limited to 35 mph. However, once the HBD at Mile 59.0 had broadcast a temperature of −23 °C, the train was allowed to proceed at the permitted track speeds (that is, between 40 mph and 50 mph). Some of the previous trains through this area had been restricted to 35 mph because of the temperature.

1.18 Wheel impacts on rail infrastructure

Within the railway industry, it is recognized that wheels producing high-impact loads can cause damage to equipment (axles and journals) and to the track infrastructure. The potential for damage to infrastructure increases as the rail fracture toughness and ductility are reduced owing to cold temperatures. Canadian National Railway (CN) previously analyzed wheel-impact and broken-wheel data from 1992 to 1995. The analysis established a causal link between high wheel-impact loads and broken rails.

The TSB has investigated at least 6 other occurrences caused by broken rails that had resulted from high wheel impacts (Appendix B).

1.19 Wheel impact load detectors

Wheel impact load detectors (WILD) are a type of wayside inspection system that measures wheel impact forces resulting from wheel tread defects. The wheel impacts are measured in kips (1 kip is equal to 1000 pounds of force). The development and installation of WILD technology was an industry initiative that has enhanced rail safety by proactively identifying high-impact wheels so that they can be removed before they cause damage to rolling stock or to the track infrastructure.

WILD systems are usually installed on tangent track, where the track speed is 50 mph. The objective is to record the measured impacts at track speed. The measured wheel impact force is directly related to speed. When a wheel tread defect is present, the faster the train travels, the greater the measured wheel impact will be. Conversely, any reduction of train speed as it traverses a WILD site can reduce the measured wheel impacts.

1.19.1 Wheel impact load detector impact wheel removal criteria

Rule 41 of the 2013 Field Manual of the Association of American Railroads (AAR) Interchange Rules specifies (in part) the following criteria for wheel removal due to impact detected by WILD:

Rule 41

STEEL WHEEL DEFECTS—OWNER'S RESPONSIBILITY

1.   Condemnable at Any Time

[…]

r.   Wheel Out-of-Round or 90,000 Pounds (90 kips) or Greater Impact.

(1) Detected by a wheel impact load detector reading 90,000 pounds (90 kips) or greater for a single wheel. The detector used must meet the calibration and validation requirements of Appendix F. The detector must reliably measure peak impacts and must provide a printable record of such measurements. Device calibration records must be maintained. Wheels with condemnable slid flat spot(s) are handling line responsibility and must not be billed otherwise.

[…]

2.   Condemnable When Car Is on Shop or Repair Track for Any Reason

[…]

f.   Detected by a Wheel Impact Load Detector reading from 80 kips to less than 90 kips for a single wheel. The detector used must have been calibrated per Appendix F. The detector must reliably measure peak impact and must provide a printable record of such measurements. Device calibration records must be maintained. Wheels with condemnable slid flat spots are handling line responsibility and must not be billed otherwise. This will be considered an Opportunistic Repair for the repairing party.

The AAR Wheels, Axles, Bearings and Lubrication Committee was responsible for the development and implementation of Rule 41. Its decision to use 90 kips as the condemning limit was based on a number of technical studies that had been conducted in the early 1990s. These studies determined that a measured impact of 90 kips was a reasonable wheel-removal threshold that would limit the damage to the equipment and to the track infrastructure.

1.19.2 Railway wheel impact load detector thresholds

In addition to the AAR condemning limits for wheel impacts, railways have developed their own removal thresholds. Because these thresholds are based on the operating practices and conditions of each railway, they vary throughout the industry.

Railway WILD thresholds have evolved over time; they evaluate the measured impact and the calculated impact for a given wheel. The measured impact is the actual wheel impact force recorded at track speed, usually 50 mph. Canadian Class I railways typically adjust the measured impact value using a speed-corrected algorithm to produce a calculated impact. The algorithm is a proactive measure that takes an actual impact level, recorded at a slower speed, and estimates it using linear progression to an impact at 50 mph. This calculation allows a railway to evaluate all wheel impacts to a normalized speed of 50 mph. However, the algorithm for each railway can differ and is sensitive to wheel defect type, low-speed conversion, and assumed linearity. The calculated value is not considered as accurate as the measured value.

1.19.3 Canadian Pacific Railway wheel impact load detector thresholds

At the time of the occurrence, in northern Ontario, CP required a car to be bad-ordered^{Footnote 42} immediately (BOI) for measured wheel impacts of 130 kips or greater, or for calculated wheel impacts of 150 kips or greater. For the remainder of the CP system, the WILD guidelines required a car to be BOI for measured wheel impacts of 140 kips or greater or calculated wheel impacts of 170 kips or greater. When cars meeting these criteria were identified, the train speed was reduced, and the car was set off at the next designated location for repair.

For calculated impacts of 100 kips or greater, CP required the car to be bad-ordered when empty. This requirement allowed the car to proceed to its destination with no restrictions and to be repaired once it was empty. If the car was already empty, it was directed to a repair facility where the wheel set was changed.

For calculated impacts of between 90 and 110 kips,^{Footnote 43} CP had a number of opportunistic threshold limits (OP1 to OP4). In these cases, CP flagged the car in its car information management system but did not bad-order the car. The car could then proceed to its destination without restrictions and could be repaired when operationally convenient. However, the car could also return to service without removal of the subject wheel set.

CP's WILD thresholds had been established primarily by industry practice and to manage the volume of wheels removed for WILD impacts. CP had not specifically conducted engineering analysis of WILD data to support the WILD removal thresholds contained in its guidelines. CP had no formal company instructions that require train crews to reduce speed through a WILD site.

1.20 Wheel impacts recorded before the derailment

Just before arriving in Thunder Bay, train 118 had traversed a WILD, where the 15th car from the head end recorded an actual impact of 99.4 kips on the south rail, which was in excess of the AAR condemning limit of 90 kips.

In the 24 hours before the derailment, 10 other trains had traversed a WILD in the vicinity of the derailment. Of these trains, 4 eastbound and 2 westbound CP trains had recorded elevated WILD impact readings on the south rail (Appendix C).

Summaries of the WILD results are presented in Table 2 and Table 3.

Train 422-12, which originated in Thunder Bay, was stopped once the readings were received from the WILD detector in White River. Car GATX 62831 recorded a calculated WILD reading of 183.0 kips, which was condemnable under CP BOI criteria. The wheel set was removed from train 422-12, and the suspect wheel set was replaced in White River.

In this occurrence, the previous trains had traversed the White River WILD at reduced speed of about 25 mph. A review of the weather information indicated that only train 112-09 (2445 on 12 January 2015) had a temperature-reduced slow order of 35 mph in place; no speed restrictions were required for the other trains, which would have been able to traverse the area of the derailment at track speed.

1.21 TSB Laboratory examinations

The TSB Laboratory examined the broken south rail and insulated joint removed from the area of the suspected initial point of derailment. Sections of the 2 tank cars that released product (PROX 36178 and GATX 200483) were also examined to determine the adequacy of the protection provided.

1.21.1 Examination of broken rail and insulated joint

The south rail had broken into several pieces, commencing from the east end of an insulated rail joint located just east of the Dublin east siding switch. The west end rail within the joint remained intact. Not all of the fractured rail pieces were recovered, and only 3 of the original 6 joint bolts were located. The joint was part of the main track turnout assembly that led to the Dublin east siding.

It was determined that

• The insulated joint bars were manufactured by PORTEC.
• Measurements of rail head wear, taken about 1 m from the fracture, were within allowable limits.
• Material hardness results were representative of intermediate-strength rail.
• Indications of joint movement were observed on the bolt shanks (Photo 2). The corresponding bolt holes were fractured and, at the top of the gauge side joint bar, the insulating polyurethane rubber coating of the bar had been worn through (Photo 3).

• The insulation had deteriorated primarily on the east half of both joint bars, but more significantly on the gauge side joint bar. This was consistent with the east end of the joint having been loose for an extended period of time. A loose joint changes the stress distribution of the joint and can overstress the rail.
• The parent rail had fractured at the eastern-most bolt hole of the joint. Four fractures emanated from this bolt hole, all of which had propagated away from the bolt hole (Figure 4).

• Fracture A originated near the bottom of the eastern-most bolt hole and extended diagonally downward and westward from the bolt hole. The fracture surface of the base portion of Fracture A exhibited the most significant post-failure damage, indicating that it was likely the primary fracture, which had remained undetected. The other 3 fractures were likely secondary fractures.

1.21.2 Examination of tank cars PROX 36178 and GATX 200483

PROX 36178 was a pressure tank car built in December 2011 to the U.S. DOT and TC specification 112J340W. GATX 200483 was a pressure tank car built in November 2003 to the DOT specification 112J340W. General requirements applicable to DOT-112 tank cars can be found in TC's Containers for Transport of Dangerous Goods by Rail, a Transport Canada Standard (TP 14877E) and the DOT Code of Federal Regulations (CFR) 49 CFR 173. The 2 standards are similar, and these tank cars met both standards.

PROX 36178 and GATX 200483 had full head shields and were jacketed and insulated. The venting, loading, and discharge valves were protected by a protective housing bolted to the manway cover. A pressure relief valve, with a start-to-discharge pressure of 280.5 pounds per square inch gauge (psig), was located inside the protective housing. The tank car heads and shell were made of AAR TC128 Grade B normalized steel with a minimum thickness of 9/16 ( 0.562) inch. The steel used to construct pressure tank cars ordered after 01 August 2005 must also meet a Charpy impact test requirement.

A total of 6 pressure tank cars were examined in the field. GATX 200483 had sustained a head puncture. On the 5 remaining tank cars, the head shields had been pushed back toward the tank. Two of these head shields had deep dents that extended into the heads, but none of the tank heads or shells on the 5 other cars had been breached. The tank-head puncture resistance system fitted to these pressure tank cars generally performed as intended.

1.21.2.1 Tank car PROX 36178

The top of tank car PROX 36178 had an impact in the area of the protective housing. The housing was designed to protect pressure tank car appurtenances such as the valves used to load and off-load the car, a safety vent valve, a gauging device, and a thermo-well. It was determined that

• The cover of the protective housing was deformed (Photo 4). One of the hinges was broken and the other was cracked, so that the cover would not close properly. The interior surface of the protective housing cover was dented and gouged from contact with the internal valve hand wheels. The walls of the protective housing had no visible deformation.

• The protective housing was fastened to the manway nozzle by 20 equally spaced studs 1 1/8 inches in diameter, secured with nuts. The flatness of the protective housing and manway nozzle mating surfaces were checked, and no discrepancy was noted. The stud holes, stud threads, and nuts had no visible impact damage. There was no indication that the studs were bent or stretched.
• The manway nozzle was a standard 20 inches in diameter. The jacket was removed to expose the weld joining the manway nozzle reinforcement to the tank. No cracks were observed in this weld. The manway nozzle and its reinforcement were pushed down into the tank on the side where the leak was observed, causing significant deformation of the tank wall in this area (Figure 5).

• The protective housing and manway nozzle joint has a thin metallic gasket (approximately 1/16 inch) to prevent leakage. This gasket sits in a groove machined in the nozzle. The gasket on the subject nozzle was crushed and damaged at the leak location, and fragments of separated gasket material were pressured onto the mating joint surfaces. The remainder of the gasket remained intact.

1.21.2.2 Tank car GATX 200483

The A end of GATX 200483 had an impact puncture that resulted in the loss of its entire load of propane. It was determined that

• The fracture initiated in the A-end head to shell weld and propagated in brittle mode into the head.
• Two small ductile tears extended on either side of the puncture origin into the shell.
• The object responsible for the puncture tore through the jacket and slipped under the edge of the head shield (Photo 5). This resulted in a significant localized impact at the A-end head-to-shell weld.

• The tank car materials met the chemical and tensile requirements for AAR TC128 Grade B steel.
• The head and shell steel had fine-grained ferrite-pearlite microstructures.
  • The weld and adjacent heat-affected zone (HAZ) had a coarser grain structure and were marginally harder than the parent metal steel. This is consistent with the tank having been post-weld heat treated.
• No metallurgical anomalies were observed that could have contributed to the initiation of the puncture.
• GATX 200483 was ordered before 01 August 2005 and was therefore not subject to impact energy absorption (Charpy V-notch [CVN]) requirements for pressure tank cars.
• However, CVN test results for the tank car materials would have met AAR impact energy absorption requirements for pressure tank cars and for low-temperature service.
• At −20 °C (the temperature reported at the time of the occurrence), CVN impact testing revealed that the average impact energy absorbed by the longitudinal shell specimens was about 40% higher than that of the head or transverse shell specimens.
• While no CVN testing was conducted on the weld bead material, it is well known that a coarser grain size favours the onset of brittle fracture.

1.21.3 TSB laboratory reports

The following TSB laboratory reports were completed in support of this investigation:

• LP 020/2015 – Examination of Tank Cars
• LP 021/2015 – Examination of Broken Rail

Neither the condition of train 118 rolling stock, nor the manner in which train 118 was operated, contributed to the derailment. The analysis will focus on rail bolt hole failures within rail joints, track inspections, elevated wheel impacts, post-accident site assessments, and pressure tank car crashworthiness.

2.1 The accident

The first marks observed on the track leading to the derailment area coincided with an insulated joint at Mile 42.0 of the Nipigon Subdivision, where the south rail within the joint was broken. A fresh impact mark observed on the tread of one of the wheels of the 4th car from the head end of train 118 indicated that the wheel likely contacted a piece of broken rail within the joint, further fragmenting the rail. The accident occurred when the broken south rail, located within the joint at Mile 42.0, further failed catastrophically beneath the head end of train 118, resulting in the derailment of the 11th to 31st freight cars.

2.2 Rail failure within the insulated joint

Indications of joint movement were observed on the bolt shanks, at the corresponding bolt holes, and at the top of the gauge side joint bar, where the insulating polyurethane rubber coating of the bar had been worn through. The polyurethane insulation was worn on the inboard side of the joint bars, which was in contact with the rail. The insulation had deteriorated primarily on the east half of both bars, but more significantly on the gauge side bar. The wear observed in the insulated joint components of the south rail was consistent with the east end of the joint having been loose for an extended period of time.

The rail failure originated at a bolt hole crack within the insulated joint, near the bottom of the eastern-most bolt hole in the south rail, and extended diagonally downward and westward from the bolt hole through the base of the rail. Post-failure damage on the primary fracture surface indicated that the fracture had existed for some period of time before the derailment.

2.3 Joint support and loose joint condition

Loose joint conditions and excessive joint deflection often occur in areas where joint support (ballast) has deteriorated and requires restoration. The 2 Canadian Pacific Railway (CP) track geometry tests conducted before the derailment recorded S22 defect values of 0.705 inch (August 2014) and 0.847 inch (November 2014) at the joint location. Both values exceeded the CP priority defect criteria of 0.625 inch and indicated that the condition of the joint had deteriorated between August 2014 and November 2014. The support of the joint had likely deteriorated further between November 2014 and the day of the occurrence (13 January 2015).

Priority S22 defects are expected to be monitored and repaired as soon as practicable. However, the S22 defect is a CP company threshold and not a Rules Respecting Track Safety (TSR) defect. As CP has no assigned near-urgent or urgent value for a S22 defect, it remains a priority defect that must be monitored. In this occurrence, the S22 priority defect was monitored, but the rail within the joint failed before restoration of the joint support. The deteriorated joint permitted excessive deflection at the east end of the joint, caused the polyurethane on the insulated joint bars to wear, and allowed the joint to become loose over time.

Without adequate support, the loose condition of the joint changed the stress distribution of the joint and overstressed the rail. As the joint loosened, the shear stress in the rail caused by the bending moment from the force of a wheel and by the impact of the advancing wheel on the joint was concentrated at the bolts and bolt holes, initiating the primary east bolt hole crack.

2.4 Wheel impacts and broken rail

In continuous welded rail (CWR) territory, severe cold temperatures cause rail to contract, which places the rail in tension. Rail steel is known to have reduced fracture toughness and ductility at low temperatures, particularly if a rail flaw, such as a bolt hole crack, is present or emerging. Wheels producing high-impact loads can cause damage to equipment (such as wheels, axles, bearings, and journals) and to the track infrastructure, often in the form of broken rails. When a rail flaw is present, it acts as a stress raiser, making the rail even more susceptible to brittle failure due to rail pull-apart or high wheel impacts.

A review of the recorded data from the wheel impact load detector (WILD) determined that at least 46 elevated wheel impacts had occurred on the south rail before the accident. Of these 46 calculated wheel impacts

• 33 were between 90 and 110 kips,
• 9 were between 110 and 130 kips,
• 3 were between 130 and 150 kips, and
• 1 was in excess of 150 kips (183.0 kips).

The precise impact that caused the rail to fail within the joint could not be determined. While the recorded impacts were all calculated, the data indicated that the south rail in the area of the joint had sustained multiple elevated wheel impacts in the 24 hours preceding the accident. Given these conditions, it is likely that the rail failure within the joint propagated from the bolt hole crack as a result of 1 or more elevated wheel impacts imparted on the south rail in the area of the joint before the arrival of train 118. The cold temperature at the time of the accident made the rail more susceptible to brittle failure.

2.5 Inspections

The track in the area of the derailment was inspected in accordance with regulatory and company requirements. A review of the inspections determined the following:

• CP required that cold weather track inspections be performed daily on main track, such as the Nipigon Subdivision, whenever the temperature fell to −25°C or below. At the time of the occurrence, the recorded temperature was −23°C, so no cold weather inspection had been conducted before the passage of train 118.
• Joint inspections and detailed turnout inspections were conducted twice annually. Track inspections were conducted twice weekly.
• Track geometry inspection and rail flaw testing were conducted more frequently than required by the TSR.
  • The 2 CP track geometry tests conducted before the derailment recorded an S22 priority defect, indicating that the joint support was deteriorating, but the defect was required only to be monitored, without any remediation.
  • The most recent ultrasonic rail flaw test was performed about 1 month before the occurrence, and no flaws or cracks were detected in the vicinity of the derailment. The bolt hole crack may not have been present at the time of the test. However, even if it was present, the crack may not have been sufficiently large or oriented in a manner to be detected by rail flaw testing.
• Two days before the derailment, the track maintainer identified that the rail appeared a bit low in the area of the joint but was within limits.
• Although cracked or broken, the rail maintained enough integrity that the centralized traffic control (CTC) signal system functioned normally and did not provide any advance warning of a broken rail before the derailment.

Despite the regular inspections that were conducted, the loose condition of the joint and the emerging bolt hole crack were not detected. The location of the primary rail base fracture within the joint bars made visual detection of the fracture difficult, especially in the winter months with snow covering the rail base.

2.6 Prevention of bolt hole cracks

One of the most common modes of rail failure is due to a fracture originating from a bolt hole crack within a rail joint. Cracks originating from the bolt holes in the web of the rail can develop for various reasons and can lead to rail failure. Loose or poorly supported joints can accelerate the initiation of a crack owing to the stresses within the joint when a train travels over it. Within a joint, a bolt hole crack can remain undetected and in place for an extended period of time until the rail is replaced or fails in service.

Alternative rail joint assembly processes have been developed to reduce the potential for rail bolt hole cracks to develop. Split sleeve cold expansion is one such process that can be performed in the field and adds little time to the assembly of the joint. Rail joint bolt holes are mechanically expanded after the hole is drilled. The expansion is accomplished by hydraulically pulling an oversized, tapered mandrel through an internally pre-lubricated split sleeve in the hole. Studies and trials have demonstrated that the split sleeve cold expansion process induces residual compressive stresses around rail-end bolt holes and reduces the likelihood of cracking by allowing the joint assembly to operate at higher stress levels.

2.7 Site assessment

Response to an emergency involving dangerous goods (DG) requires a thorough site assessment to ensure that all of the hazards associated with the emergency are identified and appropriate steps are taken to minimize the risk of harm to persons and the environment. Propane is an odourless, colourless gas that forms explosive mixtures when mixed with air. Propane is also often scented with the odorant ethyl mercaptan to make it easier to identify in the event of a leak. The hazards associated with a propane release are significant.

During the response to a rail occurrence involving large volumes of propane, the following activities are normally carried out:

• The initial responders are the train crew. The crew's task is to gather initial information from a safe distance. Once the first and last cars derailed have been identified, the train crew should depart the area and leave the detailed assessment of the site to qualified emergency responders. This did not occur in this instance.
• A detailed secondary site assessment should be made by qualified emergency responders from a safe distance. Once this is done, a detailed site entry plan is made, identifying potential sources of ignition, such as a switch heater.
• Subsequently, responders enter with appropriate personal protective equipment (PPE), self-contained breathing apparatus (SCBA), as well as air-quality monitoring and product-detection devices. The work is conducted using intrinsically safe radios, cameras, and/or cell phones. Electronic devices that are not intrinsically safe are also a potential source of ignition.

2.7.1 Personal protective equipment and sources of ignition

In this occurrence, DG tank car PROX 36178 was leaking odourized propane. DG tank car GATX 200483 lost its entire load of odourized propane, but this was not discovered until the day after the derailment.

Within 25 minutes of the derailment, sufficient information to determine that this was a serious derailment had been provided to the rail traffic controller (RTC). The information provided included the first and last cars derailed, the location of the derailed DG tank cars, identification of the cars that had rolled down the embankment, and the fact that propane was leaking. However, the RTC continued to request further information from the crew, including which tank cars were derailed, which cars were leaking, and whether the cars were in the creek. Early in the response, the RTC specified that managers were waiting for information, so the conductor continued to gather information from the site for over an hour.

The potential for rapid asphyxiation in the event of a large leak was not mitigated, as the conductor was working in the derailment area without the specified PPE for a prolonged period of time. The conductor spent considerable time in and around the derailment site seeking information on the location and state of the derailed cars. The conductor was ultimately transported to hospital suffering from respiratory irritation about 2 hours after the derailment. Respiratory irritation is listed as one of the risks of exposure to propane.

The gas-powered switch heater for the Dublin east siding switch was not identified as a source of ignition until the CP police officer arrived on site. Other possible sources of ignition, which included the head-end locomotive and the use of crew portable radios that were not intrinsically safe, were not addressed until long after the derailment had occurred.

The conductor did try to minimize exposure to the hazards by taking steps such as staying upwind and avoiding low-lying areas. However, the conductor was not equipped with SCBA, air-quality monitoring devices, product-detection devices or an intrinsically safe radio and was not aware that some of the propane was non-odourized. Furthermore, the conductor was not trained in assessing DG tank car damage or the potential for a subsequent release of product. While the conductor sustained minor injuries associated with exposure to and inhalation of propane, the outcome could have been worse.

In this occurrence, CP training, procedures, and guidelines were insufficient to protect the conductor from the hazards associated with the derailment and release of a large volume of propane while performing a detailed site assessment. Following a derailment in which a large volume of flammable gas may be present, if a train crew is unaware of potential sources of ignition and accesses a derailment site without intrinsically safe electronic devices and appropriate PPE, there is an increased risk of fire due to ignition and of health issues due to inhalation of the flammable gas.

2.7.2 Job briefing following a derailment

Responding to a derailment involving DGs is a high-stress, infrequent event for train crews. Research has shown that when teams initiate a novel task in extreme conditions, they tend to be conservative in their approach and focus on rules or formalized procedures. As a result, procedures that specifically require crews to pause, consult appropriate guidance material, and conduct a thorough job briefing that indicates how the hazards associated with the situation will be mitigated are critical to ensuring a reasoned response. Although CP's Train and Engine Safety Rule Book specify that job briefings should be conducted as the situation changes, there is no specific requirement, content, or guidance provided for a job briefing following a derailment. Consequently, following the derailment, no job briefing was conducted by the crew, nor was one specifically required by CP. If railways do not provide guidance detailing requirements for a job briefing following a derailment, hazards associated with the derailment may not be identified, increasing the risk of crew exposure or injury during a response.

2.7.3 Understanding scope of authority to make decisions on site

Research has shown that, under stressful conditions, low-status members of a team may hesitate to take action and will defer to others. This can result in subordinates being hesitant to question authority in emergency situations. In the railway hierarchy, a train crew will normally regard the RTC or an operations manager as the “proper authority.”

CP's General Operating Instructions (GOI) clearly state that “[i]f the locomotives are not directly involved in the accident, the train should be cut as close as safely possible and cars removed a safe distance.” However, this is only one of a number of instructions, and it is not emphasized that it should be the first course of action when DGs are involved. If a company does not have clear instructions and/or procedures on the safest course of action for a crew to take immediately when DGs are involved in a derailment, there is an increased risk of injury to the crew.

In this occurrence, the train crew requested permission from the RTC on 2 occasions to move the head end of the train away from the derailment site. The first request was made 35 minutes after the derailment and the second, 42 minutes after the first request. In each instance, the RTC instructed the train crew to stand by while management was consulted. The RTC further requested the train crew to remain at the derailment site, unless they felt it was unsafe to do so. In each case, the locomotive engineer deferred the decision to the RTC and remained close to the derailment site. The conductor also respected this authority and continued the site assessment as requested by the RTC. This authority was reinforced when the RTC indicated that managers were waiting for the site assessment information.

The locomotive engineer was experienced and did not require permission from the RTC to move the head end of the train away from the derailment site. In comparison, the conductor had only 4 years of experience, and this was the first derailment in which the conductor was involved. Regardless of experience, the events indicated that neither train crew member was clear on the scope of their authority. As a result, decisions were deferred to the RTC, who provided direction, rather than deferring the authority back to the train crew. If the authority of the crew to take actions in the interest of safety is not clearly communicated before and during an occurrence, safety-related decisions may not be taken at the appropriate level to reduce the associated risks.

2.8 Timely decision to seek medical attention

In the event of an injury, timely attention from emergency medical services can be critical. In this occurrence, the conductor first indicated to the RTC that he was suffering from the effects of propane inhalation at 1236. At that time and again at 1310, the RTC asked whether the conductor required an ambulance. Despite being exposed to propane and not feeling well, the conductor declined emergency medical assistance on both occasions. It was not until the locomotive engineer intervened at 1322 that medical attention was requested for the conductor.

RTC procedures in the event of an occurrence involving DGs are strictly limited to gathering information related to the derailment. The importance of providing this information is also emphasized in company DG training provided to train crews. There is no requirement for an RTC to consult, or to be aware of, the guidance provided in the 2012 Emergency Response Guidebook for the products involved in a derailment. Consequently, in this occurrence, the RTC continually requested the train crew to obtain additional information, without an appreciation of the hazards associated with the products involved or the PPE that was required for train crew members to remain at the site.

The Emergency Response Guidebook indicates that first aid for an individual exposed to propane, including moving the victim to fresh air and contacting emergency medical services. However, the RTC did not have access to this information and left the decision to the discretion of the conductor. This led to a considerable period of time elapsing between when the conductor first reported symptoms and then received medical attention.

The decision on whether emergency medical services were required was left to the conductor, who had already sustained exposure to the propane and was working in a stressful situation. Given that propane inhalation is a serious health risk that can also affect cognitive abilities, the conductor was not in an objective position to be able to make this determination at that time. Despite the conductor's repeated exposure to the propane, medical assistance was not specifically requested until the locomotive engineer intervened about 2 hours later. When coordinating an emergency response involving DGs, if RTCs do not have access to information describing potential health effects of the products involved and if the decision to request emergency medical assistance is deferred to those who have already been exposed to DGs, there is an increased risk that medical services will not be obtained in a timely manner.

2.9 Tank cars

Conditions such as train make-up, train speed, and terrain are all factors that contribute to the performance of tank cars when subjected to impact forces generated during a derailment. In this occurrence, 6 pressure tank cars were examined in the field. The head shields of 5 of the 6 tank cars had been pushed back toward the tank. Two head shields had deep dents that extended into the heads, but none of the 5 tank heads or shells was breached. Each of these 5 cars also had had significant impacts without a loss of product. In these cases, the head shields and other appliances provided proper protection. These 5 pressure tank cars generally performed as intended.

With regard to DG tank car PROX 36178, the head shield and shell remained intact. As none of the top fittings were breached, the protective housing performed as intended. However, the joint between the manway nozzle and protective housing assembly leaked product. An impact sustained during the derailment pushed the protective housing/manway nozzle assembly down into the tank, caused significant inward deformation of the shell, and crushed a portion of the gasket between the manway nozzle and protective housing assembly, which permitted the release of product.

DG tank car GATX 200483 lost its entire load due to an A-end head puncture. The car materials met the chemical and tensile requirements for AAR TC128 Grade B steel. No metallurgical anomalies were observed that might have contributed to the initiation of the puncture. Although this car was not required to meet impact energy absorption requirements, Charpy V-notch test results indicated that the tank car material met the requirements for improved puncture resistance. Despite this improved puncture resistance, tank car GATX 200483 lost its entire load when the A-end of the car sustained a significant localized head impact puncture during the derailment.

Although 5 of the 6 pressure tank cars generally performed as intended, this derailment demonstrated that even a DOT-112 pressure tank car with improved design can be vulnerable to loss of containment when exposed to high-impact forces and localized sharp-object impact punctures.

3.1 Findings as to causes and contributing factors

1. The accident occurred when the broken south rail, located within the joint at Mile 42.0, further failed catastrophically beneath the head end of train 118, resulting in the derailment of the 11th to 31st freight cars.
2. The rail failure originated at a bolt hole crack within the insulated joint, near the bottom of the eastern-most bolt hole in the south rail, and extended diagonally downward and westward from the bolt hole through the base of the rail.
3. The deteriorated joint permitted excessive deflection at the east end of the joint, caused the polyurethane on the insulated joint bars to wear, and allowed the joint to become loose over time.
4. As the joint loosened, the shear stress in the rail caused by the bending moment from the force of a wheel and by the impact of the advancing wheel on the joint was concentrated at the bolts and bolt holes, initiating the primary east bolt hole crack.
5. It is likely that the rail failure within the joint propagated from the bolt hole crack as a result of 1 or more elevated wheel impacts imparted on the south rail in the area of the joint before the arrival of train 118.
6. The cold temperature at the time of the accident made the rail more susceptible to brittle failure.
7. Despite the regular inspections that were conducted, the loose condition of the joint and the emerging bolt hole crack were not detected.
8. The location of the primary rail base fracture within the joint bars made visual detection of the fracture difficult, especially in the winter months with snow covering the rail base.
9. Canadian Pacific Railway training, procedures, and guidelines were insufficient to protect the conductor from the hazards associated with the derailment and release of a large volume of propane while performing a detailed site assessment.
10. Despite the conductor's repeated exposure to the propane, medical assistance was not specifically requested until the locomotive engineer intervened about 2 hours later.
11. An impact sustained during the derailment pushed the protective housing/manway nozzle assembly of tank car PROX 36178 down into the tank, caused significant deformation of the shell, and crushed a portion of the gasket between the manway nozzle and protective housing assembly, which permitted the release of product.
12. Tank car GATX 200483 lost its entire load when the A end of the car sustained a significant localized head impact puncture during the derailment.

3.2 Findings as to risk

1. Following a derailment in which a large volume of flammable gas may be present, if a train crew is unaware of potential sources of ignition and accesses a derailment site without intrinsically safe electronic devices and appropriate personal protective equipment, there is an increased risk of fire due to ignition and of health issues due to inhalation of the flammable gas.
2. If railways do not provide guidance detailing requirements for a job briefing following a derailment, hazards associated with the derailment may not be identified, increasing the risk of crew exposure or injury during a response.
3. If a company does not have clear instructions and/or procedures on the safest course of action for a crew to take immediately when dangerous goods are involved in a derailment, there is an increased risk of injury to the crew.
4. If the authority of the crew to take actions in the interest of safety is not clearly communicated before and during an occurrence, safety-related decisions may not be taken at the appropriate level to reduce the associated risks.
5. When coordinating an emergency response involving dangerous goods, if rail traffic controllers do not have access to information describing potential health effects of the products involved and if the decision to request emergency medical assistance is deferred to those who have already been exposed to dangerous goods, there is an increased risk that medical services will not be obtained in a timely manner.

3.3 Other findings

1. The split sleeve cold expansion process induces residual compressive stresses around rail-end bolt holes and reduces the likelihood of cracking by allowing the joint assembly to operate at higher stress levels.
2. Although 5 of the 6 pressure tank cars generally performed as intended, this derailment demonstrated that even a DOT-112 pressure tank car with improved design can be vulnerable to loss of containment when exposed to high-impact forces and localized sharp-object impact punctures.

The TSB is unaware of any safety action that has been implemented with regard to this occurrence.

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on 08 June 2016. It was officially released on 31 August 2016.

Appendix A – 2012 Emergency Response Guidebook – Guide 115

The following information (in part) for Liquefied petroleum gas/propane is listed as Guide 115 in the 2012 Emergency Response Guidebook (ERG):

Name of Material

Liquefied petroleum gas/Propane

ERG 2012 GUIDE 115

GASES - FLAMMABLE (Including Refrigerated Liquids)

POTENTIAL HAZARDS

FIRE OR EXPLOSION

• EXTREMELY FLAMMABLE.
• Will be easily ignited by heat, sparks or flames.
• Will form explosive mixtures with air.
• Vapors from liquefied gas are initially heavier than air and spread along ground.
• Vapors may travel to source of ignition and flash back.
• Cylinders exposed to fire may vent and release flammable gas through pressure relief devices.
• Containers may explode when heated.
• Ruptured cylinders may rocket.

HEALTH

• Vapors may cause dizziness or asphyxiation without warning.
• Some may be irritating if inhaled at high concentrations.
• Contact with gas or liquefied gas may cause burns, severe injury and/or frostbite.
• Fire may produce irritating and/or toxic gases.

PUBLIC SAFETY

• CALL Emergency Response Telephone Number on Shipping Paper first. If Shipping Paper not available or no answer, refer to appropriate telephone number listed on the inside back cover.
• As an immediate precautionary measure, isolate spill or leak area for at least 100 meters (330 feet) in all directions.
• Keep unauthorized personnel away.
• Stay upwind.
• Many gases are heavier than air and will spread along ground and collect in low or confined areas (sewers, basements, tanks).
• Keep out of low areas.

PROTECTIVE CLOTHING

• Wear positive pressure self-contained breathing apparatus (SCBA).
• Structural firefighters' protective clothing will only provide limited protection.
• Always wear thermal protective clothing when handling refrigerated/cryogenic liquids.

EVACUATION

Large Spill

• Consider initial downwind evacuation for at least 800 meters (½ mile).

Fire

• If tank, rail car or tank truck is involved in a fire, ISOLATE for 1600 meters (1 mile) in all directions; also, consider initial evacuation for 1600 meters (1 mile) in all directions.

EMERGENCY RESPONSE

FIRE

• DO NOT EXTINGUISH A LEAKING GAS FIRE UNLESS LEAK CAN BE STOPPED.

CAUTION: Hydrogen (UN1049), Deuterium (UN1957) and Hydrogen, refrigerated liquid (UN1966) burn with an invisible flame. Hydrogen and Methane mixture, compressed (UN2034) may burn with an invisible flame.

Small Fire

• Dry chemical or CO₂.

Large Fire

• Water spray or fog.
• Move containers from fire area if you can do it without risk.

Fire involving Tanks

• Fight fire from maximum distance or use unmanned hose holders or monitor nozzles.
• Cool containers with flooding quantities of water until well after fire is out.
• Do not direct water at source of leak or safety devices; icing may occur.
• Withdraw immediately in case of rising sound from venting safety devices or discoloration of tank.
• ALWAYS stay away from tanks engulfed in fire.
• For massive fire, use unmanned hose holders or monitor nozzles; if this is impossible, withdraw from area and let fire burn.

SPILL OR LEAK

• ELIMINATE all ignition sources (no smoking, flares, sparks or flames in immediate area).
• All equipment used when handling the product must be grounded.
• Do not touch or walk through spilled material.
• Stop leak if you can do it without risk.
• If possible, turn leaking containers so that gas escapes rather than liquid.
• Use water spray to reduce vapors or divert vapor cloud drift. Avoid allowing water runoff to contact spilled material.
• Do not direct water at spill or source of leak.
• Prevent spreading of vapors through sewers, ventilation systems and confined areas.
• Isolate area until gas has dispersed.

CAUTION: When in contact with refrigerated/cryogenic liquids, many materials become brittle and are likely to break without warning.

FIRST AID

• Move victim to fresh air.
• Call 911 or emergency medical service.
• Give artificial respiration if victim is not breathing.
• Administer oxygen if breathing is difficult.
• Remove and isolate contaminated clothing and shoes.
• Clothing frozen to the skin should be thawed before being removed.
• In case of contact with liquefied gas, thaw frosted parts with lukewarm water.
• In case of burns, immediately cool affected skin for as long as possible with cold water. Do not remove clothing if adhering to skin.
• Keep victim warm and quiet.
• Ensure that medical personnel are aware of the material(s) involved and take precautions to protect themselves.

Appendix B – Other TSB investigations involving wheel impact/broken rail derailments

R99H0010 – On 30 December 1999, Canadian National Railway (CN) freight train U-783-21-30 was travelling westward on the north track of the Saint-Hyacinthe Subdivision. At Mile 50.84, near Mont-Saint-Hilaire, Quebec, the train derailed and cars fouled the adjacent south main track. At about the same time, CN freight train M-306-31-30 was travelling eastward on the south track and collided with the cars of train U-783-21-30 that had just derailed. Two crew members on train M-306-31-30 were fatally injured.

The investigation determined that the combination of low ambient temperatures and wheel impact loads that were below CN company wheel impact load detector (WILD) threshold limits was sufficient to initiate rail failure at an existing pre-crack.

R01H0005 – On 12 March 2001, at approximately 0230 Eastern Standard Time, Canadian Pacific Railway (CP) train 301-043, proceeding westward at about 40 mph, derailed 14 cars at Mile 85.0 of the Ottawa Valley Railway North Bay Subdivision, near Bonfield, Ontario. The investigation determined that a broken rail had caused the derailment. The rail failure had resulted from stresses generated by the impact loading from wheel R1 of car CPWX 601303, combined with tensile thermal stresses due to the low ambient temperature.

R02E0114 – At 0055 Mountain Standard Time on 04 December 2002, eastward CP freight train 614–046 derailed 42 loaded non-pressure tank cars of molten sulphur at Mile 11.8 of the Taber Subdivision, near Bullshead, Alberta. Ten tank cars were breached and released product, which caught fire. About 20 people were evacuated from the area nearby. There were no injuries.

The investigation determined that the derailment was likely caused by a sudden break on the north rail under the train. A loaded potash car with flat wheels on the previous train over the point of derailment had likely generated sufficient wheel impact to have broken the rail. The cold ambient temperature made the rail less ductile and prone to failure.

R03T0030 – On 23 January 2003, while travelling at 34 mph, CP freight train 213–22 derailed 29 cars at Mile 78.2 of the White River Subdivision. The temperature at the time was −20° C. The investigation determined that impacts from a broken wheel had broken the south rail and caused the derailment. Two days earlier, the same wheel had recorded an impact of 99 kips while travelling at a speed of 30 mph. This impact force was above the Association of American Railroads' (AAR) Rule 41 condemning limit of 90 kips, but below CP's WILD removal thresholds. No maintenance action had been initiated for the wheel set after the impact measurement.

R03T0064 – On 13 February 2003, CP freight train 938–12 was proceeding southward at 42.5 mph when it derailed 21 cars at Mile 39.5 of the Parry Sound Subdivision near Nobel, Ontario. The investigation determined that wheel impacts from a previous train, which were greater than the AAR Rule 41 condemning limit of 90 kips but below CP's threshold of 140 kips, likely initiated a brittle fracture from the root of a pre-crack through the base of the rail, facilitating the final catastrophic rail failure.

R14W0041 – On 15 February 2014, CP freight train 490-15 was proceeding eastward at 42 mph on the Minnedosa Subdivision when a train-initiated emergency brake application occurred and the train came to a stop. Subsequent inspection determined that 27 covered hopper cars loaded with potash and grain had derailed in the vicinity of the Keyes siding located at Mile 43.10 near Gladstone, Manitoba. The investigation determined that the rail had failed catastrophically in brittle mode likely as a result of a high wheel impact imparted on the rail by a condemnable 6-inch-long slid flat wheel tread under the passage of CP freight train 298-15, approximately 6 hours earlier.

Appendix C – Wheel impact load detector data from previous trains