Rail transportation safety investigation report R19W0050

• Table of contents

  1. Factual information
  2. Analysis
  3. Findings
  4. Safety action
  5. Appendices

Executive summary

On 16 February 2019, at about 0217 Central Standard Time, Canadian National Railway Company unit train U73451-11, consisting of 108 tank cars loaded with petroleum crude oil (UN1267, Class 3 Packing Group I) and 2 covered hopper cars loaded with sand, was proceeding eastward on the Rivers Subdivision at about 49 mph when it experienced a train-initiated emergency brake application near St. Lazare, Manitoba. A subsequent inspection determined that 37 TC/DOT Class 117R tank cars had derailed near Mile 197.47. A total of 17 of the derailed tank cars were breached, which resulted in the release of about 815 000 litres of product. About 1000 feet of track was damaged or destroyed. There was no fire, there were no injuries, and no evacuation was required.

Following the derailment, crude oil pooled near a culvert on the north side of the rail line. South of the rail line, derailed tank cars had come to rest on their sides down the embankment and a large pool of crude oil had formed south of the cars. The measures put in place to protect responders, the public and the environment, as part of emergency response and site remediation activities, were generally effective.

The investigation identified a number of safety deficiencies described below.

The accident

Canadian National Railway Company (CN) unit train U73451-11 (the train) was designated as a key train^{Footnote 1} operating on a key route.^{Footnote 2}

Video from the lead locomotive forward-facing video recorder showed that, just after the locomotive passed a battery box at Mile 197.48 of CN’s Rivers Subdivision, there was a noticeable vibration of the recorded image and a loud noise was heard. Nine seconds later, the train went into emergency as 37 Class 117R tank cars, located in the 5th to the 41st positions behind the lead locomotives, derailed.

The vibration observed on the video appeared to occur as the locomotive passed over the location of 5 consecutive joints in the south rail over a distance of about 49 feet near Mile 197.47. This was also an area where the most recent track geometry inspection had revealed that the south rail exhibited consecutive surface conditions with the largest variation being about 1 inch.

In the vicinity of Mile 197.47, among the recovered track components were the 5 joints in the south rail. The fracture surfaces of 1 set of broken joint bars (joint 1) exhibited features consistent with fatigue cracking and brittle failure.

Video evidence, the presence of impact marks observed on the south-side wheel treads of the 1st to 5th cars behind the lead locomotives, and the condition of the broken joint bars in joint 1 indicate that the accident occurred when joint 1 in the south rail failed beneath the crude oil unit train.

Joint bar repair and subsequent failure

Standard joint bars and compromise joint bars are not designed to be installed together. The base of a compromise joint bar contains a 1/8 inch offset that permits 2 rails of different size (e.g., 136 pounds and 132 pounds) to be joined together such that the rail heads match. Because compromise joint bars are offset, they are manufactured as left-hand and right-hand bars so that the offsets match when installed on the field side of a rail and gauge side of a rail to make a compromise joint. A joint assembled with mis-matched joint bar types (i.e., standard and compromise) requires extra manual effort to line up the holes and install the bolts. Such a joint is unstable, will loosen over time, and could fail prematurely.

On 31 December 2018, a CN track maintenance supervisor conducted an ad hoc track inspection and identified a broken gauge-side joint bar connecting 2 pieces of 136-pound rail in the vicinity of Mile 197.47. The joint was marked with yellow paint so it could be located by a track maintenance crew and a track maintenance crew in the area was tasked with making the repair.

CN track maintenance crews usually carry four 132/136 RE standard joint bars and four 132/136 RE compromise joint bars in each maintenance crew truck. Visually, a 132/136 RE standard joint bar and a 132/136 RE compromise joint bar look very similar with only a 1/8-inch offset in the base of the compromise joint bar to distinguish it from the standard joint bar. CN Engineering Track Standards require track maintenance crews to paint compromise joint bars blue before installing them in the track.

The track maintenance crew located the broken 132/136 RE standard joint bar on the gauge side of the south rail, removed it and replaced it with what was perceived to be an unpainted 132/136 RE standard joint bar. However, a 132/136 RE compromise joint bar was inadvertently selected and installed with the 132/136 RE standard joint bar that was already installed on the field side of the rail. The installation of a compromise joint bar with a standard joint bar left the joint 1 assembly in the south rail misaligned and unstable.

Over a 6-week period, the misalignment of joint 1 led to a loosening of the joint, which initiated fatigue cracking in the joint bars. The joint bars failed when instantaneous overstress fractures occurred from the extremities of the fatigue cracking and extended through the remaining joint bar cross-sections which could no longer withstand the normal service loads applied as the train traversed the area.

In addition, track geometry testing on 23 November 2018 showed that the south rail in the general area of the derailment contained surface conditions, one being as large as 1 inch, indicating deteriorating infrastructure support at this joint. The presence of 5 joints and associated plug rails located within a relatively short distance of 49 feet adversely affected the track modulus^{Footnote 3} in that area and led to more rapid deterioration of joint 1 when subjected to loading as trains traversed the joint.

Relationship between train speed, track maintenance, and the severity of a derailment

Similar to other major accidents involving crude oil unit trains, although the CN crude oil train was operated in accordance with Section 4 of the TC-approved Rules Respecting Key Trains and Key Routes, the train speed (49 mph) contributed to the number of cars derailed and to the overall severity of the derailment.

The National Research Council of Canada study on factors that increase the severity of derailments involving dangerous goods noted that there is a complex relationship among train speed, train length, accident cause, and other factors that influences the severity of a derailment’s outcome. While there appears to be a linear relationship between the number of cars that derail and the speed of an accident, speed is not the only factor.

Derailments caused by broken rails, rail welds or broken joint bars had a much higher occurrence rate and derailed more cars per accident for a given speed. As speed increased, these types of derailments resulted in more severe accidents compared to other accident causes. In particular, loaded unit trains (including non-key unit trains) derailed more cars and were also involved in a larger percentage of these types of accidents. All these factors were present in this accident.

While improved tank car structure design has been shown to reduce the probability of dangerous goods (DG) release and the potential severity of an accident, the risk of a tank car being punctured or breached and releasing product exists in any derailment if the speed is sufficiently high. However, improved track repair and maintenance of key routes does reduce the likelihood of all derailments, including those involving DG.

The TC-approved Rules Respecting Track Safety (TSR) establish minimum standards for track infrastructure, and some requirements in the company engineering track standards exceed the TSR requirements. However, neither the TSR nor company standards address the need for enhanced track standards for key routes despite sometimes significant increases in DG traffic volumes, as occurred on this subdivision. This suggests that the regulatory and company track maintenance requirements may not be sufficient to protect against derailments involving DG on key routes.

To reduce the frequency and mitigate the risks associated with accidents involving key trains on key routes, it is imperative that the key route track infrastructure be adequately maintained. While the survivability of tank cars transporting DG becomes important after an accident, the most effective strategy is to address the underlying causes of accidents to prevent them from occurring in the first place.

Overall performance of the Class 117R tank cars in this derailment

All the tank cars involved in this occurrence were Class 117R tank cars. These were Class 111 tank cars built to the AAR CPC-1232 standard. The cars were equipped with jackets, insulation, and full head shields, and retrofitted with modified bottom outlet valve (BOV) handle arrangements to meet the Class 117R standard. Several of these features appear to have influenced the amount of crude oil that was released as a result of the derailment.

In previous derailments, BOV handles often had moved to the open position during the derailment, which accidently released product. In this accident, there was no crude oil spilled from the BOV despite damage to the valves.

All head breaches were associated with significant deformation of the head, which suggests that they were subjected to elevated collision forces. Despite elevated collision forces, the presence of full head shields on all the derailed tank cars likely minimized the number of tank heads that breached.

Some of the energy generated during the derailment was absorbed by the collapse of tank car jackets and insulation, which also protected against shell punctures and reduced the risk of hydrostatic tank burst or rupture.

Due to the weight of the product, about 11% of the volume of these tank cars was void space (outage). When outage is higher, there is more space available for the product to take up space within the tank, in the event that the tank becomes deformed during a derailment. The 11% average outage in the loaded tank cars further reduced the risk of a hydraulic burst of the tank shells during the derailment, which minimized the amount of product released and the potential for a fire.

he ambient temperature at the time of the accident was much colder than the flash point of the crude oil, also reducing the potential for ignition. The absence of fire at this derailment site minimized additional product release, as the crude oil that remained in the tank cars did not burn and no tank cars experienced structural failure due to exposure to a pool fire or as a result of direct flame impingement.

The overall performance of the TC/DOT Class 117R tank cars was considered to be somewhat improved as compared to the legacy Class 111 tank cars and Class 111 tank cars built to the unjacketed CPC-1232 standard that have been examined in previous TSB derailment investigations involving crude oil unit trains.

Safety action taken

Transportation Safety Board of Canada

Following this accident and 2 additional serious Canadian Pacific Railway Limited crude oil unit train derailments near Guernsey, Saskatchewan, the TSB issued Rail Safety Advisories (RSA) 02/20 and 03/20 to Transport Canada (TC) on 04 March 2020.

RSA 02/20 suggested that TC should further review and modify key train speeds, as appropriate, based on various train risk profiles while also considering other factors that influence the severity of a derailment.

RSA 03/20 suggested that TC consider revising the Rules Respecting Track Safety to include enhanced track standards for key routes.

Transport Canada

Since this accident, and in response to RSA 02/20 and RSA 03/20, TC issued Ministerial Orders MO 20-05, MO 20-06, MO 20-07, and MO 20-10 instructing the industry to develop revised Rules Respecting Key Trains and Key Routes and Rules Respecting Track Safety. The revised rules were subsequently approved by TC and contain a number of safety improvements related to the operation of key trains and track infrastructure. 

Canadian National Railway Company

Since this accident, CN requires the outside surface of all compromise joint bars that are exposed when installed in track, to be spray-painted royal blue by the supplier. This allows for compromise joint bars to be more easily differentiated from standard joint bars.

Between 01 March 2019 and 31 December 2019, on the Rivers Subdivision, CN eliminated a total of 1019 temporary plug rails (2038 rail joints) and installed 192 867 feet of continuous welded rail.

1.0 Factual information

At about 1100 Mountain Standard Time, on 14 February 2019, Canadian National Railway Company (CN) unit train U73451-11 (the train) departed Bruderheim, Alberta (Mile 99.2 on the CN Vegreville Subdivision) destined for Superior, Wisconsin, United States (U.S.), via Winnipeg, Manitoba, and Fort Frances, Ontario. Prior to departure, it was inspected by a certified car inspector and received a number 1 air brake test. The train was designated as a key train^{Footnote 4} operating on a key route.^{Footnote 5}

The train consisted of 2 head-end locomotives, a tail-end locomotive, 2 covered hopper cars loaded with sand, and 108 tank cars loaded with petroleum crude oil (UN1267, Class 3 Packing Group [PG] I). One of the covered hoppers cars was located directly behind the head-end locomotives while the other was positioned in front of the tail-end locomotive. The train weighed about 15 990 tons and was about 6725 feet long.

At 2237 Central Standard Time,^{Footnote 6}on 15 February 2019, the train arrived at Melville, Saskatchewan, Mile 270.3 on the Rivers Subdivision, to change crews. The train crew—a locomotive engineer (LE), and a conductor—were both qualified for their positions, were familiar with the territory, and met fitness and rest requirements. The train departed eastward on the Rivers Subdivision at 0017 on 16 February 2019.

While en route from Bruderheim, the train had received a mechanical roll-by inspection in Saskatoon, Saskatchewan, Mile 191.9 on the CN Watrous Subdivision, and passed by several CN wayside inspection systems with no exceptions noted.

1.1 The accident

On 16 February 2019, the eastbound train was travelling on the Rivers Subdivision. The subdivision runs predominantly in an east-west direction and, as such, the rails are identified as the north rail and the south rail. Although the Rivers Subdivision is oriented in a north-south direction for a short distance in a few areas, all directional references are based on the Rivers Subdivision predominant east-west orientation.

At 0217, the eastbound train was proceeding at 49 mph ^{Footnote 7}when a loud noise was heard, which was followed by a train-initiated emergency brake application. A subsequent examination determined that 37 Class 117R tank cars, located in the 5th to 41st positions behind the lead locomotives, had derailed in the vicinity of Mile 197.47, near St. Lazare, Manitoba (Figure 1).

Petroleum crude oil (crude oil) was observed to be leaking from several tank cars and the product had begun to pool primarily on the south side of the track. There was no fire, there were no injuries, and no evacuation was required. The train crew separated the train between the 4th and 5th cars in order to clear the crossing. Following the accident, CN immediately implemented its emergency response plan

Although the temperature at the time of the accident was −27 °C, there was no cold weather slow order in place for the area of the derailment, nor was one required.

1.2 Site examination

A soil berm was constructed to prevent the released product from contaminating a nearby oxbow.^{Footnote 8}

The lead locomotive came to rest at Mile 197.13, just east of a crossing at Mile 197.18. The 5th car (VMSX 280746) and 6th car (VMSX 281616) behind the locomotives were the first 2 derailed cars. Both cars remained attached to the head end, were upright and had no visible tank damage or leaks.

Although the leading no. 4 wheel set of the 5th car remained on the rail, the R4 wheel tread on the south rail displayed an impact mark that is consistent with contacting a broken rail (Figure 2). The 3 remaining wheel sets of VMSX 280746 were derailed. Similar impact marks were observed on the south-side wheel treads of the 1st to 4th cars behind the locomotives, but no marks were observed on the wheels of the locomotives.

All wheels on the 6th car derailed. The train had separated between the 6th and 7th cars and the remaining 35 derailed tank cars (7th to 41st) came to rest in various positions along the right-of-way between Mile 197.39 and Mile 197.49 (Figure 3).

At the east end of the derailment site, the 7th to the 15th cars had rolled down the south embankment toward the frozen oxbow. Further west, the 16th to 34th cars came to rest piled up side by side on, and perpendicular to, the track structure. At the west end of the site, the 35th to 38th cars came to rest just south of the track structure whereas the 39th to 41st cars came to rest either on or just north of the track structure (Figure 4).

The 7th to the 41st tank car (35 cars) all sustained some form of impact damage during the derailment. Damage to tank shells, tank heads, bottom outlet valves (BOV), manways and protective housings resulted in 17 of the 35 cars being breached.^{Footnote 9}

Of the 17 breached tank cars, 5 lost their entire load, 10 lost part of their load, and 2 with confirmed breaches lost no measurable amount of product. The 17 cars released a total of about 815 000 litres of crude oil. The crude oil was mostly contained in a low-lying area to the south of the track structure, near the frozen oxbow.

Approaching the derailment site from the west, there were no impact marks observed on the rails or track structure.

The initial track damage was observed at about Mile 197.47 (Figure 5). A battery box was positioned about 75 feet east of the initial track damage on the south side of the track. Extending eastward from Mile 197.47, approximately 1000 feet of the track was either damaged or destroyed.

In the vicinity of Mile 197.47, pieces of the south rail, joint bars and joint bar fasteners were recovered. Among the recovered pieces of rail, there were 5 joints, all located within a distance of 49 feet. Two of the joints had broken joint bars while the remaining 3 joints were still intact. The fracture surfaces of 1 set of broken joint bars from about Mile 197.47 displayed features consistent with fatigue cracking (Figure 6). The recovered track components were sent to the TSB Engineering Laboratory in Ottawa, Ontario, for analysis.

1.3 Recorded information

1.3.1 Locomotive forward-facing video recorder

The train’s lead locomotive (CN 2994) was equipped with a forward-facing video camera. A review of the video recording showed that as the train approached a battery box at Mile 197.48, the track was intact and there was very little vibration. However, just after the locomotive passed the battery box, a noise could be heard on the recorded audio and there was a noticeable vibration of the recorded image. Nine seconds later, a red light turned on inside the locomotive cab indicating that the pneumatic control switch valve was activated and the train was in emergency. Sounds consistent with air venting from the air brake system could also be heard at the same time.

1.3.2 Locomotive event recorder

Just before the train went into emergency, it was travelling at 49 mph with the brakes released, the brake pipe pressure at the locomotive at 88 psi, and the throttle in notch 8.

At 0217:26, the train experienced a train-initiated emergency brake application at Mile 197.38. The brake pipe pressure dropped to 67 psi and the throttle was placed into notch 7.

At 0217:28, the train had slowed to 45 mph, the brake pipe pressure dropped to 0 psi and the throttle was placed in idle.

At 0218:04, the head end of the train came to rest at about Mile 197.13 after travelling about 1320 feet in emergency.

1.4 Dangerous goods

The transportation of dangerous goods (DG)^{Footnote 10} is governed by federal regulations in Canada^{Footnote 11} and in the United States.^{Footnote 12} In this occurrence, crude oil (UN1267) was being transported in each tank car. The product was listed as Class 3 flammable liquid, PG I, which is the most hazardous group in this class.

1.4.1 Class 3 flammable liquids

Class 3 flammable liquids are DG whose vapours can form an ignitable mixture with air at or below a temperature of 60. These flammable liquids can pose serious hazards due to their volatility and flammability, which are determined by the initial boiling point^{Footnote 13} and the flash point,^{Footnote 14} respectively.

Because the volatility and flammability of products within this class can vary widely, the products are grouped together based on these characteristics so that different requirements for packaging, storage, handling, and transportation can be established. According to the Transportation of Dangerous Goods Regulations, Class 3 flammable liquids are divided into 3 packing groups, ranging from PG I (highest hazard) to PG III (lowest hazard). The specific criteria for these packing groups are

• PG I, if the flammable liquid has an initial boiling point of 35 °C or less at an absolute pressure of 101.3 kPa and any flash point;
• PG II, if the flammable liquid has an initial boiling point greater than 35 °C at an absolute pressure of 101.3 kPa and a flash point less than 23 °C; and
• PG III, if the criteria for inclusion in PG I or PG II are not met.

1.4.2 Petroleum crude oil

Crude oil is a Class 3 flammable liquid and on its own has a wide range of flammability and volatility. The product is usually qualified in terms of sulphur content (low sulphur being “sweet” and high sulphur being “sour”) and density (light to heavy). The density of crude oil is described in terms of its American Petroleum Institute (API) gravity^{Footnote 15} (expressed in degrees), where a higher number indicates lower density. The thresholds defining “light,” “medium,” and “heavy” crude oil vary depending on the product’s region of origin and the organization making the determination.^{Footnote 16}

Crude oil can also vary in viscosity, which is often referred to as the thickness of a fluid. Products with low viscosity (e.g., water) flow freely, while products with high viscosity (e.g., molasses) are thicker and do not flow freely.

1.4.3 Emergency response procedures for petroleum crude oil

Guide 128 of the Emergency Response Guidebook^{Footnote 17} identifies the potential hazards of flammable liquids, including petroleum distillates and other crude oil products. Guidance is provided for emergency response and for ensuring public safety.

Under the heading “Potential Hazards,”^{Footnote 18} the guide indicates the following:

• These products are lighter than water, are highly flammable, and will be easily ignited by heat, sparks, or flames.
• The product vapours are heavier than air; they will spread along the ground and collect in low or confined areas (e.g., sewers, basements, or tanks). These vapours may form explosive mixtures with air and may travel to source of ignition and flash back.
• These products are associated with a vapour explosion hazard indoors, outdoors or in sewers, and containers may explode when heated.

Under the headings “Emergency Response”^{Footnote 19} and “Public Safety,” ^{Footnote 20} the guide indicates the following:

• Water spray, fog or regular foam should be used to fight fire, but not straight streams of water. Because these products have a very low flash point, water spray may be inefficient; it may be necessary to use vapour-suppressing foam to reduce vapours.
• An initial downwind evacuation for at least 300 metres (1000 feet) should be considered and all ignition sources must be eliminated.
• All equipment used when handling the product must be grounded.
• Responders must not touch or walk through spilled material.
• The leak should be stopped if it can be done without risk.
• Entry into waterways, sewers, basements, or confined areas should be prevented.
• Spilled product should be absorbed or covered with dry earth, sand or other non-combustible material, and transferred to containers.
• Clean, non-sparking tools should be used to collect absorbed material.

1.5 Canadian National Railway Company emergency response

CN has a detailed Emergency Response Plan. The plan sets forth the framework and procedures for CN’s operations to safely and effectively respond to all types of emergencies, including those involving DG. The plan also serves as the Emergency Response Assistance Plan (ERAP 2-0120) filed with Transport Canada (TC) and is developed in a manner to satisfy the United States Occupational Safety and Health Administration’s requirements. The plan provides the framework for emergency response for CN’s operations and was developed to achieve the following objectives:

• To prevent injuries and save lives
• To minimize environmental damage
• To minimize property damage
• To ensure and provide for the continuity of business

After the derailment, CN immediately implemented its emergency response plan and established a unified incident command system and incident command centre . The immediate emergency response to the accident focused on containing the spilled product that was visible on the ice and snow in the area of the derailment site. Multiple response contractors and consultants were mobilized and attended the site to support the emergency response.

CN police and security personnel controlled derailment access at checkpoints surrounding the perimeter of the site.

1.5.1 Emergency response and site mitigation activities

Air quality monitoring and industrial hygiene support were undertaken at the site in areas of product release and during the staging and examination of the derailed cars. The services were provided to ensure the health and safety of personnel working at the site.

Some crude oil had been released onto the north side of the rail line embankment and pooled into an adjacent road ditch and accumulated near a culvert, which was temporarily blocked with a soil berm to assist with containment. The product was generally thick and viscous.

On the south side of the rail line, where derailed cars were lying on their sides down an embankment, there were 4 or 5 paths of product extending from the cars down the embankment. A large pool of crude oil had formed south of the cars on the embankment. The initial product release was about 10 to 15 m wide and 70 m long extending down to the oxbow. There were areas where the product had melted the snow and the product became more viscous as it cooled. Additional adjacent areas were used for various initial response operations, including equipment staging, equipment decontamination, and access roadways (Figure 7).

Emergency response at the site included the following steps:

• A large containment berm was constructed across the oxbow.
• Soil samples were taken outside of the immediate area of the derailment to establish baseline concentrations for product constituents such as benzene, toluene, ethylbenzene and xylenes.
• A 3-level product recovery program was implemented that included
• the transfer of remaining product from within the derailed cars;
• the recovery of pooled product from the ground surface; and
• the mixing of stabilizing products (wood chips, sand) with pooled product on the ground to facilitate recovery by excavation.
• Recovered product, contaminated soils and debris were removed from the site for offsite disposal at approved facilities.
• Surface water sampling locations were established along the oxbow; 6 sample locations were established south of the south berm and 2 sample locations were established east of the east berm. Daily sampling was tested for select contaminants. As there was no significant variation between the test results over several days, the sampling interval was amended to weekly and yielded similar results.
• Derailed cars were offloaded, staged and examined. Seven of the tank cars were selected for more detailed examination by the TSB and were transported to the CN Transcona Yard, in Winnipeg, for inspections. The remaining cars were examined in the staging area at the site then transported for disposal.
• Following site mitigation, initial grading of the site was completed along with replacement of topsoil. Revegetation of the site was completed once seasonal temperatures permitted.
• Surface water monitoring continued until site remediation was complete, based on analytical results of water samples.

As at June 2020:

• Surface water quality was not affected by the derailment.
• There was no inflow to the Assiniboine River.
• Resampling at sediment and soil test locations showed that contaminants had naturally attenuated due to weather and biodegradation.
• Testing data indicated that the contaminants were no longer detected in the environment at most of the sample locations.

As at May 2021:

• Sediment and groundwater monitoring and sampling were completed between July and October 2020.
• Monitoring and reclamation activities planned for 2021 were put on hold due to restrictions implemented in response to the COVID-19 pandemic.

1.6 Rivers Subdivision information

The Rivers Subdivision extends from Mile 0.0 at Winnipeg, westward to Mile 280.30 at Melville, Saskatchewan. It is part of one of CN’s main traffic corridors and consists of both double- and single-track territory at various locations. Train movements on this subdivision are governed by the centralized traffic control method of train control, as authorized by the Canadian Rail Operating Rules, and are dispatched by a rail traffic controller located in Edmonton, Alberta.

Rail lines are classified in relation to the condition or maintenance level of the track. The TC-approved Rules Respecting Track Safety,also known as the Track Safety Rules (TSR), outline the classes of track and the associated maximum permitted train speeds for each class. In the area of the derailment site, the track is Class 4 with authorized track speeds of 60 mph for freight trains and 80 mph for passenger trains. The TC-approved Rules Respecting Key Trains and Key Routes, otherwise known as the Key Train Rules (KTR), further restrict key trains to a maximum speed of 50 mph on main track.

At the time of the occurrence, traffic on the Rivers Subdivision consisted of an average of 35 freight trains and 1 passenger train per day. It is one of the busiest subdivisions on the CN system and, given the annual number of carloads of DG, it meets the criteria to be designated as a key route. The annual totals for millions of gross tons per mile (MGTM), and carloads of DG traffic, which includes flammable liquids, hauled on the subdivision are listed in Table 1.

1.7 Canadian National Railway Company track information system

Railways use track mileage points, GPS-enabled track inspection vehicles and handheld devices to locate and monitor rail and track geometry defects. CN uses its mobile computer-based Track Information System (TIS) to manage track information, including rail flaws, track geometry, and inspection and maintenance records. Rail and track geometry defect GPS coordinates are entered directly into TIS.

To correlate the data records to the location of the track work, the system uses both mileage points and GPS coordinates. The mileage points are recorded to the hundredth of a mile, which is accurate to ±52.8 feet. The GPS coordinates have a greater accuracy as they are accurate to ±20 feet. The TIS information is downloaded each morning to track maintenance personnel who then locate the track defects using the GPS coordinates.

Once a defect is located and repaired, CN Engineering staff enter the information directly into TIS. This can be done from a CN work crew vehicle using an onboard computer. Among other details, the TIS stores the defect detection method, track ID, the start and end mileage points of the work, rail weight, year rolled, continuous welded rail (CWR), rail anchoring pattern, rail closure (bolted or welded), and length in feet. However, matching the GPS coordinates of the completed work with specific mileage points is not always accurate. Furthermore, rather than use the GPS system, some engineering staff will manually input mileage locations, which can introduce additional location errors. The TIS also has limitations for inputting data, so the system sometimes lacks the information required for detailed investigations.

1.8 Track information

The track in the vicinity of the derailment site is tangent single mainline. It consists of a mix of 136-pound CWR and 132-pound CWR, manufactured by various companies between 1998 and 2015. The rail was laid on 16-inch double-shoulder tie plates fixed to no. 1 hardwood ties with 5 spikes per plate, and box-anchored every second tie. The ties were in good condition. The ballast was clean crushed rock. The shoulders were about 18 inches wide, the cribs were full, and the drainage was good. Two culverts, one 5 feet and the other 7 feet in diameter, were located at Mile 197.4.

1.8.1 Track maintenance challenges on the Rivers Subdivision

Train velocity^{Footnote 21} has significant influence on the use of assets and cost control, which are fundamental elements of CN’s railway business. All engineering employees understand the sense of urgency to move trains as quickly and as safely as possible.

Train delays that affect velocity can create inter-functional pressures within the company. These pressures can sometimes create conflict between track maintenance decisions and train operations. Because of the importance of keeping trains moving, it can often be challenging for track maintenance personnel to obtain adequate track time to conduct the required track inspection, maintenance, and repairs on high traffic volume rail subdivisions such as the Rivers Subdivision. An 18% increase in rail traffic on the subdivision between 2016 and 2018 has only added to these challenges.

1.9 Transport Canada-approved Rules Respecting Key Trains and Key Routes (2016)

The KTR outline the following (in part):

[…]

5.0 KEY ROUTES

5.1 A company must conduct rail flaw inspections not less than twice annually on main track and subdivision track portions of Key Routes.

5.2 A company must conduct an electronic geometry inspection not less than twice annually on main track and subdivision track portions of Key Routes using a heavy geometry inspection vehicle. A light geometry inspection vehicle may be used in lieu of a heavy geometry inspection vehicle only as permitted in the Rules Respecting Track Safety. If a light geometry inspection vehicle is used in lieu of a heavy geometry inspection vehicle, inspections must be conducted not less than three times annually.

5.3 A company must inspect joint bars on the main track and subdivision track portions of a Key Route in continuous welded rail territory by a walking inspection or electronic inspection by means of a camera or other technology capable of detecting joint bar defects.

5.4 A company must have procedures in place for the repair of joint bars in continuous welded rail territory. When a repair is temporary, company procedures must indicate the frequency at which the repair will be inspected until it is permanently repaired.

[…]

6.0 KEY ROUTE RISK ASSESSMENTS

6.1 Companies shall conduct risk assessments and periodic updates based on significant change to determine the level of risk associated with each Key Route over which Key Trains are operated by the company. These Key Route Risk Assessments must be conducted for all Key Routes, at a minimum, every three (3) years […]^{Footnote 22}

1.10 Transport Canada-approved Rules Respecting Track Safety (2012)

For federally regulated track, the minimum regulatory requirements for track maintenance and inspection are set out in the TSR and augmented in the KTR. Where track is identified as not meeting the requirements of the TSR, the railway company must bring the track into compliance by slowing trains or repairing the track, or halt operations over that track.^{Footnote 23}

The TSR establish minimum standards for track infrastructure, but contain no provisions to enhance track standards for key routes despite sometimes significant increases in DG traffic volumes. However, nothing precludes a railway company from implementing its own practices that exceed the minimum regulatory requirements for track maintenance and inspection.

1.10.1 Visual inspection

The TSR require Class 4 track to be visually inspected twice a week. The track in the vicinity of the derailment site was inspected in accordance with regulatory requirements. The day before the derailment, the track in the vicinity of the derailment was visually inspected with no defects noted.

1.10.2 Track geometry inspection

The TSR require Class 4 track to be inspected twice a year with a heavy geometry inspection vehicle and to be maintained to the track surface limits shown in the following table.

In the vicinity of the derailment site, CN conducted track geometry testing 7 times in 2018 using a heavy geometry inspection vehicle. The most recent track geometry car inspection had been completed on 23 November 2018 with no defects detected.

However, a review of the track geometry car pengraph for the inspection revealed that in the vicinity of the derailment, the south rail exhibited consecutive surface conditions with the largest variation being about 1 inch. The surface conditions appeared to be located in the same area as the 49-foot section containing 5 joints, near Mile 197.47.

Although individually not condemnable as TSR defects, the presence of the surface conditions indicated deteriorating infrastructure support (i.e., ties, ballast, and subgrade) in an area of the south rail that contained multiple joints located over a short distance.

The review also revealed that in the vicinity of the derailment, the maximum cross-level measured was about 1 inch. The cross-level condition was not a condemnable TSR defect. However, it would affect track loading ^{Footnote 24} as trains traversed the area, which could have led to additional deterioration of the infrastructure between 23 November 2018 and 16 February 2019, the date of the accident.

1.10.3 Rail flaw inspection

The TSR require Class 4 track with greater than 35 MGTM of annual traffic to undergo ultrasonic rail flaw inspection at least 4 times per year.

In 2018, CN conducted 12 rail flaw inspections in the vicinity of the derailment site. While these tests can detect internal defects in the rail located within a joint, these tests cannot inspect the joint bars themselves. The most recent rail flaw inspection in the vicinity of the derailment site had been conducted by Sperry Rail Services (Sperry) on 23 January 2019 with no defects detected.

1.10.4 Joint bars

With regards to joint bar inspection, the TSR state (in part):^{Footnote 25}

1. (a) Each rail joint, insulated joint, and compromise joint must be of the proper design and dimensions for the rail on which it is applied.
2. (b) If a joint bar on Classes 3 through 5 track is cracked, broken, or because of wear allows vertical movement of either rail when all bolts are tight, it must be replaced.
3. (c) If a joint bar is cracked or broken between the middle two bolt holes it must be replaced.

The TSR contain no requirements governing the minimum length of plug rails or the minimum distance between consecutive joints in main track. The TSR contain no guidance with regards to track modulus^{Footnote 26} or how it may be adversely affected by multiple consecutive short plug rails and the associated joints in CWR territory.

While there is no regulatory requirement governing the use of multiple consecutive short plug rails and the associated joints in CWR, it is not considered to be a sound engineering practice.

1.11 Machine vision photographic joint bar inspection

In addition to the TSR requirements for joint bars, the KTR require companies to further inspect joint bars on the main track and subdivision track portions of a key route in CWR territory. The inspections can be conducted by either a walking inspection or electronic inspection, such as machine vision photographic joint bar inspection technology that can detect joint bar defects such as cracked or broken joint bars and joints that are missing bolts.

On some of its rail flaw inspection vehicles, Sperry has integrated machine vision photographic joint bar inspection technology with its ultrasonic rail flaw detection system. During an ultrasonic rail flaw inspection, machine vision takes high-speed/high-resolution photographs of the exposed field-side (FS) and gauge-side (GS) surface of the joint bars in each rail joint. The photographs are then reviewed by Sperry technicians, located in its U.S. offices, who look specifically for cracked joint bars, broken joint bars and missing bolts.

When a cracked or broken joint bar is identified, Sperry notifies railway maintenance crews immediately and track slow orders are applied. A joint condition report containing all suspect joint bar photographs is sent to the railway within 72 hours of the test. Only about 10% of the photographs that show a possible defect turn out to be false positives, which indicates that machine vision is an effective inspection tool.

While it is an enhancement to safety, the current machine vision photographic joint bar inspection technology has some limitations. The resolution of the photographs limits the system to the detection of obvious cracks, as fine cracks may not be visible. Furthermore, the joint bar surfaces that mate against the web of the rail, as well as the radius that transitions between the head and the web of the rail, are hidden from view and cannot be inspected using this method.

1.11.1 Machine vision photographic joint bar inspection in the vicinity of the derailment site

On 23 January 2019, joint bars in the vicinity of the derailment site were inspected by Sperry using machine vision photographic joint bar inspection technology. The records of the 5 joints in the south rail in the vicinity of Mile 197.47 were reviewed by the TSB.

All 5 joints were assembled with 6-hole joint bars that were fully bolted. Although no condemnable defects were noted, the inspection photographs revealed the following:

• The second furthest to the east was a glued insulated joint.
• Four of the 5 joints in the south rail, including the insulated joint, were assembled with ^{Footnote 27} joint bars.
• The remaining joint was the furthest west of the 5 joints and was identified as being located at Mile 197.4751 of the south rail. The joint was assembled with a 132/136 RE compromise joint bar on the GS of the rail and a 132/136 RE standard joint bar on the FS of the rail (Figure 8 and Figure 9). The rail head ends within the joint were battered and deformed.

1.12 Gauge restraint measurement system inspection

A gauge restraint measurement system (GRMS) inspection is an industry initiative. Neither the TSR nor the KTR require GRMS track inspections. A GRMS applies a lateral load to the head of both adjacent rails of the track to measure rail motion under a combined vertical and lateral load for the detection of weak ties and fasteners.

The most recent GRMS inspection in the vicinity of the derailment site had been conducted on 08 August 2018 with no defects detected.

1.13 Track modulus

Track modulus is a composite value for the individual stiffness values of the rail, fastenings, ties, tie pads, plates, ballast, sub-ballast, and subgrade. Track modulus is also influenced by the presence of joints, the quality and depth of the ballast and sub-ballast, subgrade soil and moisture conditions, tightness of tamping, and tie spacing. For example, track at bridges, tunnels, crossings, and turnouts will typically have a higher track modulus (higher stiffness) compared to the adjacent track.

As trains travel from the stiffer CWR track onto track that contains a number of consecutive short plug rails and the associated joints, greater bending forces are introduced into the jointed area due to the difference in track modulus. When such an area is subjected to high traffic volumes and heavier trains, this can lead to more rapid deterioration of the affected track structure.^{Footnote 28}

1.14 Canadian National Railway Company Engineering Track Standards

The CN Engineering Track Standards (ETS) provide the maintenance standards and practices for CN track infrastructure in conjunction with the TSR.

1.14.1 Track Standard 1.0 Rail

This section outlines the requirements for rail, including plug rail. Plug rails used in main track must not be:

1. less than 12 feet (3,658 mm) in tangent track.
2. less than 19’ 6” (5,944 mm) in curved track.

1.14.2 Track Standard 1.2 Joints

This section addresses the installation and maintenance of joints, and states in part:

1. 13. Joint bars must be inspected prior to installation for cracks or damage.

[…]

2. 15. Only the correct joint bar for the rail section will be used.

[…]

3. 25. When track panels, 39 feet long or less, are installed with three or more square joints, limit speed to Class 3.

[…]

4. 30. Compromise joints will be painted blue annually and inspected monthly.

Track maintenance crews are responsible for ensuring that compromise joint bars are painted blue at time of installation.

The CN ETS establish a minimum length for plug rails installed in CWR territory, but there is no limit on the number of multiple consecutive short plug rails and joints that can be installed.

1.14.3 Track Standard 7.0 Track Inspection Guidelines

This section outlines requirements for track inspections, and states in part (emphasis in original):

19. Each joint in CWR track found to require remedial action as outlined in TABLE 4, shall be identified in the field with a highly visible marking. Such joint will be uniquely identified by subdivision, milepost, track number and rail (Left or right as viewed in the direction of increasing milepost) for reporting.

Table 4 in this section lists the rail joint conditions requiring remedial action (i.e., cracked or broken joint bars) and the appropriate remedial action for each condition. In the field, track inspectors often use yellow paint to mark rail or other track defects, such as broken joint bars that require repair, to help responding repair crews identify the location of the defect.

1.14.4 Track Standard 7.1 Track geometry

This section outlines requirements for track geometry, and states in part:

1. 1. Track Geometry deviations are classified as URGENT, NEAR URGENT or PRIORITY.
2. a. URGENT defects are deviations which exceed either the TC Track Safety Rules or FRA [Federal Railroad Association] Track Safety Standards.

[…]

3. c. PRIORITY deviations are conditions which exceed CN recommended maintenance tolerances.

[…]

4. 4.    When a PRIORITY deviation is identified:
5. a. The condition must be monitored and repaired prior to becoming an URGENT defect.

A CN PRIORITY defect is based on CN ETS maintenance criteria that exceed the TSR requirements. The TSR contain no equivalent PRIORITY geometry defects of any kind.

The ETS outline that for Class 4 track:

• A surface deviation in excess of 1 inch from uniform profile on either rail at the mid-ordinate of a 62-foot chord is considered a PRIORITY surface defect.
• A difference in cross-level between any 2 points less than 62 feet apart on tangent, spiral or curves in excess of 1⅜ inches is considered a PRIORITY Warp 62 defect.

1.15 Installation of plug rails

When CWR is damaged and needs replacement, the defective section of rail is typically cut out and a replacement rail (plug rail) is installed. A plug rail can be new rail or used rail that was removed from service. When rail is removed from service and is to be used as plug rail, it is visually inspected, ultrasonically tested, measured for head wear and flange wear, and then stacked on a rail rack to await installation.

When choosing a plug rail from previously used rail, the key factors in determining its suitability are its overall length and rail head wear (head height and gauge face). The used plug rail length should be slightly longer than that needed for the repair and its head height and gauge face wear should closely match the parent rail^{Footnote 29} head wear.

New 132-pound rail is commonly used as a plug rail to match with a worn 136-pound parent rail. According to the (AREMA) manual,^{Footnote 30} the same 132/136 RE standard joint bars can be used for joints in both 132-pound RE rail and 136-pound RE rail since the radius that transitions from the rail head to the rail web, and the rail web itself, are the same for both rails. The only difference between a new 136-pound rail and a 132-pound rail is a head height difference of 5 mm.

1.15.1 Compromise joint bars in plug rail repairs

If a 136-pound parent rail is worn between 5 mm and 8 mm, a new 132-pound plug rail would be a good match, and 132/136 RE standard joint bars can be used to secure the joint. However, if a 136-pound parent rail is worn more than 8 mm and less than 11 mm, then 132/136 RE compromise joint bars, which have a 3 mm (⅛ inch) vertical offset, must be used to secure the joint.

Compromise joint bars are used in sets that consist of 1 GS and 1 FS joint bar per set. When a compromise joint is required, 2 compromise joint bars must be installed. The use of 1 compromise joint bar and 1 standard joint bar is not permitted.

If such a repair is attempted, it would be difficult due to the 1/8-inch offset of the compromise joint bar. Installing a joint using a 132/136 RE standard joint bar with a 132/136 RE compromise joint bar would also take extra manual effort to line up the holes/install the bolts. A joint assembled in this fashion would also be unstable, would loosen under load, and potentially fail prematurely.

1.16 Use of joints in continuous welded rail territory

Properly maintaining CWR track periodically involves removing rail with surface and internal defects, or removing worn rail, and installing a matching plug rail. The installation of a plug rail increases the number of joints in a track as each plug rail requires 2 joints, 1 at each end.

It is well known that a lack of stability in the rail joint creates favourable conditions for fatigue cracking in the joint bars.^{Footnote 31} A loose or poorly supported joint may cause not only fatigue cracking in the joint bars, but also overload cracking in the rail web. In a tight joint, the stresses are carried by the base and head of the rail, whereas in a loose joint, stresses are transferred to the joint bar and/or rail web bolt holes by the bolts pressing against the hole bores.

Once assembled, a rail joint must preserve the continuity of the rail by providing about the same strength, stiffness, flexibility, and uniformity as the rail itself. Properly supporting the joint with sound ties and tamped ballast is necessary to accomplish this. However, the moment of inertia of properly installed joint bars^{Footnote 32} is still only about 1/3 of the I-value for corresponding non-jointed rail.^{Footnote 33}

Consequently, even when the joint bars are attached tightly to a rail, the resulting joint is still a weak spot in the track structure. This weak region leads to increased vertical deflection of the joint as freight car wheels pass over it. This can lead to loosening and deterioration of the joint, rail end head damage near the gap (batter), and degradation of the ballast and subgrade in the vicinity of the joint.^{Footnote 34}

In 2018, CN identified a total of 95 internal rail defects between Mile 145.37 and Mile 252.28 on the Rivers Subdivision. Fifty-eight of the 95 (61%) internal rail defects were joint-related.

CN recognized the need to reduce the number of joints on the Rivers Subdivision. In 2018, track maintenance crews were expanded to focus on joint elimination. However, obtaining adequate track time to carry out those repairs as traffic volumes increased proved to be challenging. While 318 joints were eliminated, at the time of the derailment, 1528 joints that were primarily associated with plug rail repairs in CWR territory remained on the subdivision.

1.17 Track maintenance in the vicinity of Mile 197.47

TIS records for the Rivers Subdivision also identified that between Mile 190.09 and Mile 200.75, 50 plug rails were installed between 26 February 2015 and 09 February 2019, which was higher than usual for only 10 miles of CWR track. As the number of plug rails increased, joint maintenance and the replacement of cracked or broken joint bars increased the maintenance activities in this area. A review of the CN TIS track maintenance records from 01 January 2017 to 15 February 2019 identified work undertaken in close proximity to Mile 197.47 (Table 3).

Since rail on the subdivision is a mix of 132-pound CWR and 136-pound CWR, to support track maintenance activities as they arise, CN track maintenance crews usually carry at least 8 joint bars in each maintenance crew truck, four 132/136 RE standard joint bars and four 132/136 RE compromise joint bars. A 132/136 RE standard joint bar and a 132/136 RE compromise joint bar look very similar. There is only a 1/8-inch offset in the base of a 132/136 RE compromise joint bar that distinguishes it from a 132/136 RE standard joint bar.

On 31 December 2018, a CN track maintenance supervisor conducted an ad hoc track inspection and identified a broken GS joint bar connecting 2 pieces of 136-pound rail in the vicinity of Mile 197.47. The joint was marked with yellow paint so it could be located by a track maintenance crew. A track maintenance crew in the area was then contacted and issued instructions to replace the joint bar. The track maintenance crew responded in a CN maintenance crew truck to make the repair.

The maintenance crew located the broken 132/136 RE standard joint bar on the GS of the south rail, removed it and replaced it with what was perceived to be a 132/136 RE standard joint bar from the truck. Once the repair was completed, the estimated location of the repair was manually entered as Mile 197.30 in TIS. There was no information in TIS that identified which joint bar was replaced (GS, FS, or both).

1.18 TSB laboratory examination of failed rail components

The south rail pieces recovered from the occurrence site were reassembled in the TSB laboratory. For ease of reference, the recovered rail segments and joints were labelled with alphabetic and numeric characters, respectively. The south rail consisted of 6 rail segments and 5 joints located within a distance of 49 feet (Figure 10). The joint bars from joint 1 and joint 5 were broken while the joint bars and rail from the other 3 joints were still intact.

Information for the south rail segments and joints is contained in Table 4 and Table 5 below.

* CTM: Cleveland Track Materials
** YRF: Yangtze Railroad Materials
*** Portec: Portec Rail Products, Inc.

1.18.1 Joint 1

Joint 1 joined together rail segments A and B. Machine vision photographic joint bar inspection of this joint on 23 January 2019 located it at Mile 197.4751. The recovered joint examined was identical to the joint observed in the machine vision photographs. The rail head end batter observed within the joint in both rail segments A and B in the machine vision photographs pre-dated the derailment and was indicative of a loose or poorly supported joint.

The joint bars had fractured between the middle 2 holes and remained attached to both rails. The joint was assembled with a 132/136 RE compromise joint bar on the GS of the rail and a 132/136 RE standard joint bar on the FS of the rail. Rail end A was intact while rail end B had broken into several pieces within the joint, and portions of its head and web were missing.

The vertical rail head wear on rail segment A was 8 mm (5/16; inch) and on rail segment B it was 6 mm (¼ inch). The head height difference between the 2 rail segments was less than 2 mm and did not require the use of compromise joint bars to assemble the joint.

The 136-pound side of the GS 132/136 RE compromise joint bar was secured to the 136-pound rail segment A, while the 132-pound side of the GS 132/136 RE compromise joint bar was secured to the 136-pound rail segment B. There was no visible blue or yellow paint on the GS compromise joint bar (Figure 11).

The FS 132/136 RE standard joint bar exhibited yellow paint on its exposed surfaces, which was a pre-existing marking that identified a defective joint for repair (Figure 12).

The following observations of the joints and rail components were made during the examination:

• Rail segment A exhibited rail head end batter while rail segment B had failed within the joint (Figure 13 and Figure 14). Well-defined fatigue cracks were observed in the top shoulder on both joint bars and in the toe of the GS 132/136 RE compromise joint bar. From the extremities of the fatigue cracks of both joint bars, instantaneous overstress fractures progressed through the remaining cross-sections when the joint bars could no longer withstand the applied loads under normal service conditions.
• The fracture surfaces on all recovered rail segment B pieces exhibited a coarse granular appearance characteristic of instantaneous overstress fracture, which suggests that the fractures occurred as a result of the derailment and were not causal.

• A chevron pattern was traced back to the likely rail segment B fracture origin at a bolt hole that was closest to the middle of the joint in the web of rail segment B.
• Imprints of bolt threads were worn into the corresponding GS 132/136 RE compromise joint bar bolt hole, which indicates that the joint was skewed as the bolt was pressed against the bore of the GS joint bar hole (Figure 15).
• The track bolts were bent, particularly the middle bolt on rail segment B. There were polished regions on the bolt shanks, shoulders and threads at the locations corresponding to the positions of the holes in the rail web and the joint bars. One side of the nuts and both sides of the spring washers were also polished.
• Polishing was observed on the GS and FS base of each rail, in the fillet radii that transitions from the rail head to the web and on the corresponding top and bottom surfaces of both joint bars. The polishing observed on the bolts, nuts, spring washers, both joint bars and corresponding rail surfaces, are all indicators that joint 1 was loose.

1.18.2 Joints 2 to 5 and related components

The following observations of the joints and related components were made during the examination:

• There were indications of some looseness in joints 2 to 5 of the south rail section, but this had not yet caused any cracks to develop in any of the joint bars or rails.
• Joints 2 to 4 remained intact. Joint 4 was an insulated joint with short plug rails attached on either side.
• Joint 5 was assembled with two 132/136 RE standard joint bars connecting a 132-pound rail and a 136-pound rail. There was some batter observed on both rail ends that pre-dated the occurrence. Both joint bars had broken in half approximately mid-length. The joint bar fracture surface features were typical of an overstress fracture with no pre-existing cracks or defects.
• All other rail and track component failures observed likely occurred as a result of the derailment and were not causal.

1.18.3 Summary of TSB laboratory examination

Since a GS compromise joint bar was installed with an FS standard joint bar in joint 1 (Mile 197.4751), the use of 2 different joint bars left the joint 1 assembly somewhat misaligned (skewed) and unstable. The misalignment led to rapid deterioration and loosening of the joint, which initiated fatigue cracking in the joint bars and ultimately resulted in their failure.

1.19 Regulatory oversight

TC promotes safe and secure transportation systems in the air, marine, rail, and surface modes, as well as the safe transportation of DG. To do so, TC develops safety regulations and standards and, in the case of railways, it facilitates the development of rules by the rail industry. Once TC approves the rules, TC is responsible for enforcing them through a number of inspection programs to monitor compliance with rules and regulations.

Rail safety is governed by the Railway Safety Act, the objectives of which are to

1. (a) promote and provide for the safety and security of the public and personnel, and the protection of property and the environment, in railway operations;
2. (b) encourage the collaboration and participation of interested parties in improving railway safety and security;
3. (c) recognize the responsibility of companies to demonstrate, by using safety management systems and other means at their disposal, that they continuously manage risks related to safety matters; and
4. (d) facilitate a modern, flexible and efficient regulatory scheme that will ensure the continuing enhancement of railway safety and security.^{Footnote 35}

TC has also developed the SMS Regulations) which require railways to manage their safety risks.

1.19.1 Transport Canada regulatory track inspections

TC has both a national inspection program that randomly selects track segments to be inspected each year, and a risk inspection program that uses a risk-based approach to target locations for inspection. The random track inspection program does not differentiate between primary and secondary main lines, while in the risk inspection program, primary traffic corridors usually receive more attention than secondary main lines.

Between 08 January 2019 and 10 January 2019, TC conducted a light geometry^{Footnote 36} car inspection of the Rivers Subdivision from Mile 151.39 to Mile 267.76. However, a lack of available track time prevented TC inspectors from inspecting between Mile 180.00 to Mile 204.57 which contained the area of the accident. The inspection identified 3 items that were not in compliance with the TSR: 2 track fasteners were not intact and 1 joint in CWR had less than 2 bolts per rail. In addition, there were 19 track geometry issues and 3 signage issues that were cause for concern.

On 14 January 2019, TC issued CN a Letter of Non-Compliance and Concern and requested that CN advise TC in writing on how it intended to address the non-compliances and concerns.

On 01 February 2019, CN provided a response to the TC letter outlining corrective actions. All 3 of the non-compliances were immediately addressed while the concerns were either being addressed or had planned corrective actions in place.

1.19.2 Railway Safety Management System Regulations, 2015

On 01 April 2015, the Railway Safety Management System Regulations, 2015 (SMS Regulations) came into force, replacing the 2001 SMS Regulations. Under these regulations, federally regulated railway companies must develop and implement a safety management system (SMS), create an index of all required processes, keep records, notify the Minister of Transport of proposed changes to their operations, and file SMS documentation with the Minister when requested.

1.19.2.1 Risk management

The SMS Regulations require that a company develop and implement a risk assessment process that identifies risks requiring remedial action as well as the remedial action to be implemented. The SMS Regulations also require that a company develop and implement a process for implementing and evaluating the remedial action that was implemented. Section 5 of the SMS Regulations states:

5  A railway company must develop and implement a safety management system that includes

[…]

(f) a risk assessment process;

(g) a process for implementing and evaluating remedial action; ^{Footnote 37}

Subsection 13 of the SMS Regulations states:

13  A railway company must, on a continual basis, conduct analyses of its railway operations to identify safety concerns, including any trends, any emerging trends or any repetitive situations.^{Footnote 38}

Subsection 15(1) of the SMS Regulations states:

15(1)  A railway company must conduct a risk assessment in the following circumstances:

[…]

(a) when it identifies a safety concern in its railway operations as a result of the analyses conducted under section 13;

[…]

(c) when a proposed change to its railway operations […] may affect the safety of the public or personnel or the protection of property or the environment:^{Footnote 39}

Such changes include but are not limited to

[…]

(iii) an increase in the volume of dangerous goods it transports,

(iv) a change to the route on which dangerous goods are transported, ^{Footnote 40}

To assist railways with implementing SMS, TC has developed a document entitled Safety Management Systems Industry Guide (April 2016). With regards to the components of a risk assessment,^{Footnote 41} the guide states that the risk assessment must

• describe the circumstances that triggered the requirement to conduct the risk assessment;
• identify and describe the risks associated with those circumstances;
• identify the factors taken into account in the risk assessment, including the persons who may be affected and whether property or the environment is affected;
• indicate, for each risk, the likelihood that the risk will occur and the severity of its consequences;
• identify the risks that require remedial action; and
• identify the remedial action for each of those risks.

1.20 Canadian National Railway Company safety management system plan

In accordance with the SMS Regulations, CN developed and implemented a detailed SMS, which included conducting risk assessments when changes to operations occur.

CN’s Risk Assessment Standard states that risk assessments shall be performed in the following instances:

• Changes to operations, procedures, infrastructure, technology, etc.
• Trend analysis showing a gradual deterioration or a sudden increase.
• Issues identified through injury and accident investigations, investigations, complaints, inspections, etc.^{Footnote 42}

If a risk assessment is determined to be necessary, the Risk Assessment Standard defines the steps to be followed, which include identifying hazards, assessing hazards, selecting control measures or remedial action, and implementing the control measures or remedial action.^{Footnote 43}

1.20.1 Canadian National Railway Company corridor risk assessment

The KTR provide the definitions of a key train and a key route, and list a set of requirements that companies must meet to provide an added margin of safety. Once a key route is identified, the KTR also require companies to conduct a key route risk assessment at least every 3 years.

In 2013, CN identified a series of subdivisions that connect Edmonton to Winnipeg as key routes and performed a corridor risk assessment (CRA). The Edmonton – Winnipeg main-line corridor was defined as the trackage that was the primary freight route between CN Walker Yard in Edmonton and CN Symington Yard in Winnipeg. The route initially comprised the Wainwright, Watrous and Rivers subdivisions. The corridor is a heavy tonnage freight route that is primarily single track with passing sidings.

The CN CRA was a comprehensive document that identified subdivision characteristics, possible safety concerns for the route as well as current and proposed risk mitigating strategies for the risks identified. In 2016, CN revised the CRA in accordance with the KTR.

In December 2018, CN issued an interim CRA that was updated to also include additional subdivisions that became key routes due to additional unit train volumes of DG on those subdivisions.

The 2018 CRA identified that the core main line (Wainwright, Watrous and Rivers subdivisions) was primarily CWR signaled territory. CN has processes in place to identify track infrastructure maintenance requirements. Rail traffic volumes and detailed track defect analyses are used to identify the need for upgrades through capital programs. This review was typically undertaken during the CN Engineering Department planning process and was used to support the need for a joint elimination program for the core main line.

CN identified that certain sections of track consisting of smaller (i.e., 115 pounds), older, and less ductile jointed rail posed a higher risk of an in-service failure when compared with CWR. As such, in 2019, CN scheduled a track rehabilitation program to replace these sections of jointed rail with CWR on portions of 4 secondary main-line subdivisions that were composed partially or wholly of jointed rail. There were no joint elimination activities specifically listed for the Rivers Subdivision, which was part of the main-line corridor. Although a joint elimination program identified in the CRA was considered necessary to eliminate derailment hazards, the CRA provided no explanation as to the risks posed by the increasing number of plug rail and joint repairs in the CWR territory on CN’s core main line, which included the Rivers Subdivision. Since joint elimination was part of the CN Engineering Department planning process, the CRA contained no target dates for the completion. Furthermore, the CRA did not identify the risks associated with increasingly high traffic volumes on a primarily single-track main line and the difficulty for track maintenance crews to carry out the necessary track maintenance and repairs, which includes the completion of the joint elimination program. Consequently, the track conditions on the Rivers Subdivision had continued to deteriorate as evidenced by the volume of plug rails and joints on the subdivision.

1.21 Other TSB investigations involving joint failures and conditions

On 22 January 2019, at about 0925 Central Standard Time, a CN freight train, travelling southward at 31 mph on the Warman Subdivision, experienced a train-initiated emergency brake application near Saskatoon, Saskatchewan,^{Footnote 44} when 29 cars and the mid-train locomotive derailed. Many of the derailed cars were piled up on the northbound lanes of divided Highway 11, blocking the crossing. The mid-train locomotive caught on fire which was quickly extinguished. There were no DG involved and there were no injuries.

The investigation determined that:

• The rail head within an insulated joint, located in the east rail of the track that traversed the median of the Highway 11 crossing, was missing; it had likely been broken and expelled under a previous train.
• when subjected to loading due to the passage of trains, the presence of 2 adjacent relatively short-length plug rails measuring 17 feet 7 inches long and 14 feet 11 inches long respectively—in an area where the track modulus varied greatly between the 2 grade crossings—likely contributed to the deterioration of the track;
• although the CN TIS is a useful tool for recording track maintenance information, it did not provide sufficient resolution to assess the work conducted at individual joints and short plug rails that were installed close together.

Since 2015, the TSB has investigated 7 other occurrences where broken joints, loose joints and/or broken rail within a joint have contributed to a derailment.^{Footnote 45}

1.22 TSB safety issues investigation

In response to a series of train derailments on secondary main lines involving broken rails in the winter of 2003–2004, the TSB carried out a safety issues investigation.^{Footnote 46} The study established a significant relationship between rail defects and the level of bulk unit train traffic on secondary main lines and found that the effect of increasing bulk train traffic had not been accommodated through regular maintenance. The same circumstances could also apply to some main line track. The study also identified that:

• Where rail weight is less than 130 pounds, increased bulk unit train tonnage significantly increases rail defects, resulting in a higher risk of broken rail derailments.
• Railways recognized that the rate of track degradation was accelerated with increases in bulk unit train tonnage on secondary main lines. However, an appropriate balance between increased track degradation and timely infrastructure maintenance and/or renewal had not been achieved.
• Compliance with the TSR in and of itself was insufficient to ensure safety since the TSR did not provide a means to anticipate changing conditions such as increased traffic over the long term.

1.23 Derailments involving tank car unit trains transporting crude oil

Since 2013, the TSB has investigated 3 serious derailments involving tank car unit trains transporting crude oil. As a result of these 3 derailments, a total of 131 tank cars loaded with crude oil derailed releasing a combined total of 10.28 million litres of product.

1.23.1 Lac-Mégantic accident and recommendation related to tank cars

On 05 July 2013, at about 2250 Eastern Daylight Time, Montreal, Maine & Atlantic Railway (MMA) freight train MMA-002, en route from Montréal, Quebec, to Saint John, New Brunswick, was stopped at Nantes, Quebec (Mile 7.40 of the Sherbrooke Subdivision), the designated MMA crew-change point. The train, consisting of 5 head-end locomotives, 1 VB car (i.e., special-purpose caboose), 1 box car, and 72 Class 111 tank cars carrying crude oil (UN1267, Class 3), was then secured on the main track and left unattended on a descending grade.

Shortly before 0100 on 06 July 2013, the unattended train started to move, and gathered speed as it rolled, uncontrolled, down the descending grade toward the town of Lac-Mégantic, Quebec. After reaching a speed of 65 mph, 63 Class 111 unjacketed tank cars and a box car derailed near the centre of the town. The derailed cars released approximately 5.98 million litres of product due to tank car damage. The released product ignited almost immediately, resulting in a large pool fire that burned for more than a day. Forty-seven people were fatally injured.

Many buildings, vehicles, and the railway tracks were destroyed. About 2000 people were initially evacuated from the surrounding area.

As part of the Lac-Mégantic investigation,^{Footnote 47} the TSB highlighted the vulnerabilities of Class 111 tank cars and recommended that

1.23.1.1 TSB reassessment of Transport Canada’s response to Recommendation R14-01 (March 2021)

As part of its mandate, the TSB makes recommendations to eliminate or reduce safety deficiencies that pose significant risks to the transportation system and warrant the attention of regulators and industry. The Board assesses responses to recommendations according to the extent to which the safety deficiency has been or is being addressed. Once recommendations have been assessed as Fully Satisfactory, they are closed. The TSB continually monitors the progress being made on its active recommendations.

Since issuing TSB Recommendation R14-01 which calls for enhanced protection standards for Class 111 tank cars, the Board has monitored and assessed industry responses on a yearly basis.

As a result of this recommendation, North American regulators and the railway industry developed and implemented a new tank car standard, the TC/DOT 117J, as well as retrofit requirements for older Class 111 tank cars in flammable liquid service (TC/DOT 117R), and implementation timelines to modernize the fleet of tank cars used for the transport of flammable liquids.

As of 01 March 2018, legacy Class 111 tank cars were prohibited for use in crude oil service in Canada and the U.S.

As a result of this recommendation, North American regulators and the railway industry developed and implemented a new tank car standard, the TC/DOT 117J, as well as retrofit requirements for older Class 111 tank cars in flammable liquid service (TC/DOT 117R), and implementation timelines to modernize the fleet of tank cars used for the transport of flammable liquids.

As of 01 March 2018, legacy Class 111 tank cars were prohibited for use in crude oil service in Canada and the U.S.

TC has been assessing the crashworthiness of both new (117J) and retrofitted (117R) Class 117 tank cars involved in recent main-track derailments. According to TC, the improved service equipment design features of Class 117 tank cars significantly reduce the potential for the release of dangerous goods from top fittings and bottom outlets, and the thermal protection system increases the survivability of the tank cars when involved in fires.

TC has also been participating in modelling full train derailments in collaboration with the Federal Railroad Administration. According to TC, the results of these models show that the performance of the specification 117J tank cars is significantly improved compared to Class 111 tank cars. TC indicated that research will continue with modelling to evaluate the performance of the specification 117R tank cars.

TC continues to monitor industry’s progress towards tank car modifications and compliance with the phase-out deadlines. TC indicated that industry has complied with the phase-out deadlines that have passed and that it is producing new 117J tank cars and retrofitted 117R tank cars at a rate sufficient to meet the phase-out schedule by the 2025 deadline in Canada.

Pending the full implementation of the new flammable liquid tank car standard, TC continues to improve risk control measures for trains carrying large volumes of flammable liquids. Such measures include speed reductions, additional track safety measures and specific operating restrictions for higher-risk key trains.

The Board acknowledged TC’s implementation of improved risk control measures for trains carrying large volumes of flammable liquids. The Board noted that a well-defined phase-out schedule of older tank cars was in place and industry’s progress in that regard was being monitored by TC. This will help ensure that, by 01 May 2025, all flammable liquids in Canada are transported in Class 117 tank cars.

The Board also acknowledged TC’s continuing efforts to characterize and evaluate the crashworthiness of Class 117 tank cars involved in accidents. The Board noted that ongoing TSB investigations (R19W0050 and R19W0320) will assess the performance of class 117 tank cars in train accidents and the subsequent risk of product loss. Until the results of these assessments are known, the Board considered TC’s response to Recommendation R14-01 to show Satisfactory Intent. ^{Footnote 48}

1.23.1.2 TSB reassessment of Pipeline and Hazardous Materials Safety Administration’s response to Recommendation R14-01 (March 2021)

Since 2017, the U.S. Bureau of Transportation Statistics (BTS) and Pipeline and Hazardous Materials Safety Administration (PHMSA) have produced an annual report that tracks industry's progress. The most recent annual report, submitted to Congress in September 2020, described the progress of tank car upgrades from 2013 through 2019, by tank car and flammable liquid type. The next annual report is scheduled for fall 2021.

By the end of 2019, new and retrofitted DOT-117 tank cars comprised nearly half of the fleet carrying Class 3 flammable liquids. In 2019, half of the new DOT-117 cars carried crude oil and 65% of retrofitted DOT-117 tank cars carried either crude oil or ethanol. PHMSA indicated that DOT-117 tank cars will continue to become a significant part of the fleet to meet the safety goal by 2029.

The Board acknowledged PHMSA’s efforts with respect to collecting tank car retrofit information and with the reporting of this information on an annual basis. The Board noted that a well-defined phase-out schedule of older tank cars was in place and industry’s progress in that regard was being monitored by PHMSA. This will help ensure that, by 01 May 2029, all flammable liquids in the United States are transported in more robust Class 117 tank cars.

Therefore, the Board considered PHMSA’s response to Recommendation R14-01 to show Satisfactory Intent. ^{Footnote 49}

1.23.2 Gladwick derailment and recommendation related to key routes

On 14 February 2015, at about 2335 Eastern Standard Time, CN crude oil unit train U70451-10 was proceeding eastward at about 38 mph on the Ruel Subdivision when it experienced a train-initiated emergency brake application at Mile 111.7, at Gladwick, Ontario.^{Footnote 50} A subsequent inspection determined that the 7th through 35th cars (29 DG tank cars in total) had derailed. Of the 29 derailed tank cars, 19 were breached and about 1.7 million litres of product was released to either atmosphere or surface. The product ignited, and fires burned for 5 days. About 900 feet of mainline track was destroyed. There was no evacuation, and there were no injuries.

The investigation determined that the derailment occurred when an insulated rail joint in the south rail at Mile 111.7 failed beneath the head end of the train and allowed the trailing L4 wheel of the 8th car to drop into gauge, which spread the rails and caused the trailing cars to derail.

All the tank cars involved were Class 111 tank cars that were compliant with the Association of American Railroads (AAR) CPC-1232 standard.^{Footnote 51} However, only 2 of the tank cars were jacketed, insulated and had full head shields while the remaining 27 were non-jacketed tank cars equipped with ½ head shields.

The investigation report indicated that TC had recognized the role that train speed and train risk profile play in the severity of the outcome of a derailment and had put some measures in place to limit the speed of key trains under certain conditions. The KTR restrict key trains to a maximum speed of 50 mph on main track and a maximum speed of 40 mph within the core and secondary core of Census Metropolitan Areas. While the restrictions contained in the rules were a step forward at the time issued, the current maximum speeds were selected without being validated by any engineering analysis.

Therefore, the Board recommended that

1.23.2.1 TSB reassessment of Transport Canada’s response to Recommendation R17-01 (March 2021)

Since issuing TSB Recommendation R17-01, which calls for a study on factors affecting the severity of derailments involving dangerous goods, and to amend the KTR, the Board has monitored and assessed TC responses on a yearly basis.^{Footnote 52}

The National Research Council of Canada (NRC) completed its report “Study on the Factors that Increase the Severity of the Outcomes for Derailments Involving Dangerous Goods and Identification of Mitigation Measures” and TC made the report available to the public as of September 2020.^{Footnote 53} Based on this study, several Ministerial Orders (MO) were issued by TC aiming to reduce the likelihood and severity of derailments involving dangerous goods (DG) and enhance rail safety in Canada.

Specifically, MO 20-06 required railway companies to update the Rules Respecting Key Trains and Key Routes that govern the movement of DG by rail in Canada. Following the issuance of the MOs, the Railway Association of Canada (RAC), on behalf of the industry, submitted revised Rules Respecting Key Trains and Key Routes to TC on 24 December 2020.

The updated rules are intended to permanently implement the following measures:

• New definition for higher-risk key train;
• Requirement for railways to have a winter operation risk mitigation plan;
• Modified cold weather speed restrictions for higher-risk trains; and
• New requirements for track inspection and maintenance (e.g., management of joints installed using joint bars in continuous welded rail and the use of replacement plug rails).

On 22 February 2021, TC approved the revised Rules Respecting Key Trains and Key Routes with an effective date of 22 August 2021.

In response to Board Recommendation R17-01, TC commissioned the NRC Study on the Factors that Increase the Severity of the Outcomes for Derailments Involving Dangerous Goods and Identification of Mitigation Measures. The NRC study was completed and made available to the public as of September 2020. TC has also approved the revised Rules Respecting Key Trains and Key Routes on 22 February 2021, with an effective date of 22 August 2021. Since both of these measures have been completed, Board Recommendation R17-01 has been fulfilled.

The Board considered the response to Recommendation R17-01 to be Fully Satisfactory.

1.23.3 Gogama derailment and track maintenance

On 07 March 2015, at 0242 Eastern Standard Time, CN crude oil unit train U70451-02 was proceeding eastward at about 43 mph on the Ruel Subdivision when it experienced a train-initiated emergency brake application at Mile 88.70, near Gogama, Ontario.^{Footnote 54} A subsequent inspection determined that the 6th to the 44th cars (39 cars in total) had derailed. As a result of the derailment, 33 out of 39 cars (85%) breached and about 2.6 million litres of crude oil (UN1267) was released to atmosphere, water, or surface. The released product ignited and caused explosions, and some product entered the nearby Makami River. A CN bridge over the Makami River (at Mile 88.70) and about 1000 feet of track were destroyed. There was no evacuation, and there were no injuries.

All the tank cars involved were Class 111 tank cars that were compliant with the CPC-1232 standard. However, only 4 of the tank cars were jacketed, insulated and had full head shields while the remaining 35 were non-jacketed tank cars equipped with ½ head shields.

The investigation determined that before the arrival of the train, a 16-inch-long portion of the parent south rail head had broken off due to a vertical split head rail failure within the east joint of a recent plug rail repair, leaving a gap in the south rail. The derailment occurred when the south rail failed catastrophically beneath the train as it traversed the track, resulting in the derailment of the 39 tank cars which were loaded with petroleum crude oil.

Following the derailment, in 2015 CN increased its investment in rail, ties, and surfacing from $10 million to $20 million for a capital track maintenance work program that took place throughout the spring and summer. Approximately 44 miles of new rail was laid, and 216 miles of track was resurfaced. Approximately 30 miles of track was re-gauged with wood plugs or concrete insulators, 773 butt welds were installed to eliminate joints, and about 37 000 concrete or wood ties were installed.

Since the derailment and the subsequent CN track maintenance on the Ruel Subdivision, only 2 main-track train derailments have occurred on the subdivision, each involving only 1 derailed car and no DG.

1.24 National Research Council study on factors that increase the severity of derailments involving dangerous goods

The objective of the NRC study^{Footnote 55} was to determine the factors that increase the severity of the outcomes for derailments involving dangerous goods, identify appropriate mitigating strategies for various train risk profiles, and explore the possibility of amending the KTR. The factors that are generally recorded and tracked in accident reports in Canada and the United States were used to categorize the severity of a derailment.

The study reviewed the KTR and discussed how the rules could manage risk and minimize the risk associated with train speed, train type (DG vs manifest), and track conditions. The literature reviewed for the study identified and provided insight into the factors that contribute to the severity of a derailment. These factors included the effects of train speed, train type, derailment cause, and other factors. The literature reviewed also suggested some potential mitigating strategies for these factors.

The study noted that there is a complex relationship between train speed, train length, accident cause and other factors on the severity of an outcome for a derailment. There is an apparent linear relationship between the number of cars that derail and increased speed of an accident. However, some high-speed derailments derail few cars and some low-speed derailments derail many cars, which suggests that speed is not the only factor.

The study identified that there is potential for implementing mitigating factors for various train risk profiles. Marshalling was also studied as a possible method of reducing DG transport risk, as the prevailing industry opinion is that the rear quarter or third of a train may be the safest location for placement of DG cars or blocks of DG cars.

Various train risk profiles were identified and compared to DG unit trains, and how the outcomes of derailments may differ for the various risk profiles, with the DG unit trains having the highest risk profile. Five different types of train risk profiles were identified:

• A train with no DG cars
• Non-key train with 19 or fewer DG cars
• A key train with 20 or more DG cars
• A key train with 1 poisonous inhalation hazard (PIH) or toxic inhalation hazard (TIH) tank car
• A unit train consisting of all DG cars, such as unit trains transporting tank cars loaded with crude oil

As speed increased, derailments caused by broken rail, rail welds and/or joint bars resulted in more severe accidents compared to other accident causes. For example, at 50 mph, an accident caused by broken rail tended to derail an average of twice as many cars as other derailment causes.

Derailments caused by broken rails or welds (i.e., unintended rail discontinuities) had a much higher occurrence rate and derailed more cars per accident for a given speed when compared to accidents caused by broken wheels, bearing failures or track geometry defects.

Loaded unit trains (including non-key unit trains) derailed more cars and were involved in a larger percentage of broken rail or broken weld accidents compared to unit trains with all empty cars.

Seasonal conditions cannot be controlled. However, there are mitigating strategies available that can offset the increased risk associated with these conditions. These mitigating strategies include speed reductions, as currently practiced by railways in cold weather conditions, and increased frequency of maintenance/inspection of track and freight cars.

Improved tank car structure design has been shown to reduce the probability of DG release and the potential severity of an accident. While improved tank car designs may reduce the probability of DG release, the risk of a tank car being breached and releasing product exists in any derailment if the speed is sufficiently high. Improved tank car designs also do not reduce the likelihood of a derailment or influence the number of cars that derail.

A review of the KTR identified that the rules can also be improved to account for the track repair and maintenance processes of railways in Canada. The study concluded that sections 5.3 and 5.4 of the KTR concerning joint bars should have a procedure in place for the temporary installation and inspection of joint bars and plug rails in CWR territory and that the procedure should include a frequency at which the temporary joint bar and/or plug rail will be inspected until it is permanently repaired. As well, the study recommended that the inspection frequency should be related to traffic volumes and the presence of key trains in the traffic.

While the KTR have some limits on train speeds based on route location, wheel bearing faults, class of track, and type of goods being transported, the KTR do not formulate any preferences or recommendations with regards to the following:

• Marshalling strategy as the placement of DG cars within a train is at the discretion of the railways in accordance with AAR and railway rules, guidelines, and recommended practices, as well as regulations set out by TC with regards to the transport of DG.
• Limits for key train length or weight (tonnage).
• Limits for DG unit train length, weight, or speed. Despite having a higher risk profile, DG unit trains, in which all cars are transporting DG, are subject to the same rules as other key trains, which may have as few as 1 car in the consist transporting Class 2.3 products (toxic gases) or a TIH product.
• Requirements for more stringent operator experience, or other human factors issues that may have an effect on the occurrence rate or severity of a derailment.

The study summarized the factors affecting derailment severity and suggested mitigation strategies. The application of these strategies to the risk profiles identified by the TSB in the Gladwick report^{Footnote 56} was presented as a set of exemplars, or hypothetical, mitigation strategies. The exemplar mitigation strategies included a combination of increased rail flaw and track geometry inspections and repairs, increased car and locomotive inspections and repairs, train speed reductions, and human factors improvements, such as requirements for increased training or work experience when operating key trains with a large percentage of DG cars.

The literature reviewed for the study supported the risk mitigation strategies suggested. The study determined that the increase in overall risk that occurs as the number of DG cars in a key train increases (from 1 DG car to a unit train in which all tank cars are DG cars) could be countered with an increasing level of track-related, equipment-related, and human factors-related requirements.

Although the complete elimination of all derailments from any cause may not be possible, it is possible to implement measures that minimize the likelihood of a derailment and reduce the severity of outcomes, without seriously impacting railway operations.

1.25 Tank car information

Historically, there have been several variations of tank cars in DG service used to transport Class 3 flammable liquids. Older legacy jacketed and non-jacketed Class 111 tank cars that were ordered before 01 October 2011 were built to older TC/DOT Class 111 standards. These types of Class 111 tank cars were no longer authorized to transport unrefined petroleum products after 01 November 2016 in Canada.

Class 111 tank cars built between 2011 and 2015 used in DG service to transport crude oil and ethanol, which are Class 3 flammable liquids of packing groups I and II, must comply with AAR CPC-1232 standard.^{Footnote 57} The TC TP14877E^{Footnote 58} standard contains the corresponding specifications. These tank cars are generally referred to as “enhanced Class 111 tank cars” or “CPC-1232 tank cars” and can continue to transport crude oil until 01 May 2025, provided they are fitted with a jacket.

Some of the Class 111 tank cars were retrofitted with jackets, thermal protection, and full head shields as well as modified BOV arrangements in order to meet the TC/DOT 117R tank car standard.

Tank cars that are used for the transport of Class 3 flammable liquids built on or after 01 October 2015 must meet the new TC/DOT 117J standard.

1.25.1 Material requirements

Older legacy Class 111 standards for jacketed and non-jacketed tank cars permitted the heads and shells to be constructed of AAR TC128 Grade B or American Society for Testing and Materials (ASTM) A516 Grade 70 carbon steel plate with no requirement to use normalized material.^{Footnote 59}

In general, Class 111 tank cars built to the CPC-1232 standard and the newer TC/DOT 117J^{Footnote 60} standard require the use of thicker normalized steel for the shell and heads that can improve puncture resistance and strength. Using normalized steel^{Footnote 61} improves the toughness and ductility of the material, providing increased fracture resistance of the tank car, when compared to non-normalized steels used for legacy Class 111 tank cars.

1.25.2 Features and appurtenances

Tank cars are designed with various features and appurtenances for loading and unloading and to protect against release of product in the event of a derailment (Figure 16).

1.25.2.1 Head shields

Head shields help protect the head of the tank car from puncture. They must be made of structural or pressure vessel steel plate with a thickness equal to or greater than 12.7 mm (½ inch). Half-height head shields cover at least the lower half of the tank head. Full-height head shield protection covers the entire tank head and is required for TC/DOT 117R and 117J tank cars. Furthermore, jacketed Class 111 tank cars built to the CPC-1232 standard are also generally fitted with a full-height head shield.

1.25.2.2 Welded appurtenances and reinforcing pads

The AAR Manual of Standards and Recommended Practices (MSRP) specification M-1001 indicates that for tank cars: “The welds securing the sill to the reinforcing plate shall have a total throat area not exceeding 85% of the total throat area of the reinforcing plate-to-shell welds.” ^{Footnote 62}

To avoid welding appurtenances directly to the tank and to minimize the potential for tank head or shell failure, reinforcing pads (re-pads) are welded to the tank. Tank car appurtenances such as stub sills are then welded to the re-pads rather than being welded directly to the tank. The welds that join re-pads to the tank head are, by design, stronger than the welds that hold the stub sill to the re-pad. This is so that in the event of excessive stub sill loading, should the welds fail, the stub sill would sacrificially break off the re-pad leaving the re-pad attached to the head. This minimizes the chances that a crack could transition from the re-pad to the head weld into the head itself and breach the tank.

1.25.2.3 Top fitting protection

Top fitting protection is provided by a protective housing compliant with clause 10.5.3.1 of TP 14877.^{Footnote 63} The protective housing encloses the top shell service equipment (valves, accessories) and the pressure relief device (PRD) for protection against rollovers and accidental horizontal loads.

1.25.2.4 Jacketed, insulated, and thermally protected tank cars

Tank car jackets encase the tank shell, heads and insulation and must be weather-resistant. Jackets must be made of ASTM 1011 steel (or equivalent) with a thickness equal to or greater than 3 mm.

Class 117R and Class 117J tank cars must be jacketed and insulated. There is a performance requirement for the insulation/thermal protection system. The performance standard requires that an insulated/thermally protected tank car has to be able to withstand a pool fire for 100 minutes, and direct flame impingement (torch fire) for 30 minutes, with no release of lading other than by a PRD.

1.25.2.5 Bottom outlet valve and skid protection

Tank cars are also required to be equipped with an approved method of skid protection to protect bottom appurtenances that project beyond the shell such as a BOV. TP 14877 as well as the AAR require that BOV handles, unless stowed separately, be designed to bend, break free, or be protected on impact, without the valve opening, or designed so that all of the handle is located within the bottom discontinuity protective structure.^{Footnote 64}, ^{Footnote 65}

All TC/DOT 117R tank cars retrofitted on or after 01 July 2015 and all 117J tank cars must meet the more recent BOV configuration requirement intended to prevent unintended BOV actuation during a derailment.^{Footnote 66}

1.26 TSB examination of derailed tank cars on site

During site remediation of derailments that involve tank cars containing DG, derailed tank cars are moved either to clear the track, to orient the tank car to minimize the release of product, or to remove any remaining product from inside the cars. To accomplish this, tank car stub sills and top fitting protective housings are often used to move the cars, which can result in extensive damage to stub sills and protective housings. As a result, it is sometimes difficult to distinguish between derailment damage and damage that occurs during remediation. Despite these challenges, every effort was made to properly characterize the observed tank car damage that resulted from the accident.

In this occurrence, all the tank cars were constructed for and owned by Valero Energy Corporation (Valero), which was also the product shipper and consignee. The tank cars were built between 2013 and 2014 by Trinity Tank Car Inc., manufactured to U.S. DOT specification 111A100W1, and compliant with the industry’s CPC-1232 standard. The cars were later retrofitted to be compliant with the DOT 117R tank car standard and re-stenciled accordingly. This was the first major derailment in Canada that involved a release of crude oil from a significant number of Class 117R tank cars.

A total of 37 Class 117R tank cars in the 5th to 41^st positions behind the lead locomotives derailed. The 5th and 6th tank cars remained upright and had no visible tank damage or leaks. The remaining 35 cars (7th to 41st) came to rest in various positions in a large pile over a distance of about 300 to 400 feet. These 35 tank cars all sustained some form of impact damage during the derailment. Damage to tank shells, tank heads, BOV, manways, and protective housings resulted in 17 of the 35 cars being breached. The site examination focused on the 35 derailed tank cars.

1.26.1 Derailment zone observations

Examination of previous tank car derailments^{Footnote 67},^{Footnote 68},^{Footnote 69} indicates that when crude oil unit trains derail, there are typically 3 major areas within a derailment zone:

1. The initial area is where tank cars derail at the head-end or leading portion of the derailment and generally scatter randomly. This is represented by cars located in the 7th to 15th positions in this accident.
2. The second area contains the main body of the derailment. This is the area where tank cars generally jackknife, align side by side and/or stack up. This is represented by cars located in the 16th to 34th positions in this accident.
3. The third area is at the tail end of the derailment. Similar to the initial area, the remaining tank cars that derail in this area usually scatter randomly but do not stack up. This is represented by cars located in the 35th to 41st positions in this accident.

Different types of damage, that range both in severity and the amount of product released, have been observed in each of the 3 derailment zone areas (Figure 17). The reasons for the amount of damage sustained by each of the derailed tank cars vary, but common elements include the speed of the train at the time of the derailment, the size of the derailment area, the topography of the derailment zone, and the weather at the time of the derailment. The following observations are considered typical for each area and are provided to explain the dynamic forces at work on the tank cars during a derailment.

1.26.1.1 Initial derailment area

The tank cars in the initial derailment area are often located some distance away from the main body of the derailment. During a derailment, tank car bodies often separate from their truck assemblies. Once a car separates from its trucks, it will slide until it encounters obstacles that will slow its movement. The momentum of the tank car usually can be reduced to a slower rate either through friction with the ground or contact with obstacles. Often, cars in this area retain excellent shell integrity during the derailment and there is usually less tank deformation and smaller impact dents or breaches.

Components attached to the exterior of these tank cars typically experience impact damage from the tanks rolling while sliding on the ground. The design of tank car appurtenances, such as BOV and top fittings, has been modified over the years to protect them from this type of damage. The volume of product released is usually lower in the initial derailment area as compared to the main body of the derailment.

Of the 9 cars in the initial derailment area (7th car to the 15th car), 4 were breached (44%). There were 2 manway breaches, 1 head breach and 1 shell breach. Only the single head breach resulted in the release of a large amount of product (> 20 000 litres).

1.26.1.2 Main body of the derailment

The tank cars in the main body of the derailment usually account for the majority of the breaches and volume of product released. This can be attributed to the large dynamic forces that the tank cars experience in this area. The first car in this area acts as an anchor point, usually on the rail bed, and it slows down or stops forward progress of the subsequent derailing tank cars. The impact forces resulting from the trailing tank cars’ momentum imparts large loads on the derailed tank cars that have come to rest and will often result in large tank deformations or punctures. This continues until the tank cars come to rest.

Of the 19 cars in the second or main body of the derailment area (16th car to the 34th car), 11 cars were breached (58%), some with multiple breaches. There were 8 shell breaches, 2 head breaches, 2 top fitting breaches, and 1 manway breach. Seven of the 8 shell breaches resulted in the release of a large volume of product (> 20 000 litres).

1.26.1.3 Tail end of the derailment

The tank cars located at the tail end of the derailment have a wide range of damage and product release.

As the cars derail in the main body of the derailment, energy is dissipated through the impacts and is imparted via the stub sill assembly up to the time that the tank cars separate from each other. The impacts and associated reduction in the speed of the trailing tank cars reduce the impact forces and typically result in less tank damage and associated product loss. However, tank cars in the tail end area typically encounter other derailed rolling stock components such as couplers, truck bolsters, side frames and wheel sets that can breach a tank and result in product release.

If the main body of the derailment anchors relatively quickly, the subsequent train mass (i.e., trailing cars) enters the derailment zone with higher speeds, resulting in greater damage, not only to the derailed cars in the main body of the derailment, but also to the trailing end cars. When this occurs, the trailing end cars will typically exhibit large head or shell impact damage, dents, or punctures, depending on car orientation.

Of the 7 cars in the third or tail end of the derailment area (35th car to the 41st car), 2 cars were breached (29%), 1 with multiple breaches. There were 2 shell breaches and 1 head breach. Both shell breaches resulted in the release of a large volume of product (> 20 000 litres).

1.26.2 Tank car breaches and product lost

Slightly less than half of the 35 tank cars examined (17 or 49%) exhibited some type of breach resulting in loss of product. Of the breached cars, 3 (8%) had more than one type of breach. Shell breaches were the most frequently observed cause (11 cars) of product release, followed by head breaches due to collision damage (4 cars). Three cars released product from breached manways. Breached top fittings (1 car) were the other cause of product release. None of the PRDs or BOVs on any of the tank cars were breached. A summary of tank car breaches in this accident is contained in Appendix A.

Of the 17 breached tank cars, 5 lost their entire load, 10 lost part of their load, and 2 tank cars with confirmed breaches lost no measurable amount of product. The 17 cars with confirmed breaches that lost product released a total of about 815 000 litres of crude oil. A summary of the volume of crude oil that was released is contained in Appendix B.

1.26.3 Tank shells

Tank shell deformations observed in this derailment ranged from minor dents, gouges, and scratches to crushed and deformed shells with large breaches. The shells of 11 tank cars were breached from impact damage. Of these 11 tank cars, 6 had small punctures or cracks less than a foot in diameter or length while the remaining 5 cars had large shell breaches that were greater than 1 foot in diameter.

Many of the shell breaches were punctures consistent with collisions with sharp, relatively small objects such as couplers, truck sides and truck bolsters. A few tank cars exhibited fractures due to large crushing damage that is typically caused when 2 tank car bodies are subject to high impact forces during a collision.

Shell breaches accounted for an estimated 509 000 litres (62%) of the total product released in the derailment. Of the 11 tank car shell breaches, 9 resulted in an estimated loss of between 55% and 100% of the carload. Shell breaches were important contributors to product release in 6 of the 9 tank cars.

The majority of the tank cars with large shell breaches were located in the main body of the derailment zone where the tank cars impacted each other and became tightly packed as they came to rest against or on each other. Most of these tank cars exhibited large-scale transverse buckling and crushing, which is indicative of plastic collapse. This is consistent with previous TSB observations that when tank cars jackknife and stack up within the main body of the derailment zone, it results in large collision forces that are contributory to extensive deformation (plastic collapse), large breaches and the associated large amount of product release.

1.26.4 Tank heads and head shields

All the Class 117R tank cars involved in this accident were equipped with full head shields. Head damage was observed in 1 or both tank heads of 32 of the 35 tank cars (91%) while the tank head shield/head area of the other 3 derailed tank cars had no collision damage. Head breaches accounted for an estimated 279 000 litres (34%) of the total volume of product released in the derailment.

The head damage observed ranged from relatively minor dents to deep dents with punctures that breached the tank head. Two of the head breaches were punctures or tears with dimensions ranging from a few inches to a little more than 2 feet in length.

Of the 32 tank cars with some form of impact damage to their heads, only 4 cars had sustained breaches due to impact damage. However, 2 of these 4 cars had breaches in both the A- and B-end heads for a total of 6 head breaches.

Of the 6 tank heads that breached, 3 were breached due to impact, 2 due to cracking, and 1 due to crushing. The head breaches were generally smaller than shell breaches, although 1 car sustained a large head breach that resulted in the total loss of product from the car.

All head breaches were associated with significant deformation of the head, which suggests that the heads were subjected to elevated collision forces.

Some of the breaches initiated from cracks in the stub sill head pad-to-tank head fillet welds that had separated. In some cases, the head brace-to-head pad fillet weld was also fractured. These breaches consisted of cracking in the weld beads which eventually propagated into the tank car head.

1.26.5 Top fittings and pressure relief devices

All the tank cars were fitted with top fitting protective housings in accordance with AAR requirements for these types of tank cars. The protective housing of 28 of the 35 derailed tank cars had some form of impact damage.

In most cases, the impact damage on the top fitting protective housing was relatively minor. Only 1 tank car had a suspected breach from valves in the housing. In this case, the protective housing was missing, the valves were sheared off and the PRD was damaged but did not release product.

1.26.6 Manways

The derailed cars were equipped with hinged and bolted manway covers. Manway covers were found with some bolts or the manway itself opened and 2 manway covers sustained broken swing bolts. However, it is suspected that many manway covers were opened during remediation activities.

The manway covers of 21 tank cars were closed with no damage observed and only 3 of the tank car manways appeared to be breached. However, 1 of the breaches most likely occurred during remediation efforts as no evidence of released product was observed around the manway with the car in situ. The remaining 2 breached manways were compromised by impact forces during the derailment that resulted in an estimated 4% and 9% of product volume lost from each car, respectively. The final upright orientation of 1 of the tank cars likely helped to minimize the amount of product released. Both manway breaches were associated with extensive deformation of the top of the tank shells, which indicated that the tank cars had also experienced severe, localized collision forces.

The manway breaches were only a small contributor to the total amount of product released and site observations confirmed that the manway assemblies performed well in this occurrence.

The manway and top fitting breaches combined resulted in an estimated 33 000 litres (4%) of the total volume of product released due to the impact forces of the derailment.

1.26.7 Bottom outlet valves

The Class 117R standard requires the BOV handle mechanism to be designed to prevent unintended valve actuation when a tank car is involved in an accident. About 77% of the derailed tank cars had either damaged or missing BOV handles. In past derailments, this would have resulted in a significant number of BOV being accidently activated and releasing product. Although many BOV handles were damaged or missing, there were no valve activations, and no product was released from a BOV during the derailment.

The BOV assembly was damaged in 19 of the 35 cars and the associated skid protection of all 19 of the damaged assemblies experienced some form of impact damage. The BOV adapter performed as designed and had been sheared off or displaced in 16 of the 19 BOV assemblies, which exposed the ball valves. The valves remained closed and did not release any product.

BOV and skid-protection damage ranged from minor damage of the skid protection, caused by impact or crushing, to deformed or broken skid protection with the BOV adapter sheared off and missing. Most of the tank cars with damaged BOV and skid-protection assemblies also exhibited significant shell deformation in the same area, which indicated that they had been subjected to large collision forces. The BOV adapters broke away as designed.

1.26.8 Stub sill

AAR requirements for stub sill re-pad attachments are intended to increase the probability that if a stub sill is overloaded, it will separate between the sill and the re-pad rather than breach the tank shell.

Three tank cars had cracking in the area where the head brace, stub sill re-pad and tank head are joined. In 2 of the 3 cases, cracking extended into the tank head and created a breach. Near these breaches, the area of the head was severely deformed, which suggests they were subjected to forces that likely exceeded the tank car design. Such forces would also have contributed to the weld cracking. In 1 case, the stub sill and re-pad were torn away from the tank shell/head but no breach occurred.

1.27 TSB detailed examination of 7 tank cars removed from the accident site

Following the site examination of all 35 derailed tank cars, 7 cars were selected for a more detailed examination. These cars were selected because the damage observed and areas of interest could not be examined without jacket removal and/or further sectioning of the tank shell and structure.

All 7 tank cars were transported to CN Transcona Shops, in Winnipeg, where they were staged for inspection. In each case, the jackets and insulation were removed, fully exposing the tank shell, head, re-pads and stub sills. A list of the cars examined and of the component of interest is contained in Table 5.

* This tank car was examined but no further work was required.

Summaries of observations are contained in the following sections

1.27.1 Stub sill and re-pad welds

1.27.1.1 VMSX 280506 (7th car)

A large re-pad was welded onto the tank at each end and the stub sills were welded onto the re-pads. The purpose of this design is for the stub sill to tear away from the re-pad without damaging the tank shell or head, in the event of an accident. In this case, the A-end stub sill was torn off the tank car during the derailment (Figure 18) and a portion of the stub sill re-pad was torn off the tank head and remained attached with the stub sill as it separated. Although no breach was observed in the area of the sill pad failure, the separation of the pad from the tank head is undesired and suggested that a more detailed examination of the failure mechanism was required.

The separated stub sill with portions of the head brace and re-pad still attached (Figure 19) and the matching re-pad fracture surface (Figure 20) were sent to the TSB Engineering Laboratory for detailed examination.

Examination of one of the weld’s cross-sections showed that there was an undercut defect and poor weld bead profile. The gap between the pad and the head brace is approximately 1.8 mm; this is 3 times larger than the gap of 0.6 mm observed at another weld. Undercuts were also present where weld beads ended at the head brace (Figure 21).

The examination determined that the stub sill from VMSX 280506 was torn off in an upward direction with a twisting force. The separation occurred partially as designed, i.e., at the stub sill re-pad-to-head brace and stub sill re-pad-to-stub sill welds; however, some of the front stub sill re-pad-to-tank head welds failed. In this area, weld defects and slightly larger-than-specified weld beads that secured the head brace to the re-pad were observed. These may have contributed to the cracking of the re-pad-to-tank head weld, but the cracking did not result in a shell breach.

Notwithstanding, the cracking observed in the root of some of the front stub sill re-pad-to-tank head welds at the A-end of VMSX 280506 may have been present before the derailment. As such, this could lead to more progressive weld cracking during normal service operations and potentially lead to the crack extending into the tank head itself, if left undetected.

1.27.1.2 VMSX 280777 (34th car) and VMSX 280652 (35th car)

Similar to VMSX 280506 (7th car), tank cars VMSX 280777 (34th car) and VMSX 280652 (35th car) also experienced a separation of the stub sill re-pad-to-tank head weld. The area around the head brace was cut out of the tank cars and sent to the TSB Engineering Laboratory for examination. When the 2 sectioned components were examined, it was determined that significant localized impacts and deformation, which occurred close to the area of the re-pad and tank head separations, were the primary reasons for the failures.

1.27.2 Top fitting protective housing

Top fittings protective housings for Class 117R tank cars must conform to the requirements of Section 8.2.3.4 of TP 14877 and Appendix E, paragraph 9.3.1 of AAR MSRP M-1002.

1.27.2.1 VMSX 280939 (20th car)

The top fitting protective housing and manway re-pad area was severely impacted. The impact was significant enough to shear the 20 bolts that hold the housing on the flange cover. The remaining flange cover and manway, along with the re-pad to which they were attached, were pushed down, deforming the top portion of the tank car. The tank car was selected for further examination since the condition of the welds, re-pad and tank shell in this area could not be examined without sectioning.

Examination of the separated top fitting protective housing indicated that a sufficiently large force impacted the housing on the B-end side to deform the housing, shear all 20 bolts securing the housing to the flange cover, and separate the housing from the car (Figure 22). The assembly was removed and sent to the TSB Engineering Laboratory for a more detailed examination of the failed bolts and the damaged top fitting protective housing.

There were no re-pad weld failures observed in the area of the tank top re-pad, top fitting protective housing or manway. Several failed bolts and several intact bolts taken from 2 other tank car housing assemblies were examined metallurgically and found to have nearly identical physical properties. All bolts examined met the Grade B7 specification in terms of hardness and tensile strength. This suggests that the failure of the protective housing bolts was due to the impact forces rather than poor material properties.

1.27.2.2 VMSX 281866 (28th car)

Similar to VMSX 280939 (20th car), the top fitting protective housing and manway re-pad area of VMSX 281866 (28th car) was impacted, pushed down, and deformed the top portion of the tank car. While the housing remained securely attached to the car, this tank car was selected for further examination since the condition of the welds, re-pad and tank shell in this area could not be examined without the removal of the tank jacket which covered the re-pad. Once the jacket was removed, the re-pad welds were observed to be intact with no visible defects.

1.27.3 Stub sill tail piece extension

1.27.3.1 VMSX 281261 (29th car)

A breach was observed extending through the A-end stub sill tail piece extension and into the tank shell. The breach was a 23-inch long crack that was perpendicular to, and extended through, both sides of the stub sill tail pieces (Figure 23).

The A-end stub sill tail piece crack on VMSX 281261 was cut open to examine the fracture surface. A fracture origin was identified at a weld bead (Figure 24).

A cross-section through the crack origin and weld bead revealed that the weld bead size was estimated to average 3/16 inch, which is larger than the specified 1/8-inch weld bead. The weld bead profile was also inconsistent and would likely not pass a quality control inspection.

The cross-sectional view of the weld indicates that it penetrated approximately 1.8 mm into the tail piece extension steel. This suggests that the cracking observed most likely initiated in the weld or heat affected zone. The weld bead profile was both larger than specified and very inconsistent, resulting in a localized stress concentrator where a crack initiated, subsequently propagated into the tank, and resulted in a breach.

1.27.4 Eduction pipes

Eduction pipes are straight, 3-inch diameter, stainless steel pipes about 118 inches (3 m) long that are used for loading and unloading product. The eduction pipe is attached to a liquid valve located in the top fitting protective housing. The pipe extends from the valve at the top of the tank to the sump in the area of the BOV at the bottom of the tank.

During the field examination of the tank cars, it was noted that the eduction pipes of many of the tank cars were bent to nearly 45 degrees from straight (Figure 25). The eduction pipes from 5 of the tank cars examined at CN Transcona Yard were removed and sent to the TSB Engineering Laboratory for examination.

The eduction pipe damage observed was the result of deformation of the tank car during the derailment. The amount of tank car deformation was estimated by calculating how much the pipe was deformed.

The distance between the ends of the bent pipes from the derailed tank cars ranged from 1.8 m to 2.9 m. This suggests that the tank deformation during the derailment ranged from 0.1 m to 1.2 m. This estimation is probably conservative since some elastic rebounding of the pipe likely occurred once the tank deformation bounced back. Although some of the derailed tank cars sustained other breaches, no breach occurred as a result of tank deformation. Despite the buckling, the eduction pipes performed as designed.

1.28 TSB laboratory assessment of crude oil product information

The product safety data sheet identified the crude oil product transported in the derailed tank cars as a Cold Lake Dilbit^{Footnote 70} Blend (CLB). It was described as a naturally occurring mixture of paraffins, naphthalenes, aromatic hydrocarbons, and small amounts of sulphur and nitrogen compounds mixed with condensate. The product is primarily used to produce fuels and lubricants.

The crude oil was produced and supplied by Cenovus Energy Incorporated (Cenovus), headquartered in Calgary, Alberta. The consignee and shipper was Valero Energy Corporation (Valero), headquartered in San Antonio, Texas. The tank cars were loaded by Cenovus at the Bruderheim Energy Terminal facility in Alberta. Product loading at the Bruderheim facility followed a detailed procedure with checks and balances to ensure that both the tank car and the product loading were performed in accordance with industry and regulatory requirements.

Cenovus provided a seasonal analysis for crude oil from September 2018 which was about 5 months prior to the shipping of the crude oil and the subsequent derailment of the CN unit train. The analysis was from a product that was similar to the crude oil being shipped but the percentage of diluent that was blended with the crude oil in order to ship the product could range from 10% to 50%. Consequently, the properties of the shipped crude oil could be different at the extremes of the diluent percentage ranges, which would also have an effect on the potential for any post-derailment fire. Regardless of the percentage of diluent present, the product was appropriately classified as Class 3 flammable liquid, PG I, which is the most hazardous group in the class.

The processing, loading and classification of the CLB were all performed in accordance with the regulatory requirements.

1.28.1 Crude oil properties

Table 7 lists the relevant product properties.

1.28.1.1 Vapour pressure

Vapour pressure of crude oil is an important physical property that affects general handling and refinery practices. It is also used as an indirect measure of the evaporation rate of volatile petroleum products. The vapour pressure of the subject crude oil was reported to be 33.0 kPa.

1.28.1.2 Initial boiling point

The initial boiling point is an important physical property used in shipping and safety regulations to define flammable/combustible materials to classify them according to their associated hazard and the requisite packing group for a flammable liquid. The initial boiling point for the subject crude oil was reported to be 24.3 °C.

1.28.1.3 Flash point

The flash point temperature is a measure of the tendency of the product to form a flammable mixture with air under controlled laboratory conditions. ^{Footnote 71}, ^{Footnote 72} Flash point is also used to classify a product according to its associated hazard(s) and the requisite packing group for a flammable liquid. The flash point of the subject crude oil was −5 °C, which meant that it had to be warmer than −5 °C to produce ignitable vapour.

1.28.1.4 Density

The Canada Energy Regulator (CER) defines “heavy crude oil” as oil having a density greater than 900 kg/m³. The density of the occurrence crude oil was reported to be 938.7 kg/m³, which meets the CER definition for heavy crude oil.

1.28.1.5 Viscosity

The kinematic viscosity (at 40 °C) of the subject crude oil was reported to be 99 centistokes (cSt). For comparison, honey is typically 75 cSt and milk is around 1.1 cSt at room temperature. This confirmed site observations that the product was thick and viscous, which is consistent with heavy crude oil.

1.28.1.6 Tank car outage

Each tank car in this occurrence had an estimated car light weight of 83 000 pounds, a gross rail load (GRL) limit of 286 000 pounds and full water capacity of about 28 000 U.S. gallons. Since the tank volume and GRL is fixed, the volume of product that can be loaded in any tank car is directly related to the weight or density of the product.

Due to the variation in crude oil properties, the weight of the product can vary depending on the supplier and the amount of dilution required to ship the product. Lighter crude oil will take up more volume in the tank resulting in reduced available outage ^{Footnote 73} while heavier crude oil takes up less volume in the tank resulting in greater available outage, given the maximum authorized gross rail load of 286 000 pounds.

Federal Railroad Administration research ^{Footnote 74} indicated that the amount of product loaded into a tank car affects its puncture resistance. The research showed that greater energy is required to puncture the tank car shells as the outage value increases. The Transportation of Dangerous Goods Regulations refer to TP 14877 Section 10.4.2.3 that requires loaded tank cars to have a minimum outage of 1% at a specified reference temperature.

The product volume capacity of each tank car and the net volume of product loaded in the tank car before the derailment were used to calculate the outage of each tank car. The average outage by volume of the 35 derailed tank cars was approximately 11% (Appendix C). This large outage average can be attributed in part to the density of the crude oil being shipped.

1.28.2 Crude oil behaviour during its release following a derailment

Crude oil behaviour during its release following a derailment can be predicted by its properties. These properties include:

• the composition and quantity of the diluent released as a vapour;
• the crude oil evaporation rate, which is related to its vapour pressure;
• the crude oil viscosity, which affects the rate at which it is able to flow on the ground and penetrate the soil (this is also dependent on product and ambient temperature);
• the density of the crude oil, which determines whether it sinks or floats on water;
• the diluent composition and percentage present in the CLB can also affect the behaviour of the released product.

The release of crude oil from derailed tank cars can be accompanied by immediate ignition, a delayed ignition or no ignition at all.

Three conditions must be fulfilled for ignition of released crude oil to occur:^{Footnote 75}

1. The material must produce sufficient quantities of vapours or gases;
2. The vapours or gases must be mixed with a sufficient quantity of oxygen; and
3. The air-vapour mixture must be at a temperature high enough to auto-ignite or a source of ignition such as a spark, small flame, superheated metal part (from friction) must be present.

1.29 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer.

Safety management is a Watchlist 2020 issue. As this occurrence demonstrates, despite railways having detailed safety management system plans and risk assessments that identify mitigation strategies to minimize potential hazards, such as the number of joints that remain in CWR track, which can lead to a derailment, there are gaps that sometimes remain in the risk assessment process.

1.30 TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP076/2019 – Failure and Metallurgical Examination and Analysis
• LP092/2019 – Tank Car Examination
• LP093/2019 – Failure and Metallurgical Analysis of 117R Tank Car Components
• LP094/2019 – Examination of Product Loading and Characteristics

2.0 Analysis

Canadian National Railway Company (CN) petroleum crude oil (crude oil) unit train U73451-11 (the train) was operated in accordance with regulatory requirements and the actions of the train crew were not considered to be contributory to the accident. The analysis will focus on track maintenance, identification of compromise joint bars, track modulus, joint elimination in continuous welded rail (CWR) territory, track maintenance records, safety management systems, and emergency response.

This was the first major derailment in Canada that involved a release of crude oil from a significant number of newer Class 117R (retrofitted) tank cars and there has been interest throughout North America in how the tank cars performed during the derailment. The results of detailed tank car examination, product analysis, and observations of both will also be discussed.

2.1 The accident

At 0217 on 16 February 2019, the eastbound CN unit train of crude oil was proceeding at 49 mph on the Rivers Subdivision when a train-initiated emergency brake application occurred.

Video from the lead locomotive forward-facing video recorder showed that, as the train approached a battery box at Mile 197.48, the track was intact and there was very little vibration. However, just after the locomotive passed the battery box, there was a noticeable vibration of the recorded image and a loud noise was heard. Nine seconds later, the train went into emergency as 37 Class 117R tank cars, located in the 5th to the 41st positions behind the lead locomotives, derailed in the vicinity of Mile 197.47, near St. Lazare, Manitoba. As a result of the derailment, 17 of the tank cars were breached and released a total of about 815 000 litres of crude oil, which was mostly contained in a low-lying area to the south of the track structure, near a frozen oxbow.

The vibration observed on the video appeared to coincide with the location of 5 consecutive joints in the south rail over a distance of about 49 feet near Mile 197.47. This was also an area where the most recent track geometry inspection had revealed that the south rail exhibited consecutive surface conditions with the largest variation being about 1 inch.

The 5th car (VMSX 280746) and 6th car (VMSX 281616) behind the locomotives were the first 2 derailed cars, and both cars remained upright and attached to the head end. Although the leading no. 4 wheel set of the 5th car remained on the rail, the R4 wheel tread on the south rail displayed an impact mark from contact with a broken rail. Similar impact marks were observed on the south-side wheel treads of the 1st to 4th cars behind the locomotives, but no marks were observed on the wheels of the locomotives.

In the vicinity of Mile 197.47, among the recovered track components were the 5 joints in the south rail. The fracture surfaces of 1 set of broken joint bars (joint 1) from about Mile 197.47 exhibited features consistent with fatigue cracking and brittle failure.

Video evidence, the presence of impact marks on the south-side wheel treads of the 1st to 5th cars behind the lead locomotives, and the condition of the broken joint bars in joint 1 indicate that joint 1 failed beneath the train.

Finding as to causes and contributing factors
The accident occurred when a joint (joint 1) in the south rail failed beneath the crude oil unit train as it traversed the CN Rivers Subdivision in the vicinity of Mile 197.47.

2.2 Joint bar repair

A standard joint bar should only be installed with another standard joint bar. Because of the offset in the base of a compromise joint bar, they are manufactured as left-hand and right-hand bars so that the offsets match when installed on the field side (FS) of a rail and gauge side (GS) of a rail to make a compromise joint. Standard joint bars and compromise joint bars are not designed to be installed together. Due to an ⅛-inch offset, any attempt to install a 132/136 RE standard joint bar with a 132/136 RE compromise joint bar would take extra manual effort to line up the holes and install the bolts. A joint assembled in this fashion would also be unstable and subject to potential premature failure.

On 31 December 2018, a CN track maintenance supervisor conducted an ad hoc track inspection and identified a broken GS joint bar connecting 2 pieces of 136-pound rail in the vicinity of Mile 197.47. The joint (joint 1) was 1 of 5 joints located within a distance of 49 feet. The joint was marked with yellow paint so it could be located by a track maintenance crew. A track maintenance crew in the area was then contacted and issued instructions to replace the broken GS joint bar. The maintenance crew responded in a CN maintenance crew truck to make the repair.

CN track maintenance crews usually carry four 132/136 RE standard joint bars and four 132/136 RE compromise joint bars in each maintenance crew truck. Visually, a 132/136 RE standard joint bar and a 132/136 RE compromise joint bar look very similar with only a 1/8-inch offset in the base of a 132/136 RE compromise joint bar that distinguishes it from a 132/136 RE standard joint bar. For this reason, the CN Engineering Track Standards (ETS) require track maintenance crews to paint compromise joint bars blue before they are installed in the track.

The track maintenance crew located the broken 132/136 RE standard joint bar on the GS of the south rail, removed it and replaced it with what was perceived to be an unpainted 132/136 RE standard joint bar taken from the back of the maintenance crew truck.

Finding as to causes and contributing factors
Since unpainted standard joint bars and unpainted compromise joint bars look very similar, the CN track maintenance crew inadvertently selected a 132/136 RE compromise joint bar and installed it with the 132/136 RE standard joint bar that was already installed on the field side of the track.

2.3 Failure of joint 1

Machine vision photographic joint bar inspection of joint 1 on 23 January 2019 located it precisely at Mile 197.4751. The images for the joint confirmed that the FS joint bar was a 132/136 RE standard joint bar while the GS joint bar was a 132/136 RE compromise joint bar.

TSB laboratory examination identified that the failed joint 1 displayed remnants of yellow paint. Joint bolt thread imprints were observed on the bore of the corresponding hole in the GS joint bar. This indicates that joint 1 was misaligned (skewed), which caused the bolt to press against the bore of the GS joint bar hole within the assembled joint.

Finding as to causes and contributing factors
The installation of a compromise joint bar with a standard joint bar left the joint 1 assembly in the south rail misaligned (skewed) and unstable.

The presence of the track surface conditions indicated deteriorating infrastructure support in the area of the south rail that contained multiple joints located over a short distance. However, these were not condemnable as defects under the Transport Canada (TC)-approved Rules Respecting Track Safety, also known as the Track Safety Rules (TSR). With the high volume of train traffic on the Rivers Subdivision, joints in the track structure are subject to vertical deflection as freight car wheels pass over them. This can lead to loosening and deterioration of the joint, rail end head damage near the gap (batter), and degradation of the ballast and subgrade in the vicinity of the joint. Under these conditions, it is likely that the track infrastructure support further deteriorated between the date of the latest geometry test (23 November 2018) and the date of the accident less than 3 months later.

2.4 Track modulus

Track modulus is a composite value for the individual stiffness values of the rail, fastenings, ties, tie pads, plates, ballast, sub-ballast, and subgrade. Track modulus is influenced by the presence of joints, the quality and depth of the ballast and sub-ballast, subgrade soil and moisture conditions, tightness of tamping, and tie spacing. For example, track at bridges, tunnels, crossings, and turnouts will typically have a higher track modulus (higher stiffness) compared to the adjacent track.

As trains travel from the stiffer CWR track onto track that contains a number of consecutive short plug rails and the associated joints, greater bending forces would be introduced into the jointed area due to the difference in track modulus. When such an area is subjected to high traffic volumes and heavier trains, this can lead to more rapid deterioration of the affected track structure.

The TSR contain no requirements governing the minimum length of plug rails or the minimum distance between consecutive joints in main track. Furthermore, the TSR contain no guidance with regards to track modulus or how it may be adversely affected by multiple consecutive short plug rails and the associated joints in CWR territory. Although there is no regulatory requirement governing the use of multiple consecutive short plug rails and the associated joints in CWR, it is not considered to be a sound engineering practice.

Finding as to causes and contributing factors
The presence of 5 joints and associated plug rails located within a relatively short distance of 49 feet adversely affected the track modulus in that area and led to more rapid deterioration of joint 1 when subjected to loading as trains traversed the joint.

2.5 Train speed

Examination of previous derailments involving tank cars indicates that when crude oil unit trains derail, there are typically 3 major areas within a derailment zone:

• The initial area is where tank cars scatter randomly and usually retain shell integrity during the derailment, and there is less tank deformation resulting in smaller impact dents or breaches. The volume of product released is usually lower in this area as compared to the main body of the derailment.
• The second area contains the main body of the derailment where the tank cars generally jackknife, align side by side and/or stack up. These tank cars account for the majority of the breaches and volume of product released due to the large dynamic forces that the tank cars experience. The first derailed car acts as an anchor while the force from the trailing cars imparts large loads on the derailed cars that have come to rest, which often results in large tank deformations or punctures.
• The third and final area is at the tail end of the derailment where the remaining tank cars that derail usually scatter randomly, but do not stack up. Tank cars located in the tail end of the derailment can have a wide range of damage and product release, but generally the trailing tank car speed and related impact forces are reduced, which typically results in less tank damage and associated product loss.

The reasons for the derailed tank car performance in each zone vary, but the most common elements include the speed of the train at the time of the derailment, the size of the derailment area, the topography of the derailment zone, and the ambient temperature at the time of the derailment.

In this occurrence, the train was proceeding at 49 mph when a joint failed under the train, derailing 37 Class 117R tank cars near Mile 197.47. A total of 17 of the derailed tank cars were breached releasing about 815 000 litres of product. The circumstances related to crude oil unit train speed, the number of cars derailed and some of the tank car damage observed in this occurrence, were similar to other major accidents involving crude oil unit trains that the TSB has investigated. These circumstances were also consistent with the National Research Council of Canada (NRC) Study on the Factors that Increase the Severity of the Outcomes for Derailments Involving Dangerous Goods and Identification of Mitigation Measures.

Finding as to causes and contributing factors
Similar to other major accidents involving crude oil unit trains, although the CN crude oil train was operated in accordance with the Rules Respecting Key Trains and Key Routes, the train speed (49 mph) contributed to the number of cars derailed and to the overall severity of the derailment.

2.6 Severity of derailments and track maintenance

The National Research Council of Canada study on factors that increase the severity of derailments involving dangerous goods noted that there is a complex relationship between train speed, train length, accident cause and other factors that influence the severity of an outcome from a derailment. While there appears to be a linear relationship between the number of cars that derail and the speed of an accident, speed is not the only factor.

Derailments caused by broken rails, rail welds or broken joint bars had a much higher occurrence rate and derailed more cars per accident for a given speed. As speed increased, these types of derailments resulted in more severe accidents compared to other accident causes. In particular, loaded unit trains (including non-key unit trains) derailed more cars and were also involved in a larger percentage of these types of accidents. All these factors were present in this accident.

While improved tank car structure design has been shown to reduce the probability of dangerous goods (DG) release and the potential severity of an accident, it does not reduce the likelihood of a derailment or influence the number of cars that derail. The risk of a tank car being punctured/ breached and releasing product exists in any derailment if the speed is sufficiently high.

For example:

• On 14 February 2015, a CN crude oil unit train derailment occurred at Mile 111.7 of the Ruel Subdivision near Gladwick, Ontario. The train was travelling at 38 mph at the time of the accident. Of the 29 derailed tank cars, 19 (66%) were breached and about 1.7 million litres of product was released to either atmosphere or surface. The investigation determined that the derailment occurred when an insulated rail joint in the south rail at Mile 111.7 failed beneath the head end of the train.
• On 07 March 2015, another CN crude oil unit train derailment occurred at Mile 88.70 of the Ruel Subdivision, near Gogama, Ontario. The train was travelling at 43 mph at the time of the accident. The investigation determined that before the arrival of the train, a 16-inch-long portion of the parent south rail head had broken off due to a vertical split head rail failure within the east joint of a recent plug rail repair, leaving a gap in the south rail. The derailment occurred when the south rail failed beneath the train as it traversed the track, resulting in the derailment the 6th to 44th (39) tank cars. As a result of the derailment, 33 cars (85%) and about 2.6 million litres of crude oil (UN1267) was released to atmosphere, water, or surface.

Both of these CN derailments occurred as a result of inadequate track maintenance and related joint conditions. Although the Ruel Subdivision was considered CWR territory, it had deteriorated over several years preceding these 2 accidents as evidenced by permanent slow orders in place due to track condition and by the installation of numerous plug rails, the related joints, and additional maintenance required to maintain them.

Improved track repair and maintenance for key routes do reduce the likelihood of all derailments, including those involving DG. Following the 2 derailments on the Ruel Subdivision, CN made a significant capital investment in the Ruel Subdivision track infrastructure and improved its track inspection and maintenance practices. While the Ruel Subdivision is still primarily Class 4 track, at the time of writing this report, there had not been a significant main-track train derailment on the subdivision since March 2015.

At the time of this accident, despite a joint elimination program, the Rivers Subdivision had about 1500 joints remaining in CWR territory, many related to plug rail repairs. In the vicinity of the accident alone, between Mile 190.09 and Mile 200.75 of the Rivers Subdivision, there were 50 plug rails installed between 26 February 2015 and 09 February 2019, which was considered high for only 10 miles of CWR track. This indicates that before the accident, the condition of the Rivers Subdivision track infrastructure had begun to deteriorate as evidenced by the number of plug rail repairs, the related joints and associated track maintenance required in CWR territory.

This accident on the Rivers Subdivision and the 2 previous accidents on the Ruel Subdivision shared some common elements. Specifically:

• All 3 of these accidents involved CN crude oil unit trains operating on key routes.
• Over time, both subdivisions had begun to deteriorate as evidenced by the significant number of plug rail repairs and related joints in CWR territory.
• All 3 of these accidents occurred primarily as a result of inadequate track maintenance and related joint conditions.

The TSR establish minimum standards for track infrastructure, and some requirements in the company engineering track standards exceed the TSR requirements. However, neither the TSR nor company standards address the need for enhanced track standards for key routes despite sometimes significant increases in DG traffic volumes, as occurred in this case. This suggests that the current regulatory and company track maintenance requirements may not be sufficient to protect against derailments involving DG on key routes.

To reduce the frequency and mitigate the risks associated with accidents involving key trains on key routes, it is imperative that the key route track infrastructure be adequately maintained. While the survivability of tank cars transporting DG becomes important after an accident, the most effective strategy is to address the underlying causes of accidents to prevent them from occurring in the first place. Since the current regulatory and company track maintenance requirements did not protect against these accidents, enhanced regulatory and company track maintenance requirements for key routes is a prevention strategy that should be considered.

Finding as to risk
If accident prevention strategies do not include enhanced regulatory and company track maintenance requirements for key routes, there is an increased risk that a track-related or joint-related failure on a key route will cause a derailment and a subsequent dangerous goods release.

2.7 Joint elimination in continuous welded rail territory

The train was a key train operating on a key route and was subject to the Rules Respecting Key Trains and Key Routes (KTR). The industry recognizes that joints are a weak spot in CWR track structure and, without adequate monitoring and inspection, pose a risk of derailment. The TSB has investigated a number of derailments caused by broken joints and/or broken rail within a joint. The risks associated with derailments are further heightened for key trains travelling on key routes, as was the case in this occurrence.

In accordance with the Railway Safety Management System Regulations, 2015 (SMS Regulations) and the KTR, CN conducted a corridor risk assessment (CRA) in 2013 and updated it in 2016 and 2018. The 2018 CRA identified the presence of jointed rail as a risk and that a rail replacement program on 4 secondary main lines was one of the mitigation activities that would eliminate a potential derailment hazard. In addition, a rail joint elimination program had been ongoing on the core main line for the previous 3 years. However, there were no specific joint elimination activities listed for the Rivers Subdivision.

CN recognized the need to reduce the number of joints in the CWR track on the Rivers Subdivision. Despite a joint elimination program that had been ongoing since 2015, by 2018 only 318 of about 1850 joints, that were primarily associated with plug rail repairs in CWR territory, were eliminated from the Rivers Subdivision. Although CN track maintenance crews were expanded in 2018 to focus on joint elimination, obtaining adequate track time to affect those repairs as traffic volumes increased proved to be challenging.

Finding as to risk
If joint elimination programs in continuous welded rail territory are not given higher priority for track time on high traffic volume key routes, the timely elimination of rail joints may not always occur, increasing the risk of joint failure and derailment.

2.8 Track maintenance records

CN uses its Track Information System (TIS) to record and manage its maintenance activities. To correlate the data records to the location of the track work, the system uses both mileage points and global positioning system (GPS) coordinates. The mileage points are recorded to the 100th of a mile, which is accurate to ±52.8 feet. The GPS coordinates have a greater accuracy, as they are accurate to ±20 feet.

However, matching the GPS coordinates of the completed work with specific mileage points is not always accurate. Furthermore, rather than use the GPS system, some CN Engineering staff will manually input mileage locations, which can introduce additional location errors. The TIS also has limitations for inputting data, so the system sometimes lacks the information required for detailed investigations. For example, if several joints or short plug rails have been installed close together, it is not easy to differentiate between them in the TIS. A previous TSB investigation highlighted similar issues with the railway’s TIS.^{Footnote 76}

Finding: Other
Although the track information system used by CN is a useful tool for recording track maintenance information, it does not provide sufficient resolution to accurately assess the work conducted at individual joints and short plug rails that may be installed close together.

For this occurrence, a search in TIS was conducted for the 5 joints installed over a 49-foot section of the south rail near Mile 197.47 and only some of the repair records could be located. The TIS record for the date and repair (i.e., the installation of the compromise joint bar) should have identified the location as Mile 197.47 and shown that the GS joint bar was replaced. However, the investigation determined that once the repair of joint 1 was completed, the estimated location of the repair was incorrectly manually entered in TIS as Mile 197.30, and there was no information as to which joint bar was replaced (GS, FS, or both) or the type of joint bar installed (standard or compromise).

Under such conditions, the presence of inaccurate location information and records for track maintenance activities in the TIS can potentially hinder the effective management of short plug rail and related joint installations.

Finding as to risk
If accurate location information and records of track maintenance work performed are not consistently entered into the track information system used by CN, short plug rail and related joint installations may not be effectively maintained, increasing the risk of component failure and derailment.

2.9 Safety issues investigation

A TSB railway safety issues investigation^{Footnote 77} established a significant relationship between rail defects and the level of bulk unit train traffic. The study noted that increasing traffic volume, which often included bulk unit train traffic, had a negative effect on track infrastructure that had not been accommodated by regular track maintenance alone. The same circumstances could also apply to mainline track.

The study noted that although railways recognized that track degradation was accelerated with increases in traffic volume and bulk unit train tonnage (e.g., crude oil unit trains), a balance between increased track degradation and timely infrastructure maintenance and/or renewal had not been achieved. The study also noted that compliance with the TSR in and of itself was insufficient to ensure safety since the TSR do not provide a means to anticipate changing conditions such as increased traffic over the long term. Similar factors were present in this occurrence.

2.10 Safety management system and corridor risk assessments

In accordance with the Railway Safety Management System Regulations, 2015, CN developed and implemented a detailed safety management system (SMS), which included conducting risk assessments when changes to operations occur and/or when trend analyses showed a change in various operational or infrastructure conditions that could affect safety. CN also has processes in place to identify track infrastructure upgrades and maintenance requirements. Rail traffic volumes and track defect analyses are used to identify the need for capital program upgrades such as joint elimination programs.

Effective safety management requires the identification of systemic risks or issues to assist in the prevention of accidents. Despite the existence of a detailed CRA that identified that a joint elimination program on the core main lines was necessary to eliminate potential derailment hazards, the CRA did not identify the risks posed by an excessive number of plug rail and joint repairs in the CWR territory of the Rivers Subdivision. There were no estimated target dates for the joint elimination to be completed.

There was also no identification of the risks associated with increasingly high traffic volumes, which included significant increases in crude oil traffic, on the primarily single-track main line of the Rivers Subdivision and the difficulty that track maintenance crews experienced acquiring track time to conduct track maintenance and repairs, which included joint elimination. The high traffic volumes presented similar challenges for TC inspectors, preventing them from obtaining adequate track time to complete a regulatory track inspection in the area of the derailment about a month before the accident.

In this case, there were gaps in the CN joint elimination program that left some risks unmitigated. Consequently, as traffic and the number of track repairs required increased, the track conditions on the Rivers Subdivision continued to deteriorate as evidenced by the volume of plug rails and joint repairs in CWR territory.

Finding as to risk
If company risk assessments do not identify all potential hazards associated with increases in traffic, the appropriate mitigations, such as increased track repairs, may not be identified, increasing the risk of accidents.

2.11 Emergency response and site mitigation activities

On the north side of the rail line, crude oil had pooled near a culvert. South of the rail line, derailed tank cars were on their sides down the embankment and a large pool of crude oil had formed south of the cars. Soil berms were put in place to contain the product and prevent it from accessing the culvert on the north side of the rail line and the oxbow south of the rail line.

A product recovery program was implemented. The recovered product, contaminated soils and debris removed from the site were sent for offsite disposal at approved facilities. Derailed tank cars were offloaded, staged, cleaned, examined, and then transported for disposal.

Soil and surface water sampling locations were established along the oxbow. The results of daily sampling were initially negligible, so sampling intervals were changed to weekly with similar results. Following site mitigation, initial grading of the site was completed along with replacement of topsoil and revegetation.

As of June 2020, surface water quality was not affected by the derailment and there was no inflow to the Assiniboine River. For sediment and soil test locations that underwent resampling, the contaminants had naturally attenuated due to weather and biodegradation and were no longer detected in the environment at most of the sample locations.

Finding: Other
The measures put in place to protect responders, the public, and the environment, as part of emergency response and site mitigation activities, were generally effective.

2.12 Tank car examination and analysis of performance

A total of 17 of the 35 tank cars (49%) examined exhibited some type of breach^{Footnote 78} and released an estimated total of 815 000 litres of product, which was mostly contained in a low-lying area adjacent to the tracks. Of the breached cars, 3 (8%) had multiple types of breaches. The tank car releases varied from minor leaks to the loss of entire carloads of crude oil.

The second area or main body of the derailment zone typically experiences the most serious breaches that result in product loss. In this case, 11 of the 19 cars in the second area or main body of the derailment (16th car to the 34th car) were breached (58%), some with multiple breaches. There were 8 shell breaches, 7 of which resulted in the release of a large volume of product (> 20 000 litres).

2.12.1 Tank car breaches

The types of breaches are summarized below:

• Shell breaches accounted for about 62% of the total volume of product released primarily due to the impact forces sustained by the cars during the derailment.
• Head breaches accounted for approximately 34% of the total volume of product released due to the impact forces of the derailment. Although more than 91% of the derailed tank cars had some form of collision damage to their head shields, only 11% of the heads were breached.
• Manway and top fittings accounted for only about 4% of the total volume of product released.

None of the 35 derailed tank car pressure relief devices (PRD) or bottom outlet valves (BOV) were breached or released product.

2.12.2 Absence of a post-derailment fire

In this accident, nearly half the tank cars were breached during the derailment and released product, but no post-derailment fire occurred. The following factors likely reduced the risk of a post-derailment fire occurring:

• The crude oil had a flash point of −5 °C. The temperature at the time of the derailment (−27 °C) was below the flash point, which reduced the potential for the product to ignite.
• The relatively high viscosity of the crude oil blend, combined with the low ambient temperature, slowed the rate of release of the product.
• The relatively low vapour pressure minimized the release of vapours.
• Since the released product did not ignite upon release, the potential for a pool fire engulfing the cars, or flame impingement directly on derailed cars was eliminated.
• Due to the topography in the vicinity of the derailment, much of the released product flowed southward away from the derailed cars, downhill toward an oxbow, located well away from any potential ignition sources.

Finding: Other
The properties of the crude oil blend, the ambient temperature, and the topography of the derailment location all appear to have played a role in preventing ignition of the spilled product.

2.12.3 Tank car outage

Federal Railroad Administration research^{Footnote 79} indicated that the amount of product loaded into the tank car affects the puncture resistance of a tank car. The research showed that greater energy is required to puncture the tank car shells as the outage value increases. The Transportation of Dangerous Goods Regulations (TP 14877 Section 10.4.2.3), require that loaded tank cars have a minimum outage of 1%, at a specified reference temperature. Due to the weight of the product, the tank cars in this derailment were loaded with an average outage of about 11%.

When tank car outage is higher, there is more space available for the product to take up space within the tank in the event that the tank becomes deformed during a derailment.

Finding: Other
In this occurrence, the 11% average outage in the loaded tank cars reduced the risk of a hydraulic burst of the tank shells during the derailment, which minimized the amount of product released and the potential for a fire.

2.12.4 Detailed examination of 7 tank cars removed from the accident site

Following the site examination of all 35 derailed tank cars, 7 cars were selected for a more detailed examination. All 7 tank cars were transported to CN Transcona Shops, in Winnipeg, Manitoba, where they were staged for inspection. Components from 6 of the cars were subsequently removed and transported to the TSB Engineering Laboratory for further examination with the following results.

2.12.4.1 Stub sill reinforcing pad-to-tank head weld failures

Association of American Railroads (AAR) specifications require a design that permits the head brace-to-reinforcing pad (re-pad) weld to separate while the stub sill re-pad remains securely fastened to the tank head in the event of an accident. The design is required to minimize the potential for a tank head breach in the event that a stub sill is impacted, sustains damage or separates from the tank during a derailment. However, in this accident, tank cars VMSX 280506 (7th car), VMSX 280777 (34th car) and VMSX 280652 (35th car) each experienced failures of the welds securing the stub sill re-pads to the tank heads that resulted in the stub sill re-pad separating from the tank head.

2.12.4.2 Stub sill tail piece extension

The cracking of the VMSX 281261 (29th car) A-end stub sill tail piece extension extended into the tank shell and caused a breach that resulted in a loss of product. The cracking of the A-end stub sill tail piece extension initiated at a poor-quality weld that secured the belly pan flashing to the stub sill. The weld bead profile was both larger than specified and very inconsistent. Subsequently, a localized stress concentrator developed that resulted in the initiation of a crack that propagated into the tank and caused a breach.

Finding as to causes and contributing factors
The A-end stub sill tail piece extension cracking observed on car VMSX 281261 (29th car) was the result of poor weld quality of the belly pan flashing that propagated from the weld into the tank shell and resulted in a tank breach and product loss.

2.12.4.3 Weld quality

Of the 7 tank cars subjected to detailed analysis in CN Transcona Yard, 4 exhibited weld quality issues. The A-end stub sill tail piece extension cracking observed on the 29th car resulted in a tank breach. Although the failures of the welds securing the tank car stub sill re-pads to the tank heads of the 7th, 34th, and 35th tank cars did not result in a breach, the potential for breach was there as the welds did not conform to specifications and did not perform their intended function. This suggests that there was a potential welding quality control issue at the time the tank cars were constructed.

Finding as to risk
If the quality of tank car welds is not maintained to specifications during tank car construction, there is an increased risk for a tank car breach to occur during a derailment.

2.12.4.4 Top fitting protective housing

The Class 117R tank cars examined have a robust design in the area of the tank top re-pad, top fitting protective housing, and manway. The energetic forces that are applied to tank car top fitting protective housings during a derailment often result in significant deformation but no breach.

Finding: Other
The top fitting protective housing bolts on car VMSX 280939 (20th car) met the required standards and likely sheared due to excessive impact loading of the housing during the derailment without compromising the integrity of the tank.

2.12.4.5 Eduction pipes

In this accident, the deformation of the eduction pipes observed in the tank cars was the result of deformation of the tank car during the derailment. The amount of deformation was estimated by calculating how much the eduction pipe was deformed. For the 5 eduction pipes examined, the tank deformation ranged from 0.1 m to 1.2 m. Although some of the cars sustained other breaches, no breach was observed as a result of tank deformation.

In the main body of a derailment, tank cars stack up and exert crushing loads on other tank cars. This type of loading is consistently one of the most significant contributors to large breaches in the tank that result in large volumes of product being released during a derailment.

Finding: Other
The examination of eduction pipe deformation following a derailment may improve understanding of the dynamics within a derailment, which could lead to improved tank car testing, qualification, and design.

2.13 Overall performance of the Class 117R tank cars in this derailment

All the tank cars involved in this occurrence were Class 117R tank cars. These were essentially Class 111 tank cars built to the AAR CPC-1232 standard equipped with jackets, insulation, full head shields, and retrofitted with modified BOV handle arrangements to meet the Class 117R standard. Several of these features appear to have influenced the amount of crude oil that was released as a result of the derailment.

In previous derailments, it was observed that BOV handles often had moved to the open position during the derailment which accidently activated the BOV and released product. This did not occur in this accident.

All head breaches were associated with significant deformation of the head, which suggests that they were subjected to elevated collision forces.

Finding: Other, as to Class 117R tank car performance
Despite elevated collision forces, the presence of full head shields on all the derailed tank cars likely minimized the number of tank heads that breached.

The temperature of the crude oil at the time of the accident was colder than its flash point; therefore, the released product did not ignite.

3.0 Findings

3.1 Findings as to causes and contributing factors

These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence.

1. The accident occurred when a joint (joint 1) in the south rail failed beneath the crude oil unit train as it traversed the Canadian National Railway Company’s Rivers Subdivision in the vicinity of Mile 197.47.
2. Since unpainted standard joint bars and unpainted compromise joint bars look very similar, the Canadian National Railway Company track maintenance crew inadvertently selected a 132/136 RE compromise joint bar and installed it with the 132/136 RE standard joint bar that was already installed on the field side of the track.
3. The installation of a compromise joint bar with a standard joint bar left the joint 1 assembly in the south rail misaligned (skewed) and unstable.
4. With deteriorating infrastructure support, the misalignment of joint 1 led to a rapid loosening of the joint, which initiated fatigue cracking in the joint bars.
5. The joint bars failed when instantaneous overstress fractures occurred from the extremities of the fatigue cracking and extended through the remaining joint bar cross-sections, which could no longer withstand the normal service loads applied as the train traversed the area.
6. The presence of 5 joints and associated plug rails located within a relatively short distance of 49 feet adversely affected the track modulus in that area and led to more rapid deterioration of joint 1 when subjected to loading as trains traversed the joint.
7. Similar to other major accidents involving crude oil unit trains, although the CN crude oil train was operated in accordance with the Rules Respecting Key Trains and Key Routes, the train speed (49 mph) contributed to the number of cars derailed and to the overall severity of the derailment.
8. The A-end stub sill tail piece extension cracking observed on car VMSX 281261 (29th car) was the result of poor weld quality of the belly pan flashing that propagated from the weld into the tank shell and resulted in a tank breach and product loss.

3.2 Findings as to risk

These are conditions, unsafe acts or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences.

1. If compromise joint bars are not clearly identified before being placed in a maintenance crew truck, there is an increased risk that a compromise joint bar might be installed with a standard joint bar, which can lead to joint bar failure with a commensurate risk of derailment.
2. If accident prevention strategies do not include enhanced regulatory and company track maintenance requirements for key routes, there is an increased risk that a track-related or joint-related failure on a key route will cause a derailment and a subsequent dangerous goods release.
3. If joint elimination programs in continuous welded rail territory are not given higher priority for track time on high traffic volume key routes, the timely elimination of rail joints may not always occur, increasing the risk of joint failure and derailment.
4. If accurate location information, and records of track maintenance work performed are not consistently entered into the track information system used by the Canadian National Railway Company, short plug rail and related joint installations may not be effectively maintained, increasing the risk of component failure and derailment.
5. If company risk assessments do not identify all potential hazards associated with increases in traffic, the appropriate mitigations, such as increased track repairs, may not be identified, increasing the risk of accidents.
6. If the quality of tank car welds is not maintained to specifications during tank car construction, there is an increased risk for a tank car breach to occur during a derailment.

3.3 Other findings

These items could enhance safety, resolve an issue of controversy, or provide a data point for future safety studies.

1. Although the track information system used by the Canadian National Railway Company is a useful tool for recording track maintenance information, it does not provide sufficient resolution to accurately assess the work conducted at individual joints and short plug rails that may be installed close together.
2. The measures put in place to protect responders, the public, and the environment, as part of emergency response and site mitigation activities, were generally effective.
3. The properties of the crude oil blend, the ambient temperature, and the topography of the derailment location all appear to have played a role in preventing ignition of the spilled product.
4. In this occurrence, the 11% average outage in the loaded tank cars reduced the risk of a hydraulic burst of the tank shells during the derailment, which minimized the amount of product released and the potential for a fire.
5. The failure of the stub sill reinforcing pad-to-tank head weld of tank car VMSX 280506 (7th car) was due to a combination of the loading of the stub sill that occurred during the derailment and the poor quality of the welds securing the head brace to the stub sill re-pad and the stub sill re-pad to the tank head.
6. Although none of the failures of the welds securing the tank car stub sill re-pads to the tank heads of tank cars VMSX 280506 (7th car), VMSX 280777 (34th car), and VMSX 280652 (35th car) resulted in a tank breach, the quality of the welds was insufficient for the welds to perform their intended function.
7. The top fitting protective housing bolts on car VMSX 280939 (20th car) met the required standards and likely sheared due to excessive impact loading of the housing during the derailment, without compromising the integrity of the tank.
8. The examination of eduction pipe deformation following a derailment may improve understanding of the dynamics within a derailment, which could lead to improved tank car testing, qualification, and design.

3.3.1 Other findings as to Class 117R tank car performance

1. The new requirements for the bottom outlet valve handle system design contributed to a reduced volume of product loss.
2. Despite a large number of top fitting protective housings being significantly damaged, they continued to minimize damage to the operating valves and pressure relief devices during the accident sequence. No reinforcing pad (re-pad) weld failures were observed in the area of the tank top re-pads.
3. Some of the energy generated during the derailment was absorbed by the collapse of tank car jackets and insulation, which also protected against shell punctures and reduced the risk of hydrostatic tank burst/rupture during the derailment.
4. Despite elevated collision forces, the presence of full head shields on all the derailed tank cars likely minimized the number of tank heads that breached.
5. The absence of fire at this derailment site minimized additional product release as the crude oil that remained in the tank cars did not burn and no tank cars experienced structural failure due to exposure to a pool fire or as a result of direct flame impingement.
6. Since the derailed Class 117R tank cars sustained no thermal damage, no comparison of tank car fire survivability could be made to previous TSB investigations.
7. The overall performance of the Class 117R tank cars was somewhat improved as compared to legacy Class 111 tank cars and Class 111 tank cars that were built to the unjacketed CPC-1232 standard that have been examined in previous TSB derailment investigations involving crude oil unit trains.

Safety action

4.1 Safety action taken

4.1.1 Transportation Safety Board of Canada

Following this accident and 2 additional serious Canadian Pacific Railway Limited crude oil unit train derailments near Guernsey, Saskatchewan, on 09 December 2019 (TSB Occurrence R19W0320) and 06 February 2020 (TSB Occurrence R20W0025), on 04 March 2020 the TSB issued Rail Safety Advisories (RSA) 02/20 and 03/20 to Transport Canada (TC).

The RSAs noted that since 2015, including this accident, the TSB had deployed to 7 train derailments involving tank cars that were transporting crude oil, 6 of which resulted in a significant release of product. A review of the 7 accidents revealed the following:

• All 7 derailments occurred on a key route on which the track was maintained in accordance with the Rules Respecting Track Safety, also known as the Track Safety Rules (TSR), Class 3 or 4 standard.
• All 7 derailments occurred as a result of a broken rail, broken joint bars or other track infrastructure condition.
• For 6 of the 7 cases:
• Train speed ranged from 38 mph to 49 mph.
• Between 29 and 39 tank cars loaded with petroleum crude oil derailed.
• A total of 8.43 million litres of petroleum crude oil was released.
• The derailment occurred during the winter months.

4.1.1.1 Rail Safety Advisory 02/20 - Modifying key train speed based on various train risk profiles

In RSA 02/20, the TSB indicated that train speed is one of the primary factors that contributes to the severity of a derailment. However, other factors such as train length, train weight, the position of the first car(s) derailed, the position of the cars in the train, and tank car design also play a role. The RSA suggested that to reduce the frequency of these accidents and the commensurate risk to the public, property and the environment, TC should further review and modify key train speeds, as appropriate, based on various train risk profiles while also considering other factors that influence the severity of a derailment.

4.1.1.2 Rail Safety Advisory 03/20 - Enhanced track standards for key routes

In RSA 03/20, the TSB noted that as train operations have evolved, the TSR have not kept pace. The current TSR came into force on 25 May 2012, almost 4 years before the TC-approved Rules Respecting Key Trains and Key Routes came into force in February 2016. While the TSR establish minimum standards for track infrastructure, there are no provisions in the TSR to address the need for enhanced track standards for key routes despite sometimes significant increases in dangerous goods traffic volumes on these routes.

To reduce the frequency and mitigate the risks associated with accidents involving key trains on key routes, it is imperative that the track infrastructure be adequately maintained. Considering that the underlying causes of the 7 accidents identified were all related to failures of track infrastructure, TC was advised that the current TSR do not address the increased risks associated with the operation of key trains. The TSB suggested that TC consider revising the Rules Respecting Track Safety to include enhanced track standards for key routes.

4.1.2 Transport Canada

4.1.2.1 Revision of the Rules Respecting Key Trains and Key Routes

In response to the TSB RSA 02/20, TC issued a number of Ministerial Orders (MO) including the following.

4.1.2.1.1 Ministerial Order MO 20-05 issued pursuant to Section 32.01 of the Railway Safety Act

On 01 April 2020, TC issued Ministerial Order MO 20-05 which indicated that pursuant to the provisions of 32.01 of the Railway Safety Act, federally regulated railway companies were ordered to implement additional safety measures for key trains.

The MO identified that there were a number of recent derailments of trains transporting dangerous goods which resulted in the breach of tank cars and the release of dangerous goods, including the St-Lazare derailment in Manitoba in 2019, the Guernsey derailment in Saskatchewan in 2019 and the second Guernsey derailment in Saskatchewan in 2020.

Federally regulated railways were ordered to implement an additional definition for a higher-risk key train, which was defined as an engine with cars that include loaded tank cars carrying crude oil or liquefied petroleum gases, as defined in the Transportation of Dangerous Goods Act, 1992, in a continuous block of 20 or more tank cars, or 35 or more tank cars dispersed through a train.

The MO also included additional speed restrictions, requirements for continuous welded rail (CWR) joint management, and requirements for installing replacement (plug) rail.

MO 20-05 was effective immediately, with the exception of the requirements for CWR joint management and installing replacement (plug) rails which were planned to come into effect on 01 September 2020. This MO will remain in effect until the Minister approves revised Rules Respecting Key Trains and Key Routes that incorporate the above measures on a permanent basis.

4.1.2.1.2 Ministerial Order MO 20-06 issued pursuant to Section 19 of the Railway Safety Act

On 01 April 2020, TC issued Ministerial Order MO 20-06 pursuant to the provisions of paragraph 19(1)(a) of the Railway Safety Act. The MO ordered federally regulated railway companies to revise the Rules Respecting Key Trains and Key Routes.

The MO required that revised rules be based on an assessment of safety risk and, at a minimum, incorporate new definitions, including of “higher-risk key trains”, which is to be defined as “an engine with cars that include loaded tank cars carrying crude oil or liquefied petroleum gases, as defined in the Transportation of Dangerous Goods Act, 1992, in a continuous block of 20 or more tank cars, or 35 or more tank cars dispersed through a train”; additional speed restrictions; requirements for CWR joint management; and requirements for installing replacement (plug) rail.

The MO required that railways file the revised Rules Respecting Key Trains and Key Routes with the Minister of Transport for approval within 210 days of the date that the MO was issued.

4.1.2.1.3 Ministerial Order MO 20-10 issued pursuant to Section 32.01 of the Railway Safety Act, MO-05 repealed

On 06 November 2020, TC issued Ministerial Order MO 20-10 pursuant to the provisions of section 32.01 of the Railway Safety Act. With the issuance of MO 20-10, MO 20-05 was repealed, and federally regulated railway companies were ordered to implement additional safety measures for key trains which included:

• Part I: Additional key train speed restrictions when a winter operation risk mitigation plan is not in place
• Part II: Requirement for Continuous Welded Rail Joint Management
• Part III: Requirement for installation of replacement (plug) rail
• Part IV: Key train speed restrictions with a winter operation risk mitigation plan in place
• Part V: Requirements for winter operation risk mitigation
• Part VI: Requirements for Rail Break Detection Technology

This order was effective immediately and will remain in effect until the Minister approves revised Rules Respecting Key Trains and Key Routes that incorporate the above measures on a permanent basis.

4.1.2.1.4 Revised Rules Respecting Key Trains and Key Routes

On 22 February 2021, TC approved the revised Rules Respecting Key Trains and Key Routes submitted by the industry. The revised rules came into effect on 22 August 2021.^{Footnote 80} The revised rules are as follows:

• Require companies to develop and adhere to a maintenance and inspection plan for permanent rail joints and temporary rail joints in CWR.
  • The inspection plan is to include time limits for the retention of temporary rail joints until permanently repaired, as well as the requirement for records detailing the location, installation, inspection, and maintenance dates for temporary rail joints.
• Restrict the maximum operating speed of key trains in CMAs.
• Define higher-risk key trains as those trains that include loaded tank cars carrying crude oil or liquefied petroleum gases in a continuous block of 20 or more tank cars or 35 or more tank cars dispersed through a train, and
  • further restrict the maximum operating speed of higher-risk key trains, when compared to key trains operating both within and outside of CMAs.
• Contain new requirements for Winter Operation Risk Mitigation Plans.

4.1.2.2 Revision of the Rules Respecting Track Safety

In response to the TSB RSA 03/20, TC issued MO 20-07.

4.1.2.2.1 Ministerial Order MO 20-07 issued pursuant to Section 19 of the Railway Safety Act

On 01 April 2020, TC issued Ministerial Order MO 20-07 which indicated that, pursuant to the provisions of paragraph 19(1)(a) of the Railway Safety Act, federally regulated railway companies were ordered to revise the TSR.

The revised TSR should be based on an assessment of safety risks, track-related derailment causes, evolving technology, current railway internal standards and industry best practices, and shall, at a minimum, address the following elements in 3 phases:

Phase 1 elements

• Training, qualification, and quality assurance
• CWR management
• Track geometry
• Rail wear management
• Rail surface management

Phase 2 elements

• Track inspection frequency
• Automated track inspection technology

Phase 3 - Structures / Other elements

• Requirement for concrete ties
• Requirement for inspection of yard tracks over which passenger equipment carrying passengers operates
• Requirements to develop and report on key track performance indicators
• Requirement to file with TC the most recent version of company track standards

The dates for filing the revised TSR with the Minister are 01 April 2021 (Phase 1), 02 October 2021 (Phase 2) and 02 April 2022 (Phase 3).

On 31 May 2021, TC approved the Phase 1 revisions to the TSR. The revised TSR Part I, Section 9, Items b) through f) includes quality assurance requirements for safety critical maintenance and repair activities.^{Footnote 81} These quality assurance requirements are expected to decrease the likelihood of derailments resulting from repair and maintenance activities that are inconsistent with the railway company’s standards and procedures.

Part II, Subpart D, Section IX of the revised TSR includes requirements for CWR Management Plans that include comprehensive installation, inspection, and maintenance requirements.^{Footnote 82}

The revised TSR also include requirements for railway companies to prepare and adhere to Track Geometry Management Plans, Rail Surface Management Plans, and Rail Wear Management Plans.

4.1.3 Canadian National Railway Company

CN provided the following information with regards to safety action taken:

CN now requires the outside surface of all compromise joint bars, which is the side of a joint bar that is exposed when installed in track, to be spray-painted royal blue by the supplier. This change allows for compromise joint bars to be more easily differentiated from standard joint bars.

The occurrence joint bars and rail were returned to CN for use in its training program for engineering personnel.

For training purposes, CN is also developing multiple rail track and joint bar kits made of lightweight composite material. Because rail track and joint bar kits could weigh up to 400 pounds, light weight kits are better suited for transport and practical, hands-on training.

The following items were part of CN’s ongoing track maintenance initiatives for the Rivers Subdivision:

• Between 01 March 2019 and 31 December 2019:
  • A total of 1019 temporary plug rails, and the associated 2038 rail joints, were eliminated from the Rivers Subdivision (main track and sidings included).
  • A total of 192 867 feet of CWR rail was installed/replaced on the Rivers Subdivision as part of CN capital programs.

Appendices

Appendix A – Summary of tank car breaches

Note: None of the cars in the consist were breached at the bottom outlet valve.

Appendix B – Summary of the volume of crude oil released

* Negative numbers in the Total volume lost column represent an estimated recovery volume greater than the actual loading volume in the tank car. Any discrepancy between the volume of product recovered and the presence of a confirmed tank car breach is the result of inaccuracies during the product recovery tracking process for each tank car. However, the Total volume loss is unaffected as it is based on Total volume transported versus Total volume recovered.

Appendix C – Tank car outage calculations

The volume capacity of each tank car and the net volume of product loaded in the tank car before the derailment were used to calculate the outage of each tank car.