Technical investigation of the Lac-Mégantic rail disaster

Police helicopter view of Lac-Mégantic, the day of the derailment

The technical investigation of the Lac-Mégantic rail disaster looked into the instigating and mitigating factors regarding the incident, one of the deadliest in Canadian railway history, with 47 deaths. It identified 18 factors related to the cargo, maintenance of the tracks, maintenance and operation of the train, and weak government oversight all combined to produce the disaster. Five recommendations for change resulted from the investigation.

Background

Parent article: Lac-Mégantic rail disaster

The involved tracks and train were operated by the Montreal, Maine and Atlantic Railway (MMA, also MM&A). Over the decade leading up to this accident, aggressive cost cutting^[1][2] for freight train operations and continued deferred maintenance on the tracks resulted in much of the trackage being in marginal condition.^[3] By 2013, speed reductions were required on 23 portions of the line involved in the incident, including a 5 mph (8.0 km/h) limit at Sherbrooke yard and 10 miles per hour (16 km/h) on a 11 miles (18 km) stretch east of Magog.^[4]

Freight trains operated by MMA were allowed (not "permitted", see parent article) by regulators in Canada (Transport Canada) and the United States (Federal Railroad Administration) to have Single Person Train Operation (SPTO, alternately OPTO) status (1 operator). The permit process, which requires public input, was not followed. The Canadian regulator and the MMA entered into a negotiation process at the culmination of which, sometime before the second week of July 2012, the government allowed MMA to reduce their manpower to SPTO. The Maine regulator had already allowed SPTO status before the first week of April 2012.^[5][6][7]

In October 2012, eight months before this accident, the lead locomotive (5017) was sent to MMA's repair shop following an engine failure. The engine was repaired with an epoxy-like material that lacked the required strength and durability. This material failed in service, leading to engine surges and excessive black and white smoke. Eventually, oil began to accumulate in the body of the turbocharger, where it would overheat and catch fire on the night of the derailment.^[8]

Events shortly prior to the derailment

The involved freight train, known as MMA 2, consisted of five head-end locomotives, led by # 5017; one remote-control "VB" car (used to house the Locotrol equipment necessary for MMA’s single engineer train operation); and one loaded box car used as a buffer car; followed by 72 non-pressure dangerous goods DOT-111 tank cars,^[9] each loaded with 113,000 litres (25,000 imp gal; 30,000 US gal) of petroleum crude oil (Class 3, UN 1267).^[10][11][12] It departed the Canadian Pacific Railway (CPR) in Côte Saint-Luc^[13][14] on July 5 earlier in the day and subsequently changed crews at the MMA yard in Farnham.^[15] MMA 2 departed Farnham and stopped at the designated MMA crew change point in Nantes at approximately 23:00. Nantes is located 11 kilometres (6.8 mi) west of Lac-Mégantic. The tracks in this location are at a 1.2% grade (slope).^[10]

Following the MMA's operating plan,^[16] the engineer parked the freight train on the main line. He set the brakes and followed standard procedure by shutting down four of the five locomotives.^[17] The train could not be parked on the adjacent siding because MMA used it routinely to store empty boxcars.^[18][19] The Nantes siding has a derail that could have stopped the train from accidentally departing.^[20] According to Transport Canada, it is unusual to leave an unattended train parked on a main line,^[21] but there were no regulations in place to prevent that behaviour.^[22]

The engineer left the lead locomotive, #5017, running to keep air pressure supplied to the train's air brakes and also applied a number of manual hand brakes.^[23] The engineer also attempted a brake test but incorrectly left the locomotive air brakes on during the test; this gave the false impression that the hand brakes alone could hold the train.^[8] The engineer then contacted the rail traffic controller in Farnham, Quebec, to advise that the train was secure. Next, the engineer contacted the rail traffic controller in Bangor, Maine to report that the lead locomotive had experienced mechanical difficulties throughout the trip and that excessive black and white smoke was coming from its smoke stack. Expecting the smoke to settle, they agreed to deal with the situation the following morning.^[8]

Having finished his work, the engineer departed by taxi for a local hotel for the night.^[24][25] After the engineer had departed, the Nantes Fire Department as well as a police officer from the Sûreté du Québec's Lac-Mégantic detachment responded to a 9-1-1 call from a citizen at 23:50, who reported a fire on the first locomotive;^[26] according to Nantes Fire Chief Patrick Lambert, "We shut down the engine before fighting the fire. Our protocol calls for us to shut down an engine because it is the only way to stop the fuel from circulating into the fire."^[27] The fire department extinguished the blaze and notified MMA's rail traffic controller in Farnham. MMA did not grant permission to the engineer to return to the scene, instead summoning a track maintenance foreman unfamiliar with the operation of railway air brakes.^[28] By 00:13 two MMA track maintenance employees had arrived from Lac-Mégantic; the Nantes firefighters left the scene as the MMA employees confirmed to the police officer and to the Farnham rail traffic controller that the train was safe.^[29]

Derailment and explosion

Area affected by the fires

With all the locomotives shut down, the air compressor could no longer supply air to the air brake system. As air naturally leaked from the brake system, the main air reservoirs were slowly depleted, gradually reducing the effectiveness of the locomotive air brakes. At 00:56, the air pressure had dropped to a point at which the combination of hand brakes and (now-reduced) locomotive air brakes could no longer hold the train, and it began to roll downhill toward Lac-Mégantic, just over seven miles away.^[8][30] The track was not equipped with signals to alert the rail traffic controller to the presence of a runaway train.^[18]

MMA 2 entered the town of Lac-Mégantic at up to 101 kilometres per hour (63 mph)^{[17][31][32][33][34]} entering a curve in an area with a speed limit of 16 kilometres per hour (10 mph)^[34] Sixty-three of the 72 tank cars as well as the buffer car derailed, with many of the tank cars rupturing badly.^[8] About six million litres of petroleum crude oil was quickly released; the fire began almost immediately,^[8] generating a ball of fire three times the height of the downtown buildings.^[35] Heat from the fires was felt as far as 2 kilometres (1.2 mi) away.^[36] People jumped from the third floor of buildings in the central business district to escape the fire. As the blazing oil flowed over the ground, it entered the town's storm sewer and emerged as huge fires towering from other storm sewer drains, manholes, and even chimneys and basements of buildings in the area.^[35]

Investigation

The Transportation Safety Board of Canada (TSB), which is prevented statutorily from issuing judgements or finding blame, started an investigation into the accident under reference R13D0054,^[37] deploying a team of 20 experts to the site to gather evidence and interview officials and witnesses. While the investigation was underway, the Transportation Safety Board asked Transport Canada review the Canadian Rail Operating Rules and special instructions by railways that cover securing equipment. They also advised that trains carrying dangerous goods should not be left unattended on a main track.^[38]

On July 8, Transport Canada investigated a second MMA train reported by police as unattended since July 5 on the Vachon Station siding near Frontenac. That train had been parked on a slope with only five handbrakes set, and did not comply with federal regulations. At least nine brakes should have be used to secure the train on level track, with additional handbrakes applied when on an incline.^[39] A local resident had posted online video of an unattended locomotive with a cabin door ajar and an engine left running.^[40]

On July 19, Transportation Safety Board of Canada chief investigator Donald Ross said "Not enough brakes were applied to the train that derailed. A sufficient number of brakes needed to be applied and the quality of brakes needs to be examined."^[41]

TSB investigators looked into the air brake system which is normally charged to 90 PSI (621 kPa) and, when the engineer reduces the air pressure to 65 pounds per square inch (448 kPa), applies the brakes. Investigators tried to determine how the air brakes were released by examining the theory that a relatively small change in air pressure could have produced a "pressure wave" to trigger a quick release of the brakes.^[12] However, Wally Kirkpatrick, manager of rules and operations at RTC Rail Solutions, said the air brakes could have leaked off over time once the engine was shut down.^[42]

Because crude oil generally does not readily ignite, TSB investigators looked into the composition of the train's cargo. Theories under investigation were:^[43]

• The oil may have contained additives to speed up the transfer of the syrupy oil. This is common when shipping via pipelines but rare for shipping by rail.^[43]
• There may have been chemical contaminants in the tank cars from a previous shipment. However, the MMA had a detailed bill of lading from a U.S. oil services company stating there were no chemicals in the crude.^[43]
• The oil may have been contaminated with chemicals used in the fracking process.^[44]
• Bakken oil can contain high levels of hydrogen sulphide gas; hydrogen sulphide is flammable, corrosive, poisonous, and explosive.^[43][45] Pipeline operators Tesoro and Enbridge no longer accept crude with more than five parts per million H₂S, citing safety concerns.^[44]
• A local propane tank near the derailment might have exploded when struck by a rail car.^[43]
• High temperatures in Quebec at the time of the derailment may have made the oil cargo more flammable.^[43]

On July 19, 2013, the TSB issued an urgent safety advisory requesting that Transport Canada consider reviewing all railway operating procedures to ensure that trains carrying Dangerous goods are not left unattended on the main track.^[16]

Also on July 19, the TSB issued another urgent safety advisory requesting that Transport Canada review Rule 112 of the Canadian Rail Operating Rules (CROR) and all related railway special instructions to ensure that equipment and trains left unattended are properly secured in order to prevent unintended movements. The TSB noted that most railway special instructions specify the minimum number of hand brakes needed in general operating conditions but not always for specific conditions. It is often left up to the operating employee to determine the number of hand brakes to apply. The employee must take into consideration the slope or grade of the track and the approximate tonnage of the equipment to be secured at a specific location. The TSB also noted that the effectiveness of the hand brake system varied from car to car depending on the design, condition and maintenance, and also from one operator to another due to differences in physical capability and personal technique. The TSB also stated that it is inadequate for railway operators to depend on the push–pull test to verify whether the hand brakes can hold the cars.^[46]

On August 1, the TSB said it has taken samples of the oil for analysis.^[47] Both Canadian^[48] and US investigators^[49] have found the Bakken crude was not identified correctly in shipping documents,^[50] and the incorrect classification led to its volatility being underestimated.^[51] The following month, the TSB identified a defective piston in the head engine as the cause of the original fire in Nantes.^[52]

Transport Canada issued notices of non-compliance after inspection of six track segments found fair to substandard rail conditions which legally must be fixed, including a concentration of defective ties on a section near a propane storage facility.^[53] On September 12, following a failed inspection, Transport Canada shut down one segment of the MMA line until hazards could be fixed.^[53][54][55] Subsequent inspections led to an October 11 embargo on the line between Lennoxville and Lac-Mégantic.^[56]

On August 19, 2014, the TSB issued its report documenting findings and recommendations.

Findings

In its August 2014 report, the TSB identified 18 distinct causes and contributing factors, many of them influencing one another:^[8][57][58]

• Factors related to the locomotive (5017), the lead locomotive on the derailed train:
  • Mechanical problems not remedied: An engineer reported trouble with the locomotive 5017’s engine on a separate trip two days before the crash in Lac-Mégantic. The locomotive remained in service despite that concern.^[57]
  • Non-standard engine repair failure: A quick and cheap repair using inappropriate materials allowed oil to accumulate in the turbocharger and exhaust manifold, resulting in a fire.^[57]
  • Locomotive engine fire: In order to put out the fire, the Nantes fire department shut down the locomotive thus inadvertently disabling the air brakes.
  • Safety device not wired to initiate braking: The "reset safety control" system was not wired to set the entire train’s brakes in the event of an engine failure.^[57]
• Factor related to the tank cars:
  • Breached tank cars and highly volatile crude oil: The tank cars were prone to puncture and the Bakken oil was highly volatile.
• Factors related to Transport Canada's role in providing oversight of railway operations:
  • Inadequate oversight of operational changes: Transport Canada did not provide adequate regulatory oversight to ensure the associated risks were addressed when the MMA made significant operational changes.^[58]
  • Limited follow-up on safety deficiencies: Transport Canada did not follow up to ensure that recurring safety deficiencies were dealt with.^[57]
  • Inefficient program to audit safety management systems (SMS): Audits were limited in frequency and scope and had no follow-up procedure.
• Factor related to the derailment:
  • Excessive train speed for track: At the point of derailment, the train was travelling at 105 km/h, more than triple the typical speed for that location.^[57]
• Factors related to train securement:
  • Independent air brakes leaked off: With all the locomotives shut down, the air compressor no longer supplied air to the air brake system. As air leaked from the brake system, the main air reservoirs were slowly depleted, gradually reducing the effectiveness of the locomotive air brakes.
  • Improper handbrake test: The engineer erroneously did the brake test with the locomotive air brakes left on. This gave the false impression that the hand brakes alone would hold the train.
  • Insufficient hand brakes: The engineer set 7 hand brakes. The TSB said that a minimum of 17 were technically required and perhaps as many as 26.
• Factors related to MMA practices:
  • Train left unattended on hill: The train was parked unattended on the main line, on a descending grade, and the securement of the train was reliant on a locomotive that was in deteriorating operating condition.^[58]
  • No additional safety defences: No additional physical safety defences (such as a derail) were in place to prevent the uncontrolled movement of the train.^[58]
  • Ineffective training and oversight on train securement: The MMA did not provide effective training or oversight to ensure that crews understood and complied with rules governing train securement.^[58]
  • Weak safety culture: The MMA was reactive rather than proactive when it came to safety. The MMA had weak safety training. There were also significant gaps between the company's operating instructions and how work was done day to day.
  • Safety management system (SMS) not fully implemented: Although MMA had developed a safety management system in 2002, the company did not begin to implement it until 2010. By 2013, the SMS was still not functioning effectively.
  • Not effectively managing risks: When making significant operational changes, the MMA did not thoroughly identify and manage the risks to ensure safe operations.^[58]

Single person train operation was initially investigated as a 19th factor in the derailment, but the investigation was not able to conclude whether having another crew member would have prevented the accident. It was thus was omitted from the final report.^[8][59] A second operator could have provided a second opinion about the thick smoke from the defective engine or verified the number of brakes to be set to hold the train on an incline.

The TSB report also contains 16 findings as to risk even though these safety risks did not lead directly to the accident. Some of the risks that the TSB recommends to be addressed are:

• the continuing risk of leaving trains unattended.
• the risk of implementing single-person train operations.
• the risk of not systematically testing petroleum crude oil.
• the risk of not planning and analysing routes on which dangerous goods are carried.
• the risk of not having emergency response assistance plans in place.
• the risk of Transport Canada not ensuring that safety management systems work effectively.

Recommendations

In its August 2014 report, the TSB documented the following recommendations:^[8]

• Transport Canada must take a more hands-on role when it comes to railways' safety management systems—making sure not just that they exist, but that they are working and that they are effective. (New recommendation.) Railways draw up Safety Management Systems and file them with Transport Canada for approval. The TSB wants Transport Canada to audit Safety Management Systems frequently and in depth to ensure they are being implemented as designed.^[60]
• Canadian railways must put in place additional physical defences to prevent runaways. (New recommendation.) The TSB wants Transport Canada to require trains to use wheel chocks for parked trains, or install more modern and better braking technology to hold parked trains in place.^[60]
• Emergency response assistance plans must be created when large volumes of liquid hydrocarbons, like oil, are shipped. (New recommendation.) The TSB wants Emergency Response Assistance Plans in place to handle accidents with hazardous materials including crude oil which was previously not included. This is to ensure that the appropriate emergency equipment is available along the route.^[60]
• Railway companies should conduct strategic route-planning and enhance train operations for all trains carrying dangerous goods. (Recommendation made in January, 2014.) The TSB wants railways to choose their routes carefully when shipping dangerous goods to avoid populated areas. Railways are resisting this recommendation because of cost of relocating routes away from population centres.^[60]
• Enhanced protection standards must be put in place for Class 111 tank cars. (Recommendation made in June, 2014.) The TSB wants to retire all the old DOT-111 tank cars. A problem with this recommendation is that the oil that exploded at Lac-Mégantic was so volatile that it would likely tear through any DOT-111 railcar, old or new.^[60]

Citations